From 4e952e62e23e0381c68c2b0f616f4698d5f0f646 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Wed, 14 Oct 2026 14:40:22 +0200
Subject: [PATCH 001/132] chore: reserve Pages sidebar select-all fix (#2052)


From 971f6ea2b458a4627aab8b4dcf45ba42f00ef18a Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Wed, 14 Oct 2026 15:14:35 +0200
Subject: [PATCH 002/132] Fix keyboard-owned Pages sidebar select all (#2052)

---
 ROADMAP.md                   |  5 +++-
 crates/ui-egui/src/canvas.rs | 15 ++++++++---
 crates/ui-egui/src/lib.rs    |  8 ++++--
 crates/ui-egui/src/panels.rs | 15 ++++++++---
 crates/ui-egui/tests/view.rs | 52 ++++++++++++++++++++++++++++++++++++
 docs/roadmap.md              |  5 ++--
 parity/acrobat-features.toml |  4 +--
 7 files changed, 89 insertions(+), 15 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index b4ab4ea8a6..593387f85a 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26% (ready for real work 49% → 75%) and ~400–700 h away
 
-> **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-13 · **Change:** minor (M3 candidate: native opens retain chosen tools through password retries and defer startup intake while preparation is pending; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M4/#2052 candidate: keyboard-owned Pages sidebar select-all; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M4: Extract and Split preserve shared Type 3 glyph resources; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M2: packed TIFF-predictor RGB rows retain their byte boundaries; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -149,6 +149,8 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- **2026-10-14 (M4/#2052 candidate):** Ctrl/Cmd+A selects all thumbnails while the Pages sidebar owns the keyboard, preserves the current page, and keeps viewer/text-field shortcuts and document selection separate. Escape and existing permission checks are retained. Focus regression and scoped UI validation pass; estimates unchanged.
+
 - **2026-10-13 (M3, native-opening candidate):** Chosen tools survive preparation, conversion and password retries; startup intake waits for pending preparation. Regression tests cover completion, cancellation and document identity. Estimates unchanged.
 - **2026-10-12 (M10, Windows printing without PowerShell, #1107):** craft-print now prints on Windows in-process: printers from EnumPrinters/GetDefaultPrinter, jobs drawn as vectors by Windows.Data.Pdf into the XPS print API with a driver-validated PrintTicket (exact paper, orientation, no scaling), so printing works where App Control for Business or AppLocker run PowerShell in Constrained Language Mode. Portrait and landscape sheets still print as one job (turned with /Rotate); a sheet size the driver lacks is refused rather than shrunk. Pins craft-libs f03ec27 (craft-libs#28); deny.toml allows the storytold/winprint.rs fork and adds a webpki-root-certs licence exception and a RUSTSEC-2024-0370 ignore for winprint's build-dependencies. An earlier craft-print revision was checked in Windows Sandbox under enforced WDAC: printers listed, CLI and desktop jobs spooled, and no powershell.exe in the 4688 audit. The final pinned revision passed craft-libs Windows CI, including a real paused-queue job; that Sandbox run has not been repeated. Estimates unchanged.
 - **2026-10-12 (M13, CLI robustness scans):** `pdfcraft-cli check` visits a directory once even when input roots overlap or directory symlinks lead back into the tree. PDFs reached through file symlinks remain accepted. Three real CLI regressions cover overlapping roots, a directory cycle and directory/file aliases. Estimates unchanged.
@@ -427,6 +429,7 @@ Newest first: the date, what moved, and the new overall estimate.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-14 | minor | M4/#2052 candidate: Pages sidebar select-all, focus ownership, Escape and document isolation validated; estimates unchanged. |
 | 2026-10-12 | minor | M3/#1364 candidate: absolute local GoToR links require desktop consent or headless allow_absolute; existing relative navigation and validation retained. Estimates unchanged. |
 | 2026-10-12 | minor | M8: redaction retires inherited `/Resources` so a parent `/Pages` can't keep a removed XObject reachable; only redacted pages that inherit are pinned (one shared reference), unredacted pages are untouched; estimates unchanged |
 | 2026-10-12 | minor | M7/#1200 candidate: bounded local GoToR opening, root-confined automation, and action-preserving appearance edits; named destinations and window behavior remain partial; estimates unchanged. |
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 9dc2c98dfa..1a7bc20a27 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -433,6 +433,8 @@ pub struct DocView {
     pub org_drag: Option<Vec<usize>>,
     /// Pages panel: the pages being dragged to a new place.
     pub panel_drag: Option<Vec<usize>>,
+    /// Transient keyboard owner for this document's Pages sidebar.
+    pub(crate) pages_focus_id: Option<egui::Id>,
     /// Marquee Zoom / Snapshot: the rectangle being dragged (page, start), and a finished one.
     pub marquee: Option<(usize, Pos2)>,
     pub marquee_done: Option<crate::zoom_snap::Marquee>,
@@ -672,6 +674,7 @@ impl DocView {
             sign: Default::default(),
             org_drag: None,
             panel_drag: None,
+            pages_focus_id: None,
             marquee: None,
             marquee_done: None,
             fill_text: None,
@@ -1137,10 +1140,7 @@ impl DocView {
     /// Select all: every page in Organize, or every word on the current page.
     pub fn select_all(&mut self) -> bool {
         if self.organize {
-            self.selected = (0..self.page_count).collect();
-            // Keep the current page as the anchor for the next Shift-click.
-            self.select_anchor = (self.page_count > 0).then_some(self.current);
-            return !self.selected.is_empty();
+            return self.select_all_pages();
         }
         let page = self.current;
         let Some(t) = self.texts.get(&page) else { return false };
@@ -1151,6 +1151,13 @@ impl DocView {
         true
     }
 
+    /// Select every page without navigating; shared by Organize and the Pages sidebar.
+    pub fn select_all_pages(&mut self) -> bool {
+        self.selected = (0..self.page_count).collect();
+        self.select_anchor = (self.page_count > 0).then_some(self.current);
+        !self.selected.is_empty()
+    }
+
     /// Rotate the view 90° clockwise or counter-clockwise (View ▸ Rotate View, ⇧⌘+ / ⇧⌘−).
     pub fn rotate_view(&mut self, clockwise: bool) {
         self.rotation = (self.rotation + if clockwise { 90 } else { 270 }) % 360;
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index f800ad6a00..cad36ad3e1 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -2650,12 +2650,16 @@ impl PdfCraftApp {
         if let Some(i) = self.active {
             // Select all belongs to the document or page grid, unless a text field or
             // overlay owns the keyboard. Other canvas shortcuts keep their own handling.
+            let pages_owns_keyboard =
+                self.right == Some(RightPanel::Pages) && self.views[i].pages_focus_id.is_some_and(|id| ctx.memory(|m| m.has_focus(id)));
             if self.dialog.is_none()
                 && !self.palette_open
-                && !ctx.egui_wants_keyboard_input()
+                && (pages_owns_keyboard || !ctx.egui_wants_keyboard_input())
                 && ctx.input_mut(|input| input.consume_shortcut(&egui::KeyboardShortcut::new(egui::Modifiers::COMMAND, Key::A)))
             {
-                if self.is_preparing() {
+                if pages_owns_keyboard {
+                    self.views[i].select_all_pages();
+                } else if self.is_preparing() {
                     if let Some(doc) = self.session.get(self.views[i].id) {
                         prepare::select_all(&mut self.views[i], &doc.form);
                     }
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index bdd625804d..01f5b74fac 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -1003,11 +1003,17 @@ fn outline_item(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, item: &OutlineIte
 /// offers Extract, Cut, Copy and Paste on the selection, or on the page clicked; dragging
 /// moves the selection, or the page grabbed, to the gap it is dropped on.
 fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocView, modal: bool, editable: bool, nav: &mut Option<Nav>) {
+    let focus_id = ui.make_persistent_id(("pages-keyboard", view.id));
+    view.pages_focus_id = Some(focus_id);
+    let keyboard = ui.interact(ui.clip_rect(), focus_id, Sense::focusable_noninteractive());
+    let owns_keyboard = keyboard.has_focus();
+    // Escape belongs to this panel while it owns the keyboard, even after pointer movement.
+    ui.memory_mut(|m| m.set_focus_lock_filter(focus_id, egui::EventFilter { escape: true, ..Default::default() }));
     // Escape drops the selection while the pointer is over the panel and nothing else wants the key.
     if !modal
         && !view.selected.is_empty()
-        && !ui.ctx().egui_wants_keyboard_input()
-        && ui.rect_contains_pointer(ui.clip_rect())
+        && (owns_keyboard || !ui.ctx().egui_wants_keyboard_input())
+        && (owns_keyboard || ui.rect_contains_pointer(ui.clip_rect()))
         && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape))
     {
         view.clear_page_selection(Some(view.current));
@@ -1015,8 +1021,8 @@ fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocVie
     // Delete (or Backspace) deletes the selection, or the current page, likewise.
     if !modal
         && editable
-        && !ui.ctx().egui_wants_keyboard_input()
-        && ui.rect_contains_pointer(ui.clip_rect())
+        && (owns_keyboard || !ui.ctx().egui_wants_keyboard_input())
+        && (owns_keyboard || ui.rect_contains_pointer(ui.clip_rect()))
         && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Delete) || i.consume_key(egui::Modifiers::NONE, egui::Key::Backspace))
     {
         delete_pages(view, info.pages.len());
@@ -1068,6 +1074,7 @@ fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut crate::DocVie
             ui.label(egui::RichText::new(&p.label).font(theme::medium(12.0)).color(if selected || picked { t.accent_text } else { t.text_muted }));
             let resp = theme::hand(resp);
             if resp.clicked() {
+                ui.memory_mut(|m| m.request_focus(focus_id));
                 let m = ui.input(|i| i.modifiers);
                 if m.shift || m.command {
                     view.click_page(i, m, true);
diff --git a/crates/ui-egui/tests/view.rs b/crates/ui-egui/tests/view.rs
index d3744dd2ef..8405e05c80 100644
--- a/crates/ui-egui/tests/view.rs
+++ b/crates/ui-egui/tests/view.rs
@@ -52,6 +52,58 @@ fn rect(h: &Harness<'static, PdfCraftApp>, page: usize) -> Option<egui::Rect> {
     h.state().views[0].page_screen_rect(page)
 }
 
+fn sidebar_key(h: &mut Harness<'static, PdfCraftApp>, key: Key, modifiers: Modifiers) {
+    h.event(egui::Event::ModifiersChanged(modifiers));
+    for pressed in [true, false] {
+        h.event(egui::Event::Key { key, physical_key: None, pressed, repeat: false, modifiers });
+    }
+    h.run_steps(2);
+    h.event(egui::Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(1);
+}
+
+#[test]
+fn pages_sidebar_select_all_keeps_current_page_and_keyboard_scope() {
+    use egui_kittest::kittest::Queryable;
+    let mut h = harness(&[("panel", "pages")]);
+    h.get_by_label("Page 2").click();
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 1);
+    // Moving the pointer is not a keyboard-focus change.
+    h.hover_at(rect(&h, 1).unwrap().center());
+    h.run_steps(1);
+    for _ in 0..2 {
+        sidebar_key(&mut h, Key::A, Modifiers::COMMAND);
+        assert_eq!(h.state().views[0].target_pages(), vec![0, 1, 2]);
+        assert_eq!(h.state().views[0].current, 1, "selecting does not navigate");
+    }
+    sidebar_key(&mut h, Key::Escape, Modifiers::NONE);
+    assert!(h.state().views[0].selected.is_empty());
+
+    // A click on the viewer returns Ctrl+A to text selection, even with Pages open.
+    let pos = rect(&h, 1).unwrap().center();
+    for pressed in [true, false] {
+        h.event(egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+    }
+    h.run_steps(3);
+    sidebar_key(&mut h, Key::A, Modifiers::COMMAND);
+    assert!(h.state().views[0].selected.is_empty(), "viewer shortcut must not select thumbnails");
+
+    // A different document does not inherit the previous sidebar's keyboard ownership.
+    h.get_by_label("Page 2").click();
+    h.run_steps(2);
+    h.state_mut().open_bytes("other.pdf", None, PAGES.to_vec()).unwrap();
+    h.run_steps(5);
+    sidebar_key(&mut h, Key::A, Modifiers::COMMAND);
+    let active = h.state().active.unwrap();
+    assert!(h.state().views[active].selected.is_empty());
+    h.get_by_label("Page 1").click();
+    h.run_steps(2);
+    sidebar_key(&mut h, Key::A, Modifiers::COMMAND);
+    assert_eq!(h.state().views[active].target_pages(), vec![0, 1, 2]);
+    assert!(h.state().views[0].selected.is_empty(), "selection remains document-local");
+}
+
 /// Two pages of different sizes: 300×400 then 600×300.
 const MIXED: &[u8] = b"%PDF-1.7
 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
diff --git a/docs/roadmap.md b/docs/roadmap.md
index fabb5e603d..142466a0bd 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,6 +1,6 @@
 # PdfCraft roadmap: milestones and what's next
 
-> **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-13 · **Change:** minor (M3 candidate: native opens retain chosen tools through password retries and defer startup intake while preparation is pending; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M4/#2052 candidate: keyboard-owned Pages sidebar select-all; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M4: Extract and Split preserve shared Type 3 glyph resources; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-12 · **Change:** minor (M2: packed TIFF-predictor RGB rows retain their byte boundaries; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -95,7 +95,7 @@ total matches the parity estimate.
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. A custom text match that ends on a reconstructed separator stops before the next glyph (#1315). Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); Lab Bradford adaptation uses LMS white-point ratios, covered by independent neutral/chromatic and direct/Indexed render oracles; inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). |
-| M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Organize opens directly into the page overview, with checkbox selection, an editable page-range selection (#1092), and per-page rotate/delete controls; Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Extract and Split preserve shared Type 3 glyph resource graphs, retaining conservative pruning limits. Missing: page transitions, recovery on the web |
+| M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Organize opens directly into the page overview, with checkbox selection, an editable page-range selection (#1092), and per-page rotate/delete controls; Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize; #2052 candidate adds keyboard-owned Pages sidebar select-all without navigation, with focus and document-isolation regression coverage, Replace pages, bookmarks from tagged headings. Extract and Split preserve shared Type 3 glyph resource graphs, retaining conservative pruning limits. Missing: page transitions, recovery on the web |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Renderer-creation errors return to the existing OpenGL startup fallback; a real-GPU regression covers errors and device reuse. The underlying x86 DX12 shader compiler failure remains unresolved; see `windows-renderer-startup.md`. With Windows' Animation effects turned off, the wheel scrolls and zooms without easing and egui's animations take no time (`motion.rs`; macOS, Linux and the browser aren't asked yet); Preferences ▸ Animation effects (Use system setting, On, Off) decides it on every platform. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
@@ -162,6 +162,7 @@ M2 (renderer), M7 (content editing), M10 (OCR and Office), M11 (Preflight and st
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-14 | minor | M4/#2052 candidate: Pages sidebar select-all, focus ownership, Escape and document isolation validated; estimates unchanged. |
 | 2026-10-12 | minor | M13: CLI check directory identity, with overlap and symlink regressions; estimates unchanged |
 | 2026-10-12 | minor | M4: shared Type 3 glyph resources survive extraction, with save/reopen and independent raster regressions; estimates unchanged |
 | 2026-10-12 | minor | M2: packed TIFF-predictor RGB row boundaries, with decoding and page-render regressions; estimates unchanged |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 359a71e9a6..c18ae42a21 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1250,8 +1250,8 @@ milestone = "M4"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/editing.rs::dragging_pages_panel_thumbnails_reorders_pages", "crates/ui-egui/tests/viewer.rs::pages_panel_thumbnails_have_a_context_menu", "crates/ui-egui/tests/editing.rs::deleting_pages_from_the_pages_panel_menu", "crates/ui-egui/tests/editing.rs::the_delete_key_deletes_pages_picked_in_the_pages_panel_but_never_every_page"]
-notes = "Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Extract pages, Cut, Copy, Paste after and Delete pages (also the Delete key over the panel). Not yet: Rotate, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
+evidence = ["crates/ui-egui/tests/view.rs::pages_sidebar_select_all_keeps_current_page_and_keyboard_scope", "crates/ui-egui/tests/editing.rs::dragging_pages_panel_thumbnails_reorders_pages", "crates/ui-egui/tests/viewer.rs::pages_panel_thumbnails_have_a_context_menu", "crates/ui-egui/tests/editing.rs::deleting_pages_from_the_pages_panel_menu", "crates/ui-egui/tests/editing.rs::the_delete_key_deletes_pages_picked_in_the_pages_panel_but_never_every_page"]
+notes = "Ctrl/Cmd+A selects every page when the Pages sidebar owns the keyboard, without navigation; Escape clears the selection. Viewer and text-field shortcuts retain their own scope. Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Extract pages, Cut, Copy, Paste after and Delete pages (also the Delete key over the panel). Not yet: Rotate, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
 
 [[feature]]
 id = "view.bookmarks-panel"

From 1d5c20c5c41ac268110bcf67e3638a69440592eb Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Thu, 15 Oct 2026 20:02:36 +0200
Subject: [PATCH 003/132] Support typed font sizes and Fill and Sign text
 colours (#2444, #2496)

---
 ROADMAP.md                            |  2 +
 crates/automation/README.md           |  7 +++
 crates/automation/src/comments.rs     |  9 ++-
 crates/automation/src/tools.rs        |  3 +-
 crates/automation/tests/automation.rs | 32 +++++++++++
 crates/ui-egui/src/canvas.rs          |  9 +++
 crates/ui-egui/src/content_ui.rs      | 83 +++++++++++++++++++++++++--
 crates/ui-egui/src/editing.rs         |  2 +-
 crates/ui-egui/src/fill_sign.rs       | 34 +++++++++--
 crates/ui-egui/src/lib.rs             |  9 +++
 crates/ui-egui/tests/control.rs       | 10 +++-
 crates/ui-egui/tests/editing.rs       | 35 +++++++++++
 crates/ui-egui/tests/fill_sign.rs     | 51 +++++++++++++++-
 docs/roadmap.md                       |  2 +
 parity/acrobat-features.toml          | 12 ++--
 15 files changed, 275 insertions(+), 25 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index fe9723fdf6..88625a7f41 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,5 +1,7 @@
 # PdfCraft roadmap
 
+> **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (typed small Edit font sizes and Fill & Sign text/date colour, #2444/#2496; estimates unchanged)
+
 **Stage: alpha** · next: beta, ~25% (ready for real work 50% → 75%) and ~400–700 h away
 
 > **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-14 · **Change:** minor (M14: the Italian catalog has every entry the other catalogs had and the code looks up; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
diff --git a/crates/automation/README.md b/crates/automation/README.md
index 4e27702a32..ddd844df1e 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -209,3 +209,10 @@ behavior. Back/Forward
 returns to page tops, does not restore zoom, does not switch documents, and is not saved across
 restarts. Standalone engine/MCP sessions have no viewport, so they do not have a separate
 navigation-history tool; use the opt-in UI control channel to navigate the displayed document.
+
+## Fill & Sign text appearance
+
+`fill_sign_add` accepts `font_size` (4–300 pt, default 10) and `color`
+(`#RRGGBB`, default black) for `text` and `date`. The colour is saved in the
+FreeText appearance and survives reopening. Other mark/signature types reject
+`color`; their appearance controls are separate.
diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index 302688f729..481d75f741 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -477,6 +477,10 @@ impl Automation {
         if sensitivity.is_some() && !scan {
             return Err(ToolError::InvalidArgs("sensitivity is only for scan: true".into()));
         }
+        let requested_color = a.color("color")?;
+        if requested_color.is_some() && !matches!(kind, "text" | "date") {
+            return Err(ToolError::InvalidArgs("color is only for type text or date".into()));
+        }
         let requested_size = a.opt_num("font_size")?;
         if requested_size.is_some() && !matches!(kind, "text" | "date") {
             return Err(ToolError::InvalidArgs("font_size is only for type text or date".into()));
@@ -555,7 +559,10 @@ impl Automation {
                 (Shape::Mark { rect: [at[0] - w / 2.0, at[1] - h / 2.0, at[0] + w / 2.0, at[1] + h / 2.0], mark }, String::new())
             }
         };
-        let style = Style::default_for(&shape);
+        let mut style = Style::default_for(&shape);
+        if let Some(color) = requested_color {
+            style.color = color;
+        }
         self.apply(a, Edit::AddAnnotation(NewAnnotation { page, shape, style, contents, author }))
     }
 
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 5e89aef78a..1bf59596f6 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1162,7 +1162,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "fill_sign_add",
             "Fill & Sign: type text or place a mark",
-            "Fill in a form that has no fields, as Acrobat's Fill & Sign does: type text (`text`, default 10 pt; `font_size` 4–300 pt), place a check, cross, dot or line, today's date (in Preferences ▸ Date format, see fill_sign_date_format, or `format`; `font_size` also applies), or a signature or initials (either `text` drawn in a script font, or `path` to a local PNG/JPEG image up to 4 MiB and 32 megapixels, scaled down to 4 megapixels, preserving transparency; with `scan: true`, `path` is instead a photo of a signature on paper, within the same limits: the signature is found, and the paper, shadows and table around it are removed, with `sensitivity` 0–100, default 50, picking up fainter ink when higher). `at` [x, y] is in points from the top-left of the page: text's top-left, mark's centre, signature's left edge centred vertically. Image signatures fit within 150 pt wide and 32 pt tall (24 pt for initials). Creates movable, undoable annotations. Typed text the standard fonts can't draw is saved and drawn as `?` (`warnings` in the result says so); a typed signature neither the script font nor its fallback can draw is refused (pass `path` instead).",
+            "Fill in a form that has no fields, as Acrobat's Fill & Sign does: type text (`text`, default 10 pt; `font_size` 4–300 pt; optional `color` as #RRGGBB for text/date, default black), place a check, cross, dot or line, today's date (in Preferences ▸ Date format, see fill_sign_date_format, or `format`; `font_size` also applies), or a signature or initials (either `text` drawn in a script font, or `path` to a local PNG/JPEG image up to 4 MiB and 32 megapixels, scaled down to 4 megapixels, preserving transparency; with `scan: true`, `path` is instead a photo of a signature on paper, within the same limits: the signature is found, and the paper, shadows and table around it are removed, with `sensitivity` 0–100, default 50, picking up fainter ink when higher). `at` [x, y] is in points from the top-left of the page: text's top-left, mark's centre, signature's left edge centred vertically. Image signatures fit within 150 pt wide and 32 pt tall (24 pt for initials). Creates movable, undoable annotations. Typed text the standard fonts can't draw is saved and drawn as `?` (`warnings` in the result says so); a typed signature neither the script font nor its fallback can draw is refused (pass `path` instead).",
         )
         .cmd("sign.fill.text")
         .with(schema(
@@ -1173,6 +1173,7 @@ pub fn tools() -> Vec<ToolDef> {
                 "at": point(),
                 "text": { "type": "string", "minLength": 1 },
                 "font_size": { "type": "number", "minimum": 4, "maximum": 300, "description": "For type text or date (default 10 pt)." },
+                "color": color(),
                 "path": { "type": "string", "description": "PNG or JPEG for signature/initials; pass either path or text." },
                 "scan": { "type": "boolean", "description": "With path: scan a photo of a signature on paper (default false)." },
                 "sensitivity": { "type": "integer", "minimum": 0, "maximum": 100, "description": "With scan: how faint ink may be, 0–100 (default 50)." },
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index 1e662d8f38..21b1794cf1 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -2785,6 +2785,38 @@ fn fill_sign_text_font_size_is_saved_and_validated() {
     ));
 }
 
+#[test]
+fn fill_sign_text_and_date_colours_are_saved_and_validated() {
+    let dir = workdir("fill-sign-text-colour");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    for (kind, y) in [("text", 40), ("date", 80)] {
+        ok(
+            &mut a,
+            "fill_sign_add",
+            json!({ "doc": doc, "page": 1, "type": kind, "at": [20, y], "text": "Blue", "color": "#3366CC", "font_size": 6.5 }),
+        );
+    }
+    for (kind, color) in [("text", "not-a-colour"), ("signature", "#3366CC"), ("check", "#3366CC")] {
+        assert!(matches!(
+            a.call("fill_sign_add", &json!({ "doc": doc, "page": 1, "type": kind, "at": [20, 100], "text": "No", "color": color })),
+            Err(ToolError::InvalidArgs(_))
+        ));
+    }
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "coloured.pdf" }));
+    let pdf = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join("coloured.pdf")).unwrap())).unwrap();
+    let page = pdfcraft_model::pages(&pdf).remove(0);
+    let annotations = pdf.resolve(page.dict.get(b"Annots").unwrap());
+    let annotations = annotations.as_array().unwrap();
+    assert_eq!(annotations.len(), 2, "invalid requests add nothing");
+    for reference in annotations {
+        let annotation = pdf.resolve(reference);
+        // FreeText stores its text colour in DA; C is the annotation background.
+        let da = annotation.as_dict().unwrap().get(b"DA").unwrap().as_string().unwrap();
+        assert_eq!(String::from_utf8(da.bytes.to_vec()).unwrap(), "0.2 0.4 0.8 rg /Helv 6.5 Tf");
+    }
+}
+
 #[test]
 fn image_signatures_through_tools_preserve_transparency_and_survive_save() {
     let dir = workdir("image-signatures");
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 989b731b7e..42454d7d9a 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -2850,6 +2850,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     info,
                     ft,
                     app.fill_text_size,
+                    app.fill_text_color,
                     view,
                     signature.as_ref(),
                     initials.as_ref(),
@@ -4436,6 +4437,14 @@ fn quick_bar(app: &mut PdfCraftApp, area: Rect, ui: &mut egui::Ui) {
                                 .suffix(" pt"),
                         );
                     }
+                    if matches!(current_fill, Some(crate::fill_sign::FillTool::Text | crate::fill_sign::FillTool::Date)) {
+                        ui.menu_button(tl!("Colour"), |ui| {
+                            if let Some(color) = comments::swatch_grid(ui, Some(app.fill_text_color)) {
+                                app.fill_text_color = color;
+                                ui.close();
+                            }
+                        });
+                    }
                     if let QuickTool::Comment(tool) = app.quick_tool {
                         let (r, _) = ui.allocate_exact_size(vec2(32.0, 9.0), Sense::hover());
                         ui.painter().hline(r.x_range().shrink(6.0), r.center().y, Stroke::new(1.0, t.divider));
diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 5f5ef32f77..110e608150 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -605,6 +605,43 @@ fn finish(cv: &mut ContentView, d: TextDraft, added: &[Added]) -> Option<Edit> {
     }
 }
 
+/// Commit a typed size once (Enter or leaving the field), rather than one undo step per key.
+/// The bounds match AddedText validation, so the panel also accepts coloured text below 8 pt.
+fn font_size_input(ui: &mut egui::Ui, size: &mut f64) {
+    let id = ui.make_persistent_id("font-size-input");
+    let (previous, mut text) = ui.data(|d| d.get_temp::<(u64, String)>(id)).unwrap_or_else(|| (size.to_bits(), size.to_string()));
+    if previous != size.to_bits() {
+        text = size.to_string();
+    }
+    let response = ui.add(egui::TextEdit::singleline(&mut text).id(id).desired_width(44.0));
+    response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::TextEdit, ui.is_enabled(), tl!("Font size:")));
+    let cancel = response.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Escape));
+    if cancel {
+        text = size.to_string();
+        response.surrender_focus();
+    } else if response.lost_focus() || (response.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter))) {
+        if let Some(value) = typed_font_size(&text) {
+            *size = value;
+        }
+        text = size.to_string();
+    }
+    let before = *size;
+    egui::ComboBox::from_id_salt("font-size").selected_text("pt").width(28.0).show_ui(ui, |ui| {
+        for value in [4.0, 6.0, 8.0, 9.0, 10.0, 11.0, 12.0, 14.0, 16.0, 18.0, 20.0, 24.0, 28.0, 36.0, 48.0, 72.0] {
+            ui.selectable_value(size, value, format!("{value} pt"));
+        }
+    });
+    if *size != before {
+        text = size.to_string();
+    }
+    ui.data_mut(|d| d.insert_temp(id, (size.to_bits(), text)));
+}
+
+fn typed_font_size(text: &str) -> Option<f64> {
+    let value = text.trim().parse::<f64>().ok()?;
+    (value.is_finite() && (1.0..=500.0).contains(&value)).then_some(value)
+}
+
 /// Format text (shown in the Edit panel while a text item is selected, or for new text).
 /// Returns the changed style; for a selected item the caller turns it into an update.
 pub(crate) fn format_panel(ui: &mut egui::Ui, t: &Tokens, style: &AddedText) -> Option<AddedText> {
@@ -616,12 +653,7 @@ pub(crate) fn format_panel(ui: &mut egui::Ui, t: &Tokens, style: &AddedText) ->
                 ui.selectable_value(&mut s.family, f, f.label());
             }
         });
-        // A list rather than a drag value: every change is an undo step.
-        egui::ComboBox::from_id_salt("font-size").selected_text(format!("{} pt", s.size)).width(70.0).show_ui(ui, |ui| {
-            for size in [8.0, 9.0, 10.0, 11.0, 12.0, 14.0, 16.0, 18.0, 20.0, 24.0, 28.0, 36.0, 48.0, 72.0] {
-                ui.selectable_value(&mut s.size, size, format!("{size} pt"));
-            }
-        });
+        font_size_input(ui, &mut s.size);
     });
     ui.horizontal(|ui| {
         if ui.selectable_label(s.bold, egui::RichText::new("B").strong()).on_hover_text(tl!("Bold")).clicked() {
@@ -911,6 +943,45 @@ mod tests {
 
     use super::*;
 
+    #[test]
+    fn typed_sizes_accept_small_fractional_values_and_reject_invalid_input() {
+        for value in ["1", "4", "6.5", " 13.25 ", "500"] {
+            assert_eq!(typed_font_size(value), Some(value.trim().parse().unwrap()));
+        }
+        for value in ["", "0", "-1", "0.5", "501", "NaN", "inf", "1e999", "small"] {
+            assert_eq!(typed_font_size(value), None, "{value}");
+        }
+    }
+
+    #[test]
+    fn typed_size_commits_once_and_invalid_input_preserves_the_style() {
+        let mut h = egui_kittest::Harness::new_ui_state(
+            |ui, state: &mut (f64, usize)| {
+                let before = state.0;
+                ui.horizontal(|ui| font_size_input(ui, &mut state.0));
+                if state.0 != before {
+                    state.1 += 1;
+                }
+            },
+            (12.0, 0),
+        );
+        h.run();
+        let enter = || egui::Event::Key { key: egui::Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE };
+        let select_all =
+            || egui::Event::Key { key: egui::Key::A, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND };
+        for (text, expected, changes) in [("6.5", 6.5, 1), ("NaN", 6.5, 1), ("0", 6.5, 1), ("13.25", 13.25, 2)] {
+            h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Font size:").click();
+            h.run();
+            h.event(select_all());
+            h.event(egui::Event::Text(text.into()));
+            h.run_steps(2);
+            assert_eq!(h.state().1, changes - usize::from(text == "6.5" || text == "13.25"), "typing alone does not commit");
+            h.event(enter());
+            h.run_steps(2);
+            assert_eq!(*h.state(), (expected, changes));
+        }
+    }
+
     /// The image a flip button leaves behind, as the panel returns it.
     fn flipped(tooltip: &str) -> pdfcraft_engine::AddedImage {
         let img = pdfcraft_engine::AddedImage::new([0.0, 0.0, 100.0, 50.0], pdfcraft_cos::ObjRef::new(7, 0));
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index be1347d68d..38a26b871b 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -531,7 +531,7 @@ impl PdfCraftApp {
         }
         let author = self.comment_prefs.author.clone();
         let rotation = self.session.get(id).map_or(0, |doc| crate::comments::page_rotation(&doc.info, tb.page));
-        let edit = crate::fill_sign::typed(tb.page, tb.at, &text, tb.size, rotation, &author);
+        let edit = crate::fill_sign::typed_with_color(tb.page, tb.at, &text, tb.size, rotation, &author, tb.color);
         if self.apply_edit(edit) {
             if let Some(view) = self.views.get_mut(i) {
                 view.fill_text = None;
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/fill_sign.rs
index 794fe0bf1b..084b5290f4 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/fill_sign.rs
@@ -404,6 +404,7 @@ pub struct TypeBox {
     pub at: [f64; 2],
     pub text: String,
     pub size: f64,
+    pub color: [f64; 3],
     pub focus: bool,
 }
 
@@ -416,6 +417,10 @@ pub fn valid_text_size(size: f64) -> Option<f64> {
     (size.is_finite() && (MIN_TEXT_SIZE..=MAX_TEXT_SIZE).contains(&size)).then_some(size)
 }
 
+pub fn valid_text_color(color: [f64; 3]) -> Option<[f64; 3]> {
+    color.iter().all(|v| v.is_finite() && (0.0..=1.0).contains(v)).then_some(color)
+}
+
 fn to_user(xf: &PageXform, info: &DocInfo, page: usize, p: Pos2) -> [f64; 2] {
     let (vx, vy) = xf.screen_to_view(p);
     let u = info.pages[page].view_to_user(vx, vy);
@@ -430,8 +435,16 @@ fn new(page: usize, shape: Shape, contents: String, author: &str) -> Edit {
 /// A typewriter annotation sized to its text, its displayed top-left at `at` on a page turned by
 /// `rotation` (its `/Rotate`).
 pub fn typed(page: usize, at: [f64; 2], text: &str, size: f64, rotation: i64, author: &str) -> Edit {
+    typed_with_color(page, at, text, size, rotation, author, [0.0; 3])
+}
+
+/// Typed text/date colour applies to its annotation appearance and survives saving.
+pub fn typed_with_color(page: usize, at: [f64; 2], text: &str, size: f64, rotation: i64, author: &str, color: [f64; 3]) -> Edit {
     let rect = crate::comments::text_box_rect(at, text, size, rotation);
-    new(page, Shape::Typewriter { rect, font_size: size }, text.to_string(), author)
+    let shape = Shape::Typewriter { rect, font_size: size };
+    let mut style = Style::default_for(&shape);
+    style.color = valid_text_color(color).unwrap_or([0.0; 3]);
+    Edit::AddAnnotation(NewAnnotation { page, shape, style, contents: text.to_string(), author: author.to_string() })
 }
 
 /// Place a saved signature (strokes normalised to a 0–1 box, y up) with its left edge at `at`,
@@ -620,6 +633,7 @@ pub(crate) fn page_input(
     info: &DocInfo,
     tool: FillTool,
     text_size: f64,
+    text_color: [f64; 3],
     view: &mut DocView,
     signature: Option<&SavedSig>,
     initials: Option<&SavedSig>,
@@ -657,13 +671,21 @@ pub(crate) fn page_input(
         FillTool::Text => {
             // Clicking away from an open box commits it: the page sees this click before the box
             // sees its lost focus, so replacing the box first would drop what was typed.
-            let open = view.fill_text.replace(TypeBox { page, at: top, text: String::new(), size: text_size, focus: true });
+            let open = view.fill_text.replace(TypeBox { page, at: top, text: String::new(), size: text_size, color: text_color, focus: true });
             open.filter(|tb| !tb.text.trim().is_empty()).map(|tb| {
-                FillAction::Edit(Box::new(typed(tb.page, tb.at, tb.text.trim(), tb.size, crate::comments::page_rotation(info, tb.page), author)))
+                FillAction::Edit(Box::new(typed_with_color(
+                    tb.page,
+                    tb.at,
+                    tb.text.trim(),
+                    tb.size,
+                    crate::comments::page_rotation(info, tb.page),
+                    author,
+                    tb.color,
+                )))
             })
         }
         FillTool::Date => Some(match date_text {
-            Ok(text) => FillAction::Edit(Box::new(typed(page, top, text, text_size, rotation, author))),
+            Ok(text) => FillAction::Edit(Box::new(typed_with_color(page, top, text, text_size, rotation, author, text_color))),
             Err(why) => FillAction::Refused(why.clone()),
         }),
         FillTool::Signature => match signature {
@@ -719,7 +741,7 @@ pub(crate) fn type_box(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
                 .font(egui::FontId::proportional((t.size as f32 * zoom).max(8.0)))
                 .desired_width(width)
                 .background_color(Color32::from_rgba_unmultiplied(255, 255, 255, 230))
-                .text_color(Color32::BLACK)
+                .text_color(crate::comments::color32(t.color))
                 .hint_text(tl!("Type text"))
                 .id_salt("fill-text-edit"),
         );
@@ -740,7 +762,7 @@ pub(crate) fn type_box(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
     if commit {
         let tb = view.fill_text.take()?;
         if !tb.text.trim().is_empty() {
-            return Some(typed(tb.page, tb.at, tb.text.trim(), tb.size, crate::comments::page_rotation(info, tb.page), author));
+            return Some(typed_with_color(tb.page, tb.at, tb.text.trim(), tb.size, crate::comments::page_rotation(info, tb.page), author, tb.color));
         }
     }
     None
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index d101d812e0..576784e190 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -550,6 +550,8 @@ pub struct PdfCraftApp {
     pub flatten_fill_sign_on_save: bool,
     /// Point size for new Fill & Sign text and dates, kept across launches.
     pub fill_text_size: f64,
+    /// Colour for new Fill & Sign text and dates, kept across launches.
+    pub fill_text_color: [f64; 3],
     pub dialog: Option<Dialog>,
     /// How to ask for the latest release (the desktop app sets it; see `updates`).
     pub update_source: Option<updates::UpdateSource>,
@@ -921,6 +923,7 @@ impl PdfCraftApp {
             ui_scale_applied: None,
             flatten_fill_sign_on_save: false,
             fill_text_size: fill_sign::TEXT_SIZE,
+            fill_text_color: [0.0; 3],
             dialog: None,
             update_source: None,
             updates: updates::Updates::default(),
@@ -2276,6 +2279,7 @@ impl PdfCraftApp {
             "right_panel_closed": self.right_panel_closed,
         });
         // Set apart: one more key inside the macro above passes serde_json's recursion limit.
+        v["fill_text_color"] = serde_json::json!(self.fill_text_color);
         v["redact_prefs"] = self.redact_defaults.to_json();
         // Set outside json! above, which is at serde_json's macro recursion limit.
         v["hide_empty_highlight_hover"] = serde_json::Value::Bool(self.comment_prefs.hide_empty_highlight_hover);
@@ -2357,6 +2361,11 @@ impl PdfCraftApp {
         if let Some(size) = v["fill_text_size"].as_f64().and_then(fill_sign::valid_text_size) {
             self.fill_text_size = size;
         }
+        if let Ok(color) = serde_json::from_value::<[f64; 3]>(v["fill_text_color"].clone())
+            && let Some(color) = fill_sign::valid_text_color(color)
+        {
+            self.fill_text_color = color;
+        }
         if let Some(prefs) = RedactPrefs::from_json(&v["redact_prefs"]) {
             self.redact_prefs = prefs.clone();
             self.redact_defaults = prefs;
diff --git a/crates/ui-egui/tests/control.rs b/crates/ui-egui/tests/control.rs
index 88ed1c0a90..a93e035c77 100644
--- a/crates/ui-egui/tests/control.rs
+++ b/crates/ui-egui/tests/control.rs
@@ -1425,8 +1425,14 @@ fn rail_reveals_its_remembered_inactive_inspector_then_closes_the_visible_panel(
 #[test]
 fn control_quit_retains_inactive_fill_sign_typing_after_cancel() {
     let (mut h, c) = harness();
-    h.state_mut().views[0].fill_text =
-        Some(pdfcraft_ui_egui::fill_sign::TypeBox { page: 0, at: [40.0, 200.0], text: "Unsaved signature note".into(), size: 10.0, focus: false });
+    h.state_mut().views[0].fill_text = Some(pdfcraft_ui_egui::fill_sign::TypeBox {
+        page: 0,
+        at: [40.0, 200.0],
+        text: "Unsaved signature note".into(),
+        size: 10.0,
+        color: [0.0; 3],
+        focus: false,
+    });
     h.state_mut().active = None;
     assert!(!h.state().session.get(h.state().views[0].id).unwrap().dirty);
     assert_eq!(ok(&mut h, &c, "ui.quit", json!({})), json!({"quitting":false,"needs_confirmation":true}));
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index f8db525751..4a31784246 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -2876,6 +2876,41 @@ fn the_format_panel_restyles_the_paragraph_being_edited() {
     assert!(s.views[0].line_editor.as_ref().is_some_and(|e| e.extras.underline));
 }
 
+#[test]
+fn typed_small_coloured_text_size_survives_save_and_reopen() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).unwrap();
+    let at = egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height());
+    h.hover_at(at);
+    h.run_steps(1);
+    h.drag_at(at);
+    h.run_steps(1);
+    h.drop_at(at);
+    h.run_steps(3);
+    assert!(h.state().views[0].line_editor.is_some());
+    h.get_by_label("Font size:").click();
+    h.run_steps(1);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+    h.event(egui::Event::Text("6.5".into()));
+    h.key_press(Key::Enter);
+    h.run_steps(4);
+    h.get_by_label("Blue").click();
+    h.run_steps(4);
+    let id = h.state().views[0].id;
+    let lines = h.state().session.get(id).unwrap().text_lines(0);
+    assert!(!lines.is_empty());
+    for line in &lines {
+        assert!((line.size - 6.5).abs() < 0.01, "{line:?}");
+        assert!(line.color[2] > line.color[0], "the small text stays blue: {line:?}");
+    }
+    let saved = h.state().session.save_bytes(id).unwrap();
+    let mut reopened = pdfcraft_engine::Session::new();
+    let rid = reopened.open("small-blue.pdf", None, saved, None).unwrap();
+    assert_eq!(reopened.get(rid).unwrap().text_lines(0), lines);
+}
+
 #[test]
 fn selected_text_formatting_keeps_the_rest_of_the_paragraph_and_reopens() {
     let mut h = harness(1, |_| {});
diff --git a/crates/ui-egui/tests/fill_sign.rs b/crates/ui-egui/tests/fill_sign.rs
index 27fd6dd8a5..b888e1e23e 100644
--- a/crates/ui-egui/tests/fill_sign.rs
+++ b/crates/ui-egui/tests/fill_sign.rs
@@ -168,6 +168,53 @@ fn fill_text_size_controls_new_text_and_survives_settings_restore() {
     assert_eq!(restored.fill_text_size, 24.0, "invalid settings do not change the size");
 }
 
+#[test]
+fn fill_text_colour_survives_preview_commit_settings_and_save() {
+    let mut h = harness();
+    h.state_mut().execute("sign.fill.text");
+    h.run_steps(2);
+    h.get_by_label("Colour").click();
+    h.run_steps(2);
+    h.get_by_label("Blue").click();
+    h.run_steps(2);
+    let color = h.state().fill_text_color;
+    assert!(color[2] > color[0], "blue was selected: {color:?}");
+    click(&mut h, 50.0, 250.0);
+    assert_eq!(h.state().views[0].fill_text.as_ref().unwrap().color, color, "the editor uses the selected colour");
+    h.event(egui::Event::Text("Blue form text".into()));
+    h.run_steps(2);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    let id = h.state().views[0].id;
+    let expected = color.map(|v| v as f32);
+    let annotation = h.state().session.get(id).unwrap().info.annotations.iter().find(|a| a.contents.as_deref() == Some("Blue form text")).unwrap();
+    assert_eq!(annotation.color, Some(expected));
+    let bytes = h.state().session.save_bytes(id).unwrap();
+    let reopened = harness_bytes(&bytes);
+    let saved = reopened
+        .state()
+        .session
+        .get(reopened.state().views[0].id)
+        .unwrap()
+        .info
+        .annotations
+        .iter()
+        .find(|a| a.contents.as_deref() == Some("Blue form text"))
+        .unwrap();
+    assert_eq!(saved.color, Some(expected));
+    let mut restored = PdfCraftApp::new();
+    restored.restore(&h.state().persist());
+    assert_eq!(restored.fill_text_color, color);
+    restored.restore(r#"{"fill_text_color":[2,0,0]}"#);
+    assert_eq!(restored.fill_text_color, color, "invalid saved colours are ignored");
+    h.state_mut().execute("edit.undo");
+    h.run_steps(2);
+    assert!(!items(&h).iter().any(|(_, text)| text.as_deref() == Some("Blue form text")));
+    h.state_mut().execute("edit.redo");
+    h.run_steps(2);
+    assert!(items(&h).iter().any(|(_, text)| text.as_deref() == Some("Blue form text")));
+}
+
 #[test]
 fn the_type_box_grows_as_text_is_typed() {
     let mut h = harness();
@@ -995,7 +1042,7 @@ fn saving_flattens_fill_and_sign_only_when_the_preference_is_on() {
     app.open_bytes("form.pdf", None, FIXTURE.to_vec()).unwrap();
     let id = app.views[0].id;
     app.session.apply(id, mark).unwrap();
-    app.views[0].fill_text = Some(TypeBox { page: 0, at: [40.0, 200.0], text: "Typed".into(), size: 10.0, focus: false });
+    app.views[0].fill_text = Some(TypeBox { page: 0, at: [40.0, 200.0], text: "Typed".into(), size: 10.0, color: [0.0; 3], focus: false });
     let kept = dir.join("kept.pdf");
     app.save_override = Some(kept.to_string_lossy().into_owned());
     assert!(app.save_active(SaveTarget::InPlace));
@@ -1006,7 +1053,7 @@ fn saving_flattens_fill_and_sign_only_when_the_preference_is_on() {
     assert!(texts.iter().any(|t| t == "Typed"), "an open type box is saved: {texts:?}");
     assert_eq!(reopened.session.get(reopened.views[0].id).unwrap().info.annotations.len(), 2, "the check mark stays too");
 
-    app.views[0].fill_text = Some(TypeBox { page: 0, at: [40.0, 160.0], text: "More".into(), size: 10.0, focus: false });
+    app.views[0].fill_text = Some(TypeBox { page: 0, at: [40.0, 160.0], text: "More".into(), size: 10.0, color: [0.0; 3], focus: false });
     app.flatten_fill_sign_on_save = true;
     let flat = dir.join("flat.pdf");
     app.save_override = Some(flat.to_string_lossy().into_owned());
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 3148823ea5..ffb34ffd7a 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,5 +1,7 @@
 # PdfCraft roadmap: milestones and what's next
 
+> **Last reviewed:** 2026-10-15 · **Last updated:** 2026-10-15 · **Change:** minor (typed small Edit font sizes and Fill & Sign text/date colour, #2444/#2496; estimates unchanged)
+
 > **Last reviewed:** 2026-10-13 · **Last updated:** 2026-10-14 · **Change:** minor (M14: the Italian catalog has every entry the other catalogs had and the code looks up, 2,528 entries; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-13 · **Change:** minor (M2/M6: spot-colour images convert once per pixel value; widget placement and the Fields panel scale with the field count; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-14 · **Change:** minor (M3 candidate: coordinate control clicks on slow frames and coalesced text selection; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 533013b547..7c35e73b5a 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1926,8 +1926,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text", "edit.text"]
 tools = ["text_edit", "content_update"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_take_new_formatting", "crates/ui-egui/tests/editing.rs::the_format_panel_restyles_the_paragraph_being_edited", "crates/automation/tests/automation.rs::editing_existing_text_through_tools"]
-notes = "existing paragraphs and added text: font family (Helvetica, Times, Courier) with bold and italic, size, colour; existing paragraphs are rewrapped"
+evidence = ["crates/edit/src/tests.rs::paragraphs_take_new_formatting", "crates/ui-egui/tests/editing.rs::the_format_panel_restyles_the_paragraph_being_edited", "crates/automation/tests/automation.rs::editing_existing_text_through_tools", "crates/ui-egui/src/content_ui.rs::typed_sizes_accept_small_fractional_values_and_reject_invalid_input", "crates/ui-egui/src/content_ui.rs::typed_size_commits_once_and_invalid_input_preserves_the_style", "crates/ui-egui/tests/editing.rs::typed_small_coloured_text_size_survives_save_and_reopen"]
+notes = "existing paragraphs and added text: font family (Helvetica, Times, Courier) with bold and italic, size, colour; existing paragraphs are rewrapped; the Edit font-size field accepts typed fractional values from 1–500 pt, including below 8 pt; Enter/focus loss commits once and invalid input preserves the previous value"
 
 [[feature]]
 id = "edit.text-format-style"
@@ -5268,8 +5268,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["sign.fill.text"]
 tools = ["fill_sign_add"]
-evidence = ["crates/ui-egui/tests/fill_sign.rs::text_marks_and_date", "crates/annot/src/tests.rs::fill_and_sign_items_are_drawn", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/engine/src/tests.rs::typed_text_reads_across_as_displayed_on_rotated_pages"]
-notes = "typewriter FreeText, 10 pt Helvetica. Reads across as displayed on pages with /Rotate (sideways-stored scans): the box follows the displayed axes and the appearance is turned back (PdfCraft key /PCTextRotate); other apps that regenerate the appearance from /DA draw it unturned. A later page rotation does not re-turn it. Field detection does not work on scanned (image-only) forms yet"
+evidence = ["crates/ui-egui/tests/fill_sign.rs::text_marks_and_date", "crates/annot/src/tests.rs::fill_and_sign_items_are_drawn", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/engine/src/tests.rs::typed_text_reads_across_as_displayed_on_rotated_pages", "crates/ui-egui/tests/fill_sign.rs::fill_text_colour_survives_preview_commit_settings_and_save", "crates/automation/tests/automation.rs::fill_sign_text_and_date_colours_are_saved_and_validated"]
+notes = "typewriter FreeText, 10 pt Helvetica. Reads across as displayed on pages with /Rotate (sideways-stored scans): the box follows the displayed axes and the appearance is turned back (PdfCraft key /PCTextRotate); other apps that regenerate the appearance from /DA draw it unturned. A later page rotation does not re-turn it. Field detection does not work on scanned (image-only) forms yet; text/date colour is selectable, remembered and preserved in saved appearances; fill_sign_add exposes color and font_size"
 
 [[feature]]
 id = "form.fill-sign-marks"
@@ -5292,8 +5292,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["sign.fill.date"]
 tools = ["fill_sign_add", "fill_sign_date_format"]
-evidence = ["crates/ui-egui/tests/fill_sign.rs::text_marks_and_date", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/date_format.rs::fill_and_sign_dates_follow_the_date_format_preference_and_it_is_remembered", "crates/engine/src/dates.rs::presets_write_the_day_in_their_own_order", "crates/engine/src/dates.rs::names_follow_the_date_language", "crates/ui-egui/tests/date_format.rs::month_names_follow_the_date_language_or_else_the_interface_language", "crates/ui-egui/tests/date_format.rs::a_date_the_pdf_cannot_hold_is_refused_with_a_warning_first"]
-notes = "local date in Preferences ▸ Date format (default m/d/yyyy; 12 presets or any pattern in Acrobat date letters with \\ escapes, checked and previewed as typed, remembered; only whole date codes accepted; month and weekday names in the interface languages, Czech months in the genitive after a day, following the interface language unless one is picked; fill_sign_add takes a one-off format and language). Beyond Acrobat: its Fill & Sign has no format setting (only Acrobat Sign accounts do). Missing: Fill & Sign text is Helvetica/WinAnsi, so a date with letters outside Western European (Czech ř, Japanese, Chinese names) is refused with a warning instead of being saved as ?; the OS locale's format isn't offered as a preset; names in languages without an interface translation"
+evidence = ["crates/ui-egui/tests/fill_sign.rs::text_marks_and_date", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/date_format.rs::fill_and_sign_dates_follow_the_date_format_preference_and_it_is_remembered", "crates/engine/src/dates.rs::presets_write_the_day_in_their_own_order", "crates/engine/src/dates.rs::names_follow_the_date_language", "crates/ui-egui/tests/date_format.rs::month_names_follow_the_date_language_or_else_the_interface_language", "crates/ui-egui/tests/date_format.rs::a_date_the_pdf_cannot_hold_is_refused_with_a_warning_first", "crates/automation/tests/automation.rs::fill_sign_text_and_date_colours_are_saved_and_validated"]
+notes = "local date in Preferences ▸ Date format (default m/d/yyyy; 12 presets or any pattern in Acrobat date letters with \\ escapes, checked and previewed as typed, remembered; only whole date codes accepted; month and weekday names in the interface languages, Czech months in the genitive after a day, following the interface language unless one is picked; fill_sign_add takes a one-off format and language). Beyond Acrobat: its Fill & Sign has no format setting (only Acrobat Sign accounts do). Missing: Fill & Sign text is Helvetica/WinAnsi, so a date with letters outside Western European (Czech ř, Japanese, Chinese names) is refused with a warning instead of being saved as ?; the OS locale's format isn't offered as a preset; names in languages without an interface translation; shares the Fill & Sign text colour preference and tool argument"
 
 [[feature]]
 id = "form.fill-sign-signature"

From a9b0db12c62f81beb8d2b57851d650d10bdb37e8 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Fri, 16 Oct 2026 10:46:02 +0200
Subject: [PATCH 004/132] fix(edit): show backgrounds on pages that paint their
 own white backdrop

Add Background draws behind the page content, so on a page that first
fills itself with opaque white (browsers' Save as PDF, print drivers) the
background was hidden completely and the tool looked broken.

- pdfcraft-edit: new `backdrop` module. A strictly detected backdrop (one
  axis-aligned `re`, opaque white in a device colour space, painted before
  anything else and covering the crop box) is replaced by turning that one
  fill into `n` in a per-page copy of its stream; the original stream is
  left untouched for other pages. Remove background restores it, unless
  the copy was edited since. Page-sized pictures (scans) are reported only.
- Background gains `replace_backdrop` (default on); the default colour is
  a visible light yellow instead of near-white.
- Dialog: offers to replace the backdrop, warns about scanned pages,
  checks pages a few per frame, preview draws text over the colour.
- Automation: `doc_background` takes `replace_backdrop`; new read-only
  `doc_backdrops` lists pages with a backdrop.

Acrobat's behaviour on such pages is unobserved; recorded as our choice
in parity/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ROADMAP.md                             |   1 +
 crates/automation/src/lib.rs           |  23 ++
 crates/automation/src/tools.rs         |   8 +-
 crates/automation/tests/backdrop.rs    | 109 +++++++++
 crates/edit/src/backdrop.rs            | 323 +++++++++++++++++++++++++
 crates/edit/src/backdrop_tests.rs      | 233 ++++++++++++++++++
 crates/edit/src/lib.rs                 |  22 +-
 crates/engine/src/lib.rs               |   7 +-
 crates/ui-egui/src/marks_ui.rs         | 101 +++++++-
 crates/ui-egui/tests/ui_group/marks.rs |  67 +++++
 parity/acrobat-features.toml           |  10 +-
 11 files changed, 892 insertions(+), 12 deletions(-)
 create mode 100644 crates/automation/tests/backdrop.rs
 create mode 100644 crates/edit/src/backdrop.rs
 create mode 100644 crates/edit/src/backdrop_tests.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index 259dbfec04..b90b9f5679 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -157,6 +157,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 | 8 | 1.0 polish: performance, right-to-left, missing languages, keyboard-only (M14) | 55–95 |
 
 ## Progress log
+- **2026-10-16 (M7, Add Background):** A background added behind a page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) was hidden completely, so the tool looked broken. The dialog now detects such pages and offers to replace the backdrop (on by default): the one fill becomes `n` in a per-page copy of its stream, and Remove background puts the original back unless the copy was edited since. Scanned pages are warned about, not touched. New `doc_backdrops` tool; `doc_background` takes `replace_backdrop`. The default colour is a visible light yellow and the preview shows text over it. Acrobat's own behaviour on such pages is unobserved. Estimates unchanged.
 - **2026-10-15 (M2, gap 12):** `cargo xtask text-oracle` scores reading order as well as word F1: the longest common subsequence of the two word sequences over the longer one. F1 is a bag of words and cannot see order at all -- measuring #2431, a change that moves text and nothing else, it called 26 of the 29 files whose output changed identical, where the order score separated 18 improvements from 6 regressions. Reports, does not gate; a disagreement with Poppler, not a verdict. Estimates unchanged.
 - **2026-10-15 (M2, #2305 follow-up):** WinAnsiEncoding 0xA0 and 0xAD and MacRomanEncoding 0xCA extract as the ordinary space and hyphen Annex D.2 names them, in the vendored hayro tables (patch 30) as well as `crates/fonts`, so search, copy and redaction see characters that were hidden behind U+00A0 and U+00AD. Across the pdf.js corpus the soft hyphens we extract fall 117 to 13 and the non-breaking spaces 30 to 26; the rest come from `/ToUnicode`. An explicit `/Differences` name keeps its glyph list value, as pdftotext does. Estimates unchanged.
 - **2026-10-13 (community, M3, #1569 review):** Pixel-only Wayland wheel, wheel-tilt and continuous input use standalone moved events, so Ctrl zoom does not remain latched after the modifier is released (#991); vendored winit patch (13), with a policy test. Estimates unchanged.
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 88856305b2..564dd8e882 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -704,6 +704,7 @@ impl Automation {
             }
             "doc_export_images" | "doc_export_text" | "doc_export_all_images" => self.export(name, &a)?,
             "doc_header_footer" | "doc_watermark" | "doc_background" | "doc_remove_marks" => self.marks(name, &a)?,
+            "doc_backdrops" => self.backdrops(&a)?,
             "doc_unprotect" => {
                 let mut out = self.apply(&a, Edit::RemoveProtection)?;
                 out["security"] = security(self.doc(&a)?);
@@ -1172,6 +1173,27 @@ impl Automation {
         Ok(out)
     }
 
+    /// Pages whose own backdrop hides a background (see `pdfcraft_edit::backdrop`).
+    fn backdrops(&mut self, a: &Args) -> Result<Value> {
+        let n = self.doc(a)?.info.pages.len();
+        let pages = match a.opt_ints("pages")? {
+            Some(_) => self.pages(a, "pages")?,
+            None => (0..n).collect(),
+        };
+        let doc = self.doc(a)?;
+        let found: Vec<Value> = pages
+            .into_iter()
+            .filter_map(|p| {
+                let kind = match doc.page_backdrop(p)? {
+                    pdfcraft_engine::Backdrop::Fill => "fill",
+                    pdfcraft_engine::Backdrop::Image => "image",
+                };
+                Some(json!({ "page": p + 1, "backdrop": kind }))
+            })
+            .collect();
+        Ok(json!({ "pages": found }))
+    }
+
     fn marks(&mut self, tool: &str, a: &Args) -> Result<Value> {
         use pdfcraft_engine::{Background, HeaderFooter, MarkKind, Watermark};
         let n = self.doc(a)?.info.pages.len();
@@ -1230,6 +1252,7 @@ impl Automation {
                     color: color("color", [1.0; 3])?,
                     opacity: a.opt_num("opacity")?.unwrap_or(1.0),
                     scale: a.opt_num("scale")?.unwrap_or(1.0).clamp(0.01, 1.0),
+                    replace_backdrop: a.opt_bool("replace_backdrop")?.unwrap_or(true),
                     ..Background::default()
                 },
                 replace,
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 5e89aef78a..e520b7bb63 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -902,12 +902,16 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["doc"],
             )),
-        t("doc_background", "Add background", "Fill page backgrounds with a colour, or a picture from `file` (an image, or page `file_page` of a PDF) fitted at `scale` (default 1), behind the content. Undoable.")
+        t("doc_background", "Add background", "Fill page backgrounds with a colour, or a picture from `file` (an image, or page `file_page` of a PDF) fitted at `scale` (default 1), behind the content. A page that paints its own opaque white backdrop would hide it, so that backdrop is replaced unless replace_backdrop is false (removing the background puts it back); a scanned page's picture still hides it (doc_backdrops lists both). Undoable.")
             .cmd("edit.background")
             .with(schema(
-                json!({ "doc": doc(), "pages": pages("to fill (default: all)"), "color": { "type": "string" }, "file": { "type": "string" }, "file_page": { "type": "integer", "minimum": 1 }, "scale": { "type": "number", "exclusiveMinimum": 0, "maximum": 1 }, "opacity": { "type": "number", "minimum": 0, "maximum": 1 }, "replace": { "type": "boolean" } }),
+                json!({ "doc": doc(), "pages": pages("to fill (default: all)"), "color": { "type": "string" }, "file": { "type": "string" }, "file_page": { "type": "integer", "minimum": 1 }, "scale": { "type": "number", "exclusiveMinimum": 0, "maximum": 1 }, "opacity": { "type": "number", "minimum": 0, "maximum": 1 }, "replace": { "type": "boolean" }, "replace_backdrop": { "type": "boolean", "description": "Replace a white backdrop the page paints itself, which would hide the background. Default true." } }),
                 &["doc"],
             )),
+        t("doc_backdrops", "List page backdrops", "Pages that paint their own backdrop, which hides a background added behind the content: `fill` (an opaque white fill doc_background can replace) or `image` (a page-sized picture, e.g. a scan, that still hides it). Pages are 1-based; pages without one are left out.")
+            .ro()
+            .cmd("edit.background")
+            .with(schema(json!({ "doc": doc(), "pages": pages("to check (default: all)") }), &["doc"])),
         t("doc_remove_marks", "Remove header & footer, watermark or background", "Remove every header and footer, watermark or background PdfCraft (or a compatible tool) added. Undoable.")
             .destructive()
             .with(schema(json!({ "doc": doc(), "kind": { "type": "string", "enum": ["header_footer", "watermark", "background"] } }), &["doc", "kind"])),
diff --git a/crates/automation/tests/backdrop.rs b/crates/automation/tests/backdrop.rs
new file mode 100644
index 0000000000..1a8a71eb8e
--- /dev/null
+++ b/crates/automation/tests/backdrop.rs
@@ -0,0 +1,109 @@
+//! Add Background on pages that paint their own backdrop, end to end through the tools: what
+//! `page_render` draws, `doc_backdrops`, save and reopen, and Remove putting the page back.
+
+use std::path::PathBuf;
+
+use pdfcraft_automation::{Automation, Content};
+use serde_json::{Value, json};
+
+/// Two 200 × 100 pt pages saying "Hi": page 1 on a white fill of its own (as browsers write),
+/// page 2 on bare paper; a third page is a "scan" (a page-sized grey picture).
+fn fixture() -> Vec<u8> {
+    let text = "0 g BT /F1 24 Tf 20 40 Td (Hi) Tj ET";
+    let contents = [format!("q 1 1 1 rg 0 0 200 100 re f Q {text}"), text.to_string(), format!("q 200 0 0 100 0 0 cm /Im0 Do Q {text}")];
+    let mut objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [4 0 R 6 0 R 8 0 R] /Count 3 /MediaBox [0 0 200 100] >>".into(),
+        "<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 1 >>\nstream\n\u{80}\nendstream"
+            .into(),
+    ];
+    for (i, c) in contents.iter().enumerate() {
+        objs.push(format!(
+            "<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> /XObject << /Im0 3 0 R >> >> >>",
+            5 + 2 * i
+        ));
+        objs.push(format!("<< /Length {} >>\nstream\n{c}\nendstream", c.len()));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+fn workdir() -> PathBuf {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-automation-backdrop-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("a.pdf"), fixture()).unwrap();
+    dir
+}
+
+fn ok(a: &mut Automation, tool: &str, args: Value) -> Value {
+    match a.call(tool, &args) {
+        Ok(mut c) => match c.remove(0) {
+            Content::Json(v) => v,
+            other => panic!("{tool}: expected JSON, got {other:?}"),
+        },
+        Err(e) => panic!("{tool} {args}: {e}"),
+    }
+}
+
+/// The RGB of a blank spot (top-right corner area) of a page rendered at 72 dpi.
+fn blank_spot(a: &mut Automation, doc: u64, page: u64) -> [u8; 3] {
+    let rendered = a.call("page_render", &json!({ "doc": doc, "page": page, "dpi": 72 })).unwrap();
+    let Content::Png { data, width, .. } = &rendered[0] else { panic!("expected a PNG") };
+    let mut reader = png::Decoder::new(std::io::Cursor::new(data)).read_info().unwrap();
+    let mut pixels = vec![0; reader.output_buffer_size().unwrap()];
+    let info = reader.next_frame(&mut pixels).unwrap();
+    let channels = info.color_type.samples();
+    let at = (10 * *width as usize + 180) * channels;
+    [pixels[at], pixels[at + 1], pixels[at + 2]]
+}
+
+const RED: [u8; 3] = [255, 0, 0];
+const WHITE: [u8; 3] = [255, 255, 255];
+
+#[test]
+fn a_background_shows_on_a_page_that_paints_its_own_white_backdrop() {
+    let dir = workdir();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(
+        ok(&mut a, "doc_backdrops", json!({ "doc": doc }))["pages"],
+        json!([{ "page": 1, "backdrop": "fill" }, { "page": 3, "backdrop": "image" }])
+    );
+
+    // Not replacing: the page's own white hides the background, as it always did.
+    ok(&mut a, "doc_background", json!({ "doc": doc, "color": "#FF0000", "replace_backdrop": false }));
+    assert_eq!(blank_spot(&mut a, doc, 1), WHITE);
+    assert_eq!(blank_spot(&mut a, doc, 2), RED);
+    ok(&mut a, "edit_undo", json!({ "doc": doc }));
+
+    // The default replaces it: red on both pages; the scan still hides it.
+    ok(&mut a, "doc_background", json!({ "doc": doc, "color": "#FF0000" }));
+    assert_eq!(blank_spot(&mut a, doc, 1), RED);
+    assert_eq!(blank_spot(&mut a, doc, 2), RED);
+    assert_ne!(blank_spot(&mut a, doc, 3), RED);
+    assert_eq!(ok(&mut a, "doc_backdrops", json!({ "doc": doc }))["pages"], json!([{ "page": 3, "backdrop": "image" }]));
+
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "out.pdf" }));
+    let saved = ok(&mut a, "doc_open", json!({ "path": "out.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(blank_spot(&mut a, saved, 1), RED, "after save and reopen");
+    ok(&mut a, "doc_remove_marks", json!({ "doc": saved, "kind": "background" }));
+    assert_eq!(blank_spot(&mut a, saved, 1), WHITE);
+    assert_eq!(
+        ok(&mut a, "doc_backdrops", json!({ "doc": saved, "pages": [1] }))["pages"],
+        json!([{ "page": 1, "backdrop": "fill" }]),
+        "the backdrop is back"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
new file mode 100644
index 0000000000..d15652f82b
--- /dev/null
+++ b/crates/edit/src/backdrop.rs
@@ -0,0 +1,323 @@
+//! A page's own backdrop: an opaque white fill (or a picture) covering the whole visible page
+//! before anything else is drawn. Many writers paint one (browsers' Save as PDF, print drivers;
+//! scans are a page-sized picture), and it hides anything placed behind the content, so a
+//! background added behind such a page never shows.
+//!
+//! A white fill can be replaced: the one fill operator becomes `n` (end the path without
+//! painting), which looks the same on white paper. The page then gets a copy of the content
+//! stream that held it, tagged `/PCBackdrop << /Original ref /At n /Len n >>`, and the stream
+//! itself is left alone (other pages may share it). [`restore`] puts the original back when the
+//! background is removed, unless the copy has been edited since. A picture can't be replaced
+//! without losing it, so it is only reported.
+//!
+//! Detection is deliberately strict: only one rectangle (`re`), in DeviceGray, DeviceRGB or
+//! DeviceCMYK, opaque in the graphics state, with an axis-aligned transform, filled before any
+//! other painting, and covering the crop box. Anything else is real content and stays.
+
+use pdfcraft_content::{Matrix, Op, Pieces};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
+
+use crate::EditError;
+
+/// How much of a page's content is read looking for a backdrop: it has to come first.
+const SCAN_BYTES: usize = 64 * 1024;
+/// How many operators are walked before giving up.
+const SCAN_OPS: usize = 4096;
+/// How far (in points) a backdrop may fall short of the crop box and still count as covering it.
+const COVER_EPS: f64 = 1.0;
+/// Components at least this close to white (per channel) count as white.
+const WHITE: f64 = 0.98;
+
+/// What paints a page's backdrop.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Backdrop {
+    /// An opaque white fill: replaceable.
+    Fill,
+    /// A picture covering the page (a scan): a background behind it stays hidden.
+    Image,
+}
+
+/// Where a replaceable fill is: the content streams (references in `/Contents` order, untagged
+/// ones only), their joined bytes, and the fill operator's joined byte range.
+struct Found {
+    refs: Vec<(usize, ObjRef)>,
+    pieces: Pieces,
+    op: std::ops::Range<usize>,
+}
+
+#[derive(Clone)]
+struct State {
+    ctm: Matrix,
+    /// Clip in default user space, when it is a known rectangle; `None` = unknown shape.
+    clip: Option<[f64; 4]>,
+    /// The fill colour is white.
+    white: bool,
+    /// Non-stroking colour space components (1, 3, 4), or 0 for a space we don't read.
+    space: usize,
+    opaque: bool,
+}
+
+/// The backdrop `page` (0-based) paints, if any.
+pub fn page_backdrop(doc: &Document, page: usize) -> Result<Option<Backdrop>, EditError> {
+    Ok(scan(doc, page)?.map(|(b, _)| b))
+}
+
+/// Replace `page`'s white backdrop fill, if it has one (see the module doc). Returns whether it
+/// did. A picture backdrop is left alone.
+pub(crate) fn replace(doc: &mut Document, page: usize) -> Result<bool, EditError> {
+    let Some((Backdrop::Fill, Some(found))) = scan(doc, page)? else { return Ok(false) };
+    let edited = found.pieces.splice([(found.op.clone(), b"n".to_vec())]);
+    let piece = found.pieces.piece_of(found.op.start);
+    let (Some(&(slot, original)), Some(bytes)) = (found.refs.get(piece), edited.get(piece)) else { return Ok(false) };
+    // Where the operator sits in that piece: the joined offset less the pieces before it.
+    let before: usize = (0..piece).filter_map(|i| edited.get(i)).map(|p| p.len() + 1).sum();
+    let at = found.op.start.saturating_sub(before);
+    let len = found.op.end.saturating_sub(found.op.start);
+    let mut note = Dict::new();
+    note.set(b"Original".to_vec(), Object::Ref(original));
+    note.set(b"At".to_vec(), Object::Int(i64::try_from(at).unwrap_or(i64::MAX)));
+    note.set(b"Len".to_vec(), Object::Int(i64::try_from(len).unwrap_or(i64::MAX)));
+    let mut dict = Dict::new();
+    dict.set(b"PCBackdrop".to_vec(), Object::Dict(note));
+    let copy = doc.add(Object::Stream(Stream::flate(dict, bytes)));
+    let p = page_of(doc, page)?;
+    let mut list = crate::contents(doc, &p)?;
+    let Some(entry) = list.get_mut(slot) else { return Ok(false) };
+    *entry = Object::Ref(copy);
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+    Ok(true)
+}
+
+/// Put back the original content streams [`replace`] copied on `page`, where the copy is still
+/// exactly what it wrote. Returns how many it restored.
+pub(crate) fn restore(doc: &mut Document, page: &pdfcraft_model::Page) -> Result<usize, EditError> {
+    let mut list = crate::contents(doc, page)?;
+    let mut restored = 0;
+    for entry in list.iter_mut() {
+        if let Some(original) = unchanged_copy_of(doc, entry) {
+            *entry = Object::Ref(original);
+            restored += 1;
+        }
+    }
+    if restored > 0 {
+        doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+    }
+    Ok(restored)
+}
+
+/// The original of a backdrop copy whose bytes are still the original's with the fill turned to
+/// `n`; `None` for anything else (including a copy edited since, which is kept).
+fn unchanged_copy_of(doc: &Document, entry: &Object) -> Option<ObjRef> {
+    let copy = doc.resolve(entry);
+    let Object::Stream(copy) = &*copy else { return None };
+    let note = copy.dict.get(b"PCBackdrop").map(|n| doc.resolve(n))?;
+    let note = note.as_dict()?;
+    let Some(Object::Ref(original)) = note.get(b"Original") else { return None };
+    let at = usize::try_from(note.get(b"At")?.as_int()?).ok()?;
+    let len = usize::try_from(note.get(b"Len")?.as_int()?).ok()?;
+    let orig = doc.get(*original);
+    let Object::Stream(orig) = &*orig else { return None };
+    let source = orig.decoded().ok()?;
+    let mut expect = source.get(..at)?.to_vec();
+    expect.push(b'n');
+    expect.extend_from_slice(source.get(at.checked_add(len)?..)?);
+    (copy.decoded().ok()? == expect).then_some(*original)
+}
+
+fn page_of(doc: &Document, page: usize) -> Result<pdfcraft_model::Page, EditError> {
+    pdfcraft_model::pages(doc).into_iter().nth(page).ok_or(EditError::NoSuchPage(page))
+}
+
+/// Find the backdrop, and for a fill, where it is.
+fn scan(doc: &Document, page: usize) -> Result<Option<(Backdrop, Option<Found>)>, EditError> {
+    let p = page_of(doc, page)?;
+    let crop = p.crop(doc);
+    let list: Vec<Object> = match p.dict.get(b"Contents") {
+        None => return Ok(None),
+        Some(c) => match &*doc.resolve(c) {
+            Object::Array(a) => a.clone(),
+            _ => vec![c.clone()],
+        },
+    };
+    // The page's own content: untagged streams (marks and the q/Q wrapper carry /PCMark). Read
+    // only as far as a backdrop could be.
+    let mut refs = Vec::new();
+    let mut data = Vec::new();
+    let mut total = 0usize;
+    for (slot, o) in list.iter().enumerate() {
+        if total >= SCAN_BYTES {
+            break;
+        }
+        let Object::Ref(r) = o else { return Ok(None) };
+        let obj = doc.get(*r);
+        let Object::Stream(s) = &*obj else { continue };
+        if s.dict.get(b"PCMark").is_some() {
+            continue;
+        }
+        let bytes = s.decoded().unwrap_or_default();
+        total = total.saturating_add(bytes.len()).saturating_add(1);
+        refs.push((slot, *r));
+        data.push(bytes);
+    }
+    let pieces = Pieces::join(&data);
+    let head = pieces.data().get(..pieces.data().len().min(SCAN_BYTES)).unwrap_or_default();
+    let parsed = pdfcraft_content::parse(head);
+    let res = resources(doc, &p.dict);
+    let found = walk(doc, &res, crop, &parsed.ops);
+    Ok(found.map(|(b, op)| match (b, op) {
+        (Backdrop::Fill, Some(op)) => (b, Some(Found { refs, pieces, op })),
+        _ => (b, None),
+    }))
+}
+
+fn resources(doc: &Document, page: &Dict) -> Dict {
+    page.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default()
+}
+
+fn sub(doc: &Document, res: &Dict, kind: &[u8], name: &[u8]) -> Option<std::sync::Arc<Object>> {
+    let d = res.get(kind).map(|d| doc.resolve(d))?;
+    let o = d.as_dict()?.get(name)?.clone();
+    Some(doc.resolve(&o))
+}
+
+/// Walk the operators until the first one that paints; a backdrop is that one, or nothing.
+fn walk(doc: &Document, res: &Dict, crop: [f64; 4], ops: &[Op]) -> Option<(Backdrop, Option<std::ops::Range<usize>>)> {
+    let mut st = State { ctm: Matrix::IDENTITY, clip: Some([f64::MIN, f64::MIN, f64::MAX, f64::MAX]), white: false, space: 1, opaque: true };
+    let mut saved: Vec<State> = Vec::new();
+    // Current path: its rectangles in user space, or `None` once it is anything else.
+    let mut path: Option<Vec<[f64; 4]>> = Some(Vec::new());
+    let mut clip_next = false;
+    for op in ops.iter().take(SCAN_OPS) {
+        match op.op.as_slice() {
+            b"q" => {
+                if saved.len() >= 64 {
+                    return None;
+                }
+                saved.push(st.clone());
+            }
+            b"Q" => st = saved.pop()?,
+            b"cm" => {
+                let m = Matrix::from_operands(op.operands.get(op.operands.len().checked_sub(6)?..)?)?;
+                if !m.0.iter().all(|v| v.is_finite()) {
+                    return None;
+                }
+                st.ctm = m.then(&st.ctm);
+            }
+            b"gs" => st.opaque = opaque_state(doc, res, op.name(0)?)?,
+            b"g" => set_colour(&mut st, 1, op),
+            b"rg" => set_colour(&mut st, 3, op),
+            b"k" => set_colour(&mut st, 4, op),
+            b"cs" => {
+                st.space = match op.name(0)? {
+                    b"DeviceGray" => 1,
+                    b"DeviceRGB" => 3,
+                    b"DeviceCMYK" => 4,
+                    _ => 0,
+                };
+                // The initial colour of these spaces is black.
+                st.white = false;
+            }
+            b"sc" | b"scn" => {
+                let n = st.space;
+                set_colour(&mut st, n, op)
+            }
+            b"re" => {
+                let [x, y, w, h] = op.nums::<4>()?;
+                let finite = [x, y, w, h].iter().all(|v| v.is_finite());
+                match (&mut path, finite && axis_aligned(&st.ctm)) {
+                    (Some(rects), true) => rects.push(st.ctm.bbox([x.min(x + w), y.min(y + h), x.max(x + w), y.max(y + h)])),
+                    _ => path = None,
+                }
+            }
+            b"m" | b"l" | b"c" | b"v" | b"y" | b"h" => path = None,
+            b"W" | b"W*" => clip_next = true,
+            b"n" => {
+                if clip_next {
+                    st.clip = clipped(st.clip, path.as_deref());
+                }
+                path = Some(Vec::new());
+                clip_next = false;
+            }
+            b"f" | b"F" | b"f*" => {
+                // One rectangle: with two, a fill rule can cut a hole where content shows.
+                let covers = match path.as_deref() {
+                    Some([r]) => st.clip.and_then(|c| intersect(*r, c)).is_some_and(|r| pdfcraft_content::contains(r, crop, COVER_EPS)),
+                    _ => false,
+                };
+                return (covers && st.white && st.opaque && !clip_next).then(|| (Backdrop::Fill, Some(op.span.clone())));
+            }
+            b"Do" => {
+                let xo = sub(doc, res, b"XObject", op.name(0)?)?;
+                let Object::Stream(s) = &*xo else { return None };
+                // A stencil or masked picture lets what is behind it show.
+                let masked = [&b"SMask"[..], b"Mask"].iter().any(|k| s.dict.get(k).is_some())
+                    || s.dict.get(b"ImageMask").is_some_and(|m| matches!(*doc.resolve(m), Object::Bool(true)));
+                let image = s.dict.name(b"Subtype") == Some(b"Image") && !masked;
+                return covers_unit_square(&st, crop, image).then_some((Backdrop::Image, None));
+            }
+            b"BI" => {
+                let masked = op
+                    .inline
+                    .as_ref()
+                    .is_some_and(|(d, _)| [&b"IM"[..], b"ImageMask"].iter().any(|k| d.get(k).is_some_and(|m| matches!(m, Object::Bool(true)))));
+                return covers_unit_square(&st, crop, !masked).then_some((Backdrop::Image, None));
+            }
+            // Anything else that paints comes first: no backdrop.
+            b"S" | b"s" | b"B" | b"B*" | b"b" | b"b*" | b"sh" | b"Tj" | b"TJ" | b"'" | b"\"" | b"EI" | b"d0" | b"d1" => return None,
+            _ => {}
+        }
+    }
+    None
+}
+
+/// A picture placed by the CTM (onto the unit square) covering the crop box, opaque, unclipped.
+fn covers_unit_square(st: &State, crop: [f64; 4], image: bool) -> bool {
+    image
+        && st.opaque
+        && axis_aligned(&st.ctm)
+        && st.clip.and_then(|c| intersect(st.ctm.bbox([0.0, 0.0, 1.0, 1.0]), c)).is_some_and(|r| pdfcraft_content::contains(r, crop, COVER_EPS))
+}
+
+fn set_colour(st: &mut State, components: usize, op: &Op) {
+    st.space = components;
+    let vals: Vec<f64> = op.operands.iter().filter_map(Object::as_f64).collect();
+    st.white = vals.len() == components
+        && match components {
+            1 | 3 => vals.iter().all(|v| *v >= WHITE),
+            4 => vals.iter().all(|v| *v <= 1.0 - WHITE),
+            _ => false,
+        };
+}
+
+/// Does the named ExtGState keep painting opaque and normal? `None` when it can't be read.
+fn opaque_state(doc: &Document, res: &Dict, name: &[u8]) -> Option<bool> {
+    let gs = sub(doc, res, b"ExtGState", name)?;
+    let gs = gs.as_dict()?;
+    let alpha = gs.get(b"ca").map(|a| doc.resolve(a).as_f64()).unwrap_or(Some(1.0))?;
+    let soft = gs.get(b"SMask").is_some_and(|m| doc.resolve(m).as_name() != Some(b"None"));
+    let blend = gs.get(b"BM").is_some_and(|b| !matches!(doc.resolve(b).as_name(), Some(b"Normal" | b"Compatible")));
+    Some(alpha >= 0.999 && !soft && !blend)
+}
+
+/// Rotations by multiples of 90° and scales only: rectangles stay rectangles.
+fn axis_aligned(m: &Matrix) -> bool {
+    let [a, b, c, d, ..] = m.0;
+    (b.abs() < 1e-9 && c.abs() < 1e-9) || (a.abs() < 1e-9 && d.abs() < 1e-9)
+}
+
+fn intersect(a: [f64; 4], b: [f64; 4]) -> Option<[f64; 4]> {
+    let r = [a[0].max(b[0]), a[1].max(b[1]), a[2].min(b[2]), a[3].min(b[3])];
+    (r.iter().all(|v| v.is_finite()) && r[2] > r[0] && r[3] > r[1]).then_some(r)
+}
+
+/// The clip after intersecting with a path: known only when the path is one rectangle.
+fn clipped(clip: Option<[f64; 4]>, path: Option<&[[f64; 4]]>) -> Option<[f64; 4]> {
+    match path {
+        Some([r]) => intersect(clip?, *r).or(Some([0.0, 0.0, 0.0, 0.0])),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+#[path = "backdrop_tests.rs"]
+mod tests;
diff --git a/crates/edit/src/backdrop_tests.rs b/crates/edit/src/backdrop_tests.rs
new file mode 100644
index 0000000000..88f058b4f5
--- /dev/null
+++ b/crates/edit/src/backdrop_tests.rs
@@ -0,0 +1,233 @@
+use std::sync::Arc;
+
+use pdfcraft_cos::{Document, ObjRef, Object, SaveOptions, Stream, write_incremental};
+
+use super::*;
+use crate::{Background, MarkKind, add_background, remove_marks};
+
+const TEXT: &str = "BT /F1 24 Tf 40 90 Td (Hello) Tj ET";
+
+/// A document from its objects (object 1 is the catalog, 2 the page tree).
+fn build(objs: &[String]) -> Document {
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+fn stream(dict: &str, data: &str) -> String {
+    format!("<< {dict} /Length {} >>\nstream\n{data}\nendstream", data.len())
+}
+
+/// One 300 × 200 page drawing `pieces` (objects 5…), with a font, a page-sized image `/Im0`
+/// (object 4) and two graphics states, `/Half` (ca 0.5) and `/Full` (ca 1).
+fn page(pieces: &[&str]) -> Document {
+    let refs: Vec<String> = (0..pieces.len()).map(|i| format!("{} 0 R", i + 5)).collect();
+    let mut objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        format!(
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents [{}] /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> /XObject << /Im0 4 0 R >> /ExtGState << /Half << /ca 0.5 >> /Full << /ca 1 /CA 1 >> >> >> >>",
+            refs.join(" ")
+        ),
+        stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", "\u{80}"),
+    ];
+    objs.extend(pieces.iter().map(|p| stream("", p)));
+    build(&objs)
+}
+
+/// The decoded content of a page, stream by stream.
+fn streams(doc: &Document) -> Vec<String> {
+    let p = &pdfcraft_model::pages(doc)[0];
+    let list = match p.dict.get(b"Contents").map(|c| doc.resolve(c)).as_deref() {
+        Some(Object::Array(a)) => a.clone(),
+        _ => vec![],
+    };
+    list.iter()
+        .map(|o| match &*doc.resolve(o) {
+            Object::Stream(s) => String::from_utf8_lossy(&s.decoded().unwrap()).into_owned(),
+            _ => String::new(),
+        })
+        .collect()
+}
+
+fn reopen(doc: &Document) -> Document {
+    let bytes = write_incremental(doc, &SaveOptions::default()).unwrap();
+    Document::open(Arc::new(bytes)).unwrap()
+}
+
+fn red() -> Background {
+    Background { color: [1.0, 0.0, 0.0], ..Background::default() }
+}
+
+#[test]
+fn a_white_fill_backdrop_is_replaced_and_put_back_when_the_background_goes() {
+    let content = format!("q 1 1 1 rg 0 0 300 200 re f Q {TEXT}");
+    let mut doc = page(&[&content]);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill));
+    let original = streams(&doc);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    let s = streams(&reopen(&doc));
+    assert_eq!(s.len(), 2, "{s:?}");
+    assert!(s[0].contains("/PCMark /Background"));
+    assert_eq!(s[1], format!("q 1 1 1 rg 0 0 300 200 re n Q {TEXT}"), "only the fill operator changed");
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None, "nothing hides the background now");
+    // The original stream object is untouched; the page points at a copy.
+    let Object::Stream(orig) = &*doc.get(ObjRef { num: 5, generation: 0 }) else { panic!("object 5 is the content") };
+    assert_eq!(String::from_utf8_lossy(&orig.decoded().unwrap()), content);
+    assert_eq!(remove_marks(&mut doc, &[0], MarkKind::Background).unwrap(), 1);
+    assert_eq!(streams(&reopen(&doc)), original, "exactly the original content");
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill));
+}
+
+#[test]
+fn updating_the_background_replaces_the_backdrop_once_and_removing_still_restores() {
+    let mut doc = page(&[&format!("1 1 1 rg 0 0 300 200 re f 0 g {TEXT}")]);
+    let original = streams(&doc);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    add_background(&mut doc, &[0], &Background { color: [0.0, 0.0, 1.0], ..Background::default() }, true).unwrap();
+    let s = streams(&doc);
+    assert_eq!(s.len(), 2, "one background, one copy: {s:?}");
+    assert!(s[1].contains("re n"));
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&doc), original);
+}
+
+#[test]
+fn a_backdrop_split_across_content_streams_is_replaced_in_the_piece_holding_the_operator() {
+    let mut doc = page(&["1 1 1 rg 0 0 300 200 re", &format!("f* {TEXT}")]);
+    let original = streams(&doc);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill));
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    let s = streams(&doc);
+    assert_eq!(s[1..], ["1 1 1 rg 0 0 300 200 re".to_string(), format!("n {TEXT}")], "{s:?}");
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&doc), original);
+}
+
+#[test]
+fn backdrops_writers_paint_are_recognised() {
+    for content in [
+        // Browsers: a flipped, scaled coordinate system and a page clip first.
+        "q 0.5 0 0 -0.5 0 200 cm 0 0 600 400 re W n 1 1 1 rg 0 0 600 400 re f Q",
+        // Larger than the page, in CMYK, through an opaque graphics state.
+        "/Full gs 0 0 0 0 k -10 -10 320 220 re f",
+        "/DeviceRGB cs 1 1 1 sc 0 0 300 200 re F",
+        "0.99 g 0 0 300 200 re f",
+        // Turned a quarter: still a rectangle.
+        "0 1 -1 0 300 0 cm 1 g 0 0 200 300 re f",
+    ] {
+        let doc = page(&[&format!("{content} 0 g {TEXT}")]);
+        assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill), "{content}");
+    }
+}
+
+#[test]
+fn content_that_is_not_a_page_backdrop_is_left_alone() {
+    for content in [
+        // Not the whole page.
+        "1 g 0 0 300 150 re f",
+        "q 0 0 100 100 re W n 1 g 0 0 300 200 re f Q",
+        // Not white, or not opaque.
+        "0.5 g 0 0 300 200 re f",
+        "1 0 0 rg 0 0 300 200 re f",
+        "0 0 0 0.5 k 0 0 300 200 re f",
+        "/Half gs 1 g 0 0 300 200 re f",
+        "/Missing gs 1 g 0 0 300 200 re f",
+        "/Pattern cs /P0 scn 0 0 300 200 re f",
+        // The initial colour is black.
+        "0 0 300 200 re f",
+        // Something else is painted first.
+        "BT /F1 9 Tf (x) Tj ET 1 g 0 0 300 200 re f",
+        "0 g 0 0 1 1 re f 1 g 0 0 300 200 re f",
+        "1 g 0 0 300 200 re S 1 g 0 0 300 200 re f",
+        // Not a single rectangle: a hole, a turned square, a fill-and-stroke.
+        "1 g 0 0 300 200 re 50 50 10 10 re f*",
+        "1 g 0 0 m 300 0 l 300 200 l 0 200 l h f",
+        "0.7 0.7 -0.7 0.7 150 -100 cm 1 g 0 0 400 400 re f",
+        "1 g 0 0 300 200 re B",
+        // Malformed.
+        "Q 1 g 0 0 300 200 re f",
+        "1 g 0 0 300 re f",
+        "1 g 0 0 1e400 200 re f",
+    ] {
+        let mut doc = page(&[&format!("{content} {TEXT}")]);
+        assert_eq!(page_backdrop(&doc, 0).unwrap(), None, "{content}");
+        let before = streams(&doc);
+        add_background(&mut doc, &[0], &red(), false).unwrap();
+        assert_eq!(streams(&doc)[1..], before[..], "{content}: the page's content is unchanged");
+    }
+}
+
+#[test]
+fn a_scanned_page_is_reported_and_its_picture_kept() {
+    let mut doc = page(&[&format!("q 300 0 0 200 0 0 cm /Im0 Do Q {TEXT}")]);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Image));
+    let before = streams(&doc);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    assert_eq!(streams(&doc)[1..], before[..]);
+    // A small picture is content, not a backdrop.
+    let doc = page(&["q 30 0 0 20 0 0 cm /Im0 Do Q"]);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None);
+}
+
+#[test]
+fn replacing_can_be_turned_off() {
+    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+    let before = streams(&doc);
+    add_background(&mut doc, &[0], &Background { replace_backdrop: false, ..red() }, false).unwrap();
+    assert_eq!(streams(&doc)[1..], before[..]);
+}
+
+#[test]
+fn a_backdrop_copy_edited_since_is_kept_when_the_background_goes() {
+    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    // Something else rewrites the copy (as Edit text does), keeping its dictionary.
+    let p = &pdfcraft_model::pages(&doc)[0];
+    let Some(Object::Array(list)) = p.dict.get(b"Contents").cloned() else { panic!("contents") };
+    let Object::Ref(copy) = list[1] else { panic!("a reference") };
+    let Object::Stream(s) = (*doc.get(copy)).clone() else { panic!("a stream") };
+    let edited = "1 g 0 0 300 200 re n BT /F1 24 Tf 40 90 Td (Edited) Tj ET";
+    doc.set(copy, Object::Stream(Stream::flate(s.dict.clone(), edited.as_bytes())));
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&doc), [edited.to_string()], "the edit survives");
+}
+
+#[test]
+fn a_content_stream_shared_by_two_pages_is_copied_for_the_one_page() {
+    let content = format!("1 g 0 0 300 200 re f {TEXT}");
+    let mut doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 5 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 5 0 R >>".into(),
+        stream("", &content),
+    ]);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None);
+    assert_eq!(page_backdrop(&doc, 1).unwrap(), Some(Backdrop::Fill), "the other page keeps its backdrop");
+}
+
+#[test]
+fn pages_without_content_or_with_odd_contents_have_no_backdrop() {
+    let doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents [5 0 R 99 0 R] >>".into(),
+        "<< /Not /AStream >>".into(),
+    ]);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None);
+    assert_eq!(page_backdrop(&doc, 1).unwrap(), None);
+    assert!(matches!(page_backdrop(&doc, 7), Err(EditError::NoSuchPage(7))));
+}
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 515f17d8da..a8ab1d51b5 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -150,11 +150,16 @@ pub struct Background {
     pub source: Option<MarkSource>,
     /// Pictures: size relative to the page (1.0 fits the page).
     pub scale: f64,
+    /// Replace a white backdrop the page paints itself, which would hide the background
+    /// ([`backdrop`]). Removing the background puts it back.
+    pub replace_backdrop: bool,
 }
 
 impl Default for Background {
+    /// A light yellow that still reads as a colour on screen (a near-white default looked as if
+    /// nothing had happened).
     fn default() -> Self {
-        Self { color: [1.0, 1.0, 0.85], opacity: 1.0, source: None, scale: 1.0 }
+        Self { color: [1.0, 0.95, 0.7], opacity: 1.0, source: None, scale: 1.0, replace_backdrop: true }
     }
 }
 
@@ -583,7 +588,9 @@ pub fn add_watermark(doc: &mut Document, pages: &[usize], wm: &Watermark, replac
     Ok(())
 }
 
-/// Add a solid-colour background behind the content of `pages`.
+/// Add a solid-colour background behind the content of `pages`. With `bg.replace_backdrop`, a
+/// white backdrop a page paints itself is replaced first, so the background shows (see
+/// [`backdrop`]); a picture backdrop (a scan) still hides it.
 pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, replace: bool) -> Result<(), EditError> {
     let all = page_list(doc);
     check(pages, all.len())?;
@@ -592,6 +599,9 @@ pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, repl
     }
     let opacity = if bg.opacity.is_finite() { bg.opacity.clamp(0.0, 1.0) } else { 1.0 };
     for &i in pages {
+        if bg.replace_backdrop {
+            backdrop::replace(doc, i)?;
+        }
         let page = page_list(doc)[i].clone();
         let (w, h) = page.display_size(doc);
         let mut content = begin(MarkKind::Background, "Background", page.view_matrix(doc));
@@ -614,13 +624,17 @@ pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, repl
 }
 
 /// Remove marks of `kind` from `pages`; returns how many were removed. When no mark is left on
-/// top of a page, the q/Q wrapper goes too, restoring the original content list.
+/// top of a page, the q/Q wrapper goes too, restoring the original content list. Removing
+/// backgrounds also puts back a backdrop [`add_background`] replaced, unless it was edited since.
 pub fn remove_marks(doc: &mut Document, pages: &[usize], kind: MarkKind) -> Result<usize, EditError> {
     let all = page_list(doc);
     check(pages, all.len())?;
     let mut removed = 0;
     for &i in pages {
         let page = &all[i];
+        if kind == MarkKind::Background {
+            backdrop::restore(doc, page)?;
+        }
         let list = contents(doc, page)?;
         let before = list.len();
         let mut kept: Vec<Object> = list.into_iter().filter(|o| stream_tag(doc, o).as_deref() != Some(kind.tag())).collect();
@@ -644,6 +658,8 @@ pub fn marks_present(doc: &Document) -> Vec<MarkKind> {
     added::scan_markers(doc).marks
 }
 
+pub mod backdrop;
+pub use backdrop::{Backdrop, page_backdrop};
 pub mod objects;
 pub use objects::{EditableObject, MAX_MOVE_OBJECTS, ObjectKind, ObjectTarget, editable_objects, move_objects};
 
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 3432cd868e..0f81fb22de 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -63,7 +63,7 @@ pub use pdfcraft_forms::{
 };
 
 pub use pdfcraft_a11y as a11y;
-pub use pdfcraft_edit::{BlockStyle, PageImage, RangeStyle, TextBlock, TextLine, first_undrawable};
+pub use pdfcraft_edit::{Backdrop, BlockStyle, PageImage, RangeStyle, TextBlock, TextLine, first_undrawable};
 pub use pdfcraft_measure as measure;
 pub use pdfcraft_xfa::Report as XfaLayout;
 
@@ -499,6 +499,11 @@ impl Document {
         self.editor.as_ref().map(|e| optimize::audit_space(&e.cos, self.bytes.len() as u64)).unwrap_or_default()
     }
 
+    /// The backdrop `page` (0-based) paints itself, which hides a background (Add Background).
+    pub fn page_backdrop(&self, page: usize) -> Option<pdfcraft_edit::Backdrop> {
+        self.editor.as_ref().and_then(|e| pdfcraft_edit::page_backdrop(&e.cos, page).ok().flatten())
+    }
+
     /// Edit a PDF: the images `page` draws (0-based).
     pub fn page_images(&self, page: usize) -> Vec<pdfcraft_edit::PageImage> {
         self.editor.as_ref().and_then(|e| pdfcraft_edit::page_images(&e.cos, page).ok()).unwrap_or_default()
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index 4a60c40a6e..ed2490737c 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -3,7 +3,7 @@
 //! preview of the current page. "Update" opens the same dialog in replace mode.
 
 use egui::{Align, Color32, CornerRadius, Layout, Rect, Stroke, pos2, vec2};
-use pdfcraft_engine::{Background, Edit, HeaderFooter, MarkKind, Watermark};
+use pdfcraft_engine::{Backdrop, Background, DocId, Edit, HeaderFooter, MarkKind, Watermark};
 
 use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, widgets};
@@ -72,6 +72,63 @@ impl PageRange {
     }
 }
 
+/// How many pages a frame the Background dialog checks for a backdrop of their own, so a long
+/// document never stalls the dialog.
+const BACKDROP_PAGES_PER_FRAME: usize = 24;
+
+/// Which pages paint their own backdrop (it hides a background), for the document and edit
+/// generation they were checked in. Filled a few pages a frame.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct BackdropCheck {
+    key: Option<(DocId, u64)>,
+    /// Per page: `None` until checked.
+    pages: Vec<Option<Option<Backdrop>>>,
+}
+
+/// What the check found among the pages a background goes on.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct BackdropCount {
+    /// Pages with a white backdrop that can be replaced.
+    pub fills: usize,
+    /// Pages covered by a picture (scans): the background stays hidden there.
+    pub images: usize,
+    /// Pages not checked yet.
+    pub pending: usize,
+}
+
+impl BackdropCheck {
+    /// Check up to [`BACKDROP_PAGES_PER_FRAME`] more of `pages` (0-based) and count them.
+    pub fn update(&mut self, doc: &pdfcraft_engine::Document, pages: &[usize]) -> BackdropCount {
+        let key = (doc.id, doc.edit_generation());
+        let count = doc.info.pages.len();
+        if self.key != Some(key) || self.pages.len() != count {
+            self.key = Some(key);
+            self.pages = vec![None; count];
+        }
+        let mut budget = BACKDROP_PAGES_PER_FRAME;
+        let mut n = BackdropCount::default();
+        for &p in pages {
+            let Some(slot) = self.pages.get_mut(p) else { continue };
+            if slot.is_none() && budget > 0 {
+                *slot = Some(doc.page_backdrop(p));
+                budget -= 1;
+            }
+            match slot {
+                None => n.pending += 1,
+                Some(Some(Backdrop::Fill)) => n.fills += 1,
+                Some(Some(Backdrop::Image)) => n.images += 1,
+                Some(None) => {}
+            }
+        }
+        n
+    }
+}
+
+/// "1 page" or "{n} pages", in a message.
+fn pages_phrase(n: usize, one: &str, many: &str) -> String {
+    if n == 1 { one.to_string() } else { crate::i18n::fmt(many, &[("n", &n.to_string())]) }
+}
+
 #[derive(Clone, Debug, PartialEq)]
 pub struct MarksDraft {
     pub hf: HeaderFooter,
@@ -90,6 +147,8 @@ pub struct MarksDraft {
     pub use_file: bool,
     pub file: Option<(String, std::sync::Arc<Vec<u8>>)>,
     pub file_page: usize,
+    /// Background: pages that paint their own backdrop.
+    pub backdrops: BackdropCheck,
 }
 
 impl Default for MarksDraft {
@@ -107,6 +166,7 @@ impl Default for MarksDraft {
             use_file: false,
             file: None,
             file_page: 1,
+            backdrops: BackdropCheck::default(),
         }
     }
 }
@@ -299,6 +359,9 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
                     d.bg.opacity = pct / 100.0;
                 }
             });
+            if let Some(doc) = app.session.get(id) {
+                backdrop_options(ui, t, d, doc, count);
+            }
         }
     }
     ui.add_space(8.0);
@@ -364,6 +427,13 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
             }
             MarkKind::Background => {
                 p.rect_filled(r, CornerRadius::ZERO, rgb32(bg.color).gamma_multiply(bg.opacity as f32));
+                // Schematic lines of text on top: the colour goes behind the content.
+                let (gap, inset) = (r.height() / 9.0, r.width() * 0.12);
+                for k in 1..8 {
+                    let y = r.top() + gap * k as f32;
+                    let end = if k % 3 == 0 { r.center().x } else { r.right() - inset };
+                    p.line_segment([pos2(r.left() + inset, y), pos2(end, y)], Stroke::new((gap * 0.3).clamp(1.0, 3.0), Color32::from_gray(90)));
+                }
             }
         });
         ui.vertical(|ui| {
@@ -477,6 +547,35 @@ fn file_source(ui: &mut egui::Ui, d: &mut MarksDraft, kind: MarkKind) -> bool {
     browse
 }
 
+/// Pages that paint their own backdrop would hide the background: offer to replace a white one,
+/// and say where a picture (a scan) will still hide it.
+fn backdrop_options(ui: &mut egui::Ui, t: &Tokens, d: &mut MarksDraft, doc: &pdfcraft_engine::Document, count: usize) {
+    let n = d.backdrops.update(doc, &d.range.pages(count));
+    if n.pending > 0 {
+        ui.label(egui::RichText::new(tl!("Checking pages…")).small().color(t.text_faint));
+        ui.ctx().request_repaint();
+    }
+    if n.fills > 0 {
+        ui.add_space(4.0);
+        let label = pages_phrase(
+            n.fills,
+            tl!("This page paints its own white backdrop, which would hide the background. Replace it"),
+            tl!("{n} pages paint their own white backdrop, which would hide the background. Replace it"),
+        );
+        ui.add(widgets::checkbox(&mut d.bg.replace_backdrop, &label));
+        ui.label(egui::RichText::new(tl!("Removing the background puts the page's own backdrop back.")).small().color(t.text_faint));
+    }
+    if n.images > 0 {
+        ui.add_space(4.0);
+        let text = pages_phrase(
+            n.images,
+            tl!("A picture covers this page (a scan?), so the background won't show there."),
+            tl!("A picture covers {n} pages (scans?), so the background won't show there."),
+        );
+        ui.label(egui::RichText::new(text).small().color(crate::content_ui::UNDRAWABLE));
+    }
+}
+
 /// The edit the dialog's OK makes.
 pub fn edit(d: &MarksDraft, kind: MarkKind, count: usize) -> Edit {
     let pages = d.range.pages(count);
diff --git a/crates/ui-egui/tests/ui_group/marks.rs b/crates/ui-egui/tests/ui_group/marks.rs
index 0a0e45b152..3a9864ea47 100644
--- a/crates/ui-egui/tests/ui_group/marks.rs
+++ b/crates/ui-egui/tests/ui_group/marks.rs
@@ -96,3 +96,70 @@ fn backgrounds_and_watermarks_from_a_file() {
     let s = h.state();
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), Some("Add background"));
 }
+
+/// Three pages: a white backdrop of its own (as browsers write), a page-sized picture (a scan)
+/// and bare paper.
+fn backdrop_fixture() -> Vec<u8> {
+    let stream = |data: &str| format!("<< /Length {} >> stream\n{data}\nendstream", data.len());
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R 5 0 R] /Count 3 /MediaBox [0 0 300 400] /Resources << /XObject << /Im0 9 0 R >> >> >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 6 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 7 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 8 0 R >>".into(),
+        stream("q 1 1 1 rg 0 0 300 400 re f Q 0 g 20 20 50 50 re f"),
+        stream("q 300 0 0 400 0 0 cm /Im0 Do Q"),
+        stream("0 g 20 20 50 50 re f"),
+        "<< /Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 1 >> stream\n\u{80}\nendstream"
+            .into(),
+    ];
+    let mut out = String::from("%PDF-1.7\n");
+    for (i, o) in objs.iter().enumerate() {
+        out.push_str(&format!("{} 0 obj {o} endobj\n", i + 1));
+    }
+    out.push_str("trailer << /Root 1 0 R >>\n%%EOF");
+    out.into_bytes()
+}
+
+#[test]
+fn the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scans() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, backdrop_fixture()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    let backdrop = |h: &Harness<'static, PdfCraftApp>, page| {
+        let s = h.state();
+        s.session.get(s.views[0].id).unwrap().page_backdrop(page)
+    };
+    assert_eq!(backdrop(&h, 0), Some(pdfcraft_engine::Backdrop::Fill));
+    h.state_mut().execute("edit.background");
+    h.run_steps(3);
+    let replace = "This page paints its own white backdrop, which would hide the background. Replace it";
+    h.get_by_label("A picture covers this page (a scan?), so the background won't show there.");
+    assert!(h.state().marks_draft.bg.replace_backdrop, "on by default");
+    // Left unticked, the backdrop stays and still hides the background.
+    h.get_by_label(replace).click();
+    h.run_steps(2);
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(backdrop(&h, 0), Some(pdfcraft_engine::Backdrop::Fill));
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(2);
+    // Ticked, it is replaced; the scan is reported, not touched.
+    h.state_mut().execute("edit.background");
+    h.run_steps(3);
+    h.get_by_label(replace).click();
+    h.run_steps(2);
+    assert!(h.state().marks_draft.bg.replace_backdrop);
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(backdrop(&h, 0), None);
+    assert_eq!(backdrop(&h, 1), Some(pdfcraft_engine::Backdrop::Image));
+    // Nothing left to replace: the offer is gone.
+    h.state_mut().execute("edit.background.update");
+    h.run_steps(3);
+    assert!(h.query_by_label(replace).is_none());
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c3d319f94f..e6b3dee939 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2495,9 +2495,9 @@ tier = "P0"
 milestone = "M7"
 status = "shipped"
 commands = ["edit.background"]
-tools = ["doc_background"]
-evidence = ["crates/ui-egui/tests/ui_group/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/ui_group/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright"]
-notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page"
+tools = ["doc_background", "doc_backdrops"]
+evidence = ["crates/ui-egui/tests/ui_group/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/ui_group/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright", "crates/automation/tests/backdrop.rs::a_background_shows_on_a_page_that_paints_its_own_white_backdrop", "crates/ui-egui/tests/ui_group/marks.rs::the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scans", "crates/edit/src/backdrop_tests.rs::content_that_is_not_a_page_backdrop_is_left_alone"]
+notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove puts it back unless the content was edited since). Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space; the dialog preview is a schematic, not the page"
 
 [[feature]]
 id = "edit.background-update-remove"
@@ -2508,8 +2508,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.background.update", "edit.background.remove"]
 tools = ["doc_background", "doc_remove_marks"]
-evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove"]
-notes = ""
+evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/edit/src/backdrop_tests.rs::a_white_fill_backdrop_is_replaced_and_put_back_when_the_background_goes", "crates/edit/src/backdrop_tests.rs::a_backdrop_copy_edited_since_is_kept_when_the_background_goes"]
+notes = "Remove also restores a page backdrop Add replaced"
 
 [[feature]]
 id = "edit.decoration-profiles"

From b5d34d439f9ef1f2393c5102fe24edd88a1afda8 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Fri, 16 Oct 2026 11:14:10 +0200
Subject: [PATCH 005/132] fix(ui): translate the Add Background backdrop
 messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The six new dialog strings (the backdrop offer, its note, the scan
warning and "Checking pages…") were missing from every catalogue, which
the *_covers_ui_literals tests require. Languages with several plural
forms use the "label: {n}" pattern so any count reads correctly.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/i18n/ar.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/bg.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/cs.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/de.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/el.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/es.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/fr.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/hu.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/it.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/ja.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/kk.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/lt.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/pl.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/pt-br.tsv   | 6 ++++++
 crates/ui-egui/src/i18n/ru.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/sl.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/te.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/tr.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/uk.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/vi.tsv      | 6 ++++++
 crates/ui-egui/src/i18n/zh-hans.tsv | 6 ++++++
 crates/ui-egui/src/i18n/zh-hant.tsv | 6 ++++++
 22 files changed, 132 insertions(+)

diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 5a0e6e9c96..abea3aae73 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -822,6 +822,12 @@
 	Applies to 1 page	يُطبَّق على صفحة واحدة
 	Applies to {n} pages	يُطبَّق على {n} صفحات
 	Replaces the existing one on those pages.	يستبدل الموجود على تلك الصفحات.
+	Checking pages…	جارٍ فحص الصفحات…
+	This page paints its own white backdrop, which would hide the background. Replace it	ترسم هذه الصفحة تعبئة بيضاء خاصة بها ستُخفي الخلفية. استبدالها
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	عدد الصفحات التي ترسم تعبئة بيضاء خاصة بها ستُخفي الخلفية: {n}. استبدالها
+	Removing the background puts the page's own backdrop back.	إزالة الخلفية تعيد التعبئة البيضاء الخاصة بالصفحة.
+	A picture covers this page (a scan?), so the background won't show there.	تغطي صورة هذه الصفحة (مسح ضوئي؟)، لذا لن تظهر الخلفية فيها.
+	A picture covers {n} pages (scans?), so the background won't show there.	عدد الصفحات التي تغطيها صور (مسح ضوئي؟): {n}؛ لن تظهر الخلفية فيها.
 	PDF or image	PDF أو صورة
 	No file chosen	لم يُختر ملف
 	Page number	رقم الصفحة
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 90791f4a86..e5f2eff8f4 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -496,6 +496,12 @@
 	Applies to 1 page	Прилага се към 1 страница
 	Applies to {n} pages	Прилага се към {n} страници
 	Replaces the existing one on those pages.	Заменя съществуващия на тези страници.
+	Checking pages…	Проверка на страниците…
+	This page paints its own white backdrop, which would hide the background. Replace it	Тази страница има собствено бяло запълване, което би скрило фона. Замяна
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Страници със собствено бяло запълване, което би скрило фона: {n}. Замяна
+	Removing the background puts the page's own backdrop back.	Премахването на фона връща собственото бяло запълване на страницата.
+	A picture covers this page (a scan?), so the background won't show there.	Изображение покрива тази страница (сканиране?), затова фонът няма да се вижда там.
+	A picture covers {n} pages (scans?), so the background won't show there.	Страници, покрити с изображения (сканирания?): {n}; фонът няма да се вижда там.
 	PDF or image	PDF или изображение
 	No file chosen	Не е избран файл
 	Page number	Номер на страница
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 4bbb9a5e77..a76c53166a 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -896,6 +896,12 @@ key	Space	Mezerník
 	Applies to 1 page	Týká se 1 stránky
 	Applies to {n} pages	Počet dotčených stránek: {n}
 	Replaces the existing one on those pages.	Nahradí stávající na těchto stránkách.
+	Checking pages…	Kontrola stránek…
+	This page paints its own white backdrop, which would hide the background. Replace it	Tato stránka má vlastní bílou výplň, která by zakryla pozadí. Nahradit ji
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Stránky s vlastní bílou výplní, která by zakryla pozadí: {n}. Nahradit ji
+	Removing the background puts the page's own backdrop back.	Odebráním pozadí se vrátí vlastní bílá výplň stránky.
+	A picture covers this page (a scan?), so the background won't show there.	Tuto stránku pokrývá obrázek (sken?), takže pozadí na ní nebude vidět.
+	A picture covers {n} pages (scans?), so the background won't show there.	Stránky pokryté obrázky (skeny?): {n}; pozadí na nich nebude vidět.
 	PDF or image	PDF nebo obrázek
 	No file chosen	Není vybrán žádný soubor
 	Page number	Číslo stránky
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 7965435257..9ec1649f0c 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -800,6 +800,12 @@
 	Applies to 1 page	Gilt für 1 Seite
 	Applies to {n} pages	Gilt für {n} Seiten
 	Replaces the existing one on those pages.	Ersetzt das Vorhandene auf diesen Seiten.
+	Checking pages…	Seiten werden geprüft…
+	This page paints its own white backdrop, which would hide the background. Replace it	Diese Seite hat eine eigene weiße Fläche, die den Hintergrund verdecken würde. Ersetzen
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} Seiten haben eine eigene weiße Fläche, die den Hintergrund verdecken würde. Ersetzen
+	Removing the background puts the page's own backdrop back.	Wird der Hintergrund entfernt, kehrt die eigene weiße Fläche der Seite zurück.
+	A picture covers this page (a scan?), so the background won't show there.	Ein Bild bedeckt diese Seite (ein Scan?), daher ist der Hintergrund dort nicht zu sehen.
+	A picture covers {n} pages (scans?), so the background won't show there.	Bilder bedecken {n} Seiten (Scans?), daher ist der Hintergrund dort nicht zu sehen.
 	PDF or image	PDF oder Bild
 	No file chosen	Keine Datei ausgewählt
 	Page number	Seitenzahl
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 57de6eef07..509adcb495 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -432,6 +432,12 @@
 	Applies to 1 page	Εφαρμόζεται σε 1 σελίδα
 	Applies to {n} pages	Εφαρμόζεται σε {n} σελίδες
 	Replaces the existing one on those pages.	Αντικαθιστά το υπάρχον στοιχείο στις συγκεκριμένες σελίδες.
+	Checking pages…	Έλεγχος σελίδων…
+	This page paints its own white backdrop, which would hide the background. Replace it	Αυτή η σελίδα έχει δική της λευκή γέμιση, που θα έκρυβε το φόντο. Αντικατάσταση
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} σελίδες έχουν δική τους λευκή γέμιση, που θα έκρυβε το φόντο. Αντικατάσταση
+	Removing the background puts the page's own backdrop back.	Η αφαίρεση του φόντου επαναφέρει τη λευκή γέμιση της σελίδας.
+	A picture covers this page (a scan?), so the background won't show there.	Μια εικόνα καλύπτει αυτή τη σελίδα (σάρωση;), οπότε το φόντο δεν θα φαίνεται εκεί.
+	A picture covers {n} pages (scans?), so the background won't show there.	Εικόνες καλύπτουν {n} σελίδες (σαρώσεις;), οπότε το φόντο δεν θα φαίνεται εκεί.
 	PDF or image	PDF ή εικόνα
 	No file chosen	Δεν έχει επιλεγεί αρχείο
 	Scale relative to target page	Κλίμακα ως προς τη σελίδα προορισμού
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index e4eb634468..b3cd598fcf 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -816,6 +816,12 @@
 	Applies to 1 page	Se aplica a 1 página
 	Applies to {n} pages	Se aplica a {n} páginas
 	Replaces the existing one on those pages.	Reemplaza al existente en esas páginas.
+	Checking pages…	Comprobando páginas…
+	This page paints its own white backdrop, which would hide the background. Replace it	Esta página tiene su propio relleno blanco, que ocultaría el fondo. Reemplazarlo
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} páginas tienen su propio relleno blanco, que ocultaría el fondo. Reemplazarlo
+	Removing the background puts the page's own backdrop back.	Al quitar el fondo, se restaura el relleno blanco propio de la página.
+	A picture covers this page (a scan?), so the background won't show there.	Una imagen cubre esta página (¿un escaneo?), así que el fondo no se verá ahí.
+	A picture covers {n} pages (scans?), so the background won't show there.	Hay imágenes que cubren {n} páginas (¿escaneos?), así que el fondo no se verá ahí.
 	PDF or image	PDF o imagen
 	No file chosen	Ningún archivo elegido
 	Page number	Número de página
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 62acea1da8..9a693fc49c 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -796,6 +796,12 @@
 	Applies to 1 page	S'applique à 1 page
 	Applies to {n} pages	S'applique à {n} pages
 	Replaces the existing one on those pages.	Remplace celui qui existe déjà sur ces pages.
+	Checking pages…	Vérification des pages…
+	This page paints its own white backdrop, which would hide the background. Replace it	Cette page a son propre remplissage blanc, qui masquerait l'arrière-plan. Le remplacer
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} pages ont leur propre remplissage blanc, qui masquerait l'arrière-plan. Le remplacer
+	Removing the background puts the page's own backdrop back.	Supprimer l'arrière-plan rétablit le remplissage blanc propre à la page.
+	A picture covers this page (a scan?), so the background won't show there.	Une image couvre cette page (une numérisation ?), l'arrière-plan n'y sera donc pas visible.
+	A picture covers {n} pages (scans?), so the background won't show there.	Des images couvrent {n} pages (des numérisations ?), l'arrière-plan n'y sera donc pas visible.
 	PDF or image	PDF ou image
 	No file chosen	Aucun fichier choisi
 	Page number	Numéro de page
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 2238e1ade5..3eaf795525 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -793,6 +793,12 @@
 	Applies to 1 page	1 oldalra vonatkozik
 	Applies to {n} pages	{n} oldalra vonatkozik
 	Replaces the existing one on those pages.	Lecseréli a meglévőt ezeken az oldalakon.
+	Checking pages…	Oldalak ellenőrzése…
+	This page paints its own white backdrop, which would hide the background. Replace it	Ennek az oldalnak saját fehér kitöltése van, amely eltakarná a hátteret. Csere
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} oldalnak saját fehér kitöltése van, amely eltakarná a hátteret. Csere
+	Removing the background puts the page's own backdrop back.	A háttér eltávolítása visszaállítja az oldal saját fehér kitöltését.
+	A picture covers this page (a scan?), so the background won't show there.	Egy kép fedi le ezt az oldalt (szkennelt?), így ott nem látszik a háttér.
+	A picture covers {n} pages (scans?), so the background won't show there.	Képek fednek le {n} oldalt (szkenneltek?), így ott nem látszik a háttér.
 	PDF or image	PDF vagy kép
 	No file chosen	Nincs fájl kiválasztva
 	Page number	Oldalszám
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 3fa2263a0b..4f52f86e71 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -819,6 +819,12 @@
 	Applies to 1 page	Si applica a 1 pagina
 	Applies to {n} pages	Si applica a {n} pagine
 	Replaces the existing one on those pages.	Sostituisce l'elemento esistente su quelle pagine.
+	Checking pages…	Verifica delle pagine…
+	This page paints its own white backdrop, which would hide the background. Replace it	Questa pagina ha un proprio riempimento bianco, che nasconderebbe lo sfondo. Sostituiscilo
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} pagine hanno un proprio riempimento bianco, che nasconderebbe lo sfondo. Sostituiscilo
+	Removing the background puts the page's own backdrop back.	Rimuovendo lo sfondo, il riempimento bianco della pagina viene ripristinato.
+	A picture covers this page (a scan?), so the background won't show there.	Un'immagine copre questa pagina (una scansione?), quindi lì lo sfondo non sarà visibile.
+	A picture covers {n} pages (scans?), so the background won't show there.	Delle immagini coprono {n} pagine (scansioni?), quindi lì lo sfondo non sarà visibile.
 	PDF or image	PDF o immagine
 	No file chosen	Nessun file scelto
 	Page number	Numero di pagina
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index ee9439e311..1abf8b00f3 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -823,6 +823,12 @@
 	Applies to 1 page	1 ページに適用
 	Applies to {n} pages	{n} ページに適用
 	Replaces the existing one on those pages.	対象ページの既存の項目を置き換えます。
+	Checking pages…	ページを確認しています…
+	This page paints its own white backdrop, which would hide the background. Replace it	このページには独自の白い塗りがあり、背景が隠れてしまいます。置き換える
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} ページに独自の白い塗りがあり、背景が隠れてしまいます。置き換える
+	Removing the background puts the page's own backdrop back.	背景を削除すると、ページ独自の白い塗りが元に戻ります。
+	A picture covers this page (a scan?), so the background won't show there.	このページは画像（スキャン？）で覆われているため、背景は表示されません。
+	A picture covers {n} pages (scans?), so the background won't show there.	{n} ページが画像（スキャン？）で覆われているため、そこでは背景は表示されません。
 	PDF or image	PDF または画像
 	No file chosen	ファイルが選択されていません
 	Page number	ページ番号
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 827165ae3a..3e5d693d52 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -778,6 +778,12 @@
 	Applies to 1 page	1 бетке қолданылады
 	Applies to {n} pages	{n} бетке қолданылады
 	Replaces the existing one on those pages.	Осы беттерде бар элементті ауыстырады.
+	Checking pages…	Беттер тексерілуде…
+	This page paints its own white backdrop, which would hide the background. Replace it	Бұл беттің өз ақ толтыруы бар, ол фонды жасырады. Ауыстыру
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} беттің өз ақ толтыруы бар, ол фонды жасырады. Ауыстыру
+	Removing the background puts the page's own backdrop back.	Фонды жою беттің өз ақ толтыруын қайтарады.
+	A picture covers this page (a scan?), so the background won't show there.	Бұл бетті сурет жауып тұр (сканер ме?), сондықтан онда фон көрінбейді.
+	A picture covers {n} pages (scans?), so the background won't show there.	{n} бетті суреттер жауып тұр (сканер ме?), сондықтан онда фон көрінбейді.
 	PDF or image	PDF немесе сурет
 	No file chosen	Файл таңдалмады
 	Page number	Бет нөмірі
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 56a785cd3e..09fd3a65f9 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -958,6 +958,12 @@
 	Replacement text	Pakaitinis tekstas
 	Replacement: pages of {name}	Pakaitinis dokumentas: {name} puslapiai
 	Replaces the existing one on those pages.	Tuose puslapiuose pakeičia esamą.
+	Checking pages…	Tikrinami puslapiai…
+	This page paints its own white backdrop, which would hide the background. Replace it	Šis puslapis turi savo baltą užpildą, kuris paslėptų foną. Pakeisti
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Puslapiai su savo baltu užpildu, kuris paslėptų foną: {n}. Pakeisti
+	Removing the background puts the page's own backdrop back.	Pašalinus foną, grąžinamas paties puslapio baltas užpildas.
+	A picture covers this page (a scan?), so the background won't show there.	Šį puslapį dengia paveikslėlis (nuskaitytas?), todėl fonas ten nesimatys.
+	A picture covers {n} pages (scans?), so the background won't show there.	Paveikslėliais padengti puslapiai (nuskaityti?): {n}; fonas ten nesimatys.
 	Report	Ataskaita
 	Report…	Ataskaita…
 	Requires user to enter a password for:	Naudotojas turi įvesti slaptažodį, kad galėtų:
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 3dbb247056..6d55eed026 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -814,6 +814,12 @@
 	Applies to 1 page	Dotyczy 1 strony
 	Applies to {n} pages	Liczba objętych stron: {n}
 	Replaces the existing one on those pages.	Zastępuje istniejący element na tych stronach.
+	Checking pages…	Sprawdzanie stron…
+	This page paints its own white backdrop, which would hide the background. Replace it	Ta strona ma własne białe wypełnienie, które zasłoniłoby tło. Zastąp
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Strony z własnym białym wypełnieniem, które zasłoniłoby tło: {n}. Zastąp
+	Removing the background puts the page's own backdrop back.	Usunięcie tła przywraca własne białe wypełnienie strony.
+	A picture covers this page (a scan?), so the background won't show there.	Tę stronę zakrywa obraz (skan?), więc tło nie będzie tam widoczne.
+	A picture covers {n} pages (scans?), so the background won't show there.	Strony zakryte obrazami (skany?): {n}; tło nie będzie tam widoczne.
 	PDF or image	PDF lub obraz
 	No file chosen	Nie wybrano pliku
 	Page number	Numer strony
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 8b3baa2d39..ca6f416885 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -451,6 +451,12 @@
 	Applies to 1 page	Aplica-se a 1 página
 	Applies to {n} pages	Aplica-se a {n} páginas
 	Replaces the existing one on those pages.	Substitui o existente nessas páginas.
+	Checking pages…	Verificando páginas…
+	This page paints its own white backdrop, which would hide the background. Replace it	Esta página tem um preenchimento branco próprio, que esconderia o plano de fundo. Substituí-lo
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} páginas têm um preenchimento branco próprio, que esconderia o plano de fundo. Substituí-lo
+	Removing the background puts the page's own backdrop back.	Remover o plano de fundo restaura o preenchimento branco da página.
+	A picture covers this page (a scan?), so the background won't show there.	Uma imagem cobre esta página (uma digitalização?), então o plano de fundo não aparecerá nela.
+	A picture covers {n} pages (scans?), so the background won't show there.	Imagens cobrem {n} páginas (digitalizações?), então o plano de fundo não aparecerá nelas.
 	PDF or image	PDF ou imagem
 	No file chosen	Nenhum arquivo escolhido
 	Page number	Número da página
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index d0f8fc239c..92f80a3fbe 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -816,6 +816,12 @@
 	Applies to 1 page	Применяется к 1 странице
 	Applies to {n} pages	Применяется к {n} страницам
 	Replaces the existing one on those pages.	Заменяет существующий на этих страницах.
+	Checking pages…	Проверка страниц…
+	This page paints its own white backdrop, which would hide the background. Replace it	На этой странице есть собственная белая заливка, которая скроет фон. Заменить
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Страницы с собственной белой заливкой, которая скроет фон: {n}. Заменить
+	Removing the background puts the page's own backdrop back.	При удалении фона собственная белая заливка страницы возвращается.
+	A picture covers this page (a scan?), so the background won't show there.	Эту страницу закрывает изображение (скан?), поэтому фон там не будет виден.
+	A picture covers {n} pages (scans?), so the background won't show there.	Страницы, закрытые изображениями (сканы?): {n}; фон там не будет виден.
 	PDF or image	PDF или изображение
 	No file chosen	Файл не выбран
 	Page number	Номер страницы
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 92d9c9a6e3..eb6b9678c4 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -1485,6 +1485,12 @@
 	Replacement text	Nadomestno besedilo
 	Replacement: pages of {name}	Zamenjava: strani datoteke {name}
 	Replaces the existing one on those pages.	Nadomesti obstoječe na teh straneh.
+	Checking pages…	Preverjanje strani…
+	This page paints its own white backdrop, which would hide the background. Replace it	Ta stran ima lastno belo polnilo, ki bi skrilo ozadje. Zamenjaj
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Strani z lastnim belim polnilom, ki bi skrilo ozadje: {n}. Zamenjaj
+	Removing the background puts the page's own backdrop back.	Odstranitev ozadja povrne lastno belo polnilo strani.
+	A picture covers this page (a scan?), so the background won't show there.	To stran prekriva slika (skeniranje?), zato ozadje tam ne bo vidno.
+	A picture covers {n} pages (scans?), so the background won't show there.	Strani, ki jih prekrivajo slike (skeniranja?): {n}; ozadje tam ne bo vidno.
 	Replacing images arrives on the web with image file pickers	Zamenjava slik bo v spletni različici na voljo z izbirniki slikovnih datotek
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Zamenjava slik na strani {p} bo v spletni različici na voljo z izbirniki slik ({i})
 	Reply	Odgovori
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 07b716eac1..9ec8e96bef 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -796,6 +796,12 @@ comment menu	Edit	సవరించు
 	Applies to 1 page	1 పేజీకి వర్తిస్తుంది
 	Applies to {n} pages	{n} పేజీలకు వర్తిస్తుంది
 	Replaces the existing one on those pages.	ఆ పేజీలలో ఇప్పటికే ఉన్నదాన్ని భర్తీ చేస్తుంది.
+	Checking pages…	పేజీలను తనిఖీ చేస్తోంది…
+	This page paints its own white backdrop, which would hide the background. Replace it	ఈ పేజీకి సొంత తెల్లని నింపు ఉంది, అది నేపథ్యాన్ని దాచేస్తుంది. భర్తీ చేయండి
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} పేజీలకు సొంత తెల్లని నింపు ఉంది, అది నేపథ్యాన్ని దాచేస్తుంది. భర్తీ చేయండి
+	Removing the background puts the page's own backdrop back.	నేపథ్యాన్ని తీసివేస్తే పేజీ సొంత తెల్లని నింపు తిరిగి వస్తుంది.
+	A picture covers this page (a scan?), so the background won't show there.	ఈ పేజీని ఒక చిత్రం కప్పుతోంది (స్కాన్?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
+	A picture covers {n} pages (scans?), so the background won't show there.	{n} పేజీలను చిత్రాలు కప్పుతున్నాయి (స్కాన్‌లు?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
 	PDF or image	PDF లేదా చిత్రం
 	No file chosen	ఫైల్ ఏదీ ఎంచుకోలేదు
 	Page number	పేజీ సంఖ్య
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index 30e19f2132..e500ba7c17 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -777,6 +777,12 @@
 	Applies to 1 page	1 sayfaya uygulanır
 	Applies to {n} pages	{n} sayfaya uygulanır
 	Replaces the existing one on those pages.	Bu sayfalardaki mevcut olanın yerini alır.
+	Checking pages…	Sayfalar denetleniyor…
+	This page paints its own white backdrop, which would hide the background. Replace it	Bu sayfanın arka planı gizleyecek kendi beyaz dolgusu var. Değiştir
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} sayfanın arka planı gizleyecek kendi beyaz dolgusu var. Değiştir
+	Removing the background puts the page's own backdrop back.	Arka planı kaldırmak, sayfanın kendi beyaz dolgusunu geri getirir.
+	A picture covers this page (a scan?), so the background won't show there.	Bu sayfayı bir resim kaplıyor (tarama mı?), bu yüzden arka plan orada görünmez.
+	A picture covers {n} pages (scans?), so the background won't show there.	{n} sayfayı resimler kaplıyor (tarama mı?), bu yüzden arka plan orada görünmez.
 	PDF or image	PDF veya resim
 	No file chosen	Dosya seçilmedi
 	Page number	Sayfa numarası
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index c60799ef1f..76bf5b0791 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -820,6 +820,12 @@
 	Applies to 1 page	Застосовується до 1 сторінки
 	Applies to {n} pages	Застосовується до {n} сторінок
 	Replaces the existing one on those pages.	Замінює наявний елемент на цих сторінках.
+	Checking pages…	Перевірка сторінок…
+	This page paints its own white backdrop, which would hide the background. Replace it	Ця сторінка має власну білу заливку, яка приховає тло. Замінити
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	Сторінки з власною білою заливкою, яка приховає тло: {n}. Замінити
+	Removing the background puts the page's own backdrop back.	Вилучення тла повертає власну білу заливку сторінки.
+	A picture covers this page (a scan?), so the background won't show there.	Цю сторінку закриває зображення (скан?), тому тло там не буде видно.
+	A picture covers {n} pages (scans?), so the background won't show there.	Сторінки, закриті зображеннями (скани?): {n}; тло там не буде видно.
 	PDF or image	PDF або зображення
 	No file chosen	Файл не вибрано
 	Page number	Номер сторінки
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index b072755236..5aabd0eb4f 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -953,6 +953,12 @@ theme	Appearance	Giao diện
 	Replacement text	Văn bản được thay vào
 	Replacement: pages of {name}	Thay thế: các trang của {name}
 	Replaces the existing one on those pages.	Thay thế cái hiện có trên các trang đó.
+	Checking pages…	Đang kiểm tra các trang…
+	This page paints its own white backdrop, which would hide the background. Replace it	Trang này có lớp tô trắng riêng, sẽ che mất nền. Thay thế
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} trang có lớp tô trắng riêng, sẽ che mất nền. Thay thế
+	Removing the background puts the page's own backdrop back.	Gỡ nền sẽ khôi phục lớp tô trắng riêng của trang.
+	A picture covers this page (a scan?), so the background won't show there.	Một hình ảnh phủ kín trang này (bản quét?), nên nền sẽ không hiện ở đó.
+	A picture covers {n} pages (scans?), so the background won't show there.	Hình ảnh phủ kín {n} trang (bản quét?), nên nền sẽ không hiện ở đó.
 	Report	Báo cáo
 	Report…	Báo cáo…
 	Requires user to enter a password for:	Yêu cầu người dùng nhập mật khẩu cho:
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 2297d1269a..b3c2642e79 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -503,6 +503,12 @@
 	Applies to 1 page	应用于 1 页
 	Applies to {n} pages	应用于 {n} 页
 	Replaces the existing one on those pages.	替换这些页面上的现有内容。
+	Checking pages…	正在检查页面…
+	This page paints its own white backdrop, which would hide the background. Replace it	此页面有自己的白色填充，会遮住背景。替换它
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} 个页面有自己的白色填充，会遮住背景。替换它
+	Removing the background puts the page's own backdrop back.	移除背景后，页面自己的白色填充会恢复。
+	A picture covers this page (a scan?), so the background won't show there.	此页面被一张图片覆盖（扫描件？），因此那里不会显示背景。
+	A picture covers {n} pages (scans?), so the background won't show there.	{n} 个页面被图片覆盖（扫描件？），因此那里不会显示背景。
 	PDF or image	PDF 或图像
 	No file chosen	未选择文件
 	Page number	页码
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 2ddb33dd6d..611c6cf5ef 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -455,6 +455,12 @@
 	Applies to 1 page	套用於 1 頁
 	Applies to {n} pages	套用於 {n} 頁
 	Replaces the existing one on those pages.	替換這些頁面上的現有內容。
+	Checking pages…	正在檢查頁面…
+	This page paints its own white backdrop, which would hide the background. Replace it	此頁面有自己的白色填色，會遮住背景。取代它
+	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} 個頁面有自己的白色填色，會遮住背景。取代它
+	Removing the background puts the page's own backdrop back.	移除背景後，頁面自己的白色填色會恢復。
+	A picture covers this page (a scan?), so the background won't show there.	此頁面被一張圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
+	A picture covers {n} pages (scans?), so the background won't show there.	{n} 個頁面被圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
 	PDF or image	PDF 或圖片
 	No file chosen	未選擇檔案
 	Page number	頁碼

From 93df949e3ef1c6f70868d3f60ee2f657a758a0c2 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Fri, 16 Oct 2026 11:40:07 +0200
Subject: [PATCH 006/132] fix(assets): refresh the catalogue hashes for the
 backdrop translations

The 22 interface catalogues are registered assets; adding the Add
Background strings changed their SHA-256. Provenance is unchanged
(contributor-original translations).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ATTRIBUTION.toml | 44 ++++++++++++++++++++++----------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index be9e2c448e..be2e770d56 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -7,7 +7,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Greek UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cefa955aa92790d6773cb1d1e15e19019b3165a00528d57d6617362e1d1988ab"
+sha256 = "dd8a8b41a1a6de5d2f9f540d0c499366ccaa1ebfe62bb259f202dd4be03fc234"
 
 # ATTRIBUTION.toml: one entry per asset (AGENTS.md §1). The source of truth for provenance and licences.
 # ATTRIBUTION.md is generated from this file: `cargo xtask assets --write`. Checked by `cargo xtask assets` (part of `xtask ci`).
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "dbfebf4e9b2e9ac31ecf72202c2098173e72ebfaf90e9fee8f0563a6734fe31f"
+sha256 = "392fa715e7a058a6d6f872a9381260e9e1598ef45b616edc71bc6b311d9c4a34"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0b0dafa3806a6b3508684f64e1f07b435113f8efd0e59201d12250c63c1d9547"
+sha256 = "343b669decabca1e05a651b410b34427f2a28bb2dd22240a877bbb57a94d87af"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "898a5240fa59cac42ef6b99cb60bcfca0094ac27370e1c8d020bd27936b56517"
+sha256 = "e56bb7c7ebe676b5cb606f0bff4102ca036a532a2c6afbcc74e8a221b2ae3382"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b4745c94797575529cd0e78c18c71fa2c0dfddfbf19b9c40b41dc2057c6f6543"
+sha256 = "9e3085c3a3d0c6114df4bd73d380d8efc4bb05ba07ad0285b4c54abd9a901b69"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2acb3f6522d6d1f744343f474fe4c51ebec610a888a7fa83fc9422228e6fa3c1"
+sha256 = "8a450837808cd319c82e39b4833623b64c3e50009beffd732d00b8eb88d32fbc"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1b739478a4f186a49900cce84edbe136206a53b46340322df4caf77bb3fb5b12"
+sha256 = "9c6c34ec7f372b3d3db2c88435b497eb4bbf2032859c1bfc3cfb12c47c3b36b6"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "da3b71608ff7fe6e230b076207cee96ac01f66e068ca1be83af1ad56ac9c60eb"
+sha256 = "9d890f88003febb885e076df172872cfff76cde77cf22b1af57c570229dc4316"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "989d2e5f57cf22c21a85951835ca9fbd05e314da67eb4c17332df1f03679fa00"
+sha256 = "617bf25bb48c93a0578e5832f54420fc47b3a97ad31bf9ffd57556a1bdb4048b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/it.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Italian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "5e84916e3ad8670216360695689fe8fd624365a29886f66a3c655ba126892f5b"
+sha256 = "b90ef8f3a4b71e2aca3bc98f8420b25fbc6f86220b75f0c5f47b731551e506f8"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pl.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Polish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "988bcf2e0322a46c0464ff7b91ab5d90193b0ea7f454812d12595eb843de6fc7"
+sha256 = "77069128e2d00b03cedf460915fc00a0cc00880e3b1aecf6de769b06c218f71b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "084f4ea06f31c632ad90b0e87f66240ce5b5dc012ac7770987d44918ee66f452"
+sha256 = "2ee89f763e825609beb78b5f05f3a035cff4f01c81a0fb80dcefbbf209d19f98"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "973cd90ec34c8a973d146a0e2c73c1d632e17357c3d87ccf10c59e64d12c1587"
+sha256 = "19844f166956ac49e6c4c09b57e2024e0d73c5c3e14ee8df994a1799bef9b648"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -162,7 +162,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "485f85d4053c9661ddda2ed9394a0644c77b489feb598d02f12ef209e11f2ee3"
+sha256 = "5b31891a0775d5e7a9cfb14a2f767b2fa17c9d948ce92b43cd371846a3d69322"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/kk.tsv"
@@ -173,7 +173,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Kazakh UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "24524864022ab2abeff68b5979519eee4e92134d0c4053d40c741bc7f01c249c"
+sha256 = "e7b587ecf87095a1317bf37830ca60e75a16a0285dfa14e0361ddfd04b44800b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -184,7 +184,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "bc6d123bdb34d5d7c22717fed1a86ff20e7e493acc1e155e61e61e2dc74459aa"
+sha256 = "9413104f8543e8a03dccb014d62bd40a77645de5b279c55b3266c02e907afb89"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -195,7 +195,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "82678dbe730f56062037ea78de165b2c016b3fa670fb1cbfc7cd713eca900bac"
+sha256 = "f1490c97273e57b256e234a8a53766318f75f888a05144727efc226c7d67f62d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ar.tsv"
@@ -206,7 +206,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Arabic UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "304d661b27cdb5246f6b2974b4b5e78667f0928cda3588440be3d8f35f254679"
+sha256 = "2216666f2d355aed70b4c60e09bfe07d902036bbad52aee1e287e5f50a887903"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/tr.tsv"
@@ -217,7 +217,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Turkish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "05e2b7d5401166d362ba055120fba9a1645d6ec324997cf670e19fafcb0c54cf"
+sha256 = "436777718e77c79ca54a16a629d725e7b480ad9fad5f25f7c249b446208797e4"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/lt.tsv"
@@ -228,7 +228,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "17c8579e0e9d1524ffbeb87e7b30c14562dbaac64400826ee786cecfe31648fa"
+sha256 = "d66b81e59728b669ed1a35e4773d0ef75b25f7143109e9a5fc7dd29e6a52ee25"
 
 
 [[asset]]
@@ -3352,7 +3352,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Vietnamese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2d1c4b4276d02512a4e20101be95a1671de5c4f5cdfd661887af5ebab0db06a6"
+sha256 = "a2dde60a333e8c75d8f07190149d28d3f210c0c8662e0493b4e67dd34789e453"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/sl.tsv"
@@ -3363,7 +3363,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Slovene UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8f8a259264cda06eb6d9a9bf91dc7d873a8561213a9a9e7acbd32623bef40be0"
+sha256 = "73563d2d36a685ef23ed517eb635a654b1a5900abe7471db17b40af62b4cd223"
 
 [[asset]]
 

From 22ec11cd28c1df31c5755c724c3cc4fdcdbc8e6f Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Sat, 17 Oct 2026 09:57:47 +0800
Subject: [PATCH 007/132] Keep lines with footnote references in paragraph
 reading order (#2929)

---
 crates/render/src/text.rs | 177 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 168 insertions(+), 9 deletions(-)

diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index b767e28314..064a68d093 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -945,6 +945,32 @@ struct SegExtra {
     more: Vec<Run>,
 }
 
+/// Whether `(script_bbox, script_h)` is a superscript or subscript on `(host_bbox, host_h)`.
+fn is_script_on(host_bbox: &[f32; 4], host_h: f32, script_bbox: &[f32; 4], script_h: f32) -> bool {
+    let host_cy = (host_bbox[1] + host_bbox[3]) / 2.0;
+    let script_cy = (script_bbox[1] + script_bbox[3]) / 2.0;
+    let script_w = script_bbox[2] - script_bbox[0];
+    let host_w = host_bbox[2] - host_bbox[0];
+    let smaller = script_h >= host_h * 0.45 && script_w < host_h * 3.0 && (script_h < host_h * 0.9 || (script_h <= host_h && host_w > script_w));
+    if !smaller {
+        return false;
+    }
+    if script_cy < host_cy {
+        // Superscript: raised above the host baseline, with its bottom inside the host line.
+        host_cy - script_cy >= host_h * 0.12
+            && host_cy - script_cy < host_h * 0.7
+            && host_bbox[3] - script_bbox[3] >= host_h * 0.15
+            && script_bbox[3] > host_bbox[1] + host_h * 0.25
+    } else {
+        // Subscript: lowered below the host baseline, with its centre still inside the host line.
+        script_cy - host_cy >= host_h * 0.12
+            && script_cy - host_cy < host_h * 0.5
+            && script_bbox[3] > host_bbox[3]
+            && host_bbox[3] > script_bbox[1] + script_h * 0.5
+            && script_bbox[1] >= host_bbox[1] - script_h * 0.2
+    }
+}
+
 impl Seg {
     fn new(first: Run, bbox: [f32; 4], h: f32) -> Self {
         Seg { first, extra: None, bbox, h }
@@ -958,9 +984,25 @@ impl Seg {
         std::iter::once(self.first).chain(self.extra.iter().flat_map(|e| e.more.iter().copied()))
     }
 
+    /// Extend `self`'s box and height with `(bbox, h)`. A smaller script (superscript or
+    /// subscript) widens the line horizontally without pulling its vertical baseline band up or
+    /// down; when a line begins with a script and continues with taller body text, the body text's
+    /// vertical band becomes the line's.
+    fn extend_box(&mut self, bbox: &[f32; 4], h: f32) {
+        if h > self.h * 1.15 || is_script_on(bbox, h, &self.bbox, self.h) {
+            self.bbox[1] = bbox[1];
+            self.bbox[3] = bbox[3];
+        } else if !(self.h > h * 1.15 || is_script_on(&self.bbox, self.h, bbox, h)) {
+            self.bbox[1] = self.bbox[1].min(bbox[1]);
+            self.bbox[3] = self.bbox[3].max(bbox[3]);
+        }
+        self.bbox[0] = self.bbox[0].min(bbox[0]);
+        self.bbox[2] = self.bbox[2].max(bbox[2]);
+        self.h = self.h.max(h);
+    }
+
     fn merge(&mut self, other: Seg) {
-        union(&mut self.bbox, &other.bbox);
-        self.h = self.h.max(other.h);
+        self.extend_box(&other.bbox, other.h);
         let extra = self.extra.get_or_insert_with(Default::default);
         extra.more.push(other.first);
         if let Some(o) = other.extra {
@@ -1177,8 +1219,10 @@ fn collide(glyphs: &[&TextGlyph], height: &dyn Fn(usize) -> f32, h: f32, sc: &mu
             }
             budget -= 1;
             let (ra, rb) = (union_find(&mut sc.parent, ri), union_find(&mut sc.parent, rj));
+            let hj = height(j);
+            let script = is_script_on(&glyphs[i].rect, hi, &glyphs[j].rect, hj) || is_script_on(&glyphs[j].rect, hj, &glyphs[i].rect, hi);
             let overlap = x1.min(glyphs[j].rect[2]) - x0(j);
-            if ra != rb && overlap > RUN_COLLISION * hi.min(height(j)) {
+            if ra != rb && !script && overlap > RUN_COLLISION * hi.min(hj) {
                 sc.parent[ra] = rb;
                 collided = true;
             }
@@ -1341,11 +1385,16 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
     let mut furthest_progress = 0.0;
     for i in 0..n {
         let g = glyphs[i].rect;
+        let hi = height(i);
         let cont = segs.last().is_some_and(|s| {
             let Some(p) = s.first.end.checked_sub(1) else { return false };
-            let ph = height(p).min(height(i));
+            let ph = height(p).min(hi);
+            let sh = s.h.min(hi);
             let gap = g[0] - glyphs[p].rect[2];
-            (cy(i) - cy(p)).abs() < ph * 0.5 && gap < ph * 3.0 && g[0] > glyphs[p].rect[0] - ph * 2.0
+            let same_line = ((cy(i) - cy(p)).abs() < ph * 0.5 && gap < ph * 3.0)
+                || ((cy(i) - s.cy()).abs() < sh * 0.3 && (s.h / hi - 1.0).abs() < 0.35 && gap < sh * 3.0);
+            let on_seg = gap < s.h * 1.2 && (is_script_on(&s.bbox, s.h, &g, hi) || is_script_on(&g, hi, &s.bbox, s.h));
+            (same_line || on_seg) && g[0] > glyphs[p].rect[0] - sh * 2.0
         });
         let reset = cont && segs.last().is_some_and(|s| restarts_run(&glyphs, s.first.start, i, furthest_progress));
         if cont
@@ -1353,11 +1402,10 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
             && let Some(s) = segs.last_mut()
         {
             s.first.end = i + 1;
-            union(&mut s.bbox, &g);
-            s.h = s.h.max(height(i));
+            s.extend_box(&g, hi);
             furthest_progress = furthest_progress.max((g[0] - run_start_x).abs()).max((g[2] - run_start_x).abs());
         } else {
-            segs.push(Seg::new(Run { start: i, end: i + 1 }, g, height(i)));
+            segs.push(Seg::new(Run { start: i, end: i + 1 }, g, hi));
             run_start_x = g[0];
             furthest_progress = 0.0;
         }
@@ -1406,7 +1454,8 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
         kept_runs
     };
     segs.truncate(retained);
-    // Merge same-baseline segments that nearly touch.
+    // Merge same-baseline segments that nearly touch, then attach any remaining superscript or
+    // subscript segments to the closest host line segment they sit on.
     let mut merged = true;
     while merged {
         merged = false;
@@ -1427,6 +1476,28 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
                 }
             }
         }
+        if !merged {
+            for b in 0..segs.len() {
+                let sb = &segs[b];
+                let best_host = (0..segs.len())
+                    .filter(|&a| {
+                        if a == b {
+                            return false;
+                        }
+                        let sa = &segs[a];
+                        let gap = (sb.bbox[0] - sa.bbox[2]).max(sa.bbox[0] - sb.bbox[2]);
+                        sa.bbox[2] - sa.bbox[0] > sb.bbox[2] - sb.bbox[0] && gap < sa.h * 1.2 && is_script_on(&sa.bbox, sa.h, &sb.bbox, sb.h)
+                    })
+                    .min_by(|&a1, &a2| (segs[a1].cy() - sb.cy()).abs().total_cmp(&(segs[a2].cy() - sb.cy()).abs()));
+                if let Some(a) = best_host {
+                    let sb = segs.remove(b);
+                    let a = if b < a { a - 1 } else { a };
+                    segs[a].merge(sb);
+                    merged = true;
+                    break;
+                }
+            }
+        }
     }
 
     // 2. Blocks.
@@ -2646,4 +2717,92 @@ mod tests {
         assert_eq!(ocr_layer_text(4, false), expected, "symbolic, no /ToUnicode");
         assert_eq!(ocr_layer_text(32, true), expected, "nonsymbolic, /ToUnicode for ASCII only");
     }
+
+    /// Issue #2929: a footnote reference (superscript) on a line stays in that line instead of
+    /// splitting out as a raised segment that steals the block's tail and pushes the host line
+    /// after the paragraph.
+    #[test]
+    fn paragraph_selection_includes_lines_with_footnote_references() {
+        for inline in [true, false] {
+            let ops = if inline {
+                "BT /F1 12 Tf 1 0 0 1 40 300 Tm (First line of the paragraph) Tj \
+                 1 0 0 1 40 285 Tm (Second line with a note) Tj \
+                 /F1 8 Tf 5.5 Ts (1) Tj 0 Ts \
+                 /F1 12 Tf ( and more text) Tj \
+                 1 0 0 1 40 270 Tm (Third line of the paragraph) Tj \
+                 /F1 7 Tf 1 0 0 1 40 104 Tm (1) Tj \
+                 /F1 10 Tf 1 0 0 1 47 100 Tm (Footnote at the bottom) Tj ET"
+            } else {
+                // Superscripts drawn in a separate pass after the body text.
+                "BT /F1 12 Tf 1 0 0 1 40 300 Tm (First line of the paragraph) Tj \
+                 1 0 0 1 40 285 Tm (Second line with a note) Tj \
+                 1 0 0 1 173 285 Tm (and more text) Tj \
+                 1 0 0 1 40 270 Tm (Third line of the paragraph) Tj \
+                 /F1 10 Tf 1 0 0 1 47 100 Tm (Footnote at the bottom) Tj \
+                 /F1 8 Tf 1 0 0 1 165 290.5 Tm (1) Tj \
+                 /F1 7 Tf 1 0 0 1 40 104 Tm (1) Tj ET"
+            };
+            let text = page_glyphs(ops);
+            let start = text.nearest(40.0, 95.0).unwrap();
+            let end = text.nearest(185.0, 128.0).unwrap();
+            assert_eq!(
+                text.text_of(start..end + 1),
+                "First line of the paragraph\nSecond line with a note1 and more text\nThird line of the paragraph",
+                "inline={inline}"
+            );
+            assert_eq!(text.line_rects(start..end + 1).len(), 3, "three selected lines, inline={inline}");
+            assert_eq!(
+                text.plain_text(),
+                "First line of the paragraph\nSecond line with a note1 and more text\nThird line of the paragraph\n1 Footnote at the bottom",
+                "inline={inline}"
+            );
+        }
+
+        // Superscript on the first line, multi-character bracketed reference `[12]` on the second
+        // line, and subscript on the third line (both inline and out-of-order).
+        for inline in [true, false] {
+            let ops = if inline {
+                "BT /F1 12 Tf 1 0 0 1 40 300 Tm (Opening claim) Tj \
+                 /F1 8 Tf 5.5 Ts (1) Tj 0 Ts \
+                 /F1 12 Tf ( in the first line) Tj \
+                 1 0 0 1 40 285 Tm (Middle citation) Tj \
+                 /F1 8 Tf 5.5 Ts ([12]) Tj 0 Ts \
+                 /F1 12 Tf ( continues here) Tj \
+                 1 0 0 1 40 270 Tm (Formula H) Tj \
+                 /F1 8 Tf -3 Ts (2) Tj 0 Ts \
+                 /F1 12 Tf (O in the third line) Tj ET"
+            } else {
+                "BT /F1 12 Tf 1 0 0 1 40 300 Tm (Opening claim) Tj \
+                 1 0 0 1 125 300 Tm (in the first line) Tj \
+                 1 0 0 1 40 285 Tm (Middle citation) Tj \
+                 1 0 0 1 135 285 Tm (continues here) Tj \
+                 1 0 0 1 40 270 Tm (Formula H) Tj \
+                 1 0 0 1 101 270 Tm (O in the third line) Tj \
+                 /F1 8 Tf 1 0 0 1 117 305.5 Tm (1) Tj \
+                 1 0 0 1 117 290.5 Tm ([12]) Tj \
+                 1 0 0 1 96.5 267 Tm (2) Tj ET"
+            };
+            let text = page_glyphs(ops);
+            assert_eq!(
+                text.plain_text(),
+                "Opening claim1 in the first line\nMiddle citation[12] continues here\nFormula H2O in the third line",
+                "inline={inline}"
+            );
+            assert_eq!(text.line_rects(0..text.glyphs.len()).len(), 3, "inline={inline}");
+        }
+
+        // Justified wide gap (18pt = 1.5 * h) after an inline superscript stays on the same line,
+        // and an out-of-order superscript kerned slightly over punctuation does not break the host
+        // word via overprint collision.
+        let justified = page_glyphs(
+            "BT /F1 12 Tf 1 0 0 1 40 300 Tm (Justified clause.) Tj \
+             /F1 8 Tf 5.5 Ts (1) Tj 0 Ts \
+             /F1 12 Tf 1 0 0 1 151 300 Tm (Next sentence on the same line) Tj \
+             1 0 0 1 40 285 Tm (Kerned clause.) Tj \
+             1 0 0 1 130 285 Tm (continues cleanly) Tj \
+             /F1 8 Tf 1 0 0 1 118 290.5 Tm (2) Tj ET",
+        );
+        assert_eq!(justified.plain_text(), "Justified clause.1 Next sentence on the same line\nKerned clause.2 continues cleanly");
+        assert_eq!(justified.line_rects(0..justified.glyphs.len()).len(), 2);
+    }
 }

From 0b63f5a4ba6ef9b40703528953715cddc9e021d7 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Sat, 17 Oct 2026 05:43:46 +0200
Subject: [PATCH 008/132] fix(edit): check page backdrops with one page-tree
 walk per batch

Review of #2815: `page_of` built every page to return one, and the Add
Background dialog checked 24 pages a frame that way, so a frame cost
24 page-tree walks (93 ms at 5,000 pages, 385 ms at 20,000).

- `page_backdrops(doc, pages)` walks the tree once for a batch; the
  dialog checks one batch a frame and `doc_backdrops` one batch in all.
  A page past the end answers None without hiding the others (the
  viewer's page count can disagree with the page tree's).
- `scan` and `replace` take the page; `add_background` no longer walks
  the tree twice more per page to replace a backdrop.
- Tests: 4,000 pages checked in one batch under a generous bound (17.6 s
  with the old lookup), batch order and missing pages, and a background
  over several pages sharing streams, replaced and restored.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/src/lib.rs      |  7 ++--
 crates/edit/src/backdrop.rs       | 52 ++++++++++++-----------
 crates/edit/src/backdrop_tests.rs | 68 +++++++++++++++++++++++++++++++
 crates/edit/src/lib.rs            |  8 ++--
 crates/engine/src/lib.rs          |  9 ++++
 crates/ui-egui/src/marks_ui.rs    | 24 ++++++++---
 6 files changed, 131 insertions(+), 37 deletions(-)

diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 564dd8e882..ba4bf7ced8 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -1182,9 +1182,10 @@ impl Automation {
         };
         let doc = self.doc(a)?;
         let found: Vec<Value> = pages
-            .into_iter()
-            .filter_map(|p| {
-                let kind = match doc.page_backdrop(p)? {
+            .iter()
+            .zip(doc.page_backdrops(&pages))
+            .filter_map(|(p, found)| {
+                let kind = match found? {
                     pdfcraft_engine::Backdrop::Fill => "fill",
                     pdfcraft_engine::Backdrop::Image => "image",
                 };
diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
index d15652f82b..967a8f9121 100644
--- a/crates/edit/src/backdrop.rs
+++ b/crates/edit/src/backdrop.rs
@@ -25,7 +25,8 @@ const SCAN_BYTES: usize = 64 * 1024;
 const SCAN_OPS: usize = 4096;
 /// How far (in points) a backdrop may fall short of the crop box and still count as covering it.
 const COVER_EPS: f64 = 1.0;
-/// Components at least this close to white (per channel) count as white.
+/// Components at least this close to white (per channel) count as white: a near-white fill
+/// (`0.99 g`) is a backdrop too, and replacing it changes the page by at most 2%.
 const WHITE: f64 = 0.98;
 
 /// What paints a page's backdrop.
@@ -57,15 +58,26 @@ struct State {
     opaque: bool,
 }
 
-/// The backdrop `page` (0-based) paints, if any.
+/// The backdrop `page` (0-based) paints, if any. Finding the page walks the page tree, so to
+/// check many pages use [`page_backdrops`], which walks it once.
 pub fn page_backdrop(doc: &Document, page: usize) -> Result<Option<Backdrop>, EditError> {
-    Ok(scan(doc, page)?.map(|(b, _)| b))
+    let all = pdfcraft_model::pages(doc);
+    let p = all.get(page).ok_or(EditError::NoSuchPage(page))?;
+    Ok(scan(doc, p).map(|(b, _)| b))
+}
+
+/// The backdrop each of `pages` (0-based) paints, in the same order, walking the page tree once.
+/// A page past the end has none, and doesn't hide what the others paint: a page count taken
+/// elsewhere (the viewer's) can disagree with the page tree's on a malformed document.
+pub fn page_backdrops(doc: &Document, pages: &[usize]) -> Vec<Option<Backdrop>> {
+    let all = pdfcraft_model::pages(doc);
+    pages.iter().map(|&p| all.get(p).and_then(|page| scan(doc, page)).map(|(b, _)| b)).collect()
 }
 
 /// Replace `page`'s white backdrop fill, if it has one (see the module doc). Returns whether it
-/// did. A picture backdrop is left alone.
-pub(crate) fn replace(doc: &mut Document, page: usize) -> Result<bool, EditError> {
-    let Some((Backdrop::Fill, Some(found))) = scan(doc, page)? else { return Ok(false) };
+/// did; when it did, `page` no longer matches the document. A picture backdrop is left alone.
+pub(crate) fn replace(doc: &mut Document, page: &pdfcraft_model::Page) -> Result<bool, EditError> {
+    let Some((Backdrop::Fill, Some(found))) = scan(doc, page) else { return Ok(false) };
     let edited = found.pieces.splice([(found.op.clone(), b"n".to_vec())]);
     let piece = found.pieces.piece_of(found.op.start);
     let (Some(&(slot, original)), Some(bytes)) = (found.refs.get(piece), edited.get(piece)) else { return Ok(false) };
@@ -80,11 +92,10 @@ pub(crate) fn replace(doc: &mut Document, page: usize) -> Result<bool, EditError
     let mut dict = Dict::new();
     dict.set(b"PCBackdrop".to_vec(), Object::Dict(note));
     let copy = doc.add(Object::Stream(Stream::flate(dict, bytes)));
-    let p = page_of(doc, page)?;
-    let mut list = crate::contents(doc, &p)?;
+    let mut list = crate::contents(doc, page)?;
     let Some(entry) = list.get_mut(slot) else { return Ok(false) };
     *entry = Object::Ref(copy);
-    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+    doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
     Ok(true)
 }
 
@@ -124,20 +135,13 @@ fn unchanged_copy_of(doc: &Document, entry: &Object) -> Option<ObjRef> {
     (copy.decoded().ok()? == expect).then_some(*original)
 }
 
-fn page_of(doc: &Document, page: usize) -> Result<pdfcraft_model::Page, EditError> {
-    pdfcraft_model::pages(doc).into_iter().nth(page).ok_or(EditError::NoSuchPage(page))
-}
-
 /// Find the backdrop, and for a fill, where it is.
-fn scan(doc: &Document, page: usize) -> Result<Option<(Backdrop, Option<Found>)>, EditError> {
-    let p = page_of(doc, page)?;
+fn scan(doc: &Document, p: &pdfcraft_model::Page) -> Option<(Backdrop, Option<Found>)> {
     let crop = p.crop(doc);
-    let list: Vec<Object> = match p.dict.get(b"Contents") {
-        None => return Ok(None),
-        Some(c) => match &*doc.resolve(c) {
-            Object::Array(a) => a.clone(),
-            _ => vec![c.clone()],
-        },
+    let c = p.dict.get(b"Contents")?;
+    let list: Vec<Object> = match &*doc.resolve(c) {
+        Object::Array(a) => a.clone(),
+        _ => vec![c.clone()],
     };
     // The page's own content: untagged streams (marks and the q/Q wrapper carry /PCMark). Read
     // only as far as a backdrop could be.
@@ -148,7 +152,7 @@ fn scan(doc: &Document, page: usize) -> Result<Option<(Backdrop, Option<Found>)>
         if total >= SCAN_BYTES {
             break;
         }
-        let Object::Ref(r) = o else { return Ok(None) };
+        let Object::Ref(r) = o else { return None };
         let obj = doc.get(*r);
         let Object::Stream(s) = &*obj else { continue };
         if s.dict.get(b"PCMark").is_some() {
@@ -164,10 +168,10 @@ fn scan(doc: &Document, page: usize) -> Result<Option<(Backdrop, Option<Found>)>
     let parsed = pdfcraft_content::parse(head);
     let res = resources(doc, &p.dict);
     let found = walk(doc, &res, crop, &parsed.ops);
-    Ok(found.map(|(b, op)| match (b, op) {
+    found.map(|(b, op)| match (b, op) {
         (Backdrop::Fill, Some(op)) => (b, Some(Found { refs, pieces, op })),
         _ => (b, None),
-    }))
+    })
 }
 
 fn resources(doc: &Document, page: &Dict) -> Dict {
diff --git a/crates/edit/src/backdrop_tests.rs b/crates/edit/src/backdrop_tests.rs
index 88f058b4f5..5dc1d80e41 100644
--- a/crates/edit/src/backdrop_tests.rs
+++ b/crates/edit/src/backdrop_tests.rs
@@ -231,3 +231,71 @@ fn pages_without_content_or_with_odd_contents_have_no_backdrop() {
     assert_eq!(page_backdrop(&doc, 1).unwrap(), None);
     assert!(matches!(page_backdrop(&doc, 7), Err(EditError::NoSuchPage(7))));
 }
+
+/// `pages` 300 × 200 pages in a flat tree; even pages paint a white backdrop, odd ones don't.
+fn many_pages(pages: usize) -> Document {
+    let kids: Vec<String> = (0..pages).map(|i| format!("{} 0 R", i + 5)).collect();
+    let mut objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        format!("<< /Type /Pages /Kids [{}] /Count {pages} /MediaBox [0 0 300 200] >>", kids.join(" ")),
+        stream("", &format!("1 g 0 0 300 200 re f 0 g {TEXT}")),
+        stream("", TEXT),
+    ];
+    objs.extend((0..pages).map(|i| format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R >>", 3 + i % 2)));
+    build(&objs)
+}
+
+#[test]
+fn checking_many_pages_walks_the_page_tree_once() {
+    // The Add Background dialog checks every page of a long document. Looking each page up on
+    // its own walked the whole tree per page, so checking them all grew with the square of the
+    // page count (minutes at 20,000 pages); one walk keeps it in proportion.
+    const PAGES: usize = 4000;
+    let doc = many_pages(PAGES);
+    let all: Vec<usize> = (0..PAGES).collect();
+    let start = std::time::Instant::now();
+    let found = page_backdrops(&doc, &all);
+    let took = start.elapsed();
+    assert_eq!(found.len(), PAGES);
+    for (i, f) in found.iter().enumerate() {
+        assert_eq!(*f, (i % 2 == 0).then_some(Backdrop::Fill), "page {i}");
+    }
+    assert!(took < std::time::Duration::from_secs(5), "checking {PAGES} pages took {took:?}");
+}
+
+#[test]
+fn a_batch_answers_in_the_order_asked_and_a_missing_page_hides_nothing() {
+    let doc = many_pages(5);
+    assert_eq!(page_backdrops(&doc, &[3, 0, 0]), [None, Some(Backdrop::Fill), Some(Backdrop::Fill)]);
+    assert_eq!(page_backdrops(&doc, &[]), []);
+    // The viewer can count more pages than the page tree holds: the others still answer.
+    assert_eq!(page_backdrops(&doc, &[2, 5, usize::MAX]), [Some(Backdrop::Fill), None, None]);
+    assert_eq!(page_backdrop(&doc, 4).unwrap(), Some(Backdrop::Fill));
+    assert!(matches!(page_backdrop(&doc, 5), Err(EditError::NoSuchPage(5))));
+}
+
+#[test]
+fn a_background_over_many_pages_replaces_each_backdrop_and_removing_restores_them() {
+    // Pages share their content streams, so each replaced page gets its own copy and the rest
+    // are checked against the document as it is after the earlier ones.
+    let mut doc = many_pages(4);
+    let all = [0, 1, 2, 3];
+    let before: Vec<Object> = pdfcraft_model::pages(&doc).iter().filter_map(|p| p.dict.get(b"Contents").cloned()).collect();
+    add_background(&mut doc, &all, &red(), true).unwrap();
+    assert_eq!(page_backdrops(&doc, &all), [None; 4]);
+    // Update: the backdrops are gone already, so nothing is copied again.
+    add_background(&mut doc, &all, &red(), true).unwrap();
+    assert_eq!(page_backdrops(&doc, &all), [None; 4]);
+    remove_marks(&mut doc, &all, MarkKind::Background).unwrap();
+    let after: Vec<Object> = pdfcraft_model::pages(&doc).iter().filter_map(|p| p.dict.get(b"Contents").cloned()).collect();
+    let refs = |list: &[Object]| -> Vec<Vec<Object>> {
+        list.iter()
+            .map(|c| match &*doc.resolve(c) {
+                Object::Array(a) => a.clone(),
+                _ => vec![c.clone()],
+            })
+            .collect()
+    };
+    assert_eq!(refs(&after), refs(&before), "every page points at its original stream again");
+    assert_eq!(page_backdrops(&doc, &all), [Some(Backdrop::Fill), None, Some(Backdrop::Fill), None]);
+}
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index a8ab1d51b5..802a258eb7 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -599,10 +599,10 @@ pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, repl
     }
     let opacity = if bg.opacity.is_finite() { bg.opacity.clamp(0.0, 1.0) } else { 1.0 };
     for &i in pages {
-        if bg.replace_backdrop {
-            backdrop::replace(doc, i)?;
+        let mut page = page_list(doc)[i].clone();
+        if bg.replace_backdrop && backdrop::replace(doc, &page)? {
+            page = page_list(doc)[i].clone();
         }
-        let page = page_list(doc)[i].clone();
         let (w, h) = page.display_size(doc);
         let mut content = begin(MarkKind::Background, "Background", page.view_matrix(doc));
         match &bg.source {
@@ -659,7 +659,7 @@ pub fn marks_present(doc: &Document) -> Vec<MarkKind> {
 }
 
 pub mod backdrop;
-pub use backdrop::{Backdrop, page_backdrop};
+pub use backdrop::{Backdrop, page_backdrop, page_backdrops};
 pub mod objects;
 pub use objects::{EditableObject, MAX_MOVE_OBJECTS, ObjectKind, ObjectTarget, editable_objects, move_objects};
 
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 0f81fb22de..0967f56524 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -504,6 +504,15 @@ impl Document {
         self.editor.as_ref().and_then(|e| pdfcraft_edit::page_backdrop(&e.cos, page).ok().flatten())
     }
 
+    /// [`Self::page_backdrop`] for each of `pages`, in order, walking the page tree once: the
+    /// way to check many pages. A page out of range has none.
+    pub fn page_backdrops(&self, pages: &[usize]) -> Vec<Option<pdfcraft_edit::Backdrop>> {
+        match &self.editor {
+            Some(e) => pdfcraft_edit::page_backdrops(&e.cos, pages),
+            None => vec![None; pages.len()],
+        }
+    }
+
     /// Edit a PDF: the images `page` draws (0-based).
     pub fn page_images(&self, page: usize) -> Vec<pdfcraft_edit::PageImage> {
         self.editor.as_ref().and_then(|e| pdfcraft_edit::page_images(&e.cos, page).ok()).unwrap_or_default()
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index ed2490737c..c838f7861e 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -105,14 +105,26 @@ impl BackdropCheck {
             self.key = Some(key);
             self.pages = vec![None; count];
         }
-        let mut budget = BACKDROP_PAGES_PER_FRAME;
+        // One batch a frame: finding a page walks the page tree, so the batch shares one walk.
+        let mut batch = Vec::with_capacity(BACKDROP_PAGES_PER_FRAME);
+        for &p in pages {
+            if batch.len() >= BACKDROP_PAGES_PER_FRAME {
+                break;
+            }
+            if matches!(self.pages.get(p), Some(None)) && !batch.contains(&p) {
+                batch.push(p);
+            }
+        }
+        if !batch.is_empty() {
+            for (p, found) in batch.iter().zip(doc.page_backdrops(&batch)) {
+                if let Some(slot) = self.pages.get_mut(*p) {
+                    *slot = Some(found);
+                }
+            }
+        }
         let mut n = BackdropCount::default();
         for &p in pages {
-            let Some(slot) = self.pages.get_mut(p) else { continue };
-            if slot.is_none() && budget > 0 {
-                *slot = Some(doc.page_backdrop(p));
-                budget -= 1;
-            }
+            let Some(slot) = self.pages.get(p) else { continue };
             match slot {
                 None => n.pending += 1,
                 Some(Some(Backdrop::Fill)) => n.fills += 1,

From 341e006b950dd38ecaf3f54d58e0cf18fd0d735f Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Sat, 17 Oct 2026 20:53:54 +0800
Subject: [PATCH 009/132] fix(render): batch out-of-order script merges and pin
 leading-script extend_box (#2929)

---
 crates/render/src/text.rs | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index 064a68d093..b2a2d914c5 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -1477,7 +1477,8 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
             }
         }
         if !merged {
-            for b in 0..segs.len() {
+            let mut b = 0;
+            while b < segs.len() {
                 let sb = &segs[b];
                 let best_host = (0..segs.len())
                     .filter(|&a| {
@@ -1494,7 +1495,8 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
                     let a = if b < a { a - 1 } else { a };
                     segs[a].merge(sb);
                     merged = true;
-                    break;
+                } else {
+                    b += 1;
                 }
             }
         }
@@ -2804,5 +2806,17 @@ mod tests {
         );
         assert_eq!(justified.plain_text(), "Justified clause.1 Next sentence on the same line\nKerned clause.2 continues cleanly");
         assert_eq!(justified.line_rects(0..justified.glyphs.len()).len(), 2);
+
+        // A line that begins with a raised superscript marker and continues with taller body text
+        // adopts the body text's vertical band (Seg::extend_box first branch) so a later
+        // out-of-order superscript on that line still measures against the body baseline.
+        let leading_script = page_glyphs(
+            "BT /F1 8 Tf 1 0 0 1 40 300 Tm 6 Ts (1) Tj 0 Ts \
+             /F1 12 Tf ( See the appendix) Tj \
+             1 0 0 1 146 300 Tm (for details) Tj \
+             /F1 8 Tf 1 0 0 1 139 303.6 Tm (2) Tj ET",
+        );
+        assert_eq!(leading_script.plain_text(), "1 See the appendix2 for details");
+        assert_eq!(leading_script.line_rects(0..leading_script.glyphs.len()).len(), 1);
     }
 }

From 22064736cd7bd9a7163a60089e19bd27dced36fa Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Sun, 18 Oct 2026 11:00:07 +0800
Subject: [PATCH 010/132] M2: pin leading superscript line geometry regression
 (#2929)

---
 ROADMAP.md                |  2 ++
 crates/render/src/text.rs | 27 ++++++++++++++++++++++++++-
 docs/roadmap.md           |  2 +-
 3 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index c895ed2c3d..9501136aab 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -160,6 +160,8 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 | 8 | 1.0 polish: performance, right-to-left, missing languages, keyboard-only (M14) | 55–95 |
 
 ## Progress log
+
+- **2026-10-18 (M2, #2929):** Pin leading-superscript segment height and baseline separately from the selection highlight, which includes the raised marker. Regression assertions distinguish the body band from a union pulled upward by the marker; estimates unchanged.
 - **2026-10-15 (M6, AcroForm XML text):** Plain AcroForm XML imports retain all direct text around comments and processing instructions, including CDATA and character references. Synthetic regressions verify exact values and unknown catalog data after incremental and full save/reopen. Nested-element and XFA interpretation are unchanged. Estimates unchanged.
 - **2026-10-15 (M6, #1917 refresh):** Integrated upstream `99941daa` while retaining the XML/XFDF attribute whitespace correction and all upstream progress. Only independent documentation conflicts required resolution; focused production and test files are unchanged from the previously green CI head. Estimates unchanged.
 - **2026-10-15 (M1, #2267 refresh):** Integrated upstream `99941daa` while retaining the raw-deflate fallback correction and all upstream progress. Only independent documentation conflicts required resolution; focused production and test files are unchanged from the previously green CI head. Estimates unchanged.
diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index b2a2d914c5..11bdd0c590 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -2817,6 +2817,31 @@ mod tests {
              /F1 8 Tf 1 0 0 1 139 303.6 Tm (2) Tj ET",
         );
         assert_eq!(leading_script.plain_text(), "1 See the appendix2 for details");
-        assert_eq!(leading_script.line_rects(0..leading_script.glyphs.len()).len(), 1);
+        let rects = leading_script.line_rects(0..leading_script.glyphs.len());
+        assert_eq!(rects.len(), 1);
+        let marker = leading_script.glyphs.first().unwrap().rect;
+        let body = leading_script.glyphs.iter().find(|g| g.text == "S").unwrap().rect;
+        let last = leading_script.glyphs.last().unwrap().rect;
+        assert!(marker[1] < body[1] && marker[3] < body[3], "marker must be raised above the body");
+        let close = |actual: f32, expected: f32| assert!((actual - expected).abs() < 0.001, "{actual} != {expected}");
+        // Highlight rectangles cover the actual glyphs, including the raised marker. They do
+        // not expose the segment's baseline band used for line grouping.
+        for (actual, expected) in rects[0].into_iter().zip([marker[0], marker[1], last[2], body[3]]) {
+            close(actual, expected);
+        }
+        close(rects[0][3] - rects[0][1], 14.8);
+        close(body[3] - 0.2 * 12.0, 100.0); // 300 pt PDF baseline on a 400 pt page.
+
+        // Pin that internal band too: replacing the first extend_box condition with `false`
+        // must fail here even when plain text and highlight rectangles remain unchanged.
+        let mut segment = Seg::new(Run { start: 0, end: 1 }, marker, marker[3] - marker[1]);
+        segment.extend_box(&body, body[3] - body[1]);
+        for (actual, expected) in segment.bbox.into_iter().zip([marker[0], body[1], body[2], body[3]]) {
+            close(actual, expected);
+        }
+        close(segment.h, 12.0);
+        close(segment.bbox[3] - segment.bbox[1], 12.0);
+        close(segment.bbox[3] - 0.2 * segment.h, 100.0);
+        close(segment.cy(), (body[1] + body[3]) / 2.0);
     }
 }
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 2c65496b6e..8bbf6e7b07 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -101,7 +101,7 @@ total matches the parity estimate.
 |---|---|---|---|---|---|
 | M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 98% | 1–2 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
 | M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 80% | 20–40 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. An unchanged incremental save of a classic table writes a zero-length cross-reference subsection instead of a section with no subsections (#1339). A full rewrite keeps unknown trailer entries, including objects reachable only from them (#1338). Fuzzing runs nightly (`xtask fuzz`). Raw-deflate fallback preserves decoding-limit errors, including through tolerant COS stream decoding. Refreshed against upstream `99941daa` (2026-10-15). Missing: ≥ 250 tests, own image codecs |
-| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized. |
+| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized.  Leading-superscript regression coverage checks the body segment height and baseline separately from glyph-union highlights (#2929). |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. The renderer keeps its one-point crop-size floor in physical points after UserUnit scaling, with regression coverage for crop origins, rotations and f32 reciprocal rounding. Existing unit policy and nearly-zero fallback are retained. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. |

From eca16e6bd50f6261e9af557809eb842d199a56fe Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Sun, 18 Oct 2026 16:24:14 +0200
Subject: [PATCH 011/132] fix(edit): backdrop copies keep the stream dictionary
 and every slot

Review of #2815 (CodeRabbit):

- A content stream whose bytes live in an external file (`/F`) draws
  those, not its inline bytes, so it is never taken for a backdrop.
- The copy keeps the original stream dictionary, unknown entries
  included, less `Length` and `DL` (Flate re-encodes it); it had started
  from an empty dictionary.
- Every `/Contents` slot that lists the original stream gets the copy: a
  page listing the same stream twice painted the white fill again over
  the background.
- The Background dialog starts with replacing on each time it opens.
  Update restores backdrops before re-applying, so a replaced page shows
  no fill and no checkbox, and a choice left off from an earlier dialog
  hid the background again unseen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/edit/src/backdrop.rs            | 29 +++++++++++---
 crates/edit/src/backdrop_tests.rs      | 52 ++++++++++++++++++++++++++
 crates/ui-egui/src/commands.rs         |  1 +
 crates/ui-egui/src/lib.rs              |  3 ++
 crates/ui-egui/src/marks_ui.rs         | 12 ++++++
 crates/ui-egui/tests/ui_group/marks.rs | 16 +++++---
 6 files changed, 102 insertions(+), 11 deletions(-)

diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
index 967a8f9121..86924b8cb7 100644
--- a/crates/edit/src/backdrop.rs
+++ b/crates/edit/src/backdrop.rs
@@ -80,7 +80,7 @@ pub(crate) fn replace(doc: &mut Document, page: &pdfcraft_model::Page) -> Result
     let Some((Backdrop::Fill, Some(found))) = scan(doc, page) else { return Ok(false) };
     let edited = found.pieces.splice([(found.op.clone(), b"n".to_vec())]);
     let piece = found.pieces.piece_of(found.op.start);
-    let (Some(&(slot, original)), Some(bytes)) = (found.refs.get(piece), edited.get(piece)) else { return Ok(false) };
+    let (Some(&(_, original)), Some(bytes)) = (found.refs.get(piece), edited.get(piece)) else { return Ok(false) };
     // Where the operator sits in that piece: the joined offset less the pieces before it.
     let before: usize = (0..piece).filter_map(|i| edited.get(i)).map(|p| p.len() + 1).sum();
     let at = found.op.start.saturating_sub(before);
@@ -89,14 +89,27 @@ pub(crate) fn replace(doc: &mut Document, page: &pdfcraft_model::Page) -> Result
     note.set(b"Original".to_vec(), Object::Ref(original));
     note.set(b"At".to_vec(), Object::Int(i64::try_from(at).unwrap_or(i64::MAX)));
     note.set(b"Len".to_vec(), Object::Int(i64::try_from(len).unwrap_or(i64::MAX)));
-    let mut dict = Dict::new();
+    // The copy keeps the original's dictionary (unknown entries included) less what describes
+    // the old encoding; `scan` refused streams whose bytes live in an external file (`/F`).
+    let Object::Stream(source) = &*doc.get(original) else { return Ok(false) };
+    let mut dict = source.dict.clone();
+    for key in [&b"Length"[..], b"DL", b"PCBackdrop"] {
+        dict.remove(key);
+    }
     dict.set(b"PCBackdrop".to_vec(), Object::Dict(note));
     let copy = doc.add(Object::Stream(Stream::flate(dict, bytes)));
+    // Every slot that draws the original: a page may list the same stream twice, and a second
+    // copy of the fill would cover the background again.
     let mut list = crate::contents(doc, page)?;
-    let Some(entry) = list.get_mut(slot) else { return Ok(false) };
-    *entry = Object::Ref(copy);
-    doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
-    Ok(true)
+    let mut replaced = false;
+    for entry in list.iter_mut().filter(|o| matches!(o, Object::Ref(r) if *r == original)) {
+        *entry = Object::Ref(copy);
+        replaced = true;
+    }
+    if replaced {
+        doc.update_dict(page.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+    }
+    Ok(replaced)
 }
 
 /// Put back the original content streams [`replace`] copied on `page`, where the copy is still
@@ -158,6 +171,10 @@ fn scan(doc: &Document, p: &pdfcraft_model::Page) -> Option<(Backdrop, Option<Fo
         if s.dict.get(b"PCMark").is_some() {
             continue;
         }
+        // Bytes in an external file (`/F`) replace the stream's own: what it draws is unknown here.
+        if s.dict.get(b"F").is_some() {
+            return None;
+        }
         let bytes = s.decoded().unwrap_or_default();
         total = total.saturating_add(bytes.len()).saturating_add(1);
         refs.push((slot, *r));
diff --git a/crates/edit/src/backdrop_tests.rs b/crates/edit/src/backdrop_tests.rs
index 5dc1d80e41..1c0744b59c 100644
--- a/crates/edit/src/backdrop_tests.rs
+++ b/crates/edit/src/backdrop_tests.rs
@@ -299,3 +299,55 @@ fn a_background_over_many_pages_replaces_each_backdrop_and_removing_restores_the
     assert_eq!(refs(&after), refs(&before), "every page points at its original stream again");
     assert_eq!(page_backdrops(&doc, &all), [Some(Backdrop::Fill), None, Some(Backdrop::Fill), None]);
 }
+
+#[test]
+fn a_content_stream_whose_bytes_live_in_an_external_file_is_left_alone() {
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents [4 0 R] >>".into(),
+        stream("/F (content.bin)", &format!("1 g 0 0 300 200 re f {TEXT}")),
+    ];
+    let mut doc = build(&objs);
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), None, "the inline bytes are not what the page draws");
+    let before = streams(&doc);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    assert_eq!(streams(&doc)[1..], before[..]);
+}
+
+#[test]
+fn the_backdrop_copy_keeps_the_original_dictionary_less_its_old_encoding() {
+    let objs = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents [4 0 R] >>".into(),
+        stream("/Vendor (keep me) /DL 9999", &format!("1 g 0 0 300 200 re f {TEXT}")),
+    ];
+    let mut doc = build(&objs);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    let doc = reopen(&doc);
+    let p = &pdfcraft_model::pages(&doc)[0];
+    let Some(Object::Array(list)) = p.dict.get(b"Contents").map(|c| (*doc.resolve(c)).clone()) else { panic!("contents") };
+    let Object::Stream(copy) = &*doc.resolve(&list[1]) else { panic!("a stream") };
+    assert!(copy.dict.get(b"Vendor").is_some(), "unknown entries survive");
+    assert!(copy.dict.get(b"DL").is_none(), "the old decoded length no longer holds");
+    assert!(copy.dict.get(b"PCBackdrop").is_some());
+    assert_eq!(String::from_utf8_lossy(&copy.decoded().unwrap()), format!("1 g 0 0 300 200 re n {TEXT}"));
+}
+
+#[test]
+fn a_stream_listed_twice_is_replaced_in_both_slots_and_restored_in_both() {
+    let mut doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents [4 0 R 4 0 R] >>".into(),
+        stream("", &format!("q 1 g 0 0 300 200 re f Q {TEXT}")),
+    ]);
+    let original = streams(&doc);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    let s = streams(&doc);
+    assert_eq!(s.len(), 3, "{s:?}");
+    assert!(s[1..].iter().all(|c| c.contains("re n") && !c.contains("re f")), "no slot still paints the white fill: {s:?}");
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&doc), original);
+}
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 832ce7cfbd..d32aedeef9 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -371,6 +371,7 @@ impl PdfCraftApp {
                     K::Background
                 };
                 self.marks_draft.replace = id.ends_with(".update");
+                self.marks_draft.opened(kind);
                 self.dialog = Some(Dialog::Marks(kind));
             }
             "edit.bates" => {
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 725bcad4b0..3e817d2717 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -2557,6 +2557,9 @@ impl PdfCraftApp {
                     }
                     "none" => None,
                     _ => Some(Dialog::About),
+                };
+                if let Some(Dialog::Marks(kind)) = self.dialog {
+                    self.marks_draft.opened(kind);
                 }
             }
             ("tools", _) => self.all_tools_expanded = value != "collapsed",
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index c838f7861e..a555b437e2 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -136,6 +136,18 @@ impl BackdropCheck {
     }
 }
 
+impl MarksDraft {
+    /// The dialog for `kind` is opening. Other settings carry over from last time, but replacing
+    /// a page's own backdrop starts on: Update restores backdrops before it re-applies, so a
+    /// page whose backdrop was replaced shows none and the checkbox stays hidden, and a choice
+    /// left off from an earlier dialog would hide the background again unseen.
+    pub fn opened(&mut self, kind: MarkKind) {
+        if kind == MarkKind::Background {
+            self.bg.replace_backdrop = true;
+        }
+    }
+}
+
 /// "1 page" or "{n} pages", in a message.
 fn pages_phrase(n: usize, one: &str, many: &str) -> String {
     if n == 1 { one.to_string() } else { crate::i18n::fmt(many, &[("n", &n.to_string())]) }
diff --git a/crates/ui-egui/tests/ui_group/marks.rs b/crates/ui-egui/tests/ui_group/marks.rs
index 3a9864ea47..20b8a41a19 100644
--- a/crates/ui-egui/tests/ui_group/marks.rs
+++ b/crates/ui-egui/tests/ui_group/marks.rs
@@ -148,18 +148,24 @@ fn the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scan
     assert_eq!(backdrop(&h, 0), Some(pdfcraft_engine::Backdrop::Fill));
     assert!(h.state_mut().execute("edit.undo"));
     h.run_steps(2);
-    // Ticked, it is replaced; the scan is reported, not touched.
+    // Reopened, the choice starts on again; ticked, the backdrop is replaced and the scan is
+    // reported, not touched.
     h.state_mut().execute("edit.background");
     h.run_steps(3);
-    h.get_by_label(replace).click();
-    h.run_steps(2);
-    assert!(h.state().marks_draft.bg.replace_backdrop);
+    h.get_by_label(replace);
+    assert!(h.state().marks_draft.bg.replace_backdrop, "on again when the dialog opens");
     h.get_by_label("OK").click();
     h.run_steps(3);
     assert_eq!(backdrop(&h, 0), None);
     assert_eq!(backdrop(&h, 1), Some(pdfcraft_engine::Backdrop::Image));
-    // Nothing left to replace: the offer is gone.
+    // Nothing left to replace: the offer is gone. A choice left off from an earlier dialog
+    // doesn't carry into Update, which restores the backdrop first and would otherwise keep it
+    // with no checkbox shown.
+    h.state_mut().marks_draft.bg.replace_backdrop = false;
     h.state_mut().execute("edit.background.update");
     h.run_steps(3);
     assert!(h.query_by_label(replace).is_none());
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(backdrop(&h, 0), None, "Update keeps the backdrop replaced");
 }

From 2512b49f803ed74d50932076b8ba8ffcc7fd2e2e Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Mon, 19 Oct 2026 04:59:52 +0800
Subject: [PATCH 012/132] test(render): derive leading-superscript selection
 range via Text::nearest (#2960)

---
 crates/render/src/text.rs | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index 7f1cd3aea6..e4b883c351 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -2966,11 +2966,17 @@ mod tests {
              /F1 8 Tf 1 0 0 1 139 303.6 Tm (2) Tj ET",
         );
         assert_eq!(leading_script.plain_text(), "1 See the appendix2 for details");
-        let rects = leading_script.line_rects(0..leading_script.glyphs.len());
-        assert_eq!(rects.len(), 1);
         let marker = leading_script.glyphs.first().unwrap().rect;
         let body = leading_script.glyphs.iter().find(|g| g.text == "S").unwrap().rect;
         let last = leading_script.glyphs.last().unwrap().rect;
+        let center = |r: [f32; 4]| ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+        let (start_x, start_y) = center(marker);
+        let (end_x, end_y) = center(last);
+        let start = leading_script.nearest(start_x, start_y).unwrap();
+        let end = leading_script.nearest(end_x, end_y).unwrap();
+        assert_eq!(leading_script.text_of(start..end + 1), "1 See the appendix2 for details");
+        let rects = leading_script.line_rects(start..end + 1);
+        assert_eq!(rects.len(), 1);
         assert!(marker[1] < body[1] && marker[3] < body[3], "marker must be raised above the body");
         let close = |actual: f32, expected: f32| assert!((actual - expected).abs() < 0.001, "{actual} != {expected}");
         // Highlight rectangles cover the actual glyphs, including the raised marker. They do

From ec34fc2c2d8b87cdfe9b7063a57a74eb6c507f73 Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Mon, 19 Oct 2026 12:54:45 +0800
Subject: [PATCH 013/132] fix(ui): pin session clock in prepare button-label
 test to prevent ModDate second-boundary flake

---
 crates/ui-egui/src/dialogs.rs   | 1 +
 crates/ui-egui/tests/prepare.rs | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 981db214b2..9f5d18dc3a 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -1387,6 +1387,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
         app.props_draft = None;
         app.view_draft = None;
         app.bulk_field_props = None;
+        app.field_props = None;
     } else {
         app.dialog = Some(next);
     }
diff --git a/crates/ui-egui/tests/prepare.rs b/crates/ui-egui/tests/prepare.rs
index d63df5232c..3e9d80c0ae 100644
--- a/crates/ui-egui/tests/prepare.rs
+++ b/crates/ui-egui/tests/prepare.rs
@@ -254,6 +254,8 @@ fn options_tab_sets_the_check_box_style() {
 fn button_label_is_editable_without_renaming_the_field() {
     use pdfcraft_engine::{Edit, NewField};
     let mut h = harness();
+    // Saves stamp /ModDate from the clock; pinned, two saves compare equal across a second.
+    h.state_mut().session = std::mem::take(&mut h.state_mut().session).with_clock(|| 1_700_000_000);
     h.state_mut().apply_edit(Edit::AddField {
         page: 0,
         rect: [40.0, 300.0, 190.0, 330.0],

From c05f00c67a148b66235c61f05dbdbf8773b48b25 Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Thu, 22 Oct 2026 16:07:14 +0800
Subject: [PATCH 014/132] fix(engine): generate Protect keys and salts with
 getrandom (#4000)

---
 Cargo.lock                 |  1 +
 crates/engine/Cargo.toml   |  4 +++
 crates/engine/src/lib.rs   | 27 +++++++-------
 crates/engine/src/tests.rs | 72 ++++++++++++++++++++++++++++++++++++++
 4 files changed, 91 insertions(+), 13 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a950149243..caa23b2662 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4109,6 +4109,7 @@ version = "0.11.0"
 dependencies = [
  "chrono",
  "craft-docpath",
+ "getrandom 0.4.3",
  "icu_properties",
  "idna",
  "image",
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index f5e35088b5..6dae6adf0a 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -51,6 +51,10 @@ unicode-segmentation = "1.13"
 # Already in the graph through lopdf; used only for the local UTC offset ("today"). The workspace
 # entry is std-only; this target adds `clock` for `chrono::Local::now`.
 chrono = { workspace = true, features = ["clock"] }
+getrandom = "0.4"
+
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+getrandom = { version = "0.4", features = ["wasm_js"] }
 
 [dev-dependencies]
 pdfcraft-testkit = { workspace = true }
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index e20cbc596e..e61d5fef36 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -2349,6 +2349,7 @@ struct EditCtx {
     today: (i64, u32, u32),
     seed: u64,
     count: u64,
+    rng: fn(&mut [u8]) -> Result<(), getrandom::Error>,
     /// Fields the edit renamed to keep imported names separate (old → new), for the repair
     /// log and the undo label.
     renamed_fields: Vec<(String, String)>,
@@ -2377,23 +2378,20 @@ impl EditCtx {
             today: (1970, 1, 1),
             seed,
             count: 0,
+            rng: getrandom::fill,
             renamed_fields: Vec::new(),
         }
     }
 
-    /// 32 bytes of entropy for new encryption keys and salts. `RandomState` is seeded by the
-    /// operating system, so no extra dependency is needed.
-    fn entropy(&mut self) -> [u8; 32] {
-        use std::hash::{BuildHasher, Hasher};
+    /// 32 bytes of entropy for new encryption keys, salts and generated owner passwords from the
+    /// platform CSPRNG. Fails closed when secure randomness is unavailable.
+    fn entropy(&mut self) -> Result<[u8; 32], EditError> {
         let mut out = [0u8; 32];
-        for (i, chunk) in out.chunks_mut(8).enumerate() {
-            let mut h = std::collections::hash_map::RandomState::new().build_hasher();
-            h.write_u64(self.seed ^ i as u64);
-            h.write_u64(self.count);
-            self.count += 1;
-            chunk.copy_from_slice(&h.finish().to_le_bytes());
+        (self.rng)(&mut out).map_err(|e| EditError::Protection(format!("no secure randomness available: {e}")))?;
+        if out == [0u8; 32] {
+            return Err(EditError::Protection("no secure randomness available".into()));
         }
-        out
+        Ok(out)
     }
 
     /// A fresh `/NM`: a random-looking UUID (version 4 layout) from a splitmix64 stream.
@@ -2806,10 +2804,13 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
         }
         Edit::Protect(p) => {
             p.validate()?;
-            let seed = cx.entropy();
+            let seed = cx.entropy()?;
             // Without a permissions password nothing is restricted, so the owner password is a
             // random one nobody needs.
-            let random_owner: String = cx.entropy().iter().map(|b| format!("{b:02x}")).collect();
+            let random_owner = match p.permissions_password {
+                Some(_) => String::new(),
+                None => cx.entropy()?.iter().map(|b| format!("{b:02x}")).collect(),
+            };
             let params = pdfcraft_cos::NewEncryption {
                 algorithm: p.algorithm,
                 user_password: p.open_password.as_deref().unwrap_or(""),
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 0df176226a..6895f188f3 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1884,6 +1884,78 @@ fn passwords_that_encryption_would_make_empty_or_equal_are_refused() {
     }
 }
 
+#[test]
+fn fresh_sessions_protecting_identical_documents_produce_different_salts() {
+    let raw = Arc::new(fixture(1));
+    let encrypt_bytes = |saved: Arc<Vec<u8>>, key: &[u8]| -> Vec<u8> {
+        let doc = pdfcraft_cos::Document::open_with_password(saved, Some("secret")).unwrap();
+        let enc = doc.trailer().get(b"Encrypt").map(|o| doc.resolve(o)).unwrap();
+        enc.as_dict().unwrap().get(key).map(|o| doc.resolve(o)).unwrap().as_string().unwrap().bytes.clone()
+    };
+    let protect_once = |p: Protection| -> Arc<Vec<u8>> {
+        let mut s = Session::new();
+        let id = s.open("same.pdf", None, raw.clone(), None).unwrap();
+        s.apply(id, Edit::Protect(p)).unwrap();
+        s.save_bytes(id).unwrap()
+    };
+    let a = protect_once(protection(Some("secret"), None));
+    let b = protect_once(protection(Some("secret"), None));
+    let (u_a, u_b) = (encrypt_bytes(a.clone(), b"U"), encrypt_bytes(b.clone(), b"U"));
+    let (o_a, o_b) = (encrypt_bytes(a.clone(), b"O"), encrypt_bytes(b.clone(), b"O"));
+    let (ue_a, ue_b) = (encrypt_bytes(a.clone(), b"UE"), encrypt_bytes(b.clone(), b"UE"));
+    let (oe_a, oe_b) = (encrypt_bytes(a, b"OE"), encrypt_bytes(b, b"OE"));
+    assert_eq!((u_a.len(), u_b.len(), o_a.len(), o_b.len()), (48, 48, 48, 48));
+    assert_ne!(&u_a[32..48], &u_b[32..48], "user validation and key salts must differ across fresh sessions");
+    assert_ne!(&o_a[32..48], &o_b[32..48], "owner validation and key salts must differ across fresh sessions");
+    assert_ne!(ue_a, ue_b, "wrapped user file keys must differ across fresh sessions");
+    assert_ne!(oe_a, oe_b, "wrapped owner file keys must differ across fresh sessions");
+
+    // Generated owner passwords in R4 (AES-128) must also come from CSPRNG entropy, even when the
+    // document already carries a fixed /ID and only an open password is set.
+    let mut with_id = pdfcraft_cos::Document::open(raw).unwrap();
+    let fixed_id = pdfcraft_cos::Object::String(pdfcraft_cos::PdfString { bytes: b"0123456789abcdef".to_vec(), hex: true });
+    with_id.trailer_mut().set(b"ID".to_vec(), pdfcraft_cos::Object::Array(vec![fixed_id.clone(), fixed_id]));
+    let raw_with_id = Arc::new(pdfcraft_cos::write_full(&with_id, &Default::default()).unwrap());
+    let protect_r4 = || -> Vec<u8> {
+        let mut s = Session::new();
+        let id = s.open("same.pdf", None, raw_with_id.clone(), None).unwrap();
+        let p = Protection { algorithm: pdfcraft_cos::Algorithm::Aes128, ..protection(Some("secret"), None) };
+        s.apply(id, Edit::Protect(p)).unwrap();
+        encrypt_bytes(s.save_bytes(id).unwrap(), b"O")
+    };
+    assert_ne!(protect_r4(), protect_r4(), "generated owner passwords must differ across fresh sessions");
+}
+
+#[test]
+fn protect_fails_closed_when_randomness_is_unavailable() {
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    static CALLS: AtomicUsize = AtomicUsize::new(0);
+    fn fail_rng(_: &mut [u8]) -> Result<(), getrandom::Error> {
+        Err(getrandom::Error::UNSUPPORTED)
+    }
+    fn zero_rng(out: &mut [u8]) -> Result<(), getrandom::Error> {
+        out.fill(0);
+        Ok(())
+    }
+    fn fail_second_rng(out: &mut [u8]) -> Result<(), getrandom::Error> {
+        if CALLS.fetch_add(1, Ordering::SeqCst) == 0 {
+            out.fill(0xA5);
+            Ok(())
+        } else {
+            Err(getrandom::Error::UNSUPPORTED)
+        }
+    }
+    CALLS.store(0, Ordering::SeqCst);
+    for rng in [fail_rng, zero_rng, fail_second_rng] {
+        let mut doc = pdfcraft_cos::Document::open(Arc::new(fixture(1))).unwrap();
+        let mut cx = EditCtx::new(None, 0);
+        cx.rng = rng;
+        let err = run_edit(&mut doc, &Edit::Protect(protection(Some("secret"), None)), &mut cx);
+        assert!(matches!(err, Err(EditError::Protection(_))), "Protect must fail closed when CSPRNG fails: {err:?}");
+        assert!(doc.output_handler().is_none(), "document must stay unprotected when CSPRNG fails");
+    }
+}
+
 /// A one-page form: a text field and a check box (with appearance states).
 fn form_fixture() -> Vec<u8> {
     let objs = [

From 2842eeaa713889b2fb306e72990050549ee1a5dd Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 13:38:28 +1100
Subject: [PATCH 015/132] fix(ui): Ctrl+Z in an open paragraph undoes the
 document, not stale text

Ctrl+Z is left to a focused text field, so in the paragraph editor it
went to the box's own Undo history. That history still held the
paragraph's text from before the last formatting change, so Ctrl+Z put
it back into a box laid out for the page after the change, a layout
the page never had, and the document kept the change. The box shared
its id across paragraphs too, so it could put back another paragraph's
text.

The history of the paragraph editor and the added-text box now starts
at what the page has. Undo and Redo keep the keys only while the box
holds typing the page doesn't have; then they reach the document. An
open box is applied (as clicking away applies it) and closed before an
Undo or Redo step, so it never shows a state the document has left;
text it can't apply keeps it open and stops the step.
---
 crates/ui-egui/src/commands.rs     |  5 ++-
 crates/ui-egui/src/content_ui.rs   | 23 +++++++++++--
 crates/ui-egui/src/edit_text_ui.rs | 29 +++++++++++++++-
 crates/ui-egui/src/editing.rs      | 54 +++++++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 55 ++++++++++++++++++++++++++++++
 5 files changed, 161 insertions(+), 5 deletions(-)

diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 92bc0b360e..ee19c168eb 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -726,7 +726,10 @@ impl PdfCraftApp {
             if matches!(spec.id, "view.previous_view" | "view.next_view") && !self.command_enabled(spec) {
                 continue;
             }
-            if typing && !spec.in_text {
+            // A box typed into on the page (a paragraph being edited, added text) keeps Undo and
+            // Redo only while it holds typing the page doesn't have; then they reach the document.
+            let page_box = matches!(spec.id, "edit.undo" | "edit.redo") && self.page_box_focused(ctx) && !self.page_typing_unapplied();
+            if typing && !spec.in_text && !page_box {
                 continue;
             }
             let Some(key) = Key::from_name(s.key) else { continue };
diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 674210529e..892e94ed67 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -66,8 +66,18 @@ pub struct TextDraft {
     /// Display space.
     pub rect: [f64; 4],
     pub text: String,
+    /// The box's formatting; its `text` is what the page has (empty for new text).
     pub style: AddedText,
     pub focus: bool,
+    /// The text the box's own Undo history starts from ([`crate::edit_text_ui::forget_typing_before`]).
+    pub typing_from: Option<String>,
+}
+
+impl TextDraft {
+    /// Typing the page doesn't have yet: Undo takes it back in the box before touching the document.
+    pub(crate) fn has_unapplied_typing(&self) -> bool {
+        self.text != self.style.text
+    }
 }
 
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -394,7 +404,7 @@ pub(crate) fn page_input(
             let page_width = info.pages.get(page).map_or(f64::INFINITY, |p| p.width as f64);
             let rect = [at[0], at[1] - style.size * 1.2, (at[0] + 200.0).min(page_width), at[1]];
             style.rect = rect;
-            cv.draft = Some(TextDraft { page, index: None, rect, text: String::new(), style, focus: true });
+            cv.draft = Some(TextDraft { page, index: None, rect, text: String::new(), style, focus: true, typing_from: None });
             consumed = true;
             if typed.is_some() {
                 view.pending_edit = typed;
@@ -432,7 +442,7 @@ pub(crate) fn page_input(
         if let Some(edit) = cv.finish_draft(added) {
             view.pending_edit = Some(edit);
         }
-        cv.draft = Some(TextDraft { page, index: Some(i), rect: t.rect, text: t.text.clone(), style: t.clone(), focus: true });
+        cv.draft = Some(TextDraft { page, index: Some(i), rect: t.rect, text: t.text.clone(), style: t.clone(), focus: true, typing_from: None });
         cv.selected = Some((page, i));
         consumed = true;
         return consumed;
@@ -560,6 +570,8 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
             // The box is white in every theme, so the caret must not follow the theme (pale in dark mode) (#655).
             ui.visuals_mut().text_cursor.stroke.color = crate::edit_text_ui::caret_color_on(Color32::WHITE);
             let [cr, cg, cb] = t.style.color.map(|v| (v.clamp(0.0, 1.0) * 255.0) as u8);
+            let input = input_id();
+            crate::edit_text_ui::forget_typing_before(ui.ctx(), input, &mut t.typing_from, &t.style.text);
             ui.horizontal_top(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
                 let resp = ui.add(
@@ -570,7 +582,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                         .background_color(if background_ready { Color32::TRANSPARENT } else { Color32::WHITE })
                         .text_color(Color32::from_rgb(cr, cg, cb))
                         .hint_text(tl!("Type text"))
-                        .id_salt("added-text-edit"),
+                        .id(input),
                 );
                 if t.focus {
                     resp.request_focus();
@@ -633,6 +645,11 @@ fn finish(cv: &mut ContentView, d: TextDraft, added: &[Added]) -> Option<Edit> {
     }
 }
 
+/// The added-text box's text field.
+pub(crate) fn input_id() -> egui::Id {
+    egui::Id::new("added-text-input")
+}
+
 /// How to use the tools, under the Add content list.
 pub(crate) fn hint(ui: &mut egui::Ui, t: &Tokens) {
     ui.label(
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 3a1ab04367..f2c5c55151 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -256,6 +256,29 @@ pub struct LineEditor {
     /// horizontal scale (%), and what they were.
     pub extras: Extras,
     extras0: Extras,
+    /// The text the box's own Undo history starts from; see [`forget_typing_before`].
+    typing_from: Option<String>,
+}
+
+/// The paragraph editor's text box.
+pub(crate) fn input_id() -> egui::Id {
+    egui::Id::new("edit-text-line-input")
+}
+
+/// The page text box `id` keeps its own Undo history, across every paragraph or box it has shown
+/// (they share the id). Once the page has `text` (the box opened on it, or formatting applied it),
+/// that history is cleared: Undo in the box takes back only what was typed since, and then reaches
+/// the document. Kept, it put back text from another paragraph, or the whole paragraph as it was
+/// before a format change, into a box showing the page as it is now.
+pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, from: &mut Option<String>, text: &str) {
+    if from.as_deref() == Some(text) {
+        return;
+    }
+    if let Some(mut state) = egui::TextEdit::load_state(ctx, id) {
+        state.clear_undoer();
+        egui::TextEdit::store_state(ctx, id, state);
+    }
+    *from = Some(text.to_owned());
 }
 
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -1199,6 +1222,7 @@ fn open_editor(
         family_chosen: false,
         extras: Extras::default(),
         extras0: Extras::default(),
+        typing_from: None,
     });
 }
 
@@ -1668,8 +1692,10 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                     let galley = editor_galley(ui, &snapshot, text.as_str(), scale, wrap_width);
                     if snapshot.changes_with(text.as_str()) { galley } else { unseen(galley) }
                 };
+                let input = input_id();
+                forget_typing_before(ui.ctx(), input, &mut ed.typing_from, &ed.original);
                 let output = egui::TextEdit::multiline(&mut ed.text)
-                    .id(egui::Id::new("edit-text-line-input"))
+                    .id(input)
                     .font(font.clone())
                     .margin(egui::Margin::ZERO)
                     .layouter(&mut layouter)
@@ -1801,6 +1827,7 @@ mod tests {
             family_chosen: false,
             extras: Extras::default(),
             extras0: Extras::default(),
+            typing_from: None,
         };
         (app, ed)
     }
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 5b821b6381..c10094b208 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -229,6 +229,9 @@ impl PdfCraftApp {
 
     fn history_step(&mut self, undo: bool) {
         let Some((i, id)) = self.active_ids() else { return };
+        if !self.close_text_editors(i, id) {
+            return;
+        }
         let result = if undo { self.session.undo(id) } else { self.session.redo(id) };
         match result {
             Ok(label) => {
@@ -247,6 +250,57 @@ impl PdfCraftApp {
         }
     }
 
+    /// Before Undo or Redo: a paragraph or added text box open on the page shows the document as
+    /// it is before the step, so it is applied as clicking away applies it, then closed. Left
+    /// open, it kept showing what the step took away, and wrote from it when it was next applied.
+    /// What was typed is then the step Undo takes back. False (nothing is undone, and the box
+    /// stays open) while it holds text the standard fonts can't draw, or text that couldn't be
+    /// applied: it is shown, never lost.
+    pub(crate) fn close_text_editors(&mut self, i: usize, id: pdfcraft_engine::DocId) -> bool {
+        let Some(view) = self.views.get_mut(i) else { return true };
+        if let Some(c) = view.content.blocked() {
+            view.content.hold_blocked();
+            self.notify(crate::content_ui::undrawable_message(c));
+            return false;
+        }
+        if let Some(ed) = view.line_editor.take()
+            && let Some(edit) = crate::edit_text_ui::finished_edit(ed.clone())
+            && !self.apply_edit(edit)
+        {
+            if let Some(view) = self.views.get_mut(i) {
+                view.line_editor = Some(ed);
+            }
+            return false;
+        }
+        let added = self.session.get(id).map(|d| d.added().to_vec()).unwrap_or_default();
+        let Some(view) = self.views.get_mut(i) else { return true };
+        let draft = view.content.draft.clone();
+        if let Some(edit) = view.content.finish_draft(&added)
+            && !self.apply_edit(edit)
+        {
+            if let Some(view) = self.views.get_mut(i) {
+                view.content.draft = draft;
+            }
+            return false;
+        }
+        true
+    }
+
+    /// Whether the keyboard is in a box typed into on the page: a paragraph being edited, or added
+    /// text.
+    pub(crate) fn page_box_focused(&self, ctx: &egui::Context) -> bool {
+        let focused = ctx.memory(|m| m.focused());
+        focused == Some(crate::edit_text_ui::input_id()) || focused == Some(crate::content_ui::input_id())
+    }
+
+    /// Typing in a box on the page (a paragraph being edited, added text) that the page doesn't
+    /// have yet: Undo and Redo keys take it back in the box first.
+    pub(crate) fn page_typing_unapplied(&self) -> bool {
+        self.active.and_then(|i| self.views.get(i)).is_some_and(|v| {
+            v.line_editor.as_ref().is_some_and(|ed| ed.has_unsaved_text()) || v.content.draft.as_ref().is_some_and(|d| d.has_unapplied_typing())
+        })
+    }
+
     /// Apply any edit a view queued this frame (organize toolbar, keys).
     /// Returns false when a field refused the typing queued for it (its editor is open again).
     pub(crate) fn process_pending_edits(&mut self) -> bool {
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 71ba9ccdac..f9228c1f05 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -5980,3 +5980,58 @@ fn mode_tabs_keep_the_hand_over_a_paragraph_scrolled_under_them() {
     click_at(&mut h, convert);
     assert_eq!(h.state().mode, pdfcraft_ui_egui::Mode::Convert, "the tab takes the click, not the paragraph's editor");
 }
+
+/// The paragraph opened for typing, as a person opens it: a click on its text.
+fn open_paragraph(h: &mut Harness<'static, PdfCraftApp>) {
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let at = egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height());
+    click_at(h, at);
+    assert!(h.state().views[0].line_editor.is_some(), "the paragraph opens for typing");
+}
+
+/// Ctrl+Z after a formatting change, with the paragraph still open: the change is undone and
+/// the editor closes. The box's own Undo used to take the key, putting back the text it had
+/// before the change into a box laid out for the page after it, and the document kept the change.
+#[test]
+fn undo_with_the_paragraph_open_undoes_the_formatting() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    {
+        let s = h.state();
+        let doc = s.session.get(s.views[0].id).unwrap();
+        assert_eq!(doc.can_undo(), Some("Edit text"));
+        assert_eq!(doc.text_blocks(0)[0].base_font, "Helvetica-Bold");
+        assert!(s.views[0].line_editor.is_some(), "still editing");
+    }
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(doc.can_undo(), None, "the formatting is undone");
+    assert_eq!(doc.text_blocks(0)[0].base_font, "Helvetica");
+    assert!(s.views[0].line_editor.is_none(), "the editor closed with the step it showed");
+}
+
+/// Undo while typing takes back the typing in the box first; the document is left alone.
+#[test]
+fn undo_while_typing_takes_back_the_typing_first() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    assert_ne!(h.state().views[0].line_editor.as_ref().unwrap().text, original);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("still typing");
+    assert_eq!(ed.text, original, "the typing is taken back");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), None, "the document is untouched");
+}

From cac63cf3dbd3449274fd8ad9689cf7778c8c5ef9 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:05:23 +1100
Subject: [PATCH 016/132] fix(ui): Redo after Undo in a page text box puts the
 typing back

With typing undone in a paragraph or added text box, its text matches
the page again, so Undo and Redo went to the document. Redo then closed
the box and redid a document change (or nothing), instead of putting the
typing back as the box's own Redo did before. And Shift+Cmd+Z is also
Cmd+Z to the Undo shortcut, so even a Redo the box kept was taken as a
document Undo.

Redo stays with the box while its own history has typing to put back
(the test egui makes when it handles the key), and Shift+Cmd+Z is never
a document Undo.
---
 crates/ui-egui/src/commands.rs     | 10 ++++++++--
 crates/ui-egui/src/editing.rs      | 21 ++++++++++++++++++++
 crates/ui-egui/tests/it/content.rs | 30 +++++++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 31 ++++++++++++++++++++++++++++++
 4 files changed, 90 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index ee19c168eb..fb4d6f1b6f 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -727,8 +727,14 @@ impl PdfCraftApp {
                 continue;
             }
             // A box typed into on the page (a paragraph being edited, added text) keeps Undo and
-            // Redo only while it holds typing the page doesn't have; then they reach the document.
-            let page_box = matches!(spec.id, "edit.undo" | "edit.redo") && self.page_box_focused(ctx) && !self.page_typing_unapplied();
+            // Redo only while it holds typing the page doesn't have, or Redo has typing to put
+            // back; then they reach the document. ⌘⇧Z is also ⌘Z to the Undo shortcut, so a
+            // Redo the box keeps is never taken as Undo.
+            let page_box = matches!(spec.id, "edit.undo" | "edit.redo")
+                && self.page_box_focused(ctx)
+                && !self.page_typing_unapplied()
+                && !(spec.id == "edit.redo" && self.page_box_can_redo(ctx))
+                && !(spec.id == "edit.undo" && ctx.input(|i| i.modifiers.shift));
             if typing && !spec.in_text && !page_box {
                 continue;
             }
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index c10094b208..39e0fd1adf 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -293,6 +293,27 @@ impl PdfCraftApp {
         focused == Some(crate::edit_text_ui::input_id()) || focused == Some(crate::content_ui::input_id())
     }
 
+    /// Whether the focused box on the page has typing its own Redo would put back: after Undo in
+    /// the box restores what the page has, Redo still belongs to the box, not the document. The
+    /// same test egui makes when it handles the key.
+    pub(crate) fn page_box_can_redo(&self, ctx: &egui::Context) -> bool {
+        let Some(view) = self.active.and_then(|i| self.views.get(i)) else { return false };
+        let focused = ctx.memory(|m| m.focused());
+        let (id, text) = if focused == Some(crate::edit_text_ui::input_id())
+            && let Some(ed) = &view.line_editor
+        {
+            (crate::edit_text_ui::input_id(), &ed.text)
+        } else if focused == Some(crate::content_ui::input_id())
+            && let Some(d) = &view.content.draft
+        {
+            (crate::content_ui::input_id(), &d.text)
+        } else {
+            return false;
+        };
+        egui::TextEdit::load_state(ctx, id)
+            .is_some_and(|state| state.cursor.char_range().is_some_and(|range| state.undoer().has_redo(&(range, text.clone()))))
+    }
+
     /// Typing in a box on the page (a paragraph being edited, added text) that the page doesn't
     /// have yet: Undo and Redo keys take it back in the box first.
     pub(crate) fn page_typing_unapplied(&self) -> bool {
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 515e3e04f1..fa0c01367a 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -861,3 +861,33 @@ fn a_resized_added_picture_shows_only_at_its_new_size() {
     let pixels = h.render().unwrap();
     assert!(red(&pixels, kept) > 100 && red(&pixels, gone) == 0, "the page raster has the picture at its new size");
 }
+
+/// The same in an added text box: Redo after Undo puts the typing back in the box, and the
+/// document's own Redo stays waiting.
+#[test]
+fn redo_after_undoing_typing_in_added_text_puts_it_back() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    let bold = pdfcraft_engine::AddedText { bold: true, ..text };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::UpdateContent { page: 0, index: 0, content: pdfcraft_engine::AddedContent::Text(bold) }));
+    assert!(h.state_mut().execute("edit.undo"));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"));
+    h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo puts the typing back");
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(doc.can_redo(), Some("Edit content"), "the document's Redo still waits");
+}
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index f9228c1f05..49e882893d 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6035,3 +6035,34 @@ fn undo_while_typing_takes_back_the_typing_first() {
     assert_eq!(ed.text, original, "the typing is taken back");
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), None, "the document is untouched");
 }
+
+/// Redo after Undo in the box puts the typing back, in the box: it doesn't reach the document,
+/// whose own Redo (a formatting change waiting here) must stay waiting.
+#[test]
+fn redo_after_undoing_typing_puts_the_typing_back() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    // Undo the bold (closing the editor), so the document has it to redo.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), Some("Edit text"));
+    open_paragraph(&mut h);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_ne!(h.state().views[0].line_editor.as_ref().unwrap().text, typed, "the typing is taken back");
+    h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("still typing");
+    assert_eq!(ed.text, typed, "Redo puts the typing back");
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
+}

From 188341c66730ccf99082e03544688c371a316bb6 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:55:09 +1100
Subject: [PATCH 017/132] test(ui): the Redo test checks Undo restores the
 exact paragraph text

---
 crates/ui-egui/tests/it/editing.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 49e882893d..4bb74f82cd 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6051,13 +6051,14 @@ fn redo_after_undoing_typing_puts_the_typing_back() {
     h.run_steps(4);
     assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), Some("Edit text"));
     open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
     h.key_press_modifiers(Modifiers::COMMAND, Key::End);
     h.event(egui::Event::Text(" more".into()));
     h.run_steps(2);
     let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
     h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
     h.run_steps(3);
-    assert_ne!(h.state().views[0].line_editor.as_ref().unwrap().text, typed, "the typing is taken back");
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the typing is taken back");
     h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
     h.run_steps(3);
     let s = h.state();

From 6c8fd74ca1c3b1b8c14e02631000990e9c641ac3 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Fri, 23 Oct 2026 16:14:01 +1100
Subject: [PATCH 018/132] fix(ui): an unchanged added-text box closes without
 an edit

Finishing a box trimmed its text before comparing it with the item, so
an unchanged box whose text was saved with trailing spaces finished as
an edit. Before an Undo or Redo step that edit was applied, clearing
the document's Redo. A box matching its item is now no edit.
---
 crates/ui-egui/src/content_ui.rs   |  4 ++++
 crates/ui-egui/tests/it/content.rs | 26 ++++++++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 892e94ed67..788ba49600 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -639,6 +639,10 @@ fn finish(cv: &mut ContentView, d: TextDraft, added: &[Added]) -> Option<Edit> {
         Some(i) => {
             let (_, a) = on_page(added, d.page).into_iter().find(|(k, _)| *k == i)?;
             let AddedContent::Text(old) = &a.content else { return None };
+            // Unchanged is no edit, even for text saved with trailing spaces the trim would drop.
+            if *old == (AddedText { text: d.text.clone(), rect: d.rect, ..d.style.clone() }) {
+                return None;
+            }
             let updated = AddedText { text, rect: d.rect, ..d.style };
             (*old != updated).then_some(Edit::UpdateContent { page: d.page, index: i, content: AddedContent::Text(updated) })
         }
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index fa0c01367a..c24501dab3 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -891,3 +891,29 @@ fn redo_after_undoing_typing_in_added_text_puts_it_back() {
     let doc = s.session.get(s.views[0].id).unwrap();
     assert_eq!(doc.can_redo(), Some("Edit content"), "the document's Redo still waits");
 }
+
+/// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
+/// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
+/// that Redo first.
+#[test]
+fn redo_with_an_unchanged_box_open_redoes_the_document() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed ".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    let pdfcraft_engine::AddedContent::Text(saved) = added(&h)[0].content.clone() else { panic!() };
+    assert_eq!(saved.text, "Reviewed ", "the trailing space is kept");
+    let bold = pdfcraft_engine::AddedText { bold: true, ..saved };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::UpdateContent { page: 0, index: 0, content: pdfcraft_engine::AddedContent::Text(bold) }));
+    assert!(h.state_mut().execute("edit.undo"));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::Z);
+    h.run_steps(4);
+    let pdfcraft_engine::AddedContent::Text(now) = &added(&h)[0].content else { panic!() };
+    assert!(now.bold, "the waiting Redo was redone");
+    assert!(h.state().views[0].content.draft.is_none(), "the box closed with the step");
+}

From f1992f5aa1bde2ae5f9e3c7824527f626cb4e5bd Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sat, 24 Oct 2026 03:24:58 +1100
Subject: [PATCH 019/132] fix(ui): typing in one tab's text box never reaches
 another tab's

The paragraph box, and the added-text box, each keep one Undo history under
one egui id, shared by every tab. A box cleared it when it opened on new
text, but a box in another tab on the same text (two copies of a document)
kept it: typing taken back with Undo in one tab came back with Redo in the
other. The document that last used the history is now kept beside it, and
the history is cleared whenever another document's box takes it over.

Tests: the paragraph and added-text cases, each with two copies of a
document open.
---
 crates/ui-egui/src/content_ui.rs   |  3 ++-
 crates/ui-egui/src/edit_text_ui.rs | 19 +++++++++------
 crates/ui-egui/tests/it/content.rs | 37 +++++++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 38 ++++++++++++++++++++++++++++++
 4 files changed, 89 insertions(+), 8 deletions(-)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 788ba49600..66ff781bbd 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -518,6 +518,7 @@ pub(crate) fn after_refresh(view: &mut DocView, added: &[Added]) {
 /// committed (a click away, or Done), and whether Done finished adding text. Discard or Escape
 /// throws the draft away.
 pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, added: &[Added]) -> (Option<Edit>, bool) {
+    let doc_id = view.id;
     let Some(page) = view.content.draft.as_ref().map(|d| d.page) else { return (None, false) };
     let Some(xf) = view.page_xform(page) else { return (None, false) };
     let zoom = xf.rect.width() / xf.pw.max(1.0);
@@ -571,7 +572,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
             ui.visuals_mut().text_cursor.stroke.color = crate::edit_text_ui::caret_color_on(Color32::WHITE);
             let [cr, cg, cb] = t.style.color.map(|v| (v.clamp(0.0, 1.0) * 255.0) as u8);
             let input = input_id();
-            crate::edit_text_ui::forget_typing_before(ui.ctx(), input, &mut t.typing_from, &t.style.text);
+            crate::edit_text_ui::forget_typing_before(ui.ctx(), input, doc_id, &mut t.typing_from, &t.style.text);
             ui.horizontal_top(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
                 let resp = ui.add(
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index f2c5c55151..8e5bf8d368 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -266,18 +266,22 @@ pub(crate) fn input_id() -> egui::Id {
 }
 
 /// The page text box `id` keeps its own Undo history, across every paragraph or box it has shown
-/// (they share the id). Once the page has `text` (the box opened on it, or formatting applied it),
-/// that history is cleared: Undo in the box takes back only what was typed since, and then reaches
-/// the document. Kept, it put back text from another paragraph, or the whole paragraph as it was
-/// before a format change, into a box showing the page as it is now.
-pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, from: &mut Option<String>, text: &str) {
-    if from.as_deref() == Some(text) {
+/// in every tab (they share the id). Once the page has `text` (the box opened on it, or formatting
+/// applied it), that history is cleared: Undo in the box takes back only what was typed since, and
+/// then reaches the document. Kept, it put back text from another paragraph, or the whole paragraph
+/// as it was before a format change, into a box showing the page as it is now. `from` is the box's
+/// own record of that; which document `doc` last used the history is kept beside it, since a box
+/// in another tab on the same text would otherwise take that document's typing with its Redo.
+pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcraft_engine::DocId, from: &mut Option<String>, text: &str) {
+    let owner = id.with("typing-doc");
+    if from.as_deref() == Some(text) && ctx.data(|d| d.get_temp::<pdfcraft_engine::DocId>(owner)) == Some(doc) {
         return;
     }
     if let Some(mut state) = egui::TextEdit::load_state(ctx, id) {
         state.clear_undoer();
         egui::TextEdit::store_state(ctx, id, state);
     }
+    ctx.data_mut(|d| d.insert_temp(owner, doc));
     *from = Some(text.to_owned());
 }
 
@@ -1577,6 +1581,7 @@ fn editor_galley(ui: &egui::Ui, ed: &LineEditor, text: &str, scale: f32, width:
 
 /// The inline editor; returns the edit once the text is applied.
 pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -> Option<Edit> {
+    let view_id = view.id;
     // Clicks outside the document (the Format text panel) keep the paragraph open.
     let outside = ctx.input(|i| i.pointer.latest_pos()).is_some_and(|p| !view.viewport_rect().contains(p));
     let page = view.line_editor.as_ref()?.page;
@@ -1693,7 +1698,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                     if snapshot.changes_with(text.as_str()) { galley } else { unseen(galley) }
                 };
                 let input = input_id();
-                forget_typing_before(ui.ctx(), input, &mut ed.typing_from, &ed.original);
+                forget_typing_before(ui.ctx(), input, view_id, &mut ed.typing_from, &ed.original);
                 let output = egui::TextEdit::multiline(&mut ed.text)
                     .id(input)
                     .font(font.clone())
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index c24501dab3..41957e6f69 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -917,3 +917,40 @@ fn redo_with_an_unchanged_box_open_redoes_the_document() {
     assert!(now.bold, "the waiting Redo was redone");
     assert!(h.state().views[0].content.draft.is_none(), "the box closed with the step");
 }
+
+/// Two copies of a document, the same added text open in each: the boxes share one Undo history,
+/// so typing taken back with Undo in one tab came back with Redo in the other.
+#[test]
+fn typing_in_one_tab_never_reaches_another_tabs_added_text() {
+    let mut h = harness();
+    h.state_mut().open_bytes("copy.pdf", None, include_bytes!("../data/form.pdf").to_vec()).unwrap();
+    h.run_steps(4);
+    let text = pdfcraft_engine::AddedText { rect: [40.0, 195.0, 240.0, 210.0], text: "Reviewed".into(), ..Default::default() };
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.text"));
+        h.run_steps(3);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        let k = r.width() / 300.0;
+        click(h, r.min + egui::vec2(45.0 * k, 195.0 * k));
+        assert_eq!(h.state().views[tab].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    };
+    for tab in [0, 1] {
+        h.state_mut().active = Some(tab);
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    }
+    open_in(&mut h, 1);
+    open_in(&mut h, 0);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" secret".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "taken back");
+    h.state_mut().active = Some(1);
+    h.run_steps(3);
+    h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[1].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "the other tab's typing stays out");
+}
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 4bb74f82cd..e87697403f 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6067,3 +6067,41 @@ fn redo_after_undoing_typing_puts_the_typing_back() {
     let doc = s.session.get(s.views[0].id).unwrap();
     assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
 }
+
+/// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
+/// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
+/// Typing in one tab, taken back with Undo, then came back with Redo in the other tab.
+#[test]
+fn typing_in_one_tab_never_reaches_another_tabs_paragraph() {
+    let mut h = harness(1, |app| {
+        app.open_bytes("copy.pdf", None, fixture(1)).expect("the copy opens");
+    });
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.edit_text"));
+        h.run_steps(2);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        click_at(h, egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height()));
+        assert!(h.state().views[tab].line_editor.is_some(), "the paragraph opens for typing");
+    };
+    open_in(&mut h, 1);
+    let original = h.state().views[1].line_editor.as_ref().unwrap().text.clone();
+    open_in(&mut h, 0);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the same paragraph");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" secret".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "taken back");
+    // The copy, its paragraph still open: Redo there has nothing of its own to put back.
+    h.state_mut().active = Some(1);
+    h.run_steps(3);
+    h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
+    h.run_steps(3);
+    let s = h.state();
+    let text = s.views[1].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert!(!text.as_deref().unwrap_or_default().contains("secret"), "the other tab's typing came in: {text:?}");
+    assert_eq!(s.session.get(s.views[1].id).unwrap().text_blocks(0)[0].text, s.session.get(s.views[0].id).unwrap().text_blocks(0)[0].text);
+}

From c7715a09e7cd63d9642b70e947d065d0b6e69837 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Fri, 23 Oct 2026 20:29:39 +0200
Subject: [PATCH 020/132] fix(ui): name the pages in the Background dialog's
 backdrop and scan messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"A picture covers this page (a scan?)" didn't say which page, so on a
range of several pages the user couldn't tell where the background
would stay hidden. Both messages now list the pages as 1-based runs
("Page 3", "Pages 1-3, 6"), stopping with "…" after eight runs.
The four strings are updated in every catalogue.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/i18n/ar.tsv      |  8 ++--
 crates/ui-egui/src/i18n/bg.tsv      |  8 ++--
 crates/ui-egui/src/i18n/ca.tsv      |  8 ++--
 crates/ui-egui/src/i18n/ckb.tsv     |  8 ++--
 crates/ui-egui/src/i18n/cs.tsv      |  8 ++--
 crates/ui-egui/src/i18n/de.tsv      |  8 ++--
 crates/ui-egui/src/i18n/el.tsv      |  8 ++--
 crates/ui-egui/src/i18n/es.tsv      |  8 ++--
 crates/ui-egui/src/i18n/fi.tsv      |  8 ++--
 crates/ui-egui/src/i18n/fr.tsv      |  8 ++--
 crates/ui-egui/src/i18n/hi.tsv      |  8 ++--
 crates/ui-egui/src/i18n/hu.tsv      |  8 ++--
 crates/ui-egui/src/i18n/id.tsv      |  8 ++--
 crates/ui-egui/src/i18n/it.tsv      |  8 ++--
 crates/ui-egui/src/i18n/ja.tsv      |  8 ++--
 crates/ui-egui/src/i18n/kk.tsv      |  8 ++--
 crates/ui-egui/src/i18n/ko.tsv      |  8 ++--
 crates/ui-egui/src/i18n/lo.tsv      |  8 ++--
 crates/ui-egui/src/i18n/lt.tsv      |  8 ++--
 crates/ui-egui/src/i18n/nb.tsv      |  8 ++--
 crates/ui-egui/src/i18n/pl.tsv      |  8 ++--
 crates/ui-egui/src/i18n/pt-br.tsv   |  8 ++--
 crates/ui-egui/src/i18n/ro.tsv      |  8 ++--
 crates/ui-egui/src/i18n/ru.tsv      |  8 ++--
 crates/ui-egui/src/i18n/sl.tsv      |  8 ++--
 crates/ui-egui/src/i18n/sq.tsv      |  8 ++--
 crates/ui-egui/src/i18n/te.tsv      |  8 ++--
 crates/ui-egui/src/i18n/th.tsv      |  8 ++--
 crates/ui-egui/src/i18n/tr.tsv      |  8 ++--
 crates/ui-egui/src/i18n/uk.tsv      |  8 ++--
 crates/ui-egui/src/i18n/vi.tsv      |  8 ++--
 crates/ui-egui/src/i18n/zh-hans.tsv |  8 ++--
 crates/ui-egui/src/i18n/zh-hant.tsv |  8 ++--
 crates/ui-egui/src/marks_ui.rs      | 66 ++++++++++++++++++++---------
 crates/ui-egui/tests/it/marks.rs    |  4 +-
 35 files changed, 181 insertions(+), 153 deletions(-)

diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 418ed9a01e..e41a752411 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -857,11 +857,11 @@
 	Applies to {n} pages	يُطبَّق على {n} صفحات
 	Replaces the existing one on those pages.	يستبدل الموجود على تلك الصفحات.
 	Checking pages…	جارٍ فحص الصفحات…
-	This page paints its own white backdrop, which would hide the background. Replace it	ترسم هذه الصفحة تعبئة بيضاء خاصة بها ستُخفي الخلفية. استبدالها
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	عدد الصفحات التي ترسم تعبئة بيضاء خاصة بها ستُخفي الخلفية: {n}. استبدالها
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	الصفحة {pages} ترسم تعبئة بيضاء خاصة بها ستُخفي الخلفية. استبدالها
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	الصفحات {pages} ترسم تعبئة بيضاء خاصة بها ستُخفي الخلفية. استبدالها
 	Removing the background puts the page's own backdrop back.	إزالة الخلفية تعيد التعبئة البيضاء الخاصة بالصفحة.
-	A picture covers this page (a scan?), so the background won't show there.	تغطي صورة هذه الصفحة (مسح ضوئي؟)، لذا لن تظهر الخلفية فيها.
-	A picture covers {n} pages (scans?), so the background won't show there.	عدد الصفحات التي تغطيها صور (مسح ضوئي؟): {n}؛ لن تظهر الخلفية فيها.
+	A picture covers page {pages} (a scan?), so the background won't show there.	تغطي صورة الصفحة {pages} (مسح ضوئي؟)، لذا لن تظهر الخلفية فيها.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	تغطي صور الصفحات {pages} (مسح ضوئي؟)، لذا لن تظهر الخلفية فيها.
 	PDF or image	PDF أو صورة
 	No file chosen	لم يُختر ملف
 	Page number	رقم الصفحة
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index c430dbf387..1854c469ef 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -528,11 +528,11 @@
 	Applies to {n} pages	Прилага се към {n} страници
 	Replaces the existing one on those pages.	Заменя съществуващия на тези страници.
 	Checking pages…	Проверка на страниците…
-	This page paints its own white backdrop, which would hide the background. Replace it	Тази страница има собствено бяло запълване, което би скрило фона. Замяна
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Страници със собствено бяло запълване, което би скрило фона: {n}. Замяна
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Страница {pages} има собствено бяло запълване, което би скрило фона. Замяна
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Страници {pages} имат собствено бяло запълване, което би скрило фона. Замяна
 	Removing the background puts the page's own backdrop back.	Премахването на фона връща собственото бяло запълване на страницата.
-	A picture covers this page (a scan?), so the background won't show there.	Изображение покрива тази страница (сканиране?), затова фонът няма да се вижда там.
-	A picture covers {n} pages (scans?), so the background won't show there.	Страници, покрити с изображения (сканирания?): {n}; фонът няма да се вижда там.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Изображение покрива страница {pages} (сканиране?), затова фонът няма да се вижда там.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Изображения покриват страници {pages} (сканирания?), затова фонът няма да се вижда там.
 	PDF or image	PDF или изображение
 	No file chosen	Не е избран файл
 	Page number	Номер на страница
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 45f3a3e9c8..34ea8188e7 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -816,11 +816,11 @@
 	Applies to {n} pages	S'aplica a {n} pàgines
 	Replaces the existing one on those pages.	Substitueix l'existent en aquestes pàgines.
 	Checking pages…	S'estan comprovant les pàgines…
-	This page paints its own white backdrop, which would hide the background. Replace it	Aquesta pàgina té el seu propi farciment blanc, que amagaria el fons. Substitueix-lo
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} pàgines tenen el seu propi farciment blanc, que amagaria el fons. Substitueix-lo
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	La pàgina {pages} té el seu propi farciment blanc, que amagaria el fons. Substitueix-lo
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Les pàgines {pages} tenen el seu propi farciment blanc, que amagaria el fons. Substitueix-lo
 	Removing the background puts the page's own backdrop back.	En eliminar el fons, es restaura el farciment blanc propi de la pàgina.
-	A picture covers this page (a scan?), so the background won't show there.	Una imatge cobreix aquesta pàgina (un escaneig?), així que el fons no s'hi veurà.
-	A picture covers {n} pages (scans?), so the background won't show there.	Hi ha imatges que cobreixen {n} pàgines (escanejos?), així que el fons no s'hi veurà.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Una imatge cobreix la pàgina {pages} (un escaneig?), així que el fons no s'hi veurà.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Hi ha imatges que cobreixen les pàgines {pages} (escanejos?), així que el fons no s'hi veurà.
 	PDF or image	PDF o imatge
 	No file chosen	Cap fitxer triat
 	Page number	Número de pàgina
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index 2e6c259688..2e7d8f69a9 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -826,11 +826,11 @@
 	Applies to {n} pages	بۆ {n} پەڕە جێبەجێ دەکرێت
 	Replaces the existing one on those pages.	ئەوەی ئێستا هەیە لەسەر ئەو پەڕانە دەگۆڕێت.
 	Checking pages…	پشکنینی پەڕەکان…
-	This page paints its own white backdrop, which would hide the background. Replace it	ئەم پەڕەیە پڕکردنەوەیەکی سپیی خۆی هەیە کە پاشبنەماکە دەشارێتەوە. جێگرتنەوە
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} پەڕە پڕکردنەوەیەکی سپیی خۆیان هەیە کە پاشبنەماکە دەشارێتەوە. جێگرتنەوە
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	پەڕەی {pages} پڕکردنەوەیەکی سپیی خۆی هەیە کە پاشبنەماکە دەشارێتەوە. جێگرتنەوە
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	پەڕەکانی {pages} پڕکردنەوەیەکی سپیی خۆیان هەیە کە پاشبنەماکە دەشارێتەوە. جێگرتنەوە
 	Removing the background puts the page's own backdrop back.	لابردنی پاشبنەما پڕکردنەوە سپییەکەی خودی پەڕەکە دەگەڕێنێتەوە.
-	A picture covers this page (a scan?), so the background won't show there.	وێنەیەک ئەم پەڕەیە دادەپۆشێت (سکان؟)، بۆیە پاشبنەماکە لەوێ دەرناکەوێت.
-	A picture covers {n} pages (scans?), so the background won't show there.	وێنەکان {n} پەڕە دادەپۆشن (سکان؟)، بۆیە پاشبنەماکە لەوێ دەرناکەوێت.
+	A picture covers page {pages} (a scan?), so the background won't show there.	وێنەیەک پەڕەی {pages} دادەپۆشێت (سکان؟)، بۆیە پاشبنەماکە لەوێ دەرناکەوێت.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	وێنەکان پەڕەکانی {pages} دادەپۆشن (سکان؟)، بۆیە پاشبنەماکە لەوێ دەرناکەوێت.
 	PDF or image	PDF یان وێنە
 	No file chosen	هیچ فایلێک هەڵنەبژێردراوە
 	Page number	ژمارەی پەڕە
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 952e9e1eb6..a2d3f1b0e9 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -932,11 +932,11 @@ key	Space	Mezerník
 	Applies to {n} pages	Počet dotčených stránek: {n}
 	Replaces the existing one on those pages.	Nahradí stávající na těchto stránkách.
 	Checking pages…	Kontrola stránek…
-	This page paints its own white backdrop, which would hide the background. Replace it	Tato stránka má vlastní bílou výplň, která by zakryla pozadí. Nahradit ji
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Stránky s vlastní bílou výplní, která by zakryla pozadí: {n}. Nahradit ji
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Stránka {pages} má vlastní bílou výplň, která by zakryla pozadí. Nahradit ji
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Stránky {pages} mají vlastní bílou výplň, která by zakryla pozadí. Nahradit ji
 	Removing the background puts the page's own backdrop back.	Odebráním pozadí se vrátí vlastní bílá výplň stránky.
-	A picture covers this page (a scan?), so the background won't show there.	Tuto stránku pokrývá obrázek (sken?), takže pozadí na ní nebude vidět.
-	A picture covers {n} pages (scans?), so the background won't show there.	Stránky pokryté obrázky (skeny?): {n}; pozadí na nich nebude vidět.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Stránku {pages} pokrývá obrázek (sken?), takže pozadí na ní nebude vidět.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Stránky {pages} pokrývají obrázky (skeny?), takže pozadí na nich nebude vidět.
 	PDF or image	PDF nebo obrázek
 	No file chosen	Není vybrán žádný soubor
 	Page number	Číslo stránky
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index e67cbbe5b6..f7b6083f6b 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -835,11 +835,11 @@
 	Applies to {n} pages	Gilt für {n} Seiten
 	Replaces the existing one on those pages.	Ersetzt das Vorhandene auf diesen Seiten.
 	Checking pages…	Seiten werden geprüft…
-	This page paints its own white backdrop, which would hide the background. Replace it	Diese Seite hat eine eigene weiße Fläche, die den Hintergrund verdecken würde. Ersetzen
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} Seiten haben eine eigene weiße Fläche, die den Hintergrund verdecken würde. Ersetzen
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Seite {pages} hat eine eigene weiße Fläche, die den Hintergrund verdecken würde. Ersetzen
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Die Seiten {pages} haben eine eigene weiße Fläche, die den Hintergrund verdecken würde. Ersetzen
 	Removing the background puts the page's own backdrop back.	Wird der Hintergrund entfernt, kehrt die eigene weiße Fläche der Seite zurück.
-	A picture covers this page (a scan?), so the background won't show there.	Ein Bild bedeckt diese Seite (ein Scan?), daher ist der Hintergrund dort nicht zu sehen.
-	A picture covers {n} pages (scans?), so the background won't show there.	Bilder bedecken {n} Seiten (Scans?), daher ist der Hintergrund dort nicht zu sehen.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Ein Bild bedeckt Seite {pages} (ein Scan?), daher ist der Hintergrund dort nicht zu sehen.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Bilder bedecken die Seiten {pages} (Scans?), daher ist der Hintergrund dort nicht zu sehen.
 	PDF or image	PDF oder Bild
 	No file chosen	Keine Datei ausgewählt
 	Page number	Seitenzahl
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 72ffad8c40..143c915388 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -439,11 +439,11 @@
 	Applies to {n} pages	Εφαρμόζεται σε {n} σελίδες
 	Replaces the existing one on those pages.	Αντικαθιστά το υπάρχον στοιχείο στις συγκεκριμένες σελίδες.
 	Checking pages…	Έλεγχος σελίδων…
-	This page paints its own white backdrop, which would hide the background. Replace it	Αυτή η σελίδα έχει δική της λευκή γέμιση, που θα έκρυβε το φόντο. Αντικατάσταση
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} σελίδες έχουν δική τους λευκή γέμιση, που θα έκρυβε το φόντο. Αντικατάσταση
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Η σελίδα {pages} έχει δική της λευκή γέμιση, που θα έκρυβε το φόντο. Αντικατάσταση
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Οι σελίδες {pages} έχουν δική τους λευκή γέμιση, που θα έκρυβε το φόντο. Αντικατάσταση
 	Removing the background puts the page's own backdrop back.	Η αφαίρεση του φόντου επαναφέρει τη λευκή γέμιση της σελίδας.
-	A picture covers this page (a scan?), so the background won't show there.	Μια εικόνα καλύπτει αυτή τη σελίδα (σάρωση;), οπότε το φόντο δεν θα φαίνεται εκεί.
-	A picture covers {n} pages (scans?), so the background won't show there.	Εικόνες καλύπτουν {n} σελίδες (σαρώσεις;), οπότε το φόντο δεν θα φαίνεται εκεί.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Μια εικόνα καλύπτει τη σελίδα {pages} (σάρωση;), οπότε το φόντο δεν θα φαίνεται εκεί.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Εικόνες καλύπτουν τις σελίδες {pages} (σαρώσεις;), οπότε το φόντο δεν θα φαίνεται εκεί.
 	PDF or image	PDF ή εικόνα
 	No file chosen	Δεν έχει επιλεγεί αρχείο
 	Scale relative to target page	Κλίμακα ως προς τη σελίδα προορισμού
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index fdda81c7a3..451b0489bc 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -851,11 +851,11 @@
 	Applies to {n} pages	Se aplica a {n} páginas
 	Replaces the existing one on those pages.	Reemplaza al existente en esas páginas.
 	Checking pages…	Comprobando páginas…
-	This page paints its own white backdrop, which would hide the background. Replace it	Esta página tiene su propio relleno blanco, que ocultaría el fondo. Reemplazarlo
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} páginas tienen su propio relleno blanco, que ocultaría el fondo. Reemplazarlo
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	La página {pages} tiene su propio relleno blanco, que ocultaría el fondo. Reemplazarlo
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Las páginas {pages} tienen su propio relleno blanco, que ocultaría el fondo. Reemplazarlo
 	Removing the background puts the page's own backdrop back.	Al quitar el fondo, se restaura el relleno blanco propio de la página.
-	A picture covers this page (a scan?), so the background won't show there.	Una imagen cubre esta página (¿un escaneo?), así que el fondo no se verá ahí.
-	A picture covers {n} pages (scans?), so the background won't show there.	Hay imágenes que cubren {n} páginas (¿escaneos?), así que el fondo no se verá ahí.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Una imagen cubre la página {pages} (¿un escaneo?), así que el fondo no se verá ahí.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Hay imágenes que cubren las páginas {pages} (¿escaneos?), así que el fondo no se verá ahí.
 	PDF or image	PDF o imagen
 	No file chosen	Ningún archivo elegido
 	Page number	Número de página
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index d2499f5261..ba4a72b142 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -815,11 +815,11 @@
 	Applies to {n} pages	Koskee {n} sivua
 	Replaces the existing one on those pages.	Korvaa näiden sivujen nykyisen.
 	Checking pages…	Tarkistetaan sivuja…
-	This page paints its own white backdrop, which would hide the background. Replace it	Tällä sivulla on oma valkoinen täyttö, joka peittäisi taustan. Korvaa se
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} sivulla on oma valkoinen täyttö, joka peittäisi taustan. Korvaa ne
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Sivulla {pages} on oma valkoinen täyttö, joka peittäisi taustan. Korvaa se
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Sivuilla {pages} on oma valkoinen täyttö, joka peittäisi taustan. Korvaa ne
 	Removing the background puts the page's own backdrop back.	Taustan poistaminen palauttaa sivun oman valkoisen täytön.
-	A picture covers this page (a scan?), so the background won't show there.	Kuva peittää tämän sivun (skannaus?), joten tausta ei näy siinä.
-	A picture covers {n} pages (scans?), so the background won't show there.	Kuvat peittävät {n} sivua (skannauksia?), joten tausta ei näy niissä.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Kuva peittää sivun {pages} (skannaus?), joten tausta ei näy siinä.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Kuvat peittävät sivut {pages} (skannauksia?), joten tausta ei näy niissä.
 	PDF or image	PDF tai kuva
 	No file chosen	Tiedostoa ei ole valittu
 	Page number	Sivunumero
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 0e63a24ae7..7eed4b9d4c 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -831,11 +831,11 @@
 	Applies to {n} pages	S'applique à {n} pages
 	Replaces the existing one on those pages.	Remplace celui qui existe déjà sur ces pages.
 	Checking pages…	Vérification des pages…
-	This page paints its own white backdrop, which would hide the background. Replace it	Cette page a son propre remplissage blanc, qui masquerait l'arrière-plan. Le remplacer
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} pages ont leur propre remplissage blanc, qui masquerait l'arrière-plan. Le remplacer
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	La page {pages} a son propre remplissage blanc, qui masquerait l'arrière-plan. Le remplacer
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Les pages {pages} ont leur propre remplissage blanc, qui masquerait l'arrière-plan. Le remplacer
 	Removing the background puts the page's own backdrop back.	Supprimer l'arrière-plan rétablit le remplissage blanc propre à la page.
-	A picture covers this page (a scan?), so the background won't show there.	Une image couvre cette page (une numérisation ?), l'arrière-plan n'y sera donc pas visible.
-	A picture covers {n} pages (scans?), so the background won't show there.	Des images couvrent {n} pages (des numérisations ?), l'arrière-plan n'y sera donc pas visible.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Une image couvre la page {pages} (une numérisation ?), l'arrière-plan n'y sera donc pas visible.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Des images couvrent les pages {pages} (des numérisations ?), l'arrière-plan n'y sera donc pas visible.
 	PDF or image	PDF ou image
 	No file chosen	Aucun fichier choisi
 	Page number	Numéro de page
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index 9202f1d62e..4a6baf1819 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -799,11 +799,11 @@
 	Applies to {n} pages	{n} पृष्ठों पर लागू
 	Replaces the existing one on those pages.	उन पृष्ठों पर मौजूदा वाले को बदल देता है।
 	Checking pages…	पृष्ठों की जाँच हो रही है…
-	This page paints its own white backdrop, which would hide the background. Replace it	इस पृष्ठ की अपनी सफ़ेद भराई है, जो पृष्ठभूमि को छिपा देगी। इसे बदलें
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} पृष्ठों की अपनी सफ़ेद भराई है, जो पृष्ठभूमि को छिपा देगी। इसे बदलें
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	पृष्ठ {pages} की अपनी सफ़ेद भराई है, जो पृष्ठभूमि को छिपा देगी। इसे बदलें
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	पृष्ठ {pages} की अपनी सफ़ेद भराई है, जो पृष्ठभूमि को छिपा देगी। इसे बदलें
 	Removing the background puts the page's own backdrop back.	पृष्ठभूमि हटाने पर पृष्ठ की अपनी सफ़ेद भराई वापस आ जाती है।
-	A picture covers this page (a scan?), so the background won't show there.	एक छवि इस पृष्ठ को ढकती है (स्कैन?), इसलिए वहाँ पृष्ठभूमि नहीं दिखेगी।
-	A picture covers {n} pages (scans?), so the background won't show there.	छवियाँ {n} पृष्ठों को ढकती हैं (स्कैन?), इसलिए वहाँ पृष्ठभूमि नहीं दिखेगी।
+	A picture covers page {pages} (a scan?), so the background won't show there.	एक छवि पृष्ठ {pages} को ढकती है (स्कैन?), इसलिए वहाँ पृष्ठभूमि नहीं दिखेगी।
+	Pictures cover pages {pages} (scans?), so the background won't show there.	छवियाँ पृष्ठ {pages} को ढकती हैं (स्कैन?), इसलिए वहाँ पृष्ठभूमि नहीं दिखेगी।
 	PDF or image	पीडीएफ़ या छवि
 	No file chosen	कोई फ़ाइल नहीं चुनी गई
 	Page number	पृष्ठ संख्या
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 80eeb2007b..f21705c6e1 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -828,11 +828,11 @@
 	Applies to {n} pages	{n} oldalra vonatkozik
 	Replaces the existing one on those pages.	Lecseréli a meglévőt ezeken az oldalakon.
 	Checking pages…	Oldalak ellenőrzése…
-	This page paints its own white backdrop, which would hide the background. Replace it	Ennek az oldalnak saját fehér kitöltése van, amely eltakarná a hátteret. Csere
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} oldalnak saját fehér kitöltése van, amely eltakarná a hátteret. Csere
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Ennek az oldalnak saját fehér kitöltése van, amely eltakarná a hátteret: {pages}. Csere
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Ezeknek az oldalaknak saját fehér kitöltése van, amely eltakarná a hátteret: {pages}. Csere
 	Removing the background puts the page's own backdrop back.	A háttér eltávolítása visszaállítja az oldal saját fehér kitöltését.
-	A picture covers this page (a scan?), so the background won't show there.	Egy kép fedi le ezt az oldalt (szkennelt?), így ott nem látszik a háttér.
-	A picture covers {n} pages (scans?), so the background won't show there.	Képek fednek le {n} oldalt (szkenneltek?), így ott nem látszik a háttér.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Egy kép fedi le ezt az oldalt: {pages} (szkennelt?), így ott nem látszik a háttér.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Képek fedik le ezeket az oldalakat: {pages} (szkenneltek?), így ott nem látszik a háttér.
 	PDF or image	PDF vagy kép
 	No file chosen	Nincs fájl kiválasztva
 	Page number	Oldalszám
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 3d7e01d636..002cd54de7 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -945,11 +945,11 @@
 	Replacement: pages of {name}	Pengganti: halaman dari {name}
 	Replaces the existing one on those pages.	Menggantikan yang ada di halaman-halaman itu.
 	Checking pages…	Memeriksa halaman…
-	This page paints its own white backdrop, which would hide the background. Replace it	Halaman ini memiliki isian putihnya sendiri, yang akan menutupi latar belakang. Ganti
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} halaman memiliki isian putihnya sendiri, yang akan menutupi latar belakang. Ganti
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Halaman {pages} memiliki isian putihnya sendiri, yang akan menutupi latar belakang. Ganti
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Halaman-halaman {pages} memiliki isian putihnya sendiri, yang akan menutupi latar belakang. Ganti
 	Removing the background puts the page's own backdrop back.	Menghapus latar belakang akan mengembalikan isian putih milik halaman.
-	A picture covers this page (a scan?), so the background won't show there.	Sebuah gambar menutupi halaman ini (hasil pindai?), jadi latar belakang tidak akan terlihat di sana.
-	A picture covers {n} pages (scans?), so the background won't show there.	Gambar menutupi {n} halaman (hasil pindai?), jadi latar belakang tidak akan terlihat di sana.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Sebuah gambar menutupi halaman {pages} (hasil pindai?), jadi latar belakang tidak akan terlihat di sana.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Gambar menutupi halaman-halaman {pages} (hasil pindai?), jadi latar belakang tidak akan terlihat di sana.
 	Report	Laporan
 	Report…	Laporan…
 	Requires user to enter a password for:	Memerlukan pengguna untuk memasukkan kata sandi untuk:
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index a11fb4abc7..fb64615371 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -854,11 +854,11 @@
 	Applies to {n} pages	Si applica a {n} pagine
 	Replaces the existing one on those pages.	Sostituisce l'elemento esistente su quelle pagine.
 	Checking pages…	Verifica delle pagine…
-	This page paints its own white backdrop, which would hide the background. Replace it	Questa pagina ha un proprio riempimento bianco, che nasconderebbe lo sfondo. Sostituiscilo
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} pagine hanno un proprio riempimento bianco, che nasconderebbe lo sfondo. Sostituiscilo
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	La pagina {pages} ha un proprio riempimento bianco, che nasconderebbe lo sfondo. Sostituiscilo
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Le pagine {pages} hanno un proprio riempimento bianco, che nasconderebbe lo sfondo. Sostituiscilo
 	Removing the background puts the page's own backdrop back.	Rimuovendo lo sfondo, il riempimento bianco della pagina viene ripristinato.
-	A picture covers this page (a scan?), so the background won't show there.	Un'immagine copre questa pagina (una scansione?), quindi lì lo sfondo non sarà visibile.
-	A picture covers {n} pages (scans?), so the background won't show there.	Delle immagini coprono {n} pagine (scansioni?), quindi lì lo sfondo non sarà visibile.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Un'immagine copre la pagina {pages} (una scansione?), quindi lì lo sfondo non sarà visibile.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Delle immagini coprono le pagine {pages} (scansioni?), quindi lì lo sfondo non sarà visibile.
 	PDF or image	PDF o immagine
 	No file chosen	Nessun file scelto
 	Page number	Numero di pagina
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index f71e0b2fc2..79b12f015a 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -858,11 +858,11 @@
 	Applies to {n} pages	{n} ページに適用
 	Replaces the existing one on those pages.	対象ページの既存の項目を置き換えます。
 	Checking pages…	ページを確認しています…
-	This page paints its own white backdrop, which would hide the background. Replace it	このページには独自の白い塗りがあり、背景が隠れてしまいます。置き換える
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} ページに独自の白い塗りがあり、背景が隠れてしまいます。置き換える
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	{pages} ページには独自の白い塗りがあり、背景が隠れてしまいます。置き換える
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	{pages} ページに独自の白い塗りがあり、背景が隠れてしまいます。置き換える
 	Removing the background puts the page's own backdrop back.	背景を削除すると、ページ独自の白い塗りが元に戻ります。
-	A picture covers this page (a scan?), so the background won't show there.	このページは画像（スキャン？）で覆われているため、背景は表示されません。
-	A picture covers {n} pages (scans?), so the background won't show there.	{n} ページが画像（スキャン？）で覆われているため、そこでは背景は表示されません。
+	A picture covers page {pages} (a scan?), so the background won't show there.	{pages} ページは画像（スキャン？）で覆われているため、背景は表示されません。
+	Pictures cover pages {pages} (scans?), so the background won't show there.	{pages} ページが画像（スキャン？）で覆われているため、そこでは背景は表示されません。
 	PDF or image	PDF または画像
 	No file chosen	ファイルが選択されていません
 	Page number	ページ番号
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 0ddf3c9b1f..a040c013b5 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -813,11 +813,11 @@
 	Applies to {n} pages	{n} бетке қолданылады
 	Replaces the existing one on those pages.	Осы беттерде бар элементті ауыстырады.
 	Checking pages…	Беттер тексерілуде…
-	This page paints its own white backdrop, which would hide the background. Replace it	Бұл беттің өз ақ толтыруы бар, ол фонды жасырады. Ауыстыру
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} беттің өз ақ толтыруы бар, ол фонды жасырады. Ауыстыру
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Өз ақ толтыруы фонды жасыратын бет: {pages}. Ауыстыру
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Өз ақ толтыруы фонды жасыратын беттер: {pages}. Ауыстыру
 	Removing the background puts the page's own backdrop back.	Фонды жою беттің өз ақ толтыруын қайтарады.
-	A picture covers this page (a scan?), so the background won't show there.	Бұл бетті сурет жауып тұр (сканер ме?), сондықтан онда фон көрінбейді.
-	A picture covers {n} pages (scans?), so the background won't show there.	{n} бетті суреттер жауып тұр (сканер ме?), сондықтан онда фон көрінбейді.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Сурет жауып тұрған бет (сканер ме?): {pages}; онда фон көрінбейді.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Суреттер жауып тұрған беттер (сканер ме?): {pages}; онда фон көрінбейді.
 	PDF or image	PDF немесе сурет
 	No file chosen	Файл таңдалмады
 	Page number	Бет нөмірі
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 8310f1f323..873c93b6f9 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -799,11 +799,11 @@
 	Applies to {n} pages	{n}개 페이지에 적용됩니다
 	Replaces the existing one on those pages.	해당 페이지의 기존 항목을 대체합니다.
 	Checking pages…	페이지 확인 중…
-	This page paints its own white backdrop, which would hide the background. Replace it	이 페이지에는 배경을 가리는 자체 흰색 채우기가 있습니다. 바꾸기
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n}개 페이지에 배경을 가리는 자체 흰색 채우기가 있습니다. 바꾸기
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	{pages}페이지에는 배경을 가리는 자체 흰색 채우기가 있습니다. 바꾸기
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	{pages}페이지에 배경을 가리는 자체 흰색 채우기가 있습니다. 바꾸기
 	Removing the background puts the page's own backdrop back.	배경을 제거하면 페이지 자체의 흰색 채우기가 복원됩니다.
-	A picture covers this page (a scan?), so the background won't show there.	이미지가 이 페이지를 덮고 있어(스캔본?) 배경이 보이지 않습니다.
-	A picture covers {n} pages (scans?), so the background won't show there.	이미지가 {n}개 페이지를 덮고 있어(스캔본?) 배경이 보이지 않습니다.
+	A picture covers page {pages} (a scan?), so the background won't show there.	이미지가 {pages}페이지를 덮고 있어(스캔본?) 배경이 보이지 않습니다.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	이미지들이 {pages}페이지를 덮고 있어(스캔본?) 배경이 보이지 않습니다.
 	PDF or image	PDF 또는 이미지
 	No file chosen	선택한 파일 없음
 	Page number	페이지 번호
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index 587a5933a7..04d5b73d1d 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -825,11 +825,11 @@
 	Applies to {n} pages	ນຳໃຊ້ກັບ {n} ໜ້າ
 	Replaces the existing one on those pages.	ປ່ຽນແທນສິ່ງທີ່ມີຢູ່ແລ້ວໃນໜ້າເຫຼົ່ານັ້ນ.
 	Checking pages…	ກຳລັງກວດສອບໜ້າ…
-	This page paints its own white backdrop, which would hide the background. Replace it	ໜ້ານີ້ມີພື້ນສີຂາວຂອງມັນເອງ ເຊິ່ງຈະບັງພື້ນຫຼັງ. ປ່ຽນແທນ
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} ໜ້າມີພື້ນສີຂາວຂອງມັນເອງ ເຊິ່ງຈະບັງພື້ນຫຼັງ. ປ່ຽນແທນ
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	ໜ້າ {pages} ມີພື້ນສີຂາວຂອງມັນເອງ ເຊິ່ງຈະບັງພື້ນຫຼັງ. ປ່ຽນແທນ
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	ໜ້າ {pages} ມີພື້ນສີຂາວຂອງພວກມັນເອງ ເຊິ່ງຈະບັງພື້ນຫຼັງ. ປ່ຽນແທນ
 	Removing the background puts the page's own backdrop back.	ການລຶບພື້ນຫຼັງຈະເອົາພື້ນສີຂາວເດີມຂອງໜ້າກັບຄືນມາ.
-	A picture covers this page (a scan?), so the background won't show there.	ມີຮູບພາບປົກໜ້ານີ້ຢູ່ (ພາບສະແກນ?), ສະນັ້ນພື້ນຫຼັງຈະບໍ່ສະແດງຢູ່ບ່ອນນັ້ນ.
-	A picture covers {n} pages (scans?), so the background won't show there.	ມີຮູບພາບປົກ {n} ໜ້າຢູ່ (ພາບສະແກນ?), ສະນັ້ນພື້ນຫຼັງຈະບໍ່ສະແດງຢູ່ບ່ອນນັ້ນ.
+	A picture covers page {pages} (a scan?), so the background won't show there.	ມີຮູບພາບປົກໜ້າ {pages} ຢູ່ (ພາບສະແກນ?), ສະນັ້ນພື້ນຫຼັງຈະບໍ່ສະແດງຢູ່ບ່ອນນັ້ນ.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	ມີຮູບພາບຫຼາຍຮູບປົກໜ້າ {pages} ຢູ່ (ພາບສະແກນ?), ສະນັ້ນພື້ນຫຼັງຈະບໍ່ສະແດງຢູ່ບ່ອນນັ້ນ.
 	PDF or image	PDF ຫຼື ຮູບພາບ
 	No file chosen	ຍັງບໍ່ໄດ້ເລືອກໄຟລ໌
 	Page number	ໝາຍເລກໜ້າ
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index f0839dc9d5..86242b6f41 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -997,11 +997,11 @@
 	Replacement: pages of {name}	Pakaitinis dokumentas: {name} puslapiai
 	Replaces the existing one on those pages.	Tuose puslapiuose pakeičia esamą.
 	Checking pages…	Tikrinami puslapiai…
-	This page paints its own white backdrop, which would hide the background. Replace it	Šis puslapis turi savo baltą užpildą, kuris paslėptų foną. Pakeisti
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Puslapiai su savo baltu užpildu, kuris paslėptų foną: {n}. Pakeisti
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Puslapis su savo baltu užpildu, kuris paslėptų foną: {pages}. Pakeisti
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Puslapiai su savo baltu užpildu, kuris paslėptų foną: {pages}. Pakeisti
 	Removing the background puts the page's own backdrop back.	Pašalinus foną, grąžinamas paties puslapio baltas užpildas.
-	A picture covers this page (a scan?), so the background won't show there.	Šį puslapį dengia paveikslėlis (nuskaitytas?), todėl fonas ten nesimatys.
-	A picture covers {n} pages (scans?), so the background won't show there.	Paveikslėliais padengti puslapiai (nuskaityti?): {n}; fonas ten nesimatys.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Paveikslėliu padengtas puslapis (nuskaitytas?): {pages}; fonas ten nesimatys.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Paveikslėliais padengti puslapiai (nuskaityti?): {pages}; fonas ten nesimatys.
 	Report	Ataskaita
 	Report…	Ataskaita…
 	Requires user to enter a password for:	Naudotojas turi įvesti slaptažodį, kad galėtų:
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index 6391c16a9a..54bafb923a 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -954,11 +954,11 @@
 	Replacement: pages of {name}	Erstatning: sider fra {name}
 	Replaces the existing one on those pages.	Erstatter den eksisterende på disse sidene.
 	Checking pages…	Kontrollerer sidene…
-	This page paints its own white backdrop, which would hide the background. Replace it	Denne siden maler sin egen hvite flate, som ville skjult bakgrunnen. Erstatt den
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} sider maler sin egen hvite flate, som ville skjult bakgrunnen. Erstatt den
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Side {pages} maler sin egen hvite flate, som ville skjult bakgrunnen. Erstatt den
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Sidene {pages} maler sine egne hvite flater, som ville skjult bakgrunnen. Erstatt dem
 	Removing the background puts the page's own backdrop back.	Når bakgrunnen fjernes, kommer sidens egen hvite flate tilbake.
-	A picture covers this page (a scan?), so the background won't show there.	Et bilde dekker denne siden (en skanning?), så bakgrunnen vises ikke der.
-	A picture covers {n} pages (scans?), so the background won't show there.	Bilder dekker {n} sider (skanninger?), så bakgrunnen vises ikke der.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Et bilde dekker side {pages} (en skanning?), så bakgrunnen vises ikke der.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Bilder dekker sidene {pages} (skanninger?), så bakgrunnen vises ikke der.
 	Report	Rapport
 	Report…	Rapport…
 	Requires user to enter a password for:	Krever at brukeren skriver inn et passord for:
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 3b732fd4d6..d3b5abf68c 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -849,11 +849,11 @@
 	Applies to {n} pages	Liczba objętych stron: {n}
 	Replaces the existing one on those pages.	Zastępuje istniejący element na tych stronach.
 	Checking pages…	Sprawdzanie stron…
-	This page paints its own white backdrop, which would hide the background. Replace it	Ta strona ma własne białe wypełnienie, które zasłoniłoby tło. Zastąp
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Strony z własnym białym wypełnieniem, które zasłoniłoby tło: {n}. Zastąp
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Strona z własnym białym wypełnieniem, które zasłoniłoby tło: {pages}. Zastąp
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Strony z własnym białym wypełnieniem, które zasłoniłoby tło: {pages}. Zastąp
 	Removing the background puts the page's own backdrop back.	Usunięcie tła przywraca własne białe wypełnienie strony.
-	A picture covers this page (a scan?), so the background won't show there.	Tę stronę zakrywa obraz (skan?), więc tło nie będzie tam widoczne.
-	A picture covers {n} pages (scans?), so the background won't show there.	Strony zakryte obrazami (skany?): {n}; tło nie będzie tam widoczne.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Strona zakryta obrazem (skan?): {pages}; tło nie będzie tam widoczne.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Strony zakryte obrazami (skany?): {pages}; tło nie będzie tam widoczne.
 	PDF or image	PDF lub obraz
 	No file chosen	Nie wybrano pliku
 	Page number	Numer strony
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index b2dce497ad..53c2d8461d 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -483,11 +483,11 @@
 	Applies to {n} pages	Aplica-se a {n} páginas
 	Replaces the existing one on those pages.	Substitui o existente nessas páginas.
 	Checking pages…	Verificando páginas…
-	This page paints its own white backdrop, which would hide the background. Replace it	Esta página tem um preenchimento branco próprio, que esconderia o plano de fundo. Substituí-lo
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} páginas têm um preenchimento branco próprio, que esconderia o plano de fundo. Substituí-lo
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	A página {pages} tem um preenchimento branco próprio, que esconderia o plano de fundo. Substituí-lo
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	As páginas {pages} têm um preenchimento branco próprio, que esconderia o plano de fundo. Substituí-lo
 	Removing the background puts the page's own backdrop back.	Remover o plano de fundo restaura o preenchimento branco da página.
-	A picture covers this page (a scan?), so the background won't show there.	Uma imagem cobre esta página (uma digitalização?), então o plano de fundo não aparecerá nela.
-	A picture covers {n} pages (scans?), so the background won't show there.	Imagens cobrem {n} páginas (digitalizações?), então o plano de fundo não aparecerá nelas.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Uma imagem cobre a página {pages} (uma digitalização?), então o plano de fundo não aparecerá nela.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Imagens cobrem as páginas {pages} (digitalizações?), então o plano de fundo não aparecerá nelas.
 	PDF or image	PDF ou imagem
 	No file chosen	Nenhum arquivo escolhido
 	Page number	Número da página
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 643f39538b..5eb10620fb 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -954,11 +954,11 @@
 	Replacement: pages of {name}	Înlocuire: pagini din {name}
 	Replaces the existing one on those pages.	Înlocuiește-l pe cel existent pe acele pagini.
 	Checking pages…	Se verifică paginile…
-	This page paints its own white backdrop, which would hide the background. Replace it	Această pagină are o umplere albă proprie, care ar ascunde fundalul. Înlocuiește-o
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} pagini au o umplere albă proprie, care ar ascunde fundalul. Înlocuiește-o
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Pagina {pages} are o umplere albă proprie, care ar ascunde fundalul. Înlocuiește-o
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Paginile {pages} au o umplere albă proprie, care ar ascunde fundalul. Înlocuiește-o
 	Removing the background puts the page's own backdrop back.	Eliminarea fundalului readuce umplerea albă proprie a paginii.
-	A picture covers this page (a scan?), so the background won't show there.	O imagine acoperă această pagină (o scanare?), deci fundalul nu se va vedea acolo.
-	A picture covers {n} pages (scans?), so the background won't show there.	Imagini acoperă {n} pagini (scanări?), deci fundalul nu se va vedea acolo.
+	A picture covers page {pages} (a scan?), so the background won't show there.	O imagine acoperă pagina {pages} (o scanare?), deci fundalul nu se va vedea acolo.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Imagini acoperă paginile {pages} (scanări?), deci fundalul nu se va vedea acolo.
 	Report	Raport
 	Report…	Raport…
 	Requires user to enter a password for:	Utilizatorul trebuie să introducă o parolă pentru:
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index a5c23bbe93..c3eaea9ba3 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -851,11 +851,11 @@
 	Applies to {n} pages	Применяется к {n} страницам
 	Replaces the existing one on those pages.	Заменяет существующий на этих страницах.
 	Checking pages…	Проверка страниц…
-	This page paints its own white backdrop, which would hide the background. Replace it	На этой странице есть собственная белая заливка, которая скроет фон. Заменить
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Страницы с собственной белой заливкой, которая скроет фон: {n}. Заменить
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Страница с собственной белой заливкой, которая скроет фон: {pages}. Заменить
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Страницы с собственной белой заливкой, которая скроет фон: {pages}. Заменить
 	Removing the background puts the page's own backdrop back.	При удалении фона собственная белая заливка страницы возвращается.
-	A picture covers this page (a scan?), so the background won't show there.	Эту страницу закрывает изображение (скан?), поэтому фон там не будет виден.
-	A picture covers {n} pages (scans?), so the background won't show there.	Страницы, закрытые изображениями (сканы?): {n}; фон там не будет виден.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Страница, закрытая изображением (скан?): {pages}; фон там не будет виден.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Страницы, закрытые изображениями (сканы?): {pages}; фон там не будет виден.
 	PDF or image	PDF или изображение
 	No file chosen	Файл не выбран
 	Page number	Номер страницы
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 5fcbdb1268..d81b47794c 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -1523,11 +1523,11 @@
 	Replacement: pages of {name}	Zamenjava: strani datoteke {name}
 	Replaces the existing one on those pages.	Nadomesti obstoječe na teh straneh.
 	Checking pages…	Preverjanje strani…
-	This page paints its own white backdrop, which would hide the background. Replace it	Ta stran ima lastno belo polnilo, ki bi skrilo ozadje. Zamenjaj
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Strani z lastnim belim polnilom, ki bi skrilo ozadje: {n}. Zamenjaj
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Stran z lastnim belim polnilom, ki bi skrilo ozadje: {pages}. Zamenjaj
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Strani z lastnim belim polnilom, ki bi skrilo ozadje: {pages}. Zamenjaj
 	Removing the background puts the page's own backdrop back.	Odstranitev ozadja povrne lastno belo polnilo strani.
-	A picture covers this page (a scan?), so the background won't show there.	To stran prekriva slika (skeniranje?), zato ozadje tam ne bo vidno.
-	A picture covers {n} pages (scans?), so the background won't show there.	Strani, ki jih prekrivajo slike (skeniranja?): {n}; ozadje tam ne bo vidno.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Stran, ki jo prekriva slika (skeniranje?): {pages}; ozadje tam ne bo vidno.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Strani, ki jih prekrivajo slike (skeniranja?): {pages}; ozadje tam ne bo vidno.
 	Replacing images arrives on the web with image file pickers	Zamenjava slik bo v spletni različici na voljo z izbirniki slikovnih datotek
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Zamenjava slik na strani {p} bo v spletni različici na voljo z izbirniki slik ({i})
 	Reply	Odgovori
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index c2fb7fd029..e0b8e0e726 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -1476,11 +1476,11 @@
 	Replacement: pages of {name}	Zëvendësimi: faqet e {name}
 	Replaces the existing one on those pages.	Zëvendëson atë ekzistues në ato faqe.
 	Checking pages…	Po kontrollohen faqet…
-	This page paints its own white backdrop, which would hide the background. Replace it	Kjo faqe ka mbushjen e vet të bardhë, e cila do ta fshihte sfondin. Zëvendësoje
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} faqe kanë mbushjen e tyre të bardhë, e cila do ta fshihte sfondin. Zëvendësoje
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Faqja {pages} ka mbushjen e vet të bardhë, e cila do ta fshihte sfondin. Zëvendësoje
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Faqet {pages} kanë mbushjen e tyre të bardhë, e cila do ta fshihte sfondin. Zëvendësoje
 	Removing the background puts the page's own backdrop back.	Heqja e sfondit e rikthen mbushjen e bardhë të faqes.
-	A picture covers this page (a scan?), so the background won't show there.	Një imazh e mbulon këtë faqe (skanim?), prandaj sfondi nuk do të duket aty.
-	A picture covers {n} pages (scans?), so the background won't show there.	Imazhe mbulojnë {n} faqe (skanime?), prandaj sfondi nuk do të duket aty.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Një imazh e mbulon faqen {pages} (skanim?), prandaj sfondi nuk do të duket aty.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Imazhe mbulojnë faqet {pages} (skanime?), prandaj sfondi nuk do të duket aty.
 	Replacing images arrives on the web with image file pickers	Zëvendësimi i imazheve vjen në ueb me zgjedhësit e skedarëve të imazhit
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Zëvendësimi i imazheve në faqen {p} vjen në ueb me zgjedhësit e imazhit ({i})
 	Reply	Përgjigju
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 0d745bbd97..adaefdbedf 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -831,11 +831,11 @@ comment menu	Edit	సవరించు
 	Applies to {n} pages	{n} పేజీలకు వర్తిస్తుంది
 	Replaces the existing one on those pages.	ఆ పేజీలలో ఇప్పటికే ఉన్నదాన్ని భర్తీ చేస్తుంది.
 	Checking pages…	పేజీలను తనిఖీ చేస్తోంది…
-	This page paints its own white backdrop, which would hide the background. Replace it	ఈ పేజీకి సొంత తెల్లని నింపు ఉంది, అది నేపథ్యాన్ని దాచేస్తుంది. భర్తీ చేయండి
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} పేజీలకు సొంత తెల్లని నింపు ఉంది, అది నేపథ్యాన్ని దాచేస్తుంది. భర్తీ చేయండి
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	పేజీ {pages}కి సొంత తెల్లని నింపు ఉంది, అది నేపథ్యాన్ని దాచేస్తుంది. భర్తీ చేయండి
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	పేజీలు {pages}కి సొంత తెల్లని నింపు ఉంది, అది నేపథ్యాన్ని దాచేస్తుంది. భర్తీ చేయండి
 	Removing the background puts the page's own backdrop back.	నేపథ్యాన్ని తీసివేస్తే పేజీ సొంత తెల్లని నింపు తిరిగి వస్తుంది.
-	A picture covers this page (a scan?), so the background won't show there.	ఈ పేజీని ఒక చిత్రం కప్పుతోంది (స్కాన్?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
-	A picture covers {n} pages (scans?), so the background won't show there.	{n} పేజీలను చిత్రాలు కప్పుతున్నాయి (స్కాన్‌లు?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
+	A picture covers page {pages} (a scan?), so the background won't show there.	పేజీ {pages}ని ఒక చిత్రం కప్పుతోంది (స్కాన్?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	పేజీలు {pages}ని చిత్రాలు కప్పుతున్నాయి (స్కాన్‌లు?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
 	PDF or image	PDF లేదా చిత్రం
 	No file chosen	ఫైల్ ఏదీ ఎంచుకోలేదు
 	Page number	పేజీ సంఖ్య
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index aaaaff4858..2740313342 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -810,11 +810,11 @@
 	Applies to {n} pages	มีผลกับ {n} หน้า
 	Replaces the existing one on those pages.	แทนที่ของเดิมในหน้าเหล่านั้น
 	Checking pages…	กำลังตรวจสอบหน้า…
-	This page paints its own white backdrop, which would hide the background. Replace it	หน้านี้มีพื้นสีขาวของตัวเองซึ่งจะบังพื้นหลัง แทนที่
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} หน้ามีพื้นสีขาวของตัวเองซึ่งจะบังพื้นหลัง แทนที่
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	หน้า {pages} มีพื้นสีขาวของตัวเองซึ่งจะบังพื้นหลัง แทนที่
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	หน้า {pages} มีพื้นสีขาวของตัวเองซึ่งจะบังพื้นหลัง แทนที่ทั้งหมด
 	Removing the background puts the page's own backdrop back.	การเอาพื้นหลังออกจะคืนพื้นสีขาวเดิมของหน้า
-	A picture covers this page (a scan?), so the background won't show there.	มีรูปภาพปิดหน้านี้อยู่ (ภาพสแกน?) จึงจะมองไม่เห็นพื้นหลังที่นั่น
-	A picture covers {n} pages (scans?), so the background won't show there.	มีรูปภาพปิด {n} หน้าอยู่ (ภาพสแกน?) จึงจะมองไม่เห็นพื้นหลังที่นั่น
+	A picture covers page {pages} (a scan?), so the background won't show there.	มีรูปภาพปิดหน้า {pages} อยู่ (ภาพสแกน?) จึงจะมองไม่เห็นพื้นหลังที่นั่น
+	Pictures cover pages {pages} (scans?), so the background won't show there.	มีรูปภาพหลายรูปปิดหน้า {pages} อยู่ (ภาพสแกน?) จึงจะมองไม่เห็นพื้นหลังที่นั่น
 	PDF or image	PDF หรือรูปภาพ
 	No file chosen	ยังไม่ได้เลือกไฟล์
 	Page number	เลขหน้า
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index 53fb666bb5..a31216ca53 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -812,11 +812,11 @@
 	Applies to {n} pages	{n} sayfaya uygulanır
 	Replaces the existing one on those pages.	Bu sayfalardaki mevcut olanın yerini alır.
 	Checking pages…	Sayfalar denetleniyor…
-	This page paints its own white backdrop, which would hide the background. Replace it	Bu sayfanın arka planı gizleyecek kendi beyaz dolgusu var. Değiştir
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} sayfanın arka planı gizleyecek kendi beyaz dolgusu var. Değiştir
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Arka planı gizleyecek kendi beyaz dolgusu olan sayfa: {pages}. Değiştir
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Arka planı gizleyecek kendi beyaz dolgusu olan sayfalar: {pages}. Değiştir
 	Removing the background puts the page's own backdrop back.	Arka planı kaldırmak, sayfanın kendi beyaz dolgusunu geri getirir.
-	A picture covers this page (a scan?), so the background won't show there.	Bu sayfayı bir resim kaplıyor (tarama mı?), bu yüzden arka plan orada görünmez.
-	A picture covers {n} pages (scans?), so the background won't show there.	{n} sayfayı resimler kaplıyor (tarama mı?), bu yüzden arka plan orada görünmez.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Resimle kaplı sayfa (tarama mı?): {pages}; arka plan orada görünmez.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Resimlerle kaplı sayfalar (tarama mı?): {pages}; arka plan orada görünmez.
 	PDF or image	PDF veya resim
 	No file chosen	Dosya seçilmedi
 	Page number	Sayfa numarası
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 3672b982dd..c1f294dfd1 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -855,11 +855,11 @@
 	Applies to {n} pages	Застосовується до {n} сторінок
 	Replaces the existing one on those pages.	Замінює наявний елемент на цих сторінках.
 	Checking pages…	Перевірка сторінок…
-	This page paints its own white backdrop, which would hide the background. Replace it	Ця сторінка має власну білу заливку, яка приховає тло. Замінити
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	Сторінки з власною білою заливкою, яка приховає тло: {n}. Замінити
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Сторінка з власною білою заливкою, яка приховає тло: {pages}. Замінити
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Сторінки з власною білою заливкою, яка приховає тло: {pages}. Замінити
 	Removing the background puts the page's own backdrop back.	Вилучення тла повертає власну білу заливку сторінки.
-	A picture covers this page (a scan?), so the background won't show there.	Цю сторінку закриває зображення (скан?), тому тло там не буде видно.
-	A picture covers {n} pages (scans?), so the background won't show there.	Сторінки, закриті зображеннями (скани?): {n}; тло там не буде видно.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Сторінка, закрита зображенням (скан?): {pages}; тло там не буде видно.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Сторінки, закриті зображеннями (скани?): {pages}; тло там не буде видно.
 	PDF or image	PDF або зображення
 	No file chosen	Файл не вибрано
 	Page number	Номер сторінки
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 5d300e8aef..526fbac0b1 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -991,11 +991,11 @@ theme	Appearance	Giao diện
 	Replacement: pages of {name}	Thay thế: các trang của {name}
 	Replaces the existing one on those pages.	Thay thế cái hiện có trên các trang đó.
 	Checking pages…	Đang kiểm tra các trang…
-	This page paints its own white backdrop, which would hide the background. Replace it	Trang này có lớp tô trắng riêng, sẽ che mất nền. Thay thế
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} trang có lớp tô trắng riêng, sẽ che mất nền. Thay thế
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	Trang {pages} có lớp tô trắng riêng, sẽ che mất nền. Thay thế
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	Các trang {pages} có lớp tô trắng riêng, sẽ che mất nền. Thay thế
 	Removing the background puts the page's own backdrop back.	Gỡ nền sẽ khôi phục lớp tô trắng riêng của trang.
-	A picture covers this page (a scan?), so the background won't show there.	Một hình ảnh phủ kín trang này (bản quét?), nên nền sẽ không hiện ở đó.
-	A picture covers {n} pages (scans?), so the background won't show there.	Hình ảnh phủ kín {n} trang (bản quét?), nên nền sẽ không hiện ở đó.
+	A picture covers page {pages} (a scan?), so the background won't show there.	Một hình ảnh phủ kín trang {pages} (bản quét?), nên nền sẽ không hiện ở đó.
+	Pictures cover pages {pages} (scans?), so the background won't show there.	Hình ảnh phủ kín các trang {pages} (bản quét?), nên nền sẽ không hiện ở đó.
 	Report	Báo cáo
 	Report…	Báo cáo…
 	Requires user to enter a password for:	Yêu cầu người dùng nhập mật khẩu cho:
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index f07073c1b3..0055556061 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -535,11 +535,11 @@
 	Applies to {n} pages	应用于 {n} 页
 	Replaces the existing one on those pages.	替换这些页面上的现有内容。
 	Checking pages…	正在检查页面…
-	This page paints its own white backdrop, which would hide the background. Replace it	此页面有自己的白色填充，会遮住背景。替换它
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} 个页面有自己的白色填充，会遮住背景。替换它
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	第 {pages} 页有自己的白色填充，会遮住背景。替换它
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	第 {pages} 页各有自己的白色填充，会遮住背景。替换它们
 	Removing the background puts the page's own backdrop back.	移除背景后，页面自己的白色填充会恢复。
-	A picture covers this page (a scan?), so the background won't show there.	此页面被一张图片覆盖（扫描件？），因此那里不会显示背景。
-	A picture covers {n} pages (scans?), so the background won't show there.	{n} 个页面被图片覆盖（扫描件？），因此那里不会显示背景。
+	A picture covers page {pages} (a scan?), so the background won't show there.	第 {pages} 页被一张图片覆盖（扫描件？），因此那里不会显示背景。
+	Pictures cover pages {pages} (scans?), so the background won't show there.	第 {pages} 页被图片覆盖（扫描件？），因此那里不会显示背景。
 	PDF or image	PDF 或图像
 	No file chosen	未选择文件
 	Page number	页码
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index b988a5d8b3..bb42c169a6 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -487,11 +487,11 @@
 	Applies to {n} pages	套用於 {n} 頁
 	Replaces the existing one on those pages.	替換這些頁面上的現有內容。
 	Checking pages…	正在檢查頁面…
-	This page paints its own white backdrop, which would hide the background. Replace it	此頁面有自己的白色填色，會遮住背景。取代它
-	{n} pages paint their own white backdrop, which would hide the background. Replace it	{n} 個頁面有自己的白色填色，會遮住背景。取代它
+	Page {pages} paints its own white backdrop, which would hide the background. Replace it	第 {pages} 頁有自己的白色填色，會遮住背景。取代它
+	Pages {pages} paint their own white backdrop, which would hide the background. Replace it	第 {pages} 頁各有自己的白色填色，會遮住背景。取代它們
 	Removing the background puts the page's own backdrop back.	移除背景後，頁面自己的白色填色會恢復。
-	A picture covers this page (a scan?), so the background won't show there.	此頁面被一張圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
-	A picture covers {n} pages (scans?), so the background won't show there.	{n} 個頁面被圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
+	A picture covers page {pages} (a scan?), so the background won't show there.	第 {pages} 頁被一張圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
+	Pictures cover pages {pages} (scans?), so the background won't show there.	第 {pages} 頁被圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
 	PDF or image	PDF 或圖片
 	No file chosen	未選擇檔案
 	Page number	頁碼
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index 8a445544be..2cf2450336 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -85,18 +85,18 @@ pub struct BackdropCheck {
 }
 
 /// What the check found among the pages a background goes on.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct BackdropCount {
-    /// Pages with a white backdrop that can be replaced.
-    pub fills: usize,
-    /// Pages covered by a picture (scans): the background stays hidden there.
-    pub images: usize,
+    /// Pages (0-based, ascending) with a white backdrop that can be replaced.
+    pub fills: Vec<usize>,
+    /// Pages (0-based, ascending) covered by a picture (scans): the background stays hidden there.
+    pub images: Vec<usize>,
     /// Pages not checked yet.
     pub pending: usize,
 }
 
 impl BackdropCheck {
-    /// Check up to [`BACKDROP_PAGES_PER_FRAME`] more of `pages` (0-based) and count them.
+    /// Check up to [`BACKDROP_PAGES_PER_FRAME`] more of `pages` (0-based) and sort them.
     pub fn update(&mut self, doc: &pdfcraft_engine::Document, pages: &[usize]) -> BackdropCount {
         let key = (doc.id, doc.edit_generation());
         let count = doc.info.pages.len();
@@ -126,11 +126,15 @@ impl BackdropCheck {
             let Some(slot) = self.pages.get(p) else { continue };
             match slot {
                 None => n.pending += 1,
-                Some(Some(Backdrop::Fill)) => n.fills += 1,
-                Some(Some(Backdrop::Image)) => n.images += 1,
+                Some(Some(Backdrop::Fill)) => n.fills.push(p),
+                Some(Some(Backdrop::Image)) => n.images.push(p),
                 Some(None) => {}
             }
         }
+        for list in [&mut n.fills, &mut n.images] {
+            list.sort_unstable();
+            list.dedup();
+        }
         n
     }
 }
@@ -147,9 +151,21 @@ impl MarksDraft {
     }
 }
 
-/// "1 page" or "{n} pages", in a message.
-fn pages_phrase(n: usize, one: &str, many: &str) -> String {
-    if n == 1 { one.to_string() } else { crate::i18n::fmt(many, &[("n", &n.to_string())]) }
+/// How many runs of pages a message lists before it stops with "…".
+const LISTED_PAGE_RUNS: usize = 8;
+
+/// `one` or `many` with `{pages}` replaced by `pages` (0-based, ascending) as 1-based runs
+/// ("1-3, 6"), so the message says which pages it means.
+fn pages_phrase(pages: &[usize], one: &str, many: &str) -> String {
+    // `count` 0 never matches a list that isn't empty, so the list is always written out.
+    let runs = crate::combine_ui::range_of(pages, 0);
+    let mut parts: Vec<&str> = runs.split(", ").take(LISTED_PAGE_RUNS + 1).collect();
+    if parts.len() > LISTED_PAGE_RUNS {
+        parts.truncate(LISTED_PAGE_RUNS);
+        parts.push("…");
+    }
+    let template = if pages.len() == 1 { one } else { many };
+    crate::i18n::fmt(template, &[("pages", &parts.join(", "))])
 }
 
 #[derive(Clone, Debug, PartialEq)]
@@ -599,22 +615,22 @@ fn backdrop_options(ui: &mut egui::Ui, t: &Tokens, d: &mut MarksDraft, doc: &pdf
         ui.label(egui::RichText::new(tl!("Checking pages…")).small().color(t.text_faint));
         ui.ctx().request_repaint();
     }
-    if n.fills > 0 {
+    if !n.fills.is_empty() {
         ui.add_space(4.0);
         let label = pages_phrase(
-            n.fills,
-            tl!("This page paints its own white backdrop, which would hide the background. Replace it"),
-            tl!("{n} pages paint their own white backdrop, which would hide the background. Replace it"),
+            &n.fills,
+            tl!("Page {pages} paints its own white backdrop, which would hide the background. Replace it"),
+            tl!("Pages {pages} paint their own white backdrop, which would hide the background. Replace it"),
         );
         ui.add(widgets::checkbox(&mut d.bg.replace_backdrop, &label));
         ui.label(egui::RichText::new(tl!("Removing the background puts the page's own backdrop back.")).small().color(t.text_faint));
     }
-    if n.images > 0 {
+    if !n.images.is_empty() {
         ui.add_space(4.0);
         let text = pages_phrase(
-            n.images,
-            tl!("A picture covers this page (a scan?), so the background won't show there."),
-            tl!("A picture covers {n} pages (scans?), so the background won't show there."),
+            &n.images,
+            tl!("A picture covers page {pages} (a scan?), so the background won't show there."),
+            tl!("Pictures cover pages {pages} (scans?), so the background won't show there."),
         );
         ui.label(egui::RichText::new(text).small().color(crate::content_ui::UNDRAWABLE));
     }
@@ -654,6 +670,18 @@ mod tests {
         assert_eq!(undrawable(MarkKind::Background, &d), None);
     }
 
+    #[test]
+    fn backdrop_messages_name_their_pages() {
+        let phrase = |pages: &[usize]| pages_phrase(pages, "Page {pages}", "Pages {pages}");
+        assert_eq!(phrase(&[2]), "Page 3");
+        assert_eq!(phrase(&[0, 1, 2, 5]), "Pages 1-3, 6");
+        assert_eq!(phrase(&[0, 1]), "Pages 1-2", "a whole document is still listed");
+        let every_other: Vec<usize> = (0..40).step_by(2).collect();
+        assert_eq!(phrase(&every_other), "Pages 1, 3, 5, 7, 9, 11, 13, 15, …", "a long list stops");
+        let runs: Vec<usize> = (0..LISTED_PAGE_RUNS * 2).step_by(2).collect();
+        assert_eq!(phrase(&runs), "Pages 1, 3, 5, 7, 9, 11, 13, 15", "exactly the limit: no …");
+    }
+
     #[test]
     fn page_ranges_with_subsets() {
         let r = PageRange::default();
diff --git a/crates/ui-egui/tests/it/marks.rs b/crates/ui-egui/tests/it/marks.rs
index 9887589119..8edc9e3ce6 100644
--- a/crates/ui-egui/tests/it/marks.rs
+++ b/crates/ui-egui/tests/it/marks.rs
@@ -179,8 +179,8 @@ fn the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scan
     assert_eq!(backdrop(&h, 0), Some(pdfcraft_engine::Backdrop::Fill));
     h.state_mut().execute("edit.background");
     h.run_steps(3);
-    let replace = "This page paints its own white backdrop, which would hide the background. Replace it";
-    h.get_by_label("A picture covers this page (a scan?), so the background won't show there.");
+    let replace = "Page 1 paints its own white backdrop, which would hide the background. Replace it";
+    h.get_by_label("A picture covers page 2 (a scan?), so the background won't show there.");
     assert!(h.state().marks_draft.bg.replace_backdrop, "on by default");
     // Left unticked, the backdrop stays and still hides the background.
     h.get_by_label(replace).click();

From b4fcf2009e35137a4c855bd81826a0c58b97b8ca Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Fri, 23 Oct 2026 20:43:55 +0200
Subject: [PATCH 021/132] fix(assets): refresh the catalogue hashes for the
 page-naming messages

c7715a09 rewrote the Add Background strings in all 33 catalogues; their
SHA-256 entries in ATTRIBUTION.toml still named the old files, which
the_real_manifest_passes rejects. Provenance is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ATTRIBUTION.toml | 66 ++++++++++++++++++++++++------------------------
 1 file changed, 33 insertions(+), 33 deletions(-)

diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index e3063a82ed..aa35ebee0b 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -7,7 +7,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Greek UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "746ab724111dc0538cb5821aaa12a27b278fd4fa2a3565c37fd9172f8a3a2465"
+sha256 = "c5692e17e4dba75cda1e082aa35dcc6ab552861c614eb98e7aef5d021737a14b"
 
 # ATTRIBUTION.toml: one entry per asset (AGENTS.md §1). The source of truth for provenance and licences.
 # ATTRIBUTION.md is generated from this file: `cargo xtask assets --write`. Checked by `cargo xtask assets` (part of `xtask ci`).
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "4ec959260c8dc24b26b150008119061896796cb849e15ef8f85ef2950ab7ca6f"
+sha256 = "e5787d93660ce25ca8ba5055d601f0c132b905cb726d0523b370c44c52928129"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "faac9e5e31340425a5e110ff0b3c54bdae8dec2842e69c827bad8b5291d8a2ce"
+sha256 = "ba079e3ead466d611171e98986b689473c7645146435f13710d9ed0190f1860a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "58180ff4dbc8482d3dcbba356f9024be094b49e2fe9732b0aec575d72a0c4bf9"
+sha256 = "77a1171f3a88d0ecd6313a5b642463ec4d4f879fef41fe155c640a8f32317f91"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3e4b99a9a565fdb96f497e4bcbe93189effcd50a04cc26fafa8715c8702d6333"
+sha256 = "95a201a467b7cc0c458b12374f328f99819b5eb56a498cb4cf1cf2e786988779"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "ef9df3df27f9de594da1cecc0e33914f86a4a1af6492af27ebd3f6895bf05489"
+sha256 = "587f3b492901e4f8b6c86feb6a7d9ab32bb3b705500c4acffc97ffe41e993f9e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2456ba17cf6cb3a15210b6492d30a0057b7f518eee72dab3833bc77d8477d56e"
+sha256 = "ca614672786c2ba2e77f23cfe9086fc37ccbc046025ba4112f8c2fc970f123e9"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8f3a4e543ac8c54adcb5f16f89749f3d835e2ad7b9554f6edc22572b3a923a4d"
+sha256 = "1caa7048aee0fe8f0072890bff5abb2492e092221ab5d5a0693a397c6b92a583"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/lo.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Lao UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "44a7d31238fbbede2ac5b2f33b1f77b9d8916a4e4af9a03a4bec863338987af0"
+sha256 = "7cf8d8389296cbc1403b581c5988af649f795f2561b08651925bb0a8d08ee399"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8403d18d064ce676bd1ac7609956b15062aadeebc0bb262cad8103a0d6e4a43c"
+sha256 = "39b3af8c1c46d3344694505e7c36afa6f67032fff96530d363707e42bba0510b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/it.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Italian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e9e0abfa57671c41875adffef7eaf8d8e6b15ffc8ffbd8385dafa3db1d89abe2"
+sha256 = "e4baa759322a6d40689cea9782d518bbad5268a74b5c7d9b41741d9d9c44fd92"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pl.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Polish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "0f3232031495a5c2b6f450b235198c22567cc79a9c8d573c32c25e5d83face72"
+sha256 = "548bd98cc3c62b5e3861c14039668c79b3dec7c055a879591afad4b279e94d4d"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e4bef8e7bf98d78151df2db59abfba5e1a955b248e5dfd5402aef12c24731108"
+sha256 = "ad35fe52dc926e11ef49ad82d92a42853a6c94e5724ec426c8ab8cc55609bc31"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -162,7 +162,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b0962e829fc149cf18cd84fecdf787bf6f3b5ce0f97e61fcdfe4a0321512f6e6"
+sha256 = "d324d91664e1846bd05aa433763f0fd16acbb815479b0e7a520e187de885232e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -173,7 +173,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1df8919d17ba42a1768a04e2b11558f47be23c63756473cafa1cc7dd3aaf7564"
+sha256 = "3363b19abe2bb38956799b8451d381e0778a3a835c92ff8c1140c1274c7b259b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/kk.tsv"
@@ -184,7 +184,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Kazakh UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e6870037279668a53cde6d1a7eae8d61c1002990d122e1d390e1057f13316200"
+sha256 = "b3307ea848e8f1676f8b95a0cb0cb0a68cf2762b8eca59ebb80cc7780a1cc364"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -195,7 +195,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cf84bfcfe361a3d5133b5de7cfd788f1f4c2b5a1969d9aefe6ec3e5749372123"
+sha256 = "2f01d6fe013487a5baed976d7f98cf89d60755dd00bba53dd42c79848f2b781b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -206,7 +206,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d25bc5760f1a4ca6f50712f242d7a7989351d42019af761db83ec702605c1d16"
+sha256 = "b2eafb2fbef3153b2b06a612605ddb7d3e6c9c66422f05147a1be5cb9ce652f6"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ar.tsv"
@@ -217,7 +217,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Arabic UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "9b89aa34aaafa8ce0a9e1e98e9be7dc69835b38101c315ce8f7c7ebcf7f96b83"
+sha256 = "c1afb46d732705d96d4b1ed2c375faf8102001a60ae48607dd8b605078994aa8"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ckb.tsv"
@@ -228,7 +228,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Central Kurdish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "62981ff0ce56a46fbd5a11ef65c7a0a6898fd9ca9cd9a424daf48e059cd42bd3"
+sha256 = "7fee1bb00cd7f4ab3366bc2190cee18edf1f6708a270dcdaa467c73feb0ce22c"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/tr.tsv"
@@ -239,7 +239,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Turkish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "27eacc541e08224ce5f52c90541cc8374c8c31c72746c6f32c9052fb5588d44a"
+sha256 = "0ec370727a8c4e4623f7ce35cd69612eb0a8a2b88acbdc931b94a999addf2d8b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/lt.tsv"
@@ -250,7 +250,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Lithuanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "cbdc4c994fb652b9081aa2ebfc06a7e4a18f0838f6af68b2d68d278c74d404df"
+sha256 = "ebce98f72db3b90ba8860982126d4492d61d0a2c8bcf1c45da21a5546bc2f076"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hi.tsv"
@@ -261,7 +261,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hindi UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "475a0094dd78dcdf74a8b30260765ea9695591b9d90d84a7e5736cbe24c82a21"
+sha256 = "c128079b905b2d48c923e437fc1d1a4864a49c18d074446bc0845d6590bb462e"
 [[asset]]
 path = "crates/ui-egui/src/i18n/id.tsv"
 title = "Indonesian interface translation catalog"
@@ -271,7 +271,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Indonesian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f6a513a55e97df333b258decf5f9d28b42cb28a0533fd85234d5c12c4bb77d4a"
+sha256 = "51d7e93a72f58dacfa3027f5f8bbeaee988787ea6497cd38cfd4282a359a4517"
 [[asset]]
 path = "crates/ui-egui/src/i18n/ko.tsv"
 title = "Korean interface translation catalog"
@@ -281,7 +281,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Korean UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "def6155d2bdc7ff2a384330e65428d4352d3122a145113e6bd54282a1bd9b64f"
+sha256 = "78499f116a6929187477c82bd42767cfb150d16f76c94df4758f6b5ae82b17be"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ro.tsv"
@@ -292,7 +292,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Romanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "524d37d0ffb574189e6b2316e78342bc31a206749e5db8b218f5dd588f8c2906"
+sha256 = "6a6d0999907a755ceeab5e66893381c57dd6252dd83049ee0eacb0f07a23e044"
 
 
 [[asset]]
@@ -304,7 +304,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Finnish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "7dbd6269e82cfbfc002c236d4cb4252bfc879ef04466f8226ae630b66d1eec07"
+sha256 = "c23be7138d1d1258f95739d097759d6b633bac65d4fe619c1ef81c92b035938e"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
@@ -3426,7 +3426,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Vietnamese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "ccc96b3b0e5cf14e88c20312e05dbbb4b08271b6bf40d932f9e5c9b81f8e0d7e"
+sha256 = "7893330225e617c2debb63a2bbaa47d85befe207833a150ec7e9c1dda9ed8fdc"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/sl.tsv"
@@ -3437,7 +3437,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Slovene UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "58590297c84a7b606f45e92b3ae0ad1ded5eef528898c02436515f8dc8e317ff"
+sha256 = "4fb04ace2319ed505779c3a0d8e63b07f886ba6414ea065dfa98ca6f46f71757"
 
 [[asset]]
 
@@ -3460,7 +3460,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Norwegian Bokmål UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3acc16cae1c2ec53da247086cc05ec67cc349bafdffd2a18738e2d2ccc0da68d"
+sha256 = "bd27598a0cdd37331ff31b63a2974392c3ed61144da1cc9cdbc5b1acd11900d1"
 
 [[asset]]
 path = "assets/icons/superscript.svg"
@@ -3515,7 +3515,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Albanian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "5bf431406a85508f86114d6c2da9e9a0a06ee5bd262c144d4575312608f2a860"
+sha256 = "7e0f5a65b7f3d4a0b79b3f27d26e52f85f0dd21bf1fb47b824d22ef3e80395f4"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/th.tsv"
@@ -3526,7 +3526,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Thai UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "00db9fa3069b3dbaf42c3e7464b36c5c5cd4a636fdb26da843cdf3fa1f50cb3e"
+sha256 = "0a448b5ae556fb575c1183d169a46a19d4339060315665e992403eac9fb48c6e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ca.tsv"
@@ -3537,4 +3537,4 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Catalan UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "712221c2439f61e3eca0932d17b144cae4a50c1c87b48225bf2496edf91be784"
+sha256 = "38188d69f1af9badfb5c1c0e988854b9da546b76de850c9ecb5f759759013ecb"

From 3485e92a95de7865077857deafb20bc590a17a1c Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Fri, 23 Oct 2026 23:58:42 +0200
Subject: [PATCH 022/132] fix(edit): backdrop copies keep no reference that
 outlives a redaction

The tag on a page's backdrop copy, `/PCBackdrop << /Original ref /At /Len >>`, kept the
page's original content stream reachable. After Add background, then Redact (or Remove
Hidden Information, or Edit text) and a full save, the text taken off the page was still in
the file, in the original stream the tag pointed at. Text extraction didn't show it; reading
the file's bytes did. Restore also gave up after any edit, so the fill stayed off without a
word.

The tag is now `/PCBackdrop << /Index n /Op (f) /Before <SHA-256> /Was [num gen] >>`: how many
of the copy's operators come before the `n`, the fill it stands in for, a hash of those
operators by value (redaction writes the stream out again with other spacing), and the
original's number as two integers, which keep nothing alive.

Remove background turns the fill back on in the copy when the operators before it still
hash the same and a scan with the fill restored finds it painted first, covering the page.
Edits and redactions after the fill are kept. When the original stream is still there with
the same bytes, the page points at it again. Otherwise the copy stays as it is, and
Remove background says which pages keep their own backdrop off: `EditNotice::BackdropsLeftOff`
(engine), a toast in the app, `warnings` from `doc_remove_marks`. `edit_notices` holds
`EditNotice` now, with the undrawn-text notice as one of its kinds. The two new UI strings
are in all 33 catalogues.

`sha2` (already in the lock file) becomes a dependency of `pdfcraft-edit`.

Tests, each seen failing with its piece of the fix reverted:
- `the_tag_holds_no_reference_and_a_full_save_keeps_no_second_copy_of_the_page` and
  `removed_text_leaves_the_file_when_a_background_replaced_the_pages_backdrop` (automation,
  redaction and Remove Hidden Information through a full save): fail with `/Original` back.
- `a_fill_that_would_cover_content_painted_before_it_stays_off`: fails without the re-scan.
- `a_copy_written_out_again_with_other_spacing_still_comes_back` and the automation test:
  fail when the raw bytes are hashed instead of the operators.
- `an_edit_after_the_fill_is_kept_and_the_backdrop_still_comes_back`: fails under the old
  rule (only an unchanged copy comes back).
- `remove_background_names_the_pages_whose_own_backdrop_stays_off` (engine),
  `remove_background_warns_about_pages_whose_own_backdrop_stays_off` (automation),
  `remove_background_says_which_pages_keep_their_own_backdrop_off` (UI): fail without the
  notice.
- `a_change_before_the_fill_leaves_it_off_and_names_the_page`,
  `a_tag_that_does_not_add_up_is_left_alone` (hostile and old-format tags, never a panic),
  `operators_hash_by_value_not_by_spelling`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                             |   1 +
 ROADMAP.md                             |   2 +-
 crates/automation/src/tools.rs         |   2 +-
 crates/automation/tests/it/backdrop.rs | 117 ++++++++++-
 crates/edit/Cargo.toml                 |   2 +
 crates/edit/src/backdrop.rs            | 270 ++++++++++++++++++++-----
 crates/edit/src/backdrop_tests.rs      | 167 ++++++++++++++-
 crates/edit/src/lib.rs                 |   8 +-
 crates/engine/src/lib.rs               |  59 +++++-
 crates/engine/src/tests.rs             |  65 +++++-
 crates/ui-egui/src/editing.rs          |  10 +-
 crates/ui-egui/src/i18n/ar.tsv         |   2 +
 crates/ui-egui/src/i18n/bg.tsv         |   2 +
 crates/ui-egui/src/i18n/ca.tsv         |   2 +
 crates/ui-egui/src/i18n/ckb.tsv        |   2 +
 crates/ui-egui/src/i18n/cs.tsv         |   2 +
 crates/ui-egui/src/i18n/de.tsv         |   2 +
 crates/ui-egui/src/i18n/el.tsv         |   2 +
 crates/ui-egui/src/i18n/es.tsv         |   2 +
 crates/ui-egui/src/i18n/fi.tsv         |   2 +
 crates/ui-egui/src/i18n/fr.tsv         |   2 +
 crates/ui-egui/src/i18n/hi.tsv         |   2 +
 crates/ui-egui/src/i18n/hu.tsv         |   2 +
 crates/ui-egui/src/i18n/id.tsv         |   2 +
 crates/ui-egui/src/i18n/it.tsv         |   2 +
 crates/ui-egui/src/i18n/ja.tsv         |   2 +
 crates/ui-egui/src/i18n/kk.tsv         |   2 +
 crates/ui-egui/src/i18n/ko.tsv         |   2 +
 crates/ui-egui/src/i18n/lo.tsv         |   2 +
 crates/ui-egui/src/i18n/lt.tsv         |   2 +
 crates/ui-egui/src/i18n/nb.tsv         |   2 +
 crates/ui-egui/src/i18n/pl.tsv         |   2 +
 crates/ui-egui/src/i18n/pt-br.tsv      |   2 +
 crates/ui-egui/src/i18n/ro.tsv         |   2 +
 crates/ui-egui/src/i18n/ru.tsv         |   2 +
 crates/ui-egui/src/i18n/sl.tsv         |   2 +
 crates/ui-egui/src/i18n/sq.tsv         |   2 +
 crates/ui-egui/src/i18n/te.tsv         |   2 +
 crates/ui-egui/src/i18n/th.tsv         |   2 +
 crates/ui-egui/src/i18n/tr.tsv         |   2 +
 crates/ui-egui/src/i18n/uk.tsv         |   2 +
 crates/ui-egui/src/i18n/vi.tsv         |   2 +
 crates/ui-egui/src/i18n/zh-hans.tsv    |   2 +
 crates/ui-egui/src/i18n/zh-hant.tsv    |   2 +
 crates/ui-egui/src/marks_ui.rs         |  10 +
 crates/ui-egui/tests/it/marks.rs       |  33 +++
 parity/acrobat-features.toml           |   6 +-
 47 files changed, 739 insertions(+), 79 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 496eeab0a4..df78711ad1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4100,6 +4100,7 @@ dependencies = [
  "pdfcraft-cos",
  "pdfcraft-fonts",
  "pdfcraft-model",
+ "sha2 0.11.0",
  "thiserror 2.0.21",
  "unicode-bidi",
 ]
diff --git a/ROADMAP.md b/ROADMAP.md
index 89ce2dadbd..4fd2db9aae 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -265,7 +265,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-19 (M3, #3360):** Switching between Read and the docking workspace retains the current document’s scroll position at fixed zoom, including within-page position; separate tabs retain their own offsets. Estimates unchanged.
 - **2026-10-18 (M8, #1350):** Integrated current main while preserving content-stream comment boundaries. Hidden-text cleanup retires unused named replacement descriptions on rewritten pages and forms, including inherited/shared resource holders, without removing descriptions still used by surviving content. Synthetic saved-byte and preservation regressions cover the cleanup. Estimates unchanged.
 - **2026-10-17 (M4, #2997):** Dragging page thumbnails in the Organize grid with Ctrl held (Option on macOS) drops copies at the gap instead of moving the pages: a "+" badge sits by the pointer, the copies land at the gap selected, and one undo step ("Duplicate pages") takes them out again. `page_duplicate` takes `at` (1-based, where the first copy goes; left out, after the last of them) so agents can drive the same thing, and the UI control channel's `ui.drag` modifiers now reach gestures that read the input state. Estimates unchanged.
-- **2026-10-16 (M7, Add Background):** A background added behind a page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) was hidden completely, so the tool looked broken. The dialog now detects such pages and offers to replace the backdrop (on by default): the one fill becomes `n` in a per-page copy of its stream, and Remove background puts the original back unless the copy was edited since. Scanned pages are warned about, not touched. New `doc_backdrops` tool; `doc_background` takes `replace_backdrop`. The default colour is a visible light yellow and the preview shows text over it. Acrobat's own behaviour on such pages is unobserved. Estimates unchanged.
+- **2026-10-16 (M7, Add Background):** A background added behind a page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) was hidden completely, so the tool looked broken. The dialog now detects such pages and offers to replace the backdrop (on by default): the one fill becomes `n` in a per-page copy of its stream, and Remove background turns the fill back on, after edits and redactions too, unless the operators before it changed or it would no longer be painted first; then it says which pages keep it off. The copy's tag holds no reference to the original stream, which had kept text a redaction or Remove Hidden Information removed in the saved file. Scanned pages are warned about, not touched. New `doc_backdrops` tool; `doc_background` takes `replace_backdrop`. The default colour is a visible light yellow and the preview shows text over it. Acrobat's own behaviour on such pages is unobserved. Estimates unchanged.
 - **2026-10-15 (M6, AcroForm XML text):** Plain AcroForm XML imports retain all direct text around comments and processing instructions, including CDATA and character references. Synthetic regressions verify exact values and unknown catalog data after incremental and full save/reopen. Nested-element and XFA interpretation are unchanged. Estimates unchanged.
 - **2026-10-15 (M6, #1917 refresh):** Integrated upstream `99941daa` while retaining the XML/XFDF attribute whitespace correction and all upstream progress. Only independent documentation conflicts required resolution; focused production and test files are unchanged from the previously green CI head. Estimates unchanged.
 - **2026-10-15 (M1, #2267 refresh):** Integrated upstream `99941daa` while retaining the raw-deflate fallback correction and all upstream progress. Only independent documentation conflicts required resolution; focused production and test files are unchanged from the previously green CI head. Estimates unchanged.
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index f526ffc3d9..19153b1387 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -971,7 +971,7 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["doc"],
             )),
-        t("doc_background", "Add background", "Fill page backgrounds with a colour, or a picture from `file` (an image, or page `file_page` of a PDF) fitted at `scale` (default 1), behind the content. A page that paints its own opaque white backdrop would hide it, so that backdrop is replaced unless replace_backdrop is false (removing the background puts it back); a scanned page's picture still hides it (doc_backdrops lists both). Undoable.")
+        t("doc_background", "Add background", "Fill page backgrounds with a colour, or a picture from `file` (an image, or page `file_page` of a PDF) fitted at `scale` (default 1), behind the content. A page that paints its own opaque white backdrop would hide it, so that backdrop is replaced unless replace_backdrop is false (removing the background turns it back on where that is still safe, and doc_remove_marks warns about the pages where it isn't); a scanned page's picture still hides it (doc_backdrops lists both). Undoable.")
             .cmd("edit.background")
             .with(schema(
                 json!({ "doc": doc(), "pages": pages("to fill (default: all)"), "color": { "type": "string" }, "file": { "type": "string" }, "file_page": { "type": "integer", "minimum": 1 }, "scale": { "type": "number", "exclusiveMinimum": 0, "maximum": 1 }, "opacity": { "type": "number", "minimum": 0, "maximum": 1 }, "replace": { "type": "boolean" }, "replace_backdrop": { "type": "boolean", "description": "Replace a white backdrop the page paints itself, which would hide the background. Default true." } }),
diff --git a/crates/automation/tests/it/backdrop.rs b/crates/automation/tests/it/backdrop.rs
index 1a8a71eb8e..2f7a002981 100644
--- a/crates/automation/tests/it/backdrop.rs
+++ b/crates/automation/tests/it/backdrop.rs
@@ -40,7 +40,12 @@ fn fixture() -> Vec<u8> {
 }
 
 fn workdir() -> PathBuf {
-    let dir = std::env::temp_dir().join(format!("pdfcraft-automation-backdrop-{}", std::process::id()));
+    named_workdir("main")
+}
+
+/// A folder of its own per test: the tests of this binary run at the same time.
+fn named_workdir(name: &str) -> PathBuf {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-automation-backdrop-{}-{name}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
     std::fs::write(dir.join("a.pdf"), fixture()).unwrap();
@@ -107,3 +112,113 @@ fn a_background_shows_on_a_page_that_paints_its_own_white_backdrop() {
     );
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// One 200 × 100 pt page on a white fill of its own: a line to redact, invisible (`3 Tr`) text
+/// that Remove Hidden Information removes, and a line that stays (`0 Tr` again: the render mode
+/// outlives `ET`). With `tag`, the content is a
+/// backdrop copy carrying that tag, under a background.
+fn secret_pdf(tag: Option<&str>) -> Vec<u8> {
+    let fill = if tag.is_some() { "n" } else { "f" };
+    let content = format!(
+        "1 1 1 rg 0 0 200 100 re {fill} 0 g BT /F1 12 Tf 10 70 Td (SECRET-LINE) Tj ET BT 3 Tr /F1 12 Tf 10 45 Td (HIDDEN-LINE) Tj ET BT 0 Tr /F1 12 Tf 10 20 Td (KEEP) Tj ET"
+    );
+    let bg = "q 1 0 0 rg 0 0 200 100 re f Q";
+    let (contents, extra) = match tag {
+        Some(t) => (
+            "[5 0 R 6 0 R]",
+            vec![
+                format!("<< /PCMark /Background /Length {} >>\nstream\n{bg}\nendstream", bg.len()),
+                format!("<< /PCBackdrop {t} /Length {} >>\nstream\n{content}\nendstream", content.len()),
+            ],
+        ),
+        None => ("[5 0 R]", vec![format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len())]),
+    };
+    let mut objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 100] >>".into(),
+        format!("<< /Type /Page /Parent 2 0 R /Contents {contents} /Resources << /Font << /F1 4 0 R >> >> >>"),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+    ];
+    objs.extend(extra);
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// Every stream of a saved file, decoded, joined: what anyone reading the file can recover.
+fn every_stream(path: &std::path::Path) -> String {
+    let doc = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(path).unwrap())).unwrap();
+    doc.scan_objects()
+        .filter_map(|(_, o)| match &*o {
+            pdfcraft_cos::Object::Stream(s) => Some(String::from_utf8_lossy(&s.decoded().unwrap_or_default()).into_owned()),
+            _ => None,
+        })
+        .collect::<Vec<_>>()
+        .join("\n")
+}
+
+/// Text a redaction or Remove Hidden Information took off a page whose backdrop a background
+/// replaced is gone from the saved file. The backdrop copy's tag used to keep a reference to the
+/// page's original content stream, and with it the removed text. Removing the background
+/// afterwards still turns the page's white fill back on.
+#[test]
+fn removed_text_leaves_the_file_when_a_background_replaced_the_pages_backdrop() {
+    for (remove, gone) in [
+        (vec![("redact_mark", json!({ "find": "SECRET-LINE" })), ("redact_apply", json!({}))], "SECRET-LINE"),
+        (vec![("doc_remove_hidden", json!({ "categories": ["hidden-text"] }))], "HIDDEN-LINE"),
+    ] {
+        let dir = named_workdir(gone);
+        std::fs::write(dir.join("s.pdf"), secret_pdf(None)).unwrap();
+        let mut a = Automation::new().with_root(&dir).unwrap();
+        let doc = ok(&mut a, "doc_open", json!({ "path": "s.pdf" }))["doc"].as_u64().unwrap();
+        ok(&mut a, "doc_background", json!({ "doc": doc, "color": "#FF0000" }));
+        for (tool, args) in &remove {
+            let mut args = args.clone();
+            args["doc"] = json!(doc);
+            ok(&mut a, tool, args);
+        }
+        ok(&mut a, "doc_save", json!({ "doc": doc, "path": "out.pdf", "full": true }));
+        let file = every_stream(&dir.join("out.pdf"));
+        assert!(file.contains("(KEEP)"), "{gone}: the page's other text is still there: {file}");
+        assert!(!file.contains(gone), "{gone} is still in the file: {file}");
+
+        let saved = ok(&mut a, "doc_open", json!({ "path": "out.pdf" }))["doc"].as_u64().unwrap();
+        let removed = ok(&mut a, "doc_remove_marks", json!({ "doc": saved, "kind": "background" }));
+        assert!(removed.get("warnings").is_none(), "{gone}: {removed}");
+        assert_eq!(
+            ok(&mut a, "doc_backdrops", json!({ "doc": saved }))["pages"],
+            json!([{ "page": 1, "backdrop": "fill" }]),
+            "{gone}: the fill is back"
+        );
+        assert_eq!(blank_spot(&mut a, saved, 1), WHITE);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
+
+/// When the backdrop can't be turned back on safely, Remove background says which pages keep it
+/// off.
+#[test]
+fn remove_background_warns_about_pages_whose_own_backdrop_stays_off() {
+    let dir = named_workdir("left-off");
+    // A tag whose hash doesn't match the bytes before the fill: they changed since.
+    let tag = format!("<< /Index 2 /Op (f) /Before <{}> >>", "00".repeat(32));
+    std::fs::write(dir.join("t.pdf"), secret_pdf(Some(&tag))).unwrap();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let doc = ok(&mut a, "doc_open", json!({ "path": "t.pdf" }))["doc"].as_u64().unwrap();
+    let removed = ok(&mut a, "doc_remove_marks", json!({ "doc": doc, "kind": "background" }));
+    let warnings = removed["warnings"].as_array().unwrap_or_else(|| panic!("{removed}"));
+    assert_eq!(warnings.len(), 1, "{removed}");
+    assert!(warnings[0].as_str().unwrap().starts_with("page 1 changed after the background was added"), "{removed}");
+    assert_eq!(ok(&mut a, "doc_backdrops", json!({ "doc": doc }))["pages"], json!([]), "the fill stays off");
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/edit/Cargo.toml b/crates/edit/Cargo.toml
index 4eb2d6132b..89d9387989 100644
--- a/crates/edit/Cargo.toml
+++ b/crates/edit/Cargo.toml
@@ -15,6 +15,8 @@ pdfcraft-content = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 pdfcraft-model = { workspace = true }
 thiserror = { workspace = true }
+# A backdrop copy's tag records a hash of the operators before the fill it turned off (backdrop.rs).
+sha2 = "0.11"
 kurbo = { workspace = true }
 # Display order of right-to-left lines in added text, and reading and writing order in Edit text;
 # already in the tree via the interface.
diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
index 86924b8cb7..d55cb753ba 100644
--- a/crates/edit/src/backdrop.rs
+++ b/crates/edit/src/backdrop.rs
@@ -5,19 +5,34 @@
 //!
 //! A white fill can be replaced: the one fill operator becomes `n` (end the path without
 //! painting), which looks the same on white paper. The page then gets a copy of the content
-//! stream that held it, tagged `/PCBackdrop << /Original ref /At n /Len n >>`, and the stream
-//! itself is left alone (other pages may share it). [`restore`] puts the original back when the
-//! background is removed, unless the copy has been edited since. A picture can't be replaced
-//! without losing it, so it is only reported.
+//! stream that held it, tagged `/PCBackdrop << /Index n /Op (f) /Before <SHA-256> /Was [num gen] >>`:
+//! how many of the copy's operators come before the `n`, the operator it stands in for, a hash of
+//! those operators (their values, not their spacing: redaction writes a stream out again with
+//! other whitespace), and the number of the stream it was copied from. The stream itself is left
+//! alone (other pages may share it). [`restore`] turns the fill back on when the background is
+//! removed, even after the page was edited or redacted, as long as the operators before the fill
+//! are unchanged and the fill would again be the first thing painted, covering the page.
+//! Otherwise the fill stays off, and [`backdrops_left_off`] names those pages. A picture can't be
+//! replaced without losing it, so it is only reported.
+//!
+//! The tag holds no page content and no reference that keeps another object alive (`/Was` is two
+//! numbers, not a reference): a reference to the original stream would keep text in the file
+//! that a redaction, Remove Hidden Information or Edit Text removed from the copy.
 //!
 //! Detection is deliberately strict: only one rectangle (`re`), in DeviceGray, DeviceRGB or
 //! DeviceCMYK, opaque in the graphics state, with an axis-aligned transform, filled before any
 //! other painting, and covering the crop box. Anything else is real content and stays.
 
 use pdfcraft_content::{Matrix, Op, Pieces};
-use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
+use sha2::{Digest, Sha256};
 
-use crate::EditError;
+use crate::{EditError, MarkKind};
+
+/// The dictionary key of a backdrop copy's tag.
+const TAG: &[u8] = b"PCBackdrop";
+/// The fill operators a backdrop can be painted with, and so the only ones a tag may restore.
+const FILLS: [&[u8]; 3] = [b"f", b"F", b"f*"];
 
 /// How much of a page's content is read looking for a backdrop: it has to come first.
 const SCAN_BYTES: usize = 64 * 1024;
@@ -39,13 +54,23 @@ pub enum Backdrop {
 }
 
 /// Where a replaceable fill is: the content streams (references in `/Contents` order, untagged
-/// ones only), their joined bytes, and the fill operator's joined byte range.
+/// ones only), their joined bytes, where each starts in them, and the fill operator's joined
+/// byte range.
 struct Found {
     refs: Vec<(usize, ObjRef)>,
     pieces: Pieces,
+    starts: Vec<usize>,
     op: std::ops::Range<usize>,
 }
 
+impl Found {
+    /// The piece holding the fill operator, and the operator's offset in it.
+    fn place(&self) -> Option<(usize, usize)> {
+        let piece = self.pieces.piece_of(self.op.start);
+        Some((piece, self.op.start.checked_sub(*self.starts.get(piece)?)?))
+    }
+}
+
 #[derive(Clone)]
 struct State {
     ctm: Matrix,
@@ -63,7 +88,7 @@ struct State {
 pub fn page_backdrop(doc: &Document, page: usize) -> Result<Option<Backdrop>, EditError> {
     let all = pdfcraft_model::pages(doc);
     let p = all.get(page).ok_or(EditError::NoSuchPage(page))?;
-    Ok(scan(doc, p).map(|(b, _)| b))
+    Ok(scan(doc, p, None).map(|(b, _)| b))
 }
 
 /// The backdrop each of `pages` (0-based) paints, in the same order, walking the page tree once.
@@ -71,32 +96,56 @@ pub fn page_backdrop(doc: &Document, page: usize) -> Result<Option<Backdrop>, Ed
 /// elsewhere (the viewer's) can disagree with the page tree's on a malformed document.
 pub fn page_backdrops(doc: &Document, pages: &[usize]) -> Vec<Option<Backdrop>> {
     let all = pdfcraft_model::pages(doc);
-    pages.iter().map(|&p| all.get(p).and_then(|page| scan(doc, page)).map(|(b, _)| b)).collect()
+    pages.iter().map(|&p| all.get(p).and_then(|page| scan(doc, page, None)).map(|(b, _)| b)).collect()
+}
+
+/// Pages (0-based, ascending) whose own white backdrop [`replace`] turned off and [`restore`]
+/// couldn't turn back on: a tagged copy is still in their content, with no background over it.
+/// They look the same on white paper.
+pub fn backdrops_left_off(doc: &Document) -> Vec<usize> {
+    let tag_of = |o: &Object| crate::stream_tag(doc, o);
+    let copy = |o: &Object| doc.resolve(o).as_dict().is_some_and(|d| d.get(TAG).is_some());
+    pdfcraft_model::pages(doc)
+        .iter()
+        .enumerate()
+        .filter(|(_, p)| {
+            let list: Vec<Object> = match p.dict.get(b"Contents").map(|c| doc.resolve(c)).as_deref() {
+                Some(Object::Array(a)) => a.clone(),
+                Some(_) => p.dict.get(b"Contents").cloned().into_iter().collect(),
+                None => Vec::new(),
+            };
+            list.iter().any(copy) && !list.iter().any(|o| tag_of(o).as_deref() == Some(MarkKind::Background.tag()))
+        })
+        .map(|(i, _)| i)
+        .collect()
 }
 
 /// Replace `page`'s white backdrop fill, if it has one (see the module doc). Returns whether it
 /// did; when it did, `page` no longer matches the document. A picture backdrop is left alone.
 pub(crate) fn replace(doc: &mut Document, page: &pdfcraft_model::Page) -> Result<bool, EditError> {
-    let Some((Backdrop::Fill, Some(found))) = scan(doc, page) else { return Ok(false) };
+    let Some((Backdrop::Fill, Some(found))) = scan(doc, page, None) else { return Ok(false) };
+    let Some((piece, at)) = found.place() else { return Ok(false) };
+    let op = found.pieces.data().get(found.op.clone()).unwrap_or_default().to_vec();
     let edited = found.pieces.splice([(found.op.clone(), b"n".to_vec())]);
-    let piece = found.pieces.piece_of(found.op.start);
     let (Some(&(_, original)), Some(bytes)) = (found.refs.get(piece), edited.get(piece)) else { return Ok(false) };
-    // Where the operator sits in that piece: the joined offset less the pieces before it.
-    let before: usize = (0..piece).filter_map(|i| edited.get(i)).map(|p| p.len() + 1).sum();
-    let at = found.op.start.saturating_sub(before);
-    let len = found.op.end.saturating_sub(found.op.start);
+    // The `n` among the copy's own operators. A copy whose fill can't be found that way again is
+    // not made: there would be no safe way back.
+    let parsed = pdfcraft_content::parse(head(bytes));
+    let Some(index) = parsed.ops.iter().position(|o| o.span.start == at && o.op == b"n") else { return Ok(false) };
+    let Some(before) = parsed.ops.get(..index) else { return Ok(false) };
     let mut note = Dict::new();
-    note.set(b"Original".to_vec(), Object::Ref(original));
-    note.set(b"At".to_vec(), Object::Int(i64::try_from(at).unwrap_or(i64::MAX)));
-    note.set(b"Len".to_vec(), Object::Int(i64::try_from(len).unwrap_or(i64::MAX)));
+    note.set(b"Index".to_vec(), Object::Int(i64::try_from(index).unwrap_or(i64::MAX)));
+    note.set(b"Op".to_vec(), Object::String(PdfString::literal(op)));
+    note.set(b"Before".to_vec(), Object::String(PdfString { bytes: ops_hash(before), hex: true }));
+    note.set(b"Was".to_vec(), Object::Array(vec![Object::Int(original.num.into()), Object::Int(original.generation.into())]));
     // The copy keeps the original's dictionary (unknown entries included) less what describes
     // the old encoding; `scan` refused streams whose bytes live in an external file (`/F`).
     let Object::Stream(source) = &*doc.get(original) else { return Ok(false) };
     let mut dict = source.dict.clone();
-    for key in [&b"Length"[..], b"DL", b"PCBackdrop"] {
+    for key in [&b"Length"[..], b"DL", TAG] {
         dict.remove(key);
     }
-    dict.set(b"PCBackdrop".to_vec(), Object::Dict(note));
+    dict.set(TAG.to_vec(), Object::Dict(note));
     let copy = doc.add(Object::Stream(Stream::flate(dict, bytes)));
     // Every slot that draws the original: a page may list the same stream twice, and a second
     // copy of the fill would cover the background again.
@@ -112,14 +161,41 @@ pub(crate) fn replace(doc: &mut Document, page: &pdfcraft_model::Page) -> Result
     Ok(replaced)
 }
 
-/// Put back the original content streams [`replace`] copied on `page`, where the copy is still
-/// exactly what it wrote. Returns how many it restored.
+/// Turn the fills [`replace`] turned off on `page` back on, where [`restored_copy`] finds that
+/// safe; a copy listed in several slots is restored in each. Returns how many slots it restored.
+/// A copy it can't restore stays as it is, tag and all, so [`backdrops_left_off`] names its page.
 pub(crate) fn restore(doc: &mut Document, page: &pdfcraft_model::Page) -> Result<usize, EditError> {
     let mut list = crate::contents(doc, page)?;
+    // Per copy: the stream that takes its place, or `None` when it stays.
+    let mut done: Vec<(ObjRef, Option<ObjRef>)> = Vec::new();
     let mut restored = 0;
     for entry in list.iter_mut() {
-        if let Some(original) = unchanged_copy_of(doc, entry) {
-            *entry = Object::Ref(original);
+        let Object::Ref(copy) = *entry else { continue };
+        let with = match done.iter().find(|(c, _)| *c == copy) {
+            Some(&(_, with)) => with,
+            None => {
+                let with = restored_copy(doc, page, copy).map(|(bytes, dict, was)| {
+                    // The stream it was copied from, while that is still here with these bytes
+                    // (other pages may share it): the page is then exactly as it was. `/Was` is
+                    // only a number, and a full save renumbers objects, so the bytes decide.
+                    let same = |w: &ObjRef| match &*doc.get(*w) {
+                        Object::Stream(s) => {
+                            [TAG, &b"PCMark"[..], b"Subtype"].iter().all(|k| s.dict.get(k).is_none())
+                                && s.decoded().ok().as_deref() == Some(bytes.as_slice())
+                        }
+                        _ => false,
+                    };
+                    match was.filter(same) {
+                        Some(w) => w,
+                        None => doc.add(Object::Stream(Stream::flate(dict, &bytes))),
+                    }
+                });
+                done.push((copy, with));
+                with
+            }
+        };
+        if let Some(with) = with {
+            *entry = Object::Ref(with);
             restored += 1;
         }
     }
@@ -129,27 +205,125 @@ pub(crate) fn restore(doc: &mut Document, page: &pdfcraft_model::Page) -> Result
     Ok(restored)
 }
 
-/// The original of a backdrop copy whose bytes are still the original's with the fill turned to
-/// `n`; `None` for anything else (including a copy edited since, which is kept).
-fn unchanged_copy_of(doc: &Document, entry: &Object) -> Option<ObjRef> {
-    let copy = doc.resolve(entry);
-    let Object::Stream(copy) = &*copy else { return None };
-    let note = copy.dict.get(b"PCBackdrop").map(|n| doc.resolve(n))?;
+/// `copy` (a stream [`replace`] wrote for `page`) with its fill turned back on: the bytes, its
+/// dictionary without the tag, and the stream it was copied from. `None` when it isn't such a
+/// copy, or when turning the fill on could paint over something: the operators before the fill
+/// changed since (their hash no longer matches), or the page would no longer paint the fill
+/// first, covering it. What comes after the fill (an edit, a redaction) is kept as it is.
+fn restored_copy(doc: &Document, page: &pdfcraft_model::Page, copy: ObjRef) -> Option<(Vec<u8>, Dict, Option<ObjRef>)> {
+    let obj = doc.get(copy);
+    let Object::Stream(s) = &*obj else { return None };
+    let note = s.dict.get(TAG).map(|n| doc.resolve(n))?;
     let note = note.as_dict()?;
-    let Some(Object::Ref(original)) = note.get(b"Original") else { return None };
-    let at = usize::try_from(note.get(b"At")?.as_int()?).ok()?;
-    let len = usize::try_from(note.get(b"Len")?.as_int()?).ok()?;
-    let orig = doc.get(*original);
-    let Object::Stream(orig) = &*orig else { return None };
-    let source = orig.decoded().ok()?;
-    let mut expect = source.get(..at)?.to_vec();
-    expect.push(b'n');
-    expect.extend_from_slice(source.get(at.checked_add(len)?..)?);
-    (copy.decoded().ok()? == expect).then_some(*original)
+    let index = usize::try_from(note.get(b"Index")?.as_int()?).ok()?;
+    let op = note.get(b"Op")?.as_string()?.bytes.as_slice();
+    if !FILLS.contains(&op) {
+        return None;
+    }
+    let hash = note.get(b"Before")?.as_string()?;
+    let bytes = s.decoded().ok()?;
+    let parsed = pdfcraft_content::parse(head(&bytes));
+    // The `n` standing in for the fill, after exactly the operators that came before it.
+    let fill = parsed.ops.get(index)?;
+    if fill.op != b"n" || !fill.operands.is_empty() || ops_hash(parsed.ops.get(..index)?) != hash.bytes {
+        return None;
+    }
+    let mut out = Vec::with_capacity(bytes.len().saturating_add(op.len()));
+    out.extend_from_slice(bytes.get(..fill.span.start)?);
+    out.extend_from_slice(op);
+    out.extend_from_slice(bytes.get(fill.span.end..)?);
+    let (Backdrop::Fill, Some(found)) = scan(doc, page, Some((copy, &out)))? else { return None };
+    let (piece, offset) = found.place()?;
+    if found.refs.get(piece).map(|&(_, r)| r) != Some(copy) || offset != fill.span.start || found.op.len() != op.len() {
+        return None;
+    }
+    let mut dict = s.dict.clone();
+    for key in [&b"Length"[..], b"DL", TAG] {
+        dict.remove(key);
+    }
+    let was = match note.get(b"Was").and_then(Object::as_array).map(Vec::as_slice) {
+        Some([num, generation]) => Some(ObjRef { num: u32::try_from(num.as_int()?).ok()?, generation: u16::try_from(generation.as_int()?).ok()? }),
+        _ => None,
+    };
+    Some((out, dict, was))
 }
 
-/// Find the backdrop, and for a fill, where it is.
-fn scan(doc: &Document, p: &pdfcraft_model::Page) -> Option<(Backdrop, Option<Found>)> {
+/// As much of a content stream as a backdrop could be in: it has to come first.
+fn head(bytes: &[u8]) -> &[u8] {
+    bytes.get(..bytes.len().min(SCAN_BYTES)).unwrap_or_default()
+}
+
+/// A SHA-256 of what `ops` are, not how they are written: keywords and operand values, with
+/// numbers in one form (`1`, `1.0` and `1.00000` are the same), so a stream written out again
+/// with other spacing or number formatting still matches.
+fn ops_hash(ops: &[Op]) -> Vec<u8> {
+    let mut h = Sha256::new();
+    for op in ops {
+        for o in &op.operands {
+            canonical(o, &mut h, 0);
+        }
+        if let Some((dict, data)) = &op.inline {
+            canonical_dict(dict, &mut h, 0);
+            bytes(b'i', data, &mut h);
+        }
+        bytes(b'k', &op.op, &mut h);
+    }
+    h.finalize().to_vec()
+}
+
+/// How deep [`canonical`] follows nested arrays and dictionaries; deeper ones count as equal.
+const CANONICAL_DEPTH: usize = 32;
+
+fn canonical(o: &Object, h: &mut Sha256, depth: usize) {
+    if depth > CANONICAL_DEPTH {
+        h.update(b"~");
+        return;
+    }
+    match o {
+        Object::Null => h.update(b"z"),
+        Object::Bool(b) => h.update(if *b { b"T" } else { b"F" }),
+        Object::Int(i) => number(&i.to_string(), h),
+        Object::Real(r) if *r == 0.0 => number("0", h),
+        Object::Real(r) => number(&format!("{r:.5}"), h),
+        Object::String(s) => bytes(b's', &s.bytes, h),
+        Object::Name(n) => bytes(b'/', n, h),
+        Object::Array(a) => {
+            h.update(b"[");
+            for x in a {
+                canonical(x, h, depth.saturating_add(1));
+            }
+            h.update(b"]");
+        }
+        Object::Dict(d) => canonical_dict(d, h, depth),
+        Object::Stream(_) | Object::Ref(_) => h.update(b"?"),
+    }
+}
+
+fn canonical_dict(d: &Dict, h: &mut Sha256, depth: usize) {
+    h.update(b"<");
+    for (k, v) in d.iter() {
+        bytes(b'/', k, h);
+        canonical(v, h, depth.saturating_add(1));
+    }
+    h.update(b">");
+}
+
+/// A number written with up to five decimals, without trailing zeros.
+fn number(text: &str, h: &mut Sha256) {
+    let t = if text.contains('.') { text.trim_end_matches('0').trim_end_matches('.') } else { text };
+    bytes(b'#', t.as_bytes(), h);
+}
+
+/// A typed, length-prefixed value, so no two different sequences hash the same way.
+fn bytes(kind: u8, b: &[u8], h: &mut Sha256) {
+    h.update([kind]);
+    h.update(u64::try_from(b.len()).unwrap_or(u64::MAX).to_le_bytes());
+    h.update(b);
+}
+
+/// Find the backdrop, and for a fill, where it is. With `swap`, that stream reads as those bytes
+/// instead of its own (to check a change before making it).
+fn scan(doc: &Document, p: &pdfcraft_model::Page, swap: Option<(ObjRef, &[u8])>) -> Option<(Backdrop, Option<Found>)> {
     let crop = p.crop(doc);
     let c = p.dict.get(b"Contents")?;
     let list: Vec<Object> = match &*doc.resolve(c) {
@@ -160,6 +334,7 @@ fn scan(doc: &Document, p: &pdfcraft_model::Page) -> Option<(Backdrop, Option<Fo
     // only as far as a backdrop could be.
     let mut refs = Vec::new();
     let mut data = Vec::new();
+    let mut starts = Vec::new();
     let mut total = 0usize;
     for (slot, o) in list.iter().enumerate() {
         if total >= SCAN_BYTES {
@@ -175,18 +350,21 @@ fn scan(doc: &Document, p: &pdfcraft_model::Page) -> Option<(Backdrop, Option<Fo
         if s.dict.get(b"F").is_some() {
             return None;
         }
-        let bytes = s.decoded().unwrap_or_default();
+        let bytes = match swap {
+            Some((with, b)) if with == *r => b.to_vec(),
+            _ => s.decoded().unwrap_or_default(),
+        };
+        starts.push(total);
         total = total.saturating_add(bytes.len()).saturating_add(1);
         refs.push((slot, *r));
         data.push(bytes);
     }
     let pieces = Pieces::join(&data);
-    let head = pieces.data().get(..pieces.data().len().min(SCAN_BYTES)).unwrap_or_default();
-    let parsed = pdfcraft_content::parse(head);
+    let parsed = pdfcraft_content::parse(head(pieces.data()));
     let res = resources(doc, &p.dict);
     let found = walk(doc, &res, crop, &parsed.ops);
     found.map(|(b, op)| match (b, op) {
-        (Backdrop::Fill, Some(op)) => (b, Some(Found { refs, pieces, op })),
+        (Backdrop::Fill, Some(op)) => (b, Some(Found { refs, pieces, starts, op })),
         _ => (b, None),
     })
 }
diff --git a/crates/edit/src/backdrop_tests.rs b/crates/edit/src/backdrop_tests.rs
index 1c0744b59c..c7bfcaa8b4 100644
--- a/crates/edit/src/backdrop_tests.rs
+++ b/crates/edit/src/backdrop_tests.rs
@@ -1,6 +1,6 @@
 use std::sync::Arc;
 
-use pdfcraft_cos::{Document, ObjRef, Object, SaveOptions, Stream, write_incremental};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, SaveOptions, Stream, write_full, write_incremental};
 
 use super::*;
 use crate::{Background, MarkKind, add_background, remove_marks};
@@ -188,19 +188,166 @@ fn replacing_can_be_turned_off() {
     assert_eq!(streams(&doc)[1..], before[..]);
 }
 
-#[test]
-fn a_backdrop_copy_edited_since_is_kept_when_the_background_goes() {
-    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
-    add_background(&mut doc, &[0], &red(), false).unwrap();
-    // Something else rewrites the copy (as Edit text does), keeping its dictionary.
-    let p = &pdfcraft_model::pages(&doc)[0];
+/// Rewrite the page's backdrop copy (the stream after the background) as another tool would:
+/// Edit text and redaction keep its dictionary and change its bytes.
+fn rewrite_copy(doc: &mut Document, bytes: &str) -> ObjRef {
+    let p = &pdfcraft_model::pages(doc)[0];
     let Some(Object::Array(list)) = p.dict.get(b"Contents").cloned() else { panic!("contents") };
     let Object::Ref(copy) = list[1] else { panic!("a reference") };
     let Object::Stream(s) = (*doc.get(copy)).clone() else { panic!("a stream") };
-    let edited = "1 g 0 0 300 200 re n BT /F1 24 Tf 40 90 Td (Edited) Tj ET";
-    doc.set(copy, Object::Stream(Stream::flate(s.dict.clone(), edited.as_bytes())));
+    assert!(s.dict.get(b"PCBackdrop").is_some(), "the copy");
+    doc.set(copy, Object::Stream(Stream::flate(s.dict.clone(), bytes.as_bytes())));
+    copy
+}
+
+#[test]
+fn an_edit_after_the_fill_is_kept_and_the_backdrop_still_comes_back() {
+    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    rewrite_copy(&mut doc, "1 g 0 0 300 200 re n BT /F1 24 Tf 40 90 Td (Edited) Tj ET");
     remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
-    assert_eq!(streams(&doc), [edited.to_string()], "the edit survives");
+    assert_eq!(streams(&doc), ["1 g 0 0 300 200 re f BT /F1 24 Tf 40 90 Td (Edited) Tj ET"], "the edit survives, under the fill");
+    assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill));
+    assert_eq!(backdrops_left_off(&doc), Vec::<usize>::new());
+}
+
+#[test]
+fn a_change_before_the_fill_leaves_it_off_and_names_the_page() {
+    for edited in [
+        // A different colour before the fill: the hash of what comes before it no longer matches.
+        "0.99 g 0 0 300 200 re n BT /F1 24 Tf 40 90 Td (Edited) Tj ET",
+        // Something painted before it.
+        "BT /F1 9 Tf (x) Tj ET 1 g 0 0 300 200 re n",
+        // The fill is gone.
+        "BT /F1 24 Tf 40 90 Td (Edited) Tj ET",
+    ] {
+        let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+        add_background(&mut doc, &[0], &red(), false).unwrap();
+        assert_eq!(backdrops_left_off(&doc), Vec::<usize>::new(), "a background is over it");
+        rewrite_copy(&mut doc, edited);
+        remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+        assert_eq!(streams(&doc), [edited.to_string()], "{edited}: the copy stays as it is");
+        assert_eq!(backdrops_left_off(&doc), [0], "{edited}");
+    }
+}
+
+#[test]
+fn a_fill_that_would_cover_content_painted_before_it_stays_off() {
+    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    // A tool puts a stream of its own before the copy, untagged: turning the fill back on would
+    // now paint white over that text.
+    let over = doc.add(Object::Stream(Stream::flate(pdfcraft_cos::Dict::new(), b"BT /F1 9 Tf 10 10 Td (Over) Tj ET")));
+    let p = pdfcraft_model::pages(&doc)[0].clone();
+    let Some(Object::Array(mut list)) = p.dict.get(b"Contents").cloned() else { panic!("contents") };
+    list.insert(1, Object::Ref(over));
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list))).unwrap();
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    let s = streams(&doc);
+    assert_eq!(s.len(), 2, "{s:?}");
+    assert!(s[1].contains("re n") && !s[1].contains("re f"), "nothing white goes over the text: {s:?}");
+    assert_eq!(backdrops_left_off(&doc), [0]);
+}
+
+#[test]
+fn the_tag_holds_no_reference_and_a_full_save_keeps_no_second_copy_of_the_page() {
+    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    // Every stream in the file that holds the page's text: only the copy the page draws. A
+    // reference from the tag to the original stream kept a second, which a redaction or Remove
+    // Hidden Information on the copy left in the file.
+    let holding: Vec<(ObjRef, Dict)> = saved
+        .scan_objects()
+        .filter_map(|(r, o)| match &*o {
+            Object::Stream(s) if String::from_utf8_lossy(&s.decoded().unwrap_or_default()).contains("(Hello)") => Some((r, s.dict.clone())),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(holding.len(), 1, "{holding:?}");
+    let Some(Object::Dict(note)) = holding[0].1.get(b"PCBackdrop").map(|n| (*saved.resolve(n)).clone()) else { panic!("the tag") };
+    fn refs(o: &Object) -> bool {
+        match o {
+            Object::Ref(_) => true,
+            Object::Array(a) => a.iter().any(refs),
+            Object::Dict(d) => d.iter().any(|(_, v)| refs(v)),
+            _ => false,
+        }
+    }
+    assert!(!note.iter().any(|(_, v)| refs(v)), "{note:?}");
+    assert_eq!(note.get(b"Op").and_then(Object::as_string).map(|s| s.bytes.clone()), Some(b"f".to_vec()));
+    assert_eq!(note.get(b"Before").and_then(Object::as_string).map(|s| s.bytes.len()), Some(32), "a SHA-256");
+    // The original is gone, so Remove writes the fill back into a stream of its own.
+    let mut saved = saved;
+    remove_marks(&mut saved, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&saved), [format!("1 g 0 0 300 200 re f {TEXT}")]);
+    assert_eq!(page_backdrop(&saved, 0).unwrap(), Some(Backdrop::Fill));
+}
+
+#[test]
+fn a_copy_written_out_again_with_other_spacing_still_comes_back() {
+    // Redaction writes the whole stream out again: one operator a line, numbers its own way.
+    let mut doc = page(&[&format!("1 g 0 0 300 200 re f {TEXT}")]);
+    add_background(&mut doc, &[0], &red(), false).unwrap();
+    rewrite_copy(&mut doc, "1.0 g\n0 0 300.000 200 re\nn\nBT\n/F1 24 Tf\n40 90 Td\n[-6505] TJ\nET");
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&doc), ["1.0 g\n0 0 300.000 200 re\nf\nBT\n/F1 24 Tf\n40 90 Td\n[-6505] TJ\nET"], "the fill is back, the rest as written");
+    assert_eq!(backdrops_left_off(&doc), Vec::<usize>::new());
+}
+
+#[test]
+fn a_tag_that_does_not_add_up_is_left_alone() {
+    let content = format!("1 g 0 0 300 200 re f {TEXT}");
+    let copied = format!("1 g 0 0 300 200 re n {TEXT}");
+    let good = ops_hash(&pdfcraft_content::parse(b"1 g 0 0 300 200 re").ops);
+    let hex = |b: &[u8]| b.iter().map(|x| format!("{x:02x}")).collect::<String>();
+    for tag in [
+        // Not a fill operator, a wrong hash, an index that isn't the `n` or runs past the end.
+        format!("<< /Index 2 /Op (B) /Before <{}> >>", hex(&good)),
+        format!("<< /Index 2 /Op (f) /Before <{}> >>", hex(&[0; 32])),
+        format!("<< /Index 1 /Op (f) /Before <{}> >>", hex(&good)),
+        format!("<< /Index 99999 /Op (f) /Before <{}> >>", hex(&good)),
+        format!("<< /Index -1 /Op (f) /Before <{}> >>", hex(&good)),
+        // Missing entries, wrong types, and the reference earlier test builds wrote.
+        "<< /Index 2 /Op (f) >>".to_string(),
+        "<< /Index (2) /Op /f /Before 3 >>".to_string(),
+        "<< /Original 5 0 R /At 19 /Len 1 >>".to_string(),
+        "(not a dictionary)".to_string(),
+    ] {
+        let mut doc = build(&[
+            "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
+            "<< /Type /Page /Parent 2 0 R /Contents [4 0 R] >>".into(),
+            stream(&format!("/PCBackdrop {tag}"), &copied),
+            stream("", &content),
+        ]);
+        remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+        assert_eq!(streams(&doc), std::slice::from_ref(&copied), "{tag}");
+        assert_eq!(backdrops_left_off(&doc), [0], "{tag}");
+    }
+    // The same page with an honest tag comes back.
+    let mut doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 200] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents [4 0 R] >>".into(),
+        stream(&format!("/PCBackdrop << /Index 2 /Op (f) /Before <{}> >>", hex(&good)), &copied),
+    ]);
+    remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
+    assert_eq!(streams(&doc), [content]);
+}
+
+#[test]
+fn operators_hash_by_value_not_by_spelling() {
+    let h = |s: &[u8]| ops_hash(&pdfcraft_content::parse(s).ops);
+    assert_eq!(h(b"1 g 0 0 300 200 re"), h(b"1.0 g\n0  0 300.00000 200 re"));
+    assert_eq!(h(b"0 g"), h(b"-0.0 g"));
+    assert_ne!(h(b"1 g 0 0 300 200 re"), h(b"0.99 g 0 0 300 200 re"));
+    assert_ne!(h(b"(ab) Tj"), h(b"(a) (b) Tj"), "operand boundaries count");
+    assert_ne!(h(b"/a /b BDC"), h(b"/ab BDC"));
+    assert_ne!(h(b""), h(b"q"));
+    // Nesting is bounded: deep arrays hash without running out of stack.
+    let deep = format!("{}{} Tj", "[".repeat(1000), "]".repeat(1000));
+    let _ = h(deep.as_bytes());
 }
 
 #[test]
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 4b524b70ed..99d80e8ae9 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -205,7 +205,8 @@ pub struct Background {
     /// Pictures: size relative to the page (1.0 fits the page).
     pub scale: f64,
     /// Replace a white backdrop the page paints itself, which would hide the background
-    /// ([`backdrop`]). Removing the background puts it back.
+    /// ([`backdrop`]). Removing the background turns it back on where that is still safe
+    /// ([`backdrops_left_off`] are the pages where it isn't).
     pub replace_backdrop: bool,
 }
 
@@ -971,7 +972,8 @@ pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, repl
 /// Remove marks of `kind` from `pages`; returns how many were removed. Wrappers left with
 /// nothing after them go too, restoring the original content list; a wrapper that content
 /// after it still relies on (another tool's appended stream) stays. Removing backgrounds also
-/// puts back a backdrop [`add_background`] replaced, unless it was edited since.
+/// turns a backdrop [`add_background`] replaced back on where that is still safe; the pages where
+/// it isn't are [`backdrops_left_off`].
 pub fn remove_marks(doc: &mut Document, pages: &[usize], kind: MarkKind) -> Result<usize, EditError> {
     let all = page_list(doc);
     check(pages, all.len())?;
@@ -1034,7 +1036,7 @@ pub fn marks_present(doc: &Document) -> Vec<MarkKind> {
 }
 
 pub mod backdrop;
-pub use backdrop::{Backdrop, page_backdrop, page_backdrops};
+pub use backdrop::{Backdrop, backdrops_left_off, page_backdrop, page_backdrops};
 mod background;
 pub use background::page_background;
 pub mod objects;
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 37b1dd2637..b329211129 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -434,9 +434,51 @@ pub struct Document {
     /// XFA forms: what was approximated, rewritten or could not be written to the XFA data
     /// (also in `info.warnings`, kept there when the document is re-read).
     pub xfa_warnings: Vec<String>,
-    /// What the last successful [`Session::apply`] wrote that its fonts can't draw: kept as typed,
-    /// drawn with `?` in its place (see [`TextNotice`]). The interface shows it; tools return it.
-    pub edit_notices: Vec<TextNotice>,
+    /// What the last successful [`Session::apply`] wants said (see [`EditNotice`]): text its fonts
+    /// can't draw, pages whose own backdrop stays off. The interface shows it; tools return it.
+    pub edit_notices: Vec<EditNotice>,
+}
+
+/// Something the last successful edit did that the user should hear about, never left silent
+/// (AGENTS.md §4).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum EditNotice {
+    /// Text stored as typed but drawn with `?`.
+    Undrawn(TextNotice),
+    /// Remove background couldn't turn back on the white backdrop these pages (0-based,
+    /// ascending) paint themselves: their content changed after the background replaced it, so
+    /// turning it on could paint over something (`pdfcraft_edit::backdrops_left_off`). They look
+    /// the same on white paper.
+    BackdropsLeftOff { pages: Vec<usize> },
+}
+
+impl std::fmt::Display for EditNotice {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            EditNotice::Undrawn(n) => n.fmt(f),
+            EditNotice::BackdropsLeftOff { pages } => {
+                let (which, own) = if pages.len() == 1 { ("page", "its") } else { ("pages", "their") };
+                write!(
+                    f,
+                    "{which} {} changed after the background was added, so {own} own white backdrop was not turned back on (it looks the same on white paper)",
+                    page_runs(pages)
+                )
+            }
+        }
+    }
+}
+
+/// 0-based pages as 1-based runs: `[0, 1, 2, 5]` is "1-3, 6".
+fn page_runs(pages: &[usize]) -> String {
+    let mut runs: Vec<(usize, usize)> = Vec::new();
+    for &p in pages {
+        match runs.last_mut() {
+            Some((_, end)) if end.checked_add(1) == Some(p) => *end = p,
+            _ => runs.push((p, p)),
+        }
+    }
+    let one = |p: usize| p.saturating_add(1);
+    runs.iter().map(|&(a, b)| if a == b { one(a).to_string() } else { format!("{}-{}", one(a), one(b)) }).collect::<Vec<_>>().join(", ")
 }
 
 /// Text an edit stored as typed but drew with `?` in place of `ch`, because the font it is drawn
@@ -3965,11 +4007,18 @@ impl Session {
         }
         // What this edit drew with `?` (a value or comment text its font can't draw, stored as
         // typed): reported, never silent (AGENTS.md §4).
-        let notices = if matches!(scope_of(&edit), Scope::Form | Scope::Comments | Scope::Full) {
-            guard(|| undrawn_notices(&editor.cos, &next)).unwrap_or_default()
+        let mut notices: Vec<EditNotice> = if matches!(scope_of(&edit), Scope::Form | Scope::Comments | Scope::Full) {
+            guard(|| undrawn_notices(&editor.cos, &next)).unwrap_or_default().into_iter().map(EditNotice::Undrawn).collect()
         } else {
             Vec::new()
         };
+        // Pages whose own white backdrop Remove background couldn't turn back on: said, not silent.
+        if matches!(edit, Edit::RemoveMarks { kind: MarkKind::Background }) {
+            let pages = guard(|| pdfcraft_edit::backdrops_left_off(&next)).unwrap_or_default();
+            if !pages.is_empty() {
+                notices.push(EditNotice::BackdropsLeftOff { pages });
+            }
+        }
         let previous = std::mem::replace(&mut editor.cos, next);
         let keys = keys_after(&edit).unwrap_or_else(|| editor.keys.clone());
         let previous_keys = std::mem::replace(&mut editor.keys, keys);
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index ed4e6efa1c..9574c49c31 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -2132,10 +2132,10 @@ fn a_value_its_font_cannot_draw_is_reported_by_the_edit_that_drew_it() {
     fill(&mut s, "name", FieldValue::Text("张三".into())).unwrap();
     let d = s.get(id).unwrap();
     assert_eq!(d.form[0].value, ["张三"]);
-    let n = &d.edit_notices;
-    assert_eq!(n.len(), 1, "{n:?}");
-    assert_eq!((n[0].field.as_deref(), n[0].page, n[0].ch, n[0].redrawn_elsewhere), (Some("name"), 0, '张', true));
-    assert!(n[0].to_string().contains("\"张\" (U+5F20)") && n[0].to_string().contains("other PDF viewers redraw"), "{}", n[0]);
+    let [EditNotice::Undrawn(n)] = d.edit_notices.as_slice() else { panic!("{:?}", d.edit_notices) };
+    assert_eq!((n.field.as_deref(), n.page, n.ch, n.redrawn_elsewhere), (Some("name"), 0, '张', true));
+    let said = d.edit_notices[0].to_string();
+    assert!(said.contains("\"张\" (U+5F20)") && said.contains("other PDF viewers redraw"), "{said}");
     fill(&mut s, "ok", FieldValue::Check(true)).unwrap();
     assert!(s.get(id).unwrap().edit_notices.is_empty(), "an unrelated edit reports nothing");
     fill(&mut s, "name", FieldValue::Text("李四".into())).unwrap();
@@ -2681,6 +2681,59 @@ fn headers_footers_watermarks_and_backgrounds_show_update_and_remove() {
     assert_eq!(s.get(id).unwrap().can_undo(), Some("Remove background"));
 }
 
+/// One 100 × 100 page under a background (`/PCMark /Background`), its own content painting a
+/// white backdrop first. With `copy`, that content is a backdrop copy whose tag is `copy`.
+fn backdrop_pdf(copy: Option<&str>) -> Vec<u8> {
+    let bg = "q 1 0 0 rg 0 0 100 100 re f Q";
+    let (tag, fill) = match copy {
+        Some(tag) => (format!("/PCBackdrop {tag} "), "n"),
+        None => (String::new(), "f"),
+    };
+    let content = format!("1 g 0 0 100 100 re {fill} 0 g BT /F1 12 Tf 10 50 Td (Hi) Tj ET");
+    format!(
+        "%PDF-1.7\n\
+         1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+         2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+         3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents [4 0 R 5 0 R] /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> >> >> endobj\n\
+         4 0 obj << /PCMark /Background /Length {} >> stream\n{bg}\nendstream endobj\n\
+         5 0 obj << {tag}/Length {} >> stream\n{content}\nendstream endobj\n\
+         trailer << /Root 1 0 R >>\n%%EOF",
+        bg.len(),
+        content.len()
+    )
+    .into_bytes()
+}
+
+/// Remove background says which pages keep their own white backdrop off (it couldn't be turned
+/// back on safely), and says nothing when every backdrop comes back.
+#[test]
+fn remove_background_names_the_pages_whose_own_backdrop_stays_off() {
+    let mut s = Session::new();
+    // A tag whose hash doesn't match the bytes before the fill: something changed them since.
+    let tag = format!("<< /Index 2 /Op (f) /Before <{}> >>", "00".repeat(32));
+    let id = s.open("a.pdf", None, Arc::new(backdrop_pdf(Some(&tag))), None).unwrap();
+    s.apply(id, Edit::RemoveMarks { kind: MarkKind::Background }).unwrap();
+    let d = s.get(id).unwrap();
+    assert_eq!(d.edit_notices, [EditNotice::BackdropsLeftOff { pages: vec![0] }]);
+    let said = d.edit_notices[0].to_string();
+    assert!(said.starts_with("page 1 changed after the background was added"), "{said}");
+    // An unrelated edit after it says nothing.
+    s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    assert!(s.get(id).unwrap().edit_notices.is_empty());
+
+    // Added and removed here: the backdrop comes back, and nothing is said.
+    let id = s.open("b.pdf", None, Arc::new(backdrop_pdf(None)), None).unwrap();
+    s.apply(id, Edit::RemoveMarks { kind: MarkKind::Background }).unwrap();
+    let background = Background { color: [1.0, 0.0, 0.0], ..Background::default() };
+    s.apply(id, Edit::AddBackground { pages: vec![0], settings: background, replace: false, file: None }).unwrap();
+    assert_eq!(s.get(id).unwrap().page_backdrops(&[0]), [None], "replaced");
+    s.apply(id, Edit::RemoveMarks { kind: MarkKind::Background }).unwrap();
+    assert!(s.get(id).unwrap().edit_notices.is_empty());
+    assert_eq!(s.get(id).unwrap().page_backdrops(&[0]), [Some(Backdrop::Fill)], "turned back on");
+    assert_eq!(page_runs(&[0, 1, 2, 5, 7, 8]), "1-3, 6, 8-9");
+    assert_eq!(page_runs(&[]), "");
+}
+
 #[test]
 fn marker_indexes_match_after_open_and_save_when_requested() {
     let (mut source, source_id) = session_with(1);
@@ -7029,11 +7082,11 @@ fn undo_and_redo_roll_back_on_a_refresh_panic_or_error() {
     // 5. Metadata scope: a panic after `doc.info.title` was written rolls back `info.title` and keeps `edit_notices`.
     s.apply(id, Edit::SetInfo { key: "Title".into(), value: "Draft".into() }).unwrap();
     let notice = TextNotice { field: None, page: 0, ch: '☺', redrawn_elsewhere: false };
-    s.doc_mut(id).unwrap().edit_notices.push(notice.clone());
+    s.doc_mut(id).unwrap().edit_notices.push(EditNotice::Undrawn(notice.clone()));
     panic_on_refresh(1);
     assert_eq!(s.undo(id), Err(EditError::Reopen("injected refresh panic".into())));
     assert_eq!(s.get(id).unwrap().info.title.as_deref(), Some("Draft"));
-    assert_eq!(s.get(id).unwrap().edit_notices, [notice]);
+    assert_eq!(s.get(id).unwrap().edit_notices, [EditNotice::Undrawn(notice)]);
     assert_eq!(s.undo(id).unwrap().as_str(), "Change Title");
     assert_eq!(s.get(id).unwrap().info.title, None);
     assert!(s.get(id).unwrap().edit_notices.is_empty());
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 2fdc2e9d02..e03dd52fe2 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -173,10 +173,14 @@ impl PdfCraftApp {
                 if std::mem::take(&mut view.comments.tool_done) && !self.comment_prefs.pinned {
                     self.quick_tool = crate::QuickTool::Select;
                 }
-                // Text saved as typed but drawn with `?` (its font can't draw it): said, not silent.
-                // Before the scripts' output, so an alert they raise still shows.
+                // Text saved as typed but drawn with `?` (its font can't draw it), or pages whose
+                // own backdrop stays off: said, not silent. Before the scripts' output, so an alert
+                // they raise still shows.
                 if let Some(n) = self.session.get(id).and_then(|d| d.edit_notices.first()).cloned() {
-                    self.notify(crate::content_ui::undrawn_message(&n));
+                    self.notify(match &n {
+                        pdfcraft_engine::EditNotice::Undrawn(t) => crate::content_ui::undrawn_message(t),
+                        pdfcraft_engine::EditNotice::BackdropsLeftOff { pages } => crate::marks_ui::backdrops_left_off_message(pages),
+                    });
                 }
                 let out = self.session.take_js_output(id);
                 self.handle_js(id, out);
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index e41a752411..20931ad0bb 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -862,6 +862,8 @@
 	Removing the background puts the page's own backdrop back.	إزالة الخلفية تعيد التعبئة البيضاء الخاصة بالصفحة.
 	A picture covers page {pages} (a scan?), so the background won't show there.	تغطي صورة الصفحة {pages} (مسح ضوئي؟)، لذا لن تظهر الخلفية فيها.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	تغطي صور الصفحات {pages} (مسح ضوئي؟)، لذا لن تظهر الخلفية فيها.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	تغيّرت الصفحة {pages} بعد إضافة الخلفية، لذا تبقى تعبئتها البيضاء الخاصة متوقفة. تبدو كما هي على الورق الأبيض.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	تغيّرت الصفحات {pages} بعد إضافة الخلفية، لذا تبقى تعبئتها البيضاء الخاصة متوقفة. تبدو كما هي على الورق الأبيض.
 	PDF or image	PDF أو صورة
 	No file chosen	لم يُختر ملف
 	Page number	رقم الصفحة
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 1854c469ef..f71d01dc01 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -533,6 +533,8 @@
 	Removing the background puts the page's own backdrop back.	Премахването на фона връща собственото бяло запълване на страницата.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Изображение покрива страница {pages} (сканиране?), затова фонът няма да се вижда там.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Изображения покриват страници {pages} (сканирания?), затова фонът няма да се вижда там.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Страница {pages} е променена след добавянето на фона, затова собственото ѝ бяло запълване остава изключено. На бяла хартия изглежда по същия начин.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Страници {pages} са променени след добавянето на фона, затова собственото им бяло запълване остава изключено. На бяла хартия изглеждат по същия начин.
 	PDF or image	PDF или изображение
 	No file chosen	Не е избран файл
 	Page number	Номер на страница
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 34ea8188e7..5164d43a10 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -821,6 +821,8 @@
 	Removing the background puts the page's own backdrop back.	En eliminar el fons, es restaura el farciment blanc propi de la pàgina.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Una imatge cobreix la pàgina {pages} (un escaneig?), així que el fons no s'hi veurà.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Hi ha imatges que cobreixen les pàgines {pages} (escanejos?), així que el fons no s'hi veurà.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	La pàgina {pages} ha canviat després d'afegir el fons, així que el seu propi farciment blanc continua desactivat. Es veu igual sobre paper blanc.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Les pàgines {pages} han canviat després d'afegir el fons, així que el seu propi farciment blanc continua desactivat. Es veuen igual sobre paper blanc.
 	PDF or image	PDF o imatge
 	No file chosen	Cap fitxer triat
 	Page number	Número de pàgina
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index 2e7d8f69a9..a87c272310 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -831,6 +831,8 @@
 	Removing the background puts the page's own backdrop back.	لابردنی پاشبنەما پڕکردنەوە سپییەکەی خودی پەڕەکە دەگەڕێنێتەوە.
 	A picture covers page {pages} (a scan?), so the background won't show there.	وێنەیەک پەڕەی {pages} دادەپۆشێت (سکان؟)، بۆیە پاشبنەماکە لەوێ دەرناکەوێت.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	وێنەکان پەڕەکانی {pages} دادەپۆشن (سکان؟)، بۆیە پاشبنەماکە لەوێ دەرناکەوێت.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	پەڕەی {pages} دوای زیادکردنی پاشبنەما گۆڕا، بۆیە پڕکردنەوە سپییەکەی خۆی کوژاوە دەمێنێتەوە. لەسەر کاغەزی سپی هەمان شێوەیە.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	پەڕەکانی {pages} دوای زیادکردنی پاشبنەما گۆڕان، بۆیە پڕکردنەوە سپییەکانی خۆیان کوژاوە دەمێننەوە. لەسەر کاغەزی سپی هەمان شێوەن.
 	PDF or image	PDF یان وێنە
 	No file chosen	هیچ فایلێک هەڵنەبژێردراوە
 	Page number	ژمارەی پەڕە
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index a2d3f1b0e9..10433a6543 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -937,6 +937,8 @@ key	Space	Mezerník
 	Removing the background puts the page's own backdrop back.	Odebráním pozadí se vrátí vlastní bílá výplň stránky.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Stránku {pages} pokrývá obrázek (sken?), takže pozadí na ní nebude vidět.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Stránky {pages} pokrývají obrázky (skeny?), takže pozadí na nich nebude vidět.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Stránka {pages} se po přidání pozadí změnila, proto její vlastní bílá výplň zůstává vypnutá. Na bílém papíře vypadá stejně.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Stránky {pages} se po přidání pozadí změnily, proto jejich vlastní bílá výplň zůstává vypnutá. Na bílém papíře vypadají stejně.
 	PDF or image	PDF nebo obrázek
 	No file chosen	Není vybrán žádný soubor
 	Page number	Číslo stránky
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index f7b6083f6b..4018a19604 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -840,6 +840,8 @@
 	Removing the background puts the page's own backdrop back.	Wird der Hintergrund entfernt, kehrt die eigene weiße Fläche der Seite zurück.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Ein Bild bedeckt Seite {pages} (ein Scan?), daher ist der Hintergrund dort nicht zu sehen.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Bilder bedecken die Seiten {pages} (Scans?), daher ist der Hintergrund dort nicht zu sehen.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Seite {pages} wurde nach dem Hinzufügen des Hintergrunds geändert, daher bleibt ihre eigene weiße Fläche ausgeschaltet. Auf weißem Papier sieht sie gleich aus.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Seiten {pages} wurden nach dem Hinzufügen des Hintergrunds geändert, daher bleiben ihre eigenen weißen Flächen ausgeschaltet. Auf weißem Papier sehen sie gleich aus.
 	PDF or image	PDF oder Bild
 	No file chosen	Keine Datei ausgewählt
 	Page number	Seitenzahl
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 143c915388..bd549327b6 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -444,6 +444,8 @@
 	Removing the background puts the page's own backdrop back.	Η αφαίρεση του φόντου επαναφέρει τη λευκή γέμιση της σελίδας.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Μια εικόνα καλύπτει τη σελίδα {pages} (σάρωση;), οπότε το φόντο δεν θα φαίνεται εκεί.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Εικόνες καλύπτουν τις σελίδες {pages} (σαρώσεις;), οπότε το φόντο δεν θα φαίνεται εκεί.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Η σελίδα {pages} άλλαξε μετά την προσθήκη του φόντου, οπότε η δική της λευκή γέμιση μένει απενεργοποιημένη. Σε λευκό χαρτί φαίνεται ίδια.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Οι σελίδες {pages} άλλαξαν μετά την προσθήκη του φόντου, οπότε οι δικές τους λευκές γεμίσεις μένουν απενεργοποιημένες. Σε λευκό χαρτί φαίνονται ίδιες.
 	PDF or image	PDF ή εικόνα
 	No file chosen	Δεν έχει επιλεγεί αρχείο
 	Scale relative to target page	Κλίμακα ως προς τη σελίδα προορισμού
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 451b0489bc..31af1e9251 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -856,6 +856,8 @@
 	Removing the background puts the page's own backdrop back.	Al quitar el fondo, se restaura el relleno blanco propio de la página.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Una imagen cubre la página {pages} (¿un escaneo?), así que el fondo no se verá ahí.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Hay imágenes que cubren las páginas {pages} (¿escaneos?), así que el fondo no se verá ahí.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	La página {pages} cambió después de añadir el fondo, así que su propio relleno blanco sigue desactivado. Se ve igual sobre papel blanco.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Las páginas {pages} cambiaron después de añadir el fondo, así que sus propios rellenos blancos siguen desactivados. Se ven igual sobre papel blanco.
 	PDF or image	PDF o imagen
 	No file chosen	Ningún archivo elegido
 	Page number	Número de página
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index ba4a72b142..5e7c1ea2d8 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -820,6 +820,8 @@
 	Removing the background puts the page's own backdrop back.	Taustan poistaminen palauttaa sivun oman valkoisen täytön.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Kuva peittää sivun {pages} (skannaus?), joten tausta ei näy siinä.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Kuvat peittävät sivut {pages} (skannauksia?), joten tausta ei näy niissä.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Sivu {pages} muuttui taustan lisäämisen jälkeen, joten sen oma valkoinen täyttö pysyy pois päältä. Valkoisella paperilla se näyttää samalta.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Sivut {pages} muuttuivat taustan lisäämisen jälkeen, joten niiden omat valkoiset täytöt pysyvät pois päältä. Valkoisella paperilla ne näyttävät samalta.
 	PDF or image	PDF tai kuva
 	No file chosen	Tiedostoa ei ole valittu
 	Page number	Sivunumero
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 7eed4b9d4c..c6d2c4090e 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -836,6 +836,8 @@
 	Removing the background puts the page's own backdrop back.	Supprimer l'arrière-plan rétablit le remplissage blanc propre à la page.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Une image couvre la page {pages} (une numérisation ?), l'arrière-plan n'y sera donc pas visible.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Des images couvrent les pages {pages} (des numérisations ?), l'arrière-plan n'y sera donc pas visible.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	La page {pages} a changé après l'ajout de l'arrière-plan, son propre remplissage blanc reste donc désactivé. Elle paraît identique sur papier blanc.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Les pages {pages} ont changé après l'ajout de l'arrière-plan, leurs propres remplissages blancs restent donc désactivés. Elles paraissent identiques sur papier blanc.
 	PDF or image	PDF ou image
 	No file chosen	Aucun fichier choisi
 	Page number	Numéro de page
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index 4a6baf1819..b45b026068 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -804,6 +804,8 @@
 	Removing the background puts the page's own backdrop back.	पृष्ठभूमि हटाने पर पृष्ठ की अपनी सफ़ेद भराई वापस आ जाती है।
 	A picture covers page {pages} (a scan?), so the background won't show there.	एक छवि पृष्ठ {pages} को ढकती है (स्कैन?), इसलिए वहाँ पृष्ठभूमि नहीं दिखेगी।
 	Pictures cover pages {pages} (scans?), so the background won't show there.	छवियाँ पृष्ठ {pages} को ढकती हैं (स्कैन?), इसलिए वहाँ पृष्ठभूमि नहीं दिखेगी।
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	पृष्ठभूमि जोड़ने के बाद पृष्ठ {pages} बदल गया, इसलिए उसकी अपनी सफ़ेद भराई बंद रहती है। सफ़ेद कागज़ पर यह वैसा ही दिखता है।
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	पृष्ठभूमि जोड़ने के बाद पृष्ठ {pages} बदल गए, इसलिए उनकी अपनी सफ़ेद भराई बंद रहती है। सफ़ेद कागज़ पर वे वैसे ही दिखते हैं।
 	PDF or image	पीडीएफ़ या छवि
 	No file chosen	कोई फ़ाइल नहीं चुनी गई
 	Page number	पृष्ठ संख्या
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index f21705c6e1..e67bb6761e 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -833,6 +833,8 @@
 	Removing the background puts the page's own backdrop back.	A háttér eltávolítása visszaállítja az oldal saját fehér kitöltését.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Egy kép fedi le ezt az oldalt: {pages} (szkennelt?), így ott nem látszik a háttér.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Képek fedik le ezeket az oldalakat: {pages} (szkenneltek?), így ott nem látszik a háttér.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Ez az oldal megváltozott a háttér hozzáadása után, ezért a saját fehér kitöltése kikapcsolva marad: {pages}. Fehér papíron ugyanúgy néz ki.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Ezek az oldalak megváltoztak a háttér hozzáadása után, ezért a saját fehér kitöltésük kikapcsolva marad: {pages}. Fehér papíron ugyanúgy néznek ki.
 	PDF or image	PDF vagy kép
 	No file chosen	Nincs fájl kiválasztva
 	Page number	Oldalszám
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 002cd54de7..b96e6fc8cb 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -950,6 +950,8 @@
 	Removing the background puts the page's own backdrop back.	Menghapus latar belakang akan mengembalikan isian putih milik halaman.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Sebuah gambar menutupi halaman {pages} (hasil pindai?), jadi latar belakang tidak akan terlihat di sana.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Gambar menutupi halaman-halaman {pages} (hasil pindai?), jadi latar belakang tidak akan terlihat di sana.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Halaman {pages} berubah setelah latar belakang ditambahkan, jadi isian putihnya sendiri tetap mati. Di kertas putih tampilannya sama.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Halaman {pages} berubah setelah latar belakang ditambahkan, jadi isian putihnya sendiri tetap mati. Di kertas putih tampilannya sama.
 	Report	Laporan
 	Report…	Laporan…
 	Requires user to enter a password for:	Memerlukan pengguna untuk memasukkan kata sandi untuk:
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index fb64615371..8bcfd6da1d 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -859,6 +859,8 @@
 	Removing the background puts the page's own backdrop back.	Rimuovendo lo sfondo, il riempimento bianco della pagina viene ripristinato.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Un'immagine copre la pagina {pages} (una scansione?), quindi lì lo sfondo non sarà visibile.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Delle immagini coprono le pagine {pages} (scansioni?), quindi lì lo sfondo non sarà visibile.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	La pagina {pages} è cambiata dopo l'aggiunta dello sfondo, quindi il suo riempimento bianco resta disattivato. Su carta bianca appare uguale.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Le pagine {pages} sono cambiate dopo l'aggiunta dello sfondo, quindi i loro riempimenti bianchi restano disattivati. Su carta bianca appaiono uguali.
 	PDF or image	PDF o immagine
 	No file chosen	Nessun file scelto
 	Page number	Numero di pagina
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 79b12f015a..47bca878f9 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -863,6 +863,8 @@
 	Removing the background puts the page's own backdrop back.	背景を削除すると、ページ独自の白い塗りが元に戻ります。
 	A picture covers page {pages} (a scan?), so the background won't show there.	{pages} ページは画像（スキャン？）で覆われているため、背景は表示されません。
 	Pictures cover pages {pages} (scans?), so the background won't show there.	{pages} ページが画像（スキャン？）で覆われているため、そこでは背景は表示されません。
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	背景を追加した後に {pages} ページが変更されたため、そのページ独自の白い塗りはオフのままです。白い紙では見た目は変わりません。
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	背景を追加した後に {pages} ページが変更されたため、それらのページ独自の白い塗りはオフのままです。白い紙では見た目は変わりません。
 	PDF or image	PDF または画像
 	No file chosen	ファイルが選択されていません
 	Page number	ページ番号
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index a040c013b5..6953af8a2c 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -818,6 +818,8 @@
 	Removing the background puts the page's own backdrop back.	Фонды жою беттің өз ақ толтыруын қайтарады.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Сурет жауып тұрған бет (сканер ме?): {pages}; онда фон көрінбейді.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Суреттер жауып тұрған беттер (сканер ме?): {pages}; онда фон көрінбейді.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Фон қосылғаннан кейін өзгерген бет, сондықтан оның өз ақ толтыруы өшірулі қалады: {pages}. Ақ қағазда бірдей көрінеді.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Фон қосылғаннан кейін өзгерген беттер, сондықтан олардың өз ақ толтырулары өшірулі қалады: {pages}. Ақ қағазда бірдей көрінеді.
 	PDF or image	PDF немесе сурет
 	No file chosen	Файл таңдалмады
 	Page number	Бет нөмірі
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 873c93b6f9..ab333c55b3 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -804,6 +804,8 @@
 	Removing the background puts the page's own backdrop back.	배경을 제거하면 페이지 자체의 흰색 채우기가 복원됩니다.
 	A picture covers page {pages} (a scan?), so the background won't show there.	이미지가 {pages}페이지를 덮고 있어(스캔본?) 배경이 보이지 않습니다.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	이미지들이 {pages}페이지를 덮고 있어(스캔본?) 배경이 보이지 않습니다.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	배경을 추가한 뒤 {pages}페이지가 바뀌어서 자체 흰색 채우기가 꺼진 채로 남습니다. 흰 종이에서는 똑같이 보입니다.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	배경을 추가한 뒤 {pages}페이지가 바뀌어서 자체 흰색 채우기가 꺼진 채로 남습니다. 흰 종이에서는 똑같이 보입니다.
 	PDF or image	PDF 또는 이미지
 	No file chosen	선택한 파일 없음
 	Page number	페이지 번호
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index 04d5b73d1d..d86deae1cd 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -830,6 +830,8 @@
 	Removing the background puts the page's own backdrop back.	ການລຶບພື້ນຫຼັງຈະເອົາພື້ນສີຂາວເດີມຂອງໜ້າກັບຄືນມາ.
 	A picture covers page {pages} (a scan?), so the background won't show there.	ມີຮູບພາບປົກໜ້າ {pages} ຢູ່ (ພາບສະແກນ?), ສະນັ້ນພື້ນຫຼັງຈະບໍ່ສະແດງຢູ່ບ່ອນນັ້ນ.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	ມີຮູບພາບຫຼາຍຮູບປົກໜ້າ {pages} ຢູ່ (ພາບສະແກນ?), ສະນັ້ນພື້ນຫຼັງຈະບໍ່ສະແດງຢູ່ບ່ອນນັ້ນ.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	ໜ້າ {pages} ປ່ຽນໄປຫຼັງຈາກເພີ່ມພື້ນຫຼັງ, ສະນັ້ນພື້ນສີຂາວຂອງມັນເອງຍັງປິດຢູ່. ເທິງເຈ້ຍສີຂາວມັນເບິ່ງຄືເກົ່າ.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	ໜ້າ {pages} ປ່ຽນໄປຫຼັງຈາກເພີ່ມພື້ນຫຼັງ, ສະນັ້ນພື້ນສີຂາວຂອງພວກມັນເອງຍັງປິດຢູ່. ເທິງເຈ້ຍສີຂາວພວກມັນເບິ່ງຄືເກົ່າ.
 	PDF or image	PDF ຫຼື ຮູບພາບ
 	No file chosen	ຍັງບໍ່ໄດ້ເລືອກໄຟລ໌
 	Page number	ໝາຍເລກໜ້າ
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 86242b6f41..30c15f1d1e 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -1002,6 +1002,8 @@
 	Removing the background puts the page's own backdrop back.	Pašalinus foną, grąžinamas paties puslapio baltas užpildas.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Paveikslėliu padengtas puslapis (nuskaitytas?): {pages}; fonas ten nesimatys.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Paveikslėliais padengti puslapiai (nuskaityti?): {pages}; fonas ten nesimatys.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Puslapis pasikeitė po fono pridėjimo, todėl jo baltas užpildas lieka išjungtas: {pages}. Ant balto popieriaus jis atrodo taip pat.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Puslapiai pasikeitė po fono pridėjimo, todėl jų balti užpildai lieka išjungti: {pages}. Ant balto popieriaus jie atrodo taip pat.
 	Report	Ataskaita
 	Report…	Ataskaita…
 	Requires user to enter a password for:	Naudotojas turi įvesti slaptažodį, kad galėtų:
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index 54bafb923a..f128c21a03 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -959,6 +959,8 @@
 	Removing the background puts the page's own backdrop back.	Når bakgrunnen fjernes, kommer sidens egen hvite flate tilbake.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Et bilde dekker side {pages} (en skanning?), så bakgrunnen vises ikke der.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Bilder dekker sidene {pages} (skanninger?), så bakgrunnen vises ikke der.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Side {pages} ble endret etter at bakgrunnen ble lagt til, så sidens egen hvite flate forblir slått av. På hvitt papir ser den lik ut.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Sidene {pages} ble endret etter at bakgrunnen ble lagt til, så sidenes egne hvite flater forblir slått av. På hvitt papir ser de like ut.
 	Report	Rapport
 	Report…	Rapport…
 	Requires user to enter a password for:	Krever at brukeren skriver inn et passord for:
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index d3b5abf68c..6567745a04 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -854,6 +854,8 @@
 	Removing the background puts the page's own backdrop back.	Usunięcie tła przywraca własne białe wypełnienie strony.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Strona zakryta obrazem (skan?): {pages}; tło nie będzie tam widoczne.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Strony zakryte obrazami (skany?): {pages}; tło nie będzie tam widoczne.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Strona zmieniona po dodaniu tła, więc jej własne białe wypełnienie pozostaje wyłączone: {pages}. Na białym papierze wygląda tak samo.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Strony zmienione po dodaniu tła, więc ich własne białe wypełnienia pozostają wyłączone: {pages}. Na białym papierze wyglądają tak samo.
 	PDF or image	PDF lub obraz
 	No file chosen	Nie wybrano pliku
 	Page number	Numer strony
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 53c2d8461d..5dfb7470c3 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -488,6 +488,8 @@
 	Removing the background puts the page's own backdrop back.	Remover o plano de fundo restaura o preenchimento branco da página.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Uma imagem cobre a página {pages} (uma digitalização?), então o plano de fundo não aparecerá nela.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Imagens cobrem as páginas {pages} (digitalizações?), então o plano de fundo não aparecerá nelas.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	A página {pages} mudou depois que o plano de fundo foi adicionado, então seu preenchimento branco próprio continua desligado. Em papel branco ela parece igual.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	As páginas {pages} mudaram depois que o plano de fundo foi adicionado, então seus preenchimentos brancos próprios continuam desligados. Em papel branco elas parecem iguais.
 	PDF or image	PDF ou imagem
 	No file chosen	Nenhum arquivo escolhido
 	Page number	Número da página
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 5eb10620fb..a4200b7836 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -959,6 +959,8 @@
 	Removing the background puts the page's own backdrop back.	Eliminarea fundalului readuce umplerea albă proprie a paginii.
 	A picture covers page {pages} (a scan?), so the background won't show there.	O imagine acoperă pagina {pages} (o scanare?), deci fundalul nu se va vedea acolo.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Imagini acoperă paginile {pages} (scanări?), deci fundalul nu se va vedea acolo.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Pagina {pages} s-a schimbat după adăugarea fundalului, așa că umplerea ei albă proprie rămâne oprită. Pe hârtie albă arată la fel.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Paginile {pages} s-au schimbat după adăugarea fundalului, așa că umplerile lor albe proprii rămân oprite. Pe hârtie albă arată la fel.
 	Report	Raport
 	Report…	Raport…
 	Requires user to enter a password for:	Utilizatorul trebuie să introducă o parolă pentru:
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index c3eaea9ba3..357ff1aa8b 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -856,6 +856,8 @@
 	Removing the background puts the page's own backdrop back.	При удалении фона собственная белая заливка страницы возвращается.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Страница, закрытая изображением (скан?): {pages}; фон там не будет виден.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Страницы, закрытые изображениями (сканы?): {pages}; фон там не будет виден.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Страница изменена после добавления фона, поэтому её собственная белая заливка остаётся выключенной: {pages}. На белой бумаге она выглядит так же.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Страницы изменены после добавления фона, поэтому их собственные белые заливки остаются выключенными: {pages}. На белой бумаге они выглядят так же.
 	PDF or image	PDF или изображение
 	No file chosen	Файл не выбран
 	Page number	Номер страницы
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index d81b47794c..f899f273a9 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -1528,6 +1528,8 @@
 	Removing the background puts the page's own backdrop back.	Odstranitev ozadja povrne lastno belo polnilo strani.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Stran, ki jo prekriva slika (skeniranje?): {pages}; ozadje tam ne bo vidno.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Strani, ki jih prekrivajo slike (skeniranja?): {pages}; ozadje tam ne bo vidno.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Stran se je spremenila po dodajanju ozadja, zato njeno lastno belo polnilo ostane izklopljeno: {pages}. Na belem papirju je videti enako.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Strani so se spremenile po dodajanju ozadja, zato njihova lastna bela polnila ostanejo izklopljena: {pages}. Na belem papirju so videti enako.
 	Replacing images arrives on the web with image file pickers	Zamenjava slik bo v spletni različici na voljo z izbirniki slikovnih datotek
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Zamenjava slik na strani {p} bo v spletni različici na voljo z izbirniki slik ({i})
 	Reply	Odgovori
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index e0b8e0e726..2c638a388d 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -1481,6 +1481,8 @@
 	Removing the background puts the page's own backdrop back.	Heqja e sfondit e rikthen mbushjen e bardhë të faqes.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Një imazh e mbulon faqen {pages} (skanim?), prandaj sfondi nuk do të duket aty.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Imazhe mbulojnë faqet {pages} (skanime?), prandaj sfondi nuk do të duket aty.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Faqja {pages} ndryshoi pasi u shtua sfondi, ndaj mbushja e saj e bardhë mbetet e fikur. Në letër të bardhë duket njësoj.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Faqet {pages} ndryshuan pasi u shtua sfondi, ndaj mbushjet e tyre të bardha mbeten të fikura. Në letër të bardhë duken njësoj.
 	Replacing images arrives on the web with image file pickers	Zëvendësimi i imazheve vjen në ueb me zgjedhësit e skedarëve të imazhit
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Zëvendësimi i imazheve në faqen {p} vjen në ueb me zgjedhësit e imazhit ({i})
 	Reply	Përgjigju
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index adaefdbedf..78a7e72189 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -836,6 +836,8 @@ comment menu	Edit	సవరించు
 	Removing the background puts the page's own backdrop back.	నేపథ్యాన్ని తీసివేస్తే పేజీ సొంత తెల్లని నింపు తిరిగి వస్తుంది.
 	A picture covers page {pages} (a scan?), so the background won't show there.	పేజీ {pages}ని ఒక చిత్రం కప్పుతోంది (స్కాన్?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	పేజీలు {pages}ని చిత్రాలు కప్పుతున్నాయి (స్కాన్‌లు?), కాబట్టి అక్కడ నేపథ్యం కనిపించదు.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	నేపథ్యాన్ని జోడించిన తర్వాత పేజీ {pages} మారింది, కాబట్టి దాని సొంత తెల్లని నింపు ఆపివేయబడే ఉంటుంది. తెల్ల కాగితంపై అది అలాగే కనిపిస్తుంది.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	నేపథ్యాన్ని జోడించిన తర్వాత పేజీలు {pages} మారాయి, కాబట్టి వాటి సొంత తెల్లని నింపులు ఆపివేయబడే ఉంటాయి. తెల్ల కాగితంపై అవి అలాగే కనిపిస్తాయి.
 	PDF or image	PDF లేదా చిత్రం
 	No file chosen	ఫైల్ ఏదీ ఎంచుకోలేదు
 	Page number	పేజీ సంఖ్య
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index 2740313342..857ff8be03 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -815,6 +815,8 @@
 	Removing the background puts the page's own backdrop back.	การเอาพื้นหลังออกจะคืนพื้นสีขาวเดิมของหน้า
 	A picture covers page {pages} (a scan?), so the background won't show there.	มีรูปภาพปิดหน้า {pages} อยู่ (ภาพสแกน?) จึงจะมองไม่เห็นพื้นหลังที่นั่น
 	Pictures cover pages {pages} (scans?), so the background won't show there.	มีรูปภาพหลายรูปปิดหน้า {pages} อยู่ (ภาพสแกน?) จึงจะมองไม่เห็นพื้นหลังที่นั่น
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	หน้า {pages} เปลี่ยนไปหลังจากเพิ่มพื้นหลัง พื้นสีขาวของตัวเองจึงยังปิดอยู่ บนกระดาษสีขาวจะดูเหมือนเดิม
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	หน้า {pages} เปลี่ยนไปหลังจากเพิ่มพื้นหลัง พื้นสีขาวของหน้าเหล่านั้นจึงยังปิดอยู่ บนกระดาษสีขาวจะดูเหมือนเดิม
 	PDF or image	PDF หรือรูปภาพ
 	No file chosen	ยังไม่ได้เลือกไฟล์
 	Page number	เลขหน้า
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index a31216ca53..cf27544d3b 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -817,6 +817,8 @@
 	Removing the background puts the page's own backdrop back.	Arka planı kaldırmak, sayfanın kendi beyaz dolgusunu geri getirir.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Resimle kaplı sayfa (tarama mı?): {pages}; arka plan orada görünmez.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Resimlerle kaplı sayfalar (tarama mı?): {pages}; arka plan orada görünmez.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Arka plan eklendikten sonra değişen sayfa, bu yüzden kendi beyaz dolgusu kapalı kalıyor: {pages}. Beyaz kâğıtta aynı görünür.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Arka plan eklendikten sonra değişen sayfalar, bu yüzden kendi beyaz dolguları kapalı kalıyor: {pages}. Beyaz kâğıtta aynı görünürler.
 	PDF or image	PDF veya resim
 	No file chosen	Dosya seçilmedi
 	Page number	Sayfa numarası
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index c1f294dfd1..265c8f9dbc 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -860,6 +860,8 @@
 	Removing the background puts the page's own backdrop back.	Вилучення тла повертає власну білу заливку сторінки.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Сторінка, закрита зображенням (скан?): {pages}; тло там не буде видно.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Сторінки, закриті зображеннями (скани?): {pages}; тло там не буде видно.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Сторінка змінена після додавання тла, тому її власна біла заливка залишається вимкненою: {pages}. На білому папері вона виглядає так само.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Сторінки змінені після додавання тла, тому їхні власні білі заливки залишаються вимкненими: {pages}. На білому папері вони виглядають так само.
 	PDF or image	PDF або зображення
 	No file chosen	Файл не вибрано
 	Page number	Номер сторінки
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 526fbac0b1..2b9189c02c 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -996,6 +996,8 @@ theme	Appearance	Giao diện
 	Removing the background puts the page's own backdrop back.	Gỡ nền sẽ khôi phục lớp tô trắng riêng của trang.
 	A picture covers page {pages} (a scan?), so the background won't show there.	Một hình ảnh phủ kín trang {pages} (bản quét?), nên nền sẽ không hiện ở đó.
 	Pictures cover pages {pages} (scans?), so the background won't show there.	Hình ảnh phủ kín các trang {pages} (bản quét?), nên nền sẽ không hiện ở đó.
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	Trang {pages} đã thay đổi sau khi thêm nền, nên lớp tô trắng riêng của nó vẫn tắt. Trên giấy trắng trông vẫn như cũ.
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	Các trang {pages} đã thay đổi sau khi thêm nền, nên lớp tô trắng riêng của chúng vẫn tắt. Trên giấy trắng trông vẫn như cũ.
 	Report	Báo cáo
 	Report…	Báo cáo…
 	Requires user to enter a password for:	Yêu cầu người dùng nhập mật khẩu cho:
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 0055556061..5b13735333 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -540,6 +540,8 @@
 	Removing the background puts the page's own backdrop back.	移除背景后，页面自己的白色填充会恢复。
 	A picture covers page {pages} (a scan?), so the background won't show there.	第 {pages} 页被一张图片覆盖（扫描件？），因此那里不会显示背景。
 	Pictures cover pages {pages} (scans?), so the background won't show there.	第 {pages} 页被图片覆盖（扫描件？），因此那里不会显示背景。
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	第 {pages} 页在添加背景后有改动，因此其自身的白色填充保持关闭。在白纸上看起来一样。
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	第 {pages} 页在添加背景后有改动，因此它们自身的白色填充保持关闭。在白纸上看起来一样。
 	PDF or image	PDF 或图像
 	No file chosen	未选择文件
 	Page number	页码
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index bb42c169a6..292d9d0e5e 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -492,6 +492,8 @@
 	Removing the background puts the page's own backdrop back.	移除背景後，頁面自己的白色填色會恢復。
 	A picture covers page {pages} (a scan?), so the background won't show there.	第 {pages} 頁被一張圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
 	Pictures cover pages {pages} (scans?), so the background won't show there.	第 {pages} 頁被圖片覆蓋（掃描檔？），因此那裡不會顯示背景。
+	Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.	第 {pages} 頁在加入背景後有變更，因此其本身的白色填色維持關閉。在白紙上看起來一樣。
+	Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper.	第 {pages} 頁在加入背景後有變更，因此它們本身的白色填色維持關閉。在白紙上看起來一樣。
 	PDF or image	PDF 或圖片
 	No file chosen	未選擇檔案
 	Page number	頁碼
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index 2cf2450336..e9652be1a6 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -154,6 +154,16 @@ impl MarksDraft {
 /// How many runs of pages a message lists before it stops with "…".
 const LISTED_PAGE_RUNS: usize = 8;
 
+/// After Remove background: the pages (0-based, ascending) whose own white backdrop stays off,
+/// because they changed after the background was added (`pdfcraft_engine::EditNotice`).
+pub(crate) fn backdrops_left_off_message(pages: &[usize]) -> String {
+    pages_phrase(
+        pages,
+        tl!("Page {pages} changed after the background was added, so its own white backdrop stays off. It looks the same on white paper."),
+        tl!("Pages {pages} changed after the background was added, so their own white backdrops stay off. They look the same on white paper."),
+    )
+}
+
 /// `one` or `many` with `{pages}` replaced by `pages` (0-based, ascending) as 1-based runs
 /// ("1-3, 6"), so the message says which pages it means.
 fn pages_phrase(pages: &[usize], one: &str, many: &str) -> String {
diff --git a/crates/ui-egui/tests/it/marks.rs b/crates/ui-egui/tests/it/marks.rs
index 8edc9e3ce6..aaeddfd7ec 100644
--- a/crates/ui-egui/tests/it/marks.rs
+++ b/crates/ui-egui/tests/it/marks.rs
@@ -212,6 +212,39 @@ fn the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scan
     assert_eq!(backdrop(&h, 0), None, "Update keeps the backdrop replaced");
 }
 
+/// Remove background says which pages keep their own white backdrop off: here one whose
+/// backdrop copy changed before the fill since the background replaced it.
+#[test]
+fn remove_background_says_which_pages_keep_their_own_backdrop_off() {
+    let copy = "1 1 1 rg 0 0 300 400 re n 0 g 20 20 50 50 re f";
+    let bg = "q 1 0 0 rg 0 0 300 400 re f Q";
+    let fixture = format!(
+        "%PDF-1.7\n\
+         1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+         2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj\n\
+         3 0 obj << /Type /Page /Parent 2 0 R /Contents [4 0 R 5 0 R] >> endobj\n\
+         4 0 obj << /PCMark /Background /Length {} >> stream\n{bg}\nendstream endobj\n\
+         5 0 obj << /PCBackdrop << /Index 2 /Op (f) /Before <{}> >> /Length {} >> stream\n{copy}\nendstream endobj\n\
+         trailer << /Root 1 0 R >>\n%%EOF",
+        bg.len(),
+        "00".repeat(32),
+        copy.len()
+    );
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, fixture.into_bytes()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert_eq!(marks(&h), [MarkKind::Background]);
+    h.state_mut().execute("edit.background.remove");
+    h.run_steps(2);
+    assert!(marks(&h).is_empty());
+    let toast = h.state().toast.as_ref().map(|(t, _)| t.clone()).unwrap_or_default();
+    assert_eq!(toast, "Page 1 changed after the background was added, so its own white backdrop stays off. It looks the same on white paper.");
+}
+
 /// Pages from 1 to 1 stays one page: the dialog used to turn "to" back into the last page on
 /// every frame while both were 1, so only page 1 could not be chosen alone. The field starts on
 /// the last page.
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index ac21f74bf4..98b5096c6c 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2509,7 +2509,7 @@ status = "shipped"
 commands = ["edit.background"]
 tools = ["doc_background", "doc_backdrops"]
 evidence = ["crates/ui-egui/tests/it/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/it/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright", "crates/automation/tests/it/backdrop.rs::a_background_shows_on_a_page_that_paints_its_own_white_backdrop", "crates/ui-egui/tests/it/marks.rs::the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scans", "crates/edit/src/backdrop_tests.rs::content_that_is_not_a_page_backdrop_is_left_alone"]
-notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove puts it back unless the content was edited since). Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space; the dialog preview is a schematic, not the page"
+notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove turns it back on, after edits and redactions too, unless the operators before it changed or it would no longer be painted first, and then says which pages keep it off). The replaced copy's tag holds no page content or reference, so text a redaction or Remove Hidden Information takes off such a page leaves the file. Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space; the dialog preview is a schematic, not the page"
 
 [[feature]]
 id = "edit.background-update-remove"
@@ -2520,8 +2520,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.background.update", "edit.background.remove"]
 tools = ["doc_background", "doc_remove_marks"]
-evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/edit/src/backdrop_tests.rs::a_white_fill_backdrop_is_replaced_and_put_back_when_the_background_goes", "crates/edit/src/backdrop_tests.rs::a_backdrop_copy_edited_since_is_kept_when_the_background_goes"]
-notes = "Remove also restores a page backdrop Add replaced"
+evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/edit/src/backdrop_tests.rs::a_white_fill_backdrop_is_replaced_and_put_back_when_the_background_goes", "crates/edit/src/backdrop_tests.rs::an_edit_after_the_fill_is_kept_and_the_backdrop_still_comes_back", "crates/edit/src/backdrop_tests.rs::a_copy_written_out_again_with_other_spacing_still_comes_back", "crates/edit/src/backdrop_tests.rs::a_change_before_the_fill_leaves_it_off_and_names_the_page", "crates/edit/src/backdrop_tests.rs::a_fill_that_would_cover_content_painted_before_it_stays_off", "crates/engine/src/tests.rs::remove_background_names_the_pages_whose_own_backdrop_stays_off", "crates/automation/tests/it/backdrop.rs::removed_text_leaves_the_file_when_a_background_replaced_the_pages_backdrop"]
+notes = "Remove also turns back on a page backdrop Add replaced, keeping edits made after it; where that isn't safe it says which pages keep it off"
 
 [[feature]]
 id = "edit.decoration-profiles"

From 632ba10ed5c8b41d9f53a0385514aeadeb4b4b31 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sat, 24 Oct 2026 18:17:48 +1100
Subject: [PATCH 023/132] fix(ui): Redo from the menu with typing in a page box
 stays in the box

Redo from the menu or toolbar closed the box first, which applied its
typing: a new edit that dropped the document's waiting Redo, and the
Redo itself then failed. The step was gone. Redo now goes to the box as
the key does: what Undo took back there comes back, and typing the page
doesn't have yet stays as it is, with the document's Redo waiting.

A new text box the document refused was put back without the request
to select the item once it exists, which stayed behind. It is put back
with the box.
---
 crates/ui-egui/src/editing.rs      | 78 ++++++++++++++++++++++++++++--
 crates/ui-egui/tests/it/content.rs | 33 +++++++++++++
 crates/ui-egui/tests/it/editing.rs | 40 +++++++++++++++
 3 files changed, 148 insertions(+), 3 deletions(-)

diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 39e0fd1adf..99cd53eff4 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -222,11 +222,31 @@ impl PdfCraftApp {
     pub fn redo(&mut self) {
         if self.combine_showing() {
             self.combine_history_step(false);
-        } else {
+        } else if !self.redo_in_page_box() {
             self.history_step(false);
         }
     }
 
+    /// Redo from the menu or toolbar while a box on the page has typing of its own: the step is
+    /// the box's, as the key's is. What Undo took back in the box comes back; typing the page
+    /// doesn't have yet stays as it is, since applying it first is a new edit, which drops the
+    /// document's Redo. True when the box took the step.
+    fn redo_in_page_box(&mut self) -> bool {
+        let Some(ctx) = self.ctx.clone() else { return false };
+        let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
+        if let Some(ed) = view.line_editor.as_mut() {
+            let Some(text) = redo_typing(&ctx, crate::edit_text_ui::input_id(), &ed.text) else { return ed.has_unsaved_text() };
+            ed.text = text;
+            return true;
+        }
+        if let Some(d) = view.content.draft.as_mut() {
+            let Some(text) = redo_typing(&ctx, crate::content_ui::input_id(), &d.text) else { return d.has_unapplied_typing() };
+            d.text = text;
+            return true;
+        }
+        false
+    }
+
     fn history_step(&mut self, undo: bool) {
         let Some((i, id)) = self.active_ids() else { return };
         if !self.close_text_editors(i, id) {
@@ -274,12 +294,13 @@ impl PdfCraftApp {
         }
         let added = self.session.get(id).map(|d| d.added().to_vec()).unwrap_or_default();
         let Some(view) = self.views.get_mut(i) else { return true };
-        let draft = view.content.draft.clone();
+        // Finishing new text also asks for it to be selected once it exists: put that back too.
+        let (draft, select_added) = (view.content.draft.clone(), view.content.select_added);
         if let Some(edit) = view.content.finish_draft(&added)
             && !self.apply_edit(edit)
         {
             if let Some(view) = self.views.get_mut(i) {
-                view.content.draft = draft;
+                (view.content.draft, view.content.select_added) = (draft, select_added);
             }
             return false;
         }
@@ -1217,6 +1238,18 @@ fn bookmark_at<'a>(items: &'a [pdfcraft_render::OutlineItem], path: &[usize]) ->
     if rest.is_empty() { Some(item) } else { bookmark_at(&item.children, rest) }
 }
 
+/// The box's own Redo, as the key does it: the typing Undo took back, put back in the box's text,
+/// with the box's history and cursor moved along. None when the box has nothing to redo.
+fn redo_typing(ctx: &egui::Context, id: egui::Id, text: &str) -> Option<String> {
+    let mut state = egui::TextEdit::load_state(ctx, id)?;
+    let mut undoer = state.undoer();
+    let (range, redone) = undoer.redo(&(state.cursor.char_range()?, text.to_owned()))?.clone();
+    state.set_undoer(undoer);
+    state.cursor.set_char_range(Some(range));
+    egui::TextEdit::store_state(ctx, id, state);
+    Some(redone)
+}
+
 #[cfg(test)]
 mod tests {
     use super::{SaveTarget, is_mail_temp_copy, write_atomically, write_atomically_syncing, write_atomically_with};
@@ -1493,6 +1526,45 @@ mod tests {
         out
     }
 
+    /// `one_page_pdf`, opening without a password, whose permissions refuse changes.
+    fn no_changes_pdf() -> Vec<u8> {
+        let mut doc = pdfcraft_cos::Document::open(std::sync::Arc::new(one_page_pdf())).unwrap();
+        let encryption = pdfcraft_cos::NewEncryption {
+            algorithm: pdfcraft_cos::Algorithm::Aes256,
+            user_password: "",
+            owner_password: "owner",
+            permissions: -1 ^ 8,
+            encrypt_metadata: true,
+            seed: [4; 32],
+        };
+        doc.set_encryption(&encryption).unwrap();
+        pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
+    }
+
+    /// Undo with a new text box open on a document that refuses changes: the box is put back as
+    /// it was. Finishing it had asked for the new item to be selected, and that request stayed
+    /// behind once the add was refused.
+    #[test]
+    fn a_refused_text_box_is_put_back_whole() {
+        let mut app = crate::PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("a.pdf", None, no_changes_pdf()).unwrap();
+        let style = crate::content_ui::default_style();
+        app.views[0].content.draft = Some(crate::content_ui::TextDraft {
+            page: 0,
+            index: None,
+            rect: [20.0, 20.0, 120.0, 40.0],
+            text: "Typed".into(),
+            style,
+            focus: false,
+            typing_from: None,
+        });
+        app.undo();
+        let content = &app.views[0].content;
+        assert_eq!(content.draft.as_ref().map(|d| d.text.as_str()), Some("Typed"), "the refused box stays open");
+        assert_eq!(content.select_added, None, "nothing was added to select");
+    }
+
     #[test]
     fn save_asks_where_to_keep_an_email_attachment_and_leaves_the_temporary_copy_alone() {
         let dir = staging_dir("mail-temp");
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 41957e6f69..81d6e00049 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -892,6 +892,39 @@ fn redo_after_undoing_typing_in_added_text_puts_it_back() {
     assert_eq!(doc.can_redo(), Some("Edit content"), "the document's Redo still waits");
 }
 
+/// Redo from the menu with retyping the page doesn't have yet in an added text box: the typing
+/// stays in the box and the document's Redo waits (closing the box first wrote the typing, which
+/// dropped that Redo). After Undo in the box, Redo from the menu puts the typing back there.
+#[test]
+fn redo_from_the_menu_with_retyping_in_the_box_keeps_the_documents_redo() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    let bold = pdfcraft_engine::AddedText { bold: true, ..text };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::UpdateContent { page: 0, index: 0, content: pdfcraft_engine::AddedContent::Text(bold) }));
+    assert!(h.state_mut().execute("edit.undo"));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "the typing stays in the box");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes it back in the box");
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo from the menu puts it back");
+    let s = h.state();
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit content"), "the document's Redo still waits");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index e87697403f..dd63003653 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6068,6 +6068,46 @@ fn redo_after_undoing_typing_puts_the_typing_back() {
     assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
 }
 
+/// Redo from the menu or toolbar with typing in the box the page doesn't have yet. Closing the
+/// box first applied the typing, a new edit that dropped the document's waiting Redo, and the
+/// Redo itself then failed: the step was gone. The typing now stays in the box and the Redo
+/// waits; once Undo in the box takes the typing back, Redo from the menu puts it back there.
+#[test]
+fn redo_from_the_menu_with_typing_in_the_box_keeps_the_documents_redo() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    // Undo the bold (closing the editor), so the document has it to redo.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    {
+        let s = h.state();
+        let ed = s.views[0].line_editor.as_ref().expect("the box stays open");
+        assert_eq!(ed.text, typed, "the typing stays in the box, unapplied");
+        let doc = s.session.get(s.views[0].id).unwrap();
+        assert_eq!((doc.can_redo(), doc.text_blocks(0)[0].base_font.as_str()), (Some("Edit text"), "Helvetica"), "the document's Redo still waits");
+    }
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "Undo takes the typing back in the box");
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(3);
+    let s = h.state();
+    assert_eq!(s.views[0].line_editor.as_ref().expect("still open").text, typed, "Redo from the menu puts the typing back");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
+}
+
 /// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
 /// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
 /// Typing in one tab, taken back with Undo, then came back with Redo in the other tab.

From 4f9b17165d2827d6638e6d2ebe583a18a5c59b58 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 01:23:16 +1100
Subject: [PATCH 024/132] fix(ui): menu Redo is enabled for the open text box's
 own Redo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Edit ▸ Redo and the toolbar button followed only the document's Redo.
After Undo in a paragraph or added text box took the typing back, with
no document step to redo, they stayed disabled and only the key could
put the typing back. Redo is now also enabled when the box open on the
page has a Redo of its own: the step redo_in_page_box takes. It doesn't
ask for the box's focus, which the menu has taken by then.
---
 crates/ui-egui/src/commands.rs     |  4 +++-
 crates/ui-egui/src/editing.rs      | 22 ++++++++++++++++++++--
 crates/ui-egui/tests/it/content.rs | 25 +++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 23 +++++++++++++++++++++++
 4 files changed, 71 insertions(+), 3 deletions(-)

diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 2ac0f82022..25cb73beba 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -84,7 +84,9 @@ impl PdfCraftApp {
         if self.combine_showing() && matches!(spec.needs, commands::Needs::Undo | commands::Needs::Redo) {
             return self.combine_can_undo(spec.needs == commands::Needs::Undo);
         }
-        commands::is_enabled(spec, &self.session, self.active_ids().map(|(_, id)| id))
+        // Redo also takes back what Undo took in a box open on the page, with no document step.
+        (commands::is_enabled(spec, &self.session, self.active_ids().map(|(_, id)| id))
+            || spec.needs == commands::Needs::Redo && self.open_box_can_redo())
             && (spec.id != "edit.copy"
                 || self
                     .active
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 455f8db4cc..207a3f4830 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -331,8 +331,19 @@ impl PdfCraftApp {
         } else {
             return false;
         };
-        egui::TextEdit::load_state(ctx, id)
-            .is_some_and(|state| state.cursor.char_range().is_some_and(|range| state.undoer().has_redo(&(range, text.clone()))))
+        has_typing_to_redo(ctx, id, text)
+    }
+
+    /// Whether the box open on the page has a Redo of its own, the step
+    /// [`Self::redo_in_page_box`] takes for Redo from the menu or toolbar: focus has moved to the
+    /// menu by then, so unlike [`Self::page_box_can_redo`] this doesn't ask for it.
+    pub(crate) fn open_box_can_redo(&self) -> bool {
+        let Some(ctx) = &self.ctx else { return false };
+        let Some(view) = self.active.and_then(|i| self.views.get(i)) else { return false };
+        if let Some(ed) = &view.line_editor {
+            return has_typing_to_redo(ctx, crate::edit_text_ui::input_id(), &ed.text);
+        }
+        view.content.draft.as_ref().is_some_and(|d| has_typing_to_redo(ctx, crate::content_ui::input_id(), &d.text))
     }
 
     /// Typing in a box on the page (a paragraph being edited, added text) that the page doesn't
@@ -1329,6 +1340,13 @@ fn bookmark_at<'a>(items: &'a [pdfcraft_render::OutlineItem], path: &[usize]) ->
     if rest.is_empty() { Some(item) } else { bookmark_at(&item.children, rest) }
 }
 
+/// Whether the page text box `id`, showing `text`, has typing its own Redo would put back: the
+/// test egui makes when it handles the key.
+fn has_typing_to_redo(ctx: &egui::Context, id: egui::Id, text: &str) -> bool {
+    egui::TextEdit::load_state(ctx, id)
+        .is_some_and(|state| state.cursor.char_range().is_some_and(|range| state.undoer().has_redo(&(range, text.to_owned()))))
+}
+
 /// The box's own Redo, as the key does it: the typing Undo took back, put back in the box's text,
 /// with the box's history and cursor moved along. None when the box has nothing to redo.
 fn redo_typing(ctx: &egui::Context, id: egui::Id, text: &str) -> Option<String> {
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 8abf757570..c2edfb8336 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -971,6 +971,31 @@ fn redo_from_the_menu_with_retyping_in_the_box_keeps_the_documents_redo() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit content"), "the document's Redo still waits");
 }
 
+/// Redo from the menu after Undo in an added text box, with nothing for the document to redo: the
+/// menu item follows the box's own Redo too, and puts the typing back.
+#[test]
+fn redo_from_the_menu_is_enabled_for_the_added_text_boxs_own_typing() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes it back in the box");
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), None, "the document has nothing to redo");
+    assert!(h.state_mut().execute("edit.redo"), "Redo is enabled for the box's own step");
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo puts it back");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 4b26d26d21..8ce8073285 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6383,6 +6383,29 @@ fn redo_from_the_menu_with_typing_in_the_box_keeps_the_documents_redo() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
 }
 
+/// Redo from the menu after Undo in the box took the typing back, with nothing for the document
+/// to redo: the menu item follows the box's own Redo too, and puts the typing back. It was
+/// disabled, as it followed only the document's Redo, and only the key could do it.
+#[test]
+fn redo_from_the_menu_is_enabled_for_the_boxs_own_typing() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    let typed = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the typing is taken back");
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_redo(), None, "the document has nothing to redo");
+    assert!(h.state_mut().execute("edit.redo"), "Redo is enabled for the box's own step");
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().expect("still open").text, typed, "Redo puts the typing back");
+}
+
 /// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
 /// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
 /// Typing in one tab, taken back with Undo, then came back with Redo in the other tab.

From 80f919977b1e31ef830dcbfb21be51a71426f944 Mon Sep 17 00:00:00 2001
From: Lcoding15 <125505497+Lcoding15@users.noreply.github.com>
Date: Sat, 24 Oct 2026 17:10:22 +0200
Subject: [PATCH 025/132] M2: page_render and render_preview report the render
 warnings next to the PNG (#4340)

The renderer reports when a page's picture is incomplete or approximate
(content cut at the page's safety budget, a colour painted in a fallback
colour), but only `pdfcraft-cli render` showed it. `page_render` and
`render_preview` returned the PNG alone, so a script or MCP client could
not tell that the image was not the whole page.

Both tools now return a JSON part after the PNG when the page has
warnings: `{ "page": 1, "warnings": [...] }`, with the sentences the CLI
prints. Warnings are strings, like every other tool's `warnings`, so
`command_run` can add its own to the same list. A page without warnings
still returns the PNG alone, so existing callers see no change.

The viewer notice the issue also asks for is left for a separate change.
---
 crates/automation/README.md                   |   6 +
 crates/automation/src/conventions.rs          |   8 +-
 crates/automation/src/lib.rs                  |  34 ++++-
 crates/automation/src/tools.rs                |   4 +-
 crates/automation/tests/it/main.rs            |   1 +
 crates/automation/tests/it/render_warnings.rs | 119 ++++++++++++++++++
 6 files changed, 161 insertions(+), 11 deletions(-)
 create mode 100644 crates/automation/tests/it/render_warnings.rs

diff --git a/crates/automation/README.md b/crates/automation/README.md
index cdaaa13e64..2b36242e53 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -181,6 +181,12 @@ working document unchanged.
 `content_list` or `object_list`. It removes only that item in a read-only preview and is
 mutually exclusive with `hide_text_block`.
 
+When the renderer reports a warning for the page, `page_render` and `render_preview` return a
+JSON part after the PNG, `{ "page": 1, "warnings": [...] }`, with the sentences
+`pdfcraft-cli render` prints: "content past the page's safety budget was skipped" and "a colour
+that could not be computed was painted in a fallback colour". A page without warnings returns
+the PNG alone.
+
 
 ## Existing text and document fonts
 
diff --git a/crates/automation/src/conventions.rs b/crates/automation/src/conventions.rs
index ac670109fb..a84c6488a4 100644
--- a/crates/automation/src/conventions.rs
+++ b/crates/automation/src/conventions.rs
@@ -1,7 +1,7 @@
 //! Shared command/inspection/preview entry points, using the existing confined tool path.
 use serde_json::{Value, json};
 
-use crate::{Args, Automation, Content, Result, ToolError, encode_png, failed, info, tools};
+use crate::{Args, Automation, Content, Result, ToolError, failed, info, rendered_content, tools};
 use pdfcraft_engine::commands;
 use pdfcraft_render::{RenderRequest, RequestKind};
 
@@ -108,7 +108,8 @@ impl Automation {
         Ok(json!({"documents":self.session.docs().iter().map(info).collect::<Vec<_>>()}))
     }
 
-    pub(crate) fn render_preview(&mut self, args: &Args) -> Result<Content> {
+    /// A bounded PNG of the page, with its render warnings after it as `page_render` gives them.
+    pub(crate) fn render_preview(&mut self, args: &Args) -> Result<Vec<Content>> {
         let id = if args.opt_int("doc")?.is_some() {
             self.doc(args)?.id
         } else {
@@ -134,7 +135,6 @@ impl Automation {
         if let Some(error) = out.error {
             return Err(failed(error));
         }
-        let data = encode_png(out.width, out.height, &out.rgba)?;
-        Ok(Content::Png { data, width: out.width, height: out.height })
+        rendered_content(&out, page)
     }
 }
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index e94354021f..5b6a0219fb 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -225,7 +225,7 @@ impl Automation {
                 let edit = Edit::SetInfo { key: a.str("key")?.into(), value: a.str("value")?.into() };
                 self.apply(&a, edit)?
             }
-            "page_render" => return self.page_render(&a).map(|c| vec![c]),
+            "page_render" => return self.page_render(&a),
             "comment_image_preview" => return self.comment_image_preview(&a),
             "text_extract" => self.text_extract(&a)?,
             "text_word_count" => self.text_word_count(&a)?,
@@ -329,7 +329,7 @@ impl Automation {
             "command_run" => return self.command_run(&a),
             "command_batch" => self.command_batch(&a)?,
             "doc_inspect" => self.doc_inspect(&a)?,
-            "render_preview" => return self.render_preview(&a).map(|c| vec![c]),
+            "render_preview" => return self.render_preview(&a),
             "page_number" => {
                 use pdfcraft_organize::LabelStyle as L;
                 let n = self.doc(&a)?.info.pages.len();
@@ -2023,7 +2023,9 @@ impl Automation {
         Ok(&mut entry.1)
     }
 
-    fn page_render(&mut self, a: &Args) -> Result<Content> {
+    /// The page as a PNG, followed by a JSON part listing the render warnings when there are any,
+    /// so a caller can tell that the picture is incomplete, as `pdfcraft-cli render` does (#4340).
+    fn page_render(&mut self, a: &Args) -> Result<Vec<Content>> {
         let id = self.doc(a)?.id;
         let page = self.page(a)?;
         let dpi = a.opt_num("dpi")?.unwrap_or(DEFAULT_DPI);
@@ -2056,8 +2058,7 @@ impl Automation {
         if let Some(e) = out.error {
             return Err(failed(format!("page {} could not be rendered: {e}", page + 1)));
         }
-        let data = encode_png(out.width, out.height, &out.rgba)?;
-        Ok(Content::Png { data, width: out.width, height: out.height })
+        rendered_content(&out, page)
     }
 
     /// A page as RGBA pixels, without encoding a PNG. `page` is 1-based and `scale` is pixels
@@ -2733,6 +2734,29 @@ fn encode_png(width: u32, height: u32, premultiplied: &[u8]) -> Result<Vec<u8>>
     pdfcraft_engine::export::encode_png(width, height, premultiplied).map_err(failed)
 }
 
+/// The output of a page-rendering tool: the PNG of the 0-based `page`, followed by a JSON part
+/// listing its render warnings when there are any. Without warnings it is the PNG alone, as it
+/// always was.
+fn rendered_content(out: &pdfcraft_render::RenderedPage, page: usize) -> Result<Vec<Content>> {
+    let data = encode_png(out.width, out.height, &out.rgba)?;
+    let mut content = vec![Content::Png { data, width: out.width, height: out.height }];
+    if !out.warnings.is_empty() {
+        // Sentences, like the other tools' `warnings`, so command_run can add its own to the list.
+        let warnings: Vec<&str> = out.warnings.iter().map(|&w| render_warning_text(w)).collect();
+        content.push(Content::Json(json!({ "page": page.saturating_add(1), "warnings": warnings })));
+    }
+    Ok(content)
+}
+
+/// What a render warning means, in the words `pdfcraft-cli render` prints for it.
+fn render_warning_text(warning: pdfcraft_render::RenderWarning) -> &'static str {
+    use pdfcraft_render::RenderWarning;
+    match warning {
+        RenderWarning::ContentTruncated => "content past the page's safety budget was skipped",
+        RenderWarning::ColourFallback => "a colour that could not be computed was painted in a fallback colour",
+    }
+}
+
 /// Extract the text of `pages` (0-based) with one renderer per worker thread.
 fn extract_parallel(bytes: &Arc<Vec<u8>>, password: Option<Arc<str>>, pages: &[usize]) -> PageTexts {
     let extract = |r: &mut PageRenderer, p: usize| {
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 1bfcc77984..e78930e880 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -164,7 +164,7 @@ pub fn tools() -> Vec<ToolDef> {
         )),
         t("doc_set_info", "Set document metadata", "Set a document information entry such as Title, Author, Subject or Keywords, or a custom property under any other name (no spaces, delimiters, / or #; at most 127 bytes; doc_info lists them under custom); an empty value removes it. When the file has XMP metadata, the matching XMP property (dc:title, dc:creator, dc:description, pdf:Keywords, xmp:CreatorTool, pdf:Producer) is changed too, so viewers that read XMP first show the new value. Undoable.")
             .with(schema(json!({ "doc": doc(), "key": { "type": "string" }, "value": { "type": "string" } }), &["doc", "key", "value"])),
-        t("page_render", "Render a page", "Render one page to a PNG image (default 96 dpi, at most 600).")
+        t("page_render", "Render a page", "Render one page to a PNG image (default 96 dpi, at most 600). When the picture is incomplete or approximate (content cut at the page's safety budget, a colour painted in a fallback colour), a JSON part follows the image: { page, warnings: [sentence, ...] }.")
             .ro()
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 }, "dpi": { "type": "number", "minimum": 1, "maximum": 600 },
                 "hide_text_block": { "type": "integer", "minimum": 1, "description": "Render an inline editor background without this paragraph (number from text_paragraphs, resolved as text_edit does: refused once an edit merged that paragraph into a neighbour). Does not modify the document." },
@@ -1442,7 +1442,7 @@ pub fn tools() -> Vec<ToolDef> {
             .destructive().with(schema(json!({"steps":{"type":"array","items":schema(json!({"id":{"type":"string"},"params":{"type":"object"}}), &["id"])},"stop_on_error":{"type":"boolean"}}), &["steps"])),
         t("doc_inspect", "Inspect open documents", "With doc, return doc_info; otherwise return information for every open document (empty documents array when none are open).")
             .ro().with(schema(json!({"doc":doc()}), &[])),
-        t("render_preview", "Render a preview", "Render a PNG bounded by max_side (default 1024), without changing or saving the document. Page defaults to 1; doc may be omitted when exactly one document is open.")
+        t("render_preview", "Render a preview", "Render a PNG bounded by max_side (default 1024), without changing or saving the document. Page defaults to 1; doc may be omitted when exactly one document is open. Render warnings follow the image as page_render gives them.")
             .ro().with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1},"max_side":{"type":"integer","minimum":1,"maximum":4096}}), &[])),
     ]
 }
diff --git a/crates/automation/tests/it/main.rs b/crates/automation/tests/it/main.rs
index d94aa9f7c4..f38c8599a3 100644
--- a/crates/automation/tests/it/main.rs
+++ b/crates/automation/tests/it/main.rs
@@ -8,3 +8,4 @@ mod button_caption;
 mod form_bulk;
 mod hostile_args;
 mod optimize_content_boundaries;
+mod render_warnings;
diff --git a/crates/automation/tests/it/render_warnings.rs b/crates/automation/tests/it/render_warnings.rs
new file mode 100644
index 0000000000..ff50c11e16
--- /dev/null
+++ b/crates/automation/tests/it/render_warnings.rs
@@ -0,0 +1,119 @@
+//! `page_render` reports the renderer's warnings next to the PNG, so a headless caller can tell
+//! that a picture is incomplete or approximate, as `pdfcraft-cli render` can (#4340).
+
+use std::path::PathBuf;
+
+use pdfcraft_automation::{Automation, Content};
+use serde_json::{Value, json};
+
+/// The warning a colour that falls back gives, worded as `pdfcraft-cli render` prints it.
+const FALLBACK: &str = "a colour that could not be computed was painted in a fallback colour";
+
+/// A one-page 200 × 200 pt PDF that draws `content`, with the colour space `CS1` defined as
+/// `[/DeviceN [/Spot1 /Spot2] /DeviceRGB 5 0 R]` and object 5 a calculator function `program`.
+fn devicen_pdf(content: &str, program: &str) -> Vec<u8> {
+    format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+         2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+         3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /CS1 [/DeviceN [/Spot1 /Spot2] /DeviceRGB 5 0 R] >> >> /Contents 4 0 R >> endobj\n\
+         4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+         5 0 obj << /FunctionType 4 /Domain [0 1 0 1] /Range [0 1 0 1 0 1] /Length {} >> stream\n{program}\nendstream endobj\n\
+         trailer << /Root 1 0 R >>\n%%EOF",
+        content.len(),
+        program.len()
+    )
+    .into_bytes()
+}
+
+/// A page whose colour falls back: the tint transform pops more than it is given, so it can't be
+/// evaluated (the renderer's own test of the warning uses the same function).
+fn fallback_pdf() -> Vec<u8> {
+    devicen_pdf("/CS1 cs 0.5 0.5 scn 0 0 100 100 re f", "{ pop pop pop }")
+}
+
+/// The same page with a tint transform that works: nothing to warn about.
+fn clean_pdf() -> Vec<u8> {
+    devicen_pdf("/CS1 cs 0.5 0.5 scn 0 0 100 100 re f", "{ pop pop 0 0 0 }")
+}
+
+/// A fresh folder holding `fallback.pdf` and `clean.pdf`, and an automation rooted there.
+fn setup(test: &str) -> (PathBuf, Automation) {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-render-warnings-{test}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("fallback.pdf"), fallback_pdf()).unwrap();
+    std::fs::write(dir.join("clean.pdf"), clean_pdf()).unwrap();
+    let a = Automation::new().with_root(&dir).unwrap();
+    (dir, a)
+}
+
+fn open(a: &mut Automation, path: &str) -> u64 {
+    match a.call("doc_open", &json!({ "path": path })).unwrap().remove(0) {
+        Content::Json(v) => v["doc"].as_u64().unwrap(),
+        other => panic!("expected JSON: {other:?}"),
+    }
+}
+
+#[test]
+fn page_render_lists_the_warnings_after_the_png() {
+    let (dir, mut a) = setup("fallback");
+    let doc = open(&mut a, "fallback.pdf");
+    let out = a.call("page_render", &json!({ "doc": doc, "page": 1, "dpi": 72 })).unwrap();
+    assert_eq!(out.len(), 2, "the PNG and the warnings: {out:?}");
+    assert!(matches!(out[0], Content::Png { width: 200, height: 200, .. }), "the image comes first, as before");
+    let Content::Json(report) = &out[1] else { panic!("expected the warnings as JSON: {:?}", out[1]) };
+    assert_eq!(report["page"], 1, "the page is 1-based, like the argument");
+    assert_eq!(report["warnings"], json!([FALLBACK]));
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+#[test]
+fn render_preview_lists_the_warnings_after_the_png_too() {
+    let (dir, mut a) = setup("preview");
+    let doc = open(&mut a, "fallback.pdf");
+    let out = a.call("render_preview", &json!({ "doc": doc, "max_side": 64 })).unwrap();
+    assert!(matches!(out.first(), Some(Content::Png { width: 64, height: 64, .. })), "{out:?}");
+    let Some(Content::Json(report)) = out.get(1) else { panic!("expected the warnings as JSON: {out:?}") };
+    assert_eq!(report["page"], 1, "the page defaults to the first");
+    assert_eq!(report["warnings"], json!([FALLBACK]));
+    let clean = open(&mut a, "clean.pdf");
+    assert_eq!(a.call("render_preview", &json!({ "doc": clean })).unwrap().len(), 1, "a clean page gives the PNG alone");
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+#[test]
+fn a_clean_page_renders_to_the_png_alone() {
+    let (dir, mut a) = setup("clean");
+    let fallback = open(&mut a, "fallback.pdf");
+    let clean = open(&mut a, "clean.pdf");
+    // The warning of one render doesn't carry over to the next, nor to another document.
+    a.call("page_render", &json!({ "doc": fallback, "page": 1, "dpi": 72 })).unwrap();
+    let out = a.call("page_render", &json!({ "doc": clean, "page": 1, "dpi": 72 })).unwrap();
+    assert_eq!(out.len(), 1, "no warnings, no extra part: {out:?}");
+    assert!(matches!(out[0], Content::Png { .. }));
+    let again = a.call("page_render", &json!({ "doc": fallback, "page": 1, "dpi": 72 })).unwrap();
+    assert_eq!(again.len(), 2, "a cached renderer still reports the page's warning: {again:?}");
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+/// Over MCP the warnings are a text block after the image and the call's `structuredContent`.
+#[cfg(feature = "mcp")]
+#[test]
+fn mcp_page_render_carries_the_warnings_as_structured_content() {
+    use pdfcraft_automation::mcp::McpServer;
+    let (dir, a) = setup("mcp");
+    let mut s = McpServer::new(a);
+    let mut rpc = |id: u64, method: &str, params: Value| -> Value {
+        let line = json!({ "jsonrpc": "2.0", "id": id, "method": method, "params": params }).to_string();
+        serde_json::from_str(&s.handle_line(&line).expect("a reply")).unwrap()
+    };
+    rpc(1, "initialize", json!({}));
+    rpc(2, "tools/call", json!({ "name": "doc_open", "arguments": { "path": "fallback.pdf" } }));
+    let reply = rpc(3, "tools/call", json!({ "name": "page_render", "arguments": { "doc": 1, "page": 1 } }));
+    let result = &reply["result"];
+    assert_eq!(result["isError"], false, "{reply}");
+    assert_eq!(result["content"][0]["type"], "image");
+    assert_eq!(result["content"][1]["type"], "text");
+    assert_eq!(result["structuredContent"]["warnings"], json!([FALLBACK]));
+    let _ = std::fs::remove_dir_all(dir);
+}

From ac868f6e2989a91c2888c82136619fda1c4d9ee3 Mon Sep 17 00:00:00 2001
From: aiongg <aiongtaigi@gmail.com>
Date: Sat, 24 Oct 2026 18:58:44 +0000
Subject: [PATCH 026/132] Tests: new text box drafts set typing_from (main's
 #4441 tests)

---
 crates/ui-egui/src/editing.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 83c6d2d229..759065e9f2 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -1872,7 +1872,7 @@ mod revert_draft_tests {
     fn text_typed_into_a_new_text_box_counts_as_unsaved_work() {
         use crate::content_ui::{TextDraft, default_style};
         let mut app = app();
-        let draft = |text: &str| TextDraft { page: 0, index: None, rect: [0.0; 4], text: text.into(), style: default_style(), focus: true };
+        let draft = |text: &str| TextDraft { page: 0, index: None, rect: [0.0; 4], text: text.into(), style: default_style(), focus: true, typing_from: None };
         assert!(!app.has_unsaved_work(0));
         app.views[0].content.draft = Some(draft("  \n"));
         assert!(!app.has_unsaved_work(0));
@@ -1897,7 +1897,7 @@ mod revert_draft_tests {
             let mut app = PdfCraftApp::new();
             app.open_bytes("source.pdf", Some(path.clone()), bytes).unwrap();
             let rect = [72.0, 72.0, 272.0, 92.0];
-            app.views[0].content.draft = Some(TextDraft { page: 0, index: None, rect, text: "Typed".into(), style: default_style(), focus: true });
+            app.views[0].content.draft = Some(TextDraft { page: 0, index: None, rect, text: "Typed".into(), style: default_style(), focus: true, typing_from: None });
             let ctx = egui::Context::default();
             if quit {
                 assert!(!app.request_quit(&ctx));

From 120de553ab7d834de12e957627e68b0c1f183393 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Sat, 24 Oct 2026 23:06:34 +0200
Subject: [PATCH 027/132] fix(ui): the Background preview follows the Replace
 checkbox

The dialog previews a colour as a tint of the page's thumbnail (main's #3009). It tinted every
page, so with Replace unticked a page that keeps its own white backdrop previewed coloured,
though OK leaves it white. A page a picture covers (a scan) previewed coloured too.

background_tint() now shows no colour where the page will still hide the background after OK:
a scan, or a white backdrop with Replace unticked. It reads the page from the dialog's backdrop
check (BackdropCheck::found, for the current version of the document only); a page the check
hasn't reached yet previews coloured, as before.

Tests, both seen failing with the fix reverted:
- marks_ui::tests::the_preview_shows_a_background_only_where_ok_lets_it_show (the rule);
- it::marks::the_background_preview_follows_the_replace_checkbox (what the dialog paints, per
  page, ticked and unticked).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/marks_ui.rs   | 38 +++++++++++++++++++++++++++++++-
 crates/ui-egui/tests/it/marks.rs | 32 +++++++++++++++++++++++++++
 parity/acrobat-features.toml     |  4 ++--
 3 files changed, 71 insertions(+), 3 deletions(-)

diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index b4c930e624..a075814aa2 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -138,6 +138,15 @@ impl BackdropCheck {
         }
         n
     }
+
+    /// What the check found on `page` (0-based) of this version of `doc`: `None` until it has
+    /// looked, `Some(None)` for a page with no backdrop of its own.
+    pub fn found(&self, doc: &pdfcraft_engine::Document, page: usize) -> Option<Option<Backdrop>> {
+        if self.key != Some((doc.id, doc.edit_generation())) {
+            return None;
+        }
+        self.pages.get(page).copied().flatten()
+    }
 }
 
 impl MarksDraft {
@@ -279,6 +288,19 @@ fn behind(color: [f64; 3], opacity: f64) -> Color32 {
     rgb32(color.map(|c| 1.0 - a * (1.0 - c)))
 }
 
+/// The preview's tint for a background colour on a page whose own backdrop is `found` (`None`
+/// when it has none, or the check hasn't reached it): no colour where the page will still hide
+/// the background after OK, because a picture covers it (a scan) or it keeps its white backdrop
+/// with Replace unticked.
+fn background_tint(d: &MarksDraft, found: Option<Backdrop>) -> Color32 {
+    let hidden = match found {
+        Some(Backdrop::Image) => true,
+        Some(Backdrop::Fill) => !d.bg.replace_backdrop,
+        None => false,
+    };
+    if hidden { Color32::WHITE } else { behind(d.bg.color, d.bg.opacity) }
+}
+
 /// The page (0-based) the preview shows: the current one when the range selects it, otherwise the
 /// first page the range selects (the current one again when it selects none).
 fn preview_page(range: &PageRange, current: usize, count: usize) -> usize {
@@ -487,7 +509,8 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
         view.need_thumbnail(target, true);
         view.thumb_id(target)
     });
-    let tint = if kind == MarkKind::Background && !d.use_file { behind(d.bg.color, d.bg.opacity) } else { Color32::WHITE };
+    let tint =
+        if kind == MarkKind::Background && !d.use_file { background_tint(d, d.backdrops.found(doc, target).flatten()) } else { Color32::WHITE };
     let hf = d.hf.clone();
     let size_h = page.1.max(1.0);
     let (wm, fit) = (d.wm.clone(), d.fit);
@@ -825,6 +848,19 @@ mod tests {
         assert_eq!(behind([0.2, 0.4, 0.6], f64::NAN), behind([0.2, 0.4, 0.6], 1.0), "opaque, as the engine has it");
     }
 
+    #[test]
+    fn the_preview_shows_a_background_only_where_ok_lets_it_show() {
+        let mut d = MarksDraft::default();
+        let colour = behind(d.bg.color, d.bg.opacity);
+        assert_ne!(colour, Color32::WHITE);
+        assert_eq!(background_tint(&d, None), colour, "no backdrop of its own");
+        assert_eq!(background_tint(&d, Some(Backdrop::Fill)), colour, "its white backdrop is replaced");
+        assert_eq!(background_tint(&d, Some(Backdrop::Image)), Color32::WHITE, "a picture covers it");
+        d.bg.replace_backdrop = false;
+        assert_eq!(background_tint(&d, Some(Backdrop::Fill)), Color32::WHITE, "its white backdrop stays and hides it");
+        assert_eq!(background_tint(&d, None), colour, "unticked changes nothing without a backdrop");
+    }
+
     #[test]
     fn the_watermark_edit_carries_the_offset() {
         let mut d = MarksDraft::default();
diff --git a/crates/ui-egui/tests/it/marks.rs b/crates/ui-egui/tests/it/marks.rs
index 2c8b39d558..f518dcd1c7 100644
--- a/crates/ui-egui/tests/it/marks.rs
+++ b/crates/ui-egui/tests/it/marks.rs
@@ -216,6 +216,38 @@ fn the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scan
     assert_eq!(backdrop(&h, 0), None, "Update keeps the backdrop replaced");
 }
 
+/// The preview shows what OK will do to each page: the colour on bare paper and on a page whose
+/// white backdrop is replaced, none on a scan, and none on that page with Replace unticked.
+#[test]
+fn the_background_preview_follows_the_replace_checkbox() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, backdrop_fixture()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.background"));
+    h.run_steps(3);
+    let replace = "Page 1 paints its own white backdrop, which would hide the background. Replace it";
+    h.get_by_label(replace);
+    let [red, green, blue] = pdfcraft_engine::Background::default().color.map(|c| (c * 255.0).round() as u8);
+    let colour = egui::Color32::from_rgb(red, green, blue);
+    let tint = |h: &mut Harness<'static, PdfCraftApp>, page: usize| {
+        h.state_mut().marks_draft.preview = Some(page);
+        h.run_steps(2);
+        wait_for_picture(h, page).2
+    };
+    assert_eq!(tint(&mut h, 0), colour, "page 1's backdrop is replaced, so the colour shows");
+    assert_eq!(tint(&mut h, 1), egui::Color32::WHITE, "a picture covers page 2");
+    assert_eq!(tint(&mut h, 2), colour, "page 3 is bare paper");
+    h.get_by_label(replace).click();
+    h.run_steps(2);
+    assert!(!h.state().marks_draft.bg.replace_backdrop);
+    assert_eq!(tint(&mut h, 0), egui::Color32::WHITE, "unticked, page 1 keeps its backdrop, which hides the colour");
+    assert_eq!(tint(&mut h, 2), colour, "page 3 has no backdrop to keep");
+}
+
 /// Remove background says which pages keep their own white backdrop off: here one whose
 /// backdrop copy changed before the fill since the background replaced it.
 #[test]
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index ae5e6a510f..46e10e8b81 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2531,8 +2531,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.background"]
 tools = ["doc_background", "doc_backdrops"]
-evidence = ["crates/ui-egui/tests/it/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/it/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright", "crates/automation/tests/it/backdrop.rs::a_background_shows_on_a_page_that_paints_its_own_white_backdrop", "crates/ui-egui/tests/it/marks.rs::the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scans", "crates/edit/src/backdrop_tests.rs::content_that_is_not_a_page_backdrop_is_left_alone", "crates/ui-egui/tests/it/marks.rs::the_preview_shows_the_page_the_range_selects_under_the_marks"]
-notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove turns it back on, after edits and redactions too, unless the operators before it changed or it would no longer be painted first, and then says which pages keep it off). The replaced copy's tag holds no page content or reference, so text a redaction or Remove Hidden Information takes off such a page leaves the file. Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space. The dialog previews a colour as a tint of the page's own thumbnail (opaque pictures on the page are tinted there too, not in the result), a file as its frame and name"
+evidence = ["crates/ui-egui/tests/it/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/it/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright", "crates/automation/tests/it/backdrop.rs::a_background_shows_on_a_page_that_paints_its_own_white_backdrop", "crates/ui-egui/tests/it/marks.rs::the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scans", "crates/ui-egui/tests/it/marks.rs::the_background_preview_follows_the_replace_checkbox", "crates/edit/src/backdrop_tests.rs::content_that_is_not_a_page_backdrop_is_left_alone", "crates/ui-egui/tests/it/marks.rs::the_preview_shows_the_page_the_range_selects_under_the_marks"]
+notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove turns it back on, after edits and redactions too, unless the operators before it changed or it would no longer be painted first, and then says which pages keep it off). The replaced copy's tag holds no page content or reference, so text a redaction or Remove Hidden Information takes off such a page leaves the file. Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space. The dialog previews a colour as a tint of the page's own thumbnail (opaque pictures on the page are tinted there too, not in the result), a file as its frame and name; a page that will still hide the background (a scan, or a white backdrop with Replace unticked) previews without the colour"
 
 [[feature]]
 id = "edit.background-update-remove"

From b9035271b0a8c773b8caede56ee435a574ff0997 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 08:36:17 +1100
Subject: [PATCH 028/132] fix(ui): menu Undo takes back typing in the open text
 box first
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Edit ▸ Undo with typing in a paragraph or added text box that the page
doesn't have yet applied the typing (a new edit, which dropped the
document's waiting Redo), closed the box and undid the typing all at
once; the key takes it back a step at a time in the box. Menu Undo now
goes to the box first, as Redo does, and is enabled while the box holds
such typing. Undo and Redo share typing_step for the box's own history.
---
 crates/ui-egui/src/commands.rs     |  4 +++-
 crates/ui-egui/src/editing.rs      | 37 +++++++++++++++++++++++-------
 crates/ui-egui/tests/it/content.rs | 26 +++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 29 +++++++++++++++++++++++
 4 files changed, 87 insertions(+), 9 deletions(-)

diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 25cb73beba..d1ef7a4505 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -84,8 +84,10 @@ impl PdfCraftApp {
         if self.combine_showing() && matches!(spec.needs, commands::Needs::Undo | commands::Needs::Redo) {
             return self.combine_can_undo(spec.needs == commands::Needs::Undo);
         }
-        // Redo also takes back what Undo took in a box open on the page, with no document step.
+        // Undo also takes back typing in a box open on the page, and Redo what Undo took there,
+        // with no document step.
         (commands::is_enabled(spec, &self.session, self.active_ids().map(|(_, id)| id))
+            || spec.needs == commands::Needs::Undo && self.page_typing_unapplied()
             || spec.needs == commands::Needs::Redo && self.open_box_can_redo())
             && (spec.id != "edit.copy"
                 || self
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 207a3f4830..d495a52a46 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -214,11 +214,31 @@ impl PdfCraftApp {
         }
         if self.combine_showing() {
             self.combine_history_step(true);
-        } else {
+        } else if !self.undo_in_page_box() {
             self.history_step(true);
         }
     }
 
+    /// Undo from the menu or toolbar while a box on the page holds typing the page doesn't have
+    /// yet: the box takes the step, as it does for the key, one step of its typing at a time.
+    /// Applying the typing first was a new edit, which dropped the document's Redo, and then the
+    /// typing was taken back all at once. True when the box took the step.
+    fn undo_in_page_box(&mut self) -> bool {
+        let Some(ctx) = self.ctx.clone() else { return false };
+        let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
+        if let Some(ed) = view.line_editor.as_mut().filter(|ed| ed.has_unsaved_text()) {
+            let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, true) else { return false };
+            ed.text = text;
+            return true;
+        }
+        if let Some(d) = view.content.draft.as_mut().filter(|d| d.has_unapplied_typing()) {
+            let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, true) else { return false };
+            d.text = text;
+            return true;
+        }
+        false
+    }
+
     pub fn redo(&mut self) {
         if self.combine_showing() {
             self.combine_history_step(false);
@@ -235,12 +255,12 @@ impl PdfCraftApp {
         let Some(ctx) = self.ctx.clone() else { return false };
         let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
         if let Some(ed) = view.line_editor.as_mut() {
-            let Some(text) = redo_typing(&ctx, crate::edit_text_ui::input_id(), &ed.text) else { return ed.has_unsaved_text() };
+            let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, false) else { return ed.has_unsaved_text() };
             ed.text = text;
             return true;
         }
         if let Some(d) = view.content.draft.as_mut() {
-            let Some(text) = redo_typing(&ctx, crate::content_ui::input_id(), &d.text) else { return d.has_unapplied_typing() };
+            let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, false) else { return d.has_unapplied_typing() };
             d.text = text;
             return true;
         }
@@ -1347,16 +1367,17 @@ fn has_typing_to_redo(ctx: &egui::Context, id: egui::Id, text: &str) -> bool {
         .is_some_and(|state| state.cursor.char_range().is_some_and(|range| state.undoer().has_redo(&(range, text.to_owned()))))
 }
 
-/// The box's own Redo, as the key does it: the typing Undo took back, put back in the box's text,
-/// with the box's history and cursor moved along. None when the box has nothing to redo.
-fn redo_typing(ctx: &egui::Context, id: egui::Id, text: &str) -> Option<String> {
+/// The box's own Undo (or Redo), as the key does it: the box's text one step back (or forward) in
+/// its typing, with the box's history and cursor moved along. None when there is no such step.
+fn typing_step(ctx: &egui::Context, id: egui::Id, text: &str, undo: bool) -> Option<String> {
     let mut state = egui::TextEdit::load_state(ctx, id)?;
     let mut undoer = state.undoer();
-    let (range, redone) = undoer.redo(&(state.cursor.char_range()?, text.to_owned()))?.clone();
+    let current = (state.cursor.char_range()?, text.to_owned());
+    let (range, stepped) = if undo { undoer.undo(&current) } else { undoer.redo(&current) }?.clone();
     state.set_undoer(undoer);
     state.cursor.set_char_range(Some(range));
     egui::TextEdit::store_state(ctx, id, state);
-    Some(redone)
+    Some(stepped)
 }
 
 #[cfg(test)]
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index c2edfb8336..a17d0793ea 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -971,6 +971,32 @@ fn redo_from_the_menu_with_retyping_in_the_box_keeps_the_documents_redo() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit content"), "the document's Redo still waits");
 }
 
+/// Undo from the menu with retyping the page doesn't have yet in an added text box: the box takes
+/// it back and stays open, and the document's waiting Redo stays.
+#[test]
+fn undo_from_the_menu_takes_back_retyping_in_the_added_text_box() {
+    let mut h = harness();
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    let text = pdfcraft_engine::AddedText { rect, text: "Reviewed".into(), ..Default::default() };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    let bold = pdfcraft_engine::AddedText { bold: true, ..text };
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::UpdateContent { page: 0, index: 0, content: pdfcraft_engine::AddedContent::Text(bold) }));
+    assert!(h.state_mut().execute("edit.undo"));
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(3);
+    let point = at(&h, 45.0, 195.0);
+    click(&mut h, point);
+    assert_eq!(h.state().views[0].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes it back in the box");
+    let s = h.state();
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit content"), "the document's Redo still waits");
+}
+
 /// Redo from the menu after Undo in an added text box, with nothing for the document to redo: the
 /// menu item follows the box's own Redo too, and puts the typing back.
 #[test]
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 8ce8073285..841633005e 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6383,6 +6383,35 @@ fn redo_from_the_menu_with_typing_in_the_box_keeps_the_documents_redo() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
 }
 
+/// Undo from the menu or toolbar with typing in the box the page doesn't have yet: the box takes
+/// the typing back, as the key does, and stays open, and the document's waiting Redo stays. The
+/// menu applied the typing first (a new edit, which dropped that Redo), closed the box and undid
+/// the typing all at once.
+#[test]
+fn undo_from_the_menu_takes_back_typing_in_the_box() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    // Undo the bold (closing the editor), so the document has it to redo and nothing to undo.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.undo"), "Undo is enabled for the box's typing");
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("the box stays open");
+    assert_eq!(ed.text, original, "the typing is taken back in the box");
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!((doc.can_redo(), doc.can_undo()), (Some("Edit text"), None), "the document is untouched");
+}
+
 /// Redo from the menu after Undo in the box took the typing back, with nothing for the document
 /// to redo: the menu item follows the box's own Redo too, and puts the typing back. It was
 /// disabled, as it followed only the document's Redo, and only the key could do it.

From f3b61b73b0284ee02c6276b7452e7daa4f25a4e2 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 08:41:17 +1100
Subject: [PATCH 029/132] style: rustfmt the two TextDraft test literals that
 took typing_from

---
 crates/ui-egui/src/editing.rs | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index c5964a98c8..5793d13194 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -1893,7 +1893,15 @@ mod revert_draft_tests {
     fn text_typed_into_a_new_text_box_counts_as_unsaved_work() {
         use crate::content_ui::{TextDraft, default_style};
         let mut app = app();
-        let draft = |text: &str| TextDraft { page: 0, index: None, rect: [0.0; 4], text: text.into(), style: default_style(), focus: true, typing_from: None };
+        let draft = |text: &str| TextDraft {
+            page: 0,
+            index: None,
+            rect: [0.0; 4],
+            text: text.into(),
+            style: default_style(),
+            focus: true,
+            typing_from: None,
+        };
         assert!(!app.has_unsaved_work(0));
         app.views[0].content.draft = Some(draft("  \n"));
         assert!(!app.has_unsaved_work(0));
@@ -1918,7 +1926,8 @@ mod revert_draft_tests {
             let mut app = PdfCraftApp::new();
             app.open_bytes("source.pdf", Some(path.clone()), bytes).unwrap();
             let rect = [72.0, 72.0, 272.0, 92.0];
-            app.views[0].content.draft = Some(TextDraft { page: 0, index: None, rect, text: "Typed".into(), style: default_style(), focus: true, typing_from: None });
+            app.views[0].content.draft =
+                Some(TextDraft { page: 0, index: None, rect, text: "Typed".into(), style: default_style(), focus: true, typing_from: None });
             let ctx = egui::Context::default();
             if quit {
                 assert!(!app.request_quit(&ctx));

From dd47c4f9e1a2e69657ced00785b934419bdd90d6 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 08:56:55 +1100
Subject: [PATCH 030/132] test(ui): the two-tab Redo test checks the copy's
 paragraph stays open

If the copy's editor had closed before or during Redo, the check for the
other tab's typing passed on an empty text. It now requires the editor
to be open before Redo and after it.
---
 crates/ui-egui/tests/it/editing.rs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index b941857f07..c22ce087f2 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6675,11 +6675,12 @@ fn typing_in_one_tab_never_reaches_another_tabs_paragraph() {
     // The copy, its paragraph still open: Redo there has nothing of its own to put back.
     h.state_mut().active = Some(1);
     h.run_steps(3);
+    assert!(h.state().views[1].line_editor.is_some(), "the copy's paragraph is still open");
     h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
     h.run_steps(3);
     let s = h.state();
-    let text = s.views[1].line_editor.as_ref().map(|ed| ed.text.clone());
-    assert!(!text.as_deref().unwrap_or_default().contains("secret"), "the other tab's typing came in: {text:?}");
+    let text = &s.views[1].line_editor.as_ref().expect("the copy's paragraph stays open through Redo").text;
+    assert!(!text.contains("secret"), "the other tab's typing came in: {text:?}");
     assert_eq!(s.session.get(s.views[1].id).unwrap().text_blocks(0)[0].text, s.session.get(s.views[0].id).unwrap().text_blocks(0)[0].text);
 }
 

From 522653d6b1c8fc1e9973308889296a016de75ea3 Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <jonathanwxh@gmail.com>
Date: Sun, 25 Oct 2026 12:03:40 +0800
Subject: [PATCH 031/132] fix(organize,print): join /Contents array pieces with
 a space (#3502)

---
 crates/organize/src/prune.rs |  9 ++--
 crates/organize/src/tests.rs | 46 ++++++++++++++++++++
 crates/print/src/lib.rs      |  7 +--
 crates/print/src/tests.rs    | 82 ++++++++++++++++++++++++++++++++++++
 4 files changed, 137 insertions(+), 7 deletions(-)

diff --git a/crates/organize/src/prune.rs b/crates/organize/src/prune.rs
index d8db2f7ac4..5a2a319fb4 100644
--- a/crates/organize/src/prune.rs
+++ b/crates/organize/src/prune.rs
@@ -231,14 +231,15 @@ impl Pruner<'_> {
     }
 }
 
-/// The page's content, concatenated (`/Contents` may be one stream or an array), decoded
-/// against one page's [`DecodeBudget`]. An error when a stream can't be decoded or the budget
-/// runs out: the page may draw names that can't be seen.
+/// The page's content, concatenated (`/Contents` may be one stream or an array) with a space
+/// between pieces as the renderer joins them, decoded against one page's [`DecodeBudget`]. An
+/// error when a stream can't be decoded or the budget runs out: the page may draw names that
+/// can't be seen.
 pub(crate) fn content_bytes(doc: &Document, contents: &Object) -> Result<Vec<u8>, CosError> {
     let mut out = Vec::new();
     for data in DecodeBudget::page().decode_contents(doc, contents) {
         out.extend(data?);
-        out.push(b'\n');
+        out.push(b' ');
     }
     Ok(out)
 }
diff --git a/crates/organize/src/tests.rs b/crates/organize/src/tests.rs
index 1ba8861cbe..0d5417f9de 100644
--- a/crates/organize/src/tests.rs
+++ b/crates/organize/src/tests.rs
@@ -3688,3 +3688,49 @@ fn bookmark_style_and_colour_are_set_as_the_table_says() {
     let got: Vec<_> = bookmarks(&saved).into_iter().map(|b| (b.color, b.bold, b.italic)).collect();
     assert_eq!(got, [(Some([0.0, 0.0, 1.0]), true, true), (None, false, false)]);
 }
+
+/// #3502: a `/Contents` array's pieces are joined with a space, as the renderer joins them, so a
+/// `%` comment at the end of a piece without a line break continues through the first line of the
+/// next piece in both resource pruning (`extract_pages`) and `page_as_form`.
+#[test]
+fn contents_pieces_join_with_a_space_across_a_trailing_comment() {
+    let build_doc = |first_piece: &str| {
+        let b: Vec<String> = vec![
+            "<< /Type /Catalog /Pages 2 0 R >>".into(),                                        // 1
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 200] >>".into(),        // 2
+            "<< /Type /Page /Parent 2 0 R /Contents [4 0 R 5 0 R] /Resources 6 0 R >>".into(), // 3
+            raw(first_piece),                                                                  // 4
+            raw("/ImHidden Do\n/ImShown Do"),                                                  // 5
+            "<< /XObject << /ImHidden 7 0 R /ImShown 8 0 R >> >>".into(),                      // 6
+            image(1, 1, 1),                                                                    // 7
+            image(1, 1, 1),                                                                    // 8
+        ];
+        open(build(&b, "/Root 1 0 R"))
+    };
+
+    // Without a trailing newline in piece 1, `% comment` swallows `/ImHidden Do` on the first
+    // line of piece 2; only `/ImShown` is drawn.
+    let commented = build_doc("q Q % comment without newline");
+    let extracted = full_roundtrip(&extract_pages(&commented, &[0]).unwrap());
+    assert_eq!(xobject_names(&extracted, 0), [b"ImShown".to_vec()], "commented-out Do across piece boundary is pruned");
+
+    let mut form_dst = Document::new_empty();
+    let (form_ref, _) = crate::page_as_form(&mut form_dst, &commented, 0).unwrap();
+    let Object::Stream(form_stream) = &*form_dst.get(form_ref) else { panic!("form stream") };
+    let form_bytes = form_stream.decoded().unwrap();
+    let drawn: Vec<Vec<u8>> = pdfcraft_content::parse(&form_bytes)
+        .ops
+        .into_iter()
+        .filter(|op| op.op == b"Do")
+        .filter_map(|op| op.operands.first().and_then(Object::as_name).map(|n| n.to_vec()))
+        .collect();
+    assert_eq!(drawn, [b"ImShown".to_vec()], "page_as_form keeps the first line of piece 2 inside the comment");
+
+    // Control: when piece 1 ends the comment with a newline, `/ImHidden Do` on piece 2's first
+    // line is a real operator and stays in both the extracted page and the form XObject.
+    let newline_ended = build_doc("q Q % comment with newline\n");
+    let extracted_ctrl = full_roundtrip(&extract_pages(&newline_ended, &[0]).unwrap());
+    let mut ctrl_names = xobject_names(&extracted_ctrl, 0);
+    ctrl_names.sort();
+    assert_eq!(ctrl_names, [b"ImHidden".to_vec(), b"ImShown".to_vec()]);
+}
diff --git a/crates/print/src/lib.rs b/crates/print/src/lib.rs
index b731aff00f..a46564add8 100644
--- a/crates/print/src/lib.rs
+++ b/crates/print/src/lib.rs
@@ -720,8 +720,9 @@ fn n(v: f64) -> String {
     if s == "-0" { "0".into() } else { s.into() }
 }
 
-/// The page's content streams decoded against `budget` and joined; streams that don't decode
-/// are left out. `None` when the budget ran out, so part of the content is missing.
+/// The page's content streams decoded against `budget` and joined with a space as the renderer
+/// joins them; streams that don't decode are left out. `None` when the budget ran out, so part of
+/// the content is missing.
 fn decoded_contents(doc: &Document, page: &Dict, budget: &mut DecodeBudget) -> Option<Vec<u8>> {
     let Some(contents) = page.get(b"Contents") else { return Some(Vec::new()) };
     let mut out = Vec::new();
@@ -729,7 +730,7 @@ fn decoded_contents(doc: &Document, page: &Dict, budget: &mut DecodeBudget) -> O
         match data {
             Ok(data) => {
                 out.extend_from_slice(&data);
-                out.push(b'\n');
+                out.push(b' ');
             }
             Err(_) if budget.remaining() == 0 => return None,
             Err(_) => {}
diff --git a/crates/print/src/tests.rs b/crates/print/src/tests.rs
index bc0454c999..e4e49b3d00 100644
--- a/crates/print/src/tests.rs
+++ b/crates/print/src/tests.rs
@@ -1059,3 +1059,85 @@ fn a_booklet_prints_both_sides_on_the_short_edge() {
     assert_eq!(booklet_duplex(BookletSubset::FrontOnly), spool::Duplex::Off);
     assert_eq!(booklet_duplex(BookletSubset::BackOnly), spool::Duplex::Off);
 }
+
+/// #3502: `/Contents` array pieces are joined with a space, matching the renderer, so a `%`
+/// comment at the end of a piece without a line break continues through the first line of the
+/// next piece in both `impose` and `text_reads_up`.
+#[test]
+fn contents_pieces_join_with_a_space_across_a_trailing_comment() {
+    let build_doc = |first_piece: &[u8]| {
+        let mut doc = Document::new_empty();
+        let font = doc.add(
+            [
+                (b"Type".to_vec(), Object::name("Font")),
+                (b"Subtype".to_vec(), Object::name("Type1")),
+                (b"BaseFont".to_vec(), Object::name("Helvetica")),
+            ]
+            .into_iter()
+            .collect::<Dict>(),
+        );
+        let s1 = doc.add(Stream::from_raw(Dict::new(), first_piece.to_vec()));
+        // Line 1 of s2 draws sideways ("HIDDEN") and 4 characters reading up; line 2 draws upright ("SHOWN").
+        let s2 = doc.add(Stream::from_raw(
+            Dict::new(),
+            b"BT /F1 18 Tf 0 1 -1 0 50 50 Tm (HIDDEN) Tj ET\nBT /F1 18 Tf 1 0 0 1 20 100 Tm (SHOWN) Tj ET".to_vec(),
+        ));
+        let fonts: Dict = [(b"F1".to_vec(), Object::Ref(font))].into_iter().collect();
+        let res: Dict = [(b"Font".to_vec(), Object::Dict(fonts))].into_iter().collect();
+        let pages_root = doc.add(Object::Null);
+        let page = doc.add(
+            [
+                (b"Type".to_vec(), Object::name("Page")),
+                (b"Parent".to_vec(), Object::Ref(pages_root)),
+                (b"MediaBox".to_vec(), Object::Array([0.0, 0.0, 200.0, 300.0].into_iter().map(Object::Real).collect())),
+                (b"Resources".to_vec(), Object::Dict(res)),
+                (b"Contents".to_vec(), Object::Array(vec![Object::Ref(s1), Object::Ref(s2)])),
+            ]
+            .into_iter()
+            .collect::<Dict>(),
+        );
+        doc.set(
+            pages_root,
+            Object::Dict(
+                [
+                    (b"Type".to_vec(), Object::name("Pages")),
+                    (b"Kids".to_vec(), Object::Array(vec![Object::Ref(page)])),
+                    (b"Count".to_vec(), Object::Int(1)),
+                ]
+                .into_iter()
+                .collect(),
+            ),
+        );
+        let cat = doc.add([(b"Type".to_vec(), Object::name("Catalog")), (b"Pages".to_vec(), Object::Ref(pages_root))].into_iter().collect::<Dict>());
+        doc.trailer_mut().set(b"Root".to_vec(), Object::Ref(cat));
+        doc
+    };
+
+    let form_strings = |imposed: Vec<u8>| -> Vec<Vec<u8>> {
+        let out = Document::open(Arc::new(imposed)).unwrap();
+        let page = &pdfcraft_model::pages(&out)[0];
+        let res = out.resolve(page.dict.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+        let xo = out.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+        let form_obj = out.resolve(xo.get(b"P0").unwrap());
+        let Object::Stream(form) = &*form_obj else { panic!("form stream") };
+        let body = form.decoded().unwrap();
+        pdfcraft_content::parse(&body)
+            .ops
+            .into_iter()
+            .filter(|op| op.op == b"Tj")
+            .filter_map(|op| op.operands.first().and_then(Object::as_string).map(|s| s.bytes.to_vec()))
+            .collect()
+    };
+
+    // Without a newline at the end of s1, `% comment` swallows line 1 of s2 (`(HIDDEN) Tj`).
+    let commented = build_doc(b"q Q % trailing comment");
+    assert!(!text_reads_up(&commented, 0), "commented-out vertical text on piece 2's first line is not counted");
+    let printed = impose(&commented, &settings(vec![0], Layout::Size(SizeMode::Actual))).unwrap();
+    assert_eq!(form_strings(printed), [b"SHOWN".to_vec()], "impose does not un-comment piece 2's first line");
+
+    // Control: when s1 terminates the comment with a newline, line 1 of s2 is drawn and counted.
+    let with_newline = build_doc(b"q Q % trailing comment\n");
+    assert!(text_reads_up(&with_newline, 0), "6 vertical vs 5 horizontal chars when line 1 is not commented out");
+    let printed_ctrl = impose(&with_newline, &settings(vec![0], Layout::Size(SizeMode::Actual))).unwrap();
+    assert_eq!(form_strings(printed_ctrl), [b"HIDDEN".to_vec(), b"SHOWN".to_vec()]);
+}

From e71a946c0f85d31e49187cd13941185caefdc097 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Sun, 25 Oct 2026 08:31:05 +0100
Subject: [PATCH 032/132] fix(edit): a backdrop is only a fill the graphics
 state paints plain white

Review of #2815 (FredApps): two ways the detector took real content for a
page's own white backdrop and replaced it by default.

- A `gs` sets only the keys its dictionary has, but each one replaced the
  whole opacity decision and read every key it left out as its default,
  so `/Transparent gs /LineOnly gs 1 g ... re f` (ca 0.5, then only a
  line width) counted as opaque. Fill alpha, soft mask and blend mode are
  now kept one by one, through `gs` and `q`/`Q`.
- A transfer function was never read: TR or TR2 mapping 1 to 0 paints
  `1 g` black, and the fill was still replaced. The transfer function is
  tracked too, TR2 over TR in the same dictionary, and only /Identity
  (and /Default for TR2) counts; anything else leaves the fill alone.

Tests: nine graphics states that must keep the fill (each also checks Add
Background leaves the content as it was) and nine that still find the
backdrop (keys set back, TR2 /Default over a TR function, q/Q restoring),
plus an end-to-end render of the reviewer's translucent case under a red
background. All the keep cases fail on the code before this change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/tests/it/backdrop.rs | 45 +++++++++++++++++
 crates/edit/src/backdrop.rs            | 67 +++++++++++++++++++++-----
 crates/edit/src/backdrop_tests.rs      | 62 +++++++++++++++++++++++-
 parity/acrobat-features.toml           |  2 +-
 4 files changed, 160 insertions(+), 16 deletions(-)

diff --git a/crates/automation/tests/it/backdrop.rs b/crates/automation/tests/it/backdrop.rs
index 2f7a002981..00570b260c 100644
--- a/crates/automation/tests/it/backdrop.rs
+++ b/crates/automation/tests/it/backdrop.rs
@@ -222,3 +222,48 @@ fn remove_background_warns_about_pages_whose_own_backdrop_stays_off() {
     assert_eq!(ok(&mut a, "doc_backdrops", json!({ "doc": doc }))["pages"], json!([]), "the fill stays off");
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// Two 200 × 100 pt pages whose full-page `1 g` fill is not a plain white backdrop (#2815
+/// review): page 1 paints it half transparent, through a `gs` that sets `ca` and a later one
+/// that only sets the line width; page 2 sends it through a transfer function that maps 1 to 0.
+fn graphics_state_pdf() -> Vec<u8> {
+    let invert = "<< /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >>";
+    let resources = format!("<< /ExtGState << /Transparent << /ca 0.5 >> /LineOnly << /LW 2 >> /Invert << /TR {invert} >> >> >>");
+    let contents = ["/Transparent gs /LineOnly gs 1 g 0 0 200 100 re f", "/Invert gs 1 g 0 0 200 100 re f"];
+    let mut objs: Vec<String> =
+        vec!["<< /Type /Catalog /Pages 2 0 R >>".into(), "<< /Type /Pages /Kids [3 0 R 5 0 R] /Count 2 /MediaBox [0 0 200 100] >>".into()];
+    for (i, c) in contents.iter().enumerate() {
+        objs.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources {resources} >>", 4 + 2 * i));
+        objs.push(format!("<< /Length {} >>\nstream\n{c}\nendstream", c.len()));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// #2815 review: a translucent fill (its `ca` left in force by a later `gs`) and a fill through
+/// a transfer function are not backdrops, so a red background goes under them and the
+/// translucent white still lightens it.
+#[test]
+fn fills_the_graphics_state_changes_are_not_replaced() {
+    let dir = named_workdir("graphics-state");
+    std::fs::write(dir.join("gs.pdf"), graphics_state_pdf()).unwrap();
+    let mut a = Automation::new().with_root(&dir).unwrap();
+    let doc = ok(&mut a, "doc_open", json!({ "path": "gs.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "doc_backdrops", json!({ "doc": doc }))["pages"], json!([]), "neither fill is a backdrop");
+    ok(&mut a, "doc_background", json!({ "doc": doc, "color": "#FF0000" }));
+    let [r, g, b] = blank_spot(&mut a, doc, 1);
+    assert_eq!(r, 255, "{:?}", [r, g, b]);
+    assert!((100..=160).contains(&g) && (100..=160).contains(&b), "half-transparent white over red, not red: {:?}", [r, g, b]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/edit/src/backdrop.rs b/crates/edit/src/backdrop.rs
index d55cb753ba..72438dedac 100644
--- a/crates/edit/src/backdrop.rs
+++ b/crates/edit/src/backdrop.rs
@@ -20,8 +20,10 @@
 //! that a redaction, Remove Hidden Information or Edit Text removed from the copy.
 //!
 //! Detection is deliberately strict: only one rectangle (`re`), in DeviceGray, DeviceRGB or
-//! DeviceCMYK, opaque in the graphics state, with an axis-aligned transform, filled before any
-//! other painting, and covering the crop box. Anything else is real content and stays.
+//! DeviceCMYK, opaque, unmasked, normally blended and with the identity transfer function as the
+//! graphics state stands after every `gs` so far (each sets only its own keys), with an
+//! axis-aligned transform, filled before any other painting, and covering the crop box.
+//! Anything else is real content and stays.
 
 use pdfcraft_content::{Matrix, Op, Pieces};
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
@@ -80,7 +82,32 @@ struct State {
     white: bool,
     /// Non-stroking colour space components (1, 3, 4), or 0 for a space we don't read.
     space: usize,
-    opaque: bool,
+    paint: Paint,
+}
+
+/// The graphics-state parameters (ExtGState, ISO 32000-2 §8.4.5) that decide whether a fill
+/// paints its colour as given. A `gs` sets only the keys its dictionary has, so each is kept on
+/// its own: a later dictionary that leaves one out keeps the earlier value.
+#[derive(Clone, Copy, Debug, PartialEq)]
+struct Paint {
+    /// Non-stroking alpha (`ca`) is 1.
+    full_alpha: bool,
+    /// No soft mask (`SMask` is `/None`).
+    no_soft_mask: bool,
+    /// The blend mode (`BM`) is Normal or Compatible.
+    normal_blend: bool,
+    /// The transfer function (`TR`, or `TR2`, which takes precedence) is the identity: a
+    /// function could turn white into any colour.
+    identity_transfer: bool,
+}
+
+impl Paint {
+    const INITIAL: Paint = Paint { full_alpha: true, no_soft_mask: true, normal_blend: true, identity_transfer: true };
+
+    /// A fill paints its colour exactly, opaque.
+    fn plain(self) -> bool {
+        self.full_alpha && self.no_soft_mask && self.normal_blend && self.identity_transfer
+    }
 }
 
 /// The backdrop `page` (0-based) paints, if any. Finding the page walks the page tree, so to
@@ -381,7 +408,7 @@ fn sub(doc: &Document, res: &Dict, kind: &[u8], name: &[u8]) -> Option<std::sync
 
 /// Walk the operators until the first one that paints; a backdrop is that one, or nothing.
 fn walk(doc: &Document, res: &Dict, crop: [f64; 4], ops: &[Op]) -> Option<(Backdrop, Option<std::ops::Range<usize>>)> {
-    let mut st = State { ctm: Matrix::IDENTITY, clip: Some([f64::MIN, f64::MIN, f64::MAX, f64::MAX]), white: false, space: 1, opaque: true };
+    let mut st = State { ctm: Matrix::IDENTITY, clip: Some([f64::MIN, f64::MIN, f64::MAX, f64::MAX]), white: false, space: 1, paint: Paint::INITIAL };
     let mut saved: Vec<State> = Vec::new();
     // Current path: its rectangles in user space, or `None` once it is anything else.
     let mut path: Option<Vec<[f64; 4]>> = Some(Vec::new());
@@ -402,7 +429,7 @@ fn walk(doc: &Document, res: &Dict, crop: [f64; 4], ops: &[Op]) -> Option<(Backd
                 }
                 st.ctm = m.then(&st.ctm);
             }
-            b"gs" => st.opaque = opaque_state(doc, res, op.name(0)?)?,
+            b"gs" => apply_state(doc, res, op.name(0)?, &mut st.paint)?,
             b"g" => set_colour(&mut st, 1, op),
             b"rg" => set_colour(&mut st, 3, op),
             b"k" => set_colour(&mut st, 4, op),
@@ -443,7 +470,7 @@ fn walk(doc: &Document, res: &Dict, crop: [f64; 4], ops: &[Op]) -> Option<(Backd
                     Some([r]) => st.clip.and_then(|c| intersect(*r, c)).is_some_and(|r| pdfcraft_content::contains(r, crop, COVER_EPS)),
                     _ => false,
                 };
-                return (covers && st.white && st.opaque && !clip_next).then(|| (Backdrop::Fill, Some(op.span.clone())));
+                return (covers && st.white && st.paint.plain() && !clip_next).then(|| (Backdrop::Fill, Some(op.span.clone())));
             }
             b"Do" => {
                 let xo = sub(doc, res, b"XObject", op.name(0)?)?;
@@ -472,7 +499,7 @@ fn walk(doc: &Document, res: &Dict, crop: [f64; 4], ops: &[Op]) -> Option<(Backd
 /// A picture placed by the CTM (onto the unit square) covering the crop box, opaque, unclipped.
 fn covers_unit_square(st: &State, crop: [f64; 4], image: bool) -> bool {
     image
-        && st.opaque
+        && st.paint.plain()
         && axis_aligned(&st.ctm)
         && st.clip.and_then(|c| intersect(st.ctm.bbox([0.0, 0.0, 1.0, 1.0]), c)).is_some_and(|r| pdfcraft_content::contains(r, crop, COVER_EPS))
 }
@@ -488,14 +515,28 @@ fn set_colour(st: &mut State, components: usize, op: &Op) {
         };
 }
 
-/// Does the named ExtGState keep painting opaque and normal? `None` when it can't be read.
-fn opaque_state(doc: &Document, res: &Dict, name: &[u8]) -> Option<bool> {
+/// Apply the named ExtGState's keys that [`Paint`] tracks; the keys it doesn't have leave
+/// `paint` as it was. `None` when the dictionary or one of those values can't be read.
+fn apply_state(doc: &Document, res: &Dict, name: &[u8], paint: &mut Paint) -> Option<()> {
     let gs = sub(doc, res, b"ExtGState", name)?;
     let gs = gs.as_dict()?;
-    let alpha = gs.get(b"ca").map(|a| doc.resolve(a).as_f64()).unwrap_or(Some(1.0))?;
-    let soft = gs.get(b"SMask").is_some_and(|m| doc.resolve(m).as_name() != Some(b"None"));
-    let blend = gs.get(b"BM").is_some_and(|b| !matches!(doc.resolve(b).as_name(), Some(b"Normal" | b"Compatible")));
-    Some(alpha >= 0.999 && !soft && !blend)
+    if let Some(alpha) = gs.get(b"ca") {
+        paint.full_alpha = doc.resolve(alpha).as_f64()? >= 0.999;
+    }
+    if let Some(mask) = gs.get(b"SMask") {
+        paint.no_soft_mask = doc.resolve(mask).as_name() == Some(b"None");
+    }
+    if let Some(blend) = gs.get(b"BM") {
+        paint.normal_blend = matches!(doc.resolve(blend).as_name(), Some(b"Normal" | b"Compatible"));
+    }
+    // TR2 takes precedence over TR in the same dictionary (§8.4.5, Table 57). Only the names
+    // are read: a function (or one per colourant) is taken to change white.
+    if let Some(transfer) = gs.get(b"TR2") {
+        paint.identity_transfer = matches!(doc.resolve(transfer).as_name(), Some(b"Identity" | b"Default"));
+    } else if let Some(transfer) = gs.get(b"TR") {
+        paint.identity_transfer = doc.resolve(transfer).as_name() == Some(b"Identity");
+    }
+    Some(())
 }
 
 /// Rotations by multiples of 90° and scales only: rectangles stay rectangles.
diff --git a/crates/edit/src/backdrop_tests.rs b/crates/edit/src/backdrop_tests.rs
index c7bfcaa8b4..6ca100adcb 100644
--- a/crates/edit/src/backdrop_tests.rs
+++ b/crates/edit/src/backdrop_tests.rs
@@ -30,14 +30,28 @@ fn stream(dict: &str, data: &str) -> String {
 
 /// One 300 × 200 page drawing `pieces` (objects 5…), with a font, a page-sized image `/Im0`
 /// (object 4) and two graphics states, `/Half` (ca 0.5) and `/Full` (ca 1).
+/// The graphics states [`page`] offers. `INVERT` is a transfer function that maps 1 to 0, so
+/// `1 g` through it paints black (#2815 review).
+const GRAPHICS_STATES: &str = concat!(
+    "/Half << /ca 0.5 >> /Full << /ca 1 /CA 1 >> /LineOnly << /LW 2 >> ",
+    "/Masked << /SMask << /S /Luminosity /G 4 0 R >> >> /Unmasked << /SMask /None >> ",
+    "/Multiply << /BM /Multiply >> /NormalBlend << /BM /Normal >> ",
+    "/Invert << /TR << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >> >> ",
+    "/Invert2 << /TR2 << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >> >> ",
+    "/IdentityTR << /TR /Identity >> /DefaultTR2 << /TR2 /Default >> ",
+    "/InvertButTR2Default << /TR << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >> /TR2 /Default >> ",
+    "/IdentityButTR2Invert << /TR /Identity /TR2 << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >> >>",
+);
+
 fn page(pieces: &[&str]) -> Document {
     let refs: Vec<String> = (0..pieces.len()).map(|i| format!("{} 0 R", i + 5)).collect();
     let mut objs = vec![
         "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
         "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
         format!(
-            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents [{}] /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> /XObject << /Im0 4 0 R >> /ExtGState << /Half << /ca 0.5 >> /Full << /ca 1 /CA 1 >> >> >> >>",
-            refs.join(" ")
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents [{}] /Resources << /Font << /F1 << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> >> /XObject << /Im0 4 0 R >> /ExtGState << {GS} >> >> >>",
+            refs.join(" "),
+            GS = GRAPHICS_STATES
         ),
         stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", "\u{80}"),
     ];
@@ -498,3 +512,47 @@ fn a_stream_listed_twice_is_replaced_in_both_slots_and_restored_in_both() {
     remove_marks(&mut doc, &[0], MarkKind::Background).unwrap();
     assert_eq!(streams(&doc), original);
 }
+
+/// #2815 review: a `gs` sets only the keys its dictionary has, so a translucent, masked,
+/// blended or transferred fill stays that way through a later `gs` that leaves the key out,
+/// and a transfer function that isn't the identity can turn `1 g` into any colour.
+#[test]
+fn graphics_state_a_later_gs_leaves_out_still_keeps_the_fill() {
+    for state in [
+        "/Half gs /LineOnly gs",
+        "/Masked gs /LineOnly gs",
+        "/Multiply gs /LineOnly gs",
+        "/Invert gs /LineOnly gs",
+        "/Invert2 gs /LineOnly gs",
+        "/Invert gs",
+        "/Invert2 gs",
+        "/IdentityButTR2Invert gs",
+        "/Invert gs q /LineOnly gs Q",
+    ] {
+        let mut doc = page(&[&format!("{state} 1 g 0 0 300 200 re f {TEXT}")]);
+        assert_eq!(page_backdrop(&doc, 0).unwrap(), None, "{state}");
+        let before = streams(&doc);
+        add_background(&mut doc, &[0], &red(), false).unwrap();
+        assert_eq!(streams(&doc)[1..], before[..], "{state}: the page's content is unchanged");
+    }
+}
+
+/// The other side of the same rule: a later `gs` that does set the key back, `TR2` naming the
+/// default over a `TR` function, and `Q` restoring what `q` saved still leave a plain white fill.
+#[test]
+fn graphics_state_set_back_before_the_fill_still_finds_the_backdrop() {
+    for state in [
+        "/Half gs /Full gs",
+        "/Masked gs /Unmasked gs",
+        "/Multiply gs /NormalBlend gs",
+        "/Invert gs /IdentityTR gs",
+        "/Invert2 gs /DefaultTR2 gs",
+        "/InvertButTR2Default gs",
+        "/LineOnly gs",
+        "q /Half gs Q",
+        "q /Invert gs Q",
+    ] {
+        let doc = page(&[&format!("{state} 1 g 0 0 300 200 re f {TEXT}")]);
+        assert_eq!(page_backdrop(&doc, 0).unwrap(), Some(Backdrop::Fill), "{state}");
+    }
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 46e10e8b81..d38b467663 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -2532,7 +2532,7 @@ status = "shipped"
 commands = ["edit.background"]
 tools = ["doc_background", "doc_backdrops"]
 evidence = ["crates/ui-egui/tests/it/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/it/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright", "crates/automation/tests/it/backdrop.rs::a_background_shows_on_a_page_that_paints_its_own_white_backdrop", "crates/ui-egui/tests/it/marks.rs::the_background_dialog_offers_to_replace_a_white_backdrop_and_warns_about_scans", "crates/ui-egui/tests/it/marks.rs::the_background_preview_follows_the_replace_checkbox", "crates/edit/src/backdrop_tests.rs::content_that_is_not_a_page_backdrop_is_left_alone", "crates/ui-egui/tests/it/marks.rs::the_preview_shows_the_page_the_range_selects_under_the_marks"]
-notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove turns it back on, after edits and redactions too, unless the operators before it changed or it would no longer be painted first, and then says which pages keep it off). The replaced copy's tag holds no page content or reference, so text a redaction or Remove Hidden Information takes off such a page leaves the file. Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space. The dialog previews a colour as a tint of the page's own thumbnail (opaque pictures on the page are tinted there too, not in the result), a file as its frame and name; a page that will still hide the background (a scan, or a white backdrop with Replace unticked) previews without the colour"
+notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page. A page that paints its own opaque white backdrop (browsers' Save as PDF, print drivers) used to hide the background entirely; the dialog now offers to replace that fill (on by default; Remove turns it back on, after edits and redactions too, unless the operators before it changed or it would no longer be painted first, and then says which pages keep it off). The replaced copy's tag holds no page content or reference, so text a redaction or Remove Hidden Information takes off such a page leaves the file. Our own choice: Acrobat's behaviour on such pages has not been observed. Still hidden: scanned pages (warned), backdrops drawn inside a form XObject, by a non-rectangular path, or in a named colour space, and white fills drawn translucent, through a soft mask, a non-Normal blend mode or a transfer function (TR/TR2) as the graphics state stands after every gs, which are real content and stay. The dialog previews a colour as a tint of the page's own thumbnail (opaque pictures on the page are tinted there too, not in the result), a file as its frame and name; a page that will still hide the background (a scan, or a white backdrop with Replace unticked) previews without the colour"
 
 [[feature]]
 id = "edit.background-update-remove"

From abc378c0bb8c34c17a3f43ea30e98db33a3c3574 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 19:10:46 +1100
Subject: [PATCH 033/132] fix(ui): a text box keeps its typing history through
 a trip to another tab
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tabs share one text box, and its Undo history was cleared whenever
another document's box took it: opening a paragraph in tab B wiped tab
A's typing steps, so Edit ▸ Undo back in A found none and closed A's
paragraph instead of taking the typing back. The box being left now
keeps a copy of its history and caret aside, under its document, and
the same box gets it back on its return; a box new to the text box
still starts with none, so typing still never reaches another tab. The
copy is a deep one: a state's history is shared between its clones.
---
 crates/ui-egui/src/edit_text_ui.rs | 26 +++++++++++++++---
 crates/ui-egui/tests/it/content.rs | 36 +++++++++++++++++++++++++
 crates/ui-egui/tests/it/editing.rs | 43 ++++++++++++++++++++++++++++++
 3 files changed, 101 insertions(+), 4 deletions(-)

diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 396c430a7f..4724cbb6e5 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -276,15 +276,33 @@ pub(crate) fn input_id() -> egui::Id {
 /// as it was before a format change, into a box showing the page as it is now. `from` is the box's
 /// own record of that; which document `doc` last used the history is kept beside it, since a box
 /// in another tab on the same text would otherwise take that document's typing with its Redo.
+/// When another document's box takes the text box, the box it leaves keeps its history (and
+/// caret) aside, and gets it back on its return, so its typing can still be undone there.
 pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcraft_engine::DocId, from: &mut Option<String>, text: &str) {
     let owner = id.with("typing-doc");
-    if from.as_deref() == Some(text) && ctx.data(|d| d.get_temp::<pdfcraft_engine::DocId>(owner)) == Some(doc) {
+    let last = ctx.data(|d| d.get_temp::<pdfcraft_engine::DocId>(owner));
+    if from.as_deref() == Some(text) && last == Some(doc) {
         return;
     }
-    if let Some(mut state) = egui::TextEdit::load_state(ctx, id) {
-        state.clear_undoer();
-        egui::TextEdit::store_state(ctx, id, state);
+    let aside = |doc: pdfcraft_engine::DocId| id.with(("typing-aside", doc));
+    if let Some(left) = last.filter(|l| *l != doc)
+        && let Some(state) = egui::TextEdit::load_state(ctx, id)
+    {
+        // A copy of its own: a state's history is shared between its clones, and the next box
+        // clears it in place.
+        let mut kept = egui::text_edit::TextEditState::default();
+        kept.cursor = state.cursor;
+        kept.set_undoer(state.undoer());
+        ctx.data_mut(|d| d.insert_temp(aside(left), kept));
     }
+    // Only the same box, still on the text it opened on, takes its history back.
+    let back = ctx.data_mut(|d| d.remove_temp::<egui::text_edit::TextEditState>(aside(doc))).filter(|_| from.as_deref() == Some(text));
+    let state = back.unwrap_or_else(|| {
+        let mut state = egui::TextEdit::load_state(ctx, id).unwrap_or_default();
+        state.clear_undoer();
+        state
+    });
+    egui::TextEdit::store_state(ctx, id, state);
     ctx.data_mut(|d| d.insert_temp(owner, doc));
     *from = Some(text.to_owned());
 }
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index a17d0793ea..43771ed724 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1022,6 +1022,42 @@ fn redo_from_the_menu_is_enabled_for_the_added_text_boxs_own_typing() {
     assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed twice"), "Redo puts it back");
 }
 
+/// Typing in tab A's added text box, the same text opened in tab B, then back to A: Edit ▸ Undo
+/// takes the typing back in A's box, which stays open.
+#[test]
+fn undo_after_a_round_trip_through_another_tab_takes_back_added_text_typing() {
+    let mut h = harness();
+    h.state_mut().open_bytes("copy.pdf", None, include_bytes!("../data/form.pdf").to_vec()).unwrap();
+    h.run_steps(4);
+    let text = pdfcraft_engine::AddedText { rect: [40.0, 195.0, 240.0, 210.0], text: "Reviewed".into(), ..Default::default() };
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.text"));
+        h.run_steps(3);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        let k = r.width() / 300.0;
+        click(h, r.min + egui::vec2(45.0 * k, 195.0 * k));
+        assert_eq!(h.state().views[tab].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    };
+    for tab in [0, 1] {
+        h.state_mut().active = Some(tab);
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text: text.clone() }));
+    }
+    open_in(&mut h, 0);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    open_in(&mut h, 1);
+    h.state_mut().active = Some(0);
+    h.run_steps(3);
+    let draft = |h: &Harness<'static, PdfCraftApp>| h.state().views[0].content.draft.as_ref().map(|d| d.text.clone());
+    assert_eq!(draft(&h).as_deref(), Some("Reviewed twice"), "A's box is still open with the typing");
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(draft(&h).as_deref(), Some("Reviewed"), "Undo takes the typing back in A's box");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index c22ce087f2..c1acc43fe7 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6645,6 +6645,49 @@ fn redo_from_the_menu_is_enabled_for_the_boxs_own_typing() {
     assert_eq!(h.state().views[0].line_editor.as_ref().expect("still open").text, typed, "Redo puts the typing back");
 }
 
+/// Typing in tab A's paragraph, a paragraph opened in tab B, then back to A: Edit ▸ Undo takes
+/// the typing back in A's box. The tabs share one text box, and its history was cleared each time
+/// another tab's box took it, so Undo found no step and closed A's paragraph instead
+/// (skylartaylor's and FredApps's review of 08ec1db7).
+#[test]
+fn undo_after_a_round_trip_through_another_tab_takes_back_the_typing() {
+    let mut h = harness(1, |app| {
+        app.open_bytes("copy.pdf", None, fixture(1)).expect("the copy opens");
+    });
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        if h.state().views[tab].line_editor.is_none() {
+            assert!(h.state_mut().execute("edit.edit_text"));
+            h.run_steps(2);
+        }
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        click_at(h, egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height()));
+        assert!(h.state().views[tab].line_editor.is_some(), "the paragraph opens for typing");
+    };
+    open_in(&mut h, 0);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    open_in(&mut h, 0);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    assert!(h.state().views[0].line_editor.as_ref().unwrap().text.ends_with(" more"));
+    open_in(&mut h, 1);
+    h.state_mut().active = Some(0);
+    h.run_steps(3);
+    assert!(h.state().views[0].line_editor.is_some(), "A's paragraph is still open after the round trip");
+    assert!(h.state_mut().execute("edit.undo"), "Undo is enabled");
+    h.run_steps(3);
+    let s = h.state();
+    let ed = s.views[0].line_editor.as_ref().expect("the box stays open: Undo takes back the typing");
+    assert_eq!(ed.text, original, "the typing is taken back in the box");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
+}
+
 /// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
 /// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
 /// Typing in one tab, taken back with Undo, then came back with Redo in the other tab.

From aa326f37cdf7ae823cb2149321bf413a7b036ef3 Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Sun, 25 Oct 2026 21:15:26 +1100
Subject: [PATCH 034/132] fix(ui): formatting restarts a text box's history;
 the menu claims the box first

Three holes in the shared text box's history:

- Formatting applied with the paragraph open left typing_from as it
  was, so when the format left the text unchanged the box kept its
  history, and Redo put typing undone before the format back on top of
  it. applied() now resets typing_from, so the next claim clears it.
- Undo or Redo from the menu in the same frame as a tab switch ran
  before the box was drawn, on the history of the other tab's box: Undo
  put tab B's text into tab A's box, and Redo put A's undone typing into
  B's. undo_in_page_box and redo_in_page_box now make the box claim the
  text box first (claim_typing), as drawing it does.
- A box new to the text box cleared only the last box's history and
  kept its caret and selection; it now starts from a default state.

claim_typing on LineEditor and TextDraft is now the one way a box takes
the text box, for drawing and for the menu.
---
 crates/ui-egui/src/content_ui.rs   |   8 ++-
 crates/ui-egui/src/edit_text_ui.rs |  23 ++++--
 crates/ui-egui/src/editing.rs      |   6 ++
 crates/ui-egui/tests/it/content.rs |  36 ++++++++++
 crates/ui-egui/tests/it/editing.rs | 110 +++++++++++++++++++++++++++++
 5 files changed, 175 insertions(+), 8 deletions(-)

diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 04d626088d..77edee6876 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -75,6 +75,12 @@ pub struct TextDraft {
 }
 
 impl TextDraft {
+    /// Take the shared text box for this box ([`crate::edit_text_ui::forget_typing_before`]): its
+    /// own history, or none once the page has its text.
+    pub(crate) fn claim_typing(&mut self, ctx: &egui::Context, doc: pdfcraft_engine::DocId) {
+        crate::edit_text_ui::forget_typing_before(ctx, input_id(), doc, &mut self.typing_from, &self.style.text);
+    }
+
     /// Typing the page doesn't have yet: Undo takes it back in the box before touching the document.
     pub(crate) fn has_unapplied_typing(&self) -> bool {
         self.text != self.style.text
@@ -604,7 +610,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                 ui.fonts_mut(|f| f.layout_job(job))
             };
             let input = input_id();
-            crate::edit_text_ui::forget_typing_before(ui.ctx(), input, doc_id, &mut t.typing_from, &t.style.text);
+            t.claim_typing(ui.ctx(), doc_id);
             ui.horizontal_top(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
                 let mut edit = egui::TextEdit::multiline(&mut t.text)
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 4724cbb6e5..a0f73eaf43 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -277,7 +277,9 @@ pub(crate) fn input_id() -> egui::Id {
 /// own record of that; which document `doc` last used the history is kept beside it, since a box
 /// in another tab on the same text would otherwise take that document's typing with its Redo.
 /// When another document's box takes the text box, the box it leaves keeps its history (and
-/// caret) aside, and gets it back on its return, so its typing can still be undone there.
+/// caret) aside, and gets it back on its return, so its typing can still be undone there. Each
+/// box claims the text box when it is drawn, and Undo and Redo from the menu claim it first too,
+/// since they can run before the box is drawn again after a tab switch.
 pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcraft_engine::DocId, from: &mut Option<String>, text: &str) {
     let owner = id.with("typing-doc");
     let last = ctx.data(|d| d.get_temp::<pdfcraft_engine::DocId>(owner));
@@ -297,11 +299,9 @@ pub(crate) fn forget_typing_before(ctx: &egui::Context, id: egui::Id, doc: pdfcr
     }
     // Only the same box, still on the text it opened on, takes its history back.
     let back = ctx.data_mut(|d| d.remove_temp::<egui::text_edit::TextEditState>(aside(doc))).filter(|_| from.as_deref() == Some(text));
-    let state = back.unwrap_or_else(|| {
-        let mut state = egui::TextEdit::load_state(ctx, id).unwrap_or_default();
-        state.clear_undoer();
-        state
-    });
+    // A box new to the text box starts with nothing of the last one's: no history, caret or
+    // selection.
+    let state = back.unwrap_or_default();
     egui::TextEdit::store_state(ctx, id, state);
     ctx.data_mut(|d| d.insert_temp(owner, doc));
     *from = Some(text.to_owned());
@@ -421,9 +421,18 @@ impl LineEditor {
         self.look0 = self.look.clone();
         self.extras0 = self.extras;
         self.original = self.text.clone();
+        // The page now has this text: the box's history restarts, even when the format left the
+        // text as it was, so a Redo from before can't put undone typing back on top of it.
+        self.typing_from = None;
         self.focus = true;
     }
 
+    /// Take the shared text box for this paragraph ([`forget_typing_before`]): its own history,
+    /// or none once the page has its text.
+    pub(crate) fn claim_typing(&mut self, ctx: &egui::Context, doc: pdfcraft_engine::DocId) {
+        forget_typing_before(ctx, input_id(), doc, &mut self.typing_from, &self.original);
+    }
+
     /// Adopt the rewritten paragraph's current geometry before the next overlay frame.
     pub(crate) fn refresh_source(&mut self, block: &pdfcraft_engine::TextBlock, lines: Vec<pdfcraft_engine::TextLine>) {
         self.source_rect = block.rect.map(|v| v as f32);
@@ -1724,7 +1733,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                     if snapshot.changes_with(text.as_str()) { galley } else { unseen(galley) }
                 };
                 let input = input_id();
-                forget_typing_before(ui.ctx(), input, view_id, &mut ed.typing_from, &ed.original);
+                ed.claim_typing(ui.ctx(), view_id);
                 let output = egui::TextEdit::multiline(&mut ed.text)
                     .id(input)
                     .font(font.clone())
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 408474eaa9..a7ee6b3d54 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -231,12 +231,15 @@ impl PdfCraftApp {
     fn undo_in_page_box(&mut self) -> bool {
         let Some(ctx) = self.ctx.clone() else { return false };
         let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
+        let doc = view.id;
         if let Some(ed) = view.line_editor.as_mut().filter(|ed| ed.has_unsaved_text()) {
+            ed.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, true) else { return false };
             ed.text = text;
             return true;
         }
         if let Some(d) = view.content.draft.as_mut().filter(|d| d.has_unapplied_typing()) {
+            d.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, true) else { return false };
             d.text = text;
             return true;
@@ -259,12 +262,15 @@ impl PdfCraftApp {
     fn redo_in_page_box(&mut self) -> bool {
         let Some(ctx) = self.ctx.clone() else { return false };
         let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return false };
+        let doc = view.id;
         if let Some(ed) = view.line_editor.as_mut() {
+            ed.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::edit_text_ui::input_id(), &ed.text, false) else { return ed.has_unsaved_text() };
             ed.text = text;
             return true;
         }
         if let Some(d) = view.content.draft.as_mut() {
+            d.claim_typing(&ctx, doc);
             let Some(text) = typing_step(&ctx, crate::content_ui::input_id(), &d.text, false) else { return d.has_unapplied_typing() };
             d.text = text;
             return true;
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 43771ed724..387cc1aed1 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -1058,6 +1058,42 @@ fn undo_after_a_round_trip_through_another_tab_takes_back_added_text_typing() {
     assert_eq!(draft(&h).as_deref(), Some("Reviewed"), "Undo takes the typing back in A's box");
 }
 
+/// Edit ▸ Undo chosen in the same frame as the switch back to tab A's added text box, before it
+/// is drawn again: the shared text box still holds tab B's history, from a box on other text, so
+/// A's box claims its own back before stepping.
+#[test]
+fn undo_in_the_frame_of_the_switch_back_takes_back_added_text_typing() {
+    let mut h = harness();
+    h.state_mut().open_bytes("copy.pdf", None, include_bytes!("../data/form.pdf").to_vec()).unwrap();
+    h.run_steps(4);
+    let rect = [40.0, 195.0, 240.0, 210.0];
+    for (tab, text) in [(0, "Reviewed"), (1, "Approved")] {
+        h.state_mut().active = Some(tab);
+        let text = pdfcraft_engine::AddedText { rect, text: text.into(), ..Default::default() };
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddText { page: 0, text }));
+    }
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.text"));
+        h.run_steps(3);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        let k = r.width() / 300.0;
+        click(h, r.min + egui::vec2(45.0 * k, 195.0 * k));
+        assert_eq!(h.state().views[tab].content.draft.as_ref().and_then(|d| d.index), Some(0), "the editor opened on the text");
+    };
+    open_in(&mut h, 0);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::End);
+    h.event(egui::Event::Text(" twice".into()));
+    h.run_steps(2);
+    open_in(&mut h, 1);
+    // Back to A and Undo at once: no frame draws A's box in between.
+    h.state_mut().active = Some(0);
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("Reviewed"), "Undo takes the typing back in A's box");
+}
+
 /// Redo with an added text box open and unchanged reaches the document's waiting Redo, even when
 /// the box's text ends in a space: closing the unchanged box writes nothing, so it can't clear
 /// that Redo first.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index c1acc43fe7..da2a703f55 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6688,6 +6688,116 @@ fn undo_after_a_round_trip_through_another_tab_takes_back_the_typing() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().can_redo(), Some("Edit text"), "the document's Redo still waits");
 }
 
+/// Typing taken back with Ctrl+Z, then Bold applied with the paragraph still open: Ctrl+Shift+Z
+/// must not bring the typing back on top of the bold, as the box's history is cleared once the
+/// page has its text. The format left the text as it was, so the box kept its history and its
+/// Redo put "Page 1 more" back (FredApps's review of abc378c0).
+#[test]
+fn redo_after_formatting_never_brings_back_typing_undone_before_it() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    open_paragraph(&mut h);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "the typing is taken back");
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), Some("Edit text"), "the bold is applied");
+    h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
+    h.run_steps(3);
+    let text = h.state().views[0].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert_eq!(text.as_deref(), Some(original.as_str()), "the typing undone before the bold stays undone");
+    // Nor through what the menu's Redo runs.
+    h.state_mut().redo();
+    h.run_steps(3);
+    let s = h.state();
+    let text = s.views[0].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert!(!text.as_deref().unwrap_or_default().contains("more"), "the menu's Redo brings it back: {text:?}");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().text_blocks(0)[0].base_font, "Helvetica-Bold", "the bold stays");
+}
+
+/// Edit ▸ Undo chosen in the same frame as the switch back to tab A, before A's box is drawn
+/// again: the shared text box still holds tab B's history then. Stepping through it put B's
+/// typing into A's box; the box now claims its own history back first (CodeRabbit on abc378c0).
+#[test]
+fn undo_in_the_frame_of_the_switch_back_takes_back_the_typing() {
+    let mut h = harness(1, |app| {
+        app.open_bytes("copy.pdf", None, fixture(1)).expect("the copy opens");
+    });
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        if h.state().views[tab].line_editor.is_none() {
+            assert!(h.state_mut().execute("edit.edit_text"));
+            h.run_steps(2);
+        }
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        click_at(h, egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height()));
+        assert!(h.state().views[tab].line_editor.is_some(), "the paragraph opens for typing");
+    };
+    open_in(&mut h, 0);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" more".into()));
+    h.run_steps(2);
+    // In B, a paragraph whose text differs from A's ("Page 1 B", applied with Bold), so B's
+    // history can't pass for A's.
+    open_in(&mut h, 1);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" B".into()));
+    h.run_steps(2);
+    h.get_by_label("Bold").click();
+    h.run_steps(4);
+    assert_eq!(h.state().views[1].line_editor.as_ref().map(|ed| ed.text.as_str()), Some("Page 1 B"), "B's paragraph is open on its own text");
+    // Back to A and Undo at once: no frame draws A's box in between.
+    h.state_mut().active = Some(0);
+    assert!(h.state_mut().execute("edit.undo"), "Undo is enabled");
+    h.run_steps(3);
+    let ed = h.state().views[0].line_editor.clone().expect("the box stays open: Undo takes back the typing");
+    assert_eq!(ed.text, original, "the typing is taken back in A's box");
+}
+
+/// Redo from the menu chosen in the same frame as a switch to tab B, whose paragraph is open on
+/// the same text as A's: the shared text box still holds A's history then, with A's undone
+/// typing to redo, so B's box claims its own history back before stepping.
+#[test]
+fn redo_in_the_frame_of_a_tab_switch_never_brings_another_tabs_typing() {
+    let mut h = harness(1, |app| {
+        app.open_bytes("copy.pdf", None, fixture(1)).expect("the copy opens");
+    });
+    let open_in = |h: &mut Harness<'static, PdfCraftApp>, tab: usize| {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(h.state_mut().execute("edit.edit_text"));
+        h.run_steps(2);
+        let r = h.state().views[tab].page_screen_rect(0).expect("on screen");
+        click_at(h, egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height()));
+        assert!(h.state().views[tab].line_editor.is_some(), "the paragraph opens for typing");
+    };
+    open_in(&mut h, 1);
+    open_in(&mut h, 0);
+    let original = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    h.key_press_modifiers(Modifiers::COMMAND, Key::End);
+    h.event(egui::Event::Text(" secret".into()));
+    h.run_steps(2);
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, original, "taken back in A");
+    // To B and Redo at once: no frame draws B's box in between.
+    h.state_mut().active = Some(1);
+    h.state_mut().redo();
+    h.run_steps(3);
+    let s = h.state();
+    let b = s.views[1].line_editor.as_ref().map(|ed| ed.text.clone());
+    assert!(!b.as_deref().unwrap_or_default().contains("secret"), "A's typing came back in B: {b:?}");
+    assert!(!s.session.get(s.views[1].id).unwrap().text_blocks(0)[0].text.contains("secret"), "A's typing reached B's page");
+}
+
 /// Two copies of a document, the same paragraph open in each. The paragraph boxes share one text
 /// box, and so one Undo history: a box opened on the same text as another tab's didn't clear it.
 /// Typing in one tab, taken back with Undo, then came back with Redo in the other tab.

From 42da7f24737ddc0d641d12602282b59494958eea Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Sun, 25 Oct 2026 21:03:30 +0100
Subject: [PATCH 035/132] fix(comments): delete or edit one reply from its own
 menu, keeping the thread
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the Comments panel a reply had no menu, and the card's Delete removes
the whole thread, so one wrong reply couldn't go without the comment and
every other reply. On the selected card each reply now has its own "…"
(Edit, Copy text, Delete), as Adobe's help describes. Delete takes that
reply with its pop-up and the replies to it, as comment_delete already
did headlessly. The comment and its other replies stay, in one undo step.
A locked reply's Delete is greyed out. Status badges and a Replace Text
caret get no menu.

Deleting moves what follows it up in /Annots. Before, any delete cleared
the selection, and the panel's inline editor stayed keyed to an index
that could now be another comment. CommentView::annotation_deleted now
finds both where they moved, from their place among what stays and what
they read, or clears them when they went too or the page changed
unexpectedly.

The new string is in every catalogue. Parity notes, the roadmap row and
comment_delete's description say a reply can be deleted on its own.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ROADMAP.md                               |   1 +
 crates/automation/src/tools.rs           |   2 +-
 crates/automation/tests/it/automation.rs |  29 ++++++
 crates/ui-egui/src/comments.rs           | 117 +++++++++++++++++++++++
 crates/ui-egui/src/comments_panel.rs     | 105 +++++++++++++++-----
 crates/ui-egui/src/editing.rs            |   8 +-
 crates/ui-egui/src/i18n/ar.tsv           |   3 +
 crates/ui-egui/src/i18n/bg.tsv           |   3 +
 crates/ui-egui/src/i18n/ca.tsv           |   3 +
 crates/ui-egui/src/i18n/ckb.tsv          |   3 +
 crates/ui-egui/src/i18n/cs.tsv           |   3 +
 crates/ui-egui/src/i18n/de.tsv           |   3 +
 crates/ui-egui/src/i18n/el.tsv           |   3 +
 crates/ui-egui/src/i18n/es.tsv           |   3 +
 crates/ui-egui/src/i18n/fa.tsv           |   3 +
 crates/ui-egui/src/i18n/fi.tsv           |   3 +
 crates/ui-egui/src/i18n/fr.tsv           |   3 +
 crates/ui-egui/src/i18n/hi.tsv           |   3 +
 crates/ui-egui/src/i18n/hu.tsv           |   3 +
 crates/ui-egui/src/i18n/id.tsv           |   3 +
 crates/ui-egui/src/i18n/it.tsv           |   3 +
 crates/ui-egui/src/i18n/ja.tsv           |   3 +
 crates/ui-egui/src/i18n/kk.tsv           |   3 +
 crates/ui-egui/src/i18n/ko.tsv           |   3 +
 crates/ui-egui/src/i18n/lo.tsv           |   3 +
 crates/ui-egui/src/i18n/lt.tsv           |   3 +
 crates/ui-egui/src/i18n/nb.tsv           |   3 +
 crates/ui-egui/src/i18n/pl.tsv           |   3 +
 crates/ui-egui/src/i18n/pt-br.tsv        |   3 +
 crates/ui-egui/src/i18n/ro.tsv           |   3 +
 crates/ui-egui/src/i18n/ru.tsv           |   3 +
 crates/ui-egui/src/i18n/sl.tsv           |   3 +
 crates/ui-egui/src/i18n/sq.tsv           |   3 +
 crates/ui-egui/src/i18n/te.tsv           |   3 +
 crates/ui-egui/src/i18n/th.tsv           |   3 +
 crates/ui-egui/src/i18n/tr.tsv           |   3 +
 crates/ui-egui/src/i18n/uk.tsv           |   3 +
 crates/ui-egui/src/i18n/vi.tsv           |   3 +
 crates/ui-egui/src/i18n/zh-hans.tsv      |   3 +
 crates/ui-egui/src/i18n/zh-hant.tsv      |   3 +
 crates/ui-egui/tests/it/comments.rs      |  94 +++++++++++++++++-
 docs/roadmap.md                          |   3 +-
 parity/acrobat-features.toml             |  16 ++--
 43 files changed, 443 insertions(+), 34 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 165fccc5e8..7c52ddac17 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -199,6 +199,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- **2026-10-25 (M5, comment replies):** One reply can be deleted from the Comments panel without its thread. On the selected card each reply has its own "…" menu (Edit, Copy text, Delete); Delete takes that reply with its pop-up and the replies to it, as `comment_delete` already did headlessly, and the comment and its other replies stay. The card stays selected, and the panel's editor stays open, on what they were on though the delete moved it in `/Annots`. A locked reply can't be deleted. Estimates unchanged.
 - **2026-10-24 (M10, #4158 partial):** Word, HTML, RTF and PowerPoint export keep a block that continues another on its line (an italic case name, a link, a superscript) as a run in its own style inside that paragraph, with the source's word space, instead of a paragraph of its own. Style changes that wrap onto the next line still split paragraphs (the reading blocks keep style boundaries). Estimates unchanged.
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 4b4ac8873b..e2fdf9f783 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -886,7 +886,7 @@ pub fn tools() -> Vec<ToolDef> {
         )),
         t("comment_image_preview", "Preview image signature layers", "Return a PNG of the page without the selected image signature/initials (layer=background, default), or its embedded image with alpha (layer=image). Includes the displayed rectangle, document rotation, image_rotation (how far clockwise the image is shown turned) and annotation opacity. Cache these layers for live placement/resizing; commit once with comment_edit. Does not change the document or undo history.")
             .ro().with(schema(comment_ref(json!({ "layer": { "type": "string", "enum": ["background", "image"], "default": "background" }, "dpi": { "type": "number", "minimum": 1, "maximum": 600, "default": 96 } })), &["doc"])),
-        t("comment_delete", "Delete a comment", "Delete a comment with its pop-up and replies. Undoable.").destructive().with(schema(comment_ref(json!({})), &["doc"])),
+        t("comment_delete", "Delete a comment", "Delete a comment with its pop-up and replies, or one reply (its id, or page and index, from comment_list) with its pop-up and the replies to it; the comment and its other replies stay. Undoable.").destructive().with(schema(comment_ref(json!({})), &["doc"])),
         t(
             "doc_protect",
             "Protect with passwords",
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 23351db9aa..ce68cd25b4 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -2134,6 +2134,35 @@ fn nested_replies_stay_in_the_listing() {
     assert!(replies.contains(&"DIRECT_REPLY") && replies.contains(&"NESTED_REPLY"), "the nested reply is listed: {replies:?}");
 }
 
+/// comment_delete on a reply deletes that reply and the replies to it, as the Comments panel's
+/// reply menu does: the comment and its other replies stay, and one undo brings it back.
+#[test]
+fn deleting_a_reply_keeps_its_comment_and_the_other_replies() {
+    let dir = workdir("delete-reply");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let root = ok(&mut a, "comment_add", json!({ "doc": doc, "page": 1, "type": "note", "at": [40, 40], "contents": "ROOT_NOTE", "author": "A" }));
+    let root_id = root["comment"]["id"].as_str().unwrap().to_string();
+    ok(&mut a, "comment_reply", json!({ "doc": doc, "id": root_id, "text": "WRONG_REPLY", "author": "B" }));
+    ok(&mut a, "comment_reply", json!({ "doc": doc, "id": root_id, "text": "RIGHT_REPLY", "author": "C" }));
+    let replies = |a: &mut Automation| -> Vec<Value> {
+        let list = ok(a, "comment_list", json!({ "doc": doc }));
+        assert_eq!(list["count"], 1, "{list}");
+        list["comments"][0]["replies"].as_array().unwrap().clone()
+    };
+    let wrong = replies(&mut a).into_iter().find(|r| r["contents"] == "WRONG_REPLY").unwrap();
+    ok(&mut a, "comment_reply", json!({ "doc": doc, "id": wrong["id"], "text": "ANSWER_TO_WRONG", "author": "D" }));
+    let texts = |a: &mut Automation| -> Vec<String> { replies(a).iter().filter_map(|r| r["contents"].as_str().map(str::to_owned)).collect() };
+    assert_eq!(texts(&mut a), ["WRONG_REPLY", "RIGHT_REPLY", "ANSWER_TO_WRONG"]);
+
+    ok(&mut a, "comment_delete", json!({ "doc": doc, "page": wrong["page"], "index": wrong["index"] }));
+    let list = ok(&mut a, "comment_list", json!({ "doc": doc }));
+    assert_eq!(list["comments"][0]["contents"], "ROOT_NOTE", "{list}");
+    assert_eq!(texts(&mut a), ["RIGHT_REPLY"], "the reply took the answer to it along");
+    assert_eq!(ok(&mut a, "edit_undo", json!({ "doc": doc }))["undone"], "Delete comment");
+    assert_eq!(texts(&mut a), ["WRONG_REPLY", "RIGHT_REPLY", "ANSWER_TO_WRONG"]);
+}
+
 /// Replies thread by their `/IRT` reference, not `/NM`: PyMuPDF names the first comment on every
 /// page `fitz-A0`. A shared id is refused rather than taken to mean page 1's comment.
 #[test]
diff --git a/crates/ui-egui/src/comments.rs b/crates/ui-egui/src/comments.rs
index bf9b5fe72c..511bee805a 100644
--- a/crates/ui-egui/src/comments.rs
+++ b/crates/ui-egui/src/comments.rs
@@ -12,6 +12,8 @@
 //! Everything is turned into `pdfcraft_engine::Edit`s, queued on the view as `pending_edit` and
 //! applied by the app, so each change is one undo step.
 
+use std::collections::HashMap;
+
 use egui::{Color32, CornerRadius, Pos2, Rect, Sense, Stroke, pos2, vec2};
 use pdfcraft_engine::{Edit, LineEnding, Markup, NewAnnotation, NoteIcon, ReviewState, Rgb, Shape, Style};
 use pdfcraft_render::{Annotation, DocInfo, PageInfo, PageText};
@@ -578,6 +580,61 @@ impl CommentView {
             self.editor_focus = None;
         }
     }
+
+    /// The annotation at `gone` was just deleted; `before` and `after` are the document's
+    /// annotations until then and now. The selection and the inline editor stay on what they
+    /// were on, where it now is (deleting a reply keeps its comment selected), and close when it
+    /// went too.
+    pub(crate) fn annotation_deleted(&mut self, before: &[Annotation], after: &[Annotation], gone: (usize, usize)) {
+        self.selected = self.selected.and_then(|k| after_delete(before, after, gone, k));
+        self.editing = self.editing.take().and_then(|(p, i, text)| after_delete(before, after, gone, (p, i)).map(|(p, i)| (p, i, text)));
+        if self.editing.is_none() {
+            self.editor_focus = None;
+        }
+    }
+}
+
+/// Where the annotation at `keep` is once the one at `gone` was deleted, or `None` when it went
+/// with it. Deleting takes the annotation's replies (at any depth) and pop-ups out of its page's
+/// `/Annots` (`pdfcraft_annot::delete_annotation`), and everything after them moves up, so `keep`
+/// is found by its place among the page's annotations that stay. When the page lost other
+/// annotations than those, or the one in that place reads differently, it is not guessed at.
+fn after_delete(before: &[Annotation], after: &[Annotation], gone: (usize, usize), keep: (usize, usize)) -> Option<(usize, usize)> {
+    if keep == gone {
+        return None;
+    }
+    if keep.0 != gone.0 {
+        return Some(keep);
+    }
+    let (old, new) = (on_page(before, gone.0), on_page(after, gone.0));
+    // Only replies on the page go with it: `/IRT` is followed through the page's `/Annots`.
+    let parents: HashMap<usize, usize> = old.iter().filter_map(|a| a.parent.filter(|p| p.0 == gone.0).map(|p| (a.index, p.1))).collect();
+    let goes = |mut i: usize| {
+        // `link_replies` settles every chain within 64 steps.
+        for _ in 0..=64 {
+            if i == gone.1 {
+                return true;
+            }
+            let Some(&up) = parents.get(&i) else { return false };
+            i = up;
+        }
+        false
+    };
+    let stays: Vec<&Annotation> = old.iter().copied().filter(|a| !goes(a.index)).collect();
+    if stays.len() != new.len() {
+        return None;
+    }
+    let rank = stays.iter().position(|a| a.index == keep.1)?;
+    let (was, now) = (stays.get(rank)?, new.get(rank)?);
+    let same = (&was.subtype, &was.name, &was.author, &was.contents, was.rect) == (&now.subtype, &now.name, &now.author, &now.contents, now.rect);
+    same.then_some((now.page, now.index))
+}
+
+/// The annotations listed on `page`, in `/Annots` order.
+fn on_page(list: &[Annotation], page: usize) -> Vec<&Annotation> {
+    let mut v: Vec<&Annotation> = list.iter().filter(|a| a.page == page).collect();
+    v.sort_by_key(|a| a.index);
+    v
 }
 
 /// Comments panel order (Acrobat: Sort by page, author, date, type, colour).
@@ -2353,6 +2410,66 @@ mod tests {
         }
     }
 
+    /// A listed comment or reply at `index` on `page`, replying to `parent`.
+    fn listed(page: usize, index: usize, contents: &str, parent: Option<(usize, usize)>) -> Annotation {
+        Annotation {
+            page,
+            subtype: "Text".into(),
+            author: None,
+            contents: Some(contents.into()),
+            modified: None,
+            name: None,
+            in_reply_to: None,
+            parent,
+            grouped: false,
+            rect: [0.0, 0.0, 20.0, 20.0],
+            color: None,
+            index,
+            state: None,
+            quads: Vec::new(),
+            locked: false,
+            intent: None,
+            fill_sign: false,
+            no_rotate: false,
+            points: Vec::new(),
+        }
+    }
+
+    /// What stays selected or open in the editor after a delete is found where it moved to: the
+    /// reply's own replies go with it (pop-ups, unlisted, are gone too), and a page that lost
+    /// something else, or whose annotation in that place reads differently, keeps nothing.
+    #[test]
+    fn a_kept_comment_is_found_where_a_delete_moved_it() {
+        // Page 0's `/Annots`: reply A, its pop-up (unlisted), the comment, reply B, a reply to A.
+        let before = vec![
+            listed(0, 0, "A", Some((0, 2))),
+            listed(0, 2, "comment", None),
+            listed(0, 3, "B", Some((0, 2))),
+            listed(0, 4, "to A", Some((0, 0))),
+            listed(1, 0, "other page", None),
+        ];
+        // Deleting A takes its pop-up and the reply to it: the comment and B move up two places.
+        let after = vec![listed(0, 0, "comment", None), listed(0, 1, "B", Some((0, 0))), listed(1, 0, "other page", None)];
+        let gone = (0, 0);
+        assert_eq!(after_delete(&before, &after, gone, (0, 2)), Some((0, 0)), "the comment");
+        assert_eq!(after_delete(&before, &after, gone, (0, 3)), Some((0, 1)), "the other reply");
+        assert_eq!(after_delete(&before, &after, gone, (0, 4)), None, "the reply to A went with it");
+        assert_eq!(after_delete(&before, &after, gone, gone), None, "the deleted one");
+        assert_eq!(after_delete(&before, &after, gone, (1, 0)), Some((1, 0)), "another page keeps its places");
+        // The page lost more than A and its replies: nothing is guessed.
+        assert_eq!(after_delete(&before, &after[..1], gone, (0, 2)), None);
+        // Another annotation in the comment's place.
+        let changed = vec![listed(0, 0, "something else", None), listed(0, 1, "B", Some((0, 0)))];
+        assert_eq!(after_delete(&before, &changed, gone, (0, 2)), None);
+
+        let mut view = CommentView { selected: Some((0, 2)), editing: Some((0, 3, "typed".into())), ..Default::default() };
+        view.annotation_deleted(&before, &after, gone);
+        assert_eq!((view.selected, view.editing), (Some((0, 0)), Some((0, 1, "typed".into()))), "both follow");
+        let mut view = CommentView { editing: Some((0, 4, "typed".into())), editor_focus: Some(EditorFocus::Take), ..Default::default() };
+        view.annotation_deleted(&before, &after, gone);
+        assert_eq!((view.editing, view.editor_focus), (None, None), "the editor closes with the reply it was open on");
+    }
+
     use pdfcraft_render::TextGlyph;
 
     /// One glyph per character, `w` points wide, on a line of `em`-point text whose baseline is at `y`, drawn
diff --git a/crates/ui-egui/src/comments_panel.rs b/crates/ui-egui/src/comments_panel.rs
index 54ca9e5152..0d917b5cae 100644
--- a/crates/ui-egui/src/comments_panel.rs
+++ b/crates/ui-egui/src/comments_panel.rs
@@ -3,7 +3,8 @@
 //! Header "Comments N" (comments, as Acrobat counts them) with "N replies" under it and search;
 //! an "Add a comment" box that posts a sticky note on the current page; cards grouped by page.
 //! Selecting a card selects the comment on the page and opens its reply box and "…" menu (Edit,
-//! Set status, Delete). Status replies show as a badge.
+//! Set status, Delete), and gives each reply a "…" of its own (Edit, Copy text, Delete). Status
+//! replies show as a badge.
 
 use std::collections::HashMap;
 
@@ -358,27 +359,10 @@ fn card(
             });
             egui::Frame::NONE.inner_margin(egui::Margin { left: 34, right: 0, top: 4, bottom: 0 }).show(ui, |ui| {
                 ui.set_width(ui.available_width());
-                if editing && let Some((_, _, text)) = view.comments.editing.as_mut() {
-                    let r = ui.add(crate::widgets::block(text).desired_rows(2).desired_width(f32::INFINITY).id_salt(("comment-edit", key)));
-                    match view.comments.editor_focus.take() {
-                        Some(crate::comments::EditorFocus::Take) => r.request_focus(),
-                        Some(crate::comments::EditorFocus::Release) => r.surrender_focus(),
-                        None => {}
+                if editing {
+                    if let Some(e) = inline_editor(ui, t, view, key, 2) {
+                        edit = Some(e);
                     }
-                    let submit = crate::comments::submit_key(ui, &r, false);
-                    ui.horizontal(|ui| {
-                        if (ui
-                            .add(egui::Button::new(egui::RichText::new(tl!("Save")).color(Color32::WHITE)).fill(t.accent).corner_radius(12))
-                            .clicked()
-                            || submit)
-                            && let Some((page, index, text)) = view.comments.editing.take()
-                        {
-                            edit = Some(Edit::SetAnnotationContents { page, index, text });
-                        }
-                        if ui.button(tl!("Cancel")).clicked() || ui.input(|i| i.key_pressed(egui::Key::Escape)) {
-                            view.comments.editing = None;
-                        }
-                    });
                 } else {
                     let body = a.contents.as_deref().unwrap_or("");
                     if body.is_empty() {
@@ -405,6 +389,7 @@ fn card(
             for r in &replies {
                 ui.add_space(8.0);
                 let mut me = egui::Rect::NOTHING;
+                let reply_key = (r.page, r.index);
                 ui.horizontal(|ui| {
                     me = avatar(ui, t, None, Some(&initials(r.author.as_deref().unwrap_or("?"))), t.text_faint);
                     ui.vertical(|ui| {
@@ -415,8 +400,25 @@ fn card(
                             if let Some(m) = &r.modified {
                                 ui.add(egui::Label::new(egui::RichText::new(m).font(theme::regular(11.0)).color(t.text_faint)).truncate());
                             }
+                            // Each reply has its own "…" (Edit, Copy text, Delete), as in Acrobat.
+                            // A Replace Text caret is half of its comment, not a reply: it has none.
+                            if selected && allowed && !r.grouped {
+                                ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+                                    let more = icons::button(ui, "ellipsis", 20.0, false, tl!("Options for this reply"));
+                                    if let Some(e) = reply_menu(ui, view, r, &more) {
+                                        edit = Some(e);
+                                    }
+                                });
+                            }
                         });
-                        widgets::wrapped_text(ui, r.contents.as_deref().unwrap_or(""), theme::regular(12.5), t.text, false);
+                        let open = view.comments.editing.as_ref().is_some_and(|(p, i, _)| (*p, *i) == reply_key);
+                        if open {
+                            if let Some(e) = inline_editor(ui, t, view, reply_key, 1) {
+                                edit = Some(e);
+                            }
+                        } else {
+                            widgets::wrapped_text(ui, r.contents.as_deref().unwrap_or(""), theme::regular(12.5), t.text, false);
+                        }
                     });
                 });
                 // The circles are 12 px in radius; leave a 1 px gap at each end.
@@ -531,6 +533,65 @@ fn card(
     edit
 }
 
+/// The inline editor open on comment or reply `key` in the panel, with Save and Cancel; returns
+/// the edit Save makes.
+fn inline_editor(ui: &mut egui::Ui, t: &Tokens, view: &mut DocView, key: (usize, usize), rows: usize) -> Option<Edit> {
+    let mut edit = None;
+    let (_, _, text) = view.comments.editing.as_mut()?;
+    let r = ui.add(crate::widgets::block(text).desired_rows(rows).desired_width(f32::INFINITY).id_salt(("comment-edit", key)));
+    match view.comments.editor_focus.take() {
+        Some(crate::comments::EditorFocus::Take) => r.request_focus(),
+        Some(crate::comments::EditorFocus::Release) => r.surrender_focus(),
+        None => {}
+    }
+    let submit = crate::comments::submit_key(ui, &r, false);
+    ui.horizontal(|ui| {
+        if (ui.add(egui::Button::new(egui::RichText::new(tl!("Save")).color(Color32::WHITE)).fill(t.accent).corner_radius(12)).clicked() || submit)
+            && let Some((page, index, text)) = view.comments.editing.take()
+        {
+            edit = Some(Edit::SetAnnotationContents { page, index, text });
+        }
+        if ui.button(tl!("Cancel")).clicked() || ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+            view.comments.editing = None;
+        }
+    });
+    edit
+}
+
+/// A reply's "…" menu, hung from its button `more`: Edit, Copy text and Delete. Delete takes
+/// the reply alone, with what hangs off it (its own replies, status changes and pop-up), as
+/// deleting a comment takes its thread; the comment and its other replies stay. Returns the
+/// edit to apply.
+fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, more: &egui::Response) -> Option<Edit> {
+    let mut edit = None;
+    let menu_id = ui.scope_id().with(("reply-menu", r.page, r.index));
+    if more.clicked() {
+        egui::Popup::open_id(ui.ctx(), menu_id);
+    }
+    egui::Popup::new(menu_id, ui.ctx().clone(), egui::PopupAnchor::ParentRect(more.rect), ui.layer_id())
+        .open_memory(None)
+        .kind(egui::PopupKind::Menu)
+        .layout(Layout::top_down_justified(Align::Min))
+        .show(|ui| {
+            ui.set_min_width(140.0);
+            if ui.button(tl_ctx!("comment menu", "Edit")).clicked() {
+                view.comments.open_editor(r.page, r.index, r.contents.clone().unwrap_or_default());
+                ui.close();
+            }
+            if ui.button(tl!("Copy text")).clicked() {
+                ui.ctx().copy_text(r.contents.clone().unwrap_or_default());
+                ui.close();
+            }
+            ui.separator();
+            // The card stays selected: the app finds its comment again after the delete.
+            if ui.add_enabled(!r.locked, egui::Button::new(tl!("Delete"))).clicked() {
+                edit = Some(Edit::DeleteAnnotation { page: r.page, index: r.index });
+                ui.close();
+            }
+        });
+    edit
+}
+
 /// A 26 pt round badge: a type glyph (comments) or initials (replies). Returns where it was drawn.
 fn avatar(ui: &mut egui::Ui, t: &Tokens, icon: Option<&str>, text: Option<&str>, color: Color32) -> egui::Rect {
     let (r, _) = ui.allocate_exact_size(vec2(26.0, 26.0), Sense::hover());
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 9a13d570d9..1ae66561b8 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -53,6 +53,12 @@ impl PdfCraftApp {
         } else {
             (None, 0, false)
         };
+        // A deletion moves the comments after it on the page: these say where the selected one,
+        // and the one open in the panel's editor, went.
+        let annots_before = match (&edit, self.session.get(id)) {
+            (Edit::DeleteAnnotation { page, .. }, Some(d)) => d.info.annotations.iter().filter(|a| a.page == *page).cloned().collect(),
+            _ => Vec::new(),
+        };
         match self.session.apply(id, edit.clone()) {
             Ok(()) => {
                 let Some(doc) = self.session.get(id) else { return true };
@@ -172,7 +178,7 @@ impl PdfCraftApp {
                             view.comments.open_editor(a.page, n, String::new());
                         }
                     }
-                    Edit::DeleteAnnotation { .. } => view.comments.selected = None,
+                    Edit::DeleteAnnotation { page, index } => view.comments.annotation_deleted(&annots_before, &info.annotations, (page, index)),
                     _ => {}
                 }
                 if std::mem::take(&mut view.comments.tool_done) && !self.comment_prefs.pinned {
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 3e6d735523..1ae1d5ca1d 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -2833,3 +2833,6 @@ certificate	Version	الإصدار
 	Rotate the selected pages clockwise	تدوير الصفحات المحددة باتجاه عقارب الساعة
 	Extract the selected pages…	استخراج الصفحات المحددة…
 	Delete the selected pages	حذف الصفحات المحددة
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	خيارات هذا الرد
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index ec0339f18a..30064446bc 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -2520,3 +2520,6 @@ animation effects	Off	Изключени
 	Rotate the selected pages clockwise	Завъртане на избраните страници по часовниковата стрелка
 	Extract the selected pages…	Извличане на избраните страници…
 	Delete the selected pages	Изтриване на избраните страници
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Опции за този отговор
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 0cacae3c2c..6917f86d45 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -2818,3 +2818,6 @@ theme	Appearance	Aspecte
 	Rotate the selected pages clockwise	Gira les pàgines seleccionades en sentit horari
 	Extract the selected pages…	Extreu les pàgines seleccionades…
 	Delete the selected pages	Suprimeix les pàgines seleccionades
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opcions d'aquesta resposta
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index 71c0c62869..457da979a4 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -2749,3 +2749,6 @@ certificate	Version	وەشان
 	Rotate the selected pages clockwise	پەڕە هەڵبژێردراوەکان بە ئاڕاستەی میلی کاتژمێر بسوڕێنە
 	Extract the selected pages…	پەڕە هەڵبژێردراوەکان دەربهێنە…
 	Delete the selected pages	پەڕە هەڵبژێردراوەکان بسڕەوە
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	هەڵبژاردەکانی ئەم وەڵامە
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index ed6d051b57..c8e2c7de10 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -2864,3 +2864,6 @@ certificate	Version	Verze
 	Rotate the selected pages clockwise	Otočit vybrané stránky po směru hodinových ručiček
 	Extract the selected pages…	Extrahovat vybrané stránky…
 	Delete the selected pages	Odstranit vybrané stránky
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Možnosti této odpovědi
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 8586a21d43..fa34681ad6 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -2558,3 +2558,6 @@ animation effects	Off	Aus
 	Rotate the selected pages clockwise	Ausgewählte Seiten im Uhrzeigersinn drehen
 	Extract the selected pages…	Ausgewählte Seiten extrahieren…
 	Delete the selected pages	Ausgewählte Seiten löschen
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Optionen für diese Antwort
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index e3eac77caa..2d16480209 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -2563,3 +2563,6 @@ animation effects	Off	Ανενεργά
 	Rotate the selected pages clockwise	Περιστροφή των επιλεγμένων σελίδων δεξιόστροφα
 	Extract the selected pages…	Εξαγωγή των επιλεγμένων σελίδων…
 	Delete the selected pages	Διαγραφή των επιλεγμένων σελίδων
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Επιλογές για αυτήν την απάντηση
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 0d4e505a70..51eb3f9483 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -2880,3 +2880,6 @@ theme	Appearance	Aspecto
 	Rotate the selected pages clockwise	Girar las páginas seleccionadas en sentido horario
 	Extract the selected pages…	Extraer las páginas seleccionadas…
 	Delete the selected pages	Eliminar las páginas seleccionadas
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opciones de esta respuesta
diff --git a/crates/ui-egui/src/i18n/fa.tsv b/crates/ui-egui/src/i18n/fa.tsv
index 5cfc217533..5c7279dfdc 100644
--- a/crates/ui-egui/src/i18n/fa.tsv
+++ b/crates/ui-egui/src/i18n/fa.tsv
@@ -2804,3 +2804,6 @@ theme	Appearance	ظاهر
 	two cells would both be named {name}	دو خانه هر دو با نام {name} نام‌گذاری می‌شوند
 	a field named {name} already exists	فیلدی با نام {name} از قبل وجود دارد
 	Today	امروز
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	گزینه‌های این پاسخ
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index a542ee9b91..7742ef6aeb 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -2827,3 +2827,6 @@ theme	Appearance	Teema
 	Rotate the selected pages clockwise	Kierrä valittuja sivuja myötäpäivään
 	Extract the selected pages…	Pura valitut sivut…
 	Delete the selected pages	Poista valitut sivut
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Tämän vastauksen asetukset
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 61c8b5171d..a8df3184fa 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2823,3 +2823,6 @@ certificate	Version	Version
 	Rotate the selected pages clockwise	Faire pivoter les pages sélectionnées dans le sens horaire
 	Extract the selected pages…	Extraire les pages sélectionnées…
 	Delete the selected pages	Supprimer les pages sélectionnées
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Options de cette réponse
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index e9d627aca9..1e239dcd7a 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -2794,3 +2794,6 @@ theme	Appearance	स्वरूप
 	Rotate the selected pages clockwise	चयनित पृष्ठों को दक्षिणावर्त घुमाएँ
 	Extract the selected pages…	चयनित पृष्ठ निकालें…
 	Delete the selected pages	चयनित पृष्ठ हटाएँ
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	इस जवाब के विकल्प
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 6b37b9169b..14e2399a20 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -2556,3 +2556,6 @@ animation effects	Off	Ki
 	Rotate the selected pages clockwise	A kijelölt oldalak forgatása az óramutató járásával megegyezően
 	Extract the selected pages…	A kijelölt oldalak kibontása…
 	Delete the selected pages	A kijelölt oldalak törlése
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	A válasz beállításai
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 292b336e10..e2eecad04e 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -2795,3 +2795,6 @@ theme	Appearance	Tampilan
 	Rotate the selected pages clockwise	Putar halaman yang dipilih searah jarum jam
 	Extract the selected pages…	Ekstrak halaman yang dipilih…
 	Delete the selected pages	Hapus halaman yang dipilih
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opsi untuk balasan ini
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 20729bae6a..e24c7239f5 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -2789,3 +2789,6 @@ certificate	SHA-256 digest	Impronta SHA-256
 	Rotate the selected pages clockwise	Ruota le pagine selezionate in senso orario
 	Extract the selected pages…	Estrai le pagine selezionate…
 	Delete the selected pages	Elimina le pagine selezionate
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opzioni per questa risposta
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 1ed4d43b6c..62334da62c 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -2557,3 +2557,6 @@ animation effects	Off	オフ
 	Rotate the selected pages clockwise	選択したページを時計回りに回転
 	Extract the selected pages…	選択したページを抽出…
 	Delete the selected pages	選択したページを削除
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	この返信のオプション
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 9022c3591c..f79ad88476 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -2555,3 +2555,6 @@ animation effects	Off	Өшірулі
 	Rotate the selected pages clockwise	Таңдалған беттерді сағат тілімен бұру
 	Extract the selected pages…	Таңдалған беттерді шығарып алу…
 	Delete the selected pages	Таңдалған беттерді жою
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Осы жауаптың параметрлері
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 09b9cad9fa..3d543237b3 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -2794,3 +2794,6 @@ theme	Appearance	모양
 	Rotate the selected pages clockwise	선택한 페이지를 시계 방향으로 회전
 	Extract the selected pages…	선택한 페이지 추출…
 	Delete the selected pages	선택한 페이지 삭제
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	이 답글의 옵션
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index 964467d823..ce4f67ebe2 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -2465,3 +2465,6 @@ animation effects	Off	ປິດ
 	Rotate the selected pages clockwise	ໝູນໜ້າທີ່ເລືອກຕາມເຂັມໂມງ
 	Extract the selected pages…	ແຍກໜ້າທີ່ເລືອກອອກ…
 	Delete the selected pages	ລຶບໜ້າທີ່ເລືອກ
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	ຕົວເລືອກຂອງການຕອບກັບນີ້
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 43749f4ec8..da076f4559 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -2818,3 +2818,6 @@ theme	Appearance	Išvaizda
 	Rotate the selected pages clockwise	Pasukti pasirinktus puslapius pagal laikrodžio rodyklę
 	Extract the selected pages…	Išskleisti pasirinktus puslapius…
 	Delete the selected pages	Ištrinti pasirinktus puslapius
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Šio atsakymo parinktys
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index 6f1739974a..b7522c2084 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -2733,3 +2733,6 @@ key	Space	Mellomrom
 	Rotate the selected pages clockwise	Roter de valgte sidene med klokken
 	Extract the selected pages…	Trekk ut de valgte sidene…
 	Delete the selected pages	Slett de valgte sidene
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Alternativer for dette svaret
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 963d717584..75756768d5 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -2653,3 +2653,6 @@ animation effects	Off	Wyłączone
 	Rotate the selected pages clockwise	Obróć zaznaczone strony w prawo
 	Extract the selected pages…	Wyodrębnij zaznaczone strony…
 	Delete the selected pages	Usuń zaznaczone strony
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opcje tej odpowiedzi
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index c34ae83bc5..24dcb6247f 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -2842,3 +2842,6 @@ theme	Appearance	Aparência
 	Rotate the selected pages clockwise	Girar as páginas selecionadas no sentido horário
 	Extract the selected pages…	Extrair as páginas selecionadas…
 	Delete the selected pages	Excluir as páginas selecionadas
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opções desta resposta
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 78d2298b93..02e383e77c 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -2818,3 +2818,6 @@ theme	Appearance	Aspect
 	Rotate the selected pages clockwise	Rotește paginile selectate în sens orar
 	Extract the selected pages…	Extrage paginile selectate…
 	Delete the selected pages	Șterge paginile selectate
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opțiuni pentru acest răspuns
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 274232d586..0429bd944b 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -2470,3 +2470,6 @@ animation effects	Off	Выкл
 	Rotate the selected pages clockwise	Повернуть выбранные страницы по часовой стрелке
 	Extract the selected pages…	Извлечь выбранные страницы…
 	Delete the selected pages	Удалить выбранные страницы
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Параметры этого ответа
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 420e6a5996..50d8fd345a 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -2562,3 +2562,6 @@ animation effects	Off	Izklopljeni
 	Rotate the selected pages clockwise	Zavrti izbrane strani v smeri urnega kazalca
 	Extract the selected pages…	Izvleci izbrane strani…
 	Delete the selected pages	Izbriši izbrane strani
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Možnosti tega odgovora
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index ba7c9dc5b3..d0306f2430 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -2544,3 +2544,6 @@ animation effects	Off	Joaktiv
 	Rotate the selected pages clockwise	Rrotullo faqet e përzgjedhura në drejtim të orës
 	Extract the selected pages…	Nxirr faqet e përzgjedhura…
 	Delete the selected pages	Fshi faqet e përzgjedhura
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Opsionet për këtë përgjigje
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 7f339989ee..84ae40746b 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -2466,3 +2466,6 @@ animation effects	Off	ఆఫ్
 	Rotate the selected pages clockwise	ఎంచుకున్న పేజీలను సవ్య దిశలో తిప్పు
 	Extract the selected pages…	ఎంచుకున్న పేజీలను సంగ్రహించు…
 	Delete the selected pages	ఎంచుకున్న పేజీలను తొలగించు
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	ఈ ప్రత్యుత్తరం ఎంపికలు
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index 2c9b892ed7..a13e6e3332 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -2720,3 +2720,6 @@ theme	Appearance	ลักษณะที่ปรากฏ
 	Rotate the selected pages clockwise	หมุนหน้าที่เลือกตามเข็มนาฬิกา
 	Extract the selected pages…	แยกหน้าที่เลือกออก…
 	Delete the selected pages	ลบหน้าที่เลือก
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	ตัวเลือกของการตอบกลับนี้
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index a2ecaea179..7695241b30 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -2553,3 +2553,6 @@ animation effects	Off	Kapalı
 	Rotate the selected pages clockwise	Seçili sayfaları saat yönünde döndür
 	Extract the selected pages…	Seçili sayfaları ayıkla…
 	Delete the selected pages	Seçili sayfaları sil
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Bu yanıtın seçenekleri
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 9c76868839..6f31d9d32a 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2579,3 +2579,6 @@ animation effects	Off	Вимкнено
 	Rotate the selected pages clockwise	Повернути вибрані сторінки за годинниковою стрілкою
 	Extract the selected pages…	Витягнути вибрані сторінки…
 	Delete the selected pages	Видалити вибрані сторінки
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Параметри цієї відповіді
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 973ba870ea..e43fdd3404 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -2824,3 +2824,6 @@ key	Space	Space
 	Rotate the selected pages clockwise	Xoay các trang đã chọn theo chiều kim đồng hồ
 	Extract the selected pages…	Trích xuất các trang đã chọn…
 	Delete the selected pages	Xóa các trang đã chọn
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	Tùy chọn cho câu trả lời này
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index d77c8f6425..7b63830365 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2521,3 +2521,6 @@ animation effects	Off	关
 	Rotate the selected pages clockwise	顺时针旋转所选页面
 	Extract the selected pages…	提取所选页面…
 	Delete the selected pages	删除所选页面
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	此回复的选项
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index ce3b939f1d..8f0ea1bed3 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -2507,3 +2507,6 @@ animation effects	Off	關
 	Rotate the selected pages clockwise	順時針旋轉所選頁面
 	Extract the selected pages…	擷取所選頁面…
 	Delete the selected pages	刪除所選頁面
+
+# Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
+	Options for this reply	此回覆的選項
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 3a3169576c..f8c26b59b8 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -4,7 +4,7 @@
 use egui::accesskit::Role;
 use egui::{Pos2, pos2};
 use egui_kittest::Harness;
-use egui_kittest::kittest::Queryable;
+use egui_kittest::kittest::{NodeT, Queryable};
 use pdfcraft_render::Annotation;
 use pdfcraft_ui_egui::{PdfCraftApp, QuickTool};
 
@@ -1327,6 +1327,98 @@ fn replies_follow_irt_references_when_names_repeat_on_every_page() {
     h.get_by_label("2 replies");
 }
 
+// Contributor-original PDF: a comment whose wrong reply (with a pop-up) comes before it in
+// `/Annots` and has an answer of its own, a locked right reply and an Accepted status. `/F 128`
+// is the Locked flag.
+const REPLY_THREAD: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [5 0 R 9 0 R 4 0 R 6 0 R 7 0 R 8 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (note) /T (Ben) /Contents (The comment) >> endobj
+5 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (wrong) /IRT 4 0 R /T (Cat) /Contents (Wrong reply) /Popup 9 0 R >> endobj
+6 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (right) /IRT 4 0 R /T (Dan) /Contents (Right reply) /F 128 >> endobj
+7 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (answer) /IRT 5 0 R /T (Eve) /Contents (Answer to the wrong reply) >> endobj
+8 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /IRT 4 0 R /StateModel /Review /State /Accepted /T (Ben) /Contents (Accepted set by Ben) >> endobj
+9 0 obj << /Type /Annot /Subtype /Popup /Rect [60 100 160 160] /Parent 5 0 R >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+/// The "…" of the reply row that shows `text`: the last one above it (it sits on the row's
+/// author line).
+fn reply_options<'a>(h: &'a Harness<'static, PdfCraftApp>, text: &str) -> egui_kittest::Node<'a> {
+    let y = h.get_by_label(text).rect().top();
+    h.query_all_by_label("Options for this reply")
+        .filter(|b| b.rect().top() <= y)
+        .max_by(|a, b| a.rect().top().total_cmp(&b.rect().top()))
+        .expect("a reply menu")
+}
+
+/// One reply is deleted from its own "…" menu, with the answer to it and its pop-up: the comment,
+/// its other reply and its status stay, and the card stays selected though the comment moved up
+/// in `/Annots`. One undo brings the reply back. A locked reply can't be deleted, and Edit
+/// changes the reply's text, not the comment's.
+#[test]
+fn one_reply_is_deleted_from_its_menu_and_the_thread_stays() {
+    let mut h = harness_with_bytes(REPLY_THREAD.to_vec(), |app| {
+        app.set_option("panel", "comments").unwrap();
+        app.views[0].comments.selected = Some((0, 2));
+    });
+    let texts = |h: &Harness<'static, PdfCraftApp>| -> Vec<String> { comments(h).iter().filter_map(|a| a.contents.clone()).collect() };
+    let all = ["Wrong reply", "The comment", "Right reply", "Answer to the wrong reply", "Accepted set by Ben"];
+    assert_eq!(texts(&h), all);
+    assert_eq!(h.query_all_by_label("Options for this reply").count(), 3, "each reply has one; the status is a badge");
+
+    reply_options(&h, "Wrong reply").click();
+    h.run_steps(2);
+    h.get_by_label("Delete").click();
+    h.run_steps(3);
+    assert_eq!(texts(&h), ["The comment", "Right reply", "Accepted set by Ben"], "the reply took its answer along");
+    let id = h.state().views[0].id;
+    assert_eq!(h.state().session.get(id).unwrap().info.annotations[0].index, 0, "its pop-up went too");
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 0)), "the card stays selected where the comment now is");
+    assert_eq!(h.query_all_by_label("Wrong reply").count(), 0);
+    assert_eq!(h.query_all_by_label("Answer to the wrong reply").count(), 0);
+    h.get_by_label("Right reply");
+    h.get_by_label("Accepted");
+    assert_eq!(h.state().session.get(id).unwrap().can_undo(), Some("Delete comment"), "one undo step");
+
+    // Copy text copies the reply's text.
+    reply_options(&h, "Right reply").click();
+    h.run_steps(2);
+    h.get_by_label("Copy text").click();
+    let mut copied = false;
+    for _ in 0..4 {
+        h.step();
+        copied |= h.output().platform_output.commands.iter().any(|c| matches!(c, egui::OutputCommand::CopyText(t) if t == "Right reply"));
+    }
+    assert!(copied, "the reply's text is copied");
+    h.run_steps(2);
+
+    // The locked reply's Delete is greyed out; its text can still be edited (ISO 32000-2
+    // Table 167: Locked doesn't restrict the contents).
+    reply_options(&h, "Right reply").click();
+    h.run_steps(2);
+    assert!(h.get_by_label("Delete").accesskit_node().is_disabled(), "a locked reply isn't deleted");
+    h.query_all_by_label("Edit").last().expect("the reply menu's Edit, after the toolbar tab").click();
+    h.run_steps(2);
+    let editor = h.query_all_by(|n| n.role() == Role::MultilineTextInput && n.placeholder() != Some("Add a reply")).next().expect("reply editor");
+    editor.click();
+    h.run_steps(1);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+    h.event(egui::Event::Text("Right reply, reworded".into()));
+    h.run_steps(2);
+    h.get_by_label("Save").click();
+    h.run_steps(3);
+    assert_eq!(texts(&h), ["The comment", "Right reply, reworded", "Accepted set by Ben"]);
+
+    h.state_mut().undo();
+    h.run_steps(2);
+    h.state_mut().undo();
+    h.run_steps(3);
+    assert_eq!(texts(&h), all, "undo brings the reply and its answer back");
+    h.get_by_label("Wrong reply");
+}
+
 #[test]
 fn the_header_names_no_replies_when_there_are_none() {
     let h = harness_with_bytes(PER_PAGE_NAMES.to_vec(), |app| {
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 40fa711c24..f1c3bfa106 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,5 +1,6 @@
 # PdfCraft roadmap: milestones and what's next
 
+> **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M5: one reply in the Comments panel is edited, copied or deleted from its own "…" menu; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
@@ -177,7 +178,7 @@ total matches the parity estimate.
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Organize opens directly into the page overview, with checkbox selection, an editable page-range selection (#1092), and per-page rotate/delete controls; Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Extract and Split preserve shared Type 3 glyph resource graphs, retaining conservative pruning limits. Missing: page transitions, recovery on the web M4: Insert-from-file preserves source bookmarks; integration tests retained with current main. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Renderer-creation errors return to the existing OpenGL startup fallback; a real-GPU regression covers errors and device reuse. The underlying x86 DX12 shader compiler failure remains unresolved; see `windows-renderer-startup.md`. With Windows' Animation effects turned off, the wheel scrolls and zooms without easing and egui's animations take no time (`motion.rs`; macOS, Linux and the browser aren't asked yet); Preferences ▸ Animation effects (Use system setting, On, Off) decides it on every platform. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web |
-| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: replies thread by their `/IRT` reference rather than the parent's `/NM`, so files that repeat names per page (PyMuPDF) thread correctly, and the Comments header counts comments without their replies, as Acrobat does, with the reply count under it; the Comments panel groups replies and counts all page roots once per frame (#2669, item 5); stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles; Ctrl+Enter submission for highlight comment text and replies, with Shift+Enter newlines (reconciled with upstream main for PR #1457 on 2026-10-14). Missing: custom stamps, replace-text proposals, summary layouts with the page |
+| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: replies thread by their `/IRT` reference rather than the parent's `/NM`, so files that repeat names per page (PyMuPDF) thread correctly, and the Comments header counts comments without their replies, as Acrobat does, with the reply count under it; the Comments panel groups replies and counts all page roots once per frame (#2669, item 5); each reply in the Comments panel has its own "…" (Edit, Copy text, Delete): Delete takes that reply and the replies to it, the comment and its other replies stay, and the card stays selected; stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles; Ctrl+Enter submission for highlight comment text and replies, with Shift+Enter newlines (reconciled with upstream main for PR #1457 on 2026-10-14). Missing: custom stamps, replace-text proposals, summary layouts with the page |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web M4: Insert-from-file preserves source bookmarks; integration tests retained with current main. |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links; nested FDF export uses lazy array owners and annotation positions, with retained entries budgeted before cloning under copied-graph limits and source `/Page` and `/Pages` dictionaries replaced by null at every copy depth); flatten; Fill & Sign with adjustable text/date size; agent tools.<br>Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. A refused restyle or resize of a text box another program drew leaves that comment unchanged (#1327). Make Current Properties Default on an arrow updates arrows, not plain lines (#1302). Flattening keeps a visible comment it cannot draw (#1317). Missing: custom stamps, replace-text proposals, summary layouts with the page |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 5e1c4a7e75..b846d36701 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -3967,8 +3967,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_reply"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::the_panel_posts_comments_and_replies", "crates/ui-egui/tests/it/comments.rs::ctrl_enter_posts_a_reply_and_shift_enter_adds_a_line", "crates/annot/src/tests.rs::replies_and_status_thread_onto_the_parent"]
-notes = "multiline reply field: Enter or Ctrl+Enter (also Command+Enter) posts, Shift+Enter adds a newline; empty replies are not posted"
+evidence = ["crates/ui-egui/tests/it/comments.rs::the_panel_posts_comments_and_replies", "crates/ui-egui/tests/it/comments.rs::ctrl_enter_posts_a_reply_and_shift_enter_adds_a_line", "crates/annot/src/tests.rs::replies_and_status_thread_onto_the_parent", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays"]
+notes = "multiline reply field: Enter or Ctrl+Enter (also Command+Enter) posts, Shift+Enter adds a newline; empty replies are not posted. On the selected card each reply has its own \"…\" menu (Edit, Copy text, Delete); a Replace Text caret, half of its comment, has none. Missing: Set status on a reply from its menu, @mentions"
 
 [[feature]]
 id = "comment.set-status"
@@ -4003,8 +4003,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_delete"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain"]
-notes = "deletes the pop-up and the reply thread"
+evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/comments.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies"]
+notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted."
 
 [[feature]]
 id = "comment.keyboard-nudge"
@@ -4039,8 +4039,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_edit"]
-evidence = ["crates/annot/src/tests.rs::text_box_text_and_colour_changes_are_drawn", "crates/annot/src/tests.rs::editing_a_text_box_refits_its_rectangle", "crates/automation/tests/it/automation.rs::comments_through_tools", "crates/ui-egui/tests/it/comments.rs::ctrl_enter_posts_a_highlight_comment_and_shift_enter_adds_a_line"]
-notes = "double-click a comment or card, or Edit in the menus; Ctrl+Enter (also Command+Enter) saves text in the focused comment editor, Shift+Enter adds a newline; a text box's rectangle follows the new text (wrap width and top edge stay, the height fits the wrapped lines)"
+evidence = ["crates/annot/src/tests.rs::text_box_text_and_colour_changes_are_drawn", "crates/annot/src/tests.rs::editing_a_text_box_refits_its_rectangle", "crates/automation/tests/it/automation.rs::comments_through_tools", "crates/ui-egui/tests/it/comments.rs::ctrl_enter_posts_a_highlight_comment_and_shift_enter_adds_a_line", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays"]
+notes = "double-click a comment or card, or Edit in the menus (a reply from its own \"…\" menu); Ctrl+Enter (also Command+Enter) saves text in the focused comment editor, Shift+Enter adds a newline; a text box's rectangle follows the new text (wrap width and top edge stay, the height fits the wrapped lines)"
 
 [[feature]]
 id = "comment.copy-comment-text"
@@ -4051,8 +4051,8 @@ milestone = "M5"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/comments.rs::comments_take_checkmarks_lock_hide_and_summarize"]
-notes = "card and canvas context menus"
+evidence = ["crates/ui-egui/tests/it/comments.rs::comments_take_checkmarks_lock_hide_and_summarize", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays"]
+notes = "card, reply and canvas context menus"
 
 [[feature]]
 id = "comment.filter-comments"

From 0a6d0f3689c82658906a5a020701beebfb30ffa8 Mon Sep 17 00:00:00 2001
From: jonathanwxh-cell <258340642+jonathanwxh-cell@users.noreply.github.com>
Date: Mon, 26 Oct 2026 10:00:14 +0000
Subject: [PATCH 036/132] fix(crypt): derive a new file id from the encryption
 seed

/ID is SHA-256 of the seed under the label id, not an unkeyed DefaultHasher digest. The salts test is a characterization; failing closed when randomness is missing stays the regression guard.

Co-authored-by: jonathanwxh-cell <jonathanwxh-cell@users.noreply.github.com>
---
 crates/cos/src/document.rs | 47 ++++++++++++++++++++++++++------------
 crates/crypt/src/lib.rs    | 10 +++++++-
 crates/crypt/src/tests.rs  | 10 ++++++++
 crates/engine/src/tests.rs |  6 +++++
 4 files changed, 58 insertions(+), 15 deletions(-)

diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index ae00234d0e..46b57d1717 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -792,8 +792,7 @@ impl Document {
         let id0 = match self.trailer.get(b"ID") {
             Some(Object::Array(a)) if a.len() == 2 => a[0].as_string().map(|s| s.bytes.clone()).unwrap_or_default(),
             _ => {
-                let mut id = generated_id(&params.seed);
-                id.truncate(16);
+                let id = pdfcraft_crypt::file_id(&params.seed);
                 let s = Object::String(crate::PdfString { bytes: id.clone(), hex: true });
                 self.trailer.set(b"ID".to_vec(), Object::Array(vec![s.clone(), s]));
                 id
@@ -2191,18 +2190,6 @@ fn rfind(hay: &[u8], needle: &[u8], from: usize) -> Option<usize> {
     (from..=hay.len() - needle.len()).rev().find(|&i| &hay[i..i + needle.len()] == needle)
 }
 
-/// A file identifier derived from entropy supplied by the caller.
-fn generated_id(seed: &[u8; 32]) -> Vec<u8> {
-    use std::hash::{Hash, Hasher};
-    let mut out = Vec::new();
-    for i in 0..2u8 {
-        let mut h = std::collections::hash_map::DefaultHasher::new();
-        (seed, i, b"pdfcraft id").hash(&mut h);
-        out.extend_from_slice(&h.finish().to_be_bytes());
-    }
-    out
-}
-
 /// The object number a classic xref subsection really starts at. A common producer bug heads the
 /// table `1 n` and then writes object 0's free entry (`0000000000 65535 f`) as its first row, so
 /// every row would be read one number too high and object 1 as free. Such a subsection is read
@@ -2250,6 +2237,38 @@ const MAX_XREF_OBJECTS: usize = 8_388_607;
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_missing_file_id_is_derived_from_the_encryption_seed() {
+        let mut doc = Document::new_empty();
+        let seed = [9u8; 32];
+        doc.set_encryption(&pdfcraft_crypt::NewEncryption {
+            algorithm: pdfcraft_crypt::Algorithm::Aes256,
+            user_password: "user",
+            owner_password: "owner",
+            permissions: -4,
+            encrypt_metadata: true,
+            seed,
+        })
+        .unwrap();
+        let id = doc.trailer().get(b"ID").and_then(|o| o.as_array()).and_then(|a| a.first()).and_then(|o| o.as_string()).map(|s| s.bytes.clone());
+        assert_eq!(id.as_deref(), Some(pdfcraft_crypt::file_id(&seed).as_slice()));
+
+        let mut kept = Document::new_empty();
+        let fixed = Object::String(crate::PdfString { bytes: b"0123456789abcdef".to_vec(), hex: true });
+        kept.trailer_mut().set(b"ID".to_vec(), Object::Array(vec![fixed.clone(), fixed]));
+        kept.set_encryption(&pdfcraft_crypt::NewEncryption {
+            algorithm: pdfcraft_crypt::Algorithm::Aes256,
+            user_password: "user",
+            owner_password: "owner",
+            permissions: -4,
+            encrypt_metadata: true,
+            seed,
+        })
+        .unwrap();
+        let still = kept.trailer().get(b"ID").and_then(|o| o.as_array()).and_then(|a| a.first()).and_then(|o| o.as_string()).map(|s| s.bytes.clone());
+        assert_eq!(still.as_deref(), Some(b"0123456789abcdef".as_slice()));
+    }
+
     #[test]
     fn a_read_state_matches_a_clone_and_no_changed_document() {
         let mut doc = Document::new_empty();
diff --git a/crates/crypt/src/lib.rs b/crates/crypt/src/lib.rs
index 82b598688a..ba9a63581c 100644
--- a/crates/crypt/src/lib.rs
+++ b/crates/crypt/src/lib.rs
@@ -602,12 +602,20 @@ fn expand(seed: &[u8; 32], label: &[u8], n: usize) -> Vec<u8> {
         h.update(label);
         h.update(counter.to_le_bytes());
         out.extend_from_slice(&h.finalize());
-        counter += 1;
+        counter = counter.saturating_add(1);
     }
     out.truncate(n);
     out
 }
 
+/// Sixteen bytes of file identifier from `seed` (SHA-256 in counter mode, label `id`).
+///
+/// `/ID` is written in the clear. Deriving it the same way as the file key keeps that public
+/// value from being an unkeyed hash of the seed.
+pub fn file_id(seed: &[u8; 32]) -> Vec<u8> {
+    expand(seed, b"id", 16)
+}
+
 /// Build the `/Encrypt` values and an authenticated (owner) handler for a new encryption.
 pub fn create(params: &NewEncryption, id0: &[u8]) -> Result<SecurityHandler, CryptError> {
     // Bits 7–8 and 13–32 must be 1; bits 1–2 must be 0 (§7.6.4.2).
diff --git a/crates/crypt/src/tests.rs b/crates/crypt/src/tests.rs
index 5110e79998..e684f1ef2e 100644
--- a/crates/crypt/src/tests.rs
+++ b/crates/crypt/src/tests.rs
@@ -4,6 +4,16 @@ fn hex(s: &str) -> Vec<u8> {
     (0..s.len()).step_by(2).map(|i| u8::from_str_radix(&s[i..i + 2], 16).unwrap()).collect()
 }
 
+#[test]
+fn file_id_is_a_one_way_16_byte_identifier() {
+    let seed = [7u8; 32];
+    let id = file_id(&seed);
+    assert_eq!(id.len(), 16);
+    assert_eq!(id, file_id(&seed));
+    assert_ne!(id, seed[..16]);
+    assert_ne!(id, file_id(&[8u8; 32]));
+}
+
 #[test]
 fn rc4_reference_vectors() {
     assert_eq!(rc4(b"Key", b"Plaintext"), hex("bbf316e8d940af0ad3"));
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 6895f188f3..ceb3f1c34f 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1886,6 +1886,12 @@ fn passwords_that_encryption_would_make_empty_or_equal_are_refused() {
 
 #[test]
 fn fresh_sessions_protecting_identical_documents_produce_different_salts() {
+    // Characterization only: two sessions' salts differ. A per-call RandomState already did
+    // that before Protect drew from the platform CSPRNG, so this does not prove the source.
+    // `protect_fails_closed_when_randomness_is_unavailable` is the guard. It does not compile
+    // against a Protect with no CSPRNG hook, and it fails closed when that hook errors or
+    // returns zeros. Comparing the stored function with `getrandom::fill` is not reliable:
+    // one function can have different addresses in different codegen units.
     let raw = Arc::new(fixture(1));
     let encrypt_bytes = |saved: Arc<Vec<u8>>, key: &[u8]| -> Vec<u8> {
         let doc = pdfcraft_cos::Document::open_with_password(saved, Some("secret")).unwrap();

From 0cdd6592077595d85322959f850d13ad121b4a6a Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Mon, 26 Oct 2026 21:20:26 +0100
Subject: [PATCH 037/132] chore: Cargo.lock: pdfcraft-edit's sha2 follows
 main's 0.11.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Cargo.lock b/Cargo.lock
index 7957416fe3..5e41927f2c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4216,7 +4216,7 @@ dependencies = [
  "pdfcraft-cos",
  "pdfcraft-fonts",
  "pdfcraft-model",
- "sha2 0.11.0",
+ "sha2 0.11.1",
  "thiserror 2.0.21",
  "unicode-bidi",
 ]

From 64fba7d177032170939861dc7eb51d8486a43264 Mon Sep 17 00:00:00 2001
From: Hitesh <shahagra@gmail.com>
Date: Sun, 25 Oct 2026 13:46:51 +0530
Subject: [PATCH 038/132] feat(edit): Esc in an open paragraph selects its box,
 so Delete removes it

In Edit text & images a click inside a paragraph opens it for typing, and selecting the whole
box meant aiming for its thin frame: a press a few pixels inside put the caret in the text
instead (#2203). Esc in the inline editor now leaves the text and selects the paragraph's box,
as Acrobat does, so Esc then Delete removes it, the arrow keys nudge it and its frame drags it.
Esc still discards an unapplied draft.

The editor asks `ObjectSelection` to select the paragraph, and the next `prepare`, which has the
document's inventory, selects it after its own Escape check, so the Esc that closed the editor
cannot clear the new selection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/tools/edit_text_ui.rs |  3 ++
 crates/ui-egui/src/tools/object_ui.rs    | 20 ++++++++++++++
 crates/ui-egui/tests/it/editing.rs       | 35 ++++++++++++++++++++++++
 parity/acrobat-features.toml             |  4 +--
 4 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index 66daa6edb8..11bf52fbb7 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -664,6 +664,9 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
         Some(apply) => {
             let ed = view.line_editor.take()?;
             if !apply {
+                // Esc leaves the text but not the paragraph: its box is selected, as in Acrobat,
+                // so Delete removes it without aiming for the frame. The draft is discarded.
+                view.objects.select_paragraph_next(ed.page, ed.block);
                 return None;
             }
             view.applied_editor = Some(ed.clone());
diff --git a/crates/ui-egui/src/tools/object_ui.rs b/crates/ui-egui/src/tools/object_ui.rs
index d495116c6c..e54446297c 100644
--- a/crates/ui-egui/src/tools/object_ui.rs
+++ b/crates/ui-egui/src/tools/object_ui.rs
@@ -25,6 +25,9 @@ pub(crate) struct ObjectSelection {
     pub hold_editor: bool,
     blocked_page: Option<usize>,
     input_blocked: bool,
+    /// A paragraph (page, block) to select once the document is at hand: Esc in the inline
+    /// editor asks for it, and the next `prepare` selects it.
+    select_paragraph: Option<(usize, usize)>,
 }
 
 #[derive(Clone, Copy)]
@@ -62,6 +65,14 @@ impl ObjectSelection {
         self.gesture = None;
         self.pending = None;
         self.blocked_page = None;
+        self.select_paragraph = None;
+    }
+
+    /// Select paragraph `block` of `page` as an object at the next `prepare`, as Acrobat does
+    /// when Esc leaves a text box: the box is then selected, so Delete removes it, the arrow keys
+    /// move it and its frame drags it, without aiming for the frame.
+    pub(crate) fn select_paragraph_next(&mut self, page: usize, block: usize) {
+        self.select_paragraph = Some((page, block));
     }
 
     pub fn prepare(&mut self, doc: &Document, enabled: bool, ctx: &egui::Context) {
@@ -106,6 +117,15 @@ impl ObjectSelection {
         if self.page.is_some() && ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
             self.clear();
         }
+        // After the Escape check: the Esc that closed the editor must not clear what it selected.
+        if let Some((page, block)) = self.select_paragraph.take()
+            && let Ok(objects) = self.inventory(doc, page)
+            && let Some(object) = objects.into_iter().find(|o| o.target == ObjectTarget { kind: ObjectKind::Text, index: block })
+        {
+            self.clear();
+            self.page = Some(page);
+            self.selected.push(object);
+        }
     }
 
     /// The move of the whole selection by `offset` (user space). The selection follows it.
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index e5e104d674..c2abd20f9b 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -6499,3 +6499,38 @@ fn a_paragraph_selected_by_its_frame_deletes_with_one_key() {
         assert_eq!(blocks(&h).iter().map(|b| b.text.as_str()).collect::<Vec<_>>(), ["Page 1"], "undo restores it");
     }
 }
+
+/// Esc in an open paragraph leaves its text and selects its box, as in Acrobat, so Esc and
+/// Delete remove it without aiming for the thin frame; the unapplied draft is discarded.
+#[test]
+fn escape_in_an_open_paragraph_selects_its_box_for_delete() {
+    for draft in [None, Some("Page one")] {
+        let mut h = harness(1, |_| {});
+        assert!(h.state_mut().execute("edit.edit_text"));
+        h.run_steps(2);
+        let id = h.state().views[0].id;
+        let blocks = |h: &Harness<'static, PdfCraftApp>| h.state().session.get(id).unwrap().text_blocks(0);
+        let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+        let k = r.width() / 200.0;
+        let b = blocks(&h)[0].clone();
+        click_at(
+            &mut h,
+            egui::pos2(r.left() + ((b.rect[0] + b.rect[2]) / 2.0) as f32 * k, r.top() + (300.0 - (b.rect[1] + b.rect[3]) / 2.0) as f32 * k),
+        );
+        assert!(h.state().views[0].line_editor.is_some(), "a click inside the paragraph opens it for typing");
+        if let Some(text) = draft {
+            h.state_mut().views[0].line_editor.as_mut().unwrap().text = text.into();
+            h.run_steps(1);
+        }
+        press(&mut h, Modifiers::NONE, Key::Escape);
+        assert!(h.state().views[0].line_editor.is_none(), "Esc leaves the text");
+        h.get_by_label("1 object selected");
+        assert_eq!(blocks(&h)[0].text, "Page 1", "the draft {draft:?} is discarded");
+        press(&mut h, Modifiers::NONE, Key::Delete);
+        assert!(blocks(&h).is_empty(), "Esc then Delete removes the paragraph: {:?}", blocks(&h));
+        // One undo step brings it back.
+        assert!(h.state_mut().execute("edit.undo"));
+        h.run_steps(2);
+        assert_eq!(blocks(&h)[0].text, "Page 1");
+    }
+}
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index bcba7a0ecd..6ec28519ae 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1878,8 +1878,8 @@ milestone = "M7"
 status = "partial"
 commands = ["edit.edit_text"]
 tools = ["text_lines", "text_paragraphs", "text_edit", "text_edit_layout", "text_font_files", "text_font_import", "text_fonts"]
-evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools", "crates/edit/src/tests.rs::a_line_whose_operator_starts_the_next_stream_can_be_edited", "crates/automation/tests/it/automation.rs::a_line_split_across_content_streams_is_listed_and_edited", "crates/ui-egui/tests/it/editing.rs::selected_text_formatting_keeps_the_rest_of_the_paragraph_and_reopens", "crates/edit/src/tests.rs::marked_paragraph_boundaries_and_cross_stream_transforms_survive_rewrite", "crates/automation/tests/it/automation.rs::explicit_font_and_disjoint_ranges_save_reopen_through_tools", "crates/edit/src/tests.rs::disjoint_style_ranges_preserve_unselected_runs_and_validate_utf8_atomically", "crates/engine/tests/it/document_fonts.rs::opentype_cff_document_font_preserves_program_codes_and_rendering_after_reopen", "crates/ui-egui/tests/it/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/it/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::mixed_styles_and_matrix_sizes_form_visual_regions_without_merging_columns", "crates/edit/src/tests.rs::rich_region_edits_preserve_styles_positions_and_delete_all_runs_after_reopen", "crates/ui-egui/tests/it/editing.rs::one_editor_contains_mixed_styles_and_visual_rows", "crates/ui-egui/tests/it/editing.rs::inline_editor_preserves_source_font_and_previews_live_bounds", "crates/fonts/src/pdf/tests.rs::mac_subset_cmap_uses_pdf_unicode_without_changing_source_program", "crates/automation/tests/it/automation.rs::mixed_visual_region_edit_preview_save_reopen_and_undo_through_tools", "crates/ui-egui/tests/it/ui.rs::the_edit_tab_turns_on_edit_text_and_images", "crates/ui-egui/tests/it/editing.rs::the_caret_on_a_small_row_is_as_tall_as_that_row", "crates/edit/src/tests.rs::uzbek_and_kazakh_cyrillic_use_the_bundled_latin_face", "crates/automation/tests/it/automation.rs::editing_uzbek_and_kazakh_cyrillic_through_tools", "crates/edit/src/tests.rs::styled_paragraph_batches_cyrillic_without_changing_source_fonts", "crates/edit/src/tests.rs::styled_paragraph_over_240_fallback_glyphs_splits_and_refuses_atomically", "crates/edit/src/tests.rs::styled_fallback_batches_keep_face_choices_and_range_styles", "crates/edit/src/tests.rs::styled_fallback_shards_keep_text_advances_and_alignment", "crates/edit/src/tests.rs::styled_fallback_budget_is_enforced_before_objects_are_written", "crates/edit/src/tests.rs::styled_fallback_same_base_font_and_character_keep_both_weights", "crates/automation/tests/it/automation.rs::styled_cyrillic_fallback_is_batched_through_tools_and_reopen"]
-notes = "The Edit tab turns Edit text & images on at once, as in Acrobat (leaving the tab puts the tool down and applies an edit in progress); click a paragraph box and retype it in place (font reused or Helvetica substituted, colour and spacing kept, rewrapped); a page's /Contents pieces are parsed joined, so a line whose operands and operator sit in different pieces is listed and edited (lines and paragraphs still don't join across pieces; Edit image still parses each piece alone); drag a box to move it or its right-edge handle to rewrap it (edit.text-move-resize); per-character formatting changes are next Since #1116: mixed-style visual regions retain source rows, subset encodings, colour and baseline anchors in one textless-background editor. Explicit paragraph/heading scopes constrain grouping; compatible graphics planes permit cross-stream regions. Full matching document fonts complete absent subset glyphs; installed/file selection, TrueType/OpenType-CFF embedding and disjoint UTF-8 range styles have save/reopen coverage. Single-face OpenType shaping/bidi retains logical text through ToUnicode/ActualText. Replacement text the paragraph's font can't show takes the craft-fonts Japanese faces when they draw all of it (Uzbek қ, Kazakh ә are in none of them), else the bundled Inter face, so those letters write in every build (#2593). Legacy non-SFNT preview, mixed-font/style contextual runs, full structure-tree preservation and author intent in untagged PDFs remain limited; Styled-path outline fallback batches by actual face with 240 glyphs per font and preserves source styles; adjacent equal-font/style characters form runs. At most 15360 distinct fallback glyphs per styled paragraph; missing glyphs are refused before fallback objects are written. Glyph coverage, mixed contextual shaping, single-style fallback and stale-font cleanup are unchanged; see docs/editing-existing-text.md"
+evidence = ["crates/edit/src/tests.rs::paragraphs_are_found_and_rewrapped", "crates/edit/src/tests.rs::text_lines_are_found_and_replaced_in_place", "crates/ui-egui/tests/it/editing.rs::editing_existing_text_in_place", "crates/automation/tests/it/automation.rs::editing_existing_text_through_tools", "crates/edit/src/tests.rs::a_line_whose_operator_starts_the_next_stream_can_be_edited", "crates/automation/tests/it/automation.rs::a_line_split_across_content_streams_is_listed_and_edited", "crates/ui-egui/tests/it/editing.rs::selected_text_formatting_keeps_the_rest_of_the_paragraph_and_reopens", "crates/edit/src/tests.rs::marked_paragraph_boundaries_and_cross_stream_transforms_survive_rewrite", "crates/automation/tests/it/automation.rs::explicit_font_and_disjoint_ranges_save_reopen_through_tools", "crates/edit/src/tests.rs::disjoint_style_ranges_preserve_unselected_runs_and_validate_utf8_atomically", "crates/engine/tests/it/document_fonts.rs::opentype_cff_document_font_preserves_program_codes_and_rendering_after_reopen", "crates/ui-egui/tests/it/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/it/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::mixed_styles_and_matrix_sizes_form_visual_regions_without_merging_columns", "crates/edit/src/tests.rs::rich_region_edits_preserve_styles_positions_and_delete_all_runs_after_reopen", "crates/ui-egui/tests/it/editing.rs::one_editor_contains_mixed_styles_and_visual_rows", "crates/ui-egui/tests/it/editing.rs::inline_editor_preserves_source_font_and_previews_live_bounds", "crates/fonts/src/pdf/tests.rs::mac_subset_cmap_uses_pdf_unicode_without_changing_source_program", "crates/automation/tests/it/automation.rs::mixed_visual_region_edit_preview_save_reopen_and_undo_through_tools", "crates/ui-egui/tests/it/ui.rs::the_edit_tab_turns_on_edit_text_and_images", "crates/ui-egui/tests/it/editing.rs::the_caret_on_a_small_row_is_as_tall_as_that_row", "crates/edit/src/tests.rs::uzbek_and_kazakh_cyrillic_use_the_bundled_latin_face", "crates/automation/tests/it/automation.rs::editing_uzbek_and_kazakh_cyrillic_through_tools", "crates/edit/src/tests.rs::styled_paragraph_batches_cyrillic_without_changing_source_fonts", "crates/edit/src/tests.rs::styled_paragraph_over_240_fallback_glyphs_splits_and_refuses_atomically", "crates/edit/src/tests.rs::styled_fallback_batches_keep_face_choices_and_range_styles", "crates/edit/src/tests.rs::styled_fallback_shards_keep_text_advances_and_alignment", "crates/edit/src/tests.rs::styled_fallback_budget_is_enforced_before_objects_are_written", "crates/edit/src/tests.rs::styled_fallback_same_base_font_and_character_keep_both_weights", "crates/automation/tests/it/automation.rs::styled_cyrillic_fallback_is_batched_through_tools_and_reopen", "crates/ui-egui/tests/it/editing.rs::escape_in_an_open_paragraph_selects_its_box_for_delete"]
+notes = "The Edit tab turns Edit text & images on at once, as in Acrobat (leaving the tab puts the tool down and applies an edit in progress); Esc in an open paragraph leaves its text and selects its box, so Delete removes it (the unapplied draft is discarded); click a paragraph box and retype it in place (font reused or Helvetica substituted, colour and spacing kept, rewrapped); a page's /Contents pieces are parsed joined, so a line whose operands and operator sit in different pieces is listed and edited (lines and paragraphs still don't join across pieces; Edit image still parses each piece alone); drag a box to move it or its right-edge handle to rewrap it (edit.text-move-resize); per-character formatting changes are next Since #1116: mixed-style visual regions retain source rows, subset encodings, colour and baseline anchors in one textless-background editor. Explicit paragraph/heading scopes constrain grouping; compatible graphics planes permit cross-stream regions. Full matching document fonts complete absent subset glyphs; installed/file selection, TrueType/OpenType-CFF embedding and disjoint UTF-8 range styles have save/reopen coverage. Single-face OpenType shaping/bidi retains logical text through ToUnicode/ActualText. Replacement text the paragraph's font can't show takes the craft-fonts Japanese faces when they draw all of it (Uzbek қ, Kazakh ә are in none of them), else the bundled Inter face, so those letters write in every build (#2593). Legacy non-SFNT preview, mixed-font/style contextual runs, full structure-tree preservation and author intent in untagged PDFs remain limited; Styled-path outline fallback batches by actual face with 240 glyphs per font and preserves source styles; adjacent equal-font/style characters form runs. At most 15360 distinct fallback glyphs per styled paragraph; missing glyphs are refused before fallback objects are written. Glyph coverage, mixed contextual shaping, single-style fallback and stale-font cleanup are unchanged; see docs/editing-existing-text.md"
 
 [[feature]]
 id = "edit.text-reflow"

From 0426c79bf55ad85480be12806918ace718ad4ea4 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Wed, 28 Oct 2026 10:43:16 +0100
Subject: [PATCH 039/132] parity: point delete-comment evidence at
 tools/comments/tests.rs

The test moved there with main's split of comments.rs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 parity/acrobat-features.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 31a21e2e73..1d15a25afe 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4003,7 +4003,7 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_delete"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/comments.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies"]
+evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies"]
 notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted."
 
 [[feature]]

From 0c5119791db7de268258b9d25f1286b82b563f8a Mon Sep 17 00:00:00 2001
From: RiceDee <345114586+RiceDee@users.noreply.github.com>
Date: Wed, 28 Oct 2026 20:59:30 +1100
Subject: [PATCH 040/132] fix(ui): keep the All tools rows clear of the
 scrollbar (#5133)

The scrollbar floats over the right edge of the tool list and covered the
right-hand rounded corners of a hovered row. The list now keeps an 18 px
gutter, so the highlight has the same 15 px gap to the panel edge on the
left and to the scrollbar on the right.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/panels/tools.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/crates/ui-egui/src/panels/tools.rs b/crates/ui-egui/src/panels/tools.rs
index 4ff76a7c43..9d106e38b3 100644
--- a/crates/ui-egui/src/panels/tools.rs
+++ b/crates/ui-egui/src/panels/tools.rs
@@ -58,6 +58,9 @@ pub(crate) fn panel_header(ui: &mut egui::Ui, t: &Tokens, title: &str, lead: Opt
     (go_back, close)
 }
 
+/// Width kept free at the right of the tool list for the floating scrollbar.
+const SCROLLBAR_GUTTER: f32 = 18.0;
+
 /// The All tools sidebar: Expand (the full view) and Close, then the tool list, the first few
 /// tools until View more shows them all.
 fn all_tools(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
@@ -70,6 +73,8 @@ fn all_tools(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
         app.left_open = false;
     }
     egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+        // The scrollbar floats over the right edge: keep the rows (and their rounded hover wash) clear of it.
+        ui.set_max_width((ui.available_width() - SCROLLBAR_GUTTER).max(0.0));
         ui.add_space(2.0);
         let shown = if app.all_tools_expanded { TOOL_GROUPS.len() } else { COLLAPSED_TOOLS.min(TOOL_GROUPS.len()) };
         for g in &TOOL_GROUPS[..shown] {

From 72edd945e56724ece07d72625964a592f83344bb Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Wed, 28 Oct 2026 12:14:42 +0100
Subject: [PATCH 041/132] fix(comments): a locked reply keeps the comment or
 reply it answers

Deleting a comment or a reply took every reply to it, locked or not: only
the target's own Locked flag was checked. A locked reply can't be deleted
on its own, so delete_annotation now refuses while anything that would go
with the target is locked (pop-ups follow their comment).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/annot/src/modify.rs   | 10 ++++++++++
 crates/annot/src/tests.rs    | 19 +++++++++++++++++++
 parity/acrobat-features.toml |  4 ++--
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/crates/annot/src/modify.rs b/crates/annot/src/modify.rs
index fc81348075..92807babd0 100644
--- a/crates/annot/src/modify.rs
+++ b/crates/annot/src/modify.rs
@@ -80,6 +80,16 @@ pub fn delete_annotation(doc: &mut Document, page: usize, index: usize) -> Resul
     // An inline comment has no reference to collect; the pop-up it names still goes.
     let seed = target.as_ref().or_else(|| target.as_dict().and_then(|d| d.reference(b"Popup")));
     let doomed = with_replies_and_popups(doc, &list, seed);
+    // A locked reply can't be deleted on its own, so it doesn't go with the comment or reply it
+    // answers either. Pop-ups follow their comment.
+    for (_, e) in list.iter().enumerate().filter(|(i, e)| *i != index && goes_with(e, &doomed)) {
+        let obj = doc.resolve(e);
+        if let Some(d) = obj.as_dict().filter(|d| d.name(b"Subtype") != Some(b"Popup".as_slice()))
+            && annotation_flags(doc, d) & FLAG_LOCKED != 0
+        {
+            return Err(AnnotError::Invalid("a reply to it is locked".into()));
+        }
+    }
     let kept: Vec<Object> = list.into_iter().enumerate().filter(|(i, e)| *i != index && !goes_with(e, &doomed)).map(|(_, e)| e).collect();
     Ok(set_annots(doc, p, kept)?)
 }
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index eb8d1a0f15..d1e2f97e89 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -229,6 +229,25 @@ fn delete_takes_popup_and_reply_chain() {
     assert_eq!(delete_annotation(&mut doc, 0, 9), Err(AnnotError::NoSuchAnnotation { page: 0, index: 9 }));
 }
 
+/// A locked reply can't be deleted, so it doesn't go with what it answers either: deleting the
+/// reply above it, or the comment, is refused and changes nothing; once it is unlocked they go.
+#[test]
+fn a_locked_reply_keeps_what_it_answers() {
+    let mut doc = fixture();
+    let note = add_annotation(&mut doc, &new(0, Shape::Note { at: [100.0, 100.0], icon: NoteIcon::Comment }), &meta("n")).unwrap();
+    let reply = add_reply(&mut doc, 0, note, "first", "Bob", &meta("r1")).unwrap();
+    let answer = add_reply(&mut doc, 0, reply, "locked answer", "Ada", &meta("r2")).unwrap();
+    set_locked(&mut doc, 0, answer, true).unwrap();
+    let before = list(&doc, 0).len();
+    assert_eq!(delete_annotation(&mut doc, 0, reply), Err(AnnotError::Invalid("a reply to it is locked".into())));
+    assert_eq!(delete_annotation(&mut doc, 0, note), Err(AnnotError::Invalid("a reply to it is locked".into())));
+    assert_eq!(list(&doc, 0).len(), before, "nothing went");
+    set_locked(&mut doc, 0, answer, false).unwrap();
+    delete_annotation(&mut doc, 0, reply).unwrap();
+    let left: Vec<String> = list(&doc, 0).iter().map(|d| text(d, b"Contents")).collect();
+    assert!(!left.iter().any(|t| t == "first" || t == "locked answer"), "the reply and its answer went: {left:?}");
+}
+
 /// A reply or pop-up written inline in `/Annots` (a file can, though the standard asks for
 /// references) goes with the comment it points at, and so does a pop-up an inline reply or an
 /// inline comment names. An unrelated inline comment stays until it is deleted itself.
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 1d15a25afe..760fa0a338 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4003,8 +4003,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_delete"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies"]
-notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted."
+evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies", "crates/annot/src/tests.rs::a_locked_reply_keeps_what_it_answers"]
+notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted, nor the comment or reply it answers while it is locked."
 
 [[feature]]
 id = "comment.keyboard-nudge"

From 28a31aebc025bf728f8487b16d214f699dca5e8a Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Wed, 28 Oct 2026 12:33:14 +0100
Subject: [PATCH 042/132] fix(comments): previews lift a stamp whatever its
 replies' locks; Delete greys out over a locked reply

The locked-reply check in delete_annotation also reached stamp_preview
and signature_image, which only take the annotation off a copy to draw
the page beneath it: an unlocked stamp with a locked reply lost its drag
preview. They now use lift_annotation, which checks no locks.

The Comments panel's Delete (comment and reply menus) and the page's
context menu are greyed out while a reply below is locked
(comments::locked_below), rather than refusing after the click.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/annot/src/lib.rs                     |  4 +-
 crates/annot/src/modify.rs                  | 28 ++++++++++----
 crates/annot/src/tests.rs                   |  4 ++
 crates/engine/src/signature_image.rs        |  2 +-
 crates/engine/src/stamp_preview.rs          |  2 +-
 crates/engine/src/tests.rs                  | 18 +++++++++
 crates/ui-egui/src/panels/comments_panel.rs | 18 ++++++---
 crates/ui-egui/src/tools/comments.rs        |  2 +-
 crates/ui-egui/src/tools/comments/menu.rs   |  5 ++-
 crates/ui-egui/src/tools/comments/state.rs  | 41 ++++++++++++++-------
 crates/ui-egui/src/tools/comments/tests.rs  | 19 ++++++++++
 crates/ui-egui/tests/it/comments.rs         |  7 ++++
 parity/acrobat-features.toml                |  4 +-
 13 files changed, 120 insertions(+), 34 deletions(-)

diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index e9e0359ce0..ae7e5a8727 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -36,8 +36,8 @@ use lookup::{annots, page_ref};
 pub use lookup::{has_visible_fill_sign, is_fill_sign, isolate_annotation, page_refs, picture_rotation, set_annots, signature_image};
 pub(crate) use modify::n;
 pub use modify::{
-    add_reply, add_text_replacement, delete_annotation, erase_ink, fillable, goes_with, move_annotation, set_contents, set_fill, set_font_size,
-    set_locked, set_marked, set_points, set_rect, set_review_state, set_style, with_replies_and_popups,
+    add_reply, add_text_replacement, delete_annotation, erase_ink, fillable, goes_with, lift_annotation, move_annotation, set_contents, set_fill,
+    set_font_size, set_locked, set_marked, set_points, set_rect, set_review_state, set_style, with_replies_and_popups,
 };
 pub use types::{
     AttachIcon, FillMark, LineEnding, Markup, Meta, NOTE_SIZE, NewAnnotation, NoteIcon, OverlayFont, OverlayLook, ReviewState, Rgb, Shape,
diff --git a/crates/annot/src/modify.rs b/crates/annot/src/modify.rs
index 92807babd0..8204e65107 100644
--- a/crates/annot/src/modify.rs
+++ b/crates/annot/src/modify.rs
@@ -70,11 +70,23 @@ pub(crate) fn touch(d: &mut Dict, meta: &Meta) {
 }
 
 /// Delete a comment together with its pop-up and its replies (and theirs), as Acrobat does.
+/// Refused while it, or a reply that would go with it, is locked.
 pub fn delete_annotation(doc: &mut Document, page: usize, index: usize) -> Result<(), AnnotError> {
+    remove_with_replies(doc, page, index, true)
+}
+
+/// Take the annotation at `(page, index)` out of its page with its pop-up and replies, as
+/// [`delete_annotation`] does but whatever their locks: for drawing the page beneath it on a
+/// copy of the document (a stamp or signature being dragged), which changes nothing.
+pub fn lift_annotation(doc: &mut Document, page: usize, index: usize) -> Result<(), AnnotError> {
+    remove_with_replies(doc, page, index, false)
+}
+
+fn remove_with_replies(doc: &mut Document, page: usize, index: usize, check_locks: bool) -> Result<(), AnnotError> {
     let p = page_ref(doc, page)?;
     let list = annots(doc, p);
     let target = list.get(index).cloned().ok_or(AnnotError::NoSuchAnnotation { page, index })?;
-    if let Some(r) = target.as_ref() {
+    if check_locks && let Some(r) = target.as_ref() {
         unlocked(doc, r)?;
     }
     // An inline comment has no reference to collect; the pop-up it names still goes.
@@ -82,12 +94,14 @@ pub fn delete_annotation(doc: &mut Document, page: usize, index: usize) -> Resul
     let doomed = with_replies_and_popups(doc, &list, seed);
     // A locked reply can't be deleted on its own, so it doesn't go with the comment or reply it
     // answers either. Pop-ups follow their comment.
-    for (_, e) in list.iter().enumerate().filter(|(i, e)| *i != index && goes_with(e, &doomed)) {
-        let obj = doc.resolve(e);
-        if let Some(d) = obj.as_dict().filter(|d| d.name(b"Subtype") != Some(b"Popup".as_slice()))
-            && annotation_flags(doc, d) & FLAG_LOCKED != 0
-        {
-            return Err(AnnotError::Invalid("a reply to it is locked".into()));
+    if check_locks {
+        for (_, e) in list.iter().enumerate().filter(|(i, e)| *i != index && goes_with(e, &doomed)) {
+            let obj = doc.resolve(e);
+            if let Some(d) = obj.as_dict().filter(|d| d.name(b"Subtype") != Some(b"Popup".as_slice()))
+                && annotation_flags(doc, d) & FLAG_LOCKED != 0
+            {
+                return Err(AnnotError::Invalid("a reply to it is locked".into()));
+            }
         }
     }
     let kept: Vec<Object> = list.into_iter().enumerate().filter(|(i, e)| *i != index && !goes_with(e, &doomed)).map(|(_, e)| e).collect();
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index d1e2f97e89..f9992a949e 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -242,6 +242,10 @@ fn a_locked_reply_keeps_what_it_answers() {
     assert_eq!(delete_annotation(&mut doc, 0, reply), Err(AnnotError::Invalid("a reply to it is locked".into())));
     assert_eq!(delete_annotation(&mut doc, 0, note), Err(AnnotError::Invalid("a reply to it is locked".into())));
     assert_eq!(list(&doc, 0).len(), before, "nothing went");
+    // Lifted on a copy, to draw the page beneath, the locks don't count.
+    let mut copy = doc.clone();
+    lift_annotation(&mut copy, 0, note).unwrap();
+    assert!(list(&copy, 0).len() < before, "the thread is lifted off the copy");
     set_locked(&mut doc, 0, answer, false).unwrap();
     delete_annotation(&mut doc, 0, reply).unwrap();
     let left: Vec<String> = list(&doc, 0).iter().map(|d| text(d, b"Contents")).collect();
diff --git a/crates/engine/src/signature_image.rs b/crates/engine/src/signature_image.rs
index daff674c19..ae8842ddfb 100644
--- a/crates/engine/src/signature_image.rs
+++ b/crates/engine/src/signature_image.rs
@@ -61,7 +61,7 @@ impl Document {
                 pdfcraft_annot::props(&editor.cos, page, index).map(|p| p.opacity).filter(|v| v.is_finite()).unwrap_or(1.0).clamp(0.0, 1.0) as f32;
             let turn = pdfcraft_annot::picture_rotation(&editor.cos, page, index).map_err(|e| e.to_string())?;
             let mut cos = editor.cos.clone();
-            pdfcraft_annot::delete_annotation(&mut cos, page, index).map_err(|e| e.to_string())?;
+            pdfcraft_annot::lift_annotation(&mut cos, page, index).map_err(|e| e.to_string())?;
             let bytes = Arc::new(pdfcraft_cos::write_incremental(&cos, &pdfcraft_cos::SaveOptions::default()).map_err(|e| e.to_string())?);
             Ok(Some(ImageSignaturePreview { image, opacity, turn, page, bytes, config: self.config.clone() }))
         })?
diff --git a/crates/engine/src/stamp_preview.rs b/crates/engine/src/stamp_preview.rs
index 6e5758a7ce..d52496cdcd 100644
--- a/crates/engine/src/stamp_preview.rs
+++ b/crates/engine/src/stamp_preview.rs
@@ -73,7 +73,7 @@ impl Document {
                 return Ok(None);
             }
             let mut background = editor.cos.clone();
-            pdfcraft_annot::delete_annotation(&mut background, page, index).map_err(|e| e.to_string())?;
+            pdfcraft_annot::lift_annotation(&mut background, page, index).map_err(|e| e.to_string())?;
             // The page beneath as it is displayed: comments without an appearance get theirs.
             let background = pdfcraft_annot::with_missing_appearances(&background).unwrap_or(background);
             let write = |cos: &pdfcraft_cos::Document| write_incremental(cos, &SaveOptions::default()).map(Arc::new).map_err(|e| e.to_string());
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 14a61b2633..31b426992c 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -3245,6 +3245,24 @@ fn comment_text(s: &Session, id: DocId) -> Vec<String> {
     t
 }
 
+/// A stamp whose reply is locked can still be dragged, so its layers are still prepared: the page
+/// beneath is drawn on a copy, where locks don't count. Deleting the stamp is what they refuse.
+#[test]
+fn a_stamp_with_a_locked_reply_still_has_its_drag_layers() {
+    let (mut s, id) = session_with(1);
+    s.apply(id, fill_item(Shape::Mark { rect: [30.0, 60.0, 130.0, 66.0], mark: FillMark::Line }, "")).unwrap();
+    s.apply(id, Edit::ReplyToAnnotation { page: 0, index: 0, text: "Approved".into(), author: "Bob".into() }).unwrap();
+    let reply = s.get(id).unwrap().info.annotations.iter().find(|a| a.parent == Some((0, 0))).expect("the reply").index;
+    s.apply(id, Edit::LockAnnotation { page: 0, index: reply, locked: true }).unwrap();
+    let doc = s.get(id).unwrap();
+    let background = doc.stamp_preview(0, 0).unwrap().expect("the line is a stamp").render_background(1.0).unwrap();
+    let px = |p: &pdfcraft_render::RenderedPage, x: u32, y: u32| -> [u8; 4] {
+        p.rgba[(((300 - y) * p.width + x) * 4) as usize..][..4].try_into().unwrap()
+    };
+    assert!((30..=130).all(|x| px(&background, x, 63) == [255, 255, 255, 255]), "the page beneath has no line");
+    assert!(s.apply(id, Edit::DeleteAnnotation { page: 0, index: 0 }).is_err(), "the locked reply keeps the stamp");
+}
+
 /// A dragged stamp's layers: the page without it (its text and other comments kept) and the
 /// stamp alone on a transparent page. Preparing them changes nothing in the document.
 #[test]
diff --git a/crates/ui-egui/src/panels/comments_panel.rs b/crates/ui-egui/src/panels/comments_panel.rs
index 5a1b736f63..9d49a68c0b 100644
--- a/crates/ui-egui/src/panels/comments_panel.rs
+++ b/crates/ui-egui/src/panels/comments_panel.rs
@@ -405,7 +405,7 @@ fn card(ui: &mut egui::Ui, view: &mut DocView, context: CardContext<'_>) -> Opti
                             if selected && allowed && !r.grouped {
                                 ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
                                     let more = icons::button(ui, "ellipsis", 20.0, false, tl!("Options for this reply"));
-                                    if let Some(e) = reply_menu(ui, view, r, &more) {
+                                    if let Some(e) = reply_menu(ui, view, r, info, &more) {
                                         edit = Some(e);
                                     }
                                 });
@@ -524,7 +524,11 @@ fn card(ui: &mut egui::Ui, view: &mut DocView, context: CardContext<'_>) -> Opti
                 ui.close();
             }
             ui.separator();
-            if ui.add_enabled(!a.locked, egui::Button::new(tl!("Delete"))).clicked() {
+            // A locked reply can't be deleted, so it keeps the comment it answers too.
+            if ui
+                .add_enabled(!a.locked && !crate::comments::locked_below(&info.annotations, (a.page, a.index)), egui::Button::new(tl!("Delete")))
+                .clicked()
+            {
                 view.comments.selected = None;
                 edit = Some(Edit::DeleteAnnotation { page: a.page, index: a.index });
                 ui.close();
@@ -562,7 +566,7 @@ fn inline_editor(ui: &mut egui::Ui, t: &Tokens, view: &mut DocView, key: (usize,
 /// the reply alone, with what hangs off it (its own replies, status changes and pop-up), as
 /// deleting a comment takes its thread; the comment and its other replies stay. Returns the
 /// edit to apply.
-fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, more: &egui::Response) -> Option<Edit> {
+fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, info: &DocInfo, more: &egui::Response) -> Option<Edit> {
     let mut edit = None;
     let menu_id = ui.scope_id().with(("reply-menu", r.page, r.index));
     if more.clicked() {
@@ -583,8 +587,12 @@ fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, more: &egui::Re
                 ui.close();
             }
             ui.separator();
-            // The card stays selected: the app finds its comment again after the delete.
-            if ui.add_enabled(!r.locked, egui::Button::new(tl!("Delete"))).clicked() {
+            // The card stays selected: the app finds its comment again after the delete. A locked
+            // reply to this one keeps it.
+            if ui
+                .add_enabled(!r.locked && !crate::comments::locked_below(&info.annotations, (r.page, r.index)), egui::Button::new(tl!("Delete")))
+                .clicked()
+            {
                 edit = Some(Edit::DeleteAnnotation { page: r.page, index: r.index });
                 ui.close();
             }
diff --git a/crates/ui-egui/src/tools/comments.rs b/crates/ui-egui/src/tools/comments.rs
index 6f3c074427..d86a0d58d2 100644
--- a/crates/ui-egui/src/tools/comments.rs
+++ b/crates/ui-egui/src/tools/comments.rs
@@ -47,7 +47,7 @@ use paint::{changing_points, drawn_shape, edited_in_view};
 use state::after_delete;
 use state::login_name;
 pub use state::{CommentView, Composer, ComposerKind, Gesture, SortBy};
-pub(crate) use state::{EditorFocus, PageCx};
+pub(crate) use state::{EditorFocus, PageCx, locked_below};
 
 /// Acrobat's selection blue for annotation frames and handles (11-visual-spec §5).
 const SELECT_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
diff --git a/crates/ui-egui/src/tools/comments/menu.rs b/crates/ui-egui/src/tools/comments/menu.rs
index d3de66a4e7..0ce50e5077 100644
--- a/crates/ui-egui/src/tools/comments/menu.rs
+++ b/crates/ui-egui/src/tools/comments/menu.rs
@@ -1,5 +1,5 @@
 use super::paint::edit_anchor;
-use super::state::{Composer, ComposerKind};
+use super::state::{Composer, ComposerKind, locked_below};
 use super::{
     Annotation, Color32, CommentPrefs, CommentTool, DocInfo, DocView, Edit, Rect, ReviewState, Rgb, SELECT_BLUE, SWATCHES, Sense, Stroke, color32,
     icons, theme, tool_for, vec2,
@@ -89,7 +89,8 @@ pub(crate) fn context_menu(
                 ui.close();
             }
             ui.separator();
-            if ui.add_enabled(allowed && !a.locked, egui::Button::new(tl!("Delete"))).clicked() {
+            // A locked reply can't be deleted, so it keeps the comment it answers too.
+            if ui.add_enabled(allowed && !a.locked && !locked_below(&info.annotations, (page, index)), egui::Button::new(tl!("Delete"))).clicked() {
                 view.comments.selected = None;
                 action = Some(CanvasAction::Edit(Box::new(Edit::DeleteAnnotation { page, index })));
                 ui.close();
diff --git a/crates/ui-egui/src/tools/comments/state.rs b/crates/ui-egui/src/tools/comments/state.rs
index c405422481..c9ca91fb01 100644
--- a/crates/ui-egui/src/tools/comments/state.rs
+++ b/crates/ui-egui/src/tools/comments/state.rs
@@ -245,19 +245,7 @@ pub(super) fn after_delete(before: &[Annotation], after: &[Annotation], gone: (u
         return Some(keep);
     }
     let (old, new) = (on_page(before, gone.0), on_page(after, gone.0));
-    // Only replies on the page go with it: `/IRT` is followed through the page's `/Annots`.
-    let parents: HashMap<usize, usize> = old.iter().filter_map(|a| a.parent.filter(|p| p.0 == gone.0).map(|p| (a.index, p.1))).collect();
-    let goes = |mut i: usize| {
-        // `link_replies` settles every chain within 64 steps.
-        for _ in 0..=64 {
-            if i == gone.1 {
-                return true;
-            }
-            let Some(&up) = parents.get(&i) else { return false };
-            i = up;
-        }
-        false
-    };
+    let goes = in_thread(&old, gone);
     let stays: Vec<&Annotation> = old.iter().copied().filter(|a| !goes(a.index)).collect();
     if stays.len() != new.len() {
         return None;
@@ -268,6 +256,33 @@ pub(super) fn after_delete(before: &[Annotation], after: &[Annotation], gone: (u
     same.then_some((now.page, now.index))
 }
 
+/// Whether the annotation at an index on `top`'s page is `top` or a reply to it at any depth:
+/// what deleting `top` takes along. `page` is that page's listed annotations. Only replies on the
+/// page go with it (`pdfcraft_annot::delete_annotation` follows `/IRT` through the page's
+/// `/Annots`).
+fn in_thread(page: &[&Annotation], top: (usize, usize)) -> impl Fn(usize) -> bool {
+    let parents: HashMap<usize, usize> = page.iter().filter_map(|a| a.parent.filter(|p| p.0 == top.0).map(|p| (a.index, p.1))).collect();
+    move |mut i: usize| {
+        // `link_replies` settles every chain within 64 steps.
+        for _ in 0..=64 {
+            if i == top.1 {
+                return true;
+            }
+            let Some(&up) = parents.get(&i) else { return false };
+            i = up;
+        }
+        false
+    }
+}
+
+/// Whether a reply to the annotation at `top`, at any depth, is locked: deleting it is refused
+/// then, as the reply can't be deleted.
+pub(crate) fn locked_below(annotations: &[Annotation], top: (usize, usize)) -> bool {
+    let page = on_page(annotations, top.0);
+    let goes = in_thread(&page, top);
+    page.iter().any(|a| a.index != top.1 && a.locked && goes(a.index))
+}
+
 /// The annotations listed on `page`, in `/Annots` order.
 fn on_page(list: &[Annotation], page: usize) -> Vec<&Annotation> {
     let mut v: Vec<&Annotation> = list.iter().filter(|a| a.page == page).collect();
diff --git a/crates/ui-egui/src/tools/comments/tests.rs b/crates/ui-egui/src/tools/comments/tests.rs
index bf000539a5..36644bb445 100644
--- a/crates/ui-egui/src/tools/comments/tests.rs
+++ b/crates/ui-egui/src/tools/comments/tests.rs
@@ -90,6 +90,25 @@ fn listed(page: usize, index: usize, contents: &str, parent: Option<(usize, usiz
     }
 }
 
+/// A locked reply at any depth keeps what it answers, up its own chain only: its comment, the
+/// reply above it, but not a sibling reply or a comment on another page.
+#[test]
+fn a_locked_reply_keeps_the_replies_and_comment_above_it() {
+    let lock = |a: Annotation| Annotation { locked: true, ..a };
+    let list = vec![
+        listed(0, 0, "comment", None),
+        listed(0, 1, "A", Some((0, 0))),
+        lock(listed(0, 2, "to A, locked", Some((0, 1)))),
+        listed(0, 3, "B", Some((0, 0))),
+        listed(1, 0, "other page", None),
+    ];
+    assert!(locked_below(&list, (0, 0)), "the comment");
+    assert!(locked_below(&list, (0, 1)), "the reply above the locked one");
+    assert!(!locked_below(&list, (0, 2)), "the locked reply itself: its own lock says so");
+    assert!(!locked_below(&list, (0, 3)), "a sibling reply");
+    assert!(!locked_below(&list, (1, 0)), "another page");
+}
+
 /// What stays selected or open in the editor after a delete is found where it moved to: the
 /// reply's own replies go with it (pop-ups, unlisted, are gone too), and a page that lost
 /// something else, or whose annotation in that place reads differently, keeps nothing.
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index f8c26b59b8..2fcc2299d1 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -1411,6 +1411,13 @@ fn one_reply_is_deleted_from_its_menu_and_the_thread_stays() {
     h.run_steps(3);
     assert_eq!(texts(&h), ["The comment", "Right reply, reworded", "Accepted set by Ben"]);
 
+    // The locked reply keeps its comment too: deleting the comment would take it along.
+    h.get_by_label("More").click();
+    h.run_steps(2);
+    assert!(h.get_by_label("Delete").accesskit_node().is_disabled(), "the comment of a locked reply isn't deleted");
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+
     h.state_mut().undo();
     h.run_steps(2);
     h.state_mut().undo();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 760fa0a338..c4670a584b 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4003,8 +4003,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_delete"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies", "crates/annot/src/tests.rs::a_locked_reply_keeps_what_it_answers"]
-notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted, nor the comment or reply it answers while it is locked."
+evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies", "crates/annot/src/tests.rs::a_locked_reply_keeps_what_it_answers", "crates/ui-egui/src/tools/comments/tests.rs::a_locked_reply_keeps_the_replies_and_comment_above_it", "crates/engine/src/tests.rs::a_stamp_with_a_locked_reply_still_has_its_drag_layers"]
+notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted, nor the comment or reply it answers while it is locked (their Delete is greyed out; a stamp or signature with a locked reply still drags with its live preview)."
 
 [[feature]]
 id = "comment.keyboard-nudge"

From 6a1783599dbf1cca8c4912993f8b83745eed78c1 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Wed, 28 Oct 2026 13:09:59 +0100
Subject: [PATCH 043/132] fix(comments): Delete asks the engine whether it
 would delete

The menus greyed Delete out from the listing's reply links while the
engine refused on the PDF's own /IRT and /Parent links, so the two could
disagree. pdfcraft_annot::deletable is now the one check: delete_annotation
runs it, and Document::annotation_deletable gives the Comments panel and
the page's context menu the same answer before they offer Delete.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/annot/src/lib.rs                     |  4 +-
 crates/annot/src/modify.rs                  | 59 ++++++++++++---------
 crates/annot/src/tests.rs                   |  5 ++
 crates/engine/src/document.rs               |  7 +++
 crates/ui-egui/src/canvas.rs                |  3 +-
 crates/ui-egui/src/panels/comments_panel.rs | 24 ++++-----
 crates/ui-egui/src/panels/right.rs          |  2 +-
 crates/ui-egui/src/tools/comments.rs        |  2 +-
 crates/ui-egui/src/tools/comments/menu.rs   |  9 ++--
 crates/ui-egui/src/tools/comments/state.rs  |  8 ---
 crates/ui-egui/src/tools/comments/tests.rs  | 21 +-------
 parity/acrobat-features.toml                |  2 +-
 12 files changed, 70 insertions(+), 76 deletions(-)

diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index ae7e5a8727..f51c645148 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -36,8 +36,8 @@ use lookup::{annots, page_ref};
 pub use lookup::{has_visible_fill_sign, is_fill_sign, isolate_annotation, page_refs, picture_rotation, set_annots, signature_image};
 pub(crate) use modify::n;
 pub use modify::{
-    add_reply, add_text_replacement, delete_annotation, erase_ink, fillable, goes_with, lift_annotation, move_annotation, set_contents, set_fill,
-    set_font_size, set_locked, set_marked, set_points, set_rect, set_review_state, set_style, with_replies_and_popups,
+    add_reply, add_text_replacement, deletable, delete_annotation, erase_ink, fillable, goes_with, lift_annotation, move_annotation, set_contents,
+    set_fill, set_font_size, set_locked, set_marked, set_points, set_rect, set_review_state, set_style, with_replies_and_popups,
 };
 pub use types::{
     AttachIcon, FillMark, LineEnding, Markup, Meta, NOTE_SIZE, NewAnnotation, NoteIcon, OverlayFont, OverlayLook, ReviewState, Rgb, Shape,
diff --git a/crates/annot/src/modify.rs b/crates/annot/src/modify.rs
index 8204e65107..2e3ae0b7d0 100644
--- a/crates/annot/src/modify.rs
+++ b/crates/annot/src/modify.rs
@@ -72,42 +72,51 @@ pub(crate) fn touch(d: &mut Dict, meta: &Meta) {
 /// Delete a comment together with its pop-up and its replies (and theirs), as Acrobat does.
 /// Refused while it, or a reply that would go with it, is locked.
 pub fn delete_annotation(doc: &mut Document, page: usize, index: usize) -> Result<(), AnnotError> {
-    remove_with_replies(doc, page, index, true)
+    deletable(doc, page, index)?;
+    lift_annotation(doc, page, index)
+}
+
+/// Whether [`delete_annotation`] deletes the annotation at `(page, index)`, or why not, without
+/// changing anything: what a Delete command asks before it is offered. It is refused while the
+/// annotation is locked, or a reply that would go with it is.
+pub fn deletable(doc: &Document, page: usize, index: usize) -> Result<(), AnnotError> {
+    let list = annots(doc, page_ref(doc, page)?);
+    let target = list.get(index).ok_or(AnnotError::NoSuchAnnotation { page, index })?;
+    if let Some(r) = target.as_ref() {
+        unlocked(doc, r)?;
+    }
+    let doomed = with_replies_and_popups(doc, &list, seed(target));
+    // A locked reply can't be deleted on its own, so it doesn't go with the comment or reply it
+    // answers either. Pop-ups follow their comment.
+    for (_, e) in list.iter().enumerate().filter(|(i, e)| *i != index && goes_with(e, &doomed)) {
+        let obj = doc.resolve(e);
+        if let Some(d) = obj.as_dict().filter(|d| d.name(b"Subtype") != Some(b"Popup".as_slice()))
+            && annotation_flags(doc, d) & FLAG_LOCKED != 0
+        {
+            return Err(AnnotError::Invalid("a reply to it is locked".into()));
+        }
+    }
+    Ok(())
 }
 
 /// Take the annotation at `(page, index)` out of its page with its pop-up and replies, as
 /// [`delete_annotation`] does but whatever their locks: for drawing the page beneath it on a
 /// copy of the document (a stamp or signature being dragged), which changes nothing.
 pub fn lift_annotation(doc: &mut Document, page: usize, index: usize) -> Result<(), AnnotError> {
-    remove_with_replies(doc, page, index, false)
-}
-
-fn remove_with_replies(doc: &mut Document, page: usize, index: usize, check_locks: bool) -> Result<(), AnnotError> {
     let p = page_ref(doc, page)?;
     let list = annots(doc, p);
-    let target = list.get(index).cloned().ok_or(AnnotError::NoSuchAnnotation { page, index })?;
-    if check_locks && let Some(r) = target.as_ref() {
-        unlocked(doc, r)?;
-    }
-    // An inline comment has no reference to collect; the pop-up it names still goes.
-    let seed = target.as_ref().or_else(|| target.as_dict().and_then(|d| d.reference(b"Popup")));
-    let doomed = with_replies_and_popups(doc, &list, seed);
-    // A locked reply can't be deleted on its own, so it doesn't go with the comment or reply it
-    // answers either. Pop-ups follow their comment.
-    if check_locks {
-        for (_, e) in list.iter().enumerate().filter(|(i, e)| *i != index && goes_with(e, &doomed)) {
-            let obj = doc.resolve(e);
-            if let Some(d) = obj.as_dict().filter(|d| d.name(b"Subtype") != Some(b"Popup".as_slice()))
-                && annotation_flags(doc, d) & FLAG_LOCKED != 0
-            {
-                return Err(AnnotError::Invalid("a reply to it is locked".into()));
-            }
-        }
-    }
-    let kept: Vec<Object> = list.into_iter().enumerate().filter(|(i, e)| *i != index && !goes_with(e, &doomed)).map(|(_, e)| e).collect();
+    let target = list.get(index).ok_or(AnnotError::NoSuchAnnotation { page, index })?;
+    let doomed = with_replies_and_popups(doc, &list, seed(target));
+    let kept: Vec<Object> = list.iter().enumerate().filter(|(i, e)| *i != index && !goes_with(e, &doomed)).map(|(_, e)| e.clone()).collect();
     Ok(set_annots(doc, p, kept)?)
 }
 
+/// What deleting the `/Annots` entry `target` starts from: its reference, or for an inline
+/// comment (which has none to collect) the pop-up it names, which still goes.
+fn seed(target: &Object) -> Option<ObjRef> {
+    target.as_ref().or_else(|| target.as_dict().and_then(|d| d.reference(b"Popup")))
+}
+
 /// Whether the `/Annots` entry `entry` goes with `going` (from [`with_replies_and_popups`]): it is
 /// one of them, or it is written inline (a file can, though the standard asks for references) and
 /// replies to (`/IRT`) or pops up for (`/Parent`) one of them. An inline entry has no reference
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index f9992a949e..a3dc14e262 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -242,11 +242,16 @@ fn a_locked_reply_keeps_what_it_answers() {
     assert_eq!(delete_annotation(&mut doc, 0, reply), Err(AnnotError::Invalid("a reply to it is locked".into())));
     assert_eq!(delete_annotation(&mut doc, 0, note), Err(AnnotError::Invalid("a reply to it is locked".into())));
     assert_eq!(list(&doc, 0).len(), before, "nothing went");
+    // Asked first, read-only, as a Delete command does: the same answer, and the answer's own
+    // lock is its own.
+    assert_eq!(deletable(&doc, 0, note), Err(AnnotError::Invalid("a reply to it is locked".into())));
+    assert_eq!(deletable(&doc, 0, answer), Err(AnnotError::Invalid("the comment is locked".into())));
     // Lifted on a copy, to draw the page beneath, the locks don't count.
     let mut copy = doc.clone();
     lift_annotation(&mut copy, 0, note).unwrap();
     assert!(list(&copy, 0).len() < before, "the thread is lifted off the copy");
     set_locked(&mut doc, 0, answer, false).unwrap();
+    assert_eq!(deletable(&doc, 0, reply), Ok(()));
     delete_annotation(&mut doc, 0, reply).unwrap();
     let left: Vec<String> = list(&doc, 0).iter().map(|d| text(d, b"Contents")).collect();
     assert!(!left.iter().any(|t| t == "first" || t == "locked answer"), "the reply and its answer went: {left:?}");
diff --git a/crates/engine/src/document.rs b/crates/engine/src/document.rs
index 7023caa55e..6220841f3f 100644
--- a/crates/engine/src/document.rs
+++ b/crates/engine/src/document.rs
@@ -305,6 +305,13 @@ impl Document {
         self.config.hide_comments
     }
 
+    /// Whether `Edit::DeleteAnnotation` would delete the annotation at `(page, index)`: the
+    /// engine's own check (it, and every reply that would go with it, unlocked), for a Delete
+    /// command to ask before it is offered.
+    pub fn annotation_deletable(&self, page: usize, index: usize) -> bool {
+        self.editor.as_ref().is_some_and(|e| pdfcraft_annot::deletable(&e.cos, page, index).is_ok())
+    }
+
     pub fn can_undo(&self) -> Option<&str> {
         self.undo_label().map(Label::as_str)
     }
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index ea37eb0dfd..ae00e1edff 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -2074,7 +2074,8 @@ fn draw_pages(
                 ui.separator();
             }
         }
-        canvas_action = comments::context_menu(ui, view, info, prefs, allowed, can_modify).or(copy_image);
+        canvas_action =
+            comments::context_menu(ui, view, info, &|page, index| doc.annotation_deletable(page, index), prefs, allowed, can_modify).or(copy_image);
     });
     *out = PageOut {
         badge_hover,
diff --git a/crates/ui-egui/src/panels/comments_panel.rs b/crates/ui-egui/src/panels/comments_panel.rs
index 9d49a68c0b..c549ed8e3e 100644
--- a/crates/ui-egui/src/panels/comments_panel.rs
+++ b/crates/ui-egui/src/panels/comments_panel.rs
@@ -115,13 +115,14 @@ fn any_contains<'a>(fields: impl IntoIterator<Item = &'a str>, q: &str) -> bool
 pub(crate) fn show(
     ui: &mut egui::Ui,
     t: &Tokens,
-    info: &DocInfo,
+    doc: &pdfcraft_engine::Document,
     view: &mut DocView,
     prefs: &CommentPrefs,
     allowed: bool,
     nav: &mut Option<Nav>,
 ) -> Option<Edit> {
     crate::widgets::begin_dialog(ui);
+    let info = &doc.info;
     let mut edit = None;
     // Search (the header's magnifier toggles it).
     if let Some(q) = view.comments.search.as_mut() {
@@ -286,7 +287,7 @@ pub(crate) fn show(
         }
         let thread = replies_of(a);
         let rotation = info.pages.get(a.page).map_or(0, |p| p.rotation);
-        if let Some(e) = card(ui, view, CardContext { theme: t, annotation: a, rotation, thread, info, prefs, allowed, nav }) {
+        if let Some(e) = card(ui, view, CardContext { theme: t, annotation: a, rotation, thread, doc, prefs, allowed, nav }) {
             edit = Some(e);
         }
     }
@@ -301,14 +302,15 @@ struct CardContext<'a> {
     // The clockwise `/Rotate` of the comment's page.
     rotation: u16,
     thread: &'a [&'a Annotation],
-    info: &'a DocInfo,
+    doc: &'a pdfcraft_engine::Document,
     prefs: &'a CommentPrefs,
     allowed: bool,
     nav: &'a mut Option<Nav>,
 }
 
 fn card(ui: &mut egui::Ui, view: &mut DocView, context: CardContext<'_>) -> Option<Edit> {
-    let CardContext { theme: t, annotation: a, rotation, thread, info, prefs, allowed, nav } = context;
+    let CardContext { theme: t, annotation: a, rotation, thread, doc, prefs, allowed, nav } = context;
+    let info = &doc.info;
     let mut edit = None;
     let key = (a.page, a.index);
     let selected = view.comments.selected == Some(key);
@@ -405,7 +407,7 @@ fn card(ui: &mut egui::Ui, view: &mut DocView, context: CardContext<'_>) -> Opti
                             if selected && allowed && !r.grouped {
                                 ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
                                     let more = icons::button(ui, "ellipsis", 20.0, false, tl!("Options for this reply"));
-                                    if let Some(e) = reply_menu(ui, view, r, info, &more) {
+                                    if let Some(e) = reply_menu(ui, view, r, doc, &more) {
                                         edit = Some(e);
                                     }
                                 });
@@ -525,10 +527,7 @@ fn card(ui: &mut egui::Ui, view: &mut DocView, context: CardContext<'_>) -> Opti
             }
             ui.separator();
             // A locked reply can't be deleted, so it keeps the comment it answers too.
-            if ui
-                .add_enabled(!a.locked && !crate::comments::locked_below(&info.annotations, (a.page, a.index)), egui::Button::new(tl!("Delete")))
-                .clicked()
-            {
+            if ui.add_enabled(doc.annotation_deletable(a.page, a.index), egui::Button::new(tl!("Delete"))).clicked() {
                 view.comments.selected = None;
                 edit = Some(Edit::DeleteAnnotation { page: a.page, index: a.index });
                 ui.close();
@@ -566,7 +565,7 @@ fn inline_editor(ui: &mut egui::Ui, t: &Tokens, view: &mut DocView, key: (usize,
 /// the reply alone, with what hangs off it (its own replies, status changes and pop-up), as
 /// deleting a comment takes its thread; the comment and its other replies stay. Returns the
 /// edit to apply.
-fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, info: &DocInfo, more: &egui::Response) -> Option<Edit> {
+fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, doc: &pdfcraft_engine::Document, more: &egui::Response) -> Option<Edit> {
     let mut edit = None;
     let menu_id = ui.scope_id().with(("reply-menu", r.page, r.index));
     if more.clicked() {
@@ -589,10 +588,7 @@ fn reply_menu(ui: &egui::Ui, view: &mut DocView, r: &Annotation, info: &DocInfo,
             ui.separator();
             // The card stays selected: the app finds its comment again after the delete. A locked
             // reply to this one keeps it.
-            if ui
-                .add_enabled(!r.locked && !crate::comments::locked_below(&info.annotations, (r.page, r.index)), egui::Button::new(tl!("Delete")))
-                .clicked()
-            {
+            if ui.add_enabled(doc.annotation_deletable(r.page, r.index), egui::Button::new(tl!("Delete"))).clicked() {
                 edit = Some(Edit::DeleteAnnotation { page: r.page, index: r.index });
                 ui.close();
             }
diff --git a/crates/ui-egui/src/panels/right.rs b/crates/ui-egui/src/panels/right.rs
index 0470543acb..a4bb7e62f8 100644
--- a/crates/ui-egui/src/panels/right.rs
+++ b/crates/ui-egui/src/panels/right.rs
@@ -178,7 +178,7 @@ pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 }
                 egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| match panel {
                     RightPanel::Comments => {
-                        if let Some(e) = crate::comments_panel::show(ui, &t, info, view, prefs, comment_allowed, &mut nav) {
+                        if let Some(e) = crate::comments_panel::show(ui, &t, doc, view, prefs, comment_allowed, &mut nav) {
                             panel_edit = Some(e);
                         }
                     }
diff --git a/crates/ui-egui/src/tools/comments.rs b/crates/ui-egui/src/tools/comments.rs
index d86a0d58d2..6f3c074427 100644
--- a/crates/ui-egui/src/tools/comments.rs
+++ b/crates/ui-egui/src/tools/comments.rs
@@ -47,7 +47,7 @@ use paint::{changing_points, drawn_shape, edited_in_view};
 use state::after_delete;
 use state::login_name;
 pub use state::{CommentView, Composer, ComposerKind, Gesture, SortBy};
-pub(crate) use state::{EditorFocus, PageCx, locked_below};
+pub(crate) use state::{EditorFocus, PageCx};
 
 /// Acrobat's selection blue for annotation frames and handles (11-visual-spec §5).
 const SELECT_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
diff --git a/crates/ui-egui/src/tools/comments/menu.rs b/crates/ui-egui/src/tools/comments/menu.rs
index 0ce50e5077..52ea8d707d 100644
--- a/crates/ui-egui/src/tools/comments/menu.rs
+++ b/crates/ui-egui/src/tools/comments/menu.rs
@@ -1,5 +1,5 @@
 use super::paint::edit_anchor;
-use super::state::{Composer, ComposerKind, locked_below};
+use super::state::{Composer, ComposerKind};
 use super::{
     Annotation, Color32, CommentPrefs, CommentTool, DocInfo, DocView, Edit, Rect, ReviewState, Rgb, SELECT_BLUE, SWATCHES, Sense, Stroke, color32,
     icons, theme, tool_for, vec2,
@@ -24,10 +24,13 @@ pub(crate) fn attachment_items(ui: &mut egui::Ui, view: &mut DocView, info: &Doc
 
 /// Items of the canvas context menu for the selected comment (or the page).
 /// `can_modify`: the document's pages may change (Flatten comments draws into them).
+/// `deletable`: whether Delete would delete the comment at (page, index) (the engine's
+/// `Document::annotation_deletable`: unlocked, and no locked reply to it).
 pub(crate) fn context_menu(
     ui: &mut egui::Ui,
     view: &mut DocView,
     info: &DocInfo,
+    deletable: &dyn Fn(usize, usize) -> bool,
     prefs: &CommentPrefs,
     allowed: bool,
     can_modify: bool,
@@ -89,8 +92,8 @@ pub(crate) fn context_menu(
                 ui.close();
             }
             ui.separator();
-            // A locked reply can't be deleted, so it keeps the comment it answers too.
-            if ui.add_enabled(allowed && !a.locked && !locked_below(&info.annotations, (page, index)), egui::Button::new(tl!("Delete"))).clicked() {
+            // The engine's own check: a locked comment, or one with a locked reply, stays.
+            if ui.add_enabled(allowed && deletable(page, index), egui::Button::new(tl!("Delete"))).clicked() {
                 view.comments.selected = None;
                 action = Some(CanvasAction::Edit(Box::new(Edit::DeleteAnnotation { page, index })));
                 ui.close();
diff --git a/crates/ui-egui/src/tools/comments/state.rs b/crates/ui-egui/src/tools/comments/state.rs
index c9ca91fb01..db45041906 100644
--- a/crates/ui-egui/src/tools/comments/state.rs
+++ b/crates/ui-egui/src/tools/comments/state.rs
@@ -275,14 +275,6 @@ fn in_thread(page: &[&Annotation], top: (usize, usize)) -> impl Fn(usize) -> boo
     }
 }
 
-/// Whether a reply to the annotation at `top`, at any depth, is locked: deleting it is refused
-/// then, as the reply can't be deleted.
-pub(crate) fn locked_below(annotations: &[Annotation], top: (usize, usize)) -> bool {
-    let page = on_page(annotations, top.0);
-    let goes = in_thread(&page, top);
-    page.iter().any(|a| a.index != top.1 && a.locked && goes(a.index))
-}
-
 /// The annotations listed on `page`, in `/Annots` order.
 fn on_page(list: &[Annotation], page: usize) -> Vec<&Annotation> {
     let mut v: Vec<&Annotation> = list.iter().filter(|a| a.page == page).collect();
diff --git a/crates/ui-egui/src/tools/comments/tests.rs b/crates/ui-egui/src/tools/comments/tests.rs
index 36644bb445..2d6641f2d3 100644
--- a/crates/ui-egui/src/tools/comments/tests.rs
+++ b/crates/ui-egui/src/tools/comments/tests.rs
@@ -90,25 +90,6 @@ fn listed(page: usize, index: usize, contents: &str, parent: Option<(usize, usiz
     }
 }
 
-/// A locked reply at any depth keeps what it answers, up its own chain only: its comment, the
-/// reply above it, but not a sibling reply or a comment on another page.
-#[test]
-fn a_locked_reply_keeps_the_replies_and_comment_above_it() {
-    let lock = |a: Annotation| Annotation { locked: true, ..a };
-    let list = vec![
-        listed(0, 0, "comment", None),
-        listed(0, 1, "A", Some((0, 0))),
-        lock(listed(0, 2, "to A, locked", Some((0, 1)))),
-        listed(0, 3, "B", Some((0, 0))),
-        listed(1, 0, "other page", None),
-    ];
-    assert!(locked_below(&list, (0, 0)), "the comment");
-    assert!(locked_below(&list, (0, 1)), "the reply above the locked one");
-    assert!(!locked_below(&list, (0, 2)), "the locked reply itself: its own lock says so");
-    assert!(!locked_below(&list, (0, 3)), "a sibling reply");
-    assert!(!locked_below(&list, (1, 0)), "another page");
-}
-
 /// What stays selected or open in the editor after a delete is found where it moved to: the
 /// reply's own replies go with it (pop-ups, unlisted, are gone too), and a page that lost
 /// something else, or whose annotation in that place reads differently, keeps nothing.
@@ -371,7 +352,7 @@ fn context_menu_colour_submenu_keeps_its_picker_open_and_a_swatch_closes_the_men
     let mut h = egui_kittest::Harness::new_ui_state(
         |ui, (view, actions): &mut (DocView, Vec<CanvasAction>)| {
             ui.button("Page").context_menu(|ui| {
-                if let Some(a) = context_menu(ui, view, &info, &prefs, true, true) {
+                if let Some(a) = context_menu(ui, view, &info, &|_, _| true, &prefs, true, true) {
                     actions.push(a);
                 }
             });
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c4670a584b..4f897b4897 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4003,7 +4003,7 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_delete"]
-evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies", "crates/annot/src/tests.rs::a_locked_reply_keeps_what_it_answers", "crates/ui-egui/src/tools/comments/tests.rs::a_locked_reply_keeps_the_replies_and_comment_above_it", "crates/engine/src/tests.rs::a_stamp_with_a_locked_reply_still_has_its_drag_layers"]
+evidence = ["crates/ui-egui/tests/it/comments.rs::comments_are_selected_moved_and_deleted_with_the_select_tool", "crates/annot/src/tests.rs::delete_takes_popup_and_reply_chain", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/src/tools/comments/tests.rs::a_kept_comment_is_found_where_a_delete_moved_it", "crates/automation/tests/it/automation.rs::deleting_a_reply_keeps_its_comment_and_the_other_replies", "crates/annot/src/tests.rs::a_locked_reply_keeps_what_it_answers", "crates/engine/src/tests.rs::a_stamp_with_a_locked_reply_still_has_its_drag_layers"]
 notes = "deletes the pop-up and the reply thread. One reply is deleted from its own \"…\" in the Comments panel (comment_delete with the reply's id, or page and index), with its pop-up and the replies to it: the comment and its other replies stay, one undo step, and the card stays selected. A locked reply can't be deleted, nor the comment or reply it answers while it is locked (their Delete is greyed out; a stamp or signature with a locked reply still drags with its live preview)."
 
 [[feature]]

From 30ed249a280686903a0c7b541578de1f228cba5d Mon Sep 17 00:00:00 2001
From: Hamza <mail.hamzanaveed@gmail.com>
Date: Wed, 28 Oct 2026 19:32:00 +0500
Subject: [PATCH 044/132] Content streams: step over a malformed token instead
 of ending the page

A malformed token ended the content stream where it stood, so the renderer,
text extraction, Find and search-based redaction all lost the rest of the
page -- while the edit reader, MuPDF and pdftotext read it (#3565, #3568). A
redaction that cannot see the text below the bad token cannot remove it,
which is the part that matters.

Each malformed shape is stepped over instead: an unterminated string, a
number that is only a sign or a dot, a name with a bad hex escape, an
unbalanced dictionary or array. Content after an inline image whose data
holds `EI` is still read, under a bounded lookahead.

Rebased onto main, 1,898 commits on: the tokenizer is still
vendor/hayro-syntax/src/content/mod.rs and applied as it was, and render's
raster.rs is split, so the two tests went to render/raster/tests.rs.
---
 crates/render/src/raster/tests.rs      |  73 ++++++++++++++++
 vendor/hayro-syntax/src/content/mod.rs | 116 +++++++++++++++++++++----
 2 files changed, 174 insertions(+), 15 deletions(-)

diff --git a/crates/render/src/raster/tests.rs b/crates/render/src/raster/tests.rs
index 36299d74fd..696eaddb61 100644
--- a/crates/render/src/raster/tests.rs
+++ b/crates/render/src/raster/tests.rs
@@ -7035,3 +7035,76 @@ fn test_clip_only_text_raster_preserves_clipping_without_painting() {
     assert!(pixels.contains(&[0, 0, 255, 255]), "fill shows through the 7 Tr clip");
     assert!(pixels.contains(&white), "the clip is text-shaped, not the whole page");
 }
+
+/// A malformed token in a content stream used to end the stream there, so the renderer, text
+/// extraction, Find and search-based redaction lost the rest of the page while the edit
+/// reader, MuPDF and pdftotext read it (#3565, #3568). Each token below is now stepped over.
+#[test]
+fn a_malformed_token_does_not_end_the_content_stream() {
+    // One token between two text objects. `BEFORE` is drawn before it, `AFTER` after.
+    let page = |token: &str| {
+        let stream = format!("BT /F1 8 Tf 2 30 Td (BEFORE) Tj ET {token} BT /F1 8 Tf 2 10 Td (AFTER) Tj ET");
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 60 40] /Resources << /Font << /F1 5 0 R >> >> /Contents 4 0 R >> endobj\n5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", stream.len()).as_bytes());
+        pdf.extend_from_slice(stream.as_bytes());
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let text = renderer.render(RenderRequest { page: 0, kind: RequestKind::Text, ..Default::default() });
+        assert!(text.error.is_none(), "{token}: {:?}", text.error);
+        text.text.expect("a text layer").plain_text()
+    };
+
+    for token in [
+        // A `re` with three operands: the typed iterator used to abort on a path operator it
+        // could not dispatch, which is what #3568 reports.
+        "20 10 10 re",
+        // More operands than the limit (ISO 32000-2 Annex C gives 10): the instruction is
+        // dropped, not the stream.
+        "0 0 0 0 0 0 0 0 0 0 0 g",
+        // A stray delimiter: the lexer could not read an operator and jumped to the end.
+        ")",
+        // The same with no space after it. Stepping over the regular characters that follow a
+        // delimiter ate the next operator, so the page lost its second text object
+        // (#3636 review); only the delimiter is stepped over.
+        ")BT ET",
+        // A malformed `#` escape in a name, so neither an object nor an operator read.
+        "/C#2 gs",
+        // And the well-formed forms still work.
+        "20 10 10 5 re n",
+        "0.5 g",
+    ] {
+        let text = page(token);
+        assert!(text.contains("BEFORE"), "{token}: {text:?}");
+        assert!(text.contains("AFTER"), "{token}: the rest of the page was lost: {text:?}");
+        assert!(text.find("BEFORE") < text.find("AFTER"), "{token}: the page is read in order: {text:?}");
+    }
+}
+
+/// Content after an inline image whose data holds `EI` is still read. This pins the property
+/// but does **not** exercise the look-ahead gating added for #3636's review: accepting a false
+/// `EI` truncates the image, while the text after the real one is read either way, and this
+/// assertion passes with the gating removed. Showing the truncation needs valid ASCII85 data
+/// that contains `EI`, which this fixture does not have.
+#[test]
+fn content_after_an_inline_image_holding_ei_is_still_read() {
+    // An ASCII85 image whose data holds `EI\n`, then an `re` with three operands and twenty
+    // `q`s -- enough steps to satisfy the look-ahead's counter if the bad `re` were skipped --
+    // before the real `EI`. `AFTER` is drawn once the image is over.
+    let stream = b"q 100 0 0 100 10 10 cm BI /W 4 /H 4 /CS /G /BPC 8 /F /A85 ID EI
+20 10 10 re q q q q q q q q q q q q q q q q q q q q EI Q BT /F1 8 Tf 2 4 Td (AFTER) Tj ET"
+        .to_vec();
+    let mut pdf =
+        b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 120 120] /Resources << /Font << /F1 5 0 R >> >> /Contents 4 0 R >> endobj\n5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj\n"
+            .to_vec();
+    pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", stream.len()).as_bytes());
+    pdf.extend_from_slice(&stream);
+    pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+
+    let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+    let text = renderer.render(RenderRequest { page: 0, kind: RequestKind::Text, ..Default::default() });
+    assert!(text.error.is_none(), "{:?}", text.error);
+    let page = text.text.expect("a text layer").plain_text();
+    // The image ran to the real `EI`, so the text after it is the page's only text: the first
+    // `EI` inside the data was not taken for the end.
+    assert!(page.contains("AFTER"), "the content after the image was lost: {page:?}");
+}
diff --git a/vendor/hayro-syntax/src/content/mod.rs b/vendor/hayro-syntax/src/content/mod.rs
index e37044c5d7..33c0e5bd05 100644
--- a/vendor/hayro-syntax/src/content/mod.rs
+++ b/vendor/hayro-syntax/src/content/mod.rs
@@ -117,6 +117,15 @@ const MAX_EI_LOOKAHEAD_STEPS: u32 = 256;
 pub trait ContentTokenizer<'a> {
     /// Return the next instruction, or `None` after the content stream ends or becomes invalid.
     fn next_instruction<'b>(&'b mut self) -> Option<Instruction<'b, 'a>>;
+
+    /// PdfCraft patch: whether this tokenizer is only judging whether bytes read as content, as
+    /// the look-ahead past a candidate `EI` does. Such a pass must not recover from a malformed
+    /// token: its whole purpose is to find out whether the bytes are content, and answering
+    /// "yes, once the bad parts are skipped" of an inline image's data would cut the image at a
+    /// false `EI` (#3636 review).
+    fn judging_only(&self) -> bool {
+        false
+    }
 }
 
 /// An iterator over operators in the PDF content streams, providing raw access to the
@@ -181,6 +190,11 @@ impl<'a> UntypedIter<'a> {
             self.committed = self.skip_blanks_and_comments();
         }
 
+        // PdfCraft patch: set when this instruction carried more operands than the limit. Its
+        // operator is then dropped with them, rather than applied to the ones that did fit
+        // (#3568).
+        let mut overflowed = false;
+
         while !self.reader.at_end() {
             // I believe booleans/null never appear as an operator?
             if matches!(
@@ -198,14 +212,31 @@ impl<'a> UntypedIter<'a> {
                     if self.undecided() {
                         return None;
                     }
-                    self.stack.push(object)?;
+                    if self.stack.push(object).is_none() {
+                        overflowed = true;
+                    }
                 } else if self.reader.read_without_context::<Operator<'_>>().is_some() {
                     if self.undecided() {
                         return None;
                     }
                     self.stack.clear();
+                } else if self.undecided() {
+                    return None;
+                } else if !self.lookahead && self.reader.peek_byte() == Some(b'/') && self.skip_bad_token() {
+                    // PdfCraft patch: a name the lexer cannot read -- a malformed `#` escape, as
+                    // in `/C#2 gs` -- used to end the stream, losing the rest of the page. Step
+                    // over it and carry on, as the edit reader and other readers do (#3568).
+                    //
+                    // Only a name. An operand that is well formed but refused by a resource cap
+                    // (a dictionary nested past the limit) still ends the stream, which is what
+                    // `dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap` in
+                    // pdfcraft's renderer asserts: reading on there would draw a page whose
+                    // content was deliberately not parsed.
+                    warn!("skipped an unreadable name in content stream");
+                    self.stack.clear();
+                    overflowed = false;
+                    continue;
                 } else {
-                    self.undecided();
                     return None;
                 }
             } else {
@@ -218,6 +249,14 @@ impl<'a> UntypedIter<'a> {
 
                         warn!("failed to read operator in content stream");
 
+                        // PdfCraft patch: a stray delimiter (`)`, say) ended the stream here, so
+                        // the rest of the page was lost. Step over it and carry on (#3568).
+                        if !self.lookahead && self.skip_bad_token() {
+                            self.stack.clear();
+                            overflowed = false;
+                            continue;
+                        }
+
                         self.reader.jump_to_end();
                         return None;
                     }
@@ -443,6 +482,17 @@ impl<'a> UntypedIter<'a> {
                     }
                 }
 
+                if overflowed && !self.lookahead {
+                    // PdfCraft patch: see `overflowed` above. ISO 32000-2 Annex C gives 10 as the
+                    // historical operand limit; past it the instruction is dropped whole.
+                    warn!("dropped an instruction with more operands than the limit");
+                    self.stack.clear();
+                    overflowed = false;
+                    self.committed = self.reader.offset();
+                    self.reader.skip_white_spaces_and_comments();
+                    continue;
+                }
+
                 self.operator = Some(operator);
                 self.committed = self.reader.offset();
                 // PdfCraft patch (28): operands in reading order, if some were dropped.
@@ -484,6 +534,36 @@ impl<'a> UntypedIter<'a> {
         open_comment.unwrap_or(self.reader.offset())
     }
 
+    /// PdfCraft patch: step over one token the lexer could not read, so the rest of the stream is
+    /// still read instead of the page ending there. A delimiter stands alone; anything else runs
+    /// to the next delimiter or space. At least one byte is always consumed when this returns
+    /// true, so the loop in `next` cannot spin (#3568).
+    fn skip_bad_token(&mut self) -> bool {
+        let before = self.reader.offset();
+        match self.reader.peek_byte() {
+            None => return false,
+            // Never step over a good token: called where the blanks after the last one have not
+            // been skipped yet, there is nothing bad here to skip. Skipping ` BT` cost the page
+            // its second text object while this was being written.
+            Some(b) if is_white_space_character(b) || b == b'%' => {}
+            // A name reads to the next delimiter, malformed escapes included.
+            Some(b'/') => {
+                let _ = skip_name_like(&mut self.reader, true);
+            }
+            // A token of regular characters runs to the next delimiter or space.
+            Some(b) if is_regular_character(b) => {
+                self.reader.forward_while(is_regular_character);
+            }
+            // A delimiter stands alone. Consuming what follows it would eat the next operator:
+            // `)BT` cost the page its second text object while this was being written
+            // (#3636 review).
+            Some(_) => self.reader.forward(),
+        }
+        // Land on the next token, as the end of the loop in `next` does.
+        self.reader.skip_white_spaces_and_comments();
+        self.reader.offset() > before
+    }
+
     /// PdfCraft patch: whether the instruction being read ran into the end of a window, so it
     /// cannot be decided yet. Records that more data is needed.
     fn undecided(&mut self) -> bool {
@@ -499,6 +579,10 @@ impl<'a> ContentTokenizer<'a> for UntypedIter<'a> {
     fn next_instruction<'b>(&'b mut self) -> Option<Instruction<'b, 'a>> {
         self.next()
     }
+
+    fn judging_only(&self) -> bool {
+        self.lookahead
+    }
 }
 
 
@@ -557,6 +641,8 @@ where
     /// Return the next typed instruction.
     #[allow(clippy::should_implement_trait)]
     pub fn next(&mut self) -> Option<TypedInstruction<'_, 'a>> {
+        // Read before the instruction borrows the tokenizer.
+        let judging = self.untyped.judging_only();
         let op = self.untyped.next_instruction()?;
         // TODO: Explore whether dispatching can be made more efficient.
         match TypedInstruction::dispatch(&op) {
@@ -565,22 +651,22 @@ where
             // operator was used, let's abort completely, otherwise we might end up drawing random stuff.
             // However, for other operators it could be worth it to just skip it but keep attempting
             // to read other content operators.
+            // PdfCraft patch: a path operator whose operands do not fit it contributes nothing to
+            // the path, so skipping it leaves the path as it was -- the same state the abort
+            // below used to leave it in, except that the rest of the page is still read. Ending
+            // the stream here lost every later operator, and with it the rest of the page, its
+            // text and anything a redaction search would have matched (#3568).
             None => {
-                if [
-                    &b"m"[..],
-                    &b"l"[..],
-                    &b"c"[..],
-                    &b"v"[..],
-                    &b"y"[..],
-                    &b"h"[..],
-                    &b"re"[..],
-                ]
-                .contains(&op.operator.0.deref())
+                // A pass that is only judging whether bytes read as content must still stop at a
+                // path operator it cannot dispatch: counting it as a step would let an inline
+                // image's data pass for a content stream and cut the image at a false `EI`
+                // (#3636 review).
+                if judging
+                    && [&b"m"[..], &b"l"[..], &b"c"[..], &b"v"[..], &b"y"[..], &b"h"[..], &b"re"[..]].contains(&op.operator.0.deref())
                 {
-                    None
-                } else {
-                    Some(TypedInstruction::Fallback(op.operator))
+                    return None;
                 }
+                Some(TypedInstruction::Fallback(op.operator))
             }
         }
     }

From bcaead540438f9aa52dcca940697bbd339998104 Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 28 Oct 2026 15:49:39 -0400
Subject: [PATCH 045/132] =?UTF-8?q?M10:=20PDF=20=E2=96=B8=20Markdown=20exp?=
 =?UTF-8?q?ort,=20through=20doc=5Fexport=5Foffice=20with=20a=20.md=20path?=
 =?UTF-8?q?=20(#1595)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ROADMAP.md                               |   1 +
 crates/automation/src/a11y/documents.rs  |   2 +-
 crates/automation/src/tools.rs           |   2 +-
 crates/automation/tests/it/automation.rs |   6 +-
 crates/engine/src/compare.rs             |  11 ++-
 crates/export/src/as_markdown.rs         | 104 +++++++++++++++++++++++
 crates/export/src/lib.rs                 |   6 +-
 crates/export/src/tests.rs               |  63 ++++++++++++++
 8 files changed, 188 insertions(+), 7 deletions(-)
 create mode 100644 crates/export/src/as_markdown.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index f5de8044e1..e230d6e578 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -449,6 +449,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 Newest first: the date, what moved, and the new overall estimate.
 
+- **2026-10-28 (M10, #1595):** Export to Markdown: `doc_export_office` with a `.md` or `.markdown` path writes CommonMark with GitHub pipe tables (headings, paragraphs with bold and italic, tables with their first row as the header, a rule between pages); text that Markdown would read as markup is escaped. Images, lists and links are not in the export's layout model and are left out. No menu item yet. Estimates unchanged.
 - **2026-10-12 (M3, GNOME title bar, #553):** On GNOME's Wayland session, whose compositor draws no window frames (it offers no `zxdg_decoration_manager_v1`), PdfCraft no longer shows winit's fallback title bar: it turns the frame off and the tab strip becomes the header bar, as in GNOME's own apps. Minimize, maximize/restore and close are drawn in Adwaita's style, in the order and on the side GNOME's `button-layout` names (Fedora's default shows only close); the window's edges and corners resize it, and a hairline outlines it while it isn't maximized. Preferences ▸ Use system title bar (shown only there) gives the window back winit's frame at once, without a restart (part of #1001), and `PDFCRAFT_TITLEBAR=app|system` overrides the choice. KDE, Sway, Hyprland, COSMIC and X11 keep the frame their desktop draws. Not done: right-clicking the header bar doesn't open GNOME's window menu (egui can't ask for it), the window has no shadow or rounded corners, the resize edges lie just inside the window rather than outside it, and Windows still uses its system frame (the rest of #1001). Estimates unchanged.
 - **2026-10-12 (M0, build label):** A local or patched build can carry a label, set at compile time with `PDFCRAFT_BUILD_LABEL`: `pdfcraft --version`, `pdfcraft-cli --version`, About and the log show `0.7.1 (titlebar)`, and `packaging/linux/package.sh` names the files `pdfcraft-0.7.1-titlebar-…` and makes the .rpm/.deb release `1.titlebar`, which upgrades over the release of the same version (and the next release over it). The version itself is unchanged, so the update check still compares it with published releases. Unlabelled builds are as before. Estimates unchanged.
 - **2026-10-11 (M6, #1208):** Dropdown and list-box Field Properties expose the existing Left/Center/Right alignment picker. Existing alignment stays intact until changed; cancel, undo/redo and save/reopen are covered through the real UI without changing options, values or flags. Estimates unchanged.
diff --git a/crates/automation/src/a11y/documents.rs b/crates/automation/src/a11y/documents.rs
index f2c9f6b77d..e52768d535 100644
--- a/crates/automation/src/a11y/documents.rs
+++ b/crates/automation/src/a11y/documents.rs
@@ -5,7 +5,7 @@ impl Automation {
         let path = self.resolve(a.str("path")?, true)?;
         let ext = path.extension().map(|e| e.to_string_lossy().into_owned()).unwrap_or_default();
         let format = pdfcraft_engine::compare::OfficeFormat::from_extension(&ext)
-            .ok_or_else(|| ToolError::InvalidArgs(format!("unsupported extension {ext:?} (docx, pptx, html or rtf)")))?;
+            .ok_or_else(|| ToolError::InvalidArgs(format!("unsupported extension {ext:?} (docx, pptx, html, rtf or md)")))?;
         let export = self.doc_to_copy(a)?.export_office_checked(format);
         write_atomic(&path, &export.bytes)?;
         // Text left out to keep a hostile page bounded is said, not silent (#3120).
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 4b4ac8873b..38ed3306fd 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1154,7 +1154,7 @@ pub fn tools() -> Vec<ToolDef> {
                 json!({ "doc": doc(), "field": { "type": "string" }, "event": { "type": "string", "enum": ["keystroke", "format", "validate", "calculate", "mouse_up"] }, "script": { "type": "string" } }),
                 &["doc", "field", "event"],
             )),
-        t("doc_export_office", "Export to Word, PowerPoint, HTML or RTF", "Export a PDF ▸ Word (.docx), PowerPoint (.pptx, one slide per page), HTML (.html, one file with images inline) or RTF (.rtf), chosen by path's extension: text, headings, bold and italic. Word uses borderless inferred tables and positioned editable shapes on pages with artwork, rotated or large text; each source page retains its size. Font matching and vector graphics remain limited. Export reads forms 50 deep and up to 50 000 a page, counting forms the page draws itself. Pages that go past either limit are listed in truncated_pages, with a warning; the text and images of the forms left out are missing.")
+        t("doc_export_office", "Export to Word, PowerPoint, HTML, RTF or Markdown", "Export a PDF ▸ Word (.docx), PowerPoint (.pptx, one slide per page), HTML (.html, one file with images inline), RTF (.rtf) or Markdown (.md or .markdown: pipe tables, images left out), chosen by path's extension: text, headings, bold and italic. Word uses borderless inferred tables and positioned editable shapes on pages with artwork, rotated or large text; each source page retains its size. Font matching and vector graphics remain limited. Export reads forms 50 deep and up to 50 000 a page, counting forms the page draws itself. Pages that go past either limit are listed in truncated_pages, with a warning; the text and images of the forms left out are missing.")
             .cmd("export.docx")
             .with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
         t("pdfa_verify", "Verify PDF/A", "Standards ▸ Verify PDF/A compliance: the PDF/A-2b or 3b rules the document breaks (ISO 19005 clause, message, page, whether Save as PDF/A can fix it), plus what it declares.")
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 78038d8ebd..4cdf0c8a03 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6830,7 +6830,7 @@ fn exporting_to_word_html_and_rtf() {
     let dir = workdir("office");
     let mut a = auto(&dir);
     let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
-    for ext in ["docx", "pptx", "html", "rtf"] {
+    for ext in ["docx", "pptx", "html", "rtf", "md"] {
         let r = ok(&mut a, "doc_export_office", json!({ "doc": doc, "path": format!("a.{ext}") }));
         assert_eq!(r["format"], ext);
     }
@@ -6839,6 +6839,10 @@ fn exporting_to_word_html_and_rtf() {
     assert!(std::fs::read(dir.join("a.docx")).unwrap().starts_with(b"PK"));
     assert!(std::fs::read(dir.join("a.pptx")).unwrap().starts_with(b"PK"));
     assert!(std::fs::read_to_string(dir.join("a.rtf")).unwrap().contains("Page 2"));
+    // #1595: Markdown, with a rule between pages.
+    let md = std::fs::read_to_string(dir.join("a.md")).unwrap();
+    assert!(md.contains("Page 1") && md.contains("Page 3") && md.matches("\n---\n").count() == 2, "{md}");
+    assert_eq!(ok(&mut a, "doc_export_office", json!({ "doc": doc, "path": "b.markdown" }))["format"], "md");
     assert!(a.call("doc_export_office", &json!({ "doc": doc, "path": "a.xyz" })).is_err());
 }
 
diff --git a/crates/engine/src/compare.rs b/crates/engine/src/compare.rs
index 044e40e2e2..dca1e24af5 100644
--- a/crates/engine/src/compare.rs
+++ b/crates/engine/src/compare.rs
@@ -141,6 +141,7 @@ pub enum OfficeFormat {
     Pptx,
     Html,
     Rtf,
+    Markdown,
 }
 
 impl OfficeFormat {
@@ -150,6 +151,7 @@ impl OfficeFormat {
             OfficeFormat::Pptx => "pptx",
             OfficeFormat::Html => "html",
             OfficeFormat::Rtf => "rtf",
+            OfficeFormat::Markdown => "md",
         }
     }
 
@@ -159,12 +161,13 @@ impl OfficeFormat {
             "pptx" => Some(OfficeFormat::Pptx),
             "html" | "htm" => Some(OfficeFormat::Html),
             "rtf" => Some(OfficeFormat::Rtf),
+            "md" | "markdown" => Some(OfficeFormat::Markdown),
             _ => None,
         }
     }
 }
 
-/// A Word, PowerPoint, HTML or RTF export ([`crate::Document::export_office_checked`]).
+/// A Word, PowerPoint, HTML, RTF or Markdown export ([`crate::Document::export_office_checked`]).
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct OfficeExport {
     /// The exported file.
@@ -275,14 +278,16 @@ impl crate::Document {
     /// [`Self::export_office`], and the pages whose text it had to leave out
     /// ([`OfficeExport::truncated_pages`]).
     pub fn export_office_checked(&self, format: OfficeFormat) -> OfficeExport {
-        // RTF leaves pictures out.
-        let (pages, truncated_pages) = self.export_pages_checked(format != OfficeFormat::Rtf, MAX_EXPORT_IMAGE_BYTES);
+        // RTF and Markdown leave pictures out.
+        let (pages, truncated_pages) =
+            self.export_pages_checked(!matches!(format, OfficeFormat::Rtf | OfficeFormat::Markdown), MAX_EXPORT_IMAGE_BYTES);
         let title = self.info.title.clone().unwrap_or_else(|| self.name.trim_end_matches(".pdf").to_string());
         let bytes = match format {
             OfficeFormat::Docx => pdfcraft_export::docx(&pages, &title),
             OfficeFormat::Pptx => pdfcraft_export::pptx(&pages, &title),
             OfficeFormat::Html => pdfcraft_export::html(&pages, &title).into_bytes(),
             OfficeFormat::Rtf => pdfcraft_export::rtf(&pages).into_bytes(),
+            OfficeFormat::Markdown => pdfcraft_export::markdown(&pages).into_bytes(),
         };
         OfficeExport { bytes, truncated_pages }
     }
diff --git a/crates/export/src/as_markdown.rs b/crates/export/src/as_markdown.rs
new file mode 100644
index 0000000000..0d2657f55e
--- /dev/null
+++ b/crates/export/src/as_markdown.rs
@@ -0,0 +1,104 @@
+use super::as_html::allowed;
+use super::layout::{Cell, Item, MAX_COLS, Page, items};
+
+/// Markdown's deepest heading.
+const MAX_HEADING: u8 = 6;
+
+/// `s` as Markdown text on one line: line breaks become spaces, control characters are dropped,
+/// and every character Markdown would read as markup is escaped with a backslash.
+fn md_text(s: &str) -> String {
+    let mut o = String::with_capacity(s.len());
+    for c in s.chars().filter(|c| allowed(*c)) {
+        match c {
+            '\n' | '\r' | '\t' => o.push(' '),
+            '\\' | '`' | '*' | '_' | '[' | ']' | '<' | '>' | '#' | '|' | '~' | '!' | '&' => {
+                o.push('\\');
+                o.push(c);
+            }
+            c => o.push(c),
+        }
+    }
+    o
+}
+
+/// `line` with its start escaped where Markdown would read a list item there (`- `, `+ `,
+/// `1. `, `1) `); the other block markers (`#`, `>`) are escaped by [`md_text`] already.
+fn block_start(line: String) -> String {
+    let digits = line.bytes().take_while(u8::is_ascii_digit).count();
+    match line.as_bytes().get(digits) {
+        Some(b'.' | b')') if digits > 0 => format!("{}\\{}", line.get(..digits).unwrap_or_default(), line.get(digits..).unwrap_or_default()),
+        Some(b'-' | b'+') if digits == 0 => format!("\\{line}"),
+        _ => line,
+    }
+}
+
+/// `text` (already escaped) in bold and/or italic. The markers go around the text without its
+/// outer spaces, which Markdown would not read as emphasis.
+pub(crate) fn emphasis(text: &str, bold: bool, italic: bool) -> String {
+    let core = text.trim();
+    if core.is_empty() || !(bold || italic) {
+        return text.to_string();
+    }
+    let lead = text.get(..text.len().saturating_sub(text.trim_start().len())).unwrap_or_default();
+    let trail = text.get(text.trim_end().len()..).unwrap_or_default();
+    let mark = match (bold, italic) {
+        (true, true) => "***",
+        (true, false) => "**",
+        _ => "*",
+    };
+    format!("{lead}{mark}{core}{mark}{trail}")
+}
+
+fn cell(c: &Cell) -> String {
+    emphasis(&md_text(&c.text), c.bold, c.italic)
+}
+
+/// Markdown (CommonMark, with GitHub's pipe tables): headings, paragraphs with bold and italic,
+/// tables with their first row as the header, and a rule between pages. Images are left out.
+pub fn markdown(pages: &[Page]) -> String {
+    let mut blocks: Vec<String> = Vec::new();
+    for it in items(pages) {
+        match it {
+            Item::Para(runs, lvl) => {
+                // A heading's weight is the heading's own, as in the HTML export.
+                let text: String = runs.iter().map(|r| emphasis(&md_text(&r.text), r.block.bold && lvl == 0, r.block.italic)).collect();
+                let text = text.trim();
+                if text.is_empty() {
+                    continue;
+                }
+                blocks.push(match lvl {
+                    0 => block_start(text.to_string()),
+                    l => format!("{} {text}", "#".repeat(usize::from(l.min(MAX_HEADING)))),
+                });
+            }
+            Item::Table(t) => {
+                // Each row as wide as the widest; a cell spanning columns is followed by empty ones.
+                // Detected tables have at most MAX_COLS columns, and a span never counts for more.
+                let span = |c: &Cell| c.span.clamp(1, MAX_COLS);
+                let width = t.rows.iter().map(|r| r.iter().map(span).fold(0usize, usize::saturating_add)).max().unwrap_or(0);
+                if width == 0 {
+                    continue;
+                }
+                let mut lines = Vec::with_capacity(t.rows.len().saturating_add(1));
+                for (i, row) in t.rows.iter().enumerate() {
+                    let mut cells: Vec<String> = Vec::with_capacity(width);
+                    for c in row {
+                        cells.push(cell(c));
+                        cells.extend(std::iter::repeat_n(String::new(), span(c).saturating_sub(1)));
+                    }
+                    cells.resize(width, String::new());
+                    lines.push(format!("| {} |", cells.join(" | ")));
+                    if i == 0 {
+                        lines.push(format!("|{}", " --- |".repeat(width)));
+                    }
+                }
+                blocks.push(lines.join("\n"));
+            }
+            Item::Img(_) => {}
+            Item::PageBreak => blocks.push("---".into()),
+        }
+    }
+    let mut s = blocks.join("\n\n");
+    s.push('\n');
+    s
+}
diff --git a/crates/export/src/lib.rs b/crates/export/src/lib.rs
index 5275b02439..54d8500a99 100644
--- a/crates/export/src/lib.rs
+++ b/crates/export/src/lib.rs
@@ -1,4 +1,4 @@
-//! pdfcraft-export — Export a PDF ▸ Word, HTML, RTF (L4).
+//! pdfcraft-export — Export a PDF ▸ Word, HTML, RTF, Markdown (L4).
 //!
 //! The engine reduces each page to [`Page`]: paragraphs (text, box, size, bold/italic) and
 //! images (encoded bytes and box), in reading order. The writers turn that into a flowing
@@ -18,6 +18,7 @@ pub use zip::Zip;
 
 mod as_docx;
 mod as_html;
+mod as_markdown;
 mod as_rtf;
 mod layout;
 
@@ -29,6 +30,9 @@ pub(crate) use as_html::esc;
 pub use as_html::html;
 #[cfg(test)]
 use as_html::{allowed, base64};
+#[cfg(test)]
+use as_markdown::emphasis;
+pub use as_markdown::markdown;
 pub use as_rtf::rtf;
 pub use layout::{Block, Cell, Image, Page, Table};
 #[cfg(test)]
diff --git a/crates/export/src/tests.rs b/crates/export/src/tests.rs
index d735eb4c20..be4708da42 100644
--- a/crates/export/src/tests.rs
+++ b/crates/export/src/tests.rs
@@ -769,3 +769,66 @@ fn a_paragraph_is_a_heading_only_when_its_text_is() {
     assert!(!xml.contains("Heading2"), "the lead-in made its paragraph a heading: {xml}");
     assert_eq!(word_paragraphs(&xml).len(), 2, "{xml}");
 }
+
+/// #1595: Markdown gets the headings, paragraphs and a rule between pages, in reading order;
+/// images are left out.
+#[test]
+fn markdown_has_headings_paragraphs_and_page_rules_in_order() {
+    let md = markdown(&[page(), page()]);
+    let order: Vec<usize> = ["# Annual Report\n\n", "## Overview\n\n", "Some \\<body\\> text \\& more", "Body text after the picture", "\n\n---\n\n"]
+        .iter()
+        .map(|x| md.find(x).unwrap_or_else(|| panic!("{x:?} missing in {md}")))
+        .collect();
+    assert!(order.windows(2).all(|w| w[0] < w[1]), "{md}");
+    assert_eq!(md.matches("\n---\n").count(), 1, "one rule between two pages: {md}");
+    assert_eq!(md.matches("# Annual Report").count(), 2, "{md}");
+    assert!(!md.contains("PNG") && !md.contains("!["), "images are left out: {md}");
+    assert!(md.ends_with(".\n") && !md.ends_with("\n\n"), "{md:?}");
+}
+
+/// #1595: text Markdown would read as markup stays text, emphasis wraps a run without its outer
+/// spaces, and a detected table becomes a pipe table with its first row as the header.
+#[test]
+fn markdown_escapes_markup_and_keeps_emphasis_and_tables() {
+    let b = |t: &str, y: f64, bold: bool, italic: bool| Block {
+        text: t.into(),
+        rect: [72.0, y, 500.0, y + 11.0],
+        size: 11.0,
+        bold,
+        italic,
+        color: [0.0; 3],
+        rotation: 0.0,
+        space_around: [false; 2],
+    };
+    let p = Page {
+        width: 612.0,
+        height: 792.0,
+        blocks: vec![
+            b("- not a list item, and long enough to make eleven points the body size here", 700.0, false, false),
+            b("1. not a numbered item either", 650.0, false, false),
+            b("*stars* _under_ `tick` [link](x) a|b # #tag\u{1}\nnext", 600.0, false, false),
+            b("Strong words in a sentence of their own.", 550.0, true, false),
+            b("slanted", 500.0, false, true),
+        ],
+        images: Vec::new(),
+        background: None,
+    };
+    let md = markdown(&[p]);
+    assert!(md.contains("\\- not a list item"), "{md}");
+    assert!(md.contains("1\\. not a numbered item"), "{md}");
+    assert!(md.contains("\\*stars\\* \\_under\\_ \\`tick\\` \\[link\\](x) a\\|b \\# \\#tag next"), "{md}");
+    assert!(md.contains("**Strong words in a sentence of their own.**"), "{md}");
+    // Markdown reads no emphasis where a marker sits next to a space: the outer spaces go outside.
+    assert_eq!(emphasis(" two words ", true, false), " **two words** ");
+    assert_eq!(emphasis("both", true, true), "***both***");
+    assert_eq!(emphasis("  ", true, true), "  ", "nothing to mark");
+    assert!(md.contains("*slanted*"), "{md}");
+    assert!(!md.chars().any(|c| !allowed(c)), "{md:?}");
+
+    let md = markdown(&[table_page()]);
+    let rows: Vec<&str> = md.lines().filter(|l| l.starts_with('|')).collect();
+    assert_eq!(rows.first(), Some(&"| Meter | Unit | Reading |"), "{md}");
+    assert_eq!(rows.get(1), Some(&"| --- | --- | --- |"), "{md}");
+    assert!(rows.contains(&"| A1 | kWh | 37414.00 |"), "{md}");
+    assert!(rows.iter().all(|r| r.matches(" | ").count() == 2), "every row has the header's three cells: {md}");
+}

From 20d396d180a33139908a3a1fad6178ab77b90eff Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 28 Oct 2026 15:56:25 -0400
Subject: [PATCH 046/132] M10: Markdown emphasis follows CommonMark's rules at
 run boundaries, and the export has a parity entry (#1595)

---
 crates/export/src/as_markdown.rs | 67 +++++++++++++++++++++++++++-----
 crates/export/src/lib.rs         |  4 +-
 crates/export/src/tests.rs       | 15 +++++--
 parity/acrobat-features.toml     | 12 ++++++
 4 files changed, 83 insertions(+), 15 deletions(-)

diff --git a/crates/export/src/as_markdown.rs b/crates/export/src/as_markdown.rs
index 0d2657f55e..a5c986c6b3 100644
--- a/crates/export/src/as_markdown.rs
+++ b/crates/export/src/as_markdown.rs
@@ -32,25 +32,71 @@ fn block_start(line: String) -> String {
     }
 }
 
-/// `text` (already escaped) in bold and/or italic. The markers go around the text without its
-/// outer spaces, which Markdown would not read as emphasis.
-pub(crate) fn emphasis(text: &str, bold: bool, italic: bool) -> String {
+/// `text` (already escaped) in bold and/or italic, its outer spaces kept outside. `open` and
+/// `close` say whether `*` markers would be read as emphasis on that side (see [`marks`]);
+/// where they would not, as in `foo` + bold `.` + `bar`, the run is wrapped in HTML tags, which
+/// CommonMark takes inline. The text's own outer spaces count as a side that marks.
+pub(crate) fn emphasis(text: &str, bold: bool, italic: bool, open: bool, close: bool) -> String {
     let core = text.trim();
     if core.is_empty() || !(bold || italic) {
         return text.to_string();
     }
     let lead = text.get(..text.len().saturating_sub(text.trim_start().len())).unwrap_or_default();
     let trail = text.get(text.trim_end().len()..).unwrap_or_default();
-    let mark = match (bold, italic) {
-        (true, true) => "***",
-        (true, false) => "**",
-        _ => "*",
+    let markers = (open || !lead.is_empty()) && (close || !trail.is_empty());
+    let (before, after) = match (markers, bold, italic) {
+        (true, true, true) => ("***", "***"),
+        (true, true, false) => ("**", "**"),
+        (true, false, _) => ("*", "*"),
+        (false, true, true) => ("<strong><em>", "</em></strong>"),
+        (false, true, false) => ("<strong>", "</strong>"),
+        (false, false, _) => ("<em>", "</em>"),
     };
-    format!("{lead}{mark}{core}{mark}{trail}")
+    format!("{lead}{before}{core}{after}{trail}")
+}
+
+/// A paragraph's runs (text, bold, italic) as one line of Markdown. Neighbouring runs in the
+/// same style are joined first, so two bold runs never meet as `****`.
+pub(crate) fn paragraph(runs: &[(&str, bool, bool)]) -> String {
+    let mut merged: Vec<(String, bool, bool)> = Vec::new();
+    for &(text, bold, italic) in runs {
+        match merged.last_mut() {
+            Some(last) if last.1 == bold && last.2 == italic => last.0.push_str(text),
+            _ => merged.push((text.to_string(), bold, italic)),
+        }
+    }
+    let texts: Vec<String> = merged.iter().map(|(text, ..)| md_text(text)).collect();
+    let mut out = String::new();
+    for (k, ((_, bold, italic), text)) in merged.iter().zip(&texts).enumerate() {
+        let core = text.trim();
+        let open = marks(core.chars().next(), out.chars().last());
+        // Markers of a styled neighbour right next to these would join them into one run.
+        let close = match (merged.get(k.saturating_add(1)), texts.get(k.saturating_add(1))) {
+            (Some((_, b, i)), Some(next)) if (*b || *i) && !next.starts_with(char::is_whitespace) => false,
+            (_, next) => marks(core.chars().last(), next.and_then(|n| n.chars().next())),
+        };
+        out.push_str(&emphasis(text, *bold, *italic, open, close));
+    }
+    out
+}
+
+/// Whether a `*` marker between the text's `edge` character and the `outside` one is read as
+/// emphasis (CommonMark's flanking rules for `*`): always next to a space or the line's edge,
+/// never next to another `*`, and otherwise unless the text's edge is punctuation while the
+/// outside is a letter or digit.
+fn marks(edge: Option<char>, outside: Option<char>) -> bool {
+    match (edge, outside) {
+        (_, None) => true,
+        (_, Some(o)) if o.is_whitespace() => true,
+        (_, Some('*')) => false,
+        (Some(e), Some(o)) => e.is_alphanumeric() || o.is_ascii_punctuation(),
+        (None, Some(_)) => false,
+    }
 }
 
 fn cell(c: &Cell) -> String {
-    emphasis(&md_text(&c.text), c.bold, c.italic)
+    // A cell sits between `| ` and ` |`, so its markers always have a space outside.
+    emphasis(&md_text(&c.text), c.bold, c.italic, true, true)
 }
 
 /// Markdown (CommonMark, with GitHub's pipe tables): headings, paragraphs with bold and italic,
@@ -61,7 +107,8 @@ pub fn markdown(pages: &[Page]) -> String {
         match it {
             Item::Para(runs, lvl) => {
                 // A heading's weight is the heading's own, as in the HTML export.
-                let text: String = runs.iter().map(|r| emphasis(&md_text(&r.text), r.block.bold && lvl == 0, r.block.italic)).collect();
+                let runs: Vec<(&str, bool, bool)> = runs.iter().map(|r| (r.text.as_str(), r.block.bold && lvl == 0, r.block.italic)).collect();
+                let text = paragraph(&runs);
                 let text = text.trim();
                 if text.is_empty() {
                     continue;
diff --git a/crates/export/src/lib.rs b/crates/export/src/lib.rs
index 54d8500a99..db53ee59c8 100644
--- a/crates/export/src/lib.rs
+++ b/crates/export/src/lib.rs
@@ -30,9 +30,9 @@ pub(crate) use as_html::esc;
 pub use as_html::html;
 #[cfg(test)]
 use as_html::{allowed, base64};
-#[cfg(test)]
-use as_markdown::emphasis;
 pub use as_markdown::markdown;
+#[cfg(test)]
+use as_markdown::{emphasis, paragraph};
 pub use as_rtf::rtf;
 pub use layout::{Block, Cell, Image, Page, Table};
 #[cfg(test)]
diff --git a/crates/export/src/tests.rs b/crates/export/src/tests.rs
index be4708da42..27cd8264e0 100644
--- a/crates/export/src/tests.rs
+++ b/crates/export/src/tests.rs
@@ -819,9 +819,18 @@ fn markdown_escapes_markup_and_keeps_emphasis_and_tables() {
     assert!(md.contains("\\*stars\\* \\_under\\_ \\`tick\\` \\[link\\](x) a\\|b \\# \\#tag next"), "{md}");
     assert!(md.contains("**Strong words in a sentence of their own.**"), "{md}");
     // Markdown reads no emphasis where a marker sits next to a space: the outer spaces go outside.
-    assert_eq!(emphasis(" two words ", true, false), " **two words** ");
-    assert_eq!(emphasis("both", true, true), "***both***");
-    assert_eq!(emphasis("  ", true, true), "  ", "nothing to mark");
+    assert_eq!(emphasis(" two words ", true, false, false, false), " **two words** ");
+    assert_eq!(emphasis("both", true, true, true, true), "***both***");
+    assert_eq!(emphasis("  ", true, true, true, true), "  ", "nothing to mark");
+    // Runs in one style are one: two bold runs side by side don't meet as `****`.
+    assert_eq!(paragraph(&[("hello", true, false), ("world", true, false)]), "**helloworld**");
+    // Markers inside a word would stay literal in CommonMark, so a run there gets HTML tags.
+    assert_eq!(paragraph(&[("foo", false, false), (".", true, false), ("bar", false, false)]), "foo<strong>.</strong>bar");
+    assert_eq!(paragraph(&[("x", true, false), ("y", false, true)]), "<strong>x</strong>*y*", "two styles side by side");
+    // `*` may sit inside a word, and before punctuation that follows a letter.
+    assert_eq!(paragraph(&[("foo", false, false), ("bar", true, false), ("baz", false, false)]), "foo**bar**baz");
+    assert_eq!(paragraph(&[("a ", false, false), ("b", true, false), (" c", false, false)]), "a **b** c");
+    assert_eq!(paragraph(&[("say ", false, false), ("this", false, true), (", then", false, false)]), "say *this*, then");
     assert!(md.contains("*slanted*"), "{md}");
     assert!(!md.chars().any(|c| !allowed(c)), "{md:?}");
 
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 47ac06fdd4..3ba6f85cf2 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7067,6 +7067,18 @@ tools = ["doc_export_office"]
 evidence = ["crates/export/src/tests.rs::table_spans_do_not_consume_text_they_do_not_emit", "crates/export/src/tests.rs::rtf_escapes_and_sizes", "crates/export/src/tests.rs::text_colour_survives_every_format", "crates/export/src/tests.rs::word_opens_text_with_control_characters_and_long_pages", "crates/automation/tests/it/automation.rs::exporting_to_word_html_and_rtf", "crates/ui-egui/tests/it/compare.rs::export_to_word_html_and_rtf"]
 notes = "Text in slots covered by a preceding table-cell span remains in paragraph flow instead of being discarded. Paragraphs with sizes, bold, italic, text colour (colortbl), Unicode; a block that continues another on its line is a formatted group inside that paragraph (#4158), though a style change that wraps onto the next line still splits it; page breaks. Images are left out."
 
+
+[[feature]]
+id = "create.export-markdown"
+title = "Export to Markdown"
+area = "J"
+tier = "P3"
+milestone = "M10"
+status = "partial"
+commands = []
+tools = ["doc_export_office"]
+evidence = ["crates/export/src/tests.rs::markdown_has_headings_paragraphs_and_page_rules_in_order", "crates/export/src/tests.rs::markdown_escapes_markup_and_keeps_emphasis_and_tables", "crates/automation/tests/it/automation.rs::exporting_to_word_html_and_rtf"]
+notes = "Requested in #1595; not an Acrobat export. doc_export_office with a .md or .markdown path writes CommonMark with GitHub pipe tables: headings (levels 1 to 6), paragraphs with bold and italic (as HTML tags where Markdown's markers would not be read as emphasis), tables with their first row as the header, and a rule between pages; text Markdown would read as markup is escaped. Missing: a menu item, images, lists and links (the export's layout model has none of the last two), and text colour."
 [[feature]]
 id = "create.export-xlsx"
 title = "Export to Excel (.xlsx) with table detection"

From 48090eadcda3119a241de8f413d30cc1c5c10f18 Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 21 Oct 2026 01:14:51 -0400
Subject: [PATCH 047/132] Alt+Left / Alt+Right go back and forward through the
 view history (#3632)

Previous view and Next view had only Cmd+[ / Cmd+] (Ctrl elsewhere), and
Alt+Left turned the page, since the arrow keys ignore Alt. The document
view now takes Alt+Left / Alt+Right (Option on macOS) for them, as Acrobat
and browsers do, before the arrows turn the page. Following a link
already records where it was followed from.

With a picture or objects selected in Edit text & images, the arrow-key
nudge ran first and also matched a press with Alt, so Alt+Left moved the
selection. It now takes only arrows pressed alone or with Shift, judged
by each key press's own modifiers rather than the frame's.

Help > Keyboard shortcuts lists the pair under the existing Previous view
/ Next view labels.
---
 crates/ui-egui/src/canvas/navigation.rs |  8 +++-
 crates/ui-egui/src/dialogs.rs           |  8 ++++
 crates/ui-egui/src/tools/object_ui.rs   | 32 ++++++++------
 crates/ui-egui/tests/it/editing.rs      | 57 ++++++++++++++++++++++---
 crates/ui-egui/tests/it/viewer.rs       | 27 ++++++++++++
 parity/acrobat-features.toml            |  4 +-
 6 files changed, 114 insertions(+), 22 deletions(-)

diff --git a/crates/ui-egui/src/canvas/navigation.rs b/crates/ui-egui/src/canvas/navigation.rs
index 46468a112d..731b2c2586 100644
--- a/crates/ui-egui/src/canvas/navigation.rs
+++ b/crates/ui-egui/src/canvas/navigation.rs
@@ -369,10 +369,14 @@ pub fn shortcuts(view: &mut DocView, ctx: &egui::Context, speed: crate::scroll_s
         view.rotate_view(false);
     }
     zoom_shortcuts(view, &pressed);
-    if pressed(cmd(Key::OpenBracket)) {
+    // Alt+← / Alt+→ (⌥ on macOS) too, as in Acrobat and browsers, back to where a link was
+    // followed from (#3632). Consumed here, before ← / → turn the page. egui matches the pattern
+    // logically, so an extra Shift is ignored and Shift+Alt+← goes back as well (harmless).
+    let alt = |k| KeyboardShortcut::new(Modifiers::ALT, k);
+    if pressed(cmd(Key::OpenBracket)) || pressed(alt(Key::ArrowLeft)) {
         view.view_history(false);
     }
-    if pressed(cmd(Key::CloseBracket)) {
+    if pressed(cmd(Key::CloseBracket)) || pressed(alt(Key::ArrowRight)) {
         view.view_history(true);
     }
     let key = |k| (arrows || !matches!(k, Key::ArrowLeft | Key::ArrowRight | Key::ArrowUp | Key::ArrowDown)) && ctx.input(|i| i.key_pressed(k));
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 138b18e1c5..ebe5110cff 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -1463,6 +1463,13 @@ fn dialog_shortcuts(ui: &mut egui::Ui) -> bool {
     let pair = |a, b| format!("{} / {}", key(a), key(b));
     // Key names, translated where a catalog has them (not scanned as UI literals).
     let named = |k: &str| tl!(k).to_string();
+    // Alt+← / Alt+→ (`canvas::shortcuts`): not a registered command, which has no Alt.
+    let alt_arrows = if crate::commands::mac_shortcuts(ui.ctx()) {
+        "⌥← / ⌥→".to_owned()
+    } else {
+        let alt = crate::i18n::key_name("Alt");
+        format!("{alt}+← / {alt}+→")
+    };
     let scroll = crate::i18n::fmt(tl!("Zoom in / out (also pinch or {key}-scroll)"), &[("key", crate::commands::command_modifier_label(ui.ctx()))]);
     for (k, v) in [
         (pair(FIND_NEXT, FIND_PREV), tl!("Next / previous match").to_string()),
@@ -1476,6 +1483,7 @@ fn dialog_shortcuts(ui: &mut egui::Ui) -> bool {
         (pair(ROTATE_CW, ROTATE_CCW), tl!("Rotate view").to_string()),
         (format!("{} / {}", crate::i18n::key_name("Home"), crate::i18n::key_name("End")), tl!("First / last page").to_string()),
         (format!("← / →, {}", pair(PAGE_PREV, PAGE_NEXT)), tl!("Previous / next page").to_string()),
+        (alt_arrows, format!("{} / {}", tl!("Previous view"), tl!("Next view"))),
         (named("V"), tl!("Select (V)").to_string()),
         (named("H / Space (hold)"), tl!("Hand (H)").to_string()),
         (crate::i18n::key_name("Delete").to_string(), tl!("Delete selected pages (Organize)").to_string()),
diff --git a/crates/ui-egui/src/tools/object_ui.rs b/crates/ui-egui/src/tools/object_ui.rs
index 96cc0adf25..114ccbd436 100644
--- a/crates/ui-egui/src/tools/object_ui.rs
+++ b/crates/ui-egui/src/tools/object_ui.rs
@@ -351,22 +351,28 @@ pub(crate) fn nudge_keys(ctx: &egui::Context, view: &mut DocView, doc: &Document
     let objects = view.objects.page.filter(|_| !view.objects.selected.is_empty() && view.objects.gesture.is_none());
     let Some(page) = objects.or(image.map(|(page, _)| page)) else { return };
     let Some(xf) = view.page_xform(page) else { return };
-    use egui::{Key, Modifiers};
+    use egui::Key;
     let mut step = egui::Vec2::ZERO;
     ctx.input_mut(|i| {
-        for (key, direction) in [
-            (Key::ArrowLeft, egui::vec2(-1.0, 0.0)),
-            (Key::ArrowRight, egui::vec2(1.0, 0.0)),
-            (Key::ArrowUp, egui::vec2(0.0, -1.0)),
-            (Key::ArrowDown, egui::vec2(0.0, 1.0)),
-        ] {
-            // Shift first: a plain key pattern also matches a Shift press.
-            if i.consume_key(Modifiers::SHIFT, key) {
-                step += direction * 10.0;
-            } else if i.consume_key(Modifiers::NONE, key) {
-                step += direction;
+        // Only an arrow pressed alone or with Shift, judged by each press's own modifiers (the
+        // frame's can differ when a key is let go in the same frame). Alt+← / Alt+→ go back and
+        // forward through the view history (#3632) and Ctrl/⌘+← / → turn the page, both in
+        // `canvas::shortcuts`.
+        i.events.retain(|e| {
+            let egui::Event::Key { key, pressed: true, modifiers, .. } = e else { return true };
+            if modifiers.alt || modifiers.ctrl || modifiers.command || modifiers.mac_cmd {
+                return true;
             }
-        }
+            let direction = match key {
+                Key::ArrowLeft => egui::vec2(-1.0, 0.0),
+                Key::ArrowRight => egui::vec2(1.0, 0.0),
+                Key::ArrowUp => egui::vec2(0.0, -1.0),
+                Key::ArrowDown => egui::vec2(0.0, 1.0),
+                _ => return true,
+            };
+            step += direction * if modifiers.shift { 10.0 } else { 1.0 };
+            false
+        });
     });
     if step == egui::Vec2::ZERO {
         return;
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 0d44f91067..6b5ab31bc9 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -4242,8 +4242,9 @@ fn press(h: &mut Harness<'static, PdfCraftApp>, modifiers: Modifiers, key: Key)
     h.run_steps(4);
 }
 
-#[test]
-fn arrow_keys_nudge_a_selected_image_instead_of_turning_the_page() {
+/// A two-page document whose first page draws one picture (a Form XObject), open in Edit text
+/// & images with the picture selected.
+fn selected_figure() -> Harness<'static, PdfCraftApp> {
     use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
     let mut doc = Document::open(std::sync::Arc::new(fixture(2))).unwrap();
     let page = pdfcraft_model::pages(&doc)[0].clone();
@@ -4271,12 +4272,18 @@ fn arrow_keys_nudge_a_selected_image_instead_of_turning_the_page() {
     h.run_steps(4);
     assert!(h.state_mut().execute("edit.edit_text"));
     h.run_steps(2);
-    let id = h.state().views[0].id;
-    let rect = |h: &Harness<'static, PdfCraftApp>| h.state().session.get(id).unwrap().page_images(0)[0].rect;
-    let before = rect(&h);
     let r = h.state().views[0].page_screen_rect(0).expect("on screen");
     click_at(&mut h, egui::pos2(r.left() + 100.0 / 200.0 * r.width(), r.top() + (300.0 - 240.0) / 300.0 * r.height()));
     assert!(h.state().views[0].image_selection.is_some(), "selected");
+    h
+}
+
+#[test]
+fn arrow_keys_nudge_a_selected_image_instead_of_turning_the_page() {
+    let mut h = selected_figure();
+    let id = h.state().views[0].id;
+    let rect = |h: &Harness<'static, PdfCraftApp>| h.state().session.get(id).unwrap().page_images(0)[0].rect;
+    let before = rect(&h);
     // As in Acrobat: an arrow moves it a point, Shift and an arrow ten.
     press(&mut h, Modifiers::NONE, Key::ArrowRight);
     press(&mut h, Modifiers::SHIFT, Key::ArrowDown);
@@ -4289,6 +4296,46 @@ fn arrow_keys_nudge_a_selected_image_instead_of_turning_the_page() {
     assert!(h.state().views[0].image_selection.is_some(), "it stays selected for the next nudge");
 }
 
+/// #3632: with a picture selected, Alt+← / Alt+→ still go back and forward through the view
+/// history. They don't nudge it (the nudge patterns also match a press with Alt), so nothing moves
+/// and the document isn't edited.
+#[test]
+fn alt_arrows_navigate_instead_of_nudging_a_selected_image() {
+    let mut h = selected_figure();
+    let id = h.state().views[0].id;
+    let rect = |h: &Harness<'static, PdfCraftApp>| h.state().session.get(id).unwrap().page_images(0)[0].rect;
+    let before = rect(&h);
+    // A followed link's jump to page 2 and back, as `go_to_dest` makes it.
+    h.state_mut().views[0].go_to_page(1);
+    h.run_steps(2);
+    h.state_mut().views[0].go_to_page(0);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "still selected, so a nudge could take the keys");
+    press(&mut h, Modifiers::ALT, Key::ArrowLeft);
+    assert_eq!(h.state().views[0].current, 1, "Alt+← went back");
+    press(&mut h, Modifiers::ALT, Key::ArrowRight);
+    assert_eq!(h.state().views[0].current, 0, "Alt+→ went forward");
+    // Each press is judged by its own modifiers, not the frame's: Alt let go in the same frame
+    // as Alt+← leaves the frame with none, and the press still goes back.
+    let arrow = |key, modifiers| egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers };
+    h.event(arrow(Key::ArrowLeft, Modifiers::ALT));
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].current, 1, "an Alt+← press went back");
+    assert_eq!(rect(&h), before, "the picture didn't move");
+    let doc = h.state().session.get(id).unwrap();
+    assert!(!doc.dirty && doc.can_undo().is_none(), "nothing was edited");
+    // And a plain → pressed before Alt goes down in the same frame still nudges.
+    h.state_mut().views[0].go_to_page(0);
+    h.run_steps(2);
+    h.event(arrow(Key::ArrowRight, Modifiers::NONE));
+    h.event(egui::Event::ModifiersChanged(Modifiers::ALT));
+    h.run_steps(4);
+    h.event(egui::Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(2);
+    let moved = rect(&h);
+    assert!((moved[0] - before[0] - 1.0).abs() < 0.01, "a plain → nudged a point: {before:?} → {moved:?}");
+}
+
 #[test]
 fn an_open_paragraph_moves_by_its_frame_and_by_the_arrow_keys() {
     let mut h = harness(2, |_| {});
diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index f2a12b69aa..9b37970670 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -70,6 +70,33 @@ fn revert_after_confirming() {
     assert_eq!((d.info.pages.len(), d.dirty), (2, false));
 }
 
+/// #3632: Alt+← / Alt+→ go back to where a link was followed from and forward again, as in
+/// Acrobat and browsers, while ← / → still turn the page.
+#[test]
+fn alt_arrows_go_back_and_forward_through_the_view_history() {
+    use egui::{Key, Modifiers};
+    let mut h = harness();
+    h.state_mut().active = Some(0);
+    h.run_steps(2);
+    // A followed link jumps the same way (`go_to_dest` → `go_to_page`).
+    h.state_mut().views[0].go_to_page(3);
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::ALT, Key::ArrowLeft);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].current, 0, "back to where the jump started");
+    h.key_press_modifiers(Modifiers::ALT, Key::ArrowRight);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].current, 3, "forward to the jump's target");
+    h.key_press(Key::ArrowLeft);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].current, 2, "← still turns the page");
+    h.ctx.set_os(egui::os::OperatingSystem::Nix);
+    assert!(h.state_mut().execute("help.shortcuts"));
+    h.run_steps(3);
+    h.get_by_label("Alt+← / Alt+→");
+    h.get_by_label("Previous view / Next view");
+}
+
 #[test]
 fn view_history_select_all_and_find_options() {
     let mut h = harness();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 51b4f55aea..897ed017bc 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1178,8 +1178,8 @@ milestone = "M3"
 status = "shipped"
 commands = ["view.previous_view", "view.next_view"]
 tools = []
-evidence = ["crates/ui-egui/tests/it/viewer.rs::view_history_select_all_and_find_options", "crates/ui-egui/tests/it/control.rs::navigation_history_commands_and_rail_are_per_tab_and_non_editing", "crates/ui-egui/tests/it/control.rs::routine_continuous_scrolling_does_not_add_navigation_history"]
-notes = "Per-tab page history: explicit search-result jumps, page navigation, bookmarks and links; no continuous-scroll history or restart persistence; existing page-step history is retained. Rail buttons, View ▸ Page navigation and Ctrl/⌘[ / Ctrl/⌘]. UI control ui.command exposes view.previous_view / view.next_view; standalone engine sessions have no viewport history. Restores page tops, not exact scroll/zoom positions."
+evidence = ["crates/ui-egui/tests/it/viewer.rs::view_history_select_all_and_find_options", "crates/ui-egui/tests/it/control.rs::navigation_history_commands_and_rail_are_per_tab_and_non_editing", "crates/ui-egui/tests/it/control.rs::routine_continuous_scrolling_does_not_add_navigation_history", "crates/ui-egui/tests/it/viewer.rs::alt_arrows_go_back_and_forward_through_the_view_history", "crates/ui-egui/tests/it/editing.rs::alt_arrows_navigate_instead_of_nudging_a_selected_image", "crates/ui-egui/tests/it/comments.rs::alt_arrows_navigate_instead_of_nudging_the_selected_comment"]
+notes = "Per-tab page history: explicit search-result jumps, page navigation, bookmarks and links; no continuous-scroll history or restart persistence; existing page-step history is retained. Rail buttons, View ▸ Page navigation, Ctrl/⌘[ / Ctrl/⌘] and Alt/⌥+← / →, also with a picture, object or comment selected (the View menu shows only the bracket shortcuts). UI control ui.command exposes view.previous_view / view.next_view; standalone engine sessions have no viewport history. Restores page tops, not exact scroll/zoom positions."
 
 [[feature]]
 id = "view.follow-links"

From 5d6f36f06029a179d2412d5556ec80fe9931f6db Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 28 Oct 2026 18:16:42 -0400
Subject: [PATCH 048/132] M5: Alt+Left / Alt+Right go back through the view
 history with a comment selected (#3632)

The comment nudge matched arrows with egui's key patterns, which let an
extra Alt through, so with a comment selected Alt+Left moved it a pixel
instead of going back. It now takes only arrows pressed alone or with
Cmd/Ctrl or Shift, judged by each key press's own modifiers, as the
picture and object nudge does.
---
 crates/ui-egui/src/tools/comments/input.rs | 29 +++++++++++++-------
 crates/ui-egui/tests/it/comments.rs        | 32 ++++++++++++++++++++++
 2 files changed, 51 insertions(+), 10 deletions(-)

diff --git a/crates/ui-egui/src/tools/comments/input.rs b/crates/ui-egui/src/tools/comments/input.rs
index af78a1e46a..2c4f4f059e 100644
--- a/crates/ui-egui/src/tools/comments/input.rs
+++ b/crates/ui-egui/src/tools/comments/input.rs
@@ -637,19 +637,28 @@ pub(crate) fn nudge_keys(ctx: &egui::Context, view: &mut DocView, info: &DocInfo
     if !movable {
         return;
     }
-    use egui::{Key, Modifiers};
+    use egui::Key;
     let mut step = egui::Vec2::ZERO;
     ctx.input_mut(|i| {
-        for (key, direction) in
-            [(Key::ArrowLeft, vec2(-1.0, 0.0)), (Key::ArrowRight, vec2(1.0, 0.0)), (Key::ArrowUp, vec2(0.0, -1.0)), (Key::ArrowDown, vec2(0.0, 1.0))]
-        {
-            // The modified patterns first: a plain one also matches a Shift press.
-            if i.consume_key(Modifiers::COMMAND, key) || i.consume_key(Modifiers::SHIFT, key) {
-                step += direction * 10.0;
-            } else if i.consume_key(Modifiers::NONE, key) {
-                step += direction;
+        // Only an arrow pressed alone or with ⌘/Ctrl or Shift, judged by each press's own
+        // modifiers. Alt+← / Alt+→ go back and forward through the view history in
+        // `canvas::shortcuts` (#3632), and egui's key patterns would let an extra Alt through.
+        // A Ctrl that isn't the command key (macOS) is left alone, as the patterns left it.
+        i.events.retain(|e| {
+            let egui::Event::Key { key, pressed: true, modifiers, .. } = e else { return true };
+            if modifiers.alt || (modifiers.ctrl && !modifiers.command) {
+                return true;
             }
-        }
+            let direction = match key {
+                Key::ArrowLeft => vec2(-1.0, 0.0),
+                Key::ArrowRight => vec2(1.0, 0.0),
+                Key::ArrowUp => vec2(0.0, -1.0),
+                Key::ArrowDown => vec2(0.0, 1.0),
+                _ => return true,
+            };
+            step += direction * if modifiers.command || modifiers.shift { 10.0 } else { 1.0 };
+            false
+        });
     });
     if step == egui::Vec2::ZERO {
         return;
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 3a3169576c..3351013c24 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -1004,6 +1004,38 @@ fn arrow_keys_nudge_the_selected_comment() {
     assert_eq!(h.state().views[0].current, 1, "and the view goes to the next page");
 }
 
+/// #3632: with a comment selected, Alt+← / Alt+→ still go back and forward through the view
+/// history instead of nudging it (egui's key patterns let an extra Alt through).
+#[test]
+fn alt_arrows_navigate_instead_of_nudging_the_selected_comment() {
+    use egui::{Key, Modifiers};
+    let mut h = harness(|app| app.set_option("quick", "square").unwrap());
+    drag_pt(&mut h, (40.0, 100.0), (140.0, 40.0));
+    h.state_mut().set_option("quick", "select").unwrap();
+    click_pt(&mut h, (90.0, 70.0));
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 0)));
+    let before = comments(&h)[0].rect;
+    // A followed link's jump to page 2 and back, as `go_to_dest` makes it.
+    h.state_mut().views[0].go_to_page(1);
+    h.run_steps(2);
+    h.state_mut().views[0].go_to_page(0);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 0)), "still selected, so a nudge could take the keys");
+    h.key_press_modifiers(Modifiers::ALT, Key::ArrowLeft);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 1, "Alt+← went back");
+    h.key_press_modifiers(Modifiers::ALT, Key::ArrowRight);
+    h.run_steps(3);
+    assert_eq!(h.state().views[0].current, 0, "Alt+→ went forward");
+    assert_eq!(comments(&h)[0].rect, before, "the comment didn't move");
+    let id = h.state().views[0].id;
+    assert_ne!(h.state().session.get(id).unwrap().can_undo(), Some("Move comment"), "nothing was nudged");
+    // A plain arrow still nudges it.
+    h.key_press(Key::ArrowRight);
+    h.run_steps(3);
+    assert!(comments(&h)[0].rect[0] > before[0], "→ nudged it");
+}
+
 #[test]
 fn a_shape_just_drawn_resizes_from_its_handles_without_the_select_tool() {
     // #2338: the new shape showed its handles, but only the Select tool answered them.

From dda63fda0fe4c9534c7507539270d100a8925966 Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Tue, 20 Oct 2026 23:09:54 -0400
Subject: [PATCH 049/132] Window title: mark unsaved changes, and set it on the
 web (#3640)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The title now reads "<name> • — PdfCraft" while the active document
has unsaved changes, as the other Craft apps write it, and goes back to
"<name> — PdfCraft" once saved.

eframe's web runner ignores ViewportCommand::Title, so the web build
never named the open document. It now also sets the page's
document.title, which an embedding host reads to confirm which document
opened and whether it has unsaved changes.
---
 crates/ui-egui/src/app.rs                | 13 ++++++++--
 crates/ui-egui/tests/it/accessibility.rs |  2 +-
 crates/ui-egui/tests/it/viewer.rs        | 33 +++++++++++++++++++++---
 3 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
index 23bee9babc..352178bb7b 100644
--- a/crates/ui-egui/src/app.rs
+++ b/crates/ui-egui/src/app.rs
@@ -546,14 +546,23 @@ impl eframe::App for PdfCraftApp {
         for view in &mut self.views {
             view.begin_render_frame();
         }
-        // The window shows the active document's name (or title, if it asks for that).
+        // The window shows the active document's name (or title, if it asks for that), with •
+        // while it has unsaved changes, as the other Craft apps write it (#3640).
+        let view = self.active.and_then(|i| self.views.get(i));
+        let dirty = view.and_then(|v| self.session.get(v.id)).is_some_and(|d| d.dirty);
+        let mark = if dirty { " •" } else { "" };
         let title = self
             .active
             .and_then(|i| crate::canvas::tab_label(self, i))
             .or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
-            .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name} — PdfCraft"));
+            .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name}{mark} — PdfCraft"));
         if title != self.window_title {
             ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
+            // eframe's web runner ignores Title: set the page's own, which an embedding host reads.
+            #[cfg(target_arch = "wasm32")]
+            if let Some(document) = web_sys::window().and_then(|w| w.document()) {
+                document.set_title(&title);
+            }
             self.window_title = title;
         }
         // The accessible window takes the same name, so a screen reader (AT-SPI on Linux, UIA on
diff --git a/crates/ui-egui/tests/it/accessibility.rs b/crates/ui-egui/tests/it/accessibility.rs
index 7d13df6adc..eebfc40020 100644
--- a/crates/ui-egui/tests/it/accessibility.rs
+++ b/crates/ui-egui/tests/it/accessibility.rs
@@ -91,7 +91,7 @@ fn checking_fixing_skipping_and_reporting() {
     assert_eq!(status(&h, Rule::Title), Status::Passed);
     assert_eq!(h.state().a11y.previous.as_ref().unwrap().1.result(Rule::Title).unwrap().status, Status::Failed);
     assert!(matches!(h.state().dialog, Some(Dialog::Properties(_))));
-    assert_eq!(h.state().window_title, "notes — PdfCraft");
+    assert_eq!(h.state().window_title, "notes • — PdfCraft");
     h.state_mut().dialog = None;
     h.run_steps(2);
     h.get_by_label("Compare");
diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index f2a12b69aa..0db837f901 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -974,10 +974,36 @@ fn tab_and_window_show_the_document_title_when_asked() {
         s.session.apply(id, Edit::SetInitialView(Box::new(v))).unwrap();
     }
     h.run_steps(2);
-    assert_eq!(h.state().window_title, "Quarterly report — PdfCraft");
+    // The edits are unsaved, so the title says so (#3640).
+    assert_eq!(h.state().window_title, "Quarterly report • — PdfCraft");
     h.get_by_label_contains("Quarterly report");
 }
 
+#[test]
+fn the_window_title_marks_unsaved_changes_until_saved() {
+    use pdfcraft_engine::Edit;
+    let mut h = harness();
+    h.run_steps(2);
+    assert_eq!(h.state().window_title, "b.pdf — PdfCraft");
+    {
+        let s = h.state_mut();
+        let id = s.views[s.active.unwrap()].id;
+        s.session.apply(id, Edit::SetInfo { key: "Subject".into(), value: "Budget".into() }).unwrap();
+    }
+    h.run_steps(2);
+    assert_eq!(h.state().window_title, "b.pdf • — PdfCraft", "unsaved changes (#3640)");
+    // Saved under its own name, so the title changes only by the mark.
+    let dir = std::env::temp_dir().join(format!("pdfcraft-title-dirty-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    h.state_mut().save_override = Some(dir.join("b.pdf").to_string_lossy().into_owned());
+    assert!(h.state_mut().execute("file.save"));
+    h.run_steps(2);
+    let _ = std::fs::remove_dir_all(&dir);
+    let s = h.state();
+    assert!(!s.session.get(s.views[s.active.unwrap()].id).unwrap().dirty);
+    assert_eq!(s.window_title, "b.pdf — PdfCraft", "saved");
+}
+
 #[test]
 fn a_placeholder_title_leaves_the_file_name_on_the_tab_and_window() {
     // A browser's "Save as PDF" of a blank page or pop-up titles the document "about:blank"
@@ -993,7 +1019,7 @@ fn a_placeholder_title_leaves_the_file_name_on_the_tab_and_window() {
         s.session.apply(id, Edit::SetInitialView(Box::new(v))).unwrap();
     }
     h.run_steps(2);
-    assert_eq!(h.state().window_title, "b.pdf — PdfCraft");
+    assert_eq!(h.state().window_title, "b.pdf • — PdfCraft");
     assert!(h.query_by_label_contains("about:blank").is_none());
 }
 
@@ -2265,6 +2291,7 @@ fn the_accessible_window_has_the_window_title_as_its_name() {
         s.session.apply(id, Edit::SetInitialView(Box::new(v))).unwrap();
     }
     h.run_steps(2);
-    assert_eq!(name(&h).as_deref(), Some("Quarterly report — PdfCraft"));
+    // Unsaved, so it carries the window title's mark too (#3640).
+    assert_eq!(name(&h).as_deref(), Some("Quarterly report • — PdfCraft"));
     assert_eq!(name(&h), Some(h.state().window_title.clone()));
 }

From 75f9c48c3958c325520e6b6392ee6249cd5c3efb Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 28 Oct 2026 14:10:44 -0400
Subject: [PATCH 050/132] M3: the window-title save test removes its temp
 folder even when an assert fails (#3640)

---
 crates/ui-egui/tests/it/viewer.rs | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index 0db837f901..e151f4cfca 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -992,13 +992,19 @@ fn the_window_title_marks_unsaved_changes_until_saved() {
     }
     h.run_steps(2);
     assert_eq!(h.state().window_title, "b.pdf • — PdfCraft", "unsaved changes (#3640)");
+    // Removed on drop, so a failing assert below doesn't leave it behind.
+    struct Dir(std::path::PathBuf);
+    impl Drop for Dir {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+    let dir = Dir(std::env::temp_dir().join(format!("pdfcraft-title-dirty-{}", std::process::id())));
+    std::fs::create_dir_all(&dir.0).unwrap();
     // Saved under its own name, so the title changes only by the mark.
-    let dir = std::env::temp_dir().join(format!("pdfcraft-title-dirty-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    h.state_mut().save_override = Some(dir.join("b.pdf").to_string_lossy().into_owned());
+    h.state_mut().save_override = Some(dir.0.join("b.pdf").to_string_lossy().into_owned());
     assert!(h.state_mut().execute("file.save"));
     h.run_steps(2);
-    let _ = std::fs::remove_dir_all(&dir);
     let s = h.state();
     assert!(!s.session.get(s.views[s.active.unwrap()].id).unwrap().dirty);
     assert_eq!(s.window_title, "b.pdf — PdfCraft", "saved");

From 4b73850671221f64a4668129e70126ff74f477f1 Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 28 Oct 2026 21:07:09 -0400
Subject: [PATCH 051/132] M3: the title marks drafts not yet applied, and the
 web page title names the file (#3640)

The dirty mark now follows has_unsaved_work, the same test the close
prompt uses, so text typed into a field or text box shows the mark before
it is applied. The web page's title, which an embedding host reads to tell
which file opened, now always names the file, even when the document asks
to show its own title; the native window title is unchanged.
---
 crates/ui-egui/src/app.rs         | 29 +++++++++++++++----------
 crates/ui-egui/src/lib.rs         |  2 ++
 crates/ui-egui/tests/it/viewer.rs | 36 +++++++++++++++++++++++++++++++
 3 files changed, 56 insertions(+), 11 deletions(-)

diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
index 352178bb7b..54f8717960 100644
--- a/crates/ui-egui/src/app.rs
+++ b/crates/ui-egui/src/app.rs
@@ -198,6 +198,7 @@ impl PdfCraftApp {
             field_table_draft: None,
             form_preview: false,
             window_title: String::new(),
+            page_title: String::new(),
             recovery: None,
             recoverable: Vec::new(),
             recovery_keys: Default::default(),
@@ -547,23 +548,29 @@ impl eframe::App for PdfCraftApp {
             view.begin_render_frame();
         }
         // The window shows the active document's name (or title, if it asks for that), with •
-        // while it has unsaved changes, as the other Craft apps write it (#3640).
-        let view = self.active.and_then(|i| self.views.get(i));
-        let dirty = view.and_then(|v| self.session.get(v.id)).is_some_and(|d| d.dirty);
+        // while it has unsaved changes, as the other Craft apps write it (#3640). Unsaved means
+        // what closing would ask about, so a draft not yet applied counts too.
+        let dirty = self.active.is_some_and(|i| self.has_unsaved_work(i));
         let mark = if dirty { " •" } else { "" };
-        let title = self
-            .active
-            .and_then(|i| crate::canvas::tab_label(self, i))
-            .or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
-            .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name}{mark} — PdfCraft"));
+        let titled = |name: Option<String>| {
+            name.or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
+                .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name}{mark} — PdfCraft"))
+        };
+        let title = titled(self.active.and_then(|i| crate::canvas::tab_label(self, i)));
+        // The web page's title is what an embedding host reads to tell which file opened, so it
+        // names the file even when the document asks to show its own title.
+        let page_title = titled(self.active.and_then(|i| self.views.get(i)).and_then(|v| self.session.get(v.id)).map(|d| d.name.clone()));
         if title != self.window_title {
             ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
-            // eframe's web runner ignores Title: set the page's own, which an embedding host reads.
+            self.window_title = title;
+        }
+        if page_title != self.page_title {
+            // eframe's web runner ignores Title: set the page's own.
             #[cfg(target_arch = "wasm32")]
             if let Some(document) = web_sys::window().and_then(|w| w.document()) {
-                document.set_title(&title);
+                document.set_title(&page_title);
             }
-            self.window_title = title;
+            self.page_title = page_title;
         }
         // The accessible window takes the same name, so a screen reader (AT-SPI on Linux, UIA on
         // Windows) can tell it apart (#4614). egui builds the root node afresh every pass.
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 8a8c51775a..f8237f7fa6 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -566,6 +566,8 @@ pub struct PdfCraftApp {
     fonts_cjk: theme::CjkPreference,
     /// The window title last sent to the platform.
     pub window_title: String,
+    /// The web page's title last set: the window title, but always with the file's name.
+    pub page_title: String,
     /// The UI control channel, when enabled (`--control`; off by default).
     control: Option<control::Control>,
     /// A bookmark being renamed in the Bookmarks panel: (path, text so far).
diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index e151f4cfca..b08c7bd702 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -1010,6 +1010,42 @@ fn the_window_title_marks_unsaved_changes_until_saved() {
     assert_eq!(s.window_title, "b.pdf — PdfCraft", "saved");
 }
 
+/// #3640: text typed but not yet applied is unsaved work too, as closing the tab says, so the
+/// title marks it.
+#[test]
+fn the_window_title_marks_a_draft_that_is_not_applied_yet() {
+    use pdfcraft_ui_egui::fill_sign::TypeBox;
+    let mut h = harness();
+    h.run_steps(2);
+    assert_eq!(h.state().window_title, "b.pdf — PdfCraft");
+    let i = h.state().active.unwrap();
+    h.state_mut().views[i].fill_text = Some(TypeBox { page: 0, at: [40.0, 200.0], text: "Typed".into(), size: 10.0, focus: false });
+    h.run_steps(2);
+    let s = h.state();
+    assert!(!s.session.get(s.views[i].id).unwrap().dirty, "nothing applied to the document yet");
+    assert_eq!(s.window_title, "b.pdf • — PdfCraft");
+    assert_eq!(s.page_title, "b.pdf • — PdfCraft");
+}
+
+/// #3640: a document that asks to show its own title shows it in the window, but the web page's
+/// title, which an embedding host reads to tell which file opened, keeps the file's name.
+#[test]
+fn the_web_page_title_names_the_file_when_the_document_shows_its_title() {
+    use pdfcraft_engine::Edit;
+    let mut h = harness();
+    {
+        let s = h.state_mut();
+        let id = s.views[s.active.unwrap()].id;
+        s.session.apply(id, Edit::SetInfo { key: "Title".into(), value: "Budget 2026".into() }).unwrap();
+        let mut v = s.session.get(id).unwrap().initial_view();
+        v.display_title = true;
+        s.session.apply(id, Edit::SetInitialView(Box::new(v))).unwrap();
+    }
+    h.run_steps(2);
+    assert_eq!(h.state().window_title, "Budget 2026 • — PdfCraft");
+    assert_eq!(h.state().page_title, "b.pdf • — PdfCraft");
+}
+
 #[test]
 fn a_placeholder_title_leaves_the_file_name_on_the_tab_and_window() {
     // A browser's "Save as PDF" of a blank page or pop-up titles the document "about:blank"

From 08f3991ab9808b71fa015f22d49dbc4720044c78 Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Wed, 28 Oct 2026 21:41:33 -0400
Subject: [PATCH 052/132] M5: Alt+Left / Alt+Right go back through the view
 history with a form field selected, judged by each press's modifiers (#3632)

Prepare's arrow nudge read the frame's Alt, so an Alt+arrow whose Alt was
let go in the same frame nudged the field instead. Each press's own
modifiers now decide, as for objects, pictures and comments.
---
 crates/ui-egui/src/tools/prepare.rs | 34 ++++++++++++++++-------------
 crates/ui-egui/tests/it/prepare.rs  | 34 +++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 15 deletions(-)

diff --git a/crates/ui-egui/src/tools/prepare.rs b/crates/ui-egui/src/tools/prepare.rs
index c5fa2b684e..e54bdd0468 100644
--- a/crates/ui-egui/src/tools/prepare.rs
+++ b/crates/ui-egui/src/tools/prepare.rs
@@ -618,30 +618,34 @@ pub(crate) fn delete_selected(view: &mut DocView) -> Option<Edit> {
 /// as the object nudge does (`object_ui::nudge_keys`) and as dragging it does (#2608). The keys
 /// are consumed before the view turns the page with them; one press is one undo step.
 pub(crate) fn nudge_keys(ctx: &egui::Context, view: &mut DocView, doc: &Document) {
-    // `consume_key` lets an extra Alt through, and Alt+↑/↓ belongs to Calculation order's move.
-    if ctx.egui_wants_keyboard_input() || view.prepare.grab.is_some() || ctx.input(|i| i.modifiers.alt) {
+    if ctx.egui_wants_keyboard_input() || view.prepare.grab.is_some() {
         return;
     }
     let Some((name, wi)) = view.prepare.selected.clone() else { return };
     let Some(w) = doc.form.iter().find(|f| f.name == name).and_then(|f| f.widgets.get(wi)) else { return };
     let Some(page) = w.page else { return };
     let Some(xf) = view.page_xform(page) else { return };
-    use egui::{Key, Modifiers};
+    use egui::Key;
     let mut step = egui::Vec2::ZERO;
     ctx.input_mut(|i| {
-        for (key, direction) in [
-            (Key::ArrowLeft, egui::vec2(-1.0, 0.0)),
-            (Key::ArrowRight, egui::vec2(1.0, 0.0)),
-            (Key::ArrowUp, egui::vec2(0.0, -1.0)),
-            (Key::ArrowDown, egui::vec2(0.0, 1.0)),
-        ] {
-            // Shift first: a plain key pattern also matches a Shift press.
-            if i.consume_key(Modifiers::SHIFT, key) {
-                step += direction * 10.0;
-            } else if i.consume_key(Modifiers::NONE, key) {
-                step += direction;
+        // Only an arrow pressed alone or with Shift, judged by each press's own modifiers (the
+        // frame's can differ when a key is let go in the same frame). Alt+← / Alt+→ go back and
+        // forward through the view history (#3632) and Alt+↑ / ↓ is Calculation order's move.
+        i.events.retain(|e| {
+            let egui::Event::Key { key, pressed: true, modifiers, .. } = e else { return true };
+            if modifiers.alt || modifiers.ctrl || modifiers.command || modifiers.mac_cmd {
+                return true;
             }
-        }
+            let direction = match key {
+                Key::ArrowLeft => egui::vec2(-1.0, 0.0),
+                Key::ArrowRight => egui::vec2(1.0, 0.0),
+                Key::ArrowUp => egui::vec2(0.0, -1.0),
+                Key::ArrowDown => egui::vec2(0.0, 1.0),
+                _ => return true,
+            };
+            step += direction * if modifiers.shift { 10.0 } else { 1.0 };
+            false
+        });
     });
     if step == egui::Vec2::ZERO {
         return;
diff --git a/crates/ui-egui/tests/it/prepare.rs b/crates/ui-egui/tests/it/prepare.rs
index 5c7850c2c0..838e04f85f 100644
--- a/crates/ui-egui/tests/it/prepare.rs
+++ b/crates/ui-egui/tests/it/prepare.rs
@@ -156,6 +156,40 @@ fn arrow_keys_nudge_the_selected_field_instead_of_turning_the_page() {
     assert_eq!(h.state().views[0].current, 0, "the arrows moved the field, not the page");
 }
 
+/// #3632: Alt+← / Alt+→ go back and forward through the view history with a field selected, and
+/// leave the field where it is, even when Alt is let go in the same frame as the arrow, so the
+/// frame has no modifiers and only the press carries Alt.
+#[test]
+fn alt_arrows_navigate_instead_of_nudging_the_selected_field() {
+    let mut h = harness();
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::InsertBlankPage { at: 1, width: 612.0, height: 792.0 }));
+    h.run_steps(2);
+    h.state_mut().execute("form.add.text");
+    h.run_steps(1);
+    let p = at(&h, 40.0, 250.0);
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.drop_at(p);
+    h.run_steps(4);
+    let name = h.state().views[0].prepare.selected.clone().expect("the placed field is selected").0;
+    let before = rect_of(&h, &name);
+    h.state_mut().views[0].go_to_page(1);
+    h.run_steps(2);
+    h.state_mut().views[0].go_to_page(0);
+    h.run_steps(2);
+    assert!(h.state().views[0].prepare.selected.is_some(), "still selected, so a nudge could take the keys");
+    let arrow = |key, modifiers| egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers };
+    h.event(arrow(egui::Key::ArrowLeft, egui::Modifiers::ALT));
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].current, 1, "an Alt+← press went back");
+    h.event(arrow(egui::Key::ArrowRight, egui::Modifiers::ALT));
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].current, 0, "an Alt+→ press went forward");
+    assert_eq!(rect_of(&h, &name), before, "the field didn't move");
+}
+
 #[test]
 fn format_validate_and_calculate_tabs() {
     use pdfcraft_engine::form_scripts::{Calculate, Format, Validate};

From 3850c9f52e073e51f8e4a1665b3ae36fae6f8e66 Mon Sep 17 00:00:00 2001
From: Adrian <adrian@mxlinux.org>
Date: Thu, 29 Oct 2026 00:37:47 -0400
Subject: [PATCH 053/132] M3: the titles follow a document opened while the
 window or tab is hidden (#3640)

eframe runs only App::logic while a window or browser tab is hidden, so a
?file= download that finished then opened the document without the titles
changing. The titles are now set at the end of logic as well as in ui.
---
 crates/ui-egui/src/app.rs         | 58 ++++++++++++++++++-------------
 crates/ui-egui/tests/it/viewer.rs | 25 +++++++++++++
 2 files changed, 58 insertions(+), 25 deletions(-)

diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
index 54f8717960..583b55a6bf 100644
--- a/crates/ui-egui/src/app.rs
+++ b/crates/ui-egui/src/app.rs
@@ -31,6 +31,37 @@ impl Default for PdfCraftApp {
 }
 
 impl PdfCraftApp {
+    /// The window's title and, on the web, the page's, from the active document (#3640). Done in
+    /// `logic` too, which also runs while the window or browser tab is hidden: a document opened
+    /// then (a `?file=` download finishing) still names the page an embedding host reads.
+    fn sync_titles(&mut self, ctx: &egui::Context) {
+        // The window shows the active document's name (or title, if it asks for that), with •
+        // while it has unsaved changes, as the other Craft apps write it (#3640). Unsaved means
+        // what closing would ask about, so a draft not yet applied counts too.
+        let dirty = self.active.is_some_and(|i| self.has_unsaved_work(i));
+        let mark = if dirty { " •" } else { "" };
+        let titled = |name: Option<String>| {
+            name.or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
+                .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name}{mark} — PdfCraft"))
+        };
+        let title = titled(self.active.and_then(|i| crate::canvas::tab_label(self, i)));
+        // The web page's title is what an embedding host reads to tell which file opened, so it
+        // names the file even when the document asks to show its own title.
+        let page_title = titled(self.active.and_then(|i| self.views.get(i)).and_then(|v| self.session.get(v.id)).map(|d| d.name.clone()));
+        if title != self.window_title {
+            ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
+            self.window_title = title;
+        }
+        if page_title != self.page_title {
+            // eframe's web runner ignores Title: set the page's own.
+            #[cfg(target_arch = "wasm32")]
+            if let Some(document) = web_sys::window().and_then(|w| w.document()) {
+                document.set_title(&page_title);
+            }
+            self.page_title = page_title;
+        }
+    }
+
     /// Construct an application with the default session, panels, theme and control state.
     pub fn new() -> Self {
         Self {
@@ -528,6 +559,7 @@ impl eframe::App for PdfCraftApp {
         // Last, after everything that can open or answer the "save changes?" question.
         self.attend_save_prompt(ctx);
         self.sync_native_menu(ctx);
+        self.sync_titles(ctx);
     }
 
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
@@ -547,31 +579,7 @@ impl eframe::App for PdfCraftApp {
         for view in &mut self.views {
             view.begin_render_frame();
         }
-        // The window shows the active document's name (or title, if it asks for that), with •
-        // while it has unsaved changes, as the other Craft apps write it (#3640). Unsaved means
-        // what closing would ask about, so a draft not yet applied counts too.
-        let dirty = self.active.is_some_and(|i| self.has_unsaved_work(i));
-        let mark = if dirty { " •" } else { "" };
-        let titled = |name: Option<String>| {
-            name.or_else(|| self.combine_showing().then(|| tl!("Combine files").to_owned()))
-                .map_or_else(|| "PdfCraft".to_owned(), |name| format!("{name}{mark} — PdfCraft"))
-        };
-        let title = titled(self.active.and_then(|i| crate::canvas::tab_label(self, i)));
-        // The web page's title is what an embedding host reads to tell which file opened, so it
-        // names the file even when the document asks to show its own title.
-        let page_title = titled(self.active.and_then(|i| self.views.get(i)).and_then(|v| self.session.get(v.id)).map(|d| d.name.clone()));
-        if title != self.window_title {
-            ctx.send_viewport_cmd(egui::ViewportCommand::Title(title.clone()));
-            self.window_title = title;
-        }
-        if page_title != self.page_title {
-            // eframe's web runner ignores Title: set the page's own.
-            #[cfg(target_arch = "wasm32")]
-            if let Some(document) = web_sys::window().and_then(|w| w.document()) {
-                document.set_title(&page_title);
-            }
-            self.page_title = page_title;
-        }
+        self.sync_titles(&ctx);
         // The accessible window takes the same name, so a screen reader (AT-SPI on Linux, UIA on
         // Windows) can tell it apart (#4614). egui builds the root node afresh every pass.
         ctx.accesskit_node_builder(egui::accesskit_root_id(), |root| root.set_label(self.window_title.as_str()));
diff --git a/crates/ui-egui/tests/it/viewer.rs b/crates/ui-egui/tests/it/viewer.rs
index b08c7bd702..187a8057fd 100644
--- a/crates/ui-egui/tests/it/viewer.rs
+++ b/crates/ui-egui/tests/it/viewer.rs
@@ -1027,6 +1027,31 @@ fn the_window_title_marks_a_draft_that_is_not_applied_yet() {
     assert_eq!(s.page_title, "b.pdf • — PdfCraft");
 }
 
+/// #3640: a document that arrives while the window or browser tab is hidden, when eframe runs
+/// only `App::logic` and no frame is drawn, still gives the titles its name.
+#[test]
+fn a_document_opened_while_hidden_names_the_titles() {
+    let mut h = harness();
+    h.run_steps(2);
+    let before = h.state().views.len();
+    let bytes = pdfcraft_engine::Session::new().create_from_text("Arrived", "Arrived while hidden").unwrap();
+    h.state().inbox.lock().unwrap().push(("arrived.pdf".into(), bytes.to_vec()));
+    let ctx = h.ctx.clone();
+    let mut frame = eframe::Frame::_new_kittest();
+    // The open runs on a worker and is taken in by a later `logic`, as eframe keeps calling it.
+    for _ in 0..500 {
+        let _ = ctx.run_logic(&egui::RawInput::default(), |ctx| eframe::App::logic(h.state_mut(), ctx, &mut frame));
+        if h.state().views.len() > before {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    let s = h.state();
+    assert_eq!(s.views.len(), before + 1, "the document opened in logic");
+    assert_eq!(s.page_title, "arrived.pdf — PdfCraft");
+    assert_eq!(s.window_title, "arrived.pdf — PdfCraft");
+}
+
 /// #3640: a document that asks to show its own title shows it in the window, but the web page's
 /// title, which an embedding host reads to tell which file opened, keeps the file's name.
 #[test]

From 67b5b2dcf6b78718c8ac1f8091533ee4eaeaa98f Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Sat, 24 Oct 2026 08:20:34 +0200
Subject: [PATCH 054/132] A moved comment is drawn where it goes while it is
 dragged

Moving a rectangle, an oval or any other comment showed only its blue
frame going, the shape staying where it was until release. The comment is
now rendered alone once as the drag starts (Document::comment_layer: a
read-only copy with only that comment, no page content) and laid over the
page where it goes; the page beneath keeps showing it where it was until
the move is applied, as a CAD program's move does. Rendering the page
without it would cost a whole page's render at every drag on a heavy plan.
Stamps and Fill & Sign marks keep their own layers. annot: isolate_annotations
for several comments of a page, so a group can be drawn together.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ROADMAP.md                                  |   1 +
 crates/annot/src/lookup.rs                  |  29 +++-
 crates/engine/src/lib.rs                    |   2 +-
 crates/engine/src/stamp_preview.rs          |  59 ++++++-
 crates/engine/src/tests.rs                  |  38 +++++
 crates/ui-egui/src/canvas.rs                |   5 +
 crates/ui-egui/src/canvas/signature_drag.rs | 171 +++++++++++++++-----
 crates/ui-egui/tests/it/comments.rs         |  61 +++++++
 docs/ui-parity.md                           |   1 +
 parity/acrobat-features.toml                |  12 ++
 10 files changed, 330 insertions(+), 49 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index f5de8044e1..1793d39298 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -220,6 +220,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
   The regression checks two distinct appearances, inherited resources, print/reopen pixels and unchanged source data.
   Estimates unchanged.
 - **2026-10-21 (M3, window resize and move on Wayland):** With PdfCraft's own title bar on GNOME/Wayland, a second resize by a window edge, or a second move by the empty tab strip, works straight after the first; it waited for a click inside the window, because the compositor keeps the button's release from egui. A unit test covers the release given back; checked by hand in a test build. Estimates unchanged.
+- **2026-10-24 (M5, move preview):** A comment being moved is drawn where it goes while it is dragged (a rectangle or oval showed only its blue frame): the comment is rendered alone once as the drag starts and laid over the page, which shows it where it was until the move is applied. Engine `Document::comment_layer`; synthetic engine and UI regressions. Estimates unchanged.
 - **2026-10-22 (M4, #3916 partial):** Document edits and Undo/Redo cancel an Organize page drag. Pointer-release regressions check exact page order and save/reopen.
 - **2026-10-22 (M10, #3752 paper):** CUPS jobs ask for the chosen paper in every size. The 13 sizes the Print dialog sent no paper for (A6, A0–A2, ARCH, ANSI C–E) use PWG 5101.1 names, checked against a synthetic PPD with `cupsfilter`, and `doc_print` to a printer sends the paper too. The macOS tray half (Auto Select instead of the PPD's default tray) is a craft-print change that needs a pin bump here. Estimates unchanged.
 - **2026-10-22 (M14, macOS association recovery candidate):** Successful desktop open/save/sign can queue recovery of an existing per-file binding to the running PDFCraft bundle through NSWorkspace. Metadata-only watcher changes retain undo and avoid false overwrite prompts; real same-length/same-mtime edits remain protected. Rebased on 0.12.0 and reuses #3042's shared atomic metadata preservation; the bounded recovery parser does not narrow save limits. Prior native Preview TEST-signature and Finder workflows passed on macOS 27.0.1; other versions remain unqualified. Estimates unchanged.
diff --git a/crates/annot/src/lookup.rs b/crates/annot/src/lookup.rs
index c81ec78ef4..50097a5e9f 100644
--- a/crates/annot/src/lookup.rs
+++ b/crates/annot/src/lookup.rs
@@ -226,16 +226,31 @@ pub fn picture_rotation(doc: &Document, page: usize, index: usize) -> Result<i64
 /// over the page while it is dragged. `false`, with `doc` unchanged, when the annotation has no
 /// normal appearance (`/AP /N`) for that render to draw.
 pub fn isolate_annotation(doc: &mut Document, page: usize, index: usize) -> Result<bool, AnnotError> {
+    isolate_annotations(doc, page, &[index])
+}
+
+/// [`isolate_annotation`] for several annotations of one page: those of them with a normal
+/// appearance stay, in their order on the page. `false`, with `doc` unchanged, when none has one.
+pub fn isolate_annotations(doc: &mut Document, page: usize, indices: &[usize]) -> Result<bool, AnnotError> {
     let p = page_ref(doc, page)?;
-    let entry = annots(doc, p).get(index).cloned().ok_or(AnnotError::NoSuchAnnotation { page, index })?;
-    let has_normal = {
-        let obj = doc.resolve(&entry);
-        obj.as_dict().and_then(|d| d.get(b"AP")).is_some_and(|ap| doc.resolve(ap).as_dict().is_some_and(|ap| ap.contains(b"N")))
-    };
-    if !has_normal {
+    let list = annots(doc, p);
+    let mut kept = Vec::new();
+    for (index, entry) in list.iter().enumerate() {
+        if !indices.contains(&index) {
+            continue;
+        }
+        let obj = doc.resolve(entry);
+        if obj.as_dict().and_then(|d| d.get(b"AP")).is_some_and(|ap| doc.resolve(ap).as_dict().is_some_and(|ap| ap.contains(b"N"))) {
+            kept.push(entry.clone());
+        }
+    }
+    if let Some(&index) = indices.iter().find(|&&i| i >= list.len()) {
+        return Err(AnnotError::NoSuchAnnotation { page, index });
+    }
+    if kept.is_empty() {
         return Ok(false);
     }
-    set_annots(doc, p, vec![entry])?;
+    set_annots(doc, p, kept)?;
     doc.update_dict(p, |d| {
         d.remove(b"Contents");
     })?;
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index c41c0466c4..cb3297b9d2 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -66,7 +66,7 @@ pub use links::{
 };
 pub use signature_image::{ImageSignaturePreview, SignatureImage};
 pub use signature_scan::{PhotoRect, ScanError, SignaturePhoto, Turn};
-pub use stamp_preview::StampPreview;
+pub use stamp_preview::{CommentLayer, StampPreview};
 pub use text_preview::{TextEditPreview, UnmarkedPages};
 
 pub use pdfcraft_organize::{BoxSpec, FieldConflicts, PageBox, SplitBy, Transition, TransitionSpec, mime_for_name, split_ranges};
diff --git a/crates/engine/src/stamp_preview.rs b/crates/engine/src/stamp_preview.rs
index 6e5758a7ce..e6307234ae 100644
--- a/crates/engine/src/stamp_preview.rs
+++ b/crates/engine/src/stamp_preview.rs
@@ -1,4 +1,5 @@
-//! A stamp while it is moved or resized: the page without it, and the stamp alone.
+//! A stamp while it is moved or resized: the page without it, and the stamp alone. Any other
+//! comment while it is moved: the comment alone.
 
 use std::sync::Arc;
 
@@ -81,3 +82,59 @@ impl Document {
         })?
     }
 }
+
+/// Comments alone on a transparent page, for drawing them where they go while they are moved.
+/// The page beneath keeps showing them where they were until the move is applied: rendering the page
+/// without it would cost a whole page's render at every drag on a heavy plan. Read-only, as
+/// [`StampPreview`] is.
+pub struct CommentLayer {
+    page: usize,
+    bytes: Arc<Vec<u8>>,
+    config: RenderConfig,
+}
+
+impl CommentLayer {
+    /// One worker for the comments alone: their page has no content and no other annotations.
+    pub fn renderer(&self) -> RenderPool {
+        RenderPool::new(self.bytes.clone(), 1, self.transparent())
+    }
+
+    /// The comments alone, rendered synchronously with the renderer's normal pixel limits.
+    pub fn render(&self, scale: f32) -> Result<RenderedPage, String> {
+        if !scale.is_finite() || scale <= 0.0 {
+            return Err("preview scale must be finite and positive".into());
+        }
+        guard(|| {
+            let out =
+                PageRenderer::new(self.bytes.clone(), self.transparent()).render(RenderRequest { page: self.page, scale, ..Default::default() });
+            if let Some(e) = &out.error {
+                return Err(e.clone());
+            }
+            Ok(out)
+        })?
+    }
+
+    fn transparent(&self) -> RenderConfig {
+        RenderConfig { transparent: true, ..self.config.clone() }
+    }
+}
+
+impl Document {
+    /// The comments at `indices` on `page` alone (the ones moved together), drawn as on screen:
+    /// one without an appearance of its own gets the one the page view draws. `None` when one
+    /// of them doesn't exist or none has anything to draw.
+    pub fn comment_layer(&self, page: usize, indices: &[usize]) -> Result<Option<CommentLayer>, String> {
+        guard(|| {
+            let editor = self.editor.as_ref().ok_or("the document can't be read")?;
+            if indices.is_empty() || !indices.iter().all(|&i| self.info.annotations.iter().any(|a| a.page == page && a.index == i)) {
+                return Ok(None);
+            }
+            let mut alone = pdfcraft_annot::with_missing_appearances(&editor.cos).unwrap_or_else(|| editor.cos.clone());
+            if !pdfcraft_annot::isolate_annotations(&mut alone, page, indices).map_err(|e| e.to_string())? {
+                return Ok(None);
+            }
+            let bytes = write_incremental(&alone, &SaveOptions::default()).map(Arc::new).map_err(|e| e.to_string())?;
+            Ok(Some(CommentLayer { page, bytes, config: self.config.clone() }))
+        })?
+    }
+}
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 6a68916dff..f59f8af159 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -3485,6 +3485,44 @@ trailer << /Root 1 0 R >>
     assert!(doc.stamp_preview(0, 1).unwrap().is_none(), "a stamp without an appearance");
 }
 
+/// A moved comment's layer: the comment alone on a transparent page (no page text, no other
+/// comment), drawn as on screen, another app's comment without an appearance too. Preparing it
+/// changes nothing in the document.
+#[test]
+fn comment_layer_draws_the_comment_alone() {
+    let (mut s, id) = session_with(1);
+    s.apply(id, rect_comment(0, [140.0, 40.0, 190.0, 90.0])).unwrap();
+    s.apply(id, rect_comment(0, [20.0, 20.0, 60.0, 60.0])).unwrap();
+    let doc = s.get(id).unwrap();
+    let (generation, dirty) = (doc.edit_generation(), doc.dirty);
+    let layer = doc.comment_layer(0, &[0]).unwrap().expect("a rectangle").render(1.0).unwrap();
+    let px = |p: &pdfcraft_render::RenderedPage, x: u32, y: u32| -> [u8; 4] {
+        p.rgba[(((300 - y) * p.width + x) * 4) as usize..][..4].try_into().unwrap()
+    };
+    assert_eq!(px(&layer, 165, 65), [255, 0, 0, 255], "the rectangle is drawn");
+    let near = |x: u32, y: u32| (137..=193).contains(&x) && (37..=93).contains(&y);
+    let stray: Vec<(u32, u32)> =
+        (1..300).flat_map(|y| (0..200).map(move |x| (x, y))).filter(|&(x, y)| !near(x, y) && px(&layer, x, y) != [0, 0, 0, 0]).collect();
+    assert!(stray.is_empty(), "only the rectangle is on its layer: {:?}", &stray[..stray.len().min(8)]);
+    assert!(doc.comment_layer(0, &[9]).unwrap().is_none(), "no such comment");
+    let both = doc.comment_layer(0, &[0, 1]).unwrap().expect("both").render(1.0).unwrap();
+    assert_eq!((px(&both, 165, 65), px(&both, 40, 40)), ([255, 0, 0, 255], [255, 0, 0, 255]), "moved together, drawn together");
+    let doc = s.get(id).unwrap();
+    assert_eq!((doc.edit_generation(), doc.dirty, doc.can_undo()), (generation, dirty, Some("Add rectangle")), "the document is unchanged");
+
+    let bare = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /Annots [4 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Square /Rect [140 40 190 90] /C [1 0 0] >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+    let mut s = Session::new();
+    let id = s.open("bare.pdf", None, Arc::new(bare.to_vec()), None).unwrap();
+    let layer = s.get(id).unwrap().comment_layer(0, &[0]).unwrap().expect("drawn as on screen").render(1.0).unwrap();
+    assert!((138..=142).any(|x| px(&layer, x, 65)[..3] == [255, 0, 0]), "the square without an appearance is drawn");
+}
+
 #[test]
 fn flattening_fill_and_sign_keeps_other_comments_fields_and_undoes() {
     let (mut s, id) = session_with(1);
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 91d2c41367..35069064de 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1743,6 +1743,11 @@ fn draw_page(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, i
     let preview_target = (matches!(tool, QuickTool::Select | QuickTool::Fill(_)) && !comments_hidden).then_some(view.comments.selected).flatten();
     view.signature_drag.prepare(ui.ctx(), doc, preview_target, scale);
     view.signature_drag.paint(painter, &pcx, &view.comments, view.pending_edit.as_ref());
+    // Any other comment being moved: drawn where it goes, over the page that still shows it
+    // where it was.
+    let stale = view.signature_drag.moving_page().is_some_and(|p| view.page_out_of_date(p));
+    view.signature_drag.prepare_move(ui.ctx(), doc, &view.comments, view.pending_edit.as_ref(), stale, scale);
+    view.signature_drag.paint_move(painter, &pcx, &view.comments, view.pending_edit.as_ref());
 
     // Any press on the page ends Select All of the document: text read or not, any tool,
     // on a link too.
diff --git a/crates/ui-egui/src/canvas/signature_drag.rs b/crates/ui-egui/src/canvas/signature_drag.rs
index e574d68ec4..c864d5354a 100644
--- a/crates/ui-egui/src/canvas/signature_drag.rs
+++ b/crates/ui-egui/src/canvas/signature_drag.rs
@@ -1,5 +1,6 @@
 //! Cached page and stamp layers: a stamp (an image signature, a Fill & Sign mark, any other stamp)
-//! follows each pointer frame, moved or resized, without editing the PDF.
+//! follows each pointer frame, moved or resized, without editing the PDF. Any other comment
+//! follows the pointer while it is moved: its own layer is drawn where it goes.
 
 use egui::{ColorImage, TextureHandle, TextureOptions, pos2, vec2};
 use pdfcraft_engine::{Document, Edit};
@@ -16,6 +17,16 @@ pub(crate) struct SignatureDrag {
     key: Option<(u64, usize, usize)>,
     aspect_ratio: Option<f32>,
     layers: Option<Layers>,
+    /// The comment being moved that has no stamp layers: (edit generation, page, index), and
+    /// the comment alone, drawn over the page where it goes.
+    moving: Option<((u64, usize, usize), Moving)>,
+}
+
+struct Moving {
+    /// The comment's layer: `from` is its box when the move started.
+    layer: StampLayer,
+    /// Released and applied: keep it where it went until the page shows it there.
+    settling: bool,
 }
 
 struct Layers {
@@ -109,29 +120,14 @@ impl SignatureDrag {
         let mut pending = layers.received_tag != Some(tag);
         // The stamp itself is small: it stays sharp at every zoom.
         if let Front::Stamp(stamp) = &mut layers.front {
-            let Some((scale, tile)) = stamp_tile(p, stamp.from, scale) else {
+            match stamp.update(ctx, page, p, scale) {
+                Some(waiting) => pending |= waiting,
                 // Nothing to lay over the page: the frame alone follows the pointer, as before.
-                self.layers = None;
-                return;
-            };
-            let tag = (scale * 1000.0) as u64;
-            if stamp.tag != Some(tag) {
-                stamp.renderer.set_queue(vec![RenderRequest { page, scale, tag, tile: Some(tile), ..Default::default() }]);
-                stamp.tag = Some(tag);
-            }
-            if let Some(out) = stamp.renderer.try_recv()
-                && out.request.tag == tag
-            {
-                let (Some(t), None) = (out.request.tile, &out.error) else {
+                None => {
                     self.layers = None;
                     return;
-                };
-                let s = out.request.scale;
-                let area = [t.x as f32 / s, t.y as f32 / s, t.x.saturating_add(t.w) as f32 / s, t.y.saturating_add(t.h) as f32 / s];
-                let image = crate::canvas::texture_image([out.width as usize, out.height as usize], out.rgba);
-                stamp.pixels = Some((tag, ctx.load_texture("signature-drag-stamp", image, TextureOptions::LINEAR), area));
+                }
             }
-            pending |= stamp.pixels.as_ref().is_none_or(|(received, ..)| *received != tag);
         }
         if pending {
             ctx.request_repaint_after(std::time::Duration::from_millis(16));
@@ -150,6 +146,14 @@ impl SignatureDrag {
 
     /// Movement/resizing only change this stamp's geometry, so its layers are reusable.
     pub fn committed(&mut self, edit: &Edit, generation: u64) {
+        if let Some((key, m)) = self.moving.as_mut()
+            && matches!(edit, Edit::MoveAnnotation { page, index, .. } if (*page, *index) == (key.1, key.2))
+        {
+            key.0 = generation;
+            m.settling = true;
+        } else {
+            self.moving = None;
+        }
         if let Edit::MoveAnnotation { page, index, .. } | Edit::ResizeAnnotation { page, index, .. } = edit
             && self.contains(*page, *index)
         {
@@ -158,7 +162,7 @@ impl SignatureDrag {
                 layers.settling = true;
             }
         } else {
-            *self = Self::default();
+            *self = Self { moving: self.moving.take(), ..Self::default() };
         }
     }
 
@@ -199,27 +203,114 @@ impl SignatureDrag {
                 *turn,
                 egui::Color32::from_white_alpha((opacity * 255.0).round() as u8),
             ),
-            Front::Stamp(stamp) => {
-                let Some((_, texture, area)) = &stamp.pixels else { return };
-                // Where the stamp's pixels were rendered, stretched as its box is from `from` to `rect`.
-                let from = cx.xf.user_rect(cx.info, page, stamp.from);
-                if from.width() < 0.01 || from.height() < 0.01 {
-                    return;
-                }
-                let stretch = vec2(rect.width() / from.width(), rect.height() / from.height());
-                let mut mesh = egui::Mesh::with_texture(texture.id());
-                for (u, v) in [(0.0, 0.0), (1.0, 0.0), (1.0, 1.0), (0.0, 1.0)] {
-                    let (x, y) = (area[0] + u * (area[2] - area[0]), area[1] + v * (area[3] - area[1]));
-                    let at = cx.xf.norm_to_screen(x / cx.xf.pw, y / cx.xf.ph);
-                    let pos = rect.min + (at - from.min) * stretch;
-                    mesh.vertices.push(egui::epaint::Vertex { pos, uv: pos2(u, v), color: egui::Color32::WHITE });
-                }
-                mesh.add_triangle(0, 1, 2);
-                mesh.add_triangle(0, 2, 3);
-                painter.add(egui::Shape::mesh(mesh));
-            }
+            Front::Stamp(stamp) => stamp.paint(&painter, cx, page, rect),
         }
     }
+
+    /// The page of the comment being moved, whose raster [`Self::prepare_move`] asks about.
+    pub fn moving_page(&self) -> Option<usize> {
+        self.moving.as_ref().map(|((_, page, _), _)| *page)
+    }
+
+    /// While a comment without stamp layers is moved, its own layer: rendered when the move
+    /// starts, kept after release until the page's raster shows it where it went (`stale`: the
+    /// page is still drawn as before its last change).
+    pub fn prepare_move(&mut self, ctx: &egui::Context, doc: &Document, cv: &CommentView, pending: Option<&Edit>, stale: bool, scale: f32) {
+        let generation = doc.edit_generation();
+        let dragged = match cv.gesture {
+            Some(Gesture::Move { page, index, .. }) if !self.contains(page, index) => Some((generation, page, index)),
+            _ => None,
+        };
+        let keep = |key: (u64, usize, usize), m: &Moving| {
+            let (_, page, index) = key;
+            dragged == Some(key)
+                || matches!(pending, Some(Edit::MoveAnnotation { page: p, index: i, .. }) if (*p, *i) == (page, index))
+                || m.settling && stale
+        };
+        if self.moving.as_ref().is_some_and(|(key, m)| !keep(*key, m)) {
+            self.moving = None;
+        }
+        if self.moving.is_none()
+            && let Some(key @ (_, page, index)) = dragged
+            && let Some(a) = doc.info.annotations.iter().find(|a| a.page == page && a.index == index && !a.locked)
+            && let Ok(Some(alone)) = doc.comment_layer(page, &[index])
+        {
+            let layer = StampLayer { renderer: alone.renderer(), from: a.rect, tag: None, pixels: None };
+            self.moving = Some((key, Moving { layer, settling: false }));
+        }
+        let Some(((_, page, _), m)) = self.moving.as_mut() else { return };
+        let Some(p) = doc.info.pages.get(*page) else { return };
+        match m.layer.update(ctx, *page, p, scale) {
+            Some(pending) => {
+                if pending {
+                    ctx.request_repaint_after(std::time::Duration::from_millis(16));
+                }
+            }
+            // Nothing to lay over the page: the frame alone follows the pointer, as before.
+            None => self.moving = None,
+        }
+    }
+
+    /// The comment being moved, drawn where it goes (as far as its frame has gone).
+    pub fn paint_move(&self, painter: &egui::Painter, cx: &PageCx<'_>, cv: &CommentView, pending: Option<&Edit>) {
+        let Some(((_, page, index), m)) = &self.moving else { return };
+        if *page != cx.page || cx.hidden {
+            return;
+        }
+        let Some(a) = cx.get(*index) else { return };
+        let (pointer, shift) = painter.ctx().input(|i| (i.pointer.hover_pos(), i.modifiers.shift));
+        // As far as its frame has gone from where the move started (once applied, its box is
+        // already where it went).
+        let rect = cx.adjusted_rect(a, cv.gesture.as_ref(), pointer, shift, pending);
+        let from = cx.xf.user_rect(cx.info, *page, m.layer.from);
+        let painter = painter.with_clip_rect(painter.clip_rect().intersect(cx.xf.rect));
+        m.layer.paint(&painter, cx, *page, from.translate(rect.min - from.min));
+    }
+}
+
+impl StampLayer {
+    /// Render the layer's tile at `scale` (or less, within [`MAX_STAMP_SIDE`]) and take it when
+    /// it arrives. `Some(true)` while the pixels at this scale are still on their way, `None`
+    /// when there is nothing to draw.
+    fn update(&mut self, ctx: &egui::Context, page: usize, p: &PageInfo, scale: f32) -> Option<bool> {
+        let (scale, tile) = stamp_tile(p, self.from, scale)?;
+        let tag = (scale * 1000.0) as u64;
+        if self.tag != Some(tag) {
+            self.renderer.set_queue(vec![RenderRequest { page, scale, tag, tile: Some(tile), ..Default::default() }]);
+            self.tag = Some(tag);
+        }
+        if let Some(out) = self.renderer.try_recv()
+            && out.request.tag == tag
+        {
+            let (Some(t), None) = (out.request.tile, &out.error) else { return None };
+            let s = out.request.scale;
+            let area = [t.x as f32 / s, t.y as f32 / s, t.x.saturating_add(t.w) as f32 / s, t.y.saturating_add(t.h) as f32 / s];
+            let image = crate::canvas::texture_image([out.width as usize, out.height as usize], out.rgba);
+            self.pixels = Some((tag, ctx.load_texture("signature-drag-stamp", image, TextureOptions::LINEAR), area));
+        }
+        Some(self.pixels.as_ref().is_none_or(|(received, ..)| *received != tag))
+    }
+
+    /// The layer's pixels where its box goes on screen, `rect`: moved, and stretched as its box
+    /// is from `from` to `rect`.
+    fn paint(&self, painter: &egui::Painter, cx: &PageCx<'_>, page: usize, rect: egui::Rect) {
+        let Some((_, texture, area)) = &self.pixels else { return };
+        let from = cx.xf.user_rect(cx.info, page, self.from);
+        if from.width() < 0.01 || from.height() < 0.01 {
+            return;
+        }
+        let stretch = vec2(rect.width() / from.width(), rect.height() / from.height());
+        let mut mesh = egui::Mesh::with_texture(texture.id());
+        for (u, v) in [(0.0, 0.0), (1.0, 0.0), (1.0, 1.0), (0.0, 1.0)] {
+            let (x, y) = (area[0] + u * (area[2] - area[0]), area[1] + v * (area[3] - area[1]));
+            let at = cx.xf.norm_to_screen(x / cx.xf.pw, y / cx.xf.ph);
+            let pos = rect.min + (at - from.min) * stretch;
+            mesh.vertices.push(egui::epaint::Vertex { pos, uv: pos2(u, v), color: egui::Color32::WHITE });
+        }
+        mesh.add_triangle(0, 1, 2);
+        mesh.add_triangle(0, 2, 3);
+        painter.add(egui::Shape::mesh(mesh));
+    }
 }
 
 impl Layers {
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 3a3169576c..5b261f28e2 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -2657,3 +2657,64 @@ fn text_comments_can_save_a_zero_width_default() {
     assert_eq!(restored.comment_prefs.style(CommentTool::TextBox).width, 0.0);
     assert_eq!(restored.comment_prefs.style(CommentTool::Callout).width, 0.0);
 }
+
+/// Moving a rectangle or an oval showed only its blue frame going while the shape stayed where
+/// it was until release. Now the comment itself is drawn where it goes (the page beneath shows it
+/// where it was until the move is applied), and the pointer frames change nothing.
+#[test]
+fn a_moved_comment_is_drawn_where_it_goes_before_release() {
+    let _gpu = crate::gpu();
+    let mut h = harness(|_| {});
+    let id = h.state().views[0].id;
+    for shape in
+        [pdfcraft_engine::Shape::Rectangle { rect: [30.0, 30.0, 70.0, 70.0] }, pdfcraft_engine::Shape::Oval { rect: [230.0, 30.0, 270.0, 70.0] }]
+    {
+        let style = pdfcraft_engine::Style { color: [1.0, 0.0, 0.0], opacity: 1.0, width: 2.0, fill: Some([1.0, 0.0, 0.0]) };
+        assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddAnnotation(pdfcraft_engine::NewAnnotation {
+            page: 0,
+            shape,
+            style,
+            contents: String::new(),
+            author: "Tester".into(),
+        })));
+    }
+    h.state_mut().views[0].comments.selected = None;
+    crate::support::settle(&mut h);
+    let red = |v: [u8; 4]| v[0] > 200 && v[1] < 80 && v[2] < 80;
+    for ((x, y), (tx, ty)) in [((50.0, 50.0), (150.0, 120.0)), ((250.0, 50.0), (200.0, 150.0))] {
+        let generation = h.state().session.get(id).unwrap().edit_generation();
+        let (from, to) = (at(&h, x, y), at(&h, tx, ty));
+        // Beside the pointer, whose arrow is drawn over the page.
+        let (was, goes) = (at(&h, x - 10.0, y - 10.0), at(&h, tx - 10.0, ty - 10.0));
+        let px = |pixels: &image::RgbaImage, p: Pos2| pixels.get_pixel(p.x.round() as u32, p.y.round() as u32).0;
+        h.hover_at(from);
+        h.run_steps(1);
+        h.drag_at(from);
+        h.run_steps(1);
+        for k in 1..=4 {
+            h.hover_at(from + (to - from) * (k as f32 / 4.0));
+            h.run_steps(1);
+        }
+        let mut shown = false;
+        for _ in 0..100 {
+            h.run_steps(2);
+            let pixels = h.render().unwrap();
+            if red(px(&pixels, goes)) {
+                shown = true;
+                assert!(red(px(&pixels, was)), "the page still shows it where it was");
+                break;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(10));
+        }
+        assert!(shown, "the comment at ({x}, {y}) is drawn under the pointer before release");
+        assert_eq!(h.state().session.get(id).unwrap().edit_generation(), generation, "pointer frames never edit the document");
+        h.drop_at(to);
+        h.run_steps(3);
+        let doc = h.state().session.get(id).unwrap();
+        assert_eq!(doc.can_undo(), Some("Move comment"));
+        crate::support::settle(&mut h);
+        let pixels = h.render().unwrap();
+        assert!(!red(px(&pixels, was)), "once applied it is gone from where it was");
+        assert!(red(px(&pixels, goes)), "and shown where it went");
+    }
+}
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index 703f1e9d8b..86eb0c66e7 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -47,6 +47,7 @@ No dump of Acrobat's menu tree has been diffed against the registry yet (gap 24)
 | Hand tool, middle-button pan, autoscroll | yes | hand tool; Linux autoscroll | partial |
 | Text selection, column select | yes, Alt-drag columns | reading-order selection; Alt/Option-drag or Edit ▸ Column select (#740) | shipped |
 | Select and move several objects at once | yes | on one page: Shift/Ctrl/⌘-click and marquee, one undo step (#844); not across pages, no group resize | partial |
+| Moved comments drawn where they go while dragged | yes | yes: the comment's own pixels follow the pointer, the page shows it where it was until release; stamps and Fill & Sign marks also hide the original | shipped |
 | Object handles: corners keep proportion, edges free | yes | yes for added images and signatures; Shift on a corner keeps the proportions of comments, stamps and form fields (#2199); no Alt resize from the centre | shipped |
 | Arrange, align and distribute page objects | yes | fields only | partial |
 | Rulers, grids, snap to grid, guides | yes | no | planned |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 3b8dba920c..98e9f2bb2e 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4042,6 +4042,18 @@ tools = ["comment_edit"]
 evidence = ["crates/annot/src/tests.rs::lines_and_polygons_are_reshaped_by_their_points", "crates/ui-egui/tests/it/comments.rs::line_ends_are_dragged_to_change_length_and_angle", "crates/automation/tests/it/automation.rs::comments_are_reshaped_through_the_tool"]
 notes = "A selected line, arrow, connected lines, polygon or cloud has a handle on each end or corner (instead of the frame); dragging one changes the length and angle (Shift holds it to 45° from the point before), with the new shape drawn while dragging, as one undo step (Edit::ReshapeAnnotation). The drawing tools keep drawing from an end (a new line starts there); the Select tool reshapes. /Rect follows the points with room for the width and arrowheads, and the appearance is drawn anew. Headless: comment_edit `points`; comment_list reports them. Measurements keep the points they measured; locked comments keep their shape. Not yet: adding or removing a corner."
 
+[[feature]]
+id = "comment.move-preview"
+title = "A moved comment is drawn where it goes while it is dragged"
+area = "E"
+tier = "P1"
+milestone = "M5"
+status = "shipped"
+commands = []
+tools = []
+evidence = ["crates/ui-egui/tests/it/comments.rs::a_moved_comment_is_drawn_where_it_goes_before_release", "crates/engine/src/tests.rs::comment_layer_draws_the_comment_alone"]
+notes = "Dragging a rectangle, oval, line, text box or any other comment with the Select tool draws the comment itself under the pointer, not only its blue frame: it is rendered alone once as the drag starts (Document::comment_layer, a read-only copy with only that comment and no page content) and laid over the page where it goes; the page beneath keeps showing it where it was until the move is applied, as a CAD program's move does (rendering the page without it would cost a whole page at every drag on a heavy plan). Stamps and Fill & Sign marks keep their own layers, which also hide the original. Pointer frames never edit the document. Not yet: resizing shows the frame only."
+
 [[feature]]
 id = "comment.edit-comment-text"
 title = "Edit comment text"

From 158318c09b2327014e3fae3aa75b490e02341725 Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Sat, 24 Oct 2026 23:14:23 +0200
Subject: [PATCH 055/132] Review: the move preview cuts a comment kept upright
 on a turned page from the box it is drawn in

A NoRotate comment on a quarter-turned page isn't drawn in its /Rect; its layer's tile and
its offset now come from the box it is shown in, as the frame it follows does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas/signature_drag.rs |  5 +-
 crates/ui-egui/tests/it/comments.rs         | 59 +++++++++++++++++++++
 2 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/crates/ui-egui/src/canvas/signature_drag.rs b/crates/ui-egui/src/canvas/signature_drag.rs
index c864d5354a..d05be0eaa2 100644
--- a/crates/ui-egui/src/canvas/signature_drag.rs
+++ b/crates/ui-egui/src/canvas/signature_drag.rs
@@ -235,7 +235,10 @@ impl SignatureDrag {
             && let Some(a) = doc.info.annotations.iter().find(|a| a.page == page && a.index == index && !a.locked)
             && let Ok(Some(alone)) = doc.comment_layer(page, &[index])
         {
-            let layer = StampLayer { renderer: alone.renderer(), from: a.rect, tag: None, pixels: None };
+            // The box it is drawn in: a comment kept upright on a turned page (NoRotate) isn't
+            // drawn in its /Rect, and the frame it follows is that box too.
+            let rotation = doc.info.pages.get(page).map_or(0, |p| p.rotation);
+            let layer = StampLayer { renderer: alone.renderer(), from: a.shown_rect(rotation), tag: None, pixels: None };
             self.moving = Some((key, Moving { layer, settling: false }));
         }
         let Some(((_, page, _), m)) = self.moving.as_mut() else { return };
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 5b261f28e2..0e02dadd6c 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -2718,3 +2718,62 @@ fn a_moved_comment_is_drawn_where_it_goes_before_release() {
         assert!(red(px(&pixels, goes)), "and shown where it went");
     }
 }
+
+/// A comment kept upright on a turned page (NoRotate on a /Rotate 90 page) is drawn where it goes
+/// while it is dragged too: its layer is cut from the box it is drawn in, not from its /Rect.
+#[test]
+fn an_upright_comment_on_a_turned_page_is_drawn_where_it_goes_before_release() {
+    let _gpu = crate::gpu();
+    let pdf = String::from_utf8_lossy(TEXT_FIXTURE)
+        .replace("/Contents 5 0 R /Resources", "/Contents 5 0 R /Rotate 90 /Annots [8 0 R] /Resources")
+        .replace(
+            "trailer",
+            "8 0 obj << /Type /Annot /Subtype /Square /Rect [40 60 160 90] /F 20 /C [1 0 0] /IC [1 0 0] /BS << /W 2 >> >> endobj\ntrailer",
+        )
+        .into_bytes();
+    let mut h = harness_with_bytes(pdf, |_| {});
+    crate::support::settle(&mut h);
+    let id = h.state().views[0].id;
+    let drawn = {
+        let app = h.state();
+        let v = &app.views[0];
+        let info = &app.session.get(v.id).unwrap().info;
+        let a = info.annotations.iter().find(|a| a.subtype == "Square").expect("the square");
+        assert!(a.no_rotate, "kept upright");
+        let page = &info.pages[0];
+        let xf =
+            pdfcraft_ui_egui::canvas::PageXform { rect: v.page_screen_rect(0).expect("on screen"), rot: v.rotation, pw: page.width, ph: page.height };
+        xf.user_rect(info, 0, a.shown_rect(page.rotation))
+    };
+    let red = |v: [u8; 4]| v[0] > 200 && v[1] < 80 && v[2] < 80;
+    let px = |pixels: &image::RgbaImage, p: Pos2| pixels.get_pixel(p.x.round() as u32, p.y.round() as u32).0;
+    // Beside the pointer, which is drawn over the page.
+    let (from, delta) = (drawn.center(), egui::vec2(160.0, 120.0));
+    let was = pos2(drawn.left() + 6.0, drawn.center().y);
+    let goes = was + delta;
+    assert!(red(px(&h.render().unwrap(), was)), "drawn in its upright box");
+    let generation = h.state().session.get(id).unwrap().edit_generation();
+    h.hover_at(from);
+    h.run_steps(1);
+    h.drag_at(from);
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(from + delta * (k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    let mut shown = false;
+    for _ in 0..100 {
+        h.run_steps(2);
+        let pixels = h.render().unwrap();
+        if red(px(&pixels, goes)) {
+            shown = true;
+            assert!(red(px(&pixels, was)), "the page still shows it where it was");
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    assert!(shown, "the upright comment is drawn under the pointer before release");
+    assert_eq!(h.state().session.get(id).unwrap().edit_generation(), generation, "pointer frames never edit the document");
+    h.drop_at(from + delta);
+    h.run_steps(3);
+}

From a793400ff5702f8795d9a789618ae580933f541e Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Sun, 25 Oct 2026 08:00:56 +0100
Subject: [PATCH 056/132] Rebase: the move preview follows PagePointer's
 position

main now gives page modules one pointer per frame (#2685); the comment drawn where it goes
follows `cx.ptr.pos`, as its frame does, instead of egui's hover position.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas/signature_drag.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/canvas/signature_drag.rs b/crates/ui-egui/src/canvas/signature_drag.rs
index d05be0eaa2..ed126d86c6 100644
--- a/crates/ui-egui/src/canvas/signature_drag.rs
+++ b/crates/ui-egui/src/canvas/signature_drag.rs
@@ -261,10 +261,10 @@ impl SignatureDrag {
             return;
         }
         let Some(a) = cx.get(*index) else { return };
-        let (pointer, shift) = painter.ctx().input(|i| (i.pointer.hover_pos(), i.modifiers.shift));
+        let shift = painter.ctx().input(|i| i.modifiers.shift);
         // As far as its frame has gone from where the move started (once applied, its box is
         // already where it went).
-        let rect = cx.adjusted_rect(a, cv.gesture.as_ref(), pointer, shift, pending);
+        let rect = cx.adjusted_rect(a, cv.gesture.as_ref(), cx.ptr.pos, shift, pending);
         let from = cx.xf.user_rect(cx.info, *page, m.layer.from);
         let painter = painter.with_clip_rect(painter.clip_rect().intersect(cx.xf.rect));
         m.layer.paint(&painter, cx, *page, from.translate(rect.min - from.min));

From b4f13fd8ba6afd57e58493f4a8106722143c2a82 Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Mon, 26 Oct 2026 07:20:09 +0100
Subject: [PATCH 057/132] Review: a moved comment's layer that can't be made is
 asked for once per drag

When Document::comment_layer gave nothing (a comment with nothing to draw, or
a document that can't be read), prepare_move asked again on every pointer
frame of the drag, and each time it copies and writes out the whole
document. The failure is now remembered for that drag (edit generation, page,
index); the next drag asks again.

A render that fails no longer drops the layer either: only its pixels go, so
the frame alone follows the pointer as before, the failed scale isn't waited
for, and another scale renders the same layer again without making it anew.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas/signature_drag.rs | 98 ++++++++++++++++++---
 1 file changed, 88 insertions(+), 10 deletions(-)

diff --git a/crates/ui-egui/src/canvas/signature_drag.rs b/crates/ui-egui/src/canvas/signature_drag.rs
index ed126d86c6..c706b8a113 100644
--- a/crates/ui-egui/src/canvas/signature_drag.rs
+++ b/crates/ui-egui/src/canvas/signature_drag.rs
@@ -20,6 +20,10 @@ pub(crate) struct SignatureDrag {
     /// The comment being moved that has no stamp layers: (edit generation, page, index), and
     /// the comment alone, drawn over the page where it goes.
     moving: Option<((u64, usize, usize), Moving)>,
+    /// The comment being moved whose layer couldn't be made (nothing to draw, or a document that
+    /// can't be read): only its frame follows the pointer, and the layer isn't made again on
+    /// every frame of the drag.
+    no_layer: Option<(u64, usize, usize)>,
 }
 
 struct Moving {
@@ -60,6 +64,8 @@ struct StampLayer {
     tag: Option<u64>,
     /// The rendered stamp: its tag, and the view-space box its pixels cover.
     pixels: Option<(u64, TextureHandle, [f32; 4])>,
+    /// The tag whose render failed: not waited for, and asked for again only at another scale.
+    failed: Option<u64>,
 }
 
 impl SignatureDrag {
@@ -86,7 +92,7 @@ impl SignatureDrag {
                     let front = Front::Image { texture, opacity: preview.opacity, turn: preview.turn };
                     self.layers = Some(Layers::new(front, preview.renderer()));
                 } else if let Ok(Some(preview)) = doc.stamp_preview(page, index) {
-                    let stamp = StampLayer { renderer: preview.stamp_renderer(), from: a.rect, tag: None, pixels: None };
+                    let stamp = StampLayer { renderer: preview.stamp_renderer(), from: a.rect, tag: None, pixels: None, failed: None };
                     self.layers = Some(Layers::new(Front::Stamp(Box::new(stamp)), preview.background_renderer()));
                 }
             }
@@ -230,16 +236,25 @@ impl SignatureDrag {
         if self.moving.as_ref().is_some_and(|(key, m)| !keep(*key, m)) {
             self.moving = None;
         }
+        if self.no_layer != dragged {
+            self.no_layer = None;
+        }
         if self.moving.is_none()
+            && self.no_layer.is_none()
             && let Some(key @ (_, page, index)) = dragged
             && let Some(a) = doc.info.annotations.iter().find(|a| a.page == page && a.index == index && !a.locked)
-            && let Ok(Some(alone)) = doc.comment_layer(page, &[index])
         {
-            // The box it is drawn in: a comment kept upright on a turned page (NoRotate) isn't
-            // drawn in its /Rect, and the frame it follows is that box too.
-            let rotation = doc.info.pages.get(page).map_or(0, |p| p.rotation);
-            let layer = StampLayer { renderer: alone.renderer(), from: a.shown_rect(rotation), tag: None, pixels: None };
-            self.moving = Some((key, Moving { layer, settling: false }));
+            // Made once per drag: it copies and writes out the whole document.
+            match doc.comment_layer(page, &[index]) {
+                Ok(Some(alone)) => {
+                    // The box it is drawn in: a comment kept upright on a turned page (NoRotate)
+                    // isn't drawn in its /Rect, and the frame it follows is that box too.
+                    let rotation = doc.info.pages.get(page).map_or(0, |p| p.rotation);
+                    let layer = StampLayer { renderer: alone.renderer(), from: a.shown_rect(rotation), tag: None, pixels: None, failed: None };
+                    self.moving = Some((key, Moving { layer, settling: false }));
+                }
+                _ => self.no_layer = Some(key),
+            }
         }
         let Some(((_, page, _), m)) = self.moving.as_mut() else { return };
         let Some(p) = doc.info.pages.get(*page) else { return };
@@ -249,8 +264,10 @@ impl SignatureDrag {
                     ctx.request_repaint_after(std::time::Duration::from_millis(16));
                 }
             }
-            // Nothing to lay over the page: the frame alone follows the pointer, as before.
-            None => self.moving = None,
+            // Nothing to lay over the page at this scale (no box, or the render failed): the
+            // frame alone follows the pointer, as before. The layer stays, so another scale
+            // renders it again without making it anew.
+            None => m.layer.pixels = None,
         }
     }
 
@@ -282,10 +299,16 @@ impl StampLayer {
             self.renderer.set_queue(vec![RenderRequest { page, scale, tag, tile: Some(tile), ..Default::default() }]);
             self.tag = Some(tag);
         }
+        if self.failed == Some(tag) {
+            return None;
+        }
         if let Some(out) = self.renderer.try_recv()
             && out.request.tag == tag
         {
-            let (Some(t), None) = (out.request.tile, &out.error) else { return None };
+            let (Some(t), None) = (out.request.tile, &out.error) else {
+                self.failed = Some(tag);
+                return None;
+            };
             let s = out.request.scale;
             let area = [t.x as f32 / s, t.y as f32 / s, t.x.saturating_add(t.w) as f32 / s, t.y.saturating_add(t.h) as f32 / s];
             let image = crate::canvas::texture_image([out.width as usize, out.height as usize], out.rgba);
@@ -338,3 +361,58 @@ fn stamp_tile(p: &PageInfo, rect: [f32; 4], scale: f32) -> Option<(f32, Tile)> {
     let (right, bottom) = (((x1 * scale).ceil() + 1.0).min(width).max(left + 1.0), ((y1 * scale).ceil() + 1.0).min(height).max(top + 1.0));
     Some((scale, Tile { x: left as u32, y: top as u32, w: (right - left) as u32, h: (bottom - top) as u32 }))
 }
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+
+    use super::*;
+
+    /// One page with one comment that has nothing to draw: a sound annotation without an
+    /// appearance, for which none is built.
+    fn silent() -> Vec<u8> {
+        let objs = [
+            "<< /Type /Catalog /Pages 2 0 R >>",
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Annots [4 0 R] >>",
+            "<< /Type /Annot /Subtype /Sound /Rect [50 50 70 70] /Contents (hush) >>",
+        ];
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objs.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = out.len();
+        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+        for o in offsets {
+            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+        out
+    }
+
+    /// A moved comment whose own layer can't be made is asked for once per drag, not on every
+    /// pointer frame (making it copies and writes out the whole document); only its frame follows
+    /// the pointer. Once the drag ends, the next one asks again.
+    #[test]
+    fn a_comment_with_nothing_to_draw_is_prepared_once_per_drag() {
+        let mut session = pdfcraft_engine::Session::new();
+        let id = session.open("silent.pdf", None, Arc::new(silent()), None).expect("opens");
+        let doc = session.get(id).expect("open");
+        let index = doc.info.annotations.iter().find(|a| a.subtype == "Sound").expect("listed").index;
+        let ctx = egui::Context::default();
+        let mut cv = CommentView::default();
+        cv.gesture = Some(Gesture::Move { page: 0, index, from: pos2(0.0, 0.0) });
+        let mut drag = SignatureDrag::default();
+        let key = Some((doc.edit_generation(), 0, index));
+        drag.prepare_move(&ctx, doc, &cv, None, false, 1.0);
+        assert!(drag.moving.is_none(), "nothing to draw");
+        assert_eq!(drag.no_layer, key, "remembered for this drag");
+        drag.prepare_move(&ctx, doc, &cv, None, false, 1.0);
+        assert!(drag.moving.is_none() && drag.no_layer == key, "and not made again");
+        cv.gesture = None;
+        drag.prepare_move(&ctx, doc, &cv, None, false, 1.0);
+        assert_eq!(drag.no_layer, None, "forgotten when the drag ends");
+    }
+}

From b68362bdc246b1cf2f149358ac402437df494634 Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Wed, 28 Oct 2026 17:27:17 +0100
Subject: [PATCH 058/132] Rebase: isolate_annotations is exported from main's
 lookup module

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/annot/src/lib.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index e9e0359ce0..e43fb80291 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -33,7 +33,9 @@ pub use info::{Props, Summary, is_comment_subtype, props, set_info, summaries};
 #[cfg(test)]
 use lookup::{ANNOTS_ENTRIES_COPIED, PageWalk, annot_dict, annot_ref};
 use lookup::{annots, page_ref};
-pub use lookup::{has_visible_fill_sign, is_fill_sign, isolate_annotation, page_refs, picture_rotation, set_annots, signature_image};
+pub use lookup::{
+    has_visible_fill_sign, is_fill_sign, isolate_annotation, isolate_annotations, page_refs, picture_rotation, set_annots, signature_image,
+};
 pub(crate) use modify::n;
 pub use modify::{
     add_reply, add_text_replacement, delete_annotation, erase_ink, fillable, goes_with, move_annotation, set_contents, set_fill, set_font_size,

From 22c08fb65bb2f6632af2611e411e3a933dba375c Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Wed, 28 Oct 2026 19:17:50 +0100
Subject: [PATCH 059/132] A test that Fill & Sign's typed text is drawn where
 it goes while it is dragged (#4619)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/tests/it/comments.rs | 49 +++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 0e02dadd6c..22cb7601d3 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -2719,6 +2719,55 @@ fn a_moved_comment_is_drawn_where_it_goes_before_release() {
     }
 }
 
+/// Fill & Sign's typed text (a Typewriter FreeText) is drawn where it goes while it is dragged
+/// too, not only its frame (#4619).
+#[test]
+fn moved_fill_and_sign_text_is_drawn_where_it_goes_before_release() {
+    let _gpu = crate::gpu();
+    let mut h = harness(|_| {});
+    h.state_mut().execute("sign.fill.text");
+    click_pt(&mut h, (40.0, 150.0));
+    h.event(egui::Event::Text("WWWWWW".into()));
+    h.run_steps(1);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(3);
+    let a = comments(&h).into_iter().find(|a| a.contents.as_deref() == Some("WWWWWW")).expect("the typed text");
+    assert!(a.fill_sign && a.subtype == "FreeText", "{a:?}");
+    h.state_mut().quick_tool = QuickTool::Select;
+    h.state_mut().views[0].comments.selected = None;
+    crate::support::settle(&mut h);
+    let (x, y) = ((a.rect[0] + a.rect[2]) / 2.0, (a.rect[1] + a.rect[3]) / 2.0);
+    let (dx, dy) = (120.0, -60.0);
+    let (from, to) = (at(&h, x, y), at(&h, x + dx, y + dy));
+    // Ink in the left of the box where it goes, inside its frame and away from the pointer, which
+    // is drawn over the page.
+    let goes = egui::Rect::from_two_pos(at(&h, a.rect[0] + dx, a.rect[1] + dy), at(&h, a.rect[2] + dx, a.rect[3] + dy)).shrink(3.0);
+    let inked = |pixels: &image::RgbaImage| {
+        (goes.left() as u32..(to.x - 12.0) as u32)
+            .any(|px| (goes.top() as u32..goes.bottom() as u32).any(|py| pixels.get_pixel(px, py).0[..3].iter().all(|c| *c < 100)))
+    };
+    h.hover_at(from);
+    h.run_steps(1);
+    h.drag_at(from);
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(from + (to - from) * (k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    let mut shown = false;
+    for _ in 0..100 {
+        h.run_steps(2);
+        if inked(&h.render().unwrap()) {
+            shown = true;
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    assert!(shown, "the typed text is drawn under the pointer before release");
+    h.drop_at(to);
+    h.run_steps(3);
+}
+
 /// A comment kept upright on a turned page (NoRotate on a /Rotate 90 page) is drawn where it goes
 /// while it is dragged too: its layer is cut from the box it is drawn in, not from its /Rect.
 #[test]

From f0cd96e90bf696099b02201ac68f9ccb8a00c7d2 Mon Sep 17 00:00:00 2001
From: Oliver Hagmann <268387159+ohagmann@users.noreply.github.com>
Date: Thu, 29 Oct 2026 05:54:15 +0100
Subject: [PATCH 060/132] Review: isolate_annotations says that an index off
 the page's list is an error

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/annot/src/lookup.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crates/annot/src/lookup.rs b/crates/annot/src/lookup.rs
index 50097a5e9f..c7a0fd9831 100644
--- a/crates/annot/src/lookup.rs
+++ b/crates/annot/src/lookup.rs
@@ -231,6 +231,8 @@ pub fn isolate_annotation(doc: &mut Document, page: usize, index: usize) -> Resu
 
 /// [`isolate_annotation`] for several annotations of one page: those of them with a normal
 /// appearance stay, in their order on the page. `false`, with `doc` unchanged, when none has one.
+/// An index that isn't one of the page's annotations is an error even when the others are, and
+/// leaves `doc` unchanged too.
 pub fn isolate_annotations(doc: &mut Document, page: usize, indices: &[usize]) -> Result<bool, AnnotError> {
     let p = page_ref(doc, page)?;
     let list = annots(doc, p);

From 9f483490c7e16d1071a8b46663177b25e2e4d8e7 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 12:01:18 +0100
Subject: [PATCH 061/132] fix(ui): Escape cancels any drag the pages hold, and
 its release does nothing

Escape cancelled a comment gesture, Prepare's marquee, measuring and the camera tool, each in its
own module; with the Sign area, crop, marquee zoom, a redaction box, the Link tool's rectangle,
a paragraph or picture drag, added content, an object move or a text selection it did nothing,
and the release then drew, placed or opened what the drag had begun (the step-4 probe: Escape
mid-rectangle still opened the signing dialog).

document_area now handles Escape once, before the pages: while the pages hold a press, it drops
every pointer gesture (DocView::cancel_pointer_gestures, as automation's cancel does) and marks
the press cancelled. Until the button is up the page tools take no input from it, so its
release neither clicks (a stamp, a Fill & Sign mark) nor ends a drag. Escape without a press
keeps its meanings (close the editor, clear the selection, back to the Select tool).

Un-ignores escape_cancels_a_signature_rectangle. Two new tests: Escape mid-press keeps the
release from placing a stamp, and Escape mid-drag abandons a crop rectangle. All three fail
with the cancel taken out; the stamp test also fails with the cancel kept and the release let
through.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs       | 22 +++++++++++++++-
 crates/ui-egui/tests/it/pointer.rs | 42 +++++++++++++++++++++++++++++-
 2 files changed, 62 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 91d2c41367..c2c74ac8a7 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -473,6 +473,9 @@ pub struct DocView {
     pub(crate) signature_drag: crate::signature_drag::SignatureDrag,
     /// What the page modules claim for the cursor this frame; `document_area` sets it once.
     pub(crate) cursor: crate::page_cursor::PageCursor,
+    /// Escape cancelled the press the pages hold: the page ignores it until the button is up, so
+    /// its release neither clicks nor ends a drag.
+    pub(crate) press_cancelled: bool,
     /// A non-edit action requested by the organize toolbar, handled by the app.
     pub pending_action: Option<ViewAction>,
     /// The grid gap the next inserted files go to (set by a "+" between pages); otherwise they
@@ -726,6 +729,7 @@ impl DocView {
             fill_signature_page: None,
             signature_drag: Default::default(),
             cursor: Default::default(),
+            press_cancelled: false,
         }
     }
 
@@ -1737,7 +1741,8 @@ fn draw_page(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, i
     }
 
     let slot = PageSlot { i, r, xf };
-    let input = page_tool_input(ui, view, frame, &slot);
+    // A cancelled press takes nothing until the button is up.
+    let input = if view.press_cancelled { PageInput { consumed: true, area_tool: false } } else { page_tool_input(ui, view, frame, &slot) };
     let painter = ui.painter();
     let pcx = comments::PageCx { page: i, xf: &xf, ptr, info, tool, prefs, allowed, hidden: comments_hidden, redact_mark };
     let preview_target = (matches!(tool, QuickTool::Select | QuickTool::Fill(_)) && !comments_hidden).then_some(view.comments.selected).flatten();
@@ -1754,6 +1759,20 @@ fn draw_page(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, i
     page_overlays(ui, view, frame, &slot, &input);
 }
 
+/// Escape while the pages hold a press abandons the gesture it drives, whichever tool's: nothing is
+/// placed, drawn, moved, resized or opened, and the press is ignored until the button is up. The
+/// frame of the release still belongs to the cancelled press.
+fn cancel_on_escape(ctx: &egui::Context, view: &mut DocView, ptr: &PagePointer) {
+    if view.press_cancelled && !ptr.any_down && ptr.edges.is_empty() {
+        view.press_cancelled = false;
+    }
+    if !view.press_cancelled && ptr.origin.is_some() && ptr.primary_down && ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape))
+    {
+        view.cancel_pointer_gestures();
+        view.press_cancelled = true;
+    }
+}
+
 fn draw_pages(
     ui: &mut egui::Ui,
     viewport: Rect,
@@ -1833,6 +1852,7 @@ fn draw_pages(
     // The pointer as the pages see it: nothing over them (a dialog from the frame it opens),
     // or a press they hold. The page modules read it rather than egui's raw pointer state.
     let ptr = PagePointer::read(ui, &resp, modal);
+    cancel_on_escape(ui.ctx(), view, &ptr);
     let pointer = ptr.pos;
     // A press on a page makes it the current one (as in Acrobat), so a page command with
     // no selection (Rotate, Delete) acts on the page the reader pointed at, not on a page
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index 74120834bc..442eade9ea 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -713,7 +713,6 @@ fn touch_drag_moves_a_comment_and_leaves_no_gesture_behind() {
 // Ending a gesture.
 
 #[test]
-#[ignore = "step 4 of the page pointer router: press-time capture and cancel"]
 fn escape_cancels_a_signature_rectangle() {
     let mut h = open(link_pdf(), "150", false);
     h.state_mut().quick_tool = QuickTool::SignArea { certify: false };
@@ -732,3 +731,44 @@ fn escape_cancels_a_signature_rectangle() {
     assert_eq!(s.quick_tool, QuickTool::SignArea { certify: false }, "Escape abandons the rectangle; the tool stays");
     assert!(s.dialog.is_none(), "and no signing dialog opens: {:?}", s.dialog);
 }
+
+/// Escape with the button down drops the press: its release places no stamp, and the next click
+/// places one.
+#[test]
+fn escape_mid_press_keeps_its_release_from_placing_a_stamp() {
+    let mut h = open(link_pdf(), "150", false);
+    stamp_tool(&mut h);
+    let p = at(&h, 150.0, 150.0);
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.key_press(egui::Key::Escape);
+    h.run_steps(1);
+    h.drop_at(p);
+    h.run_steps(4);
+    assert_eq!(stamps(&h), 0, "the cancelled press places nothing on release");
+    mouse_click(&mut h, p);
+    assert_eq!(stamps(&h), 1, "the next click places a stamp");
+}
+
+/// Escape mid-drag abandons a crop rectangle: the page keeps its boxes.
+#[test]
+fn escape_cancels_a_crop_rectangle() {
+    let mut h = open(text_pdf(), "150", false);
+    h.state_mut().quick_tool = QuickTool::Crop;
+    h.run_steps(4);
+    let (a, b) = (at(&h, 40.0, 360.0), at(&h, 260.0, 60.0));
+    h.hover_at(a);
+    h.run_steps(1);
+    h.drag_at(a);
+    h.run_steps(1);
+    h.hover_at(b);
+    h.run_steps(2);
+    h.key_press(egui::Key::Escape);
+    h.run_steps(1);
+    h.drop_at(b);
+    h.run_steps(4);
+    let s = h.state();
+    assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), None, "no page box was set");
+}

From 35d28a60cc7f627a0bb04d75423cace9fdc00ca1 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 12:15:07 +0100
Subject: [PATCH 062/132] fix(ui): comments, links and text selection decide a
 press by one hit test

The page router (canvas/page_router.rs): a page module answers "what of mine is under this
point?" in one hit test, which gives a Hit (an owner, a layer, a cursor, a tip). On the frame of
a press, the hits at the press point decide who it belongs to, by PR 2's table (the highest
layer the tool reaches), and the router holds that capture until the button is up and its
release has been seen; automation's cancel and Escape drop it. The pointer's hits claim the
cursor and the tip, after the tools that are not converted yet, as before.

Comments: comments::hit is the module's only hit test, with each tool's filter (Select: point
handles, resize handles, then the comment; Fill & Sign: the same over its marks only; shape
tools: the selected comment's handles only). The Select tool's drag, click and double click act
on the comment and part the press was captured on, instead of testing the press origin and the
release point again; fill_grabs and select_grabs ask the router while the button is down. The
topmost comment is the one drawn last (/Annots order), not the last in inspection's top-edge
order: over stacked comments the tip named the top one while a click selected the one
underneath. Text markup declines the drag, so a click on a highlight selects it and a drag
across it still selects the text.

Links: the link hover is a hit (hand and target), and a click follows the link its press was
on. Text selection starts unless the press is held by something that keeps its drag (a link, a
comment that moves); it tested for a link under the pointer at the moment egui called the press
a drag, so a drag from text onto a link selected nothing.

Un-ignores a_click_on_stacked_comments_selects_the_one_drawn_on_top; new test
a_drag_from_text_onto_a_link_selects_the_text. Both fail with their fix reverted (inspection
order for the topmost comment; the link test at the pointer).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs               |  70 ++++--
 crates/ui-egui/src/canvas/page_router.rs   | 151 ++++++++++++
 crates/ui-egui/src/lib.rs                  |   1 +
 crates/ui-egui/src/tools/comments.rs       |   2 +-
 crates/ui-egui/src/tools/comments/input.rs | 254 ++++++++++-----------
 crates/ui-egui/src/tools/comments/state.rs |   5 +-
 crates/ui-egui/tests/it/pointer.rs         |  14 +-
 7 files changed, 337 insertions(+), 160 deletions(-)
 create mode 100644 crates/ui-egui/src/canvas/page_router.rs

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index c2c74ac8a7..d67b18b802 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -29,6 +29,7 @@ mod navigation;
 mod organize;
 pub(super) mod page_cursor;
 pub(super) mod page_pointer;
+pub(super) mod page_router;
 pub mod scroll_speed;
 mod selection;
 pub(super) mod signature_drag;
@@ -473,6 +474,8 @@ pub struct DocView {
     pub(crate) signature_drag: crate::signature_drag::SignatureDrag,
     /// What the page modules claim for the cursor this frame; `document_area` sets it once.
     pub(crate) cursor: crate::page_cursor::PageCursor,
+    /// Who the press the pages hold belongs to.
+    pub(crate) router: crate::page_router::PageRouter,
     /// Escape cancelled the press the pages hold: the page ignores it until the button is up, so
     /// its release neither clicks nor ends a drag.
     pub(crate) press_cancelled: bool,
@@ -590,6 +593,7 @@ impl DocView {
         self.org_drag = None;
         self.panel_drag = None;
         self.selection_drag = false;
+        self.router.cancel();
         self.auto_scroll.cancel();
         self.prepare.cancel_pointer_gesture();
         self.content.cancel_pointer_gesture();
@@ -729,6 +733,7 @@ impl DocView {
             fill_signature_page: None,
             signature_drag: Default::default(),
             cursor: Default::default(),
+            router: Default::default(),
             press_cancelled: false,
         }
     }
@@ -1124,6 +1129,11 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     let PageFrame { resp, ptr, pointer, .. } = *frame;
     let cx = PageToolContext { ui, resp, xf: &xf, ptr, page: i, doc, info };
     let pcx = comments::PageCx { page: i, xf: &xf, ptr, info, tool, prefs, allowed, hidden: comments_hidden, redact_mark };
+    let hits = |view: &DocView, p: Pos2| [link_hit(info, &xf, i, p), comments::hit(&pcx, view, p)].into_iter().flatten();
+    if let Some(o) = ptr.pressed().filter(|o| xf.rect.contains(*o)) {
+        let at = hits(view, o).collect::<Vec<_>>();
+        view.router.press(i, at, tool);
+    }
     if let QuickTool::Measure(measure_tool) = tool {
         crate::measure_ui::page_input(ui, resp, doc, view, &pcx, measure_tool, units);
     }
@@ -1326,6 +1336,15 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         view.links.context = Some((i, l.index));
     }
     let consumed = on_objects || on_edit_text || on_link || on_content || boxing || on_field || comments::page_input(ui, resp, &pcx, view);
+    // The cursor and the tip from what lies under the pointer, after the tools claimed theirs (the
+    // last claim on a layer stands).
+    if frame.env.unobstructed
+        && let Some(p) = pointer
+    {
+        for h in hits(view, p).collect::<Vec<_>>() {
+            view.cursor.claim_with_tip(h.layer, h.icon, h.tip);
+        }
+    }
     PageInput { consumed, area_tool }
 }
 
@@ -1430,8 +1449,10 @@ fn update_text_cursor(view: &mut DocView, gesture: &TextGesture<'_>) {
 }
 
 fn update_selection_on_press(ui: &egui::Ui, view: &mut DocView, text: &PageText, gesture: &TextGesture<'_>) {
+    // A press held by what keeps its drag (a link, a comment that moves) selects no text; one on
+    // text markup lets its drag select the text underneath.
     let press_here = gesture.ptr.origin.is_some_and(|origin| gesture.rect.contains(origin));
-    if gesture.ptr.pressed().is_some() && press_here && !gesture.over_link {
+    if gesture.ptr.pressed().is_some() && press_here && !view.router.keeps_drag() {
         let now = ui.input(|input| input.time);
         let (max_delay, max_dist) = ui.ctx().options(|options| (options.input_options.max_double_click_delay, options.input_options.max_click_dist));
         let consecutive = now - view.last_press_time <= max_delay && view.last_press_pos.is_some_and(|pos| pos.distance(gesture.pointer) <= max_dist);
@@ -1446,7 +1467,7 @@ fn update_selection_on_press(ui: &egui::Ui, view: &mut DocView, text: &PageText,
             view.selection = Some(Selection::run(gesture.page, first, last));
         }
     }
-    if gesture.resp.drag_started() && press_here && !gesture.over_link {
+    if gesture.resp.drag_started() && press_here && !view.router.keeps_drag() {
         view.actions_dismissed = None;
         view.selection_drag = true;
         let origin = gesture.ptr.origin.unwrap_or(gesture.pointer);
@@ -1518,7 +1539,7 @@ fn finish_text_pointer_gesture(ui: &egui::Ui, view: &mut DocView, text: &PageTex
         && let Some((first, last)) = text.nearest(gesture.vx, gesture.vy).and_then(|anchor| click_unit(text, clicks, anchor))
     {
         view.selection = Some(Selection::run(gesture.page, first, last));
-    } else if gesture.resp.clicked() && view.clicks < 2 && !gesture.over_link {
+    } else if gesture.resp.clicked() && view.clicks < 2 && !view.router.keeps_drag() {
         let shift = ui.input(|input| input.modifiers.shift);
         match (
             view.selection.as_mut().filter(|selection| shift && selection.page == gesture.page).map(|selection| &mut selection.span),
@@ -1606,25 +1627,14 @@ fn page_overlays(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_
     // Links: the hand and the link's target, which count only for the tools that follow or
     // edit links (`Layer::reached_by`). Tips draw above the palette, so none shows while it is
     // open, even beside it.
-    if unobstructed && let Some(p) = pointer {
-        for l in info.links.iter().filter(|l| l.page == i) {
-            let sr = xf.user_rect(info, i, l.rect);
-            if sr.contains(p) {
-                let label = match &l.target {
-                    LinkTarget::Page(n, _) => {
-                        crate::i18n::fmt(tl!("Go to page {p}"), &[("p", info.pages.get(*n).map(|p| p.label.as_str()).unwrap_or("?"))])
-                    }
-                    LinkTarget::Uri(u) => u.clone(),
-                    LinkTarget::SetLayers { .. } => tl!("Set layer visibility").to_string(),
-                    LinkTarget::RemoteGoTo { file, .. } => file.clone(),
-                    LinkTarget::Other(s) => crate::i18n::fmt(tl!("{s} action"), &[("s", s)]),
-                };
-                view.cursor.claim_with_tip(Layer::Link, egui::CursorIcon::PointingHand, Some(label));
-                if resp.clicked() && tool == QuickTool::Select && !input.consumed {
-                    frame.out.clicked_link = Some(l.target.clone());
-                }
-            }
-        }
+    if unobstructed
+        && resp.clicked()
+        && tool == QuickTool::Select
+        && !input.consumed
+        && let Some(crate::page_router::Owner::Link { index }) = view.router.owner(i)
+        && let Some(l) = info.links.get(index)
+    {
+        frame.out.clicked_link = Some(l.target.clone());
     }
     // Comments say what they are with any tool, beside its cursor, as Acrobat's do.
     comments::describe(&pcx, view);
@@ -1759,6 +1769,21 @@ fn draw_page(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, i
     page_overlays(ui, view, frame, &slot, &input);
 }
 
+/// The link under `p` on `page`: the hand, and where a click goes. Only the Select tool follows
+/// links and the Link tool edits them (`Layer::reached_by`).
+fn link_hit(info: &DocInfo, xf: &PageXform, page: usize, p: Pos2) -> Option<crate::page_router::Hit> {
+    let (index, l) = info.links.iter().enumerate().rfind(|(_, l)| l.page == page && xf.user_rect(info, page, l.rect).contains(p))?;
+    let label = match &l.target {
+        LinkTarget::Page(n, _) => crate::i18n::fmt(tl!("Go to page {p}"), &[("p", info.pages.get(*n).map(|p| p.label.as_str()).unwrap_or("?"))]),
+        LinkTarget::Uri(u) => u.clone(),
+        LinkTarget::SetLayers { .. } => tl!("Set layer visibility").to_string(),
+        LinkTarget::RemoteGoTo { file, .. } => file.clone(),
+        LinkTarget::Other(s) => crate::i18n::fmt(tl!("{s} action"), &[("s", s)]),
+    };
+    let owner = crate::page_router::Owner::Link { index };
+    Some(crate::page_router::Hit { tip: Some(label), ..crate::page_router::Hit::new(owner, Layer::Link, egui::CursorIcon::PointingHand) })
+}
+
 /// Escape while the pages hold a press abandons the gesture it drives, whichever tool's: nothing is
 /// placed, drawn, moved, resized or opened, and the press is ignored until the button is up. The
 /// frame of the release still belongs to the cancelled press.
@@ -1853,6 +1878,7 @@ fn draw_pages(
     // or a press they hold. The page modules read it rather than egui's raw pointer state.
     let ptr = PagePointer::read(ui, &resp, modal);
     cancel_on_escape(ui.ctx(), view, &ptr);
+    view.router.settle(ptr.any_down, !ptr.edges.is_empty());
     let pointer = ptr.pos;
     // A press on a page makes it the current one (as in Acrobat), so a page command with
     // no selection (Rotate, Delete) acts on the page the reader pointed at, not on a page
diff --git a/crates/ui-egui/src/canvas/page_router.rs b/crates/ui-egui/src/canvas/page_router.rs
new file mode 100644
index 0000000000..82769bd8f4
--- /dev/null
+++ b/crates/ui-egui/src/canvas/page_router.rs
@@ -0,0 +1,151 @@
+//! Who a press on the pages belongs to.
+//!
+//! Each page module answers "what of mine is under this point?" in one place, its hit test, and
+//! the answer is a [`Hit`]: what is there ([`Owner`]), on which [`Layer`], with which cursor and
+//! tip. The pointer's hits set the cursor and the tip; on the frame of a press, the hits at the
+//! press point decide who captures it ([`PageRouter::press`]), by the same table: the highest layer
+//! the active tool reaches. Until the button is up only the owner acts on the press, its drag and
+//! its release, so what the cursor promised is what the press does, and nothing takes a gesture
+//! back halfway.
+
+use egui::CursorIcon;
+
+use crate::QuickTool;
+use crate::page_cursor::Layer;
+
+/// What a hit is on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Owner {
+    /// A comment (or a Fill & Sign mark), by its `/Annots` index, and the part of it.
+    Comment { index: usize, part: CommentPart },
+    /// A link, by its index in the document's links.
+    Link { index: usize },
+}
+
+/// The part of a comment a hit is on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum CommentPart {
+    /// The comment itself: a drag moves it, a click selects it.
+    Body,
+    /// A resize handle of the selected comment: (-1, 0 or 1) across, then down.
+    Handle(i8, i8),
+    /// A point of the selected line, polygon or cloud.
+    Point(usize),
+}
+
+/// What lies under a point, for one page module.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Hit {
+    pub owner: Owner,
+    pub layer: Layer,
+    pub icon: CursorIcon,
+    /// Beside the pointer where this hit wins (a link's target).
+    pub tip: Option<String>,
+    /// A drag from here is not this owner's: a click on a highlight selects it, a drag across it
+    /// selects the text underneath.
+    pub declines_drag: bool,
+}
+
+impl Hit {
+    pub(crate) fn new(owner: Owner, layer: Layer, icon: CursorIcon) -> Self {
+        Hit { owner, layer, icon, tip: None, declines_drag: false }
+    }
+}
+
+/// The hit that wins among `hits` with `tool`: the highest layer the tool reaches, the last of
+/// equals (modules are asked bottom up, in paint order).
+pub(crate) fn top(hits: impl IntoIterator<Item = Hit>, tool: QuickTool) -> Option<Hit> {
+    hits.into_iter().filter(|h| h.layer.reached_by(tool)).fold(None, |best: Option<Hit>, h| match best {
+        Some(b) if b.layer > h.layer => Some(b),
+        _ => Some(h),
+    })
+}
+
+/// A press the pages hold, and who it belongs to.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Capture {
+    pub page: usize,
+    pub owner: Owner,
+    pub declines_drag: bool,
+}
+
+/// The press the pages hold, from its frame until the button is up.
+#[derive(Debug, Default)]
+pub(crate) struct PageRouter {
+    capture: Option<Capture>,
+}
+
+impl PageRouter {
+    /// A press on `page`: `hits` at the press point decide who it belongs to. A press nobody's
+    /// hit claims is held by nobody (the page's text, or a tool that acts anywhere on the page).
+    pub(crate) fn press(&mut self, page: usize, hits: impl IntoIterator<Item = Hit>, tool: QuickTool) {
+        self.capture = top(hits, tool).map(|h| Capture { page, owner: h.owner, declines_drag: h.declines_drag });
+    }
+
+    /// Who holds the press on `page`.
+    pub(crate) fn owner(&self, page: usize) -> Option<Owner> {
+        self.capture.as_ref().filter(|c| c.page == page).map(|c| c.owner)
+    }
+
+    /// Whether the press is held by someone who keeps its drag: then the page's text is not
+    /// selected by it.
+    pub(crate) fn keeps_drag(&self) -> bool {
+        self.capture.as_ref().is_some_and(|c| !c.declines_drag)
+    }
+
+    /// The press is over once the button is up and its release has been seen.
+    pub(crate) fn settle(&mut self, any_down: bool, edges: bool) {
+        if !any_down && !edges {
+            self.capture = None;
+        }
+    }
+
+    /// Drops the press (Escape, a dialog, automation's cancel).
+    pub(crate) fn cancel(&mut self) {
+        self.capture = None;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn hit(layer: Layer, index: usize) -> Hit {
+        Hit::new(Owner::Comment { index, part: CommentPart::Body }, layer, CursorIcon::Move)
+    }
+
+    #[test]
+    fn the_highest_reached_layer_wins_and_the_last_of_equals() {
+        let hits = [hit(Layer::Comment, 0), hit(Layer::Link, 1), hit(Layer::Comment, 2)];
+        assert_eq!(top(hits.clone(), QuickTool::Select).map(|h| h.owner), Some(hits[2].owner));
+        // A stamp reaches neither links nor comments.
+        let stamp = QuickTool::Stamp(pdfcraft_engine::StampKind::DynApproved);
+        assert_eq!(top(hits, stamp), None);
+        assert_eq!(top([hit(Layer::Placed, 3), hit(Layer::Comment, 4)], stamp).map(|h| h.owner), Some(hit(Layer::Placed, 3).owner));
+    }
+
+    #[test]
+    fn a_press_is_held_until_the_button_is_up_and_its_release_seen() {
+        let mut r = PageRouter::default();
+        r.press(2, [hit(Layer::Comment, 7)], QuickTool::Select);
+        assert_eq!(r.owner(2), Some(hit(Layer::Comment, 7).owner));
+        assert_eq!(r.owner(1), None, "only on its page");
+        assert!(r.keeps_drag());
+        r.settle(false, true);
+        assert!(r.owner(2).is_some(), "the release frame still belongs to the press");
+        r.settle(false, false);
+        assert_eq!(r.owner(2), None);
+        r.press(0, [], QuickTool::Select);
+        assert_eq!(r.owner(0), None, "a press nobody claims is held by nobody");
+        assert!(!r.keeps_drag());
+    }
+
+    #[test]
+    fn a_highlight_lets_its_drag_go_to_the_text() {
+        let mut r = PageRouter::default();
+        r.press(0, [Hit { declines_drag: true, ..hit(Layer::Comment, 0) }], QuickTool::Select);
+        assert!(r.owner(0).is_some() && !r.keeps_drag());
+        r.cancel();
+        assert_eq!(r.owner(0), None);
+    }
+}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 8a8c51775a..317c2b45c6 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -77,6 +77,7 @@ use canvas::fling;
 use canvas::image_pick;
 use canvas::page_cursor;
 use canvas::page_pointer;
+use canvas::page_router;
 pub use canvas::scroll_speed;
 use canvas::signature_drag;
 use canvas::wheel_boost;
diff --git a/crates/ui-egui/src/tools/comments.rs b/crates/ui-egui/src/tools/comments.rs
index 5909fdd423..ac1d82ea97 100644
--- a/crates/ui-egui/src/tools/comments.rs
+++ b/crates/ui-egui/src/tools/comments.rs
@@ -37,7 +37,7 @@ pub(crate) use geometry::{corner_ratio, page_rotation, resized};
 pub use geometry::{drawn_text_box_rect, text_box_rect};
 #[cfg(test)]
 use input::hover_tip;
-pub(crate) use input::{describe, fill_grabs, keys, nudge_keys, page_after_text, page_input, select_grabs};
+pub(crate) use input::{describe, fill_grabs, hit, keys, nudge_keys, page_after_text, page_input, select_grabs};
 pub use menu::{CanvasAction, fill_picker, recent_custom_colours, remember_custom_colour, status_badge, swatch_grid};
 #[cfg(test)]
 use menu::{RECENT_CUSTOM, same_colour};
diff --git a/crates/ui-egui/src/tools/comments/input.rs b/crates/ui-egui/src/tools/comments/input.rs
index af78a1e46a..102767b6cb 100644
--- a/crates/ui-egui/src/tools/comments/input.rs
+++ b/crates/ui-egui/src/tools/comments/input.rs
@@ -6,6 +6,7 @@ use super::paint::{drawn_shape, edit_anchor, erase, new_comment};
 use super::state::{Composer, ComposerKind, Gesture, PageCx};
 use super::{Annotation, CommentPrefs, CommentTool, DocInfo, DocView, Edit, Pos2, QuickTool, Rect, Shape, vec2};
 use crate::page_cursor::{Layer, Subject};
+use crate::page_router::{CommentPart, Hit, Owner};
 
 /// Comment input on one page, before text selection runs. Returns `true` when the pointer
 /// gesture belongs to commenting (text selection must ignore it).
@@ -34,79 +35,104 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>,
     }
     let gestures = Gestures { ui, resp, cx, pointer, origin, page_rect, pressed_here, over_page };
     match cx.tool {
-        QuickTool::Comment(_) if draw_grab => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
+        QuickTool::Comment(_) if draw_grab => select_input(ui, resp, cx, view, pointer, origin),
         QuickTool::Comment(tool) if tool.draws() => gestures.draw_shape(view, tool),
         QuickTool::Comment(tool) if tool.clicks_points() => gestures.click_points(view, tool),
         QuickTool::Comment(CommentTool::Callout) => gestures.callout(view),
         QuickTool::Comment(CommentTool::Attach) => gestures.attach(view),
         QuickTool::Comment(CommentTool::Caret) => gestures.caret(view, caret_text.as_deref()),
         QuickTool::Comment(tool @ (CommentTool::Note | CommentTool::TextBox)) => gestures.note_or_box(view, tool),
-        QuickTool::Select => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
-        QuickTool::Fill(_) if fill_grab => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
+        QuickTool::Select => select_input(ui, resp, cx, view, pointer, origin),
+        QuickTool::Fill(_) if fill_grab => select_input(ui, resp, cx, view, pointer, origin),
         _ => false,
     }
 }
 
-/// With a Fill & Sign tool, the Fill & Sign marks already on the page are picked up as with the
-/// Select tool, as in Acrobat: hovering one shows the move cursor, a click selects it, a drag
-/// moves it and the selected one's handles resize it. Elsewhere the tool places its mark. While
-/// the button is down the press decides; otherwise the pointer (egui clears the press origin on
-/// release, so a click is located by the pointer).
+/// What of the comments lies under `p`, for the cursor, the tip and the press: the one hit test
+/// of this module. With the Select tool, the selected comment's point handles, then its resize
+/// handles, then the topmost comment. With a Fill & Sign tool, the same over Fill & Sign's marks
+/// only, as Acrobat picks them up: a press anywhere else places the tool's mark. With a shape
+/// tool (rectangle, oval, line, polygon…), only the selected comment's handles, so the shape just
+/// drawn can be resized straight away (#2338); a press anywhere else, the shape itself included,
+/// draws. `None` with other tools, off the page, or with comments hidden.
+pub(crate) fn hit(cx: &PageCx<'_>, view: &DocView, p: Pos2) -> Option<Hit> {
+    if cx.hidden || !cx.xf.rect.contains(p) {
+        return None;
+    }
+    let pick: fn(&Annotation) -> bool = match cx.tool {
+        QuickTool::Select => |_| true,
+        QuickTool::Fill(_) => |a| a.fill_sign,
+        QuickTool::Comment(tool) if (tool.draws() || tool.clicks_points()) && tool != CommentTool::Eraser => {
+            // A polygon being clicked out keeps its clicks, even near an old shape's handle.
+            if view.comments.gesture.is_some() {
+                return None;
+            }
+            |_| true
+        }
+        _ => return None,
+    };
+    let bodies = matches!(cx.tool, QuickTool::Select | QuickTool::Fill(_));
+    if let Some(a) = view.comments.selected.filter(|(page, _)| *page == cx.page).and_then(|(_, i)| cx.get(i)).filter(|a| pick(a) && cx.allowed) {
+        if grabs_points(cx.tool)
+            && reshapable(a)
+            && let Some(point) = point_handle(cx, a, p)
+        {
+            return Some(Hit::new(Owner::Comment { index: a.index, part: CommentPart::Point(point) }, Layer::Handle, egui::CursorIcon::Crosshair));
+        }
+        if resizable(a)
+            && let Some((x, y)) = HANDLES.into_iter().find(|h| handle_pos(cx.screen_rect(a), *h).distance(p) <= 7.0)
+        {
+            let icon = match (x, y) {
+                (0, _) => egui::CursorIcon::ResizeVertical,
+                (_, 0) => egui::CursorIcon::ResizeHorizontal,
+                (-1, -1) | (1, 1) => egui::CursorIcon::ResizeNwSe,
+                _ => egui::CursorIcon::ResizeNeSw,
+            };
+            return Some(Hit::new(Owner::Comment { index: a.index, part: CommentPart::Handle(x, y) }, Layer::Handle, icon));
+        }
+    }
+    let a = cx.hit(p).filter(|a| bodies && pick(a))?;
+    // A click on a highlight over a link follows the link, so the link's hand and tip show there.
+    if cx.tool == QuickTool::Select && a.subtype == "Highlight" && on_link(cx, p) {
+        return None;
+    }
+    let markup = is_markup(&a.subtype);
+    let icon = if cx.allowed && !markup { egui::CursorIcon::Move } else { egui::CursorIcon::PointingHand };
+    // Signatures and Fill & Sign's marks are placed on the page rather than comments on it.
+    let layer = if a.fill_sign { Layer::Placed } else { Layer::Comment };
+    // Text markup does not move: a click selects it, a drag across it selects the text.
+    Some(Hit { declines_drag: markup, ..Hit::new(Owner::Comment { index: a.index, part: CommentPart::Body }, layer, icon) })
+}
+
+/// Whether the comments take the press on this page (or, with no button down, would take one
+/// under the pointer), so the tools beneath leave it: a live move, resize or reshape, or a press
+/// held by a comment that keeps its drag.
+fn grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
+    if matches!(view.comments.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page)
+    {
+        return true;
+    }
+    if cx.ptr.any_down {
+        return matches!(view.router.owner(cx.page), Some(Owner::Comment { .. })) && view.router.keeps_drag();
+    }
+    cx.ptr.pos.and_then(|p| hit(cx, view, p)).is_some_and(|h| !h.declines_drag)
+}
+
+/// With a Fill & Sign tool, a Fill & Sign mark already on the page is picked up as with the Select
+/// tool ([`hit`]), so the tool does not place a mark there.
 pub(crate) fn fill_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
-    matches!(cx.tool, QuickTool::Fill(_)) && grabs(cx, view, |a| a.fill_sign)
+    matches!(cx.tool, QuickTool::Fill(_)) && grabs(cx, view)
 }
 
 /// With the Select tool, a comment that would move (not text markup) is picked up before a form
 /// field under it, so a signature placed over a field can still be dragged off it.
 pub(crate) fn select_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
-    cx.tool == QuickTool::Select && grabs(cx, view, |a| !is_markup(&a.subtype))
+    cx.tool == QuickTool::Select && grabs(cx, view)
 }
 
-/// With a shape tool (rectangle, oval, line, polygon…), the selected comment's resize handles
-/// are picked up as with the Select tool, so the shape just drawn can be resized straight away
-/// (#2338). Only the handles: a press anywhere else, the shape itself included, still draws.
-pub(crate) fn draw_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
-    let QuickTool::Comment(tool) = cx.tool else { return false };
-    if !(tool.draws() || tool.clicks_points()) || tool == CommentTool::Eraser || cx.hidden {
-        return false;
-    }
-    let cv = &view.comments;
-    if matches!(cv.gesture, Some(Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page) {
-        return true;
-    }
-    // A polygon being clicked out keeps its clicks, even near an old shape's handle.
-    if cv.gesture.is_some() {
-        return false;
-    }
-    press_point(cx).is_some_and(|p| on_handle(cx, view, p, |_| true))
-}
-
-/// Whether the press (or, with no button down, the pointer) is on a `pick` comment or on the
-/// selected one's resize handles.
-fn grabs(cx: &PageCx<'_>, view: &DocView, pick: impl Fn(&Annotation) -> bool) -> bool {
-    if cx.hidden {
-        return false;
-    }
-    if matches!(view.comments.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page)
-    {
-        return true;
-    }
-    let Some(p) = press_point(cx) else { return false };
-    on_handle(cx, view, p, &pick) || cx.hit(p).is_some_and(pick)
-}
-
-/// Where a gesture on this page is decided: the press while the button is down, otherwise the
-/// pointer (egui clears the press origin on release). `None` off the page.
-fn press_point(cx: &PageCx<'_>) -> Option<Pos2> {
-    (if cx.ptr.any_down { cx.ptr.origin } else { cx.ptr.pos }).filter(|p| cx.xf.rect.contains(*p))
-}
-
-/// Whether `p` is on a resize handle of the selected comment, when it is a resizable `pick`.
-fn on_handle(cx: &PageCx<'_>, view: &DocView, p: Pos2, pick: impl Fn(&Annotation) -> bool) -> bool {
-    view.comments.selected.filter(|(page, _)| *page == cx.page).and_then(|(_, i)| cx.get(i)).filter(|a| pick(a) && cx.allowed).is_some_and(|a| {
-        (resizable(a) && HANDLES.into_iter().any(|h| handle_pos(cx.screen_rect(a), h).distance(p) <= 7.0))
-            || (grabs_points(cx.tool) && reshapable(a) && point_handle(cx, a, p).is_some())
-    })
+/// With a shape tool, the selected comment's handles are picked up ([`hit`]).
+fn draw_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
+    matches!(cx.tool, QuickTool::Comment(_)) && grabs(cx, view)
 }
 
 /// Whether `p` is on one of this page's links.
@@ -149,80 +175,45 @@ pub(super) fn hover_tip(a: &Annotation, prefs: &CommentPrefs) -> Option<String>
     Some(if body.is_empty() { who } else { format!("{who}\n{body}") })
 }
 
-/// The Select tool: hover, select, move, resize, edit, delete.
-fn select_input(
-    ui: &egui::Ui,
-    resp: &egui::Response,
-    cx: &PageCx<'_>,
-    view: &mut DocView,
-    pointer: Option<Pos2>,
-    origin: Option<Pos2>,
-    pressed_here: bool,
-) -> bool {
-    let cv = &mut view.comments;
-    let selected = cv.selected.filter(|(p, _)| *p == cx.page).and_then(|(_, i)| cx.get(i));
-    // Handles of a selected, resizable comment.
-    let handle_at = |p: Pos2| -> Option<(i8, i8)> {
-        let a = selected.filter(|a| cx.allowed && resizable(a))?;
-        let r = cx.screen_rect(a);
-        HANDLES.into_iter().find(|h| handle_pos(r, *h).distance(p) <= 7.0)
+/// The Select tool: select, move, resize, edit, delete, on the comment the press was on (its
+/// owner, from [`hit`]). The cursor comes from [`hit`] too.
+fn select_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>, view: &mut DocView, pointer: Option<Pos2>, origin: Option<Pos2>) -> bool {
+    let owner = match view.router.owner(cx.page) {
+        Some(Owner::Comment { index, part }) => cx.get(index).map(|a| (a, part)),
+        _ => None,
     };
-    // Ends and corners of a selected line, connected lines, polygon or cloud.
-    let point_at =
-        |p: Pos2| -> Option<usize> { selected.filter(|a| cx.allowed && grabs_points(cx.tool) && reshapable(a)).and_then(|a| point_handle(cx, a, p)) };
+    let cv = &mut view.comments;
     let mut consumed = false;
-    if let Some(p) = pointer {
-        if point_at(p).is_some() {
-            view.cursor.claim(Layer::Handle, egui::CursorIcon::Crosshair);
-        } else if let Some(h) = handle_at(p) {
-            view.cursor.claim(
-                Layer::Handle,
-                match h {
-                    (0, _) => egui::CursorIcon::ResizeVertical,
-                    (_, 0) => egui::CursorIcon::ResizeHorizontal,
-                    (-1, -1) | (1, 1) => egui::CursorIcon::ResizeNwSe,
-                    _ => egui::CursorIcon::ResizeNeSw,
-                },
-            );
-        } else if let Some(a) = cx.hit(p)
-            // A click on a highlight over a link follows the link, so the link's hand and tip
-            // show there.
-            && !(a.subtype == "Highlight" && on_link(cx, p))
-        {
-            let movable = cx.allowed && !is_markup(&a.subtype);
-            let icon = if movable { egui::CursorIcon::Move } else { egui::CursorIcon::PointingHand };
-            // Signatures and Fill & Sign's marks are placed on the page rather than comments on it.
-            view.cursor.claim(if a.fill_sign { Layer::Placed } else { Layer::Comment }, icon);
-        }
-    }
     if resp.drag_started()
-        && pressed_here
-        && let Some(o) = origin
+        && let (Some((a, part)), Some(o)) = (owner, origin)
     {
-        if let (Some(point), Some(a)) = (point_at(o), selected) {
-            let points = a.points.iter().map(|q| [f64::from(q[0]), f64::from(q[1])]).collect();
-            cv.gesture = Some(Gesture::Reshape { page: cx.page, index: a.index, point, points });
-            consumed = true;
-        } else if let (Some(h), Some(a)) = (handle_at(o), selected) {
-            // On screen, the image is also turned by the view's rotation.
-            let turned = !cx.xf.rot.is_multiple_of(180);
-            let aspect_ratio = view.signature_drag.aspect_ratio(cx.page, a.index).map(|ratio| if turned { ratio.recip() } else { ratio });
-            // A drawn signature keeps its shape from the corners, as image signatures do.
-            let aspect_ratio = aspect_ratio.or_else(|| {
-                let r = cx.screen_rect(a);
-                (a.fill_sign && a.subtype == "Ink" && r.height() > 0.0).then(|| r.width() / r.height())
-            });
-            cv.gesture = Some(Gesture::Resize { page: cx.page, index: a.index, handle: h, from: o, aspect_ratio });
-            consumed = true;
-        } else if let Some(a) = cx.hit(o)
-            && !is_markup(&a.subtype)
-        {
-            cv.selected = Some((cx.page, a.index));
-            cv.reveal = true;
-            if cx.allowed {
-                cv.gesture = Some(Gesture::Move { page: cx.page, index: a.index, from: o });
+        match part {
+            CommentPart::Point(point) => {
+                let points = a.points.iter().map(|q| [f64::from(q[0]), f64::from(q[1])]).collect();
+                cv.gesture = Some(Gesture::Reshape { page: cx.page, index: a.index, point, points });
+                consumed = true;
             }
-            consumed = true;
+            CommentPart::Handle(x, y) => {
+                // On screen, the image is also turned by the view's rotation.
+                let turned = !cx.xf.rot.is_multiple_of(180);
+                let aspect_ratio = view.signature_drag.aspect_ratio(cx.page, a.index).map(|ratio| if turned { ratio.recip() } else { ratio });
+                // A drawn signature keeps its shape from the corners, as image signatures do.
+                let aspect_ratio = aspect_ratio.or_else(|| {
+                    let r = cx.screen_rect(a);
+                    (a.fill_sign && a.subtype == "Ink" && r.height() > 0.0).then(|| r.width() / r.height())
+                });
+                cv.gesture = Some(Gesture::Resize { page: cx.page, index: a.index, handle: (x, y), from: o, aspect_ratio });
+                consumed = true;
+            }
+            CommentPart::Body if !is_markup(&a.subtype) => {
+                cv.selected = Some((cx.page, a.index));
+                cv.reveal = true;
+                if cx.allowed {
+                    cv.gesture = Some(Gesture::Move { page: cx.page, index: a.index, from: o });
+                }
+                consumed = true;
+            }
+            CommentPart::Body => {}
         }
     }
     if matches!(cv.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. } | Gesture::Reshape { page, .. }) if page == cx.page) {
@@ -266,15 +257,10 @@ fn select_input(
     // (egui clears the press origin on release, so clicks are located by the pointer.)
     let on_page = pointer.is_some_and(|p| cx.xf.rect.contains(p));
     if resp.clicked() && on_page {
-        let follow_link =
-            cx.tool == QuickTool::Select && !consumed && cv.gesture.is_none() && !resp.double_clicked() && pointer.is_some_and(|p| on_link(cx, p));
-        match pointer.and_then(|p| cx.hit(p)) {
-            Some(a) if a.subtype == "Highlight" && follow_link => {
-                // A plain click follows the link beneath text highlighting. Keep other
-                // annotations and active gestures in control of their own input.
-                cv.selected = None;
-            }
-            Some(a) => {
+        // A click elsewhere (a link beneath text highlighting included: it follows the link)
+        // leaves comments unselected.
+        match owner {
+            Some((a, _)) => {
                 cv.selected = Some((cx.page, a.index));
                 cv.reveal = true;
                 consumed = true;
@@ -285,7 +271,7 @@ fn select_input(
     if resp.double_clicked()
         && on_page
         && cx.allowed
-        && let Some(a) = pointer.and_then(|p| cx.hit(p))
+        && let Some((a, _)) = owner
     {
         cv.selected = Some((cx.page, a.index));
         cv.composer = Some(Composer {
diff --git a/crates/ui-egui/src/tools/comments/state.rs b/crates/ui-egui/src/tools/comments/state.rs
index 36149bb2a0..3bcb12f90d 100644
--- a/crates/ui-egui/src/tools/comments/state.rs
+++ b/crates/ui-egui/src/tools/comments/state.rs
@@ -307,9 +307,10 @@ impl PageCx<'_> {
             .collect()
     }
 
-    /// The topmost comment under `p`.
+    /// The topmost comment under `p`: the one drawn last, in `/Annots` order (inspection lists
+    /// comments by position, not in paint order).
     pub(super) fn hit(&self, p: Pos2) -> Option<&Annotation> {
-        self.comments().filter(|a| self.screen_rects(a).any(|r| r.expand(3.0).contains(p))).last()
+        self.comments().filter(|a| self.screen_rects(a).any(|r| r.expand(3.0).contains(p))).max_by_key(|a| a.index)
     }
 
     pub(crate) fn get(&self, index: usize) -> Option<&Annotation> {
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index 442eade9ea..fbd3d720e4 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -296,11 +296,23 @@ fn a_links_tip_shows_only_with_its_hand() {
     assert_eq!(hover(&mut h, rectangle, 3.0), (Crosshair, false), "a drag draws a rectangle");
 }
 
+/// A drag from plain text onto a link still selects the text: the press decides, not where the
+/// pointer has got to once egui calls it a drag.
+#[test]
+fn a_drag_from_text_onto_a_link_selects_the_text() {
+    let mut h = open(linked_text_pdf(), "150", false);
+    // "before you start." lies right of the link, which covers x 40..160.
+    let (plain, linked) = (at(&h, 200.0, 303.0), at(&h, 100.0, 303.0));
+    assert_eq!(wait_for_cursor(&mut h, plain, |c| c == egui::CursorIcon::Text), egui::CursorIcon::Text, "the page's text has arrived");
+    mouse_drag(&mut h, plain, linked - plain);
+    let selected = h.state().views[0].selected_text().unwrap_or_default();
+    assert!(selected.contains("example.org"), "the drag selected across the link: {selected:?}");
+}
+
 /// Over two comments the tip names the one drawn on top (#3620), and a click should select that
 /// one too. The renderer paints in `/Annots` order, but the hit test takes the last comment in
 /// inspection's order, which is by top edge, and selects the one underneath.
 #[test]
-#[ignore = "step 3 of the page pointer router: one hit test"]
 fn a_click_on_stacked_comments_selects_the_one_drawn_on_top() {
     let mut h = open(stacked_comments_pdf(), "150", false);
     let overlap = at(&h, 125.0, 225.0);

From 7d72f21da366fbb09fa9d02830b2c43d5c60f4fa Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 12:21:35 +0100
Subject: [PATCH 063/132] fix(ui): the area and placement tools act only on
 their own presses, of the primary button

The Sign area, marquee zoom and snapshot, crop and redaction boxes, and the stamps, act where
nothing drawn over the page holds the press (the page router has no owner for it), rather than
wherever the press lands on the page. Fill & Sign already asks the router (fill_grabs).

Their drags start on the primary button and end with its release, however egui reported it:
its drag stop, or the button found up. They started on any button, so a right-drag drew a
signature rectangle and opened the signing dialog (and drew a crop or a marquee), and the end
waited for a pointer position, so a drag whose release came without one never ended.

New test a_right_drag_draws_no_signature_rectangle, seen failing with the drag started on any
button.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs           |  6 ++++--
 crates/ui-egui/src/canvas/crop.rs      |  9 ++++++---
 crates/ui-egui/src/canvas/zoom_snap.rs |  9 ++++++---
 crates/ui-egui/src/tools/redact_ui.rs  |  3 ++-
 crates/ui-egui/src/tools/sign_ui.rs    |  9 ++++++---
 crates/ui-egui/tests/it/pointer.rs     | 21 +++++++++++++++++++++
 6 files changed, 45 insertions(+), 12 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index d67b18b802..f2b5720190 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1145,7 +1145,8 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         && let Some(p) = ptr.within(xf.rect)
     {
         view.cursor.claim(Layer::ToolArea, egui::CursorIcon::Crosshair);
-        if resp.clicked() {
+        // The tool's own click: nothing drawn over the page here holds the press.
+        if resp.clicked() && view.router.owner(i).is_none() {
             // Centred on the click, upright as the page is shown.
             let (vx, vy) = xf.screen_to_view(p);
             let (w, h) = kind.size();
@@ -1169,7 +1170,8 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         && let Some(p) = ptr.within(xf.rect)
     {
         view.cursor.claim(Layer::ToolArea, egui::CursorIcon::Crosshair);
-        if resp.clicked() {
+        // The tool's own click: nothing drawn over the page here holds the press.
+        if resp.clicked() && view.router.owner(i).is_none() {
             // Centred on the click at its natural size (the engine sizes it).
             let (vx, vy) = xf.screen_to_view(p);
             let u = info.pages[i].view_to_user(vx, vy);
diff --git a/crates/ui-egui/src/canvas/crop.rs b/crates/ui-egui/src/canvas/crop.rs
index dd88db1a19..bdd1e9e135 100644
--- a/crates/ui-egui/src/canvas/crop.rs
+++ b/crates/ui-egui/src/canvas/crop.rs
@@ -38,15 +38,18 @@ pub(crate) fn page_input(ui: &egui::Ui, input: CropPageInput<'_>) -> bool {
     if !allowed {
         return false;
     }
-    if resp.drag_started()
+    // The tool's own press, of the primary button: nothing drawn over the page here holds it.
+    if resp.drag_started_by(egui::PointerButton::Primary)
+        && view.router.owner(page).is_none()
         && let Some(o) = origin.filter(|o| xf.rect.contains(*o))
     {
         view.crop_drag = Some((page, o));
     }
     if let Some((p, start)) = view.crop_drag
         && p == page
-        && let Some(end) = pointer
     {
+        // Where the pointer is, or where it went down when it is off the window.
+        let end = pointer.unwrap_or(start);
         let end = Pos2::new(end.x.clamp(xf.rect.left(), xf.rect.right()), end.y.clamp(xf.rect.top(), xf.rect.bottom()));
         let r = Rect::from_two_pos(start, end);
         // Dim what will be cut away.
@@ -60,7 +63,7 @@ pub(crate) fn page_input(ui: &egui::Ui, input: CropPageInput<'_>) -> bool {
             painter.rect_filled(band, CornerRadius::ZERO, Color32::from_black_alpha(70));
         }
         painter.rect_stroke(r, CornerRadius::ZERO, Stroke::new(1.0, Color32::from_rgb(0x14, 0x73, 0xE6)), egui::StrokeKind::Middle);
-        if resp.drag_stopped() {
+        if resp.drag_stopped() || !ptr.primary_down {
             view.crop_drag = None;
             if r.width() >= 4.0 && r.height() >= 4.0 {
                 let (a, b) = (to_user(xf, info, page, r.left_top()), to_user(xf, info, page, r.right_bottom()));
diff --git a/crates/ui-egui/src/canvas/zoom_snap.rs b/crates/ui-egui/src/canvas/zoom_snap.rs
index 8e530ac58e..5a0dcf6733 100644
--- a/crates/ui-egui/src/canvas/zoom_snap.rs
+++ b/crates/ui-egui/src/canvas/zoom_snap.rs
@@ -19,19 +19,22 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, p
     if pointer.is_some_and(|p| xf.rect.contains(p)) {
         view.cursor.claim(Layer::ToolArea, egui::CursorIcon::Crosshair);
     }
-    if resp.drag_started()
+    // The tool's own press, of the primary button: nothing drawn over the page here holds it.
+    if resp.drag_started_by(egui::PointerButton::Primary)
+        && view.router.owner(page).is_none()
         && let Some(o) = origin.filter(|o| xf.rect.contains(*o))
     {
         view.marquee = Some((page, o));
     }
     if let Some((p, start)) = view.marquee
         && p == page
-        && let Some(end) = pointer
     {
+        // Where the pointer is, or where it went down when it is off the window.
+        let end = pointer.unwrap_or(start);
         let end = Pos2::new(end.x.clamp(xf.rect.left(), xf.rect.right()), end.y.clamp(xf.rect.top(), xf.rect.bottom()));
         let r = Rect::from_two_pos(start, end);
         ui.painter().rect_stroke(r, CornerRadius::ZERO, Stroke::new(1.0, Color32::from_rgb(0x14, 0x73, 0xE6)), egui::StrokeKind::Middle);
-        if resp.drag_stopped() {
+        if resp.drag_stopped() || !ptr.primary_down {
             view.marquee = None;
             let (a, b) = (xf.screen_to_view(r.left_top()), xf.screen_to_view(r.right_bottom()));
             view.marquee_done = Some((page, r, [a.0.min(b.0), a.1.min(b.1), a.0.max(b.0), a.1.max(b.1)]));
diff --git a/crates/ui-egui/src/tools/redact_ui.rs b/crates/ui-egui/src/tools/redact_ui.rs
index e5c2ac06e5..96b544b4d0 100644
--- a/crates/ui-egui/src/tools/redact_ui.rs
+++ b/crates/ui-egui/src/tools/redact_ui.rs
@@ -256,7 +256,8 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, over_text: impl Fn(Pos2) -> bo
     if !over_text(p) {
         view.cursor.claim(Layer::ToolArea, egui::CursorIcon::Crosshair);
     }
-    if resp.drag_started() {
+    // The tool's own press, of the primary button: nothing drawn over the page here holds it.
+    if resp.drag_started_by(egui::PointerButton::Primary) && view.router.owner(page).is_none() {
         let origin = ptr.origin.unwrap_or(p);
         if !over_text(origin) {
             view.redact_drag = Some((page, origin));
diff --git a/crates/ui-egui/src/tools/sign_ui.rs b/crates/ui-egui/src/tools/sign_ui.rs
index 921f9a738d..b00d07279a 100644
--- a/crates/ui-egui/src/tools/sign_ui.rs
+++ b/crates/ui-egui/src/tools/sign_ui.rs
@@ -176,20 +176,23 @@ pub(crate) fn page_input(
     if pointer.is_some_and(|p| xf.rect.contains(p)) {
         view.cursor.claim(Layer::ToolArea, egui::CursorIcon::Crosshair);
     }
-    if resp.drag_started()
+    // The tool's own press, of the primary button: nothing drawn over the page here holds it.
+    if resp.drag_started_by(egui::PointerButton::Primary)
+        && view.router.owner(page).is_none()
         && let Some(o) = origin.filter(|o| xf.rect.contains(*o))
     {
         view.sign.drag = Some((page, o));
     }
     if let Some((p, start)) = view.sign.drag
         && p == page
-        && let Some(end) = pointer
     {
+        // Where the pointer is, or where it went down when it is off the window.
+        let end = pointer.unwrap_or(start);
         let end = Pos2::new(end.x.clamp(xf.rect.left(), xf.rect.right()), end.y.clamp(xf.rect.top(), xf.rect.bottom()));
         let r = Rect::from_two_pos(start, end);
         ui.painter().rect_filled(r, CornerRadius::ZERO, Color32::from_rgba_unmultiplied(0x14, 0x73, 0xE6, 28));
         ui.painter().rect_stroke(r, CornerRadius::ZERO, Stroke::new(1.0, Color32::from_rgb(0x14, 0x73, 0xE6)), egui::StrokeKind::Middle);
-        if resp.drag_stopped() {
+        if resp.drag_stopped() || !ptr.primary_down {
             view.sign.drag = None;
             if r.width() >= 8.0 && r.height() >= 8.0 {
                 let user = |q: Pos2| {
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index fbd3d720e4..4a28943b11 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -744,6 +744,27 @@ fn escape_cancels_a_signature_rectangle() {
     assert!(s.dialog.is_none(), "and no signing dialog opens: {:?}", s.dialog);
 }
 
+/// Only the primary button draws a signature rectangle: a right-drag opens no signing dialog.
+#[test]
+fn a_right_drag_draws_no_signature_rectangle() {
+    let mut h = open(link_pdf(), "150", false);
+    h.state_mut().quick_tool = QuickTool::SignArea { certify: false };
+    h.run_steps(4);
+    let (a, b) = (at(&h, 60.0, 200.0), at(&h, 200.0, 120.0));
+    let button = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Secondary, pressed, modifiers: egui::Modifiers::NONE };
+    h.hover_at(a);
+    h.run_steps(1);
+    h.event(button(a, true));
+    h.run_steps(1);
+    h.hover_at(b);
+    h.run_steps(2);
+    h.event(button(b, false));
+    h.run_steps(4);
+    let s = h.state();
+    assert_eq!(s.quick_tool, QuickTool::SignArea { certify: false }, "the tool stays: no rectangle was drawn");
+    assert!(s.dialog.is_none(), "and no signing dialog opens: {:?}", s.dialog);
+}
+
 /// Escape with the button down drops the press: its release places no stamp, and the next click
 /// places one.
 #[test]

From 63fa5010d80cb42396f9ccd09083eed56ddb7721 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 12:29:57 +0100
Subject: [PATCH 064/132] fix(ui): form fields and Prepare decide a press by
 one hit test

Forms: forms_ui::hit is the fields' only hit test (cursor and press). The press opens a text
field (#2213) and its click acts on the field the press was on, from the page router, instead
of the field under the release point: a press on one check box released over the one beside it
ticked the second. Now it ticks neither, as a button pressed and released off itself does
nothing. Forms no longer wait on comments::select_grabs: a comment that moves (a note, a shape,
a signature, a Fill & Sign mark) hits on the Placed layer, over form fields, so it still takes a
press over a field (a signature can be dragged off the field it covers), and text markup stays
on the Comment layer, under them, so a click on a box under a highlight ticks the box.
select_grabs goes.

Prepare Form: prepare::hit (the selected field's corner handles, then a field, on Placed so a
field being moved stays over the comments as before) gives the cursor, and the drag, click and
double click act on what the press was on; a press held by something else is not Prepare's.

New tests: a_press_on_one_check_box_released_over_another_ticks_neither (fails without this
commit: the second box is ticked) and a_check_box_under_a_highlight_takes_the_click (fails with
markup on the Placed layer).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs               | 28 +++++---
 crates/ui-egui/src/canvas/page_router.rs   |  6 ++
 crates/ui-egui/src/tools/comments.rs       |  2 +-
 crates/ui-egui/src/tools/comments/input.rs | 11 +--
 crates/ui-egui/src/tools/forms_ui.rs       | 78 +++++++++++++---------
 crates/ui-egui/src/tools/prepare.rs        | 75 +++++++++++++--------
 crates/ui-egui/tests/it/pointer.rs         | 59 ++++++++++++++++
 7 files changed, 184 insertions(+), 75 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index f2b5720190..4ec1ea6f4e 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1129,7 +1129,24 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     let PageFrame { resp, ptr, pointer, .. } = *frame;
     let cx = PageToolContext { ui, resp, xf: &xf, ptr, page: i, doc, info };
     let pcx = comments::PageCx { page: i, xf: &xf, ptr, info, tool, prefs, allowed, hidden: comments_hidden, redact_mark };
-    let hits = |view: &DocView, p: Pos2| [link_hit(info, &xf, i, p), comments::hit(&pcx, view, p)].into_iter().flatten();
+    let field_tool = match tool {
+        QuickTool::Field(f) => Some(f),
+        _ => None,
+    };
+    // While a table is being set up, nothing else is drawn or moved.
+    let prepare_allowed = can_modify && table_preview.is_none() && frame.out.open_table.is_none();
+    // What lies under a point, bottom up: links, comments, then form fields (Prepare's fields,
+    // being moved, over the comments; filled ones under the comments that move).
+    let hits = |view: &DocView, p: Pos2| {
+        let fields = if preparing {
+            crate::prepare::hit(&xf, info, i, form, field_tool, prepare_allowed, &view.prepare, p)
+        } else if tool == QuickTool::Select {
+            crate::forms_ui::hit(&xf, info, i, form, can_fill, p)
+        } else {
+            None
+        };
+        [link_hit(info, &xf, i, p), comments::hit(&pcx, view, p), fields].into_iter().flatten()
+    };
     if let Some(o) = ptr.pressed().filter(|o| xf.rect.contains(*o)) {
         let at = hits(view, o).collect::<Vec<_>>();
         view.router.press(i, at, tool);
@@ -1231,13 +1248,7 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         frame.out.open_boxes = true;
     }
     let on_field = if preparing {
-        let field_tool = match tool {
-            QuickTool::Field(f) => Some(f),
-            _ => None,
-        };
-        // While a table is being set up, nothing else is drawn or moved.
-        let allowed = can_modify && table_preview.is_none() && frame.out.open_table.is_none();
-        let o = crate::prepare::page_input(cx, form, field_tool, allowed, view);
+        let o = crate::prepare::page_input(cx, form, field_tool, prepare_allowed, view);
         frame.out.field_props |= o.properties;
         frame.out.field_placed |= o.placed;
         frame.out.open_table = frame.out.open_table.or(o.table);
@@ -1245,7 +1256,6 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     } else {
         tool == QuickTool::Select
             && !(editing_content && can_modify && crate::content_ui::select_grabs(&xf, ptr, i, info, added, view))
-            && !comments::select_grabs(&pcx, view)
             && crate::forms_ui::page_input(cx, form, can_fill, view)
     };
     // Redact draws boxes off text; so does Highlight (an area highlight, as in Acrobat).
diff --git a/crates/ui-egui/src/canvas/page_router.rs b/crates/ui-egui/src/canvas/page_router.rs
index 82769bd8f4..c5751cdf14 100644
--- a/crates/ui-egui/src/canvas/page_router.rs
+++ b/crates/ui-egui/src/canvas/page_router.rs
@@ -20,6 +20,12 @@ pub(crate) enum Owner {
     Comment { index: usize, part: CommentPart },
     /// A link, by its index in the document's links.
     Link { index: usize },
+    /// A form field's widget, by the field's index in the form and the widget's in the field.
+    Field { field: usize, widget: usize },
+    /// Prepare Form: a field's widget, to select and move.
+    PrepareField { field: usize, widget: usize },
+    /// Prepare Form: a corner handle of the selected field, to resize it.
+    PrepareCorner { left: bool, top: bool },
 }
 
 /// The part of a comment a hit is on.
diff --git a/crates/ui-egui/src/tools/comments.rs b/crates/ui-egui/src/tools/comments.rs
index ac1d82ea97..a6e718ce7f 100644
--- a/crates/ui-egui/src/tools/comments.rs
+++ b/crates/ui-egui/src/tools/comments.rs
@@ -37,7 +37,7 @@ pub(crate) use geometry::{corner_ratio, page_rotation, resized};
 pub use geometry::{drawn_text_box_rect, text_box_rect};
 #[cfg(test)]
 use input::hover_tip;
-pub(crate) use input::{describe, fill_grabs, hit, keys, nudge_keys, page_after_text, page_input, select_grabs};
+pub(crate) use input::{describe, fill_grabs, hit, keys, nudge_keys, page_after_text, page_input};
 pub use menu::{CanvasAction, fill_picker, recent_custom_colours, remember_custom_colour, status_badge, swatch_grid};
 #[cfg(test)]
 use menu::{RECENT_CUSTOM, same_colour};
diff --git a/crates/ui-egui/src/tools/comments/input.rs b/crates/ui-egui/src/tools/comments/input.rs
index 102767b6cb..17e1e102c3 100644
--- a/crates/ui-egui/src/tools/comments/input.rs
+++ b/crates/ui-egui/src/tools/comments/input.rs
@@ -98,8 +98,9 @@ pub(crate) fn hit(cx: &PageCx<'_>, view: &DocView, p: Pos2) -> Option<Hit> {
     }
     let markup = is_markup(&a.subtype);
     let icon = if cx.allowed && !markup { egui::CursorIcon::Move } else { egui::CursorIcon::PointingHand };
-    // Signatures and Fill & Sign's marks are placed on the page rather than comments on it.
-    let layer = if a.fill_sign { Layer::Placed } else { Layer::Comment };
+    // What a drag moves whole (a note, a shape, a signature, a Fill & Sign mark) is placed on the
+    // page, over a form field; text markup lies on the text, under one.
+    let layer = if a.fill_sign || !markup { Layer::Placed } else { Layer::Comment };
     // Text markup does not move: a click selects it, a drag across it selects the text.
     Some(Hit { declines_drag: markup, ..Hit::new(Owner::Comment { index: a.index, part: CommentPart::Body }, layer, icon) })
 }
@@ -124,12 +125,6 @@ pub(crate) fn fill_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
     matches!(cx.tool, QuickTool::Fill(_)) && grabs(cx, view)
 }
 
-/// With the Select tool, a comment that would move (not text markup) is picked up before a form
-/// field under it, so a signature placed over a field can still be dragged off it.
-pub(crate) fn select_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
-    cx.tool == QuickTool::Select && grabs(cx, view)
-}
-
 /// With a shape tool, the selected comment's handles are picked up ([`hit`]).
 fn draw_grabs(cx: &PageCx<'_>, view: &DocView) -> bool {
     matches!(cx.tool, QuickTool::Comment(_)) && grabs(cx, view)
diff --git a/crates/ui-egui/src/tools/forms_ui.rs b/crates/ui-egui/src/tools/forms_ui.rs
index 8b897d8207..077ad8550c 100644
--- a/crates/ui-egui/src/tools/forms_ui.rs
+++ b/crates/ui-egui/src/tools/forms_ui.rs
@@ -15,6 +15,7 @@ use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageToolContext, PageXform};
 use crate::page_cursor::Layer;
+use crate::page_router::{Hit, Owner};
 use crate::theme::Tokens;
 
 const FOCUS_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
@@ -151,48 +152,64 @@ fn toggle_edit(f: &FormField, w: &FormWidget) -> Option<Edit> {
     Some(Edit::SetFieldValue { name: f.name.clone(), value })
 }
 
-/// Clicks on form widgets of one page. `true` when a field owns the press or click.
-pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], allowed: bool, view: &mut DocView) -> bool {
-    let PageToolContext { ui, resp, xf, ptr, page, info, .. } = cx;
-    let Some(p) = ptr.within(xf.rect) else { return false };
-    let hit = form.iter().find_map(|f| {
+/// Whether `w`, a widget of `f`, takes a press: fillable, a push button with an action, or an
+/// empty signature field (signed by clicking it, Use a certificate). A radio button of a group can
+/// be read-only on its own.
+fn usable(f: &FormField, w: &FormWidget, allowed: bool) -> bool {
+    let pressable = f.kind == FormFieldKind::PushButton && !f.read_only() && f.button.is_some();
+    allowed && !w.read_only && (fillable(f) || pressable || f.kind == FormFieldKind::Signature)
+}
+
+/// The form widget under `p` on `page`: the one hit test of the fields, for the cursor and the
+/// press. Over the page's text too: a check box drawn with a glyph, or set on printed text, is a
+/// button, not text to select.
+pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, form: &[FormField], allowed: bool, p: Pos2) -> Option<Hit> {
+    if !xf.rect.contains(p) {
+        return None;
+    }
+    let (field, f, widget, w) = form.iter().enumerate().find_map(|(fi, f)| {
         f.widgets
             .iter()
             .enumerate()
             .find(|(_, w)| w.page == Some(page) && !w.hidden && widget_rect(xf, info, page, w.rect).contains(p))
-            .map(|(i, w)| (f, i, w))
-    });
-    let Some((f, wi, w)) = hit else { return false };
-    // The field's tooltip (`/TU`), as Acrobat shows it on hover (#3854). ISO 32000-2 Table 226
-    // makes it the name the user interface identifies the field by.
-    if let Some(tip) = f.tooltip.as_deref().filter(|t| !t.trim().is_empty()) {
+            .map(|(wi, w)| (fi, f, wi, w))
+    })?;
+    let icon = match (usable(f, w, allowed), f.kind) {
+        (false, _) => egui::CursorIcon::NotAllowed,
+        (true, FormFieldKind::Text) => egui::CursorIcon::Text,
+        _ => egui::CursorIcon::PointingHand,
+    };
+    Some(Hit::new(Owner::Field { field, widget }, Layer::Field, icon))
+}
+
+/// Presses and clicks on form widgets of one page, on the field the press was on ([`hit`]).
+/// `true` while a field holds the press.
+pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], allowed: bool, view: &mut DocView) -> bool {
+    let PageToolContext { ui, resp, xf, ptr, page, info, .. } = cx;
+    // The field's tooltip (`/TU`) under the pointer, as Acrobat shows it on hover (#3854). ISO
+    // 32000-2 Table 226 makes it the name the user interface identifies the field by.
+    if let Some(p) = ptr.within(xf.rect)
+        && let Some(Owner::Field { field, .. }) = hit(xf, info, page, form, allowed, p).map(|h| h.owner)
+        && let Some(tip) = form.get(field).and_then(|f| f.tooltip.as_deref()).filter(|t| !t.trim().is_empty())
+    {
         resp.clone().on_hover_text_at_pointer(tip);
     }
-    // Empty signature fields are signed by clicking them (Use a certificate); push buttons run
-    // their action.
-    let pressable = f.kind == FormFieldKind::PushButton && !f.read_only() && f.button.is_some();
-    // A radio button of a group can be read-only on its own.
-    let usable = allowed && !w.read_only && (fillable(f) || pressable || f.kind == FormFieldKind::Signature);
-    // Over the page's text too: a check box drawn with a glyph, or set on printed text, is a
-    // button, not text to select.
-    view.cursor.claim(
-        Layer::Field,
-        match (usable, f.kind) {
-            (false, _) => egui::CursorIcon::NotAllowed,
-            (true, FormFieldKind::Text) => egui::CursorIcon::Text,
-            _ => egui::CursorIcon::PointingHand,
-        },
-    );
+    let Some(Owner::Field { field, widget: wi }) = view.router.owner(page) else { return false };
+    let Some((f, w)) = form.get(field).and_then(|f| f.widgets.get(wi).map(|w| (f, w))) else { return false };
+    let usable = usable(f, w, allowed);
     // A text field opens on the press rather than the click, so a drag that starts on it
     // selects its text (#2213).
-    let pressed = f.kind == FormFieldKind::Text && usable && resp.is_pointer_button_down_on() && ptr.pressed().is_some();
-    if pressed && view.forms.focus.as_ref().is_none_or(|x| x.name != f.name || x.widget != wi) {
+    if f.kind == FormFieldKind::Text
+        && usable
+        && let Some(at) = ptr.pressed()
+        && view.forms.focus.as_ref().is_none_or(|x| x.name != f.name || x.widget != wi)
+    {
         commit(view, form);
-        view.forms.focus = Some(Focus { press: Some(p), ..open_focus(f, wi) });
+        view.forms.focus = Some(Focus { press: Some(at), ..open_focus(f, wi) });
         view.forms.pressed = true;
     }
     if !resp.clicked() {
-        return resp.is_pointer_button_down_on();
+        return true;
     }
     if !allowed {
         view.forms.notice = Some(FormNotice::Security);
@@ -231,6 +248,7 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], allowed: b
             }
         }
         FormFieldKind::List => {
+            let Some(p) = ptr.within(xf.rect) else { return true };
             commit(view, form);
             view.forms.focus = Some(open_focus(f, wi));
             let r = widget_rect(xf, info, page, w.rect);
diff --git a/crates/ui-egui/src/tools/prepare.rs b/crates/ui-egui/src/tools/prepare.rs
index c5fa2b684e..e8861b5cf6 100644
--- a/crates/ui-egui/src/tools/prepare.rs
+++ b/crates/ui-egui/src/tools/prepare.rs
@@ -13,6 +13,7 @@ use pdfcraft_render::DocInfo;
 use crate::canvas::{DocView, PageToolContext, PageXform};
 use crate::comments;
 use crate::page_cursor::Layer;
+use crate::page_router::{Hit, Owner};
 use crate::theme;
 use crate::widgets;
 
@@ -252,6 +253,38 @@ pub(crate) struct Outcome {
     pub table: Option<(usize, [f64; 4])>,
 }
 
+/// What Prepare Form's Select tool has under `p` on `page`: the selected field's corner handles,
+/// then a field. A field being moved is placed on the page over the comments; nothing with a field
+/// tool, which draws anywhere.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn hit(
+    xf: &PageXform,
+    info: &DocInfo,
+    page: usize,
+    form: &[FormField],
+    tool: Option<FieldTool>,
+    allowed: bool,
+    prep: &PrepareView,
+    p: Pos2,
+) -> Option<Hit> {
+    if tool.is_some() || !allowed || !xf.rect.contains(p) {
+        return None;
+    }
+    let selected_rect = prep
+        .selected
+        .as_ref()
+        .and_then(|(n, wi)| form.iter().find(|f| &f.name == n)?.widgets.get(*wi).filter(|w| w.page == Some(page)))
+        .map(|w| screen_rect(xf, info, page, w.rect));
+    if let Some((_, left, top)) = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(p) <= 6.0)) {
+        let icon = if left == top { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw };
+        return Some(Hit::new(Owner::PrepareCorner { left, top }, Layer::Handle, icon));
+    }
+    let (field, widget) = form.iter().enumerate().find_map(|(fi, f)| {
+        f.widgets.iter().enumerate().find(|(_, w)| w.page == Some(page) && screen_rect(xf, info, page, w.rect).contains(p)).map(|(wi, _)| (fi, wi))
+    })?;
+    Some(Hit::new(Owner::PrepareField { field, widget }, Layer::Placed, egui::CursorIcon::Move))
+}
+
 /// Pointer input on one page while preparing a form.
 pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], tool: Option<FieldTool>, allowed: bool, view: &mut DocView) -> Outcome {
     let PageToolContext { ui, resp, xf, ptr, page, info, .. } = cx;
@@ -383,33 +416,21 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], tool: Opti
             prep.also.clear();
         }
     }
-    // The Select tool: corner handles of the selection, then fields.
-    let selected_rect = prep
-        .selected
-        .as_ref()
-        .and_then(|(n, wi)| form.iter().find(|f| &f.name == n)?.widgets.get(*wi).filter(|w| w.page == Some(page)))
-        .map(|w| screen_rect(xf, info, page, w.rect));
-    let corner = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(p) <= 6.0));
-    let hit = form.iter().find_map(|f| {
-        f.widgets.iter().enumerate().find(|(_, w)| w.page == Some(page) && screen_rect(xf, info, page, w.rect).contains(p)).map(|(i, _)| (f, i))
-    });
-    if let Some((_, left, top)) = corner {
-        view.cursor.claim(Layer::Handle, if left == top { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw });
-    } else if hit.is_some() {
-        view.cursor.claim(Layer::Field, egui::CursorIcon::Move);
-    }
-    if resp.drag_started() {
+    // The Select tool: what the press was on ([`hit`]), a corner handle or a field; elsewhere a
+    // drag draws a selection rectangle. A press held by something drawn over the fields (a
+    // comment) is not Prepare's.
+    let owner = view.router.owner(page);
+    let held = matches!(owner, Some(Owner::PrepareField { .. } | Owner::PrepareCorner { .. }));
+    let hit = match owner {
+        Some(Owner::PrepareField { field, widget }) => form.get(field).map(|f| (f, widget)),
+        _ => None,
+    };
+    if resp.drag_started() && (held || owner.is_none()) {
         let origin = ptr.origin.unwrap_or(p);
-        if let Some((_, left, top)) = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(origin) <= 6.0)) {
+        if let Some(Owner::PrepareCorner { left, top }) = owner {
             prep.grab = Some((page, Grab::Corner(left, top), origin));
             out.consumed = true;
-        } else if let Some((f, wi)) = form.iter().find_map(|f| {
-            f.widgets
-                .iter()
-                .enumerate()
-                .find(|(_, w)| w.page == Some(page) && screen_rect(xf, info, page, w.rect).contains(origin))
-                .map(|(i, _)| (f, i))
-        }) {
+        } else if let Some((f, wi)) = hit {
             prep.selected = Some((f.name.clone(), wi));
             prep.grab = Some((page, Grab::Move, origin));
             out.consumed = true;
@@ -429,7 +450,7 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], tool: Opti
         out.properties = true;
         return out;
     }
-    if resp.clicked() {
+    if resp.clicked() && (held || owner.is_none()) {
         let extend = ui.input(|i| i.modifiers.shift || i.modifiers.command);
         match hit {
             // Shift/⌘-click adds or removes a field from the selection.
@@ -437,14 +458,14 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], tool: Opti
                 prep.select((f.name.clone(), wi), extend);
                 out.consumed = true;
             }
-            None if corner.is_none() => {
+            None if !held => {
                 prep.selected = None;
                 prep.also.clear();
             }
             None => out.consumed = true,
         }
     }
-    out.consumed |= hit.is_some() && resp.is_pointer_button_down_on();
+    out.consumed |= held;
     out
 }
 
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index 4a28943b11..b110041986 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -107,6 +107,31 @@ fn checkbox_pdf() -> Vec<u8> {
     ])
 }
 
+/// A 300×400 page with two unchecked check boxes side by side: `agree` at x 100..120 and
+/// `other` at x 120..140, both at y 200..220.
+fn two_checkboxes_pdf() -> Vec<u8> {
+    pdf(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R] /DA (/ZaDb 0 Tf 0 g) /DR << /Font << /ZaDb 6 0 R >> >> >> >>",
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (agree) /V /Off /AS /Off /Rect [100 200 120 220] /P 3 0 R /F 4 /MK << /CA (4) >> /DA (/ZaDb 11 Tf 0 g) >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (other) /V /Off /AS /Off /Rect [120 200 140 220] /P 3 0 R /F 4 /MK << /CA (4) >> /DA (/ZaDb 11 Tf 0 g) >>",
+        "<< /Type /Font /Subtype /Type1 /BaseFont /ZapfDingbats >>",
+    ])
+}
+
+/// The check box `agree` of [`checkbox_pdf`], with a highlight drawn over it.
+fn highlighted_checkbox_pdf() -> Vec<u8> {
+    pdf(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] /DA (/ZaDb 0 Tf 0 g) /DR << /Font << /ZaDb 5 0 R >> >> >> >>",
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 6 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /T (agree) /V /Off /AS /Off /Rect [100 200 120 220] /P 3 0 R /F 4 /MK << /CA (4) >> /DA (/ZaDb 11 Tf 0 g) >>",
+        "<< /Type /Font /Subtype /Type1 /BaseFont /ZapfDingbats >>",
+        "<< /Type /Annot /Subtype /Highlight /Rect [95 195 125 225] /QuadPoints [95 225 125 225 95 195 125 195] /C [1 1 0] /F 4 /T (Ana) >>",
+    ])
+}
+
 /// The app with `pdf` open at `zoom` percent and its first frames run. The left panel stays
 /// open only where a test places the page relative to the window's chrome.
 fn open(pdf: Vec<u8>, zoom: &'static str, left_open: bool) -> Harness<'static, PdfCraftApp> {
@@ -688,6 +713,40 @@ fn coalesced_click_places_a_stamp() {
     assert_eq!(stamps(&h), 1, "a click whose press and release share a frame places the stamp");
 }
 
+/// The value of the field named `name` on the first view's document.
+fn field_value(h: &Harness<'_, PdfCraftApp>, name: &str) -> Vec<String> {
+    let s = h.state();
+    s.session.get(s.views[0].id).unwrap().form.iter().find(|f| f.name == name).unwrap().value.clone()
+}
+
+/// A press belongs to the field it lands on: pressed at the right edge of `agree` and released just
+/// over the edge of `other` beside it (a click still, to egui), it ticks neither, as a button
+/// pressed and released off itself does nothing. The release used to tick `other`.
+#[test]
+fn a_press_on_one_check_box_released_over_another_ticks_neither() {
+    let mut h = open(two_checkboxes_pdf(), "150", false);
+    let (press, release) = (at(&h, 119.0, 210.0), at(&h, 121.0, 210.0));
+    h.hover_at(press);
+    h.run_steps(1);
+    h.drag_at(press);
+    h.run_steps(1);
+    h.drop_at(release);
+    h.run_steps(4);
+    assert_eq!((field_value(&h, "agree"), field_value(&h, "other")), (Vec::<String>::new(), Vec::new()), "neither box is ticked");
+}
+
+/// Text markup lies on the text, under a form field: a click on a check box under a highlight
+/// ticks the box, and the field's hand shows there.
+#[test]
+fn a_check_box_under_a_highlight_takes_the_click() {
+    let mut h = open(highlighted_checkbox_pdf(), "150", false);
+    let p = at(&h, 110.0, 210.0);
+    assert_eq!(cursor_at(&mut h, p), egui::CursorIcon::PointingHand);
+    mouse_click(&mut h, p);
+    assert_eq!(field_value(&h, "agree"), ["Yes"], "the box is ticked");
+    assert_eq!(h.state().views[0].comments.selected, None, "and the highlight is not selected");
+}
+
 #[test]
 fn mouse_click_ticks_a_check_box() {
     // Control for the tap below.

From a4c5fbed64425ce7811ec62bb67d1627330d8e13 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 12:50:01 +0100
Subject: [PATCH 065/132] fix(ui): Edit text's paragraphs, pictures, objects
 and added content decide a press by one hit test

Edit text's paragraph edges were tested twice: by edit_text_ui for the cursor, on the page's
paragraphs, and by object_ui for the press, on its own object inventory (grabs_edge). Where the
two inventories disagree, the resize arrow shows and a press starts an invisible area selection
instead (#2276, the review's step-3 probe). The open paragraph's frame showed the Move cursor
4 px out and took the press 6 px out.

Each of these parts now has one hit test, in the page router's table, and acts only on the
press it was captured on:
- edit_text_ui::hit: a paragraph's edges (Handle), its body (Text; Editor for the open one).
- edit_text_ui::picture_hit and picture_handle_hit: a picture's body on the Text layer, asked
  before the paragraphs, so text on top of artwork takes the press; the selected picture's
  corners and rotate knob on Handle, asked after them, so they win over text.
- object_ui::hit: the objects selected together (Placed) and the open paragraph's frame
  (Handle), with one reach (FRAME_REACH, 6 px) for the cursor and the press. An area selection
  starts only where nobody's hit claims the press.
- content_ui::hit: added text and pictures (Placed; the selected one's corners on Handle), over
  form fields; Add text starts a new box only where nobody's hit claims the press.
image_owns_pointer and content_ui::select_grabs go, with the edge test object_ui kept a copy of
(grabs_edge). The page's hits move into canvas::PageHits.

Un-ignores a_paragraph_edge_resizes_wherever_it_shows_the_resize_cursor: it passes on main
already (the inventories agree for its paragraph since the probe was written), so it stays as a
guard rather than as proof. New test an_open_paragraphs_frame_shows_move_wherever_a_press_takes_the_box
fails on the previous commit (the cursor is Default there).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs                  | 176 +++++++++++++-----
 crates/ui-egui/src/canvas/page_router.rs      |  40 ++++
 crates/ui-egui/src/tools/content_ui.rs        |  56 +++---
 crates/ui-egui/src/tools/edit_text_ui.rs      |  66 ++++---
 .../ui-egui/src/tools/edit_text_ui/image.rs   | 100 +++++-----
 crates/ui-egui/src/tools/object_ui.rs         |  54 +++---
 crates/ui-egui/tests/it/editing.rs            |  23 +++
 crates/ui-egui/tests/it/pointer.rs            |   1 -
 8 files changed, 354 insertions(+), 162 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 4ec1ea6f4e..b96364cb56 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1129,26 +1129,34 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     let PageFrame { resp, ptr, pointer, .. } = *frame;
     let cx = PageToolContext { ui, resp, xf: &xf, ptr, page: i, doc, info };
     let pcx = comments::PageCx { page: i, xf: &xf, ptr, info, tool, prefs, allowed, hidden: comments_hidden, redact_mark };
+    let (lines, images) =
+        if matches!(tool, QuickTool::AddText | QuickTool::EditText) && can_modify { edit_inventory(view, doc, i) } else { Default::default() };
     let field_tool = match tool {
         QuickTool::Field(f) => Some(f),
         _ => None,
     };
     // While a table is being set up, nothing else is drawn or moved.
     let prepare_allowed = can_modify && table_preview.is_none() && frame.out.open_table.is_none();
-    // What lies under a point, bottom up: links, comments, then form fields (Prepare's fields,
-    // being moved, over the comments; filled ones under the comments that move).
-    let hits = |view: &DocView, p: Pos2| {
-        let fields = if preparing {
-            crate::prepare::hit(&xf, info, i, form, field_tool, prepare_allowed, &view.prepare, p)
-        } else if tool == QuickTool::Select {
-            crate::forms_ui::hit(&xf, info, i, form, can_fill, p)
-        } else {
-            None
-        };
-        [link_hit(info, &xf, i, p), comments::hit(&pcx, view, p), fields].into_iter().flatten()
+    let hits = PageHits {
+        page: i,
+        xf: &xf,
+        info,
+        tool,
+        pcx: &pcx,
+        form,
+        can_fill,
+        can_modify,
+        editing_content,
+        preparing,
+        field_tool,
+        prepare_allowed,
+        added,
+        lines: &lines,
+        images: &images,
+        clip: ui.clip_rect(),
     };
     if let Some(o) = ptr.pressed().filter(|o| xf.rect.contains(*o)) {
-        let at = hits(view, o).collect::<Vec<_>>();
+        let at = hits.at(view, o);
         view.router.press(i, at, tool);
     }
     if let QuickTool::Measure(measure_tool) = tool {
@@ -1254,9 +1262,7 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         frame.out.open_table = frame.out.open_table.or(o.table);
         o.consumed || field_tool.is_some()
     } else {
-        tool == QuickTool::Select
-            && !(editing_content && can_modify && crate::content_ui::select_grabs(&xf, ptr, i, info, added, view))
-            && crate::forms_ui::page_input(cx, form, can_fill, view)
+        tool == QuickTool::Select && crate::forms_ui::page_input(cx, form, can_fill, view)
     };
     // Redact draws boxes off text; so does Highlight (an area highlight, as in Acrobat).
     let area_tool = tool == QuickTool::Redact && can_modify || tool == QuickTool::Comment(comments::CommentTool::Highlight) && allowed;
@@ -1268,21 +1274,7 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         };
         crate::redact_ui::page_input(cx, over_text, view)
     };
-    let image_owns_pointer = tool == QuickTool::EditText && crate::edit_text_ui::image_owns_pointer(ui, &xf, ptr, i, info, view);
-    let on_objects = !image_owns_pointer && tool == QuickTool::EditText && can_modify && crate::object_ui::page_input(cx, view);
-    let lines = if matches!(tool, QuickTool::AddText | QuickTool::EditText) && can_modify {
-        let generation = doc.edit_generation();
-        match view.edit_lines.get(&i) {
-            Some((g, l)) if *g == generation => l.clone(),
-            _ => {
-                let l = doc.text_blocks(i);
-                view.edit_lines.insert(i, (generation, l.clone()));
-                l
-            }
-        }
-    } else {
-        Vec::new()
-    };
+    let on_objects = tool == QuickTool::EditText && can_modify && crate::object_ui::page_input(cx, view);
     let over_source = tool == QuickTool::AddText
         && pointer.is_some_and(|p| {
             !crate::content_ui::hits_added(&xf, info, i, added, p)
@@ -1314,18 +1306,9 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     // instead of vanishing until the pointer comes back.
     let others_own_pointer = on_objects || on_content;
     let on_edit_text = (tool == QuickTool::EditText || over_source) && can_modify && {
-        let generation = doc.edit_generation();
-        let images = match view.edit_images.get(&i) {
-            Some((g, l)) if *g == generation => l.clone(),
-            _ => {
-                let l = doc.page_images(i);
-                view.edit_images.insert(i, (generation, l.clone()));
-                l
-            }
-        };
         // Editable text takes precedence over background/overlapping artwork. Both
         // inventories are painted every frame, even when text owns the pointer.
-        let text_used = crate::edit_text_ui::page_input(cx, &lines, view, !others_own_pointer && !image_owns_pointer);
+        let text_used = crate::edit_text_ui::page_input(cx, &lines, view, !others_own_pointer);
         let image_cx = crate::edit_text_ui::ImageCx {
             ui,
             resp,
@@ -1333,7 +1316,7 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
             ptr,
             page: i,
             info,
-            allow_interaction: !others_own_pointer && (image_owns_pointer || !text_used),
+            allow_interaction: !others_own_pointer && (matches!(view.router.owner(i), Some(crate::page_router::Owner::Picture { .. })) || !text_used),
         };
         let image_used = crate::edit_text_ui::image_input(&image_cx, &images, view, &mut frame.out.image_action);
         !others_own_pointer && (text_used || image_used)
@@ -1353,13 +1336,122 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     if frame.env.unobstructed
         && let Some(p) = pointer
     {
-        for h in hits(view, p).collect::<Vec<_>>() {
+        for h in hits.at(view, p) {
             view.cursor.claim_with_tip(h.layer, h.icon, h.tip);
         }
     }
     PageInput { consumed, area_tool }
 }
 
+/// Edit text's paragraphs and pictures on page `i`, kept while the document is unchanged.
+fn edit_inventory(
+    view: &mut DocView,
+    doc: &pdfcraft_engine::Document,
+    i: usize,
+) -> (Vec<pdfcraft_engine::TextBlock>, Vec<pdfcraft_engine::PageImage>) {
+    let generation = doc.edit_generation();
+    let lines = match view.edit_lines.get(&i) {
+        Some((g, l)) if *g == generation => l.clone(),
+        _ => {
+            let l = doc.text_blocks(i);
+            view.edit_lines.insert(i, (generation, l.clone()));
+            l
+        }
+    };
+    let images = match view.edit_images.get(&i) {
+        Some((g, l)) if *g == generation => l.clone(),
+        _ => {
+            let l = doc.page_images(i);
+            view.edit_images.insert(i, (generation, l.clone()));
+            l
+        }
+    };
+    (lines, images)
+}
+
+/// What the page modules have under a point on one page, for the page router.
+struct PageHits<'a> {
+    page: usize,
+    xf: &'a PageXform,
+    info: &'a DocInfo,
+    tool: QuickTool,
+    pcx: &'a comments::PageCx<'a>,
+    form: &'a [pdfcraft_engine::FormField],
+    can_fill: bool,
+    can_modify: bool,
+    /// Edit a PDF is open: added text and pictures can be picked up.
+    editing_content: bool,
+    preparing: bool,
+    field_tool: Option<crate::prepare::FieldTool>,
+    /// Prepare may draw and move fields (not while a table is being set up).
+    prepare_allowed: bool,
+    added: &'a [pdfcraft_engine::Added],
+    lines: &'a [pdfcraft_engine::TextBlock],
+    images: &'a [pdfcraft_engine::PageImage],
+    /// The pages' visible area (the picture's rotate knob stays inside it).
+    clip: Rect,
+}
+
+impl PageHits<'_> {
+    /// The hits at `p`, bottom up: links, comments; Edit text's pictures under its paragraphs (text
+    /// on top of artwork takes the press), added content, the objects selected together and the
+    /// open paragraph's frame, the selected picture's grips over them all; then form fields
+    /// (Prepare's, being moved, over the comments; filled ones under added content and the
+    /// comments that move).
+    fn at(&self, view: &DocView, p: Pos2) -> Vec<crate::page_router::Hit> {
+        let PageHits {
+            page,
+            xf,
+            info,
+            tool,
+            pcx,
+            form,
+            can_fill,
+            can_modify,
+            editing_content,
+            preparing,
+            field_tool,
+            prepare_allowed,
+            added,
+            lines,
+            images,
+            clip,
+        } = *self;
+        let fields = if preparing {
+            crate::prepare::hit(xf, info, page, form, field_tool, prepare_allowed, &view.prepare, p)
+        } else if tool == QuickTool::Select {
+            crate::forms_ui::hit(xf, info, page, form, can_fill, p)
+        } else {
+            None
+        };
+        // With Add text, only the paragraphs and pictures not under added content.
+        let editing =
+            can_modify && (tool == QuickTool::EditText || tool == QuickTool::AddText && !crate::content_ui::hits_added(xf, info, page, added, p));
+        let (pictures, paragraphs, objects, grips) = if editing {
+            let open = view.line_editor.as_ref().filter(|e| e.page == page);
+            let frame = open
+                .filter(|e| !e.has_changes())
+                .and_then(|e| lines.get(e.block))
+                .map(|l| xf.user_rect(info, page, l.rect.map(|v| v as f32)).expand(2.0));
+            (
+                crate::edit_text_ui::picture_hit(xf, page, info, images, view, p),
+                crate::edit_text_ui::hit(xf, info, page, lines, open.map(|e| e.block), p),
+                (tool == QuickTool::EditText).then(|| crate::object_ui::hit(view, xf, info, page, frame, p)).flatten(),
+                crate::edit_text_ui::picture_handle_hit(clip, xf, page, info, images, view, p),
+            )
+        } else {
+            (None, None, None, None)
+        };
+        // Added text and pictures, over the page's own paragraphs and under the objects selected
+        // together.
+        let added = (editing_content && can_modify).then(|| crate::content_ui::hit(xf, info, page, added, view, p)).flatten();
+        [link_hit(info, xf, page, p), comments::hit(pcx, view, p), pictures, paragraphs, added, objects, grips, fields]
+            .into_iter()
+            .flatten()
+            .collect()
+    }
+}
+
 /// Text layer: find matches, selection, I-beam and drag-to-select.
 fn text_layer(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, slot: &PageSlot, input: &PageInput) {
     let PageEnv { info, selects_text, tool, .. } = frame.env;
diff --git a/crates/ui-egui/src/canvas/page_router.rs b/crates/ui-egui/src/canvas/page_router.rs
index c5751cdf14..06d3c48568 100644
--- a/crates/ui-egui/src/canvas/page_router.rs
+++ b/crates/ui-egui/src/canvas/page_router.rs
@@ -26,6 +26,46 @@ pub(crate) enum Owner {
     PrepareField { field: usize, widget: usize },
     /// Prepare Form: a corner handle of the selected field, to resize it.
     PrepareCorner { left: bool, top: bool },
+    /// Edit text: a paragraph, by its index among the page's, and what of it a press takes.
+    Paragraph { block: usize, part: ParagraphPart },
+    /// Edit text: a picture, by its index among the page's, and what of it a press takes.
+    Picture { index: usize, part: PicturePart },
+    /// Edit text: the objects selected together, or the frame of the paragraph open for typing.
+    Objects { part: ObjectsPart },
+    /// Added text or a picture placed on the page, by its index among the page's, and a corner of
+    /// the selected one (left, top) or the item itself.
+    Added { index: usize, corner: Option<(bool, bool)> },
+}
+
+/// The part of a picture a hit is on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum PicturePart {
+    /// The picture: a click selects it, a drag moves the selected one.
+    Body,
+    /// A corner of the selected picture (left top, right top, left bottom, right bottom): a drag
+    /// resizes it.
+    Corner(usize),
+    /// The selected picture's rotate knob: a drag turns it.
+    Knob,
+}
+
+/// What of the objects a hit is on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ObjectsPart {
+    /// The objects selected together: a drag moves them all.
+    Selection,
+    /// The frame drawn around the paragraph open for typing: a click selects the box, a drag moves it.
+    Frame,
+}
+
+/// The part of a paragraph a hit is on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ParagraphPart {
+    /// The paragraph: a drag moves it, a click opens it for typing.
+    Body,
+    /// Its left or right edge (on screen): a drag rewraps it.
+    Left,
+    Right,
 }
 
 /// The part of a comment a hit is on.
diff --git a/crates/ui-egui/src/tools/content_ui.rs b/crates/ui-egui/src/tools/content_ui.rs
index a0d9cefa13..fdc6e3f98b 100644
--- a/crates/ui-egui/src/tools/content_ui.rs
+++ b/crates/ui-egui/src/tools/content_ui.rs
@@ -9,7 +9,7 @@ use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageToolContext, PageXform};
 use crate::page_cursor::Layer;
-use crate::page_pointer::PagePointer;
+use crate::page_router::{Hit, Owner};
 use crate::theme::Tokens;
 use crate::widgets;
 
@@ -330,18 +330,22 @@ fn dragged(r: Rect, grab: Grab, d: egui::Vec2, keep_aspect: bool) -> Rect {
     }
 }
 
-/// Added text and images keep pointer ownership over a form field while editing content.
-pub(crate) fn select_grabs(xf: &PageXform, ptr: &PagePointer, page: usize, info: &DocInfo, added: &[Added], view: &DocView) -> bool {
-    let cv = &view.content;
-    if cv.grab.is_some_and(|(grab_page, _, _)| grab_page == page) {
-        return true;
+/// What of the added text and pictures lies under `p` on `page`: the selected item's corners, then
+/// the topmost item. Placed on the page, over a form field under it.
+pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, added: &[Added], view: &DocView, p: Pos2) -> Option<Hit> {
+    if !xf.rect.contains(p) {
+        return None;
     }
-    let Some(p) = ptr.within(xf.rect) else { return false };
-    on_page(added, page).into_iter().any(|(index, item)| {
-        let rect = screen_rect(xf, info, page, item.content.rect());
-        rect.expand(2.0).contains(p)
-            || cv.selected == Some((page, index)) && handles(rect).into_iter().any(|(corner, _, _)| corner.distance(p) <= 6.0)
-    })
+    let items = on_page(added, page);
+    let selected = view.content.selected.filter(|s| s.0 == page).and_then(|(_, si)| items.iter().find(|(i, _)| *i == si));
+    if let Some((index, a)) = selected
+        && let Some((_, left, top)) = handles(screen_rect(xf, info, page, a.content.rect())).into_iter().find(|(c, ..)| c.distance(p) <= 6.0)
+    {
+        let icon = if left == top { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw };
+        return Some(Hit::new(Owner::Added { index: *index, corner: Some((left, top)) }, Layer::Handle, icon));
+    }
+    let (index, _) = items.iter().rev().find(|(_, a)| screen_rect(xf, info, page, a.content.rect()).expand(2.0).contains(p))?;
+    Some(Hit::new(Owner::Added { index: *index, corner: None }, Layer::Placed, egui::CursorIcon::Move))
 }
 
 /// Pointer input on one page in Edit mode (`adding_text` with the Text tool). `true` when it
@@ -396,7 +400,8 @@ pub(crate) fn page_input(
     let corner = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(p) <= 6.0));
     if adding_text && hit.is_none() {
         view.cursor.claim(Layer::ToolArea, egui::CursorIcon::Text);
-        if resp.clicked() {
+        // A new box where nothing drawn over the page holds the press.
+        if resp.clicked() && view.router.owner(page).is_none() {
             // Text that can't be drawn stays where it is being typed (#125).
             if cv.hold_blocked() {
                 return true;
@@ -420,20 +425,21 @@ pub(crate) fn page_input(
         }
         return consumed;
     }
-    if let Some((_, left, top)) = corner {
-        view.cursor.claim(Layer::Handle, if left == top { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw });
-    } else if hit.is_some() {
-        view.cursor.claim(Layer::Placed, egui::CursorIcon::Move);
-    }
+    // A drag on what the press was on ([`hit`]): a corner resizes the selected item, the item
+    // itself moves.
     if resp.drag_started() {
         let origin = ptr.origin.unwrap_or(p);
-        if let Some((_, left, top)) = selected_rect.and_then(|r| handles(r).into_iter().find(|(c, ..)| c.distance(origin) <= 6.0)) {
-            cv.grab = Some((page, Grab::Corner(left, top), origin));
-            consumed = true;
-        } else if let Some((i, _)) = items.iter().rev().find(|(_, a)| screen_rect(xf, info, page, a.content.rect()).expand(2.0).contains(origin)) {
-            cv.selected = Some((page, *i));
-            cv.grab = Some((page, Grab::Move, origin));
-            consumed = true;
+        match view.router.owner(page) {
+            Some(Owner::Added { corner: Some((left, top)), .. }) => {
+                cv.grab = Some((page, Grab::Corner(left, top), origin));
+                consumed = true;
+            }
+            Some(Owner::Added { index, corner: None }) => {
+                cv.selected = Some((page, index));
+                cv.grab = Some((page, Grab::Move, origin));
+                consumed = true;
+            }
+            _ => {}
         }
         return consumed;
     }
diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index 224bc3f545..4ea80b1d6b 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -14,6 +14,7 @@ use pdfcraft_render::DocInfo;
 use crate::canvas::{DocView, PageToolContext, PageXform};
 use crate::page_cursor::Layer;
 use crate::page_pointer::PagePointer;
+use crate::page_router::{Hit, Owner, ParagraphPart};
 
 mod background;
 mod image;
@@ -21,7 +22,7 @@ mod layout;
 
 pub(crate) use background::TextBackground;
 pub use image::{CropMode, ImageSelection};
-pub(crate) use image::{ImageAction, ImageCx, image_input, image_owns_pointer};
+pub(crate) use image::{ImageAction, ImageCx, body_hit as picture_hit, handle_hit as picture_handle_hit, image_input};
 #[cfg(test)]
 use image::{rotate_knob, turn_degrees};
 #[cfg(test)]
@@ -233,8 +234,9 @@ pub struct BlockDrag {
 
 /// How far an edge grip reaches either side of a box's edge (screen pixels).
 const EDGE_REACH: f32 = 6.0;
-/// How far outside an open paragraph's frame the pointer still means the frame (screen pixels).
-const FRAME_REACH: f32 = 4.0;
+/// How far outside an open paragraph's frame the pointer still means the frame (screen pixels):
+/// the frame's Move cursor shows, and a press there takes hold of the box (`object_ui`).
+pub(crate) const FRAME_REACH: f32 = 6.0;
 
 /// The rewrap handles drawn on a paragraph box's left and right edges (screen).
 fn width_handles(b: Rect) -> [Rect; 2] {
@@ -277,11 +279,25 @@ fn has_edges(info: &DocInfo, page: usize) -> bool {
     info.pages.get(page).is_some_and(|p| p.rotation % 180 == 0)
 }
 
-/// Whether a press at `p` takes hold of the width handle of one of the paragraphs `rects` (user
-/// space). The handle is drawn half outside the box and grabs from a little further out still,
-/// where a press is not on the box itself, so area selection must leave it to [`page_input`].
-pub(crate) fn grabs_edge(xf: &PageXform, info: &DocInfo, page: usize, mut rects: impl Iterator<Item = [f64; 4]>, p: Pos2) -> bool {
-    has_edges(info, page) && rects.any(|r| edge_at(paragraph_box(xf, info, page, r), p).is_some())
+/// What of the paragraphs `lines` lies under `p` on `page`: the one hit test of Edit text's
+/// paragraphs, for the cursor and the press. A closed paragraph moves when dragged (the four-way
+/// arrow says so; a click still opens it for typing) and its edge rewraps it, from a little way
+/// outside the box (the handle is drawn half outside it, #2276); the open one takes the text
+/// cursor. `active` is the paragraph open for typing on this page.
+pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, lines: &[pdfcraft_engine::TextBlock], active: Option<usize>, p: Pos2) -> Option<Hit> {
+    if !xf.rect.contains(p) {
+        return None;
+    }
+    let boxes: Vec<Rect> = lines.iter().map(|l| paragraph_box(xf, info, page, l.rect)).collect();
+    let (block, grip) = grab_at(&boxes, p, has_edges(info, page))?;
+    let paragraph = |part| Owner::Paragraph { block, part };
+    Some(match (active, grip) {
+        (None, Grip::Left) => Hit::new(paragraph(ParagraphPart::Left), Layer::Handle, egui::CursorIcon::ResizeHorizontal),
+        (None, Grip::Right) => Hit::new(paragraph(ParagraphPart::Right), Layer::Handle, egui::CursorIcon::ResizeHorizontal),
+        (None, Grip::Move) => Hit::new(paragraph(ParagraphPart::Body), Layer::Text, egui::CursorIcon::Move),
+        (Some(open), _) if open == block => Hit::new(paragraph(ParagraphPart::Body), Layer::Editor, egui::CursorIcon::Text),
+        (Some(_), _) => Hit::new(paragraph(ParagraphPart::Body), Layer::Text, egui::CursorIcon::Text),
+    })
 }
 
 fn user_box(xf: &PageXform, info: &DocInfo, page: usize, r: Rect) -> [f64; 4] {
@@ -416,35 +432,37 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, lines: &[pdfcraft_engine::Text
         return true;
     }
     // Dragging a box (not while a paragraph is open for typing) moves it; from an edge, resizes it.
-    // What it grabs comes from where the button went down, not where the pointer is now: egui
+    // What it grabs is what the press was on ([`hit`]), not what is under the pointer now: egui
     // only calls it a drag once the pointer has moved a few pixels (or been held a moment), and a
     // quick flick has left the edge by then.
+    let owner = match view.router.owner(page) {
+        Some(Owner::Paragraph { block, part }) => Some((block, part)),
+        _ => None,
+    };
     if resp.drag_started()
         && active.is_none()
         && let Some(o) = ptr.origin
-        && let Some((block, grip)) = grab_at(&boxes, o, upright)
+        && let Some((block, part)) = owner
     {
+        let grip = match part {
+            ParagraphPart::Body => Grip::Move,
+            ParagraphPart::Left => Grip::Left,
+            ParagraphPart::Right => Grip::Right,
+        };
         view.block_drag = Some(BlockDrag { page, block, generation: doc.edit_generation(), start: o, grip });
         return true;
     }
     let Some(p) = ptr.within(xf.rect) else { return false };
-    let Some((hit, grip)) = grab_at(&boxes, p, upright) else { return false };
-    if active != Some(hit) {
-        painter.rect_stroke(boxes[hit], CornerRadius::same(2), Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+    // The paragraph under the pointer: outlined, with its width handles when closed.
+    let Some((hovered, _)) = grab_at(&boxes, p, upright) else { return false };
+    if active != Some(hovered) {
+        painter.rect_stroke(boxes[hovered], CornerRadius::same(2), Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
     }
-    let on_edge = active.is_none() && grip != Grip::Move;
     if upright && active.is_none() {
-        draw_handles(boxes[hit]);
-    }
-    // A closed paragraph moves when dragged (the four-way arrow says so; a click still opens it
-    // for typing); an edge rewraps it. The open one takes the text cursor.
-    if on_edge {
-        view.cursor.claim(Layer::Handle, egui::CursorIcon::ResizeHorizontal);
-    } else if active.is_none() {
-        view.cursor.claim(Layer::Text, egui::CursorIcon::Move);
-    } else {
-        view.cursor.claim(if active == Some(hit) { Layer::Editor } else { Layer::Text }, egui::CursorIcon::Text);
+        draw_handles(boxes[hovered]);
     }
+    // A click opens the paragraph the press was on.
+    let Some((hit, _)) = owner else { return true };
     if resp.clicked() {
         view.image_selection = None;
         // A click that moves the editor to another paragraph applies the open one first, so its
diff --git a/crates/ui-egui/src/tools/edit_text_ui/image.rs b/crates/ui-egui/src/tools/edit_text_ui/image.rs
index d9dbb59fa3..6956e656af 100644
--- a/crates/ui-egui/src/tools/edit_text_ui/image.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui/image.rs
@@ -1,5 +1,6 @@
 use super::{ACCENT, Color32, CornerRadius, DocInfo, DocView, Edit, MAX_OUTLINES, PagePointer, PageXform, Pos2, Rect, Stroke, user_box};
 use crate::page_cursor::Layer;
+use crate::page_router::{Hit, Owner, PicturePart};
 
 /// A selected page image, and what the pointer is doing to it.
 #[derive(Clone, Debug, PartialEq)]
@@ -229,19 +230,45 @@ fn stretched_picture(painter: &egui::Painter, xf: &PageXform, tex: egui::Texture
     clipped.add(egui::Shape::mesh(mesh));
 }
 
-/// Once a selected corner or the rotate knob is grabbed, text under it cannot take over the gesture. The same
-/// applies after the pointer leaves the image/page while dragging.
-pub(crate) fn image_owns_pointer(ui: &egui::Ui, xf: &PageXform, ptr: &PagePointer, page: usize, info: &DocInfo, view: &DocView) -> bool {
-    let Some(selection) = view.image_selection.as_ref().filter(|s| s.page == page) else { return false };
-    if selection.drag.is_some() {
-        return true;
+/// The selected picture's grips under `p`: its corners and its rotate knob. They are asked after
+/// the paragraphs, so text on top of a picture cannot take them; `clip` is the pages' visible
+/// area, which the knob stays inside.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn handle_hit(
+    clip: Rect,
+    xf: &PageXform,
+    page: usize,
+    info: &DocInfo,
+    images: &[pdfcraft_engine::PageImage],
+    view: &DocView,
+    p: Pos2,
+) -> Option<Hit> {
+    let s = view.image_selection.as_ref().filter(|s| s.page == page && s.crop.is_none())?;
+    let b = images.get(s.index)?.visible_rect.map(|r| xf.user_rect(info, page, r.map(|v| v as f32)))?;
+    let picture = |part| Owner::Picture { index: s.index, part };
+    if rotate_knob(b, clip).0.distance(p) < 8.0 {
+        return Some(Hit::new(picture(PicturePart::Knob), Layer::Handle, egui::CursorIcon::Grab));
     }
-    let Some(image) = view.edit_images.get(&page).and_then(|(_, images)| images.get(selection.index)) else { return false };
-    let Some(rect) = image.visible_rect else { return false };
-    let b = xf.user_rect(info, page, rect.map(|v| v as f32));
-    let p = if ptr.primary_down { ptr.origin } else { ptr.pos };
-    let knob = rotate_knob(b, ui.clip_rect()).0;
-    p.is_some_and(|p| [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom(), knob].iter().any(|c| c.distance(p) < 8.0))
+    let corner = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()].iter().position(|c| c.distance(p) < 8.0)?;
+    let icon = if matches!(corner, 0 | 3) { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw };
+    Some(Hit::new(picture(PicturePart::Corner(corner)), Layer::Handle, icon))
+}
+
+/// The picture under `p` (its shape, not only its box): a click selects it, a drag moves the
+/// selected one. On the text layer, asked before the paragraphs: editable text on top of a
+/// picture takes the press.
+pub(crate) fn body_hit(xf: &PageXform, page: usize, info: &DocInfo, images: &[pdfcraft_engine::PageImage], view: &DocView, p: Pos2) -> Option<Hit> {
+    if !xf.rect.contains(p) {
+        return None;
+    }
+    let (x, y) = xf.screen_to_view(p);
+    let user = info.pages.get(page)?.view_to_user(x, y).map(f64::from);
+    let index = images
+        .iter()
+        .rposition(|im| im.visible_rect.is_some_and(|r| xf.user_rect(info, page, r.map(|v| v as f32)).contains(p)) && im.contains(user))?;
+    let selected = view.image_selection.as_ref().is_some_and(|s| s.page == page && s.index == index);
+    let icon = if selected { egui::CursorIcon::Move } else { egui::CursorIcon::PointingHand };
+    Some(Hit::new(Owner::Picture { index, part: PicturePart::Body }, Layer::Text, icon))
 }
 
 /// What a right-click on a selected image asks for.
@@ -508,37 +535,28 @@ pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage
             painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
             draw_handles(painter, b);
         }
-        if allow_interaction && let Some(corner) = hover_pos.and_then(|p| corners.iter().position(|c| c.distance(p) < 8.0)) {
-            view.cursor.claim(Layer::Handle, if matches!(corner, 0 | 3) { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw });
-        }
         // The rotate handle: a knob above the top edge, joined to it by a short stem.
         let (knob, stem) = rotate_knob(b, ui.clip_rect());
         if view.image_selection.as_ref().is_some_and(|s| s.drag.is_none()) {
             painter.line_segment([stem, knob], Stroke::new(1.0, ACCENT));
             painter.circle(knob, 5.0, Color32::WHITE, Stroke::new(1.0, ACCENT));
-            if allow_interaction && hover_pos.is_some_and(|p| p.distance(knob) < 8.0) {
-                view.cursor.claim(Layer::Handle, egui::CursorIcon::Grab);
-            }
         }
+        // A drag on what the press was on ([`handle_hit`], [`body_hit`]): the knob turns the
+        // picture, a corner resizes it from the opposite one, the picture itself moves.
         if allow_interaction
             && resp.drag_started()
             && let Some(o) = ptr.origin
-            && o.distance(knob) < 8.0
+            && let Some(Owner::Picture { index, part }) = view.router.owner(page)
+            && index == i
+            && let Some(s) = view.image_selection.as_mut()
         {
-            if let Some(s) = view.image_selection.as_mut() {
-                s.drag = Some((o, None));
-                s.turning = true;
-            }
-        } else if allow_interaction
-            && resp.drag_started()
-            && let Some(o) = ptr.origin
-        {
-            let corner = corners.iter().position(|c| c.distance(o) < 8.0);
-            if corner.is_some() || image_contains(i, o) {
-                let opposite = corner.map(|k| corners[3 - k]);
-                if let Some(s) = view.image_selection.as_mut() {
-                    s.drag = Some((o, opposite));
+            match part {
+                PicturePart::Knob => {
+                    s.drag = Some((o, None));
+                    s.turning = true;
                 }
+                PicturePart::Corner(k) => s.drag = Some((o, 3usize.checked_sub(k).and_then(|opposite| corners.get(opposite)).copied())),
+                PicturePart::Body => s.drag = Some((o, None)),
             }
         }
         if view.image_selection.as_ref().is_some_and(|s| s.turning) {
@@ -584,17 +602,13 @@ pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage
     if selected != Some(hit) {
         painter.rect_stroke(boxes[hit], CornerRadius::ZERO, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)), egui::StrokeKind::Outside);
     }
-    let Some(b) = boxes.get(hit).copied() else { return false };
-    let corner = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()].iter().position(|c| c.distance(p) < 8.0);
-    match (selected == Some(hit), corner) {
-        (true, Some(0 | 3)) => view.cursor.claim(Layer::Handle, egui::CursorIcon::ResizeNwSe),
-        (true, Some(_)) => view.cursor.claim(Layer::Handle, egui::CursorIcon::ResizeNeSw),
-        (true, None) => view.cursor.claim(Layer::Placed, egui::CursorIcon::Move),
-        // A click selects it.
-        _ => view.cursor.claim(Layer::Placed, egui::CursorIcon::PointingHand),
-    }
-    if resp.clicked() || resp.secondary_clicked() {
-        view.image_selection = Some(ImageSelection { page, index: hit, drag: None, crop: None, turning: false, settled: None });
+    // A click selects the picture the press was on; a right-click the one under the pointer.
+    let clicked = match view.router.owner(page) {
+        Some(Owner::Picture { index, .. }) if resp.clicked() => Some(index),
+        _ => resp.secondary_clicked().then_some(hit),
+    };
+    if let Some(index) = clicked {
+        view.image_selection = Some(ImageSelection { page, index, drag: None, crop: None, turning: false, settled: None });
     }
     if resp.secondary_clicked() {
         ui.ctx().data_mut(|d| d.insert_temp(menu_key, true));
diff --git a/crates/ui-egui/src/tools/object_ui.rs b/crates/ui-egui/src/tools/object_ui.rs
index 96cc0adf25..db3982cd28 100644
--- a/crates/ui-egui/src/tools/object_ui.rs
+++ b/crates/ui-egui/src/tools/object_ui.rs
@@ -9,6 +9,7 @@ use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageToolContext, PageXform};
 use crate::page_cursor::Layer;
+use crate::page_router::{Hit, ObjectsPart, Owner};
 
 const BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
 
@@ -161,6 +162,19 @@ fn leave_single(view: &mut DocView) {
     view.block_drag = None;
 }
 
+/// What of the objects lies under `p` on `page`: the objects selected together (a drag moves
+/// them), or the frame around the paragraph open for typing (`open`: its box on screen), which
+/// takes hold of the box as in Acrobat: a click selects it, a drag moves it, its text keeps the
+/// caret.
+pub(crate) fn hit(view: &DocView, xf: &PageXform, info: &DocInfo, page: usize, open: Option<Rect>, p: Pos2) -> Option<Hit> {
+    let s = &view.objects;
+    if s.page == Some(page) && !s.selected.is_empty() && s.selected.iter().fold(Rect::NOTHING, |r, o| r.union(screen(xf, info, page, o))).contains(p)
+    {
+        return Some(Hit::new(Owner::Objects { part: ObjectsPart::Selection }, Layer::Placed, egui::CursorIcon::Move));
+    }
+    open.filter(|r| on_frame(r.shrink(2.0), p)).map(|_| Hit::new(Owner::Objects { part: ObjectsPart::Frame }, Layer::Handle, egui::CursorIcon::Move))
+}
+
 /// Returns true while group selection owns the interaction. Ordinary clicks still reach the
 /// single-object text/resize tools. A text draft is finished or discarded through its editor.
 pub(crate) fn page_input(cx: PageToolContext<'_>, view: &mut DocView) -> bool {
@@ -246,14 +260,7 @@ fn input(s: &mut ObjectSelection, cx: PageToolContext<'_>, view: &mut DocView) -
         return s.page == Some(page) && !s.selected.is_empty();
     };
     if !pressed {
-        if s.page == Some(page) && !s.selected.is_empty() {
-            let union = s.selected.iter().fold(Rect::NOTHING, |r, o| r.union(screen(xf, info, page, o)));
-            if union.contains(p) {
-                view.cursor.claim(Layer::Placed, egui::CursorIcon::Move);
-            }
-            return true;
-        }
-        return false;
+        return s.page == Some(page) && !s.selected.is_empty();
     }
     let objects = match s.inventory(doc, page) {
         Ok(objects) => objects,
@@ -296,18 +303,16 @@ fn input(s: &mut ObjectSelection, cx: PageToolContext<'_>, view: &mut DocView) -
         view.current = page;
         return true;
     }
-    if s.page == Some(page) && !s.selected.is_empty() {
-        let union = s.selected.iter().fold(Rect::NOTHING, |r, o| r.union(screen(xf, info, page, o)));
-        if union.contains(p) && !resp.double_clicked() {
-            s.gesture = Some(Gesture { start: p, now: p, marquee: false, additive: false });
-            return true;
-        }
+    // What the press was on ([`hit`]): the selection moves; the frame of the paragraph open for
+    // typing selects its box (for the arrow keys) and moves it.
+    let owner = view.router.owner(page);
+    if owner == Some(Owner::Objects { part: ObjectsPart::Selection }) && !resp.double_clicked() {
+        s.gesture = Some(Gesture { start: p, now: p, marquee: false, additive: false });
+        return true;
     }
-    // The frame of the paragraph open for typing takes hold of the box, as in Acrobat: a click
-    // selects it (for the arrow keys), a drag moves it. Its text keeps the caret.
-    if let Some(block) = view.line_editor.as_ref().filter(|e| e.page == page && !e.has_changes()).map(|e| e.block)
+    if owner == Some(Owner::Objects { part: ObjectsPart::Frame })
+        && let Some(block) = view.line_editor.as_ref().filter(|e| e.page == page && !e.has_changes()).map(|e| e.block)
         && let Some(object) = objects.iter().find(|o| o.target == ObjectTarget { kind: ObjectKind::Text, index: block })
-        && on_frame(screen(xf, info, page, object), p)
     {
         s.clear();
         s.page = Some(page);
@@ -318,11 +323,9 @@ fn input(s: &mut ObjectSelection, cx: PageToolContext<'_>, view: &mut DocView) -
         return true;
     }
     s.clear();
-    // A closed paragraph's width handle reaches past its box, and a press there rewraps the
-    // paragraph (as in `edit_text_ui`) instead of starting an area selection (#2276).
-    let on_edge = view.line_editor.as_ref().is_none_or(|e| e.page != page)
-        && crate::edit_text_ui::grabs_edge(xf, info, page, objects.iter().filter(|o| o.target.kind == ObjectKind::Text).map(|o| o.rect), p);
-    if hit.is_some() || on_edge {
+    // A press on something (a paragraph, its edge reaching past its box #2276, a picture, added
+    // content) is its own; only one on the empty page starts an area selection.
+    if hit.is_some() || view.router.owner(page).is_some() {
         return false;
     }
     leave_single(view);
@@ -335,12 +338,9 @@ fn input(s: &mut ObjectSelection, cx: PageToolContext<'_>, view: &mut DocView) -
 /// Whether `p` is on the frame drawn around a paragraph open for typing (`r`, screen): just
 /// outside the text, where a press would otherwise close the paragraph.
 fn on_frame(r: Rect, p: Pos2) -> bool {
-    r.expand(2.0 + FRAME_REACH).contains(p) && !r.expand(2.0).contains(p)
+    r.expand(2.0 + crate::edit_text_ui::FRAME_REACH).contains(p) && !r.expand(2.0).contains(p)
 }
 
-/// How far outside a paragraph's frame a press still grabs it (screen pixels).
-const FRAME_REACH: f32 = 6.0;
-
 /// The arrow keys move the selected image or objects a point, Shift and an arrow ten points,
 /// as in Acrobat. They are taken before the view turns the page with them.
 pub(crate) fn nudge_keys(ctx: &egui::Context, view: &mut DocView, doc: &Document) {
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 0d44f91067..f247eb59b0 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -4334,6 +4334,29 @@ fn an_open_paragraph_moves_by_its_frame_and_by_the_arrow_keys() {
     assert_eq!(h.state().session.get(id).unwrap().text_lines(0).len(), 1, "moved, not retyped");
 }
 
+/// The open paragraph's frame shows the Move cursor as far out as a press there takes hold of the
+/// box: the cursor reached 4 px past the frame, the press 6.
+#[test]
+fn an_open_paragraphs_frame_shows_move_wherever_a_press_takes_the_box() {
+    let mut h = harness(2, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let before = h.state().session.get(id).unwrap().text_blocks(0)[0].clone();
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 200.0;
+    let screen = |x: f64, y: f64| egui::pos2(r.left() + x as f32 * k, r.top() + (300.0 - y as f32) * k);
+    click_at(&mut h, screen((before.rect[0] + before.rect[2]) / 2.0, (before.rect[1] + before.rect[3]) / 2.0));
+    assert!(h.state().views[0].line_editor.is_some(), "a click on the text opens it for typing");
+    // 7 px above the text: 5 px past the frame drawn 2 px out.
+    let far = screen((before.rect[0] + before.rect[2]) / 2.0, before.rect[3]) - egui::vec2(0.0, 7.0);
+    h.hover_at(far);
+    h.run_steps(3);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Move, "the frame offers to move the box there");
+    click_at(&mut h, far);
+    assert!(h.state().views[0].line_editor.is_none(), "and a click there selects the box");
+}
+
 /// Contributor-original text, with an off-origin CropBox. Keep the moving paragraph last in
 /// source order so an ordinary hit picks it again when two independent boxes fully overlap.
 fn paragraph_drag_fixture(content: &str, rotation: i64, unit: i64) -> Vec<u8> {
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index b110041986..397d6316f8 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -405,7 +405,6 @@ fn narrow_from_left(dx: f32) -> (egui::CursorIcon, usize) {
 }
 
 #[test]
-#[ignore = "step 3 of the page pointer router: one hit test"]
 fn a_paragraph_edge_resizes_wherever_it_shows_the_resize_cursor() {
     let (inside_cursor, inside_lines) = narrow_from_left(1.0);
     assert_eq!(inside_cursor, egui::CursorIcon::ResizeHorizontal);

From bcc71601d48126223ee5e84811436ac7ca36ca47 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 12:53:44 +0100
Subject: [PATCH 066/132] docs: page modules decide a press by one hit test and
 act on the router's owner

A "Page presses" non-negotiable in CLAUDE.md, beside "Page input" and "Page cursor": a page
module decides what of its own is under a point in one hit test (a Hit from
canvas/page_router.rs) that gives its cursor, its tip and its press, and acts on a press only
when the router says it is its own, never by testing the press point again or by asking
another module; Escape cancels any press the pages hold.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CLAUDE.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CLAUDE.md b/CLAUDE.md
index cd1b5b284a..c47674135c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -23,6 +23,7 @@ PdfCraft is a clean-room, open-source, Rust-native PDF application targeting Ado
 - **Layering.** Nothing below L7 depends on egui/winit/eframe/rfd (`plan/architecture.md` §3). `cos`/`filters`/`crypt`/`arlington` stay standalone.
 - **Page input.** Page modules read `PagePointer` (`crates/ui-egui/src/page_pointer.rs`), never egui's raw pointer state (`hover_pos`, `interact_pos`, `latest_pos`, `press_origin`, button reads); `page_pointer::tests::page_modules_read_the_pointer_only_through_page_pointer` enforces it.
 - **Page cursor.** Page modules claim the cursor for what is under the pointer (`view.cursor.claim(Layer::…, icon)`, `crates/ui-egui/src/canvas/page_cursor.rs`), never set it (`set_cursor_icon`, `cursor_icon =`, `on_hover_cursor`); `document_area` sets it once, from the claim on the highest layer the active tool reaches. `page_pointer::tests::page_modules_claim_the_cursor_and_never_set_it` enforces it.
+- **Page presses.** A page module decides what of its own is under a point in one hit test, which returns a `Hit` (owner, layer, cursor, tip; `crates/ui-egui/src/canvas/page_router.rs`) and gives its cursor, its tip and its press. It acts on a press only when the router says the press is its own (`view.router.owner(page)`), never by testing the press point again or by asking another module whether it wants it. Escape cancels any press the pages hold (`cancel_on_escape`), and that press is ignored until the button is up.
 - **Fidelity.** The PDF object graph is the model. Preserve unknown data. Saves are incremental unless a full rewrite is required. Never silently drop or repair data without recording it.
 - **Never panic.** Every PDF, script, MCP call, settings file and keystroke is untrusted input, and none of it may crash the app or lose the user's work. This outranks feature work. Return `Result` (the crate's error enum) and propagate with `?`, or fall back leniently and record it. In non-test code:
   - No `unwrap`/`expect`/`panic!`/`unreachable!`/`todo!` unless it is provably infallible, with a comment saying why.

From 4b3033c86942e0850ad888172a684fec543c12e4 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 13:55:29 +0100
Subject: [PATCH 067/132] fix(ui): review fixes for the page router: Escape on
 text drags, the open frame's sides, a stale owner

From a review of this branch:
- Escape mid-drag with a text markup tool (Highlight, Underline, Strikeout, Squiggly, Replace
  Text) or Redact over text left the half-made selection on the page: the cancel took the Escape
  that would have cleared it. It is dropped now. The marks made from a selection at its end
  (after the page tools, which the release blocking did not reach) also wait for a cancelled
  press's button; egui ends its own drag on Escape without a drag stop, so they were not made
  in practice, but nothing but egui stopped them.
- The open paragraph's frame took the press above and below the text only: its sides still gave
  edge grips (a closed paragraph's rewrap handles) on the Editor layer, over the frame. Edges now
  belong to closed paragraphs only.
- A press in the frame right after a release kept the last press's owner until a page claimed
  it, so a drag from the margin beside a page could move the comment just clicked. A new press
  now drops the last owner before the pages give it theirs.
- A release and a new press in one frame no longer leave the new press cancelled.
- Added content is picked up with the tools that act on it (Select, Add text, Edit text), not with
  every tool while Edit a PDF is open.
- The layer docs in page_cursor.rs say what lies on each layer now.

New tests an_open_paragraphs_frame_takes_the_box_beside_its_text and
a_drag_from_beside_the_page_right_after_a_click_leaves_the_comment_alone (the release and the
next press in one frame) fail on the previous commit. escape_cancels_a_highlight_being_dragged_over_text
(with a control: the drag highlights without Escape) passes there too, for the reason above, and
stays as a guard.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs             | 27 ++++++++++---
 crates/ui-egui/src/canvas/page_cursor.rs | 18 +++++----
 crates/ui-egui/src/tools/edit_text_ui.rs |  3 +-
 crates/ui-egui/tests/it/editing.rs       | 24 +++++++++++
 crates/ui-egui/tests/it/pointer.rs       | 51 ++++++++++++++++++++++++
 5 files changed, 109 insertions(+), 14 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index b96364cb56..f843a2ca6c 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1444,7 +1444,8 @@ impl PageHits<'_> {
         };
         // Added text and pictures, over the page's own paragraphs and under the objects selected
         // together.
-        let added = (editing_content && can_modify).then(|| crate::content_ui::hit(xf, info, page, added, view, p)).flatten();
+        let picks_up = matches!(tool, QuickTool::Select | QuickTool::AddText | QuickTool::EditText);
+        let added = (editing_content && can_modify && picks_up).then(|| crate::content_ui::hit(xf, info, page, added, view, p)).flatten();
         [link_hit(info, xf, page, p), comments::hit(pcx, view, p), pictures, paragraphs, added, objects, grips, fields]
             .into_iter()
             .flatten()
@@ -1688,9 +1689,12 @@ fn page_overlays(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_
     }
     crate::image_pick::drop_stale(doc, view);
     crate::image_pick::paint(painter, &xf, i, info, view);
-    comments::page_after_text(resp, &pcx, view);
-    if tool == QuickTool::Redact && can_modify {
-        crate::redact_ui::after_text(resp, i, info, view);
+    // A cancelled press ends no selection: no markup or redaction is made from it.
+    if !view.press_cancelled {
+        comments::page_after_text(resp, &pcx, view);
+        if tool == QuickTool::Redact && can_modify {
+            crate::redact_ui::after_text(resp, i, info, view);
+        }
     }
     if input.area_tool {
         crate::redact_ui::paint(painter, i, view, pointer);
@@ -1892,11 +1896,19 @@ fn link_hit(info: &DocInfo, xf: &PageXform, page: usize, p: Pos2) -> Option<crat
 /// placed, drawn, moved, resized or opened, and the press is ignored until the button is up. The
 /// frame of the release still belongs to the cancelled press.
 fn cancel_on_escape(ctx: &egui::Context, view: &mut DocView, ptr: &PagePointer) {
-    if view.press_cancelled && !ptr.any_down && ptr.edges.is_empty() {
+    // Over once the button is up and its release seen, or when a new press comes (its release and
+    // the next press can share a frame).
+    let new_press = matches!(ptr.edges.last(), Some(crate::page_pointer::Edge::Press(_)));
+    if view.press_cancelled && (new_press || !ptr.any_down && ptr.edges.is_empty()) {
         view.press_cancelled = false;
     }
     if !view.press_cancelled && ptr.origin.is_some() && ptr.primary_down && ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape))
     {
+        // A text selection being dragged goes with its drag: the markup, redaction or Replace
+        // Text that its end would make is not made.
+        if view.selection_drag {
+            view.clear_selection();
+        }
         view.cancel_pointer_gestures();
         view.press_cancelled = true;
     }
@@ -1983,6 +1995,11 @@ fn draw_pages(
     let ptr = PagePointer::read(ui, &resp, modal);
     cancel_on_escape(ui.ctx(), view, &ptr);
     view.router.settle(ptr.any_down, !ptr.edges.is_empty());
+    // A new press is no longer the last one's, wherever it lands (the page it is on gives it
+    // its owner; in the gap between pages it has none).
+    if ptr.pressed().is_some() {
+        view.router.cancel();
+    }
     let pointer = ptr.pos;
     // A press on a page makes it the current one (as in Acrobat), so a page command with
     // no selection (Rotate, Delete) acts on the page the reader pointed at, not on a page
diff --git a/crates/ui-egui/src/canvas/page_cursor.rs b/crates/ui-egui/src/canvas/page_cursor.rs
index 382f5efb63..e40dc1c4f3 100644
--- a/crates/ui-egui/src/canvas/page_cursor.rs
+++ b/crates/ui-egui/src/canvas/page_cursor.rs
@@ -20,18 +20,19 @@ use crate::QuickTool;
 pub(crate) enum Layer {
     /// The page under the active tool: the crosshair it places or draws with, its I-beam or hand.
     ToolArea,
-    /// The page's text, to select, and Edit text's paragraphs.
+    /// The page's text, to select; Edit text's paragraphs, and its pictures beneath them.
     Text,
     /// Links.
     Link,
-    /// Comments: notes, shapes and markup.
+    /// Text markup (highlights, underlines…), which lies on the text: under a form field.
     Comment,
     /// Form fields.
     Field,
-    /// What a drag moves whole: signatures and Fill & Sign's marks, added text and images,
-    /// selected objects, pictures in Edit text.
+    /// What a drag moves whole: notes, shapes, signatures and Fill & Sign's marks, added text and
+    /// pictures, the objects selected together, Prepare's fields.
     Placed,
-    /// The grips of the selected item: resize, rewrap and crop handles, paragraph edges.
+    /// The grips of the selected item: resize, rewrap, rotate and crop handles, paragraph edges,
+    /// the frame of the paragraph open for typing.
     Handle,
     /// An open editor: a paragraph being typed in, a picture being cropped.
     Editor,
@@ -45,9 +46,10 @@ const LAYERS: [Layer; 9] =
 
 impl Layer {
     /// Whether a press with `tool` acts on what lies on this layer, so that the layer's claims
-    /// count. Only the Select tool follows links (the Link tool edits them) and picks up
-    /// comments: every other tool draws, places or selects text over them. The other layers are
-    /// claimed only by the modules of the tools that act on them, so they count for every tool.
+    /// count. Only the Select tool follows links (the Link tool edits them) and selects text
+    /// markup: every other tool draws, places or selects text over them. The other layers are
+    /// claimed only by the modules of the tools that act on them (each module's hit test filters
+    /// by tool), so they count for every tool.
     pub(crate) fn reached_by(self, tool: QuickTool) -> bool {
         match self {
             Layer::Link => matches!(tool, QuickTool::Select | QuickTool::Link),
diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index 4ea80b1d6b..6ec31b0015 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -289,7 +289,8 @@ pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, lines: &[pdfcraft
         return None;
     }
     let boxes: Vec<Rect> = lines.iter().map(|l| paragraph_box(xf, info, page, l.rect)).collect();
-    let (block, grip) = grab_at(&boxes, p, has_edges(info, page))?;
+    // Edges rewrap closed paragraphs only: around the open one lies its frame (`object_ui`).
+    let (block, grip) = grab_at(&boxes, p, has_edges(info, page) && active.is_none())?;
     let paragraph = |part| Owner::Paragraph { block, part };
     Some(match (active, grip) {
         (None, Grip::Left) => Hit::new(paragraph(ParagraphPart::Left), Layer::Handle, egui::CursorIcon::ResizeHorizontal),
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index f247eb59b0..be5413b49c 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -4357,6 +4357,30 @@ fn an_open_paragraphs_frame_shows_move_wherever_a_press_takes_the_box() {
     assert!(h.state().views[0].line_editor.is_none(), "and a click there selects the box");
 }
 
+/// The open paragraph's frame takes hold of the box on its sides too: there the edges of a closed
+/// paragraph would rewrap it, but around the open one lies its frame.
+#[test]
+fn an_open_paragraphs_frame_takes_the_box_beside_its_text() {
+    let mut h = harness(2, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let before = h.state().session.get(id).unwrap().text_blocks(0)[0].clone();
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 200.0;
+    let screen = |x: f64, y: f64| egui::pos2(r.left() + x as f32 * k, r.top() + (300.0 - y as f32) * k);
+    let middle = (before.rect[1] + before.rect[3]) / 2.0;
+    click_at(&mut h, screen((before.rect[0] + before.rect[2]) / 2.0, middle));
+    assert!(h.state().views[0].line_editor.is_some(), "a click on the text opens it for typing");
+    // 6 px left of the text: 4 px past the frame drawn 2 px out.
+    let beside = screen(before.rect[0], middle) - egui::vec2(6.0, 0.0);
+    h.hover_at(beside);
+    h.run_steps(3);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Move, "the frame offers to move the box there");
+    click_at(&mut h, beside);
+    assert!(h.state().views[0].line_editor.is_none(), "and a click there selects the box");
+}
+
 /// Contributor-original text, with an off-origin CropBox. Keep the moving paragraph last in
 /// source order so an ordinary hit picks it again when two independent boxes fully overlap.
 fn paragraph_drag_fixture(content: &str, rotation: i64, unit: i64) -> Vec<u8> {
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index 397d6316f8..0d058cb458 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -802,6 +802,57 @@ fn escape_cancels_a_signature_rectangle() {
     assert!(s.dialog.is_none(), "and no signing dialog opens: {:?}", s.dialog);
 }
 
+/// A highlight dragged over the line of [`text_pdf`] at 150 %, from x 45 to x 150, with Escape
+/// before the release when `escape`; the comments then on the page.
+fn drag_a_highlight(escape: bool) -> usize {
+    let mut h = open(text_pdf(), "150", false);
+    h.state_mut().quick_tool = QuickTool::Comment(CommentTool::Highlight);
+    h.run_steps(4);
+    let (a, b) = (at(&h, 45.0, 303.0), at(&h, 150.0, 303.0));
+    assert_eq!(wait_for_cursor(&mut h, a, |c| c == egui::CursorIcon::Text), egui::CursorIcon::Text, "the page's text has arrived");
+    h.drag_at(a);
+    h.run_steps(1);
+    h.hover_at(b);
+    h.run_steps(2);
+    if escape {
+        h.key_press(egui::Key::Escape);
+        h.run_steps(1);
+    }
+    h.drop_at(b);
+    h.run_steps(4);
+    let s = h.state();
+    s.session.get(s.views[0].id).unwrap().info.annotations.len()
+}
+
+/// Escape mid-drag abandons a highlight being drawn over text: the release makes no highlight.
+#[test]
+fn escape_cancels_a_highlight_being_dragged_over_text() {
+    assert_eq!(drag_a_highlight(false), 1, "control: the drag highlights the text");
+    assert_eq!(drag_a_highlight(true), 0, "with Escape before the release, no highlight is made");
+}
+
+/// A click on a comment, and in the frame of its release a press beside the page, then a drag
+/// from there: the drag is not the comment's, so it does not move it.
+#[test]
+fn a_drag_from_beside_the_page_right_after_a_click_leaves_the_comment_alone() {
+    let mut h = open(comment_on_text_pdf(), "150", false);
+    let on_comment = at(&h, 120.0, 315.0);
+    let beside = page(&h).left_center() - egui::vec2(20.0, 0.0);
+    let before = square(&h).expect("the rectangle");
+    h.hover_at(on_comment);
+    h.run_steps(1);
+    h.drag_at(on_comment);
+    h.run_steps(1);
+    let button = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE };
+    one_frame(&mut h, [button(on_comment, false), egui::Event::PointerMoved(beside), button(beside, true)]);
+    h.run_steps(1);
+    h.hover_at(beside + egui::vec2(0.0, 60.0));
+    h.run_steps(2);
+    h.drop_at(beside + egui::vec2(0.0, 60.0));
+    h.run_steps(4);
+    assert_eq!(square(&h), Some(before), "the comment stays where it was");
+}
+
 /// Only the primary button draws a signature rectangle: a right-drag opens no signing dialog.
 #[test]
 fn a_right_drag_draws_no_signature_rectangle() {

From adeb9c1cf2336c10639d8172325e708edf515856 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 14:22:11 +0100
Subject: [PATCH 068/132] fix(comments): Undo and Redo close the panel's inline
 editor

A delete moves the panel's inline editor along with its comment or reply,
but Undo and Redo cleared only the selection. Either can put annotations
back or take them away, so the editor stayed keyed to an index that could
now be another reply: with B's editor open, delete reply A, Undo, and Save
wrote B's draft over A. history_step now closes the editor (and its
unsaved text) with the selection. Found by FredApps in review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ROADMAP.md                                 |  2 +-
 crates/ui-egui/src/editing.rs              |  2 +-
 crates/ui-egui/src/tools/comments/state.rs | 10 ++++
 crates/ui-egui/tests/it/comments.rs        | 65 ++++++++++++++++++++++
 parity/acrobat-features.toml               |  4 +-
 5 files changed, 79 insertions(+), 4 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 7708f1ae04..6f580f6097 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -201,7 +201,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 ## Progress log
 
 - **2026-10-27 (M10, OCR models):** Model staging downloads and verifies the ONNX pair after the upstream RTEN URL brownout; runtime discovery prefers complete ONNX pairs per directory, retains complete RTEN fallback and preserves directory precedence.
-- **2026-10-25 (M5, comment replies):** One reply can be deleted from the Comments panel without its thread. On the selected card each reply has its own "…" menu (Edit, Copy text, Delete); Delete takes that reply with its pop-up and the replies to it, as `comment_delete` already did headlessly, and the comment and its other replies stay. The card stays selected, and the panel's editor stays open, on what they were on though the delete moved it in `/Annots`. A locked reply can't be deleted. Estimates unchanged.
+- **2026-10-25 (M5, comment replies):** One reply can be deleted from the Comments panel without its thread. On the selected card each reply has its own "…" menu (Edit, Copy text, Delete); Delete takes that reply with its pop-up and the replies to it, as `comment_delete` already did headlessly, and the comment and its other replies stay. The card stays selected, and the panel's editor stays open, on what they were on though the delete moved it in `/Annots`. Undo and Redo close the editor, since either can move what it was open on. A locked reply can't be deleted. Estimates unchanged.
 - **2026-10-24 (M10, #4158 partial):** Word, HTML, RTF and PowerPoint export keep a block that continues another on its line (an italic case name, a link, a superscript) as a run in its own style inside that paragraph, with the source's word space, instead of a paragraph of its own. Style changes that wrap onto the next line still split paragraphs (the reading blocks keep style boundaries). Estimates unchanged.
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 1ee4c7a6f6..7e5ea8ed6f 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -232,7 +232,7 @@ impl PdfCraftApp {
                 if let Some(doc) = self.session.get(id) {
                     self.views[i].document_changed(&doc.info);
                 }
-                self.views[i].comments.selected = None;
+                self.views[i].comments.history_stepped();
                 let label = crate::i18n::edit_label(&label);
                 if undo {
                     self.notify_fmt("Undid {label}", &[("label", &label)]);
diff --git a/crates/ui-egui/src/tools/comments/state.rs b/crates/ui-egui/src/tools/comments/state.rs
index db45041906..a886e2dfd7 100644
--- a/crates/ui-egui/src/tools/comments/state.rs
+++ b/crates/ui-egui/src/tools/comments/state.rs
@@ -230,6 +230,16 @@ impl CommentView {
             self.editor_focus = None;
         }
     }
+
+    /// Undo or Redo just ran. Either may have put annotations back or taken them away, on any
+    /// page, so a (page, index) held here may now name another one. The selection and the inline
+    /// editor close, its unsaved text with it, rather than Save writing that text over whatever
+    /// took its place.
+    pub(crate) fn history_stepped(&mut self) {
+        self.selected = None;
+        self.editing = None;
+        self.editor_focus = None;
+    }
 }
 
 /// Where the annotation at `keep` is once the one at `gone` was deleted, or `None` when it went
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 2fcc2299d1..70326c2f30 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -1426,6 +1426,71 @@ fn one_reply_is_deleted_from_its_menu_and_the_thread_stays() {
     h.get_by_label("Wrong reply");
 }
 
+// Contributor-original PDF: a comment and its replies A, B and C, in that `/Annots` order.
+const THREE_REPLIES: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Annots [4 0 R 5 0 R 6 0 R 7 0 R] >> endobj
+4 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (note) /T (Ben) /Contents (The comment) >> endobj
+5 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (a) /IRT 4 0 R /T (Cat) /Contents (Reply A) >> endobj
+6 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (b) /IRT 4 0 R /T (Dan) /Contents (Reply B) >> endobj
+7 0 obj << /Type /Annot /Subtype /Text /Rect [20 140 40 160] /NM (c) /IRT 4 0 R /T (Eve) /Contents (Reply C) >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+/// Opens the inline editor on the reply that shows `text`, from its "…" menu, and types `draft`
+/// into it without saving.
+fn draft_reply(h: &mut Harness<'static, PdfCraftApp>, text: &str, draft: &str) {
+    reply_options(h, text).click();
+    h.run_steps(2);
+    h.query_all_by_label("Edit").last().expect("the reply menu's Edit, after the toolbar tab").click();
+    h.run_steps(2);
+    let editor = h.query_all_by(|n| n.role() == Role::MultilineTextInput && n.placeholder() != Some("Add a reply")).next().expect("reply editor");
+    editor.click();
+    h.run_steps(1);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+    h.event(egui::Event::Text(draft.into()));
+    h.run_steps(2);
+}
+
+/// A reply's inline editor, left open with a draft, closes on Undo and on Redo. Either can put
+/// a reply back in its place or take one away, and the editor would have saved the draft over
+/// whichever reply took that place: reply A after delete → Undo, reply C after Redo.
+#[test]
+fn undo_and_redo_close_a_reply_editor_left_open() {
+    let mut h = harness_with_bytes(THREE_REPLIES.to_vec(), |app| {
+        app.set_option("panel", "comments").unwrap();
+        app.views[0].comments.selected = Some((0, 0));
+    });
+    let texts = |h: &Harness<'static, PdfCraftApp>| -> Vec<String> { comments(h).iter().filter_map(|a| a.contents.clone()).collect() };
+    let all = ["The comment", "Reply A", "Reply B", "Reply C"];
+    assert_eq!(texts(&h), all);
+
+    draft_reply(&mut h, "Reply B", "B's draft");
+    reply_options(&h, "Reply A").click();
+    h.run_steps(2);
+    h.get_by_label("Delete").click();
+    h.run_steps(3);
+    assert_eq!(texts(&h), ["The comment", "Reply B", "Reply C"]);
+    assert_eq!(h.state().views[0].comments.editing, Some((0, 1, "B's draft".to_string())), "the editor follows B up");
+
+    h.state_mut().undo();
+    h.run_steps(3);
+    assert_eq!(texts(&h), all, "undo puts A back where B's editor now points");
+    assert_eq!(h.state().views[0].comments.editing, None, "the editor closes on undo");
+    assert_eq!(h.query_all_by_label("Save").count(), 0, "no draft is left to save over A");
+
+    h.state_mut().views[0].comments.selected = Some((0, 0));
+    h.run_steps(2);
+    draft_reply(&mut h, "Reply B", "B's draft");
+    assert_eq!(h.state().views[0].comments.editing, Some((0, 2, "B's draft".to_string())));
+    h.state_mut().redo();
+    h.run_steps(3);
+    assert_eq!(texts(&h), ["The comment", "Reply B", "Reply C"], "redo deletes A again, and C takes B's place");
+    assert_eq!(h.state().views[0].comments.editing, None, "the editor closes on redo");
+    assert_eq!(h.query_all_by_label("Save").count(), 0, "no draft is left to save over C");
+}
+
 #[test]
 fn the_header_names_no_replies_when_there_are_none() {
     let h = harness_with_bytes(PER_PAGE_NAMES.to_vec(), |app| {
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 52d6fa0c72..f7e95de61d 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -4051,8 +4051,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_edit"]
-evidence = ["crates/annot/src/tests.rs::text_box_text_and_colour_changes_are_drawn", "crates/annot/src/tests.rs::editing_a_text_box_refits_its_rectangle", "crates/automation/tests/it/automation.rs::comments_through_tools", "crates/ui-egui/tests/it/comments.rs::ctrl_enter_posts_a_highlight_comment_and_shift_enter_adds_a_line", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays"]
-notes = "double-click a comment or card, or Edit in the menus (a reply from its own \"…\" menu); Ctrl+Enter (also Command+Enter) saves text in the focused comment editor, Shift+Enter adds a newline; a text box's rectangle follows the new text (wrap width and top edge stay, the height fits the wrapped lines)"
+evidence = ["crates/annot/src/tests.rs::text_box_text_and_colour_changes_are_drawn", "crates/annot/src/tests.rs::editing_a_text_box_refits_its_rectangle", "crates/automation/tests/it/automation.rs::comments_through_tools", "crates/ui-egui/tests/it/comments.rs::ctrl_enter_posts_a_highlight_comment_and_shift_enter_adds_a_line", "crates/ui-egui/tests/it/comments.rs::one_reply_is_deleted_from_its_menu_and_the_thread_stays", "crates/ui-egui/tests/it/comments.rs::undo_and_redo_close_a_reply_editor_left_open"]
+notes = "double-click a comment or card, or Edit in the menus (a reply from its own \"…\" menu); Ctrl+Enter (also Command+Enter) saves text in the focused comment editor, Shift+Enter adds a newline; a text box's rectangle follows the new text (wrap width and top edge stay, the height fits the wrapped lines). Undo or Redo closes the panel's editor without saving it, since either can move the comment it was open on"
 
 [[feature]]
 id = "comment.copy-comment-text"

From 3d14ffd722a0ab46df5603c2741fb9818e15d7c7 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 14:27:40 +0100
Subject: [PATCH 069/132] fix(ui): Add text places a box on a picture and
 beside a paragraph again

With Add text, the page router's hits included Edit text's pictures and paragraph edges, which
nothing acts on with Add text, and Add text starts a box only where nobody owns the press: on a
scanned page (a picture filling it) no click placed a box, a click within a paragraph's edge
grip beside it did nothing, and the cursor over a picture was the hand. Add text now has only
the paragraphs' bodies, over their text, where it finishes the box being typed (over_source).

New test add_text_places_a_box_on_a_picture_and_beside_a_paragraph, seen failing on the
previous commit. From CodeRabbit's review of #5300.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs       | 15 +++++++++----
 crates/ui-egui/tests/it/editing.rs | 36 ++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index f843a2ca6c..6bdf5660c6 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1433,11 +1433,18 @@ impl PageHits<'_> {
                 .filter(|e| !e.has_changes())
                 .and_then(|e| lines.get(e.block))
                 .map(|l| xf.user_rect(info, page, l.rect.map(|v| v as f32)).expand(2.0));
+            // Add text acts on the page's paragraphs only over their text (it finishes the box
+            // being typed there): not on pictures, nor beside a paragraph, where a click starts
+            // a new box.
+            let edit_text = tool == QuickTool::EditText;
+            let body = |h: &crate::page_router::Hit| {
+                matches!(h.owner, crate::page_router::Owner::Paragraph { part: crate::page_router::ParagraphPart::Body, .. })
+            };
             (
-                crate::edit_text_ui::picture_hit(xf, page, info, images, view, p),
-                crate::edit_text_ui::hit(xf, info, page, lines, open.map(|e| e.block), p),
-                (tool == QuickTool::EditText).then(|| crate::object_ui::hit(view, xf, info, page, frame, p)).flatten(),
-                crate::edit_text_ui::picture_handle_hit(clip, xf, page, info, images, view, p),
+                edit_text.then(|| crate::edit_text_ui::picture_hit(xf, page, info, images, view, p)).flatten(),
+                crate::edit_text_ui::hit(xf, info, page, lines, open.map(|e| e.block), p).filter(|h| edit_text || body(h)),
+                edit_text.then(|| crate::object_ui::hit(view, xf, info, page, frame, p)).flatten(),
+                edit_text.then(|| crate::edit_text_ui::picture_handle_hit(clip, xf, page, info, images, view, p)).flatten(),
             )
         } else {
             (None, None, None, None)
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index be5413b49c..96020a67fd 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -3935,6 +3935,42 @@ fn editing_existing_images_on_the_page() {
     check_existing_artwork("picture.png", png);
 }
 
+/// Add text places a box with a click anywhere off its own boxes: on a scanned page (one picture
+/// filling it) too, and just beside a paragraph, where Edit text would rewrap it.
+#[test]
+fn add_text_places_a_box_on_a_picture_and_beside_a_paragraph() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::AddText;
+    h.run_steps(2);
+    let c = h.state().views[0].page_screen_rect(0).expect("on screen").center();
+    h.hover_at(c);
+    h.run_steps(2);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Text, "the I-beam over the picture");
+    click_at(&mut h, c);
+    assert!(h.state().views[0].content.draft.is_some(), "a click on the picture starts a text box");
+
+    let mut h = harness(2, |_| {});
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::AddText;
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let block = h.state().session.get(id).unwrap().text_blocks(0)[0].clone();
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 200.0;
+    // 6 px left of the text: 4 px past its box, within a closed paragraph's edge grip in Edit text.
+    let beside = egui::pos2(r.left() + block.rect[0] as f32 * k, r.top() + (300.0 - ((block.rect[1] + block.rect[3]) / 2.0) as f32) * k)
+        - egui::vec2(6.0, 0.0);
+    click_at(&mut h, beside);
+    assert!(h.state().views[0].content.draft.is_some(), "a click beside the paragraph starts a text box");
+}
+
 #[test]
 fn dragging_the_rotate_knob_turns_a_page_image() {
     let mut png = Vec::new();

From 43337c7fd5f7b5123efcebcc84de35c394726e7a Mon Sep 17 00:00:00 2001
From: Hamza <mail.hamzanaveed@gmail.com>
Date: Thu, 29 Oct 2026 19:06:11 +0500
Subject: [PATCH 070/132] Drop the dead operand-overflow branch rather than
 revive it

Review is right that `Stack::push` always returned `Some(())`, so `overflowed`
never became true and the whole-instruction discard was dead code.

Making it live breaks the page. `an_operator_with_hundreds_of_operands_does_
not_end_the_content` (#4260) puts 300 stray operands before `0 1 0 rg` and
asserts the `rg` still reads its own three: with the discard alive the fill
stays the previous red, measured as `left: [255, 0, 0]` against
`right: [0, 255, 0]`.

The ring buffer already gives the right answer. It keeps the newest operands,
which are the ones nearest the operator -- its own -- and no operator takes
anywhere near 256 of them: `scn` takes one per colourant and ISO 32000 allows a
DeviceN space 32. So the strays fall off the back and the operator is applied to
its own operands, which is what Acrobat and Chromium do. Dropping the
instruction would lose content that is there to be read.

The dead branch and the flag are gone, `push` no longer returns a result it
cannot produce, and a test pins what the buffer does: the strays are `1` and the
operator's own operand is `0`, so the two answers differ. Keeping the oldest
operands instead fails it at 256 strays.
---
 crates/render/src/raster/tests.rs      | 34 +++++++++++++++++++++--
 vendor/hayro-syntax/src/content/mod.rs | 38 ++++++++------------------
 2 files changed, 43 insertions(+), 29 deletions(-)

diff --git a/crates/render/src/raster/tests.rs b/crates/render/src/raster/tests.rs
index 696eaddb61..39a489bb1d 100644
--- a/crates/render/src/raster/tests.rs
+++ b/crates/render/src/raster/tests.rs
@@ -7058,8 +7058,9 @@ fn a_malformed_token_does_not_end_the_content_stream() {
         // A `re` with three operands: the typed iterator used to abort on a path operator it
         // could not dispatch, which is what #3568 reports.
         "20 10 10 re",
-        // More operands than the limit (ISO 32000-2 Annex C gives 10): the instruction is
-        // dropped, not the stream.
+        // Eleven operands: under the 256 the stack holds, so this one runs on its own last
+        // operand. Past the limit is covered by
+        // `an_operator_past_the_operand_limit_reads_its_own_operands` below.
         "0 0 0 0 0 0 0 0 0 0 0 g",
         // A stray delimiter: the lexer could not read an operator and jumped to the end.
         ")",
@@ -7080,6 +7081,35 @@ fn a_malformed_token_does_not_end_the_content_stream() {
     }
 }
 
+/// An operator preceded by more operands than the stack holds is applied to its own operands,
+/// which are the ones nearest it, rather than to whichever of the strays survived. The parser
+/// had a branch meant to drop such an instruction whole, dead because `Stack::push` always
+/// reported success (noted in review of #3636); reviving it loses legitimate content, which
+/// `an_operator_with_hundreds_of_operands_does_not_end_the_content` measures, so the dead branch
+/// is gone and this pins what the ring buffer does instead.
+#[test]
+fn an_operator_past_the_operand_limit_reads_its_own_operands() {
+    // The strays are `1` and the operator's own operand is `0`, so the two answers differ: white
+    // if the operator read a stray, black if it read its own.
+    let page = |strays: usize| {
+        let stream = format!("{}0 g 0 0 20 20 re f", "1 ".repeat(strays));
+        let pdf = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] /Contents 4 0 R >> endobj\n4 0 obj << /Length {} >> stream\n{stream}\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF",
+            stream.len()
+        );
+        let mut r = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+        assert!(p.error.is_none(), "{strays} strays: {:?}", p.error);
+        p.rgba.as_chunks::<4>().0.to_vec()
+    };
+    let all_black = |pixels: &[[u8; 4]]| pixels.iter().all(|p| *p == [0, 0, 0, 255]);
+
+    // None, a few, the limit, and past it: the fill is the black the `g` asked for every time.
+    for strays in [0, 5, 255, 256, 257, 600] {
+        assert!(all_black(&page(strays)), "{strays} stray operands: the `g` reads its own operand");
+    }
+}
+
 /// Content after an inline image whose data holds `EI` is still read. This pins the property
 /// but does **not** exercise the look-ahead gating added for #3636's review: accepting a false
 /// `EI` truncates the image, while the text after the real one is read either way, and this
diff --git a/vendor/hayro-syntax/src/content/mod.rs b/vendor/hayro-syntax/src/content/mod.rs
index 33c0e5bd05..1d71d73d2e 100644
--- a/vendor/hayro-syntax/src/content/mod.rs
+++ b/vendor/hayro-syntax/src/content/mod.rs
@@ -190,11 +190,6 @@ impl<'a> UntypedIter<'a> {
             self.committed = self.skip_blanks_and_comments();
         }
 
-        // PdfCraft patch: set when this instruction carried more operands than the limit. Its
-        // operator is then dropped with them, rather than applied to the ones that did fit
-        // (#3568).
-        let mut overflowed = false;
-
         while !self.reader.at_end() {
             // I believe booleans/null never appear as an operator?
             if matches!(
@@ -212,9 +207,7 @@ impl<'a> UntypedIter<'a> {
                     if self.undecided() {
                         return None;
                     }
-                    if self.stack.push(object).is_none() {
-                        overflowed = true;
-                    }
+                    self.stack.push(object);
                 } else if self.reader.read_without_context::<Operator<'_>>().is_some() {
                     if self.undecided() {
                         return None;
@@ -234,7 +227,6 @@ impl<'a> UntypedIter<'a> {
                     // content was deliberately not parsed.
                     warn!("skipped an unreadable name in content stream");
                     self.stack.clear();
-                    overflowed = false;
                     continue;
                 } else {
                     return None;
@@ -253,7 +245,6 @@ impl<'a> UntypedIter<'a> {
                         // the rest of the page was lost. Step over it and carry on (#3568).
                         if !self.lookahead && self.skip_bad_token() {
                             self.stack.clear();
-                            overflowed = false;
                             continue;
                         }
 
@@ -302,7 +293,7 @@ impl<'a> UntypedIter<'a> {
                         UnfilteredEnd::Found(end_data, end_after_ei) => {
                             let image_data = stream_data.get(..end_data)?;
                             let stream = Stream::new(image_data, dict.clone());
-                            self.stack.push(Object::Stream(stream))?;
+                            self.stack.push(Object::Stream(stream));
                             self.reader.read_bytes(end_after_ei)?;
                             self.reader.skip_white_spaces();
                             accepted = true;
@@ -464,7 +455,7 @@ impl<'a> UntypedIter<'a> {
                                 return None;
                             }
 
-                            self.stack.push(Object::Stream(stream))?;
+                            self.stack.push(Object::Stream(stream));
 
                             self.reader.read_bytes(2)?;
                             self.reader.skip_white_spaces();
@@ -482,17 +473,6 @@ impl<'a> UntypedIter<'a> {
                     }
                 }
 
-                if overflowed && !self.lookahead {
-                    // PdfCraft patch: see `overflowed` above. ISO 32000-2 Annex C gives 10 as the
-                    // historical operand limit; past it the instruction is dropped whole.
-                    warn!("dropped an instruction with more operands than the limit");
-                    self.stack.clear();
-                    overflowed = false;
-                    self.committed = self.reader.offset();
-                    self.reader.skip_white_spaces_and_comments();
-                    continue;
-                }
-
                 self.operator = Some(operator);
                 self.committed = self.reader.offset();
                 // PdfCraft patch (28): operands in reading order, if some were dropped.
@@ -717,11 +697,16 @@ impl<'a> Stack<'a> {
     }
 
     /// PdfCraft patch (28): push an operand, dropping the oldest once `MAX_OPERANDS` are held
-    /// (see `MAX_OPERANDS`). Never fails: it used to, and the failure ended the content stream.
-    fn push(&mut self, operand: Object<'a>) -> Option<()> {
+    /// (see `MAX_OPERANDS`). It cannot fail: it used to, and the failure ended the content stream.
+    ///
+    /// The operands kept are the newest, so the ones nearest the operator -- which are its own.
+    /// No operator takes anywhere near `MAX_OPERANDS` of them (`scn` takes one per colourant, and
+    /// ISO 32000 allows a DeviceN space 32), so an instruction preceded by stray operands is
+    /// applied to its own and the strays fall off the back.
+    fn push(&mut self, operand: Object<'a>) {
         if self.data.len() < MAX_OPERANDS {
             self.data.push(operand);
-            return Some(());
+            return;
         }
 
         self.dropped = true;
@@ -729,7 +714,6 @@ impl<'a> Stack<'a> {
             *slot = operand;
         }
         self.oldest = (self.oldest + 1) % MAX_OPERANDS;
-        Some(())
     }
 
     /// PdfCraft patch (28): put the operands back in the order they were read, oldest first,

From 8a21ed1236fdea41778d00cb46882f134370d522 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 15:06:53 +0100
Subject: [PATCH 071/132] fix(ui): Add text opens a paragraph from just inside
 its edge again

With Add text, the page router's hits kept only the paragraphs' bodies (3d14ffd7), so a click
just inside a closed paragraph's left or right edge, within the edge's grip, had no owner: it
neither opened the paragraph (over_source counts the point as the paragraph's) nor started a new
box. Add text now keeps a paragraph's hit wherever the point lies in a paragraph's box, edges
included, by the same test as over_source (edit_text_ui::over_paragraph), and drops it only
beside the box, where a click starts a new box. The edge's grip shows there again, and a drag
from it rewraps the paragraph, as on main.

New test add_text_opens_a_paragraph_from_just_inside_its_edge, seen failing with this commit's
source reverted. From CodeRabbit's second review of #5300.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs             | 18 +++++++-----------
 crates/ui-egui/src/tools/edit_text_ui.rs |  6 ++++++
 crates/ui-egui/tests/it/editing.rs       | 23 +++++++++++++++++++++++
 3 files changed, 36 insertions(+), 11 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 6bdf5660c6..79c95d049b 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1276,10 +1276,8 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
     };
     let on_objects = tool == QuickTool::EditText && can_modify && crate::object_ui::page_input(cx, view);
     let over_source = tool == QuickTool::AddText
-        && pointer.is_some_and(|p| {
-            !crate::content_ui::hits_added(&xf, info, i, added, p)
-                && lines.iter().any(|line| xf.user_rect(info, i, line.rect.map(|v| v as f32)).expand(2.0).contains(p))
-        });
+        && pointer
+            .is_some_and(|p| !crate::content_ui::hits_added(&xf, info, i, added, p) && crate::edit_text_ui::over_paragraph(&xf, info, i, &lines, p));
     let source_blocked = over_source && view.content.hold_blocked();
     if over_source && resp.clicked() && !source_blocked {
         if let Some(edit) = view.content.finish_draft(added) {
@@ -1433,16 +1431,14 @@ impl PageHits<'_> {
                 .filter(|e| !e.has_changes())
                 .and_then(|e| lines.get(e.block))
                 .map(|l| xf.user_rect(info, page, l.rect.map(|v| v as f32)).expand(2.0));
-            // Add text acts on the page's paragraphs only over their text (it finishes the box
-            // being typed there): not on pictures, nor beside a paragraph, where a click starts
-            // a new box.
+            // Add text acts on the page's paragraphs only in their boxes, edges included (it
+            // finishes the box being typed there, `over_source`): not on pictures, nor beside a
+            // paragraph, where a click starts a new box.
             let edit_text = tool == QuickTool::EditText;
-            let body = |h: &crate::page_router::Hit| {
-                matches!(h.owner, crate::page_router::Owner::Paragraph { part: crate::page_router::ParagraphPart::Body, .. })
-            };
+            let on_paragraphs = edit_text || crate::edit_text_ui::over_paragraph(xf, info, page, lines, p);
             (
                 edit_text.then(|| crate::edit_text_ui::picture_hit(xf, page, info, images, view, p)).flatten(),
-                crate::edit_text_ui::hit(xf, info, page, lines, open.map(|e| e.block), p).filter(|h| edit_text || body(h)),
+                on_paragraphs.then(|| crate::edit_text_ui::hit(xf, info, page, lines, open.map(|e| e.block), p)).flatten(),
                 edit_text.then(|| crate::object_ui::hit(view, xf, info, page, frame, p)).flatten(),
                 edit_text.then(|| crate::edit_text_ui::picture_handle_hit(clip, xf, page, info, images, view, p)).flatten(),
             )
diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index 6ec31b0015..f5f19582de 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -273,6 +273,12 @@ fn paragraph_box(xf: &PageXform, info: &DocInfo, page: usize, rect: [f64; 4]) ->
     xf.user_rect(info, page, rect.map(|v| v as f32)).expand(2.0)
 }
 
+/// Whether `p` lies in the box of one of the paragraphs `lines` on `page`, its edge grips there
+/// included, not beside it: where Add text acts on the page's own paragraphs.
+pub(crate) fn over_paragraph(xf: &PageXform, info: &DocInfo, page: usize, lines: &[pdfcraft_engine::TextBlock], p: Pos2) -> bool {
+    lines.iter().any(|l| paragraph_box(xf, info, page, l.rect).contains(p))
+}
+
 /// The width handles need the page upright (or upside down): on a quarter-turned page the
 /// screen's horizontal is the paragraph's vertical.
 fn has_edges(info: &DocInfo, page: usize) -> bool {
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 96020a67fd..508e27bab2 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -3971,6 +3971,29 @@ fn add_text_places_a_box_on_a_picture_and_beside_a_paragraph() {
     assert!(h.state().views[0].content.draft.is_some(), "a click beside the paragraph starts a text box");
 }
 
+/// Add text opens a paragraph with a click anywhere in its box, just inside its edge too, where the
+/// edge's grip shows (a drag there rewraps it, as with Edit text). Add text's hits left the grip
+/// out there, so the click neither opened the paragraph nor started a box.
+#[test]
+fn add_text_opens_a_paragraph_from_just_inside_its_edge() {
+    let mut h = harness(2, |_| {});
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::AddText;
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let block = h.state().session.get(id).unwrap().text_blocks(0)[0].clone();
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 200.0;
+    // 2 px right of where the text starts: 4 px into its box, within its left edge's grip.
+    let inside = egui::pos2(r.left() + block.rect[0] as f32 * k, r.top() + (300.0 - ((block.rect[1] + block.rect[3]) / 2.0) as f32) * k)
+        + egui::vec2(2.0, 0.0);
+    h.hover_at(inside);
+    h.run_steps(2);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::ResizeHorizontal, "the edge's grip");
+    click_at(&mut h, inside);
+    assert!(h.state().views[0].line_editor.is_some(), "the click opens the paragraph for typing");
+    assert!(h.state().views[0].content.draft.is_none(), "and starts no text box");
+}
+
 #[test]
 fn dragging_the_rotate_knob_turns_a_page_image() {
     let mut png = Vec::new();

From 2929ba854e5a3351896eeb0685e7ffd09afc52fb Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 15:07:04 +0100
Subject: [PATCH 072/132] fix(ui): a click on a link or a form button counts
 only released over it

A click acted on what its press was on wherever the button came up: a press on a link, a push
button, a signature field or a list box that slipped off it before the release (still a click to
egui, within 6 px) followed the link, ran the button's action, opened signing or picked a list
box's option. On main a click went to what lay under its release. Now it needs both: the
link's or the fields' hit test at the release point must give what the press was on, as a button
pressed and released off itself does nothing. Check boxes and radio buttons already did so, by
their overlay's click-outside test.

New tests a_press_on_a_link_released_off_it_follows_nothing and
a_press_on_a_button_released_off_it_runs_nothing, seen failing with this commit's source
reverted; the check box test shares their slipping_click helper. From CodeRabbit's second review
of #5300.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs         |  6 ++--
 crates/ui-egui/src/tools/forms_ui.rs |  5 +++-
 crates/ui-egui/tests/it/pointer.rs   | 45 +++++++++++++++++++++++++++-
 3 files changed, 52 insertions(+), 4 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 79c95d049b..03bfa167a1 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1737,12 +1737,14 @@ fn page_overlays(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_
     paint_field_highlights(painter, &xf, info, form.as_slice(), i, view.highlight_fields);
     // Links: the hand and the link's target, which count only for the tools that follow or
     // edit links (`Layer::reached_by`). Tips draw above the palette, so none shows while it is
-    // open, even beside it.
+    // open, even beside it. A click follows the link its press was on, released over it: one that
+    // slips off the link first follows nothing, as a button's does.
     if unobstructed
         && resp.clicked()
         && tool == QuickTool::Select
         && !input.consumed
-        && let Some(crate::page_router::Owner::Link { index }) = view.router.owner(i)
+        && let Some(owner @ crate::page_router::Owner::Link { index }) = view.router.owner(i)
+        && pointer.and_then(|p| link_hit(info, &xf, i, p)).is_some_and(|h| h.owner == owner)
         && let Some(l) = info.links.get(index)
     {
         frame.out.clicked_link = Some(l.target.clone());
diff --git a/crates/ui-egui/src/tools/forms_ui.rs b/crates/ui-egui/src/tools/forms_ui.rs
index 077ad8550c..7232b1169b 100644
--- a/crates/ui-egui/src/tools/forms_ui.rs
+++ b/crates/ui-egui/src/tools/forms_ui.rs
@@ -208,7 +208,10 @@ pub(crate) fn page_input(cx: PageToolContext<'_>, form: &[FormField], allowed: b
         view.forms.focus = Some(Focus { press: Some(at), ..open_focus(f, wi) });
         view.forms.pressed = true;
     }
-    if !resp.clicked() {
+    // A click counts released over the widget its press was on, as a button's does: one that slips
+    // off it first does nothing (a check box's overlay closes on it too).
+    if !resp.clicked() || !ptr.pos.and_then(|p| hit(xf, info, page, form, allowed, p)).is_some_and(|h| h.owner == Owner::Field { field, widget: wi })
+    {
         return true;
     }
     if !allowed {
diff --git a/crates/ui-egui/tests/it/pointer.rs b/crates/ui-egui/tests/it/pointer.rs
index 0d058cb458..889caf4c1c 100644
--- a/crates/ui-egui/tests/it/pointer.rs
+++ b/crates/ui-egui/tests/it/pointer.rs
@@ -132,6 +132,16 @@ fn highlighted_checkbox_pdf() -> Vec<u8> {
     ])
 }
 
+/// A 300×400 page with a push button at x 100..200, y 200..220 whose action opens a web address.
+fn button_pdf() -> Vec<u8> {
+    pdf(&[
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] /DA (/Helv 0 Tf 0 g) >> >>",
+        PAGES,
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (web) /Rect [100 200 200 220] /P 3 0 R /A << /S /URI /URI (https://example.org/) >> >>",
+    ])
+}
+
 /// The app with `pdf` open at `zoom` percent and its first frames run. The left panel stays
 /// open only where a test places the page relative to the window's chrome.
 fn open(pdf: Vec<u8>, zoom: &'static str, left_open: bool) -> Harness<'static, PdfCraftApp> {
@@ -725,13 +735,46 @@ fn field_value(h: &Harness<'_, PdfCraftApp>, name: &str) -> Vec<String> {
 fn a_press_on_one_check_box_released_over_another_ticks_neither() {
     let mut h = open(two_checkboxes_pdf(), "150", false);
     let (press, release) = (at(&h, 119.0, 210.0), at(&h, 121.0, 210.0));
+    slipping_click(&mut h, press, release);
+    assert_eq!((field_value(&h, "agree"), field_value(&h, "other")), (Vec::<String>::new(), Vec::new()), "neither box is ticked");
+}
+
+/// A click whose pointer slips from `press` to `release` before the button comes up (a click
+/// still, to egui, while they are close), in frames of their own as [`mouse_click`] sends them.
+fn slipping_click(h: &mut Harness<'_, PdfCraftApp>, press: egui::Pos2, release: egui::Pos2) {
     h.hover_at(press);
     h.run_steps(1);
     h.drag_at(press);
     h.run_steps(1);
     h.drop_at(release);
     h.run_steps(4);
-    assert_eq!((field_value(&h, "agree"), field_value(&h, "other")), (Vec::<String>::new(), Vec::new()), "neither box is ticked");
+}
+
+/// A click follows the link its press was on only when released over it: pressed just inside the
+/// link's edge and released just past it, it follows nothing, as a button pressed and released off
+/// itself does nothing. The press used to be enough.
+#[test]
+fn a_press_on_a_link_released_off_it_follows_nothing() {
+    let mut h = open(link_pdf(), "150", false);
+    // The link ends at x 250.
+    let press = at(&h, 249.0, 325.0);
+    slipping_click(&mut h, press, press + egui::vec2(5.0, 0.0));
+    assert_eq!(h.state().pending_link, None, "nothing asks to open the link");
+    mouse_click(&mut h, press);
+    assert!(h.state().pending_link.is_some(), "a click there asks to open it");
+}
+
+/// The same for a push button: pressed just inside its edge and released just past it, it runs no
+/// action. The press used to be enough.
+#[test]
+fn a_press_on_a_button_released_off_it_runs_nothing() {
+    let mut h = open(button_pdf(), "150", false);
+    // The button ends at x 200.
+    let press = at(&h, 199.0, 210.0);
+    slipping_click(&mut h, press, press + egui::vec2(5.0, 0.0));
+    assert_eq!(h.state().pending_link, None, "the button's action does not run");
+    mouse_click(&mut h, press);
+    assert!(h.state().pending_link.is_some(), "a click there runs it");
 }
 
 /// Text markup lies on the text, under a form field: a click on a check box under a highlight

From 11bc8c56528fc3a820669d41c0eec29310cdad24 Mon Sep 17 00:00:00 2001
From: alehel <git@ornumhelgaker.no>
Date: Thu, 29 Oct 2026 15:32:48 +0100
Subject: [PATCH 073/132] fix(ui): Add text finishes a paragraph drag that
 leaves the paragraph's box

With Add text the page's own paragraphs took input only while the pointer was over one
(over_source), and their drags end in edit_text_ui::page_input. A paragraph dragged off its box
was left hanging after the release (block_drag), to land wherever the pointer next met a
paragraph; one flicked off in its first move never started, so nothing moved. main has the same
test. Add text now also acts on the paragraph the page router says holds the press, until the
button is up, so the drag ends where it is released, as with Edit text, and Add text's
new-box path does not take the press over.

New test add_text_finishes_a_paragraph_drag_that_leaves_its_box, seen failing before the fix
(the drag still pending after the release); the flick was checked by hand the same way. From
CodeRabbit's third review of #5300.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs       |  8 ++++++--
 crates/ui-egui/tests/it/editing.rs | 33 ++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 03bfa167a1..c39fdedef1 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1275,9 +1275,13 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
         crate::redact_ui::page_input(cx, over_text, view)
     };
     let on_objects = tool == QuickTool::EditText && can_modify && crate::object_ui::page_input(cx, view);
+    // Add text acts on the page's own paragraphs over them, and on the one its press was on until
+    // the button is up: a drag that leaves the box still ends, and no new box takes it over.
     let over_source = tool == QuickTool::AddText
-        && pointer
-            .is_some_and(|p| !crate::content_ui::hits_added(&xf, info, i, added, p) && crate::edit_text_ui::over_paragraph(&xf, info, i, &lines, p));
+        && (matches!(view.router.owner(i), Some(crate::page_router::Owner::Paragraph { .. }))
+            || pointer.is_some_and(|p| {
+                !crate::content_ui::hits_added(&xf, info, i, added, p) && crate::edit_text_ui::over_paragraph(&xf, info, i, &lines, p)
+            }));
     let source_blocked = over_source && view.content.hold_blocked();
     if over_source && resp.clicked() && !source_blocked {
         if let Some(edit) = view.content.finish_draft(added) {
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 508e27bab2..baeee71f5c 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -3994,6 +3994,39 @@ fn add_text_opens_a_paragraph_from_just_inside_its_edge() {
     assert!(h.state().views[0].content.draft.is_none(), "and starts no text box");
 }
 
+/// With Add text a paragraph dragged off its own box still moves to where the button comes up, as
+/// with Edit text. Add text acted on the page's paragraphs only while the pointer was over one, so
+/// the drag was left hanging, to land wherever the pointer next met a paragraph.
+#[test]
+fn add_text_finishes_a_paragraph_drag_that_leaves_its_box() {
+    let mut h = harness(2, |_| {});
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::AddText;
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let before = h.state().session.get(id).unwrap().text_blocks(0)[0].rect;
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let k = r.width() / 200.0;
+    let from = egui::pos2(r.left() + ((before[0] + before[2]) / 2.0) as f32 * k, r.top() + (300.0 - ((before[1] + before[3]) / 2.0) as f32) * k);
+    // The drag starts in the box (8 px down), then goes 60 pt down, onto the blank page under it.
+    h.hover_at(from);
+    h.run_steps(1);
+    h.drag_at(from);
+    h.run_steps(1);
+    h.hover_at(from + egui::vec2(0.0, 8.0));
+    h.run_steps(1);
+    for i in 1..=4 {
+        h.hover_at(from + egui::vec2(0.0, 15.0 * k * i as f32));
+        h.run_steps(1);
+    }
+    h.drop_at(from + egui::vec2(0.0, 60.0 * k));
+    for _ in 0..10 {
+        h.run_steps(2);
+    }
+    assert!(h.state().views[0].block_drag.is_none(), "the drag is over");
+    let after = h.state().session.get(id).unwrap().text_blocks(0)[0].rect;
+    assert!(before[1] - after[1] > 50.0, "the paragraph moved down with it: {before:?} to {after:?}");
+}
+
 #[test]
 fn dragging_the_rotate_knob_turns_a_page_image() {
     let mut png = Vec::new();

From f175beb25a17fc9dc967d396aeae1a10c503549e Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Fri, 23 Oct 2026 21:16:12 +0200
Subject: [PATCH 074/132] M11: PDF Optimizer stores black-and-white images as
 CCITT Group 4 when smaller

pdfcraft_filters::encode_g4 encodes packed 1-bit rows as Group 4 (ITU-T
T.6, /K -1) through the fax crate (MIT, already in the tree via tiff),
with rows capped at 32,767 samples so its 16-bit positions can't
overflow; round trips are checked against hayro-ccitt.

The optimizer (Settings::mono, CCITT G4 by default, so Reduce File Size
too) re-encodes a 1-bit image of one colour component, or an image
mask, stored with no filter or general-purpose ones, when that is
smaller as stored. The samples decode to the same bits, so colour
space, decode array and masks stay. PDF Optimizer gets a Monochrome
Images row and doc_optimize a mono option. optimize.mono-compression
goes from planned to partial (JBIG2 and monochrome downsampling not
yet).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 Cargo.lock                                  |   2 +
 Cargo.toml                                  |   4 +
 ROADMAP.md                                  |   1 +
 crates/automation/src/documents.rs          |   9 +-
 crates/automation/src/tools.rs              |   3 +-
 crates/automation/tests/it/automation.rs    |  89 ++++++++++
 crates/filters/Cargo.toml                   |   4 +-
 crates/filters/README.md                    |   7 +-
 crates/filters/src/ccitt.rs                 | 182 +++++++++++++++++++
 crates/filters/src/lib.rs                   |   6 +-
 crates/optimize/README.md                   |   8 +
 crates/optimize/src/images.rs               |  64 ++++++-
 crates/optimize/src/lib.rs                  |  17 +-
 crates/optimize/tests/optimize.rs           | 185 +++++++++++++++++++-
 crates/ui-egui/src/i18n/ar.tsv              |   2 +
 crates/ui-egui/src/i18n/bg.tsv              |   2 +
 crates/ui-egui/src/i18n/ca.tsv              |   2 +
 crates/ui-egui/src/i18n/ckb.tsv             |   2 +
 crates/ui-egui/src/i18n/cs.tsv              |   2 +
 crates/ui-egui/src/i18n/de.tsv              |   2 +
 crates/ui-egui/src/i18n/el.tsv              |   2 +
 crates/ui-egui/src/i18n/es.tsv              |   2 +
 crates/ui-egui/src/i18n/fi.tsv              |   2 +
 crates/ui-egui/src/i18n/fr.tsv              |   2 +
 crates/ui-egui/src/i18n/hi.tsv              |   2 +
 crates/ui-egui/src/i18n/hu.tsv              |   2 +
 crates/ui-egui/src/i18n/id.tsv              |   2 +
 crates/ui-egui/src/i18n/it.tsv              |   2 +
 crates/ui-egui/src/i18n/ja.tsv              |   2 +
 crates/ui-egui/src/i18n/kk.tsv              |   2 +
 crates/ui-egui/src/i18n/ko.tsv              |   2 +
 crates/ui-egui/src/i18n/lo.tsv              |   2 +
 crates/ui-egui/src/i18n/lt.tsv              |   2 +
 crates/ui-egui/src/i18n/nb.tsv              |   2 +
 crates/ui-egui/src/i18n/pl.tsv              |   2 +
 crates/ui-egui/src/i18n/pt-br.tsv           |   2 +
 crates/ui-egui/src/i18n/ro.tsv              |   2 +
 crates/ui-egui/src/i18n/ru.tsv              |   2 +
 crates/ui-egui/src/i18n/sl.tsv              |   2 +
 crates/ui-egui/src/i18n/sq.tsv              |   2 +
 crates/ui-egui/src/i18n/te.tsv              |   2 +
 crates/ui-egui/src/i18n/th.tsv              |   2 +
 crates/ui-egui/src/i18n/tr.tsv              |   2 +
 crates/ui-egui/src/i18n/uk.tsv              |   2 +
 crates/ui-egui/src/i18n/vi.tsv              |   2 +
 crates/ui-egui/src/i18n/zh-hans.tsv         |   2 +
 crates/ui-egui/src/i18n/zh-hant.tsv         |   2 +
 crates/ui-egui/src/workflows/optimize_ui.rs |  20 ++-
 crates/ui-egui/tests/it/create.rs           |   2 +
 docs/roadmap.md                             |   2 +
 parity/acrobat-features.toml                |  12 +-
 51 files changed, 666 insertions(+), 17 deletions(-)
 create mode 100644 crates/filters/src/ccitt.rs

diff --git a/Cargo.lock b/Cargo.lock
index 8fd7c9133b..42426bc688 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4424,7 +4424,9 @@ dependencies = [
 name = "pdfcraft-filters"
 version = "0.15.0"
 dependencies = [
+ "fax",
  "flate2",
+ "hayro-ccitt",
  "proptest",
  "thiserror 2.0.21",
  "weezl 0.2.1",
diff --git a/Cargo.toml b/Cargo.toml
index 64a3cf5b60..5a92b67475 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -65,6 +65,10 @@ hayro-syntax = "0.7.2"
 lopdf = "0.45"
 flate2 = { version = "1.1", default-features = false, features = ["rust_backend"] }
 weezl = "0.2"
+# CCITT Group 4 encoding (pdfcraft-filters); already in the tree through tiff.
+fax = "0.2.7"
+# An independent CCITT decoder, for round-trip tests; already in the tree through hayro.
+hayro-ccitt = "0.3"
 
 # foundation
 thiserror = "2"
diff --git a/ROADMAP.md b/ROADMAP.md
index f5de8044e1..42f70325bc 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,6 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
+- **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
 - **2026-10-23 (M7, #2636 partial):** A new `PasteContent` edit pastes an added text box or image copied in the same document or another, keeping its style, picture, turns, flips and crop, as one undo step; `content_copy` drives it headlessly. A paste lands beside earlier copies (18 pt steps) and stays on the page. A pasted image reuses its picture object in its own document and after the first paste into another; there a colour profile is dropped and CMYK colours stored losslessly are turned to RGB. The desktop keys and menus follow in separate PRs. Estimates unchanged.
diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index 476c451028..1b26dec7f1 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -279,7 +279,7 @@ impl Automation {
     }
 
     pub(crate) fn doc_optimize(&mut self, a: &Args) -> Result<Value> {
-        use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, Preset};
+        use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, MonoCompression, Preset};
         let id = self.doc(a)?.id;
         let before = self.doc(a)?.bytes.len();
         let path = self.resolve(a.str("path")?, true)?;
@@ -317,6 +317,13 @@ impl Automation {
         };
         settings.color = images("color", settings.color)?;
         settings.gray = images("gray", settings.gray)?;
+        if let Some(c) = a.get("mono").and_then(|m| m.get("compression")).and_then(Value::as_str) {
+            settings.mono = match c {
+                "ccitt_g4" | "ccitt" | "g4" => MonoCompression::CcittG4,
+                "retain" => MonoCompression::Retain,
+                other => return Err(ToolError::InvalidArgs(format!("unknown mono compression {other:?} (ccitt_g4, retain)"))),
+            };
+        }
         for (key, flag) in [
             ("merge_fragments", &mut settings.merge_fragments),
             ("discard_thumbnails", &mut settings.discard_thumbnails),
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 53c4582af9..c4a9f283b5 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1433,7 +1433,7 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { compression: ccitt_g4|retain } (default ccitt_g4: black-and-white images and image masks are stored losslessly as CCITT Group 4 when that is smaller; counted in images_recompressed). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
@@ -1444,6 +1444,7 @@ pub fn tools() -> Vec<ToolDef> {
                     "merge_fragments": { "type": "boolean" },
                     "color": { "type": "object" },
                     "gray": { "type": "object" },
+                    "mono": { "type": "object" },
                     "discard_thumbnails": { "type": "boolean" },
                     "discard_alternate_images": { "type": "boolean" },
                     "discard_tags": { "type": "boolean" },
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 01d0d1eb24..aa4b50d087 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6372,6 +6372,95 @@ fn lzw_streams_are_stored_with_flate_through_tools() {
     assert_eq!(filters("kept.pdf"), (Some(Object::name("LZWDecode")), ops));
 }
 
+/// A one-page PDF drawing a 1-bit scan of text (glyph strokes with ragged edges, as a scanner
+/// leaves them) of 1000 × 400 samples, stored with Flate.
+fn scanned_page() -> Vec<u8> {
+    use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_full};
+    let (w, h) = (1000usize, 400usize);
+    let stride = w.div_ceil(8);
+    let mut data = vec![0xFFu8; stride * h];
+    let mut seed = 0x2545_F491_4F6C_DD1Du64;
+    let mut next = move || {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        seed
+    };
+    for line in (4..h - 20).step_by(24) {
+        let mut x = 8;
+        while x + 12 < w {
+            let wide = 3 + (next() % 5) as usize;
+            let (top, bottom) = (line + (next() % 4) as usize, line + 14);
+            for y in top..bottom {
+                let left = x + usize::from(next() % 8 == 0);
+                let right = x + wide - usize::from(next() % 8 == 0);
+                for xx in left..right {
+                    data[y * stride + xx / 8] &= !(0x80 >> (xx % 8));
+                }
+            }
+            x += wide + 2 + (next() % 4) as usize;
+        }
+    }
+    let mut doc = Document::new_empty();
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("XObject"));
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w as i64));
+    d.set(b"Height".to_vec(), Object::Int(h as i64));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    let image = doc.add(Object::Stream(Stream::flate(d, &data)));
+    let pages = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages"))).unwrap();
+    let mut x = Dict::new();
+    x.set(b"Scan".to_vec(), Object::Ref(image));
+    let mut res = Dict::new();
+    res.set(b"XObject".to_vec(), Object::Dict(x));
+    let content = doc.add(Object::Stream(Stream::from_raw(Dict::new(), b"q 500 0 0 200 50 500 cm /Scan Do Q".to_vec())));
+    let mut p = Dict::new();
+    p.set(b"Type".to_vec(), Object::name("Page"));
+    p.set(b"Parent".to_vec(), Object::Ref(pages));
+    p.set(b"MediaBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 612.into(), 792.into()]));
+    p.set(b"Resources".to_vec(), Object::Dict(res));
+    p.set(b"Contents".to_vec(), Object::Ref(content));
+    let page = doc.add(Object::Dict(p));
+    doc.update_dict(pages, |d| {
+        d.set(b"Kids".to_vec(), Object::Array(vec![Object::Ref(page)]));
+        d.set(b"Count".to_vec(), Object::Int(1));
+    })
+    .unwrap();
+    write_full(&doc, &SaveOptions::default()).unwrap()
+}
+
+/// A scan's black-and-white image is stored as CCITT Group 4 by default, and kept as it is with
+/// `mono: { compression: retain }`.
+#[test]
+fn doc_optimize_stores_black_and_white_images_as_ccitt_group_4() {
+    let dir = workdir("optimize-mono");
+    std::fs::write(dir.join("scan.pdf"), scanned_page()).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "scan.pdf" }))["doc"].as_u64().unwrap();
+    let kept = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "kept.pdf", "mono": { "compression": "retain" } }));
+    assert_eq!((kept["images"].as_u64(), kept["images_recompressed"].as_u64()), (Some(1), Some(0)), "{kept}");
+    let r = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "small.pdf" }));
+    assert_eq!((r["images"].as_u64(), r["images_recompressed"].as_u64()), (Some(1), Some(1)), "{r}");
+    assert!(r["image_bytes_after"].as_u64() < r["image_bytes_before"].as_u64(), "{r}");
+    // The copy written stores the image as Group 4.
+    let small = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join("small.pdf")).unwrap())).unwrap();
+    let filters: Vec<Vec<u8>> = small
+        .object_numbers()
+        .into_iter()
+        .filter_map(|num| match &*small.get(pdfcraft_cos::ObjRef { num, generation: small.generation(num) }) {
+            pdfcraft_cos::Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => s.dict.name(b"Filter").map(<[u8]>::to_vec),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(filters, [b"CCITTFaxDecode".to_vec()]);
+    assert!(matches!(
+        a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "mono": { "compression": "jbig2" } })),
+        Err(ToolError::InvalidArgs(_))
+    ));
+}
+
 /// A one-page PDF whose page picture is drawn as `rows` grey images one pixel row high, 600 px
 /// wide on a 72 pt square (600 ppi), as some PDF printers write it.
 fn printed_in_strips(rows: usize) -> Vec<u8> {
diff --git a/crates/filters/Cargo.toml b/crates/filters/Cargo.toml
index 9d2ae34b94..2ed64eb8bd 100644
--- a/crates/filters/Cargo.toml
+++ b/crates/filters/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "pdfcraft-filters"
-description = "PDF stream filters (ISO 32000-2 §7.4): Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength"
+description = "PDF stream filters (ISO 32000-2 §7.4): Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength, CCITT Group 4 encoding"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -11,9 +11,11 @@ repository.workspace = true
 workspace = true
 
 [dependencies]
+fax.workspace = true
 flate2.workspace = true
 thiserror.workspace = true
 
 [dev-dependencies]
+hayro-ccitt.workspace = true
 proptest.workspace = true
 weezl.workspace = true
diff --git a/crates/filters/README.md b/crates/filters/README.md
index 959180d87a..413dff37c1 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -3,7 +3,7 @@
 PDF stream filters: the decoders and encoders behind `/Filter` and `/DecodeParms`.
 
 - **Layer:** L0, standalone. No dependency on any other PdfCraft crate. `cos` depends on it (architecture §3 rule 3).
-- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters).
+- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder.
 - `#![forbid(unsafe_code)]`. Builds for `wasm32-unknown-unknown`.
 
 ## API
@@ -22,6 +22,7 @@ decode_tolerant(chain, data, max_output) -> Result<(Vec<u8>, bool /*partial*/),
 decode_tolerant_counted(chain, data, max_output) -> Result<(Vec<u8>, bool /*partial*/, usize /*decoded*/), (FilterError, usize /*decoded*/)>
 encode(filter, params, data) -> Result<Vec<u8>, FilterError>
 encode_flate(data) -> Vec<u8>   // zlib, level 6
+encode_g4(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as CCITT Group 4; columns <= MAX_G4_COLUMNS
 ```
 
 - `chain` is applied first to last, as in a `/Filter` array.
@@ -40,14 +41,16 @@ encode_flate(data) -> Vec<u8>   // zlib, level 6
 | ASCIIHexDecode | white space ignored, odd digit padded with 0, `>` EOD (optional), other characters → Corrupt | upper case, newline every 64 digits, `>` |
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
+| CCITTFaxDecode | not here (`Unsupported`; renderers decode it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
 
 ## Tests
 
 - Unit tests per filter with hand-computed vectors (the ISO 32000-2 LZW example, RFC 1951 stored blocks, PNG/TIFF rows).
 - LZW is cross-checked against `weezl` (dev-dependency) in both directions for both early-change settings.
 - `tests/proptests.rs`: encode→decode round trips for every encodable filter × predictor × colors × bpc × columns, two-filter chains, output-limit checks, and fuzz-style no-panic tests (random bytes, random/nonsense params, bit-flipped valid streams).
+- `ccitt.rs`: Group 4 output decoded by `hayro-ccitt` (dev-dependency, an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
 
-M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2, CCITT G3/G4 decode and G4 encode, DCT encode) and Flate encode levels other than 6.
+M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2, CCITT G3/G4 decode, DCT encode), CCITT Group 3 encoding and Flate encode levels other than 6.
diff --git a/crates/filters/src/ccitt.rs b/crates/filters/src/ccitt.rs
new file mode 100644
index 0000000000..3c8018525a
--- /dev/null
+++ b/crates/filters/src/ccitt.rs
@@ -0,0 +1,182 @@
+//! CCITT Group 4 (ITU-T T.6) encoding, for `CCITTFaxDecode` with `/K -1` (ISO 32000-2 §7.4.6).
+//! The coding is the `fax` crate's; this module checks what it is given.
+
+use fax::encoder::Encoder;
+use fax::{Color, VecWriter};
+
+use crate::FilterError;
+
+/// The widest row [`encode_g4`] encodes. The encoder counts the positions in a row in 16 bits
+/// and adds two of them, so a row stays within half that range.
+pub const MAX_G4_COLUMNS: u32 = 32_767;
+
+/// `rows` rows of `columns` 1-bit samples, most significant bit first, each row starting on a new
+/// byte (as a PDF image's samples are packed), encoded as CCITT Group 4 with an end-of-block mark.
+///
+/// A 0 bit is coded black and a 1 bit white, so the stream decodes to the same bits with
+/// `/BlackIs1 false`, the default: an image keeps its colour space and decode array. Bytes after
+/// the last row are ignored, as are the bits that pad a row to a whole byte.
+///
+/// Errors: no rows or columns, or rows wider than [`MAX_G4_COLUMNS`] ([`FilterError::Unsupported`]);
+/// fewer bytes than the rows need ([`FilterError::Corrupt`]).
+pub fn encode_g4(data: &[u8], columns: u32, rows: u32) -> Result<Vec<u8>, FilterError> {
+    let width = match u16::try_from(columns) {
+        Ok(w) if w > 0 && columns <= MAX_G4_COLUMNS => w,
+        _ => return Err(FilterError::Unsupported(format!("CCITT Group 4 encoding of rows {columns} samples wide"))),
+    };
+    if rows == 0 {
+        return Err(FilterError::Unsupported("CCITT Group 4 encoding of an image without rows".into()));
+    }
+    let stride = usize::from(width).div_ceil(8);
+    let samples = usize::try_from(rows).ok().and_then(|r| r.checked_mul(stride)).and_then(|n| data.get(..n)).ok_or_else(|| FilterError::Corrupt {
+        filter: "CCITTFaxDecode",
+        detail: format!("{} bytes for {rows} rows of {columns} samples", data.len()),
+    })?;
+    let mut encoder = Encoder::new(VecWriter::new());
+    for row in samples.chunks_exact(stride) {
+        let pels = (0..usize::from(width)).map(|x| {
+            let white = row.get(x / 8).is_some_and(|b| b & (0x80 >> (x % 8)) != 0);
+            if white { Color::White } else { Color::Black }
+        });
+        // `VecWriter` writes to memory: its error type has no values.
+        if let Err(never) = encoder.encode_line(pels, width) {
+            match never {}
+        }
+    }
+    match encoder.finish() {
+        Ok(writer) => Ok(writer.finish()),
+        Err(never) => match never {},
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The rows decoded by an independent decoder (`hayro-ccitt`), as 1 for white and 0 for black.
+    pub(crate) fn decode(data: &[u8], columns: u32, rows: u32) -> Vec<Vec<bool>> {
+        struct Rows(Vec<Vec<bool>>, Vec<bool>, usize);
+        impl hayro_ccitt::Decoder for Rows {
+            fn push_pixel(&mut self, white: bool) {
+                self.1.push(white);
+            }
+            fn push_pixel_chunk(&mut self, white: bool, chunks: u32) {
+                self.1.extend(std::iter::repeat_n(white, chunks as usize * 8));
+            }
+            fn next_line(&mut self) {
+                let mut row = std::mem::take(&mut self.1);
+                row.truncate(self.2);
+                self.0.push(row);
+            }
+        }
+        let settings = hayro_ccitt::DecodeSettings {
+            columns,
+            rows,
+            end_of_block: true,
+            end_of_line: false,
+            rows_are_byte_aligned: false,
+            encoding: hayro_ccitt::EncodingMode::Group4,
+            invert_black: false,
+        };
+        let mut out = Rows(Vec::new(), Vec::new(), columns as usize);
+        hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings)).unwrap();
+        out.0
+    }
+
+    /// The rows of packed samples `data`, as 1 for a 1 bit.
+    pub(crate) fn unpack(data: &[u8], columns: u32, rows: u32) -> Vec<Vec<bool>> {
+        let stride = (columns as usize).div_ceil(8);
+        (0..rows as usize).map(|y| (0..columns as usize).map(|x| data[y * stride + x / 8] & (0x80 >> (x % 8)) != 0).collect()).collect()
+    }
+
+    #[test]
+    fn a_page_of_text_like_marks_round_trips_and_shrinks() {
+        let (w, h) = (1700u32, 220u32);
+        let stride = (w as usize).div_ceil(8);
+        let mut data = vec![0xFF; stride * h as usize];
+        // Short black strokes in lines, like glyphs on a white page.
+        for y in (20..h as usize).step_by(40) {
+            for dy in 0..12 {
+                for x in (100..1600).step_by(9) {
+                    if (x / 9 + dy) % 5 != 0 {
+                        data[(y + dy) * stride + x / 8] &= !(0x80 >> (x % 8));
+                    }
+                }
+            }
+        }
+        let g4 = encode_g4(&data, w, h).unwrap();
+        assert_eq!(decode(&g4, w, h), unpack(&data, w, h));
+        assert!(g4.len() * 4 < data.len(), "{} bytes from {}", g4.len(), data.len());
+    }
+
+    #[test]
+    fn padding_bits_and_trailing_bytes_are_ignored() {
+        // 3 columns: the last 5 bits of each byte pad the row; set them to anything.
+        let data = [0b1010_1111, 0b0101_0000, 0b1110_1010, 0xAB, 0xCD];
+        let g4 = encode_g4(&data, 3, 3).unwrap();
+        assert_eq!(decode(&g4, 3, 3), [[true, false, true], [false, true, false], [true, true, true]]);
+    }
+
+    #[test]
+    fn what_it_cannot_encode_is_an_error() {
+        assert!(matches!(encode_g4(&[0; 8], 0, 1), Err(FilterError::Unsupported(_))));
+        assert!(matches!(encode_g4(&[0; 8], 8, 0), Err(FilterError::Unsupported(_))));
+        assert!(matches!(encode_g4(&vec![0; 4097], MAX_G4_COLUMNS + 1, 1), Err(FilterError::Unsupported(_))));
+        assert!(matches!(encode_g4(&[0; 3], 16, 2), Err(FilterError::Corrupt { .. })), "two rows of 16 need 4 bytes");
+        assert!(matches!(encode_g4(&[], 1, u32::MAX), Err(FilterError::Corrupt { .. })));
+        let widest = vec![0x55; (MAX_G4_COLUMNS as usize).div_ceil(8) * 2];
+        let g4 = encode_g4(&widest, MAX_G4_COLUMNS, 2).unwrap();
+        assert_eq!(decode(&g4, MAX_G4_COLUMNS, 2), unpack(&widest, MAX_G4_COLUMNS, 2));
+    }
+
+    /// Rows of `columns` samples built from `runs`: alternating white and black runs one longer
+    /// than those values (so never empty, even when shrinking makes them all 0), repeated until the
+    /// rows are full; or, with `noise`, the bytes of `runs` as they are.
+    fn bitmap(columns: u32, rows: u32, runs: &[u8], noise: bool) -> Vec<u8> {
+        let stride = (columns as usize).div_ceil(8);
+        let mut data = vec![0u8; stride * rows as usize];
+        if runs.is_empty() {
+            return data;
+        }
+        if noise {
+            data.iter_mut().zip(runs.iter().cycle()).for_each(|(d, r)| *d = *r);
+            return data;
+        }
+        let (mut white, mut left, mut next) = (true, 1 + usize::from(runs[0]), 1);
+        for y in 0..rows as usize {
+            for x in 0..columns as usize {
+                if left == 0 {
+                    white = !white;
+                    left = 1 + usize::from(runs[next % runs.len()]);
+                    next += 1;
+                }
+                if white {
+                    data[y * stride + x / 8] |= 0x80 >> (x % 8);
+                }
+                left -= 1;
+            }
+        }
+        data
+    }
+
+    proptest::proptest! {
+        /// Any bitmap, of noise or of runs, decodes to its own bits through an independent decoder.
+        #[test]
+        fn bitmaps_round_trip(
+            columns in 1u32..400,
+            rows in 1u32..24,
+            runs in proptest::collection::vec(0u8..=255, 1..48),
+            noise in proptest::bool::ANY,
+        ) {
+            let data = bitmap(columns, rows, &runs, noise);
+            let g4 = encode_g4(&data, columns, rows).unwrap();
+            proptest::prop_assert_eq!(decode(&g4, columns, rows), unpack(&data, columns, rows));
+        }
+
+        /// Whatever it is given, it returns.
+        #[test]
+        fn any_input_returns(data in proptest::collection::vec(0u8..=255, 0..600), columns in 0u32..40_000, rows in 0u32..80) {
+            let _ = encode_g4(&data, columns, rows);
+        }
+    }
+}
diff --git a/crates/filters/src/lib.rs b/crates/filters/src/lib.rs
index 22a78aefdb..b9461435eb 100644
--- a/crates/filters/src/lib.rs
+++ b/crates/filters/src/lib.rs
@@ -6,7 +6,8 @@
 //! TIFF/PNG predictors, `ASCIIHexDecode`, `ASCII85Decode`, `RunLengthDecode`).
 //! Image codecs (`DCTDecode`, `JPXDecode`, `JBIG2Decode`, `CCITTFaxDecode`),
 //! `Crypt` and unknown filters are reported as [`FilterError::Unsupported`] so
-//! callers keep such data encoded.
+//! callers keep such data encoded. 1-bit samples can be encoded as CCITT Group 4
+//! ([`encode_g4`]).
 //!
 //! Every decoder is bounded by a caller-supplied `max_output` (decompression-bomb
 //! defence) and never panics on malformed input.
@@ -15,6 +16,7 @@
 
 mod ascii85;
 mod asciihex;
+mod ccitt;
 mod flate;
 mod lzw;
 mod predictor;
@@ -22,6 +24,8 @@ mod runlength;
 
 use std::borrow::Cow;
 
+pub use ccitt::{MAX_G4_COLUMNS, encode_g4};
+
 /// A PDF stream filter, identified by its `/Filter` name.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub enum Filter {
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index cbe37f6b7b..6b4d04b071 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -32,6 +32,14 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   its colour transform (an Adobe marker's, else `/ColorTransform`, ISO 32000-2 §7.4.8), so one
   stored untransformed keeps its colours; one whose marker and `/ColorTransform` disagree is left
   alone, since readers differ on which wins.
+- **Monochrome images** (`Settings::mono`, CCITT Group 4 by default): a 1-bit image with one
+  colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
+  general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
+  that is smaller as stored. It is lossless: the samples decode to the same bits, so the colour
+  space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
+  on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
+  JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
+  than 32,767 samples.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index b9761b85fc..0a157b8c33 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -5,7 +5,7 @@ use std::collections::{HashMap, HashSet};
 use pdfcraft_content::{Matrix, Pieces};
 use pdfcraft_cos::{DecodeBudget, Dict, Document, ObjRef, Object, Stream};
 
-use crate::{Compression, ImageSettings, OptimizeError, Report, Settings, Stage};
+use crate::{Compression, ImageSettings, MonoCompression, OptimizeError, Report, Settings, Stage};
 
 /// Images with more pixels than this are left alone (memory).
 const MAX_PIXELS: u64 = 80_000_000;
@@ -532,6 +532,61 @@ fn process(doc: &Document, s: &Stream, ppi: f64, settings: &ImageSettings, n: us
     (after < before).then_some((new, smask))
 }
 
+/// Whether colour space `cs` has one colour component, so a 1-bit image in it has one bit per
+/// pixel: grey, a separation, an indexed space or a DeviceN of one colourant.
+fn one_component(doc: &Document, cs: &Object) -> bool {
+    let cs = doc.resolve(cs);
+    match &*cs {
+        Object::Name(n) => matches!(n.as_slice(), b"DeviceGray" | b"G" | b"CalGray" | b"Indexed" | b"I"),
+        Object::Array(a) => match a.first().and_then(Object::as_name) {
+            Some(b"CalGray" | b"Separation" | b"Indexed" | b"I") => true,
+            Some(b"ICCBased") => a.get(1).is_some_and(|icc| matches!(&*doc.resolve(icc), Object::Stream(s) if s.dict.int(b"N") == Some(1))),
+            Some(b"DeviceN") => a.get(1).is_some_and(|names| doc.resolve(names).as_array().is_some_and(|n| n.len() == 1)),
+            _ => false,
+        },
+        _ => false,
+    }
+}
+
+/// A black-and-white image (one bit per pixel, or an image mask) stored again as CCITT Group 4,
+/// if `compression` asks for that and the result is smaller as stored. Only images whose samples
+/// PdfCraft decodes (no filter, or general-purpose filters: image codecs don't decode here)
+/// qualify. The samples decode to the same bits, so the colour space, decode array and masks stay
+/// as they are.
+fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stream> {
+    if compression != MonoCompression::CcittG4 {
+        return None;
+    }
+    let d = &s.dict;
+    let bits = d.int(b"BitsPerComponent");
+    let qualifies = if matches!(d.get(b"ImageMask"), Some(Object::Bool(true))) {
+        bits.is_none_or(|b| b == 1)
+    } else {
+        bits == Some(1) && d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs))
+    };
+    if !qualifies {
+        return None;
+    }
+    let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
+    if w == 0 || h == 0 || w > pdfcraft_filters::MAX_G4_COLUMNS || u64::from(w) * u64::from(h) > MAX_PIXELS {
+        return None;
+    }
+    let g4 = pdfcraft_filters::encode_g4(&s.decoded().ok()?, w, h).ok()?;
+    let mut new = d.clone();
+    for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
+        new.remove(k);
+    }
+    let mut parms = Dict::new();
+    parms.set(b"K".to_vec(), Object::Int(-1));
+    parms.set(b"Columns".to_vec(), Object::Int(i64::from(w)));
+    parms.set(b"Rows".to_vec(), Object::Int(i64::from(h)));
+    new.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+    new.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+    let new = Stream::from_raw(new, g4);
+    // Smaller as stored, counting the larger dictionary: a tiny image can lose by it.
+    (crate::stored_len(&new)? < crate::stored_len(s)?).then_some(new)
+}
+
 pub(crate) fn run(
     doc: &mut Document,
     pages: &[ObjRef],
@@ -558,6 +613,13 @@ pub(crate) fn run(
         let obj = doc.get(r);
         let Object::Stream(s) = &*obj else { continue };
         report.images += 1;
+        if let Some(new) = mono(doc, s, settings.mono) {
+            report.image_bytes_before += s.raw.len();
+            report.image_bytes_after += new.raw.len();
+            report.images_recompressed += 1;
+            doc.set(r, Object::Stream(new));
+            continue;
+        }
         let Some(n) = s.dict.get(b"ColorSpace").and_then(|cs| components(doc, cs)) else { continue };
         let st = if n == 1 { &settings.gray } else { &settings.color };
         let Some((new, smask)) = process(doc, s, ppi, st, n) else { continue };
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index 9f9fcdf2be..f4f7baf988 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -10,7 +10,8 @@
 //!   A new image replaces the old one only if it is smaller. Images PdfCraft can't decode
 //!   faithfully (CMYK and other colour spaces, masks, decode arrays other than the default,
 //!   JPEG 2000, JBIG2, CCITT, other than 8 bits, JPEGs whose Adobe marker and `/ColorTransform`
-//!   disagree) are left alone.
+//!   disagree) are left alone. Black-and-white (1-bit) images are stored again as CCITT Group 4,
+//!   losslessly, when that is smaller.
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings.
 //! - **Clean up:** drop images and forms that pages list but never draw (such as a deleted
@@ -118,6 +119,15 @@ pub enum Compression {
     Retain,
 }
 
+/// How black-and-white (1-bit) images are stored.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum MonoCompression {
+    /// CCITT Group 4 (lossless), when smaller than the image as it is.
+    CcittG4,
+    /// Keep each image's own compression.
+    Retain,
+}
+
 /// Acrobat's JPEG quality steps.
 pub const QUALITIES: [(&str, u8); 5] = [("Minimum", 25), ("Low", 45), ("Medium", 60), ("High", 80), ("Maximum", 95)];
 
@@ -147,6 +157,8 @@ pub struct Settings {
     pub merge_fragments: bool,
     pub color: ImageSettings,
     pub gray: ImageSettings,
+    /// Black-and-white (1-bit) images, and image masks.
+    pub mono: MonoCompression,
     pub discard_thumbnails: bool,
     pub discard_alternate_images: bool,
     pub discard_tags: bool,
@@ -181,6 +193,7 @@ impl Default for Settings {
             merge_fragments: true,
             color: ImageSettings::REDUCE,
             gray: ImageSettings::REDUCE,
+            mono: MonoCompression::CcittG4,
             discard_thumbnails: true,
             discard_alternate_images: true,
             discard_tags: false,
@@ -539,7 +552,7 @@ fn strip_ascii_wrapper(s: &Stream) -> Option<Stream> {
 
 /// Bytes the stream object takes in the file: its dictionary with `/Length` set as the writer
 /// sets it, then its data.
-fn stored_len(s: &Stream) -> Option<usize> {
+pub(crate) fn stored_len(s: &Stream) -> Option<usize> {
     let mut dict = s.dict.clone();
     dict.set(b"Length".to_vec(), Object::Int(i64::try_from(s.raw.len()).ok()?));
     let mut out = Vec::new();
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 3e69e27cb9..8c0afe89e7 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -5,7 +5,7 @@ use std::sync::Arc;
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, SaveOptions, Stream, write_full};
 use pdfcraft_filters::{Filter, Params};
 use pdfcraft_optimize::{
-    Compatibility, Compression, ImageSettings, OptimizeError, Settings, SpaceCategory, audit_space, effective_resolutions, optimize,
+    Compatibility, Compression, ImageSettings, MonoCompression, OptimizeError, Settings, SpaceCategory, audit_space, effective_resolutions, optimize,
 };
 
 fn image(doc: &mut Document, w: u32, h: u32, n: usize, jpeg: bool, smask: Option<ObjRef>) -> ObjRef {
@@ -218,6 +218,189 @@ fn an_identity_decode_array_does_not_stop_reduce() {
     assert_eq!(stream(&doc, odd).dict.int(b"Width"), Some(900));
 }
 
+/// Rows of `w` 1-bit samples (1 white, 0 black), each starting on a byte: lines of text-like
+/// glyphs; or, with `noise`, random bits.
+fn bilevel(w: u32, h: u32, noise: bool) -> Vec<u8> {
+    let stride = (w as usize).div_ceil(8);
+    let mut data = vec![0xFF; stride * h as usize];
+    let mut seed = 0x9E37_79B9_7F4A_7C15u64;
+    let mut next = move || {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        seed
+    };
+    let mut black = |x: usize, y: usize| {
+        if x < w as usize && y < h as usize {
+            data[y * stride + x / 8] &= !(0x80 >> (x % 8));
+        }
+    };
+    if noise {
+        for y in 0..h as usize {
+            for x in 0..w as usize {
+                if next() & 1 == 0 {
+                    black(x, y);
+                }
+            }
+        }
+        return data;
+    }
+    // Lines 24 rows apart, of glyphs drawn from a few shapes (a stem, a bowl, an arch, a dotted
+    // stem) at any column, 1–3 columns apart with a wider gap between words: text as a scanner
+    // sees it. Clean, identical rows would favour Flate; a scan's ragged edges favour Group 4.
+    for line in (4..h as usize).step_by(24) {
+        let mut x = 8;
+        while x + 16 < w as usize {
+            let wide = 5 + (next() % 4) as usize;
+            let shape = next() % 4;
+            // Now and then a row of a stroke is a column wider or narrower at an edge, as a scan's
+            // edges are.
+            let mut ragged = || match next() % 8 {
+                0 => 0,
+                1 => 2,
+                _ => 1,
+            };
+            let mut fill = |x0: usize, x1: usize, y0: usize, y1: usize| {
+                for y in line + y0..line + y1 {
+                    let (left, right) = ((x + x0 + 1).saturating_sub(ragged()), x + x1 + ragged());
+                    for xx in left..right.saturating_sub(1) {
+                        black(xx, y);
+                    }
+                }
+            };
+            match shape {
+                0 => fill(0, 2, 0, 14),
+                1 => {
+                    fill(0, wide, 4, 6);
+                    fill(0, wide, 12, 14);
+                    fill(0, 2, 4, 14);
+                    fill(wide - 2, wide, 4, 14);
+                }
+                2 => {
+                    fill(0, 2, 4, 14);
+                    fill(wide - 2, wide, 6, 14);
+                    fill(0, wide - 1, 4, 6);
+                }
+                _ => {
+                    fill(0, 2, 7, 14);
+                    fill(0, 2, 2, 4);
+                }
+            }
+            x += wide + 2 + (next() % 2) as usize + if next() % 6 == 0 { 7 } else { 0 };
+        }
+    }
+    data
+}
+
+/// A 1-bit image of `data`, Flate-compressed (with `predictor`, a PNG predictor, if any), with
+/// `entries` added to its dictionary.
+fn mono_image(doc: &mut Document, w: u32, h: u32, data: &[u8], predictor: Option<i64>, entries: &[(&str, Object)]) -> ObjRef {
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("XObject"));
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w as i64));
+    d.set(b"Height".to_vec(), Object::Int(h as i64));
+    for (k, v) in entries {
+        d.set(k.as_bytes().to_vec(), v.clone());
+    }
+    let s = match predictor {
+        None => Stream::flate(d, data),
+        Some(predictor) => {
+            let params = pdfcraft_filters::Params { predictor, colors: 1, bits_per_component: 1, columns: w as i64, early_change: 1 };
+            let mut parms = Dict::new();
+            parms.set(b"Predictor".to_vec(), Object::Int(predictor));
+            parms.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+            parms.set(b"Columns".to_vec(), Object::Int(w as i64));
+            d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+            d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+            Stream::from_raw(d, pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, data).unwrap())
+        }
+    };
+    doc.add(Object::Stream(s))
+}
+
+fn render(doc: &Document) -> Vec<u8> {
+    let bytes = write_full(doc, &SaveOptions::default()).unwrap();
+    let mut r = pdfcraft_render::PageRenderer::new(Arc::new(bytes), pdfcraft_render::RenderConfig::default());
+    let out = r.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+    assert!(out.error.is_none(), "{:?}", out.error);
+    out.rgba.to_vec()
+}
+
+/// Black-and-white images become CCITT Group 4, losslessly: the page looks the same to the pixel.
+/// Grey, an image mask (with a decode array that inverts it), an indexed image of two colours and
+/// one stored with a PNG predictor qualify; noise (bigger as G4), a 1-bit RGB image, one wider
+/// than Group 4 encodes and a tiny one (bigger as stored) are left alone, as is everything with
+/// `mono: Retain`.
+#[test]
+fn black_and_white_images_become_ccitt_group_4() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200, 480);
+    let text = bilevel(w, h, false);
+    let gray = mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let decode = Object::Array(vec![1.into(), 0.into()]);
+    let mask = mono_image(&mut doc, w, h, &text, None, &[("ImageMask", Object::Bool(true)), ("Decode", decode.clone())]);
+    let indexed_cs = Object::Array(vec![
+        Object::name("Indexed"),
+        Object::name("DeviceRGB"),
+        1.into(),
+        Object::String(pdfcraft_cos::PdfString::literal(vec![0xC0, 0x10, 0x10, 0xF8, 0xF0, 0xE0])),
+    ]);
+    let indexed = mono_image(&mut doc, w, h, &text, None, &[("BitsPerComponent", 1.into()), ("ColorSpace", indexed_cs.clone())]);
+    let predicted = mono_image(&mut doc, w, h, &text, Some(15), &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let noise =
+        mono_image(&mut doc, 400, 200, &bilevel(400, 200, true), None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let rgb = mono_image(
+        &mut doc,
+        400,
+        160,
+        &bilevel(1200, 160, false),
+        None,
+        &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceRGB"))],
+    );
+    let wide = mono_image(
+        &mut doc,
+        40_000,
+        2,
+        &bilevel(40_000, 2, false),
+        None,
+        &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))],
+    );
+    // 64 × 8 white: its Group 4 data is smaller than its Flate data, but not by the longer
+    // dictionary Group 4 needs.
+    let tiny = mono_image(&mut doc, 64, 8, &[0xFF; 64], None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let tiny_g4 = pdfcraft_filters::encode_g4(&[0xFF; 64], 64, 8).unwrap();
+    assert!(tiny_g4.len() < stream(&doc, tiny).raw.len(), "{} against {}", tiny_g4.len(), stream(&doc, tiny).raw.len());
+    page(
+        &mut doc,
+        &[("G", gray), ("M", mask), ("I", indexed), ("P", predicted), ("N", noise), ("R", rgb), ("W", wide), ("T", tiny)],
+        "q 300 0 0 120 20 660 cm /G Do Q q 0 0.4 0.8 rg 300 0 0 120 320 660 cm /M Do Q q 300 0 0 120 20 520 cm /I Do Q \
+         q 300 0 0 120 320 520 cm /P Do Q q 200 0 0 100 20 400 cm /N Do Q q 200 0 0 80 240 400 cm /R Do Q q 560 0 0 4 20 380 cm /W Do Q q 64 0 0 8 460 400 cm /T Do Q",
+    );
+    let before = render(&doc);
+    let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
+    let untouched = [noise, rgb, wide, tiny].map(|r| raw(&doc, r));
+
+    let mut kept = doc.clone();
+    let r = optimize(&mut kept, &Settings { mono: MonoCompression::Retain, ..Settings::default() }).unwrap();
+    assert_eq!(r.images_recompressed, 0, "Retain keeps every image as it is");
+    assert!([gray, mask, indexed, predicted].iter().all(|i| raw(&kept, *i) == raw(&doc, *i)));
+
+    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(r.images_recompressed, 4);
+    assert!(r.image_bytes_after < r.image_bytes_before, "{} → {}", r.image_bytes_before, r.image_bytes_after);
+    for i in [gray, mask, indexed, predicted] {
+        let s = stream(&doc, i);
+        assert_eq!(s.dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
+        let parms = s.dict.get(b"DecodeParms").and_then(Object::as_dict).cloned().unwrap();
+        assert_eq!((parms.int(b"K"), parms.int(b"Columns"), parms.int(b"Rows")), (Some(-1), Some(w as i64), Some(h as i64)));
+    }
+    assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
+    assert_eq!(stream(&doc, indexed).dict.get(b"ColorSpace"), Some(&indexed_cs), "the colour space stays");
+    assert_eq!([noise, rgb, wide, tiny].map(|r| raw(&doc, r)), untouched);
+    assert!(render(&doc) == before, "the page looks the same");
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 3e6d735523..4f43912938 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -597,6 +597,8 @@
 	Clean Up	تنظيف
 	Color Images	الصور الملونة
 	Grayscale Images	الصور الرمادية
+	Monochrome Images	الصور أحادية اللون
+	CCITT Group 4	CCITT المجموعة 4
 	Bicubic downsampling to	تقليل العينات بطريقة Bicubic إلى
 	for images above	للصور التي تتجاوز
 	Compression	الضغط
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index ec0339f18a..9464683b36 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -259,6 +259,8 @@
 	Clean Up	Почистване
 	Color Images	Цветни изображения
 	Grayscale Images	Изображения в сива скала
+	Monochrome Images	Монохромни изображения
+	CCITT Group 4	CCITT група 4
 	Bicubic downsampling to	Бикубично понижаване на резолюцията до
 	for images above	за изображения над
 	Compression	Компресия
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 0cacae3c2c..c7d351ac13 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -560,6 +560,8 @@
 	Clean Up	Neteja
 	Color Images	Imatges en color
 	Grayscale Images	Imatges en escala de grisos
+	Monochrome Images	Imatges monocromes
+	CCITT Group 4	CCITT grup 4
 	Bicubic downsampling to	Reducció bicúbica de resolució a
 	for images above	per a imatges de més de
 	Compression	Compressió
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index 71c0c62869..c5fa4b6967 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -567,6 +567,8 @@
 	Clean Up	پاککردنەوە
 	Color Images	وێنە ڕەنگاوڕەنگەکان
 	Grayscale Images	وێنە خۆڵەمێشییەکان
+	Monochrome Images	وێنە یەکڕەنگەکان
+	CCITT Group 4	CCITT گرووپی 4
 	Bicubic downsampling to	کەمکردنەوەی نموونە بە شێوازی Bicubic بۆ
 	for images above	بۆ ئەو وێنانەی سەرووی
 	Compression	پەستاندن
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index ed6d051b57..342f762378 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -681,6 +681,8 @@ key	Space	Mezerník
 	Clean Up	Vyčištění
 	Color Images	Barevné obrázky
 	Grayscale Images	Obrázky ve stupních šedi
+	Monochrome Images	Monochromatické obrázky
+	CCITT Group 4	CCITT skupina 4
 	Bicubic downsampling to	Bikubické převzorkování na
 	for images above	u obrázků nad
 	Compression	Komprese
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 8586a21d43..71163b6b96 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -570,6 +570,8 @@
 	Clean Up	Aufräumen
 	Color Images	Farbbilder
 	Grayscale Images	Graustufenbilder
+	Monochrome Images	Monochrome Bilder
+	CCITT Group 4	CCITT Gruppe 4
 	Bicubic downsampling to	Bikubische Neuberechnung auf
 	for images above	für Bilder über
 	Compression	Komprimierung
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index e3eac77caa..13f762d6ca 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -1906,6 +1906,8 @@
 	Clean Up	Εκκαθάριση
 	Color Images	Έγχρωμες εικόνες
 	Grayscale Images	Εικόνες σε κλίμακα του γκρι
+	Monochrome Images	Μονόχρωμες εικόνες
+	CCITT Group 4	CCITT Ομάδα 4
 	Bicubic downsampling to	Δικυβική μείωση ανάλυσης σε
 	for images above	για εικόνες πάνω από
 	ZIP	ZIP
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 0d4e505a70..0457264377 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -593,6 +593,8 @@
 	Clean Up	Limpieza
 	Color Images	Imágenes en color
 	Grayscale Images	Imágenes en escala de grises
+	Monochrome Images	Imágenes monocromas
+	CCITT Group 4	CCITT grupo 4
 	Bicubic downsampling to	Reducción de resolución bicúbica a
 	for images above	para imágenes por encima de
 	Compression	Compresión
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index a542ee9b91..5bd26bff11 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -560,6 +560,8 @@
 	Clean Up	Siivoa
 	Color Images	Värikuvat
 	Grayscale Images	Harmaasävykuvat
+	Monochrome Images	Mustavalkokuvat
+	CCITT Group 4	CCITT ryhmä 4
 	Bicubic downsampling to	Bikuubinen alinäytteistys tarkkuuteen
 	for images above	kuville, joiden tarkkuus yli
 	Compression	Pakkaus
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 61c8b5171d..b5434915af 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -570,6 +570,8 @@
 	Clean Up	Nettoyer
 	Color Images	Images couleur
 	Grayscale Images	Images en niveaux de gris
+	Monochrome Images	Images monochromes
+	CCITT Group 4	CCITT groupe 4
 	Bicubic downsampling to	Sous-échantillonnage bicubique à
 	for images above	pour les images au-dessus de
 	Compression	Compression
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index e9d627aca9..30aa915af7 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -544,6 +544,8 @@
 	Clean Up	सफ़ाई
 	Color Images	रंगीन छवियाँ
 	Grayscale Images	ग्रेस्केल छवियाँ
+	Monochrome Images	मोनोक्रोम छवियाँ
+	CCITT Group 4	CCITT समूह 4
 	Bicubic downsampling to	बाइक्यूबिक डाउनसैंपलिंग तक
 	for images above	इससे बड़ी छवियों के लिए
 	Compression	संपीड़न
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 6b37b9169b..b7e494ab0c 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -568,6 +568,8 @@
 	Clean Up	Tisztítás
 	Color Images	Színes képek
 	Grayscale Images	Szürkeárnyalatos képek
+	Monochrome Images	Monokróm képek
+	CCITT Group 4	CCITT 4. csoport
 	Bicubic downsampling to	Kettős köbös újramintázás erre
 	for images above	az ennél nagyobb képeknél
 	Compression	Tömörítés
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 292b336e10..c87527fee3 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -2055,6 +2055,8 @@ comment menu	Edit	Edit
 	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Rumus dan elemen non-teks serupa memerlukan teks alternatif. Tambahkan teks alternatif ke elemen tersebut.
 	Gray	Abu-abu
 	Grayscale Images	Gambar Skala Abu-abu
+	Monochrome Images	Gambar Monokrom
+	CCITT Group 4	CCITT Grup 4
 	Green	Hijau
 	Green on black	Hijau di atas hitam
 	H / Space (hold)	H / Space (tahan)
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 20729bae6a..62b012f091 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -594,6 +594,8 @@
 	Clean Up	Pulizia
 	Color Images	Immagini a colori
 	Grayscale Images	Immagini in scala di grigi
+	Monochrome Images	Immagini monocromatiche
+	CCITT Group 4	CCITT gruppo 4
 	Bicubic downsampling to	Sottocampionamento bicubico a
 	for images above	per immagini oltre
 	Compression	Compressione
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 1ed4d43b6c..beb3002eb6 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -597,6 +597,8 @@
 	Clean Up	クリーンアップ
 	Color Images	カラー画像
 	Grayscale Images	グレースケール画像
+	Monochrome Images	白黒画像
+	CCITT Group 4	CCITT グループ 4
 	Bicubic downsampling to	バイキュービック法でダウンサンプル:
 	for images above	対象画像の解像度:
 	Compression	圧縮
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 9022c3591c..08a390dade 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -557,6 +557,8 @@
 	Clean Up	Тазалау
 	Color Images	Түсті кескіндер
 	Grayscale Images	Сұр реңкті кескіндер
+	Monochrome Images	Монохромды кескіндер
+	CCITT Group 4	CCITT 4-топ
 	Bicubic downsampling to	Бикубтық төмендету
 	for images above	мұнан асатын кескіндер үшін
 	Compression	Сығымдау
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 09b9cad9fa..1b6dcc99ee 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -544,6 +544,8 @@
 	Clean Up	정리
 	Color Images	컬러 이미지
 	Grayscale Images	회색조 이미지
+	Monochrome Images	흑백 이미지
+	CCITT Group 4	CCITT 그룹 4
 	Bicubic downsampling to	다음 값으로 바이큐빅 다운샘플링
 	for images above	다음 값을 초과하는 이미지에 적용
 	Compression	압축
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index 964467d823..168fccb36e 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -565,6 +565,8 @@
 	Clean Up	ອະນາໄມ
 	Color Images	ຮູບພາບສີ
 	Grayscale Images	ຮູບພາບລະດັບສີເທົາ
+	Monochrome Images	ຮູບພາບຂາວດຳ
+	CCITT Group 4	CCITT ກຸ່ມ 4
 	Bicubic downsampling to	ຫຼຸດຄວາມລະອຽດແບບ Bicubic ລົງເປັນ:
 	for images above	ສຳລັບຮູບພາບທີ່ເກີນ:
 	Compression	ການບີບອັດ
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 43749f4ec8..33ffe03418 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -2123,6 +2123,8 @@ comment menu	Edit	Redaguoti
 	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Formulėms ir panašiems netekstiniams elementams reikia alternatyviojo teksto. Pridėkite jį.
 	Gray	Pilka
 	Grayscale Images	Pilkų atspalvių paveikslėliai
+	Monochrome Images	Vienspalviai paveikslėliai
+	CCITT Group 4	CCITT 4 grupė
 	Green	Žalia
 	Green on black	Žalia juodame fone
 	H / Space (hold)	H / tarpo klavišas (laikyti)
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index 6f1739974a..f3f37a1afa 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -2060,6 +2060,8 @@
 	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Formler og lignende elementer som ikke er tekst, trenger alternativ tekst. Legg til alternativ tekst på dem.
 	Gray	Grå
 	Grayscale Images	Gråtonebilder
+	Monochrome Images	Svart-hvitt-bilder
+	CCITT Group 4	CCITT gruppe 4
 	Green	Grønn
 	Green on black	Grønn på svart
 	H / Space (hold)	H / Mellomrom (hold)
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 963d717584..0dd3604189 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -592,6 +592,8 @@
 	Clean Up	Porządkowanie
 	Color Images	Obrazy kolorowe
 	Grayscale Images	Obrazy w skali szarości
+	Monochrome Images	Obrazy monochromatyczne
+	CCITT Group 4	CCITT grupa 4
 	Bicubic downsampling to	Zmniejsz rozdzielczość metodą dwusześcienną do
 	for images above	dla obrazów powyżej
 	Compression	Kompresja
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index c34ae83bc5..6ab4ec9d85 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -216,6 +216,8 @@
 	Clean Up	Limpar
 	Color Images	Imagens coloridas
 	Grayscale Images	Imagens em escala de cinza
+	Monochrome Images	Imagens monocromáticas
+	CCITT Group 4	CCITT grupo 4
 	Bicubic downsampling to	Redução bicúbica de amostragem para
 	for images above	para imagens acima de
 	Compression	Compactação
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 78d2298b93..0b0050a4f1 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -2066,6 +2066,8 @@ comment menu	Edit	Editare
 	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Formulele și alte elemente non-text similare au nevoie de text alternativ. Adăugați-le text alternativ.
 	Gray	Gri
 	Grayscale Images	Imagini în tonuri de gri
+	Monochrome Images	Imagini monocrome
+	CCITT Group 4	CCITT grupa 4
 	Green	Verde
 	Green on black	Verde pe negru
 	H / Space (hold)	H / Spațiu (ținut apăsat)
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 274232d586..f9a17709ba 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -590,6 +590,8 @@
 	Clean Up	Очистить
 	Color Images	Цветные изображения
 	Grayscale Images	Изображения в оттенках серого
+	Monochrome Images	Монохромные изображения
+	CCITT Group 4	CCITT группа 4
 	Bicubic downsampling to	Бикубическое уменьшение до
 	for images above	для изображений выше
 	Compression	Сжатие
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 420e6a5996..83790b055e 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -891,6 +891,8 @@
 	Grab bag	Razno
 	Gray	Siva
 	Grayscale Images	Sivinske slike
+	Monochrome Images	Enobarvne slike
+	CCITT Group 4	CCITT skupina 4
 	Green	Zelena
 	H / Space (hold)	H / preslednica (drži)
 	HTML web page	Spletna stran HTML
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index ba7c9dc5b3..cc899a668a 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -880,6 +880,8 @@
 	Grab bag	Të ndryshme
 	Gray	Gri
 	Grayscale Images	Imazhe në nuanca gri
+	Monochrome Images	Imazhe bardhezi
+	CCITT Group 4	CCITT grupi 4
 	Green	Jeshile
 	H / Space (hold)	H / Hapësira (mbaje shtypur)
 	HTML web page	Faqe interneti HTML
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 7f339989ee..43a2782674 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -574,6 +574,8 @@ comment menu	Edit	సవరించు
 	Clean Up	చక్కదిద్దడం
 	Color Images	రంగు చిత్రాలు
 	Grayscale Images	గ్రేస్కేల్ చిత్రాలు
+	Monochrome Images	మోనోక్రోమ్ చిత్రాలు
+	CCITT Group 4	CCITT గ్రూప్ 4
 	Bicubic downsampling to	బైక్యూబిక్ డౌన్‌శాంప్లింగ్, లక్ష్యం:
 	for images above	ఈ రిజల్యూషన్ మించిన చిత్రాలకు:
 	Compression	కుదింపు
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index 2c9b892ed7..4eeeb6f951 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -554,6 +554,8 @@
 	Clean Up	ล้างข้อมูล
 	Color Images	รูปภาพสี
 	Grayscale Images	รูปภาพระดับสีเทา
+	Monochrome Images	รูปภาพขาวดำ
+	CCITT Group 4	CCITT กลุ่ม 4
 	Bicubic downsampling to	ลดความละเอียดแบบ Bicubic เป็น
 	for images above	สำหรับรูปภาพที่สูงกว่า
 	Compression	การบีบอัด
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index a2ecaea179..d5124513cf 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -555,6 +555,8 @@
 	Clean Up	Temizle
 	Color Images	Renkli Resimler
 	Grayscale Images	Gri Tonlamalı Resimler
+	Monochrome Images	Tek Renkli Resimler
+	CCITT Group 4	CCITT Grup 4
 	Bicubic downsampling to	Şu değere bikübik alt örnekleme:
 	for images above	bundan büyük resimler için:
 	Compression	Sıkıştırma
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 9c76868839..8051e42f82 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -595,6 +595,8 @@
 	Clean Up	Очищення
 	Color Images	Кольорові зображення
 	Grayscale Images	Зображення у відтінках сірого
+	Monochrome Images	Монохромні зображення
+	CCITT Group 4	CCITT група 4
 	Bicubic downsampling to	Бікубічне зниження роздільної здатності до
 	for images above	для зображень із роздільною здатністю понад
 	Compression	Стиснення
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 973ba870ea..8703b4c8ee 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -2111,6 +2111,8 @@ comment menu	Edit	Sửa
 	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Công thức và các phần tử không phải văn bản tương tự cần có văn bản thay thế. Hãy thêm văn bản thay thế cho chúng.
 	Gray	Xám
 	Grayscale Images	Ảnh thang xám
+	Monochrome Images	Ảnh đơn sắc
+	CCITT Group 4	CCITT nhóm 4
 	Green	Xanh lá
 	Green on black	Xanh lá trên nền đen
 	H / Space (hold)	H / Space (giữ)
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index d77c8f6425..da2722c7fa 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -265,6 +265,8 @@
 	Clean Up	清理
 	Color Images	彩色图像
 	Grayscale Images	灰度图像
+	Monochrome Images	单色图像
+	CCITT Group 4	CCITT 第 4 组
 	Bicubic downsampling to	双三次降采样至
 	for images above	（高于此分辨率的图像）
 	Compression	压缩
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index ce3b939f1d..8f42d9da3b 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -221,6 +221,8 @@
 	Clean Up	清理
 	Color Images	彩色圖片
 	Grayscale Images	灰階圖片
+	Monochrome Images	單色圖片
+	CCITT Group 4	CCITT 第 4 組
 	Bicubic downsampling to	雙三次降取樣至
 	for images above	（高於此解析度的圖片）
 	Compression	壓縮
diff --git a/crates/ui-egui/src/workflows/optimize_ui.rs b/crates/ui-egui/src/workflows/optimize_ui.rs
index 3bb80ac439..d3a5cfd4a1 100644
--- a/crates/ui-egui/src/workflows/optimize_ui.rs
+++ b/crates/ui-egui/src/workflows/optimize_ui.rs
@@ -8,7 +8,7 @@
 use std::sync::{Arc, Mutex};
 
 use egui::{Align, Layout, RichText};
-use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, Preset, QUALITIES, Settings};
+use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, MonoCompression, Preset, QUALITIES, Settings};
 use pdfcraft_engine::optimizer::{OptimizeStage, Optimized};
 use pdfcraft_engine::{DocId, EditError, Hidden, OptimizeReport};
 
@@ -143,6 +143,23 @@ fn image_row(ui: &mut egui::Ui, id: &str, title: &str, s: &mut ImageSettings) {
     ui.add_space(8.0);
 }
 
+/// Monochrome Images: how 1-bit images and image masks are stored.
+fn mono_row(ui: &mut egui::Ui, m: &mut MonoCompression) {
+    ui.label(egui::RichText::new(tl!("Monochrome Images")).font(theme::semibold(13.0)));
+    ui.horizontal(|ui| {
+        ui.label(tl!("Compression"));
+        let label = match m {
+            MonoCompression::CcittG4 => tl!("CCITT Group 4"),
+            MonoCompression::Retain => tl!("Retain existing"),
+        };
+        craft_ui::ComboBox::from_id_salt(("mono", "compression")).selected_text(label).show_ui(ui, |ui| {
+            ui.selectable_value(m, MonoCompression::CcittG4, tl!("CCITT Group 4"));
+            ui.selectable_value(m, MonoCompression::Retain, tl!("Retain existing"));
+        });
+    });
+    ui.add_space(8.0);
+}
+
 fn discard_box(ui: &mut egui::Ui, list: &mut Vec<Hidden>, h: Hidden, label: &str) {
     let mut on = list.contains(&h);
     if ui.add(widgets::checkbox(&mut on, tl!(label))).changed() {
@@ -205,6 +222,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut OptimizeDraft, t: &Tokens) -> (boo
             ui.add(widgets::checkbox(&mut s.merge_fragments, tl!("Merge image fragments")));
             image_row(ui, "color", "Color Images", &mut s.color);
             image_row(ui, "gray", "Grayscale Images", &mut s.gray);
+            mono_row(ui, &mut s.mono);
             ui.label(
                 egui::RichText::new(tl!("Each image is measured where pages draw it; an image is replaced only if the result is smaller."))
                     .small()
diff --git a/crates/ui-egui/tests/it/create.rs b/crates/ui-egui/tests/it/create.rs
index a1f368922d..22ac8503e7 100644
--- a/crates/ui-egui/tests/it/create.rs
+++ b/crates/ui-egui/tests/it/create.rs
@@ -187,6 +187,8 @@ fn the_pdf_optimizer_dialog_saves_an_optimized_copy() {
     h.run_steps(2);
     h.get_by_label("PDF Optimizer");
     h.get_by_label("Color Images");
+    h.get_by_label("Monochrome Images");
+    assert_eq!(h.state().optimize_draft.settings.mono, pdfcraft_engine::optimize::MonoCompression::CcittG4);
     h.get_by_label("Discard Objects").click();
     h.run_steps(2);
     h.get_by_label("Discard document tags").click();
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 25205e92c1..9a2a42dacc 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,6 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
+> **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
 
@@ -255,6 +256,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
 | 2026-10-23 | minor | M8, #3205 follow-up: phone-pattern redaction includes the +39 country code on labelled Italian geographic numbers with a slash; dates, protocol identifiers and whole-run guards remain. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 3b8dba920c..daffc88188 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7325,7 +7325,7 @@ status = "shipped"
 commands = ["optimize.reduce"]
 tools = ["doc_reduce"]
 evidence = ["crates/ui-egui/tests/it/create.rs::reduce_file_size_writes_a_compact_copy", "crates/ui-egui/tests/it/create.rs::reduce_file_size_saves_nothing_when_the_file_is_already_small", "crates/engine/src/tests.rs::create_and_reduce", "crates/automation/tests/it/automation.rs::creating_and_reducing_through_tools", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::an_identity_decode_array_does_not_stop_reduce"]
-notes = "images above 225 ppi to 150 ppi JPEG medium (after merging page pictures printed as one-pixel strips into one image), thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
+notes = "images above 225 ppi to 150 ppi JPEG medium (after merging page pictures printed as one-pixel strips into one image), black-and-white images to CCITT Group 4 when that is smaller, thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
 
 [[feature]]
 id = "optimize.compatibility-level"
@@ -7381,11 +7381,11 @@ title = "Monochrome compression (JBIG2, CCITT G4)"
 area = "K"
 tier = "P1"
 milestone = "M11"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["optimize.advanced", "optimize.reduce"]
+tools = ["doc_optimize", "doc_reduce"]
+evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 0a5f8bce2d22b32dbb57cab17cbd9fd53c9063d1 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Fri, 23 Oct 2026 21:57:34 +0200
Subject: [PATCH 075/132] M11: black-and-white images: only DeviceGray counts
 as a one-component name; refuse a malformed mono

A bare /Indexed, /I or /CalGray is no colour space on its own, so it can
only name a resource, which might be RGB: such an image is now left
alone instead of being read as one bit per pixel. doc_optimize refuses a
mono that isn't an object or a compression that isn't a known name,
instead of reading it as the default (from CodeRabbit's review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/automation/src/documents.rs       | 16 +++++++++-----
 crates/automation/tests/it/automation.rs |  9 ++++----
 crates/optimize/src/images.rs            |  6 +++--
 crates/optimize/tests/optimize.rs        | 28 +++++++++++++++++-------
 4 files changed, 39 insertions(+), 20 deletions(-)

diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index 1b26dec7f1..6e2c0a83f5 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -317,12 +317,16 @@ impl Automation {
         };
         settings.color = images("color", settings.color)?;
         settings.gray = images("gray", settings.gray)?;
-        if let Some(c) = a.get("mono").and_then(|m| m.get("compression")).and_then(Value::as_str) {
-            settings.mono = match c {
-                "ccitt_g4" | "ccitt" | "g4" => MonoCompression::CcittG4,
-                "retain" => MonoCompression::Retain,
-                other => return Err(ToolError::InvalidArgs(format!("unknown mono compression {other:?} (ccitt_g4, retain)"))),
-            };
+        if let Some(mono) = a.get("mono") {
+            let unknown = |c: &Value| ToolError::InvalidArgs(format!("unknown mono compression {c} (ccitt_g4, retain)"));
+            let mono = mono.as_object().ok_or_else(|| ToolError::InvalidArgs("mono must be an object: { compression: ccitt_g4|retain }".into()))?;
+            if let Some(c) = mono.get("compression") {
+                settings.mono = match c.as_str() {
+                    Some("ccitt_g4" | "ccitt" | "g4") => MonoCompression::CcittG4,
+                    Some("retain") => MonoCompression::Retain,
+                    _ => return Err(unknown(c)),
+                };
+            }
         }
         for (key, flag) in [
             ("merge_fragments", &mut settings.merge_fragments),
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index aa4b50d087..8392b6722f 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6455,10 +6455,11 @@ fn doc_optimize_stores_black_and_white_images_as_ccitt_group_4() {
         })
         .collect();
     assert_eq!(filters, [b"CCITTFaxDecode".to_vec()]);
-    assert!(matches!(
-        a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "mono": { "compression": "jbig2" } })),
-        Err(ToolError::InvalidArgs(_))
-    ));
+    // An unknown compression, one that isn't a name, or a mono that isn't an object is refused,
+    // not read as the default.
+    for mono in [json!({ "compression": "jbig2" }), json!({ "compression": false }), json!("retain")] {
+        assert!(matches!(a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "mono": mono })), Err(ToolError::InvalidArgs(_))), "{mono}");
+    }
 }
 
 /// A one-page PDF whose page picture is drawn as `rows` grey images one pixel row high, 600 px
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 0a157b8c33..ad76003074 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -533,11 +533,13 @@ fn process(doc: &Document, s: &Stream, ppi: f64, settings: &ImageSettings, n: us
 }
 
 /// Whether colour space `cs` has one colour component, so a 1-bit image in it has one bit per
-/// pixel: grey, a separation, an indexed space or a DeviceN of one colourant.
+/// pixel: grey, a separation, an indexed space or a DeviceN of one colourant. Of names, only
+/// DeviceGray counts: another name is no colour space on its own (`/Indexed` and `/CalGray` need
+/// their parameters), so it can only name a resource, which might be RGB.
 fn one_component(doc: &Document, cs: &Object) -> bool {
     let cs = doc.resolve(cs);
     match &*cs {
-        Object::Name(n) => matches!(n.as_slice(), b"DeviceGray" | b"G" | b"CalGray" | b"Indexed" | b"I"),
+        Object::Name(n) => matches!(n.as_slice(), b"DeviceGray" | b"G"),
         Object::Array(a) => match a.first().and_then(Object::as_name) {
             Some(b"CalGray" | b"Separation" | b"Indexed" | b"I") => true,
             Some(b"ICCBased") => a.get(1).is_some_and(|icc| matches!(&*doc.resolve(icc), Object::Stream(s) if s.dict.int(b"N") == Some(1))),
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 8c0afe89e7..db32ea7ad2 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -329,9 +329,9 @@ fn render(doc: &Document) -> Vec<u8> {
 
 /// Black-and-white images become CCITT Group 4, losslessly: the page looks the same to the pixel.
 /// Grey, an image mask (with a decode array that inverts it), an indexed image of two colours and
-/// one stored with a PNG predictor qualify; noise (bigger as G4), a 1-bit RGB image, one wider
-/// than Group 4 encodes and a tiny one (bigger as stored) are left alone, as is everything with
-/// `mono: Retain`.
+/// one stored with a PNG predictor qualify; noise (bigger as G4), a 1-bit RGB image, one whose
+/// colour space is a resource name, one wider than Group 4 encodes and a tiny one (bigger as
+/// stored) are left alone, as is everything with `mono: Retain`.
 #[test]
 fn black_and_white_images_become_ccitt_group_4() {
     let mut doc = Document::new_empty();
@@ -366,20 +366,32 @@ fn black_and_white_images_become_ccitt_group_4() {
         None,
         &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))],
     );
+    // A bare /Indexed is no colour space on its own: it names the page's resource, here RGB, so
+    // these samples are three to a pixel.
+    let named =
+        mono_image(&mut doc, 400, 160, &bilevel(1200, 160, false), None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("Indexed"))]);
     // 64 × 8 white: its Group 4 data is smaller than its Flate data, but not by the longer
     // dictionary Group 4 needs.
     let tiny = mono_image(&mut doc, 64, 8, &[0xFF; 64], None, &[("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))]);
     let tiny_g4 = pdfcraft_filters::encode_g4(&[0xFF; 64], 64, 8).unwrap();
     assert!(tiny_g4.len() < stream(&doc, tiny).raw.len(), "{} against {}", tiny_g4.len(), stream(&doc, tiny).raw.len());
-    page(
+    let p = page(
         &mut doc,
-        &[("G", gray), ("M", mask), ("I", indexed), ("P", predicted), ("N", noise), ("R", rgb), ("W", wide), ("T", tiny)],
+        &[("G", gray), ("M", mask), ("I", indexed), ("P", predicted), ("N", noise), ("R", rgb), ("W", wide), ("T", tiny), ("X", named)],
         "q 300 0 0 120 20 660 cm /G Do Q q 0 0.4 0.8 rg 300 0 0 120 320 660 cm /M Do Q q 300 0 0 120 20 520 cm /I Do Q \
-         q 300 0 0 120 320 520 cm /P Do Q q 200 0 0 100 20 400 cm /N Do Q q 200 0 0 80 240 400 cm /R Do Q q 560 0 0 4 20 380 cm /W Do Q q 64 0 0 8 460 400 cm /T Do Q",
+         q 300 0 0 120 320 520 cm /P Do Q q 200 0 0 100 20 400 cm /N Do Q q 200 0 0 80 240 400 cm /R Do Q q 560 0 0 4 20 380 cm /W Do Q q 64 0 0 8 460 400 cm /T Do Q q 200 0 0 80 240 300 cm /X Do Q",
     );
+    doc.update_dict(p, |d| {
+        if let Some(Object::Dict(res)) = d.get_mut(b"Resources") {
+            let mut cs = Dict::new();
+            cs.set(b"Indexed".to_vec(), Object::name("DeviceRGB"));
+            res.set(b"ColorSpace".to_vec(), Object::Dict(cs));
+        }
+    })
+    .unwrap();
     let before = render(&doc);
     let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
-    let untouched = [noise, rgb, wide, tiny].map(|r| raw(&doc, r));
+    let untouched = [noise, rgb, wide, tiny, named].map(|r| raw(&doc, r));
 
     let mut kept = doc.clone();
     let r = optimize(&mut kept, &Settings { mono: MonoCompression::Retain, ..Settings::default() }).unwrap();
@@ -397,7 +409,7 @@ fn black_and_white_images_become_ccitt_group_4() {
     }
     assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
     assert_eq!(stream(&doc, indexed).dict.get(b"ColorSpace"), Some(&indexed_cs), "the colour space stays");
-    assert_eq!([noise, rgb, wide, tiny].map(|r| raw(&doc, r)), untouched);
+    assert_eq!([noise, rgb, wide, tiny, named].map(|r| raw(&doc, r)), untouched);
     assert!(render(&doc) == before, "the page looks the same");
 }
 

From faa582e7f73a65708cde262e5b5d246e1ff6ca1c Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Fri, 23 Oct 2026 23:48:17 +0200
Subject: [PATCH 076/132] M11: doc_optimize refuses an unknown key in mono

A misspelled key ({"mono": {"compresson": "retain"}}) left the preset's
setting in place unnoticed; it is now InvalidArgs (from CodeRabbit's
review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/automation/src/documents.rs       | 4 ++++
 crates/automation/tests/it/automation.rs | 6 +++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index 6e2c0a83f5..40aa4ac522 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -320,6 +320,10 @@ impl Automation {
         if let Some(mono) = a.get("mono") {
             let unknown = |c: &Value| ToolError::InvalidArgs(format!("unknown mono compression {c} (ccitt_g4, retain)"));
             let mono = mono.as_object().ok_or_else(|| ToolError::InvalidArgs("mono must be an object: { compression: ccitt_g4|retain }".into()))?;
+            // A misspelled key would otherwise leave the preset's setting in place unnoticed.
+            if let Some(key) = mono.keys().find(|k| *k != "compression") {
+                return Err(ToolError::InvalidArgs(format!("unknown mono key {key:?} (compression)")));
+            }
             if let Some(c) = mono.get("compression") {
                 settings.mono = match c.as_str() {
                     Some("ccitt_g4" | "ccitt" | "g4") => MonoCompression::CcittG4,
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 8392b6722f..dcd321eddb 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6455,9 +6455,9 @@ fn doc_optimize_stores_black_and_white_images_as_ccitt_group_4() {
         })
         .collect();
     assert_eq!(filters, [b"CCITTFaxDecode".to_vec()]);
-    // An unknown compression, one that isn't a name, or a mono that isn't an object is refused,
-    // not read as the default.
-    for mono in [json!({ "compression": "jbig2" }), json!({ "compression": false }), json!("retain")] {
+    // An unknown compression, one that isn't a name, a misspelled key, or a mono that isn't an
+    // object is refused, not read as the default.
+    for mono in [json!({ "compression": "jbig2" }), json!({ "compression": false }), json!({ "compresson": "retain" }), json!("retain")] {
         assert!(matches!(a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "mono": mono })), Err(ToolError::InvalidArgs(_))), "{mono}");
     }
 }

From 7add9b38e3d9979daf05f06fedb9db745e7d540c Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 11:14:54 +0200
Subject: [PATCH 077/132] M11: the optimizer reads images through /DecodeParms
 given by reference

Stream::decoded reads only direct parameter dictionaries, so an image
whose /DecodeParms is a reference (whole, or as array entries) was
decoded without its predictor. For a 1-bit image with a PNG predictor
the rows came out shifted by their tag bytes, Group 4 of that was still
smaller, and the picture was replaced by a skewed one; resampling and
merging image strips read the same way.

pdfcraft_cos::Document::with_direct_parms gives the stream with the
parameters its filters use made direct: only the entries at the
filters' places, and none for a chain longer than any decoder takes,
so at most MAX_CHAIN objects are copied. The optimizer's pixels() and
the Group 4 step decode through it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/cos/README.md               |  1 +
 crates/cos/src/document.rs         |  3 +-
 crates/cos/src/document/objects.rs | 35 +++++++++++++++++++++-
 crates/cos/src/document/tests.rs   | 36 ++++++++++++++++++++++
 crates/optimize/README.md          |  4 ++-
 crates/optimize/src/images.rs      |  9 ++++--
 crates/optimize/tests/optimize.rs  | 48 ++++++++++++++++++++++++++++++
 7 files changed, 130 insertions(+), 6 deletions(-)

diff --git a/crates/cos/README.md b/crates/cos/README.md
index ab382219d5..89b6826a8a 100644
--- a/crates/cos/README.md
+++ b/crates/cos/README.md
@@ -24,6 +24,7 @@ let obj  = doc.get(ObjRef { num: 12, gen: 0 });      // load (and cache): Arc<Ob
 let real = doc.resolve(&obj);                        // follow one indirect reference
 let d    = doc.dict(&obj);                           // Option<Dict>, resolving first
 let data = stream.decoded()?;                        // filters applied on demand
+let data = doc.with_direct_parms(&stream).decoded()?; // /DecodeParms given by reference too
 
 doc.set(r, Object::Dict(d));                         // edit: lands in the overlay
 let r = doc.add(obj);                                // append a new object
diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index 0fac1591a9..4c7748cc95 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -5,11 +5,12 @@
 //! Edits never touch the original bytes; the writer appends them (incremental save) or rewrites
 //! the file (full save).
 
+use std::borrow::Cow;
 use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::{Arc, Mutex, Weak};
 
 use crate::CosError;
-use crate::object::{Dict, ObjRef, Object};
+use crate::object::{Dict, ObjRef, Object, Stream};
 use crate::parser::{EndstreamIndex, Lexer, is_whitespace, parse_indirect, parse_indirect_shared};
 
 mod objects;
diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index 8744a3ea3e..039f3dd101 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -1,7 +1,7 @@
 use super::reader::find;
 use super::state::{LENGTHS, LoadGuard, ObjStm, ObjectReader, ReadState, Slot, SourceIdentity, objstm_member, owned_bytes};
 use super::xref::{Revision, XrefEntry};
-use super::{Arc, CosError, Dict, Document, Lexer, ObjRef, Object, is_whitespace, parse_indirect_shared};
+use super::{Arc, CosError, Cow, Dict, Document, Lexer, ObjRef, Object, Stream, is_whitespace, parse_indirect_shared};
 
 impl Document {
     pub fn bytes(&self) -> &Arc<Vec<u8>> {
@@ -158,6 +158,39 @@ impl Document {
         }
     }
 
+    /// `s` with the `/DecodeParms` its filters use made direct, so [`Stream::decoded`] reads them:
+    /// an indirect dictionary resolved, and of an array (itself perhaps indirect), the entries at
+    /// the filters' places (`/Crypt` counts, ISO 32000-2 §7.4.1) resolved, the rest dropped. `s`
+    /// itself when none of those is indirect, or when the chain is longer than any decoder takes
+    /// ([`pdfcraft_filters::MAX_CHAIN`]), so at most that many objects are copied.
+    pub fn with_direct_parms<'s>(&self, s: &'s Stream) -> Cow<'s, Stream> {
+        let Some(p) = s.dict.get(b"DecodeParms") else { return Cow::Borrowed(s) };
+        let filters = match s.dict.get(b"Filter") {
+            Some(Object::Array(a)) => a.len(),
+            Some(_) => 1,
+            None => 0,
+        };
+        if filters > pdfcraft_filters::MAX_CHAIN {
+            return Cow::Borrowed(s);
+        }
+        let whole = matches!(p, Object::Ref(_));
+        let resolved = self.resolve(p);
+        let direct = match &*resolved {
+            Object::Array(a) => {
+                let used = a.get(..filters.min(a.len())).unwrap_or_default();
+                if !whole && !used.iter().any(|e| matches!(e, Object::Ref(_))) {
+                    return Cow::Borrowed(s);
+                }
+                Object::Array(used.iter().map(|e| (*self.resolve(e)).clone()).collect())
+            }
+            other if whole => other.clone(),
+            _ => return Cow::Borrowed(s),
+        };
+        let mut s = s.clone();
+        s.dict.set(b"DecodeParms".to_vec(), direct);
+        Cow::Owned(s)
+    }
+
     /// Resolve and return a dictionary (a stream's dictionary counts).
     pub fn dict(&self, o: &Object) -> Option<Dict> {
         self.resolve(o).as_dict().cloned()
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index bf22f23d76..61a71e24d8 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -1,5 +1,41 @@
 use super::*;
 
+/// /DecodeParms given by reference, whole or as array entries, are read once made direct: here a
+/// Flate predictor, which the stream alone doesn't see. Only the entries the filters use are
+/// resolved, and nothing is for a chain longer than a decoder takes.
+#[test]
+fn decode_parms_given_by_reference_are_read_once_direct() {
+    let rows = [1u8, 2, 3, 4, 5, 6, 7, 8];
+    let params = pdfcraft_filters::Params { predictor: 12, colors: 1, bits_per_component: 8, columns: 4, early_change: 1 };
+    let coded = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &rows).unwrap();
+    let mut parms = Dict::new();
+    parms.set(b"Predictor".to_vec(), Object::Int(12));
+    parms.set(b"Columns".to_vec(), Object::Int(4));
+    let mut doc = Document::new_empty();
+    let r = doc.add(Object::Dict(parms.clone()));
+    let array = doc.add(Object::Array(vec![Object::Ref(r)]));
+    let stream = |filters: usize, p: Object| {
+        let mut d = Dict::new();
+        d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"); filters]));
+        d.set(b"DecodeParms".to_vec(), p);
+        Stream::from_raw(d, coded.clone())
+    };
+    for p in [Object::Ref(r), Object::Array(vec![Object::Ref(r)]), Object::Ref(array)] {
+        let s = stream(1, p.clone());
+        assert_ne!(s.decoded().unwrap(), rows, "{p:?} read as it is");
+        assert_eq!(doc.with_direct_parms(&s).decoded().unwrap(), rows, "{p:?}");
+    }
+    let direct = stream(1, Object::Dict(parms));
+    assert!(matches!(doc.with_direct_parms(&direct), Cow::Borrowed(_)), "nothing to resolve");
+    assert_eq!(direct.decoded().unwrap(), rows);
+    // Entries past the filters' are left out, unresolved; so is everything past the chain limit.
+    let many = stream(1, Object::Array(vec![Object::Ref(r); 1000]));
+    let made = doc.with_direct_parms(&many);
+    assert_eq!(made.dict.get(b"DecodeParms").and_then(Object::as_array).map(Vec::len), Some(1));
+    let long = stream(pdfcraft_filters::MAX_CHAIN + 1, Object::Array(vec![Object::Ref(r); 9]));
+    assert!(matches!(doc.with_direct_parms(&long), Cow::Borrowed(_)));
+}
+
 #[test]
 fn a_read_state_matches_a_clone_and_no_changed_document() {
     let mut doc = Document::new_empty();
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 6b4d04b071..4098adc3b0 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -31,7 +31,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   image masks, decode arrays, more than 8 bits, JPEG 2000, JBIG2 and CCITT. A JPEG is read with
   its colour transform (an Adobe marker's, else `/ColorTransform`, ISO 32000-2 §7.4.8), so one
   stored untransformed keeps its colours; one whose marker and `/ColorTransform` disagree is left
-  alone, since readers differ on which wins.
+  alone, since readers differ on which wins. Samples are read with `/DecodeParms` given by
+  reference too (`Document::with_direct_parms`), here and below: without them a predictor's tag
+  bytes would shift every row of an image written back.
 - **Monochrome images** (`Settings::mono`, CCITT Group 4 by default): a 1-bit image with one
   colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
   general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index ad76003074..59b3b64174 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -258,7 +258,9 @@ fn count_decoded(_n: u64) {
     DECODED_PIXELS.with(|c| c.set(c.get().saturating_add(_n)));
 }
 
-/// 8-bit samples of an image (`n` components), decoded. `None` for a JPEG whose colour transform
+/// 8-bit samples of an image (`n` components), decoded, with `/DecodeParms` given by reference
+/// too ([`Document::with_direct_parms`]): read without them, a predictor's tag bytes would shift
+/// every row, and the image would be written back wrong. `None` for a JPEG whose colour transform
 /// readers may disagree about ([`ycc_encoded`]).
 pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize) -> Option<Vec<u8>> {
     let (w, h) = (u32::try_from(s.dict.int(b"Width")?).ok()?, u32::try_from(s.dict.int(b"Height")?).ok()?);
@@ -275,7 +277,7 @@ pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize) -> Option<Vec<u8>> {
         count_decoded(u64::from(w) * u64::from(h));
         (v.len() == bytes).then_some(v)
     } else {
-        let v = s.decoded().ok()?;
+        let v = doc.with_direct_parms(s).decoded().ok()?;
         Some(v.get(..bytes)?.to_vec())
     }
 }
@@ -573,7 +575,8 @@ fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stre
     if w == 0 || h == 0 || w > pdfcraft_filters::MAX_G4_COLUMNS || u64::from(w) * u64::from(h) > MAX_PIXELS {
         return None;
     }
-    let g4 = pdfcraft_filters::encode_g4(&s.decoded().ok()?, w, h).ok()?;
+    // Through its parameters given by reference too, as `pixels` reads.
+    let g4 = pdfcraft_filters::encode_g4(&doc.with_direct_parms(s).decoded().ok()?, w, h).ok()?;
     let mut new = d.clone();
     for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
         new.remove(k);
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index db32ea7ad2..58699fb521 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -413,6 +413,54 @@ fn black_and_white_images_become_ccitt_group_4() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// An image whose /DecodeParms are a reference is read through them, as one with them direct: a
+/// predictor's tag bytes would otherwise shift every row, and the image would be stored again
+/// wrong. Here a 1-bit image with a PNG predictor (stored again as Group 4) and an eight-bit grey
+/// one with a PNG predictor at 600 ppi (resampled) come out byte for byte as with direct parameters.
+#[test]
+fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
+    let build = |by_reference: bool| {
+        let mut doc = Document::new_empty();
+        let (w, h) = (1200u32, 480u32);
+        let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
+        let one_bit = mono_image(&mut doc, w, h, &bilevel(w, h, false), Some(15), &grey);
+        let shades: Vec<u8> = (0..w * h).map(|i| ((i % w) * 255 / w) as u8 ^ ((i / w) as u8 & 0x0F)).collect();
+        let params = pdfcraft_filters::Params { predictor: 15, colors: 1, bits_per_component: 8, columns: w as i64, early_change: 1 };
+        let mut parms = Dict::new();
+        parms.set(b"Predictor".to_vec(), Object::Int(15));
+        parms.set(b"Columns".to_vec(), Object::Int(w as i64));
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w as i64));
+        d.set(b"Height".to_vec(), Object::Int(h as i64));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        let coded = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &shades).unwrap();
+        let eight_bit = doc.add(Object::Stream(Stream::from_raw(d, coded)));
+        if by_reference {
+            for r in [one_bit, eight_bit] {
+                let mut s = stream(&doc, r);
+                let parms = s.dict.get(b"DecodeParms").cloned().unwrap();
+                s.dict.set(b"DecodeParms".to_vec(), Object::Ref(doc.add(parms)));
+                doc.set(r, Object::Stream(s));
+            }
+        }
+        // 300 × 120 pt is 288 ppi; 144 × 57.6 pt is 600 ppi.
+        page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
+        let before = [one_bit, eight_bit].map(|r| stream(&doc, r).raw);
+        let r = optimize(&mut doc, &Settings::default()).unwrap();
+        assert_eq!((r.images_resampled, r.images_recompressed), (1, 1), "{r:?}");
+        let after = [one_bit, eight_bit].map(|r| stream(&doc, r));
+        assert!(before.iter().zip(&after).all(|(b, a)| *b != a.raw), "both stored again");
+        assert_eq!(after[0].dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
+        after.map(|s| s.raw)
+    };
+    assert_eq!(build(true), build(false));
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();

From 70d6815c6d7d22f850974295df9d5a86026404c9 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 20:03:12 +0100
Subject: [PATCH 078/132] M11: Persian for the PDF Optimizer's black-and-white
 image rows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Persian came to main after these rows were written, so fa.tsv had neither "Monochrome Images"
nor "CCITT Group 4". They go beside "Grayscale Images", worded like the Arabic and Kurdish rows,
with the Persian digit the catalogue uses elsewhere ("AES ۱۲۸-بیتی").

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/ui-egui/src/i18n/fa.tsv | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crates/ui-egui/src/i18n/fa.tsv b/crates/ui-egui/src/i18n/fa.tsv
index 5cfc217533..09a2e21689 100644
--- a/crates/ui-egui/src/i18n/fa.tsv
+++ b/crates/ui-egui/src/i18n/fa.tsv
@@ -594,6 +594,8 @@
 	Clean Up	پاک‌سازی
 	Color Images	تصاویر رنگی
 	Grayscale Images	تصاویر خاکستری
+	Monochrome Images	تصاویر تک‌رنگ
+	CCITT Group 4	CCITT گروه ۴
 	Bicubic downsampling to	نمونه برداری کاهشی دو مکعبی به
 	for images above	برای تصاویر بالا‌تر از
 	Compression	فشرده‌سازی

From 58945d1f5b7db2ef910f5d397171bb6a604ae819 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 15:37:34 +0100
Subject: [PATCH 079/132] M11: the optimizer reads numbers inside /DecodeParms
 given by reference

Document::with_direct_parms resolved an indirect /DecodeParms and its
array entries but not the numbers inside (/Predictor 9 0 R), which
Dict::int doesn't follow. A 1-bit image with such a predictor was
decoded without it, its rows shifted by their tag bytes, and Group 4 of
that stored in its place; resampling read images the same way. It now
keeps, of each parameters dictionary, the numbers and flags the decoders
read, resolved, and /JBIG2Globals as a reference. Only those small
values are copied (an entry that is no dictionary is null), so a file
naming one big object from every key and filter can't have it copied a
hundred times.

The change is #4384's, moved down so that every PR stacked on this one
reads such parameters.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/cos/src/document/objects.rs | 89 +++++++++++++++++++++++++-----
 crates/cos/src/document/tests.rs   | 28 +++++++++-
 crates/optimize/README.md          |  4 +-
 crates/optimize/tests/optimize.rs  | 39 ++++++++-----
 4 files changed, 129 insertions(+), 31 deletions(-)

diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index 039f3dd101..e7d7255306 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -160,9 +160,12 @@ impl Document {
 
     /// `s` with the `/DecodeParms` its filters use made direct, so [`Stream::decoded`] reads them:
     /// an indirect dictionary resolved, and of an array (itself perhaps indirect), the entries at
-    /// the filters' places (`/Crypt` counts, ISO 32000-2 §7.4.1) resolved, the rest dropped. `s`
-    /// itself when none of those is indirect, or when the chain is longer than any decoder takes
-    /// ([`pdfcraft_filters::MAX_CHAIN`]), so at most that many objects are copied.
+    /// the filters' places (`/Crypt` counts, ISO 32000-2 §7.4.1) resolved, the rest dropped. Of
+    /// each dictionary only the entries the decoders read are kept, numbers and flags given by
+    /// reference (`/Predictor 7 0 R`) resolved; `/JBIG2Globals` stays a reference. `s` itself
+    /// when none of those is indirect, or when the chain is longer than any decoder takes
+    /// ([`pdfcraft_filters::MAX_CHAIN`]). Only small values are copied, so a file can't have a
+    /// large object copied once for each key and filter.
     pub fn with_direct_parms<'s>(&self, s: &'s Stream) -> Cow<'s, Stream> {
         let Some(p) = s.dict.get(b"DecodeParms") else { return Cow::Borrowed(s) };
         let filters = match s.dict.get(b"Filter") {
@@ -173,24 +176,45 @@ impl Document {
         if filters > pdfcraft_filters::MAX_CHAIN {
             return Cow::Borrowed(s);
         }
-        let whole = matches!(p, Object::Ref(_));
-        let resolved = self.resolve(p);
-        let direct = match &*resolved {
-            Object::Array(a) => {
-                let used = a.get(..filters.min(a.len())).unwrap_or_default();
-                if !whole && !used.iter().any(|e| matches!(e, Object::Ref(_))) {
-                    return Cow::Borrowed(s);
+        let mut changed = matches!(p, Object::Ref(_));
+        // Its numbers and flags kept, resolved; anything else is no filter's parameters (null).
+        let one = |e: &Object, changed: &mut bool| -> Object {
+            *changed |= matches!(e, Object::Ref(_));
+            let Object::Dict(d) = &*self.held(e) else { return Object::Null };
+            let mut made = Dict::new();
+            for key in DECODE_PARMS_KEYS {
+                let Some(v) = d.get(key) else { continue };
+                *changed |= matches!(v, Object::Ref(_));
+                let v = self.held(v);
+                if matches!(*v, Object::Int(_) | Object::Real(_) | Object::Bool(_)) {
+                    made.set(key.to_vec(), (*v).clone());
                 }
-                Object::Array(used.iter().map(|e| (*self.resolve(e)).clone()).collect())
             }
-            other if whole => other.clone(),
-            _ => return Cow::Borrowed(s),
+            if let Some(g @ Object::Ref(_)) = d.get(b"JBIG2Globals") {
+                made.set(b"JBIG2Globals".to_vec(), g.clone());
+            }
+            Object::Dict(made)
         };
+        let made = match &*self.held(p) {
+            Object::Array(a) => Object::Array(a.get(..filters.min(a.len())).unwrap_or_default().iter().map(|e| one(e, &mut changed)).collect()),
+            _ => one(p, &mut changed),
+        };
+        if !changed {
+            return Cow::Borrowed(s);
+        }
         let mut s = s.clone();
-        s.dict.set(b"DecodeParms".to_vec(), direct);
+        s.dict.set(b"DecodeParms".to_vec(), made);
         Cow::Owned(s)
     }
 
+    /// `o`, or the object it refers to, without copying either.
+    fn held<'o>(&self, o: &'o Object) -> Held<'o> {
+        match o {
+            Object::Ref(_) => Held::Resolved(self.resolve(o)),
+            o => Held::Direct(o),
+        }
+    }
+
     /// Resolve and return a dictionary (a stream's dictionary counts).
     pub fn dict(&self, o: &Object) -> Option<Dict> {
         self.resolve(o).as_dict().cloned()
@@ -603,3 +627,40 @@ impl Document {
         matches!(self.try_get(r.num).as_deref(), Ok(Object::Dict(d)) if d.name(b"Type") == Some(b"Catalog") || d.contains(b"Pages"))
     }
 }
+
+/// The `/DecodeParms` entries the decoders read (ISO 32000-2 Tables 8, 11 and 13: the Flate and
+/// LZW predictors, CCITT, DCT's colour transform): numbers and flags a file may give by
+/// reference, which [`Dict::int`] doesn't follow.
+const DECODE_PARMS_KEYS: [&[u8]; 13] = [
+    b"Predictor",
+    b"Colors",
+    b"BitsPerComponent",
+    b"Columns",
+    b"EarlyChange",
+    b"K",
+    b"Rows",
+    b"EndOfLine",
+    b"EncodedByteAlign",
+    b"EndOfBlock",
+    b"BlackIs1",
+    b"DamagedRowsBeforeError",
+    b"ColorTransform",
+];
+
+/// An object read in place, or the object a reference names as the document holds it: either way
+/// nothing is copied ([`Document::held`]).
+enum Held<'o> {
+    Direct(&'o Object),
+    Resolved(Arc<Object>),
+}
+
+impl std::ops::Deref for Held<'_> {
+    type Target = Object;
+
+    fn deref(&self) -> &Object {
+        match self {
+            Held::Direct(o) => o,
+            Held::Resolved(o) => o,
+        }
+    }
+}
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index 61a71e24d8..edbd68f562 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -1,7 +1,7 @@
 use super::*;
 
-/// /DecodeParms given by reference, whole or as array entries, are read once made direct: here a
-/// Flate predictor, which the stream alone doesn't see. Only the entries the filters use are
+/// /DecodeParms given by reference, whole, as array entries or as the numbers inside, are read
+/// once made direct: here a Flate predictor, which the stream alone doesn't see. Only the entries the filters use are
 /// resolved, and nothing is for a chain longer than a decoder takes.
 #[test]
 fn decode_parms_given_by_reference_are_read_once_direct() {
@@ -25,6 +25,30 @@ fn decode_parms_given_by_reference_are_read_once_direct() {
         assert_ne!(s.decoded().unwrap(), rows, "{p:?} read as it is");
         assert_eq!(doc.with_direct_parms(&s).decoded().unwrap(), rows, "{p:?}");
     }
+    // A number inside given by reference, which `Dict::int` doesn't follow: in the dictionary
+    // itself, and in an array's entry.
+    let twelve = doc.add(Object::Int(12));
+    let mut inner = parms.clone();
+    inner.set(b"Predictor".to_vec(), Object::Ref(twelve));
+    for p in [Object::Dict(inner.clone()), Object::Array(vec![Object::Dict(inner)])] {
+        let s = stream(1, p.clone());
+        assert_ne!(s.decoded().unwrap(), rows, "{p:?} read as it is");
+        assert_eq!(doc.with_direct_parms(&s).decoded().unwrap(), rows, "{p:?}");
+    }
+    // Only numbers and flags are copied: a key naming a big array, or an entry that is no
+    // dictionary, is left out (a file could name one big object from every key and filter).
+    let big = doc.add(Object::Array(vec![Object::Int(1); 100_000]));
+    let mut hostile = Dict::new();
+    hostile.set(b"Predictor".to_vec(), Object::Ref(big));
+    hostile.set(b"Columns".to_vec(), Object::Ref(big));
+    hostile.set(b"Colors".to_vec(), Object::Ref(twelve));
+    let entry = doc.add(Object::Dict(hostile));
+    let two = stream(2, Object::Array(vec![Object::Ref(entry), Object::Ref(big)]));
+    let made = doc.with_direct_parms(&two);
+    let made = made.dict.get(b"DecodeParms").and_then(Object::as_array).unwrap();
+    let first = made[0].as_dict().unwrap();
+    assert_eq!((first.contains(b"Predictor"), first.contains(b"Columns"), first.int(b"Colors")), (false, false, Some(12)));
+    assert!(matches!(made[1], Object::Null), "{:?}", made[1]);
     let direct = stream(1, Object::Dict(parms));
     assert!(matches!(doc.with_direct_parms(&direct), Cow::Borrowed(_)), "nothing to resolve");
     assert_eq!(direct.decoded().unwrap(), rows);
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 4098adc3b0..3bb09038c6 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -32,8 +32,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   its colour transform (an Adobe marker's, else `/ColorTransform`, ISO 32000-2 §7.4.8), so one
   stored untransformed keeps its colours; one whose marker and `/ColorTransform` disagree is left
   alone, since readers differ on which wins. Samples are read with `/DecodeParms` given by
-  reference too (`Document::with_direct_parms`), here and below: without them a predictor's tag
-  bytes would shift every row of an image written back.
+  reference too, the numbers inside included (`Document::with_direct_parms`), here and below:
+  without them a predictor's tag bytes would shift every row of an image written back.
 - **Monochrome images** (`Settings::mono`, CCITT Group 4 by default): a 1-bit image with one
   colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
   general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 58699fb521..0336d73e9d 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -413,13 +413,15 @@ fn black_and_white_images_become_ccitt_group_4() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
-/// An image whose /DecodeParms are a reference is read through them, as one with them direct: a
-/// predictor's tag bytes would otherwise shift every row, and the image would be stored again
-/// wrong. Here a 1-bit image with a PNG predictor (stored again as Group 4) and an eight-bit grey
-/// one with a PNG predictor at 600 ppi (resampled) come out byte for byte as with direct parameters.
+/// An image whose /DecodeParms are a reference, or hold numbers given by reference
+/// (`/Predictor 9 0 R`, which `Dict::int` doesn't follow), is read through them, as one with them
+/// direct: a predictor's tag bytes would otherwise shift every row, and the image would be stored
+/// again wrong. Here a 1-bit image with a PNG predictor (stored again as Group 4) and an eight-bit
+/// grey one with a PNG predictor at 600 ppi (resampled) come out byte for byte as with direct
+/// parameters.
 #[test]
 fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
-    let build = |by_reference: bool| {
+    let build = |how: &str| {
         let mut doc = Document::new_empty();
         let (w, h) = (1200u32, 480u32);
         let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
@@ -440,13 +442,22 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
         d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
         let coded = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &shades).unwrap();
         let eight_bit = doc.add(Object::Stream(Stream::from_raw(d, coded)));
-        if by_reference {
-            for r in [one_bit, eight_bit] {
-                let mut s = stream(&doc, r);
-                let parms = s.dict.get(b"DecodeParms").cloned().unwrap();
-                s.dict.set(b"DecodeParms".to_vec(), Object::Ref(doc.add(parms)));
-                doc.set(r, Object::Stream(s));
-            }
+        for r in [one_bit, eight_bit] {
+            let mut s = stream(&doc, r);
+            let Some(Object::Dict(mut parms)) = s.dict.get(b"DecodeParms").cloned() else { panic!("{:?}", s.dict) };
+            let made = match how {
+                "whole" => Object::Ref(doc.add(Object::Dict(parms))),
+                "numbers" => {
+                    for k in [&b"Predictor"[..], b"Columns"] {
+                        let v = parms.get(k).cloned().unwrap();
+                        parms.set(k.to_vec(), Object::Ref(doc.add(v)));
+                    }
+                    Object::Dict(parms)
+                }
+                _ => continue,
+            };
+            s.dict.set(b"DecodeParms".to_vec(), made);
+            doc.set(r, Object::Stream(s));
         }
         // 300 × 120 pt is 288 ppi; 144 × 57.6 pt is 600 ppi.
         page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
@@ -458,7 +469,9 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
         assert_eq!(after[0].dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
         after.map(|s| s.raw)
     };
-    assert_eq!(build(true), build(false));
+    let direct = build("direct");
+    assert_eq!(build("whole"), direct, "the dictionary by reference");
+    assert_eq!(build("numbers"), direct, "the numbers inside by reference");
 }
 
 #[test]

From e6fddf155b996f099d4b24d9ae3b79e2c7397068 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 16:49:31 +0100
Subject: [PATCH 080/132] M11: /Crypt doesn't count against with_direct_parms'
 chain limit

The decoders leave /Crypt out wherever it stands (Stream::filters), so
a chain of /Crypt and eight other filters decodes, but with_direct_parms
counted nine and left its parameters as they were: a predictor given by
reference was then skipped. Only the other filters count now, and a
/Crypt entry is null in the copy, as no decoder reads it. Tests cover
that chain and one exactly as long as a decoder takes.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/cos/src/document/objects.rs | 20 ++++++++++++--------
 crates/cos/src/document/tests.rs   | 19 +++++++++++++++++++
 2 files changed, 31 insertions(+), 8 deletions(-)

diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index e7d7255306..fb20b50cf1 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -162,18 +162,20 @@ impl Document {
     /// an indirect dictionary resolved, and of an array (itself perhaps indirect), the entries at
     /// the filters' places (`/Crypt` counts, ISO 32000-2 §7.4.1) resolved, the rest dropped. Of
     /// each dictionary only the entries the decoders read are kept, numbers and flags given by
-    /// reference (`/Predictor 7 0 R`) resolved; `/JBIG2Globals` stays a reference. `s` itself
-    /// when none of those is indirect, or when the chain is longer than any decoder takes
+    /// reference (`/Predictor 7 0 R`) resolved; `/JBIG2Globals` stays a reference. A `/Crypt`
+    /// entry, which no decoder reads ([`Stream::filters`] leaves it out), is null. `s` itself
+    /// when none of those is indirect, or when the other filters are more than any decoder takes
     /// ([`pdfcraft_filters::MAX_CHAIN`]). Only small values are copied, so a file can't have a
     /// large object copied once for each key and filter.
     pub fn with_direct_parms<'s>(&self, s: &'s Stream) -> Cow<'s, Stream> {
         let Some(p) = s.dict.get(b"DecodeParms") else { return Cow::Borrowed(s) };
-        let filters = match s.dict.get(b"Filter") {
-            Some(Object::Array(a)) => a.len(),
-            Some(_) => 1,
-            None => 0,
+        let crypt = |f: &Object| matches!(f.as_name(), Some(b"Crypt"));
+        let filters: Vec<bool> = match s.dict.get(b"Filter") {
+            Some(Object::Array(a)) => a.iter().map(crypt).collect(),
+            Some(f) => vec![crypt(f)],
+            None => Vec::new(),
         };
-        if filters > pdfcraft_filters::MAX_CHAIN {
+        if filters.iter().filter(|c| !**c).count() > pdfcraft_filters::MAX_CHAIN {
             return Cow::Borrowed(s);
         }
         let mut changed = matches!(p, Object::Ref(_));
@@ -196,7 +198,9 @@ impl Document {
             Object::Dict(made)
         };
         let made = match &*self.held(p) {
-            Object::Array(a) => Object::Array(a.get(..filters.min(a.len())).unwrap_or_default().iter().map(|e| one(e, &mut changed)).collect()),
+            Object::Array(a) => {
+                Object::Array(a.iter().zip(&filters).map(|(e, crypt)| if *crypt { Object::Null } else { one(e, &mut changed) }).collect())
+            }
             _ => one(p, &mut changed),
         };
         if !changed {
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index edbd68f562..d8d75c4af1 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -58,6 +58,25 @@ fn decode_parms_given_by_reference_are_read_once_direct() {
     assert_eq!(made.dict.get(b"DecodeParms").and_then(Object::as_array).map(Vec::len), Some(1));
     let long = stream(pdfcraft_filters::MAX_CHAIN + 1, Object::Array(vec![Object::Ref(r); 9]));
     assert!(matches!(doc.with_direct_parms(&long), Cow::Borrowed(_)));
+    // A chain as long as a decoder takes is resolved, and a `/Crypt` in it doesn't count, as
+    // the decoders leave it out: ASCIIHex as often as the limit allows, then the predictor's
+    // Flate, its parameters by reference.
+    let hex = |b: &[u8]| b.iter().flat_map(|x| format!("{x:02X}").into_bytes()).chain(*b">").collect::<Vec<u8>>();
+    let wrapped = (1..pdfcraft_filters::MAX_CHAIN).fold(coded.clone(), |data, _| hex(&data));
+    for crypt in [false, true] {
+        let mut names = vec![Object::name("ASCIIHexDecode"); pdfcraft_filters::MAX_CHAIN - 1];
+        names.push(Object::name("FlateDecode"));
+        if crypt {
+            names.insert(0, Object::name("Crypt"));
+        }
+        let mut entries = vec![Object::Null; names.len() - 1];
+        entries.push(Object::Ref(r));
+        let mut d = Dict::new();
+        d.set(b"Filter".to_vec(), Object::Array(names));
+        d.set(b"DecodeParms".to_vec(), Object::Array(entries));
+        let s = Stream::from_raw(d, wrapped.clone());
+        assert_eq!(doc.with_direct_parms(&s).decoded().unwrap(), rows, "with /Crypt: {crypt}");
+    }
 }
 
 #[test]

From 88c089bd2931500b3b1481de9b7e508eed345447 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 16:49:31 +0100
Subject: [PATCH 081/132] M11: the optimizer decodes an image no further than
 its samples can need

A 1-bit image was decoded for Group 4 up to MAX_DECODED (1 GiB), so a
few kilobytes of Flate could cost a gigabyte, and the same held for the
samples of a colour or grey image read to resample it (pixels). Both now
stop at twice the samples plus a byte a row and 4 KiB, as redaction
does; data past that can only be a decompression bomb, and the image is
left alone.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/src/images.rs     | 18 ++++++++++++++----
 crates/optimize/tests/optimize.rs | 28 ++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 59b3b64174..6eb0ddaa79 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -261,7 +261,8 @@ fn count_decoded(_n: u64) {
 /// 8-bit samples of an image (`n` components), decoded, with `/DecodeParms` given by reference
 /// too ([`Document::with_direct_parms`]): read without them, a predictor's tag bytes would shift
 /// every row, and the image would be written back wrong. `None` for a JPEG whose colour transform
-/// readers may disagree about ([`ycc_encoded`]).
+/// readers may disagree about ([`ycc_encoded`]), and for data that decodes past what the samples
+/// can need ([`allowance`]).
 pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize) -> Option<Vec<u8>> {
     let (w, h) = (u32::try_from(s.dict.int(b"Width")?).ok()?, u32::try_from(s.dict.int(b"Height")?).ok()?);
     if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_PIXELS {
@@ -277,11 +278,18 @@ pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize) -> Option<Vec<u8>> {
         count_decoded(u64::from(w) * u64::from(h));
         (v.len() == bytes).then_some(v)
     } else {
-        let v = doc.with_direct_parms(s).decoded().ok()?;
+        let v = doc.with_direct_parms(s).decoded_within(allowance(bytes, h)?).ok()?;
         Some(v.get(..bytes)?.to_vec())
     }
 }
 
+/// How far an image of `bytes` samples in `rows` rows is decoded: a filter stage may produce up
+/// to twice them (ASCIIHex text under Flate) plus a PNG predictor's byte a row. More can only be a
+/// decompression bomb, and the image is left alone.
+fn allowance(bytes: usize, rows: u32) -> Option<usize> {
+    bytes.checked_add(usize::try_from(rows).ok()?)?.checked_mul(2)?.checked_add(4096)
+}
+
 /// Whether the samples of a three-component JPEG are YCbCr, to be converted to RGB (ISO 32000-2
 /// §7.4.8). An Adobe APP14 marker's transform flag says so, overriding the filter's
 /// /ColorTransform; without a marker /ColorTransform does, 1 (YCbCr) by default.
@@ -575,8 +583,10 @@ fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stre
     if w == 0 || h == 0 || w > pdfcraft_filters::MAX_G4_COLUMNS || u64::from(w) * u64::from(h) > MAX_PIXELS {
         return None;
     }
-    // Through its parameters given by reference too, as `pixels` reads.
-    let g4 = pdfcraft_filters::encode_g4(&doc.with_direct_parms(s).decoded().ok()?, w, h).ok()?;
+    // Through its parameters given by reference too, as `pixels` reads, and no further than its
+    // rows can need.
+    let bytes = usize::try_from(w).ok()?.div_ceil(8).checked_mul(usize::try_from(h).ok()?)?;
+    let g4 = pdfcraft_filters::encode_g4(&doc.with_direct_parms(s).decoded_within(allowance(bytes, h)?).ok()?, w, h).ok()?;
     let mut new = d.clone();
     for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
         new.remove(k);
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 0336d73e9d..62e3b5a156 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -474,6 +474,34 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
     assert_eq!(build("numbers"), direct, "the numbers inside by reference");
 }
 
+/// An image whose data decodes far past what its samples can need (a decompression bomb) is left
+/// alone rather than decoded up to the 1 GiB limit: a 1-bit one that would become Group 4, and an
+/// eight-bit one that would be resampled, each with a megabyte of zeros after its samples.
+#[test]
+fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
+    let (w, h) = (1200u32, 480u32);
+    let text = bilevel(w, h, false);
+    let shades: Vec<u8> = (0..w * h).map(|i| ((i % w) * 255 / w) as u8 ^ ((i / w) as u8 & 0x0F)).collect();
+    for padding in [0, 1 << 20] {
+        let mut doc = Document::new_empty();
+        let padded = |data: &[u8]| data.iter().copied().chain(std::iter::repeat_n(0, padding)).collect::<Vec<u8>>();
+        let grey = |bits: i64| [("BitsPerComponent", bits.into()), ("ColorSpace", Object::name("DeviceGray"))];
+        let one_bit = mono_image(&mut doc, w, h, &padded(&text), None, &grey(1));
+        let eight_bit = mono_image(&mut doc, w, h, &padded(&shades), None, &grey(8));
+        // 300 × 120 pt is 288 ppi; 144 × 57.6 pt is 600 ppi.
+        page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
+        let before = [one_bit, eight_bit].map(|r| stream(&doc, r).raw);
+        let r = optimize(&mut doc, &Settings::default()).unwrap();
+        let after = [one_bit, eight_bit].map(|r| stream(&doc, r).raw);
+        if padding == 0 {
+            assert_eq!((r.images_resampled, r.images_recompressed), (1, 1), "{r:?}");
+        } else {
+            assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "{r:?}");
+            assert_eq!(after, before);
+        }
+    }
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();

From 3143c4a04430e56dda7646ea2bf466af6da2c469 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 16:56:27 +0100
Subject: [PATCH 082/132] M11: tests for which 1-bit images become Group 4, and
 the byte totals

A test now covers what qualifies and what doesn't: an ICC profile of
one component and a DeviceN of one colourant convert, three components
and two colourants (more than a bit a pixel) don't; an image mask
converts with /BitsPerComponent 1 given, not with 8; an image of exactly
80 million pixels converts, one row more doesn't. The byte totals are
checked exactly. Each of those rules could be broken before with no
test failing (cargo mutants). one_component's comment now says /G
counts with DeviceGray, as the code does.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/src/images.rs     |  5 +--
 crates/optimize/tests/optimize.rs | 59 +++++++++++++++++++++++++++++++
 2 files changed, 62 insertions(+), 2 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 6eb0ddaa79..f516af7319 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -544,8 +544,9 @@ fn process(doc: &Document, s: &Stream, ppi: f64, settings: &ImageSettings, n: us
 
 /// Whether colour space `cs` has one colour component, so a 1-bit image in it has one bit per
 /// pixel: grey, a separation, an indexed space or a DeviceN of one colourant. Of names, only
-/// DeviceGray counts: another name is no colour space on its own (`/Indexed` and `/CalGray` need
-/// their parameters), so it can only name a resource, which might be RGB.
+/// DeviceGray counts, with `/G`, its abbreviation, which readers take as grey too: another name
+/// is no colour space on its own (`/Indexed` and `/CalGray` need their parameters), so it can only
+/// name a resource, which might be RGB.
 fn one_component(doc: &Document, cs: &Object) -> bool {
     let cs = doc.resolve(cs);
     match &*cs {
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 62e3b5a156..e1a088b561 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -413,6 +413,65 @@ fn black_and_white_images_become_ccitt_group_4() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// Which 1-bit images qualify for Group 4: those of one colour component, an ICC profile of one
+/// component and a DeviceN of one colourant among them, but not one of three components or two
+/// colourants (more than a bit a pixel); image masks of one bit, as `/BitsPerComponent 1` says or
+/// by default, but not one that says 8; and images of up to 80 million pixels, not one row more.
+/// The byte totals count exactly the images stored again.
+#[test]
+fn group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200u32, 480u32);
+    let text = bilevel(w, h, false);
+    let icc = |doc: &mut Document, n: i64| {
+        let mut d = Dict::new();
+        d.set(b"N".to_vec(), Object::Int(n));
+        Object::Array(vec![Object::name("ICCBased"), Object::Ref(doc.add(Object::Stream(Stream::from_raw(d, Vec::new()))))])
+    };
+    let device_n = |colourants: &[&str]| {
+        let mut tint = Dict::new();
+        tint.set(b"FunctionType".to_vec(), Object::Int(2));
+        tint.set(b"Domain".to_vec(), Object::Array(vec![0.into(), 1.into()]));
+        tint.set(b"N".to_vec(), Object::Int(1));
+        Object::Array(vec![
+            Object::name("DeviceN"),
+            Object::Array(colourants.iter().map(|c| Object::name(c)).collect()),
+            Object::name("DeviceGray"),
+            Object::Dict(tint),
+        ])
+    };
+    let one_bit = |cs: Object| [("BitsPerComponent", 1.into()), ("ColorSpace", cs)];
+    let icc_1 = icc(&mut doc, 1);
+    let icc_1 = mono_image(&mut doc, w, h, &text, None, &one_bit(icc_1));
+    let icc_3 = icc(&mut doc, 3);
+    let icc_3 = mono_image(&mut doc, w, h, &bilevel(3 * w, h, false), None, &one_bit(icc_3));
+    let spot = mono_image(&mut doc, w, h, &text, None, &one_bit(device_n(&["Spot"])));
+    let two_spots = mono_image(&mut doc, w, h, &bilevel(2 * w, h, false), None, &one_bit(device_n(&["Spot", "Other"])));
+    let mask = |bits: i64| [("ImageMask", Object::Bool(true)), ("BitsPerComponent", bits.into())];
+    let mask_1 = mono_image(&mut doc, w, h, &text, None, &mask(1));
+    let mask_8 = mono_image(&mut doc, w, h, &bilevel(8 * w, h, false), None, &mask(8));
+    // 10,000 × 8,000 is the limit itself.
+    let grey = one_bit(Object::name("DeviceGray"));
+    let at_limit = mono_image(&mut doc, 10_000, 8_000, &bilevel(10_000, 8_000, false), None, &grey);
+    let past_limit = mono_image(&mut doc, 10_000, 8_001, &bilevel(10_000, 8_001, false), None, &grey);
+    let all = [icc_1, icc_3, spot, two_spots, mask_1, mask_8, at_limit, past_limit];
+    let names: Vec<String> = (0..all.len()).map(|i| format!("Im{i}")).collect();
+    let content: String = (0..all.len()).map(|i| format!("q 200 0 0 80 {} {} cm /Im{i} Do Q ", 6 + 200 * (i % 3), 690 - 100 * (i / 3))).collect();
+    page(&mut doc, &names.iter().map(String::as_str).zip(all).collect::<Vec<_>>(), &content);
+    let converted = [icc_1, spot, mask_1, at_limit];
+    let left = [icc_3, two_spots, mask_8, past_limit];
+    let before = |doc: &Document, refs: &[ObjRef]| refs.iter().map(|r| stream(doc, *r).raw).collect::<Vec<_>>();
+    let (old, untouched) = (before(&doc, &converted), before(&doc, &left));
+    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(r.images_recompressed, converted.len(), "{r:?}");
+    for i in converted {
+        assert_eq!(stream(&doc, i).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "{i:?}");
+    }
+    assert_eq!(before(&doc, &left), untouched);
+    let new = before(&doc, &converted);
+    assert_eq!((r.image_bytes_before, r.image_bytes_after), (old.iter().map(|b| b.len()).sum(), new.iter().map(|b| b.len()).sum()));
+}
+
 /// An image whose /DecodeParms are a reference, or hold numbers given by reference
 /// (`/Predictor 9 0 R`, which `Dict::int` doesn't follow), is read through them, as one with them
 /// direct: a predictor's tag bytes would otherwise shift every row, and the image would be stored

From 4543bae3bfd00cd17183fe63f2540f56831fd2ac Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 16:56:27 +0100
Subject: [PATCH 083/132] M11: say redaction and export don't read Group 4 yet;
 Reduce File Size's descriptions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Redaction doesn't decode CCITT, so a mark over part of an image the
  optimizer stored as Group 4 removes the whole image (nothing leaks),
  and Export ▸ Images refuses it. The optimize README and the
  mono-compression parity note say so. Later PRs of this stack add both
  (#4335 export, #4384 redaction).
- doc_reduce's description, Engine::reduced_bytes and docs/cli-batch.md
  now list the black-and-white step; docs/target-app-parity.md's
  optimize row gives the measured counts and no longer lists CCITT as
  missing; the M11 milestone row lists it as done.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/automation/src/tools.rs     | 2 +-
 crates/engine/src/session/files.rs | 9 +++++----
 crates/optimize/README.md          | 3 ++-
 docs/cli-batch.md                  | 3 ++-
 docs/roadmap.md                    | 2 +-
 docs/target-app-parity.md          | 2 +-
 parity/acrobat-features.toml       | 2 +-
 7 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index c4a9f283b5..2760be9298 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1332,7 +1332,7 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["from"],
         )),
-        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
+        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images stored as CCITT Group 4 whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
             .cmd("optimize.reduce")
             .with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
         t("doc_initial_view", "Initial view", "Read or change how the document opens (Document Properties ▸ Initial View) and its reading options: navigation (page, bookmarks, pages, attachments, layers), layout (default, single, continuous, two_up, two_up_continuous, two_up_cover, two_up_continuous_cover), magnification (default, actual, fit_page, fit_width, fit_height, fit_visible, or a percentage), page, window options (fit_window, center_window, full_screen, display_title), interface options (hide_menubar, hide_toolbar, hide_window_ui), language and binding (left, right). Only the given ones change; returns the result. Undoable.").with(schema(
diff --git a/crates/engine/src/session/files.rs b/crates/engine/src/session/files.rs
index 1e8cd9b08a..5453163aca 100644
--- a/crates/engine/src/session/files.rs
+++ b/crates/engine/src/session/files.rs
@@ -68,10 +68,11 @@ impl Session {
         if pdf { Ok(bytes.clone()) } else { self.convert_to_pdf(name, bytes).map(|(_, pdf)| pdf) }
     }
 
-    /// Reduce File Size: Acrobat's defaults (images above 225 ppi to 150 ppi, JPEG medium
-    /// quality; thumbnails dropped), identical resources merged, unused objects dropped, objects
-    /// packed into compressed object streams. Returns the bytes and how many objects were
-    /// merged. The open document is not changed (Acrobat saves the reduced copy as a new file).
+    /// Reduce File Size: Acrobat's defaults (colour and grey images above 225 ppi to 150 ppi,
+    /// JPEG medium quality; black-and-white stored as CCITT Group 4 whenever smaller; thumbnails
+    /// dropped), identical resources merged, unused objects dropped, objects packed into
+    /// compressed object streams. Returns the bytes and how many objects were merged. The open
+    /// document is not changed (Acrobat saves the reduced copy as a new file).
     pub fn reduced_bytes(&self, id: DocId) -> Result<(Arc<Vec<u8>>, usize), EditError> {
         let (bytes, report) = self.optimized_bytes(id, &optimize::Settings::default(), &[])?;
         Ok((bytes, report.merged))
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 3bb09038c6..e153de7af0 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -41,7 +41,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
   JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
-  than 32,767 samples.
+  than 32,767 samples. Redaction doesn't decode Group 4 yet: a mark over part of an image stored
+  this way removes the whole image (nothing leaks), and Export ▸ Images can't export one.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/docs/cli-batch.md b/docs/cli-batch.md
index ffe0356cf5..0892791194 100644
--- a/docs/cli-batch.md
+++ b/docs/cli-batch.md
@@ -27,7 +27,8 @@ new engine importers become available here automatically. Without `convert`,
 only `.pdf` inputs are processed. Unsupported extensions are reported as skipped.
 
 - `optimize` uses Reduce File Size settings: JPEG quality 60, resampling to 150 ppi
-  above 225 ppi, plus the existing document cleanup. `--ppi` (9–1600) sets the target
+  above 225 ppi (black-and-white images stored as CCITT Group 4 when smaller), plus the
+  existing document cleanup. `--ppi` (9–1600) sets the target
   and a threshold of 1.5 times that value; `--quality` (1–100) sets JPEG quality.
   These settings can lose image detail. A candidate that is not smaller retains
   the bytes entering that step. This is not an images-only or lossless preset.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 9a2a42dacc..75be8e3833 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -196,7 +196,7 @@ total matches the parity estimate.
 | M8 | Security + redaction | 100–180 | 68% | 15–30 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize.<br>Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Redaction cleans indirect and form structure references, preserving surviving form tags. Redaction retires inherited resource dictionaries, so a parent `/Pages` can't keep a removed XObject reachable; unredacted pages are left untouched. Image redaction removes alternate images and unsupported masks only on affected images. Changed marked-content spans lose replacement descriptions; untouched spans keep theirs. Hidden-text cleanup retires unused named descriptions across inherited/shared page and form resources (64 focused tests and scoped Rust 1.96 Clippy/wasm checks pass; publication CI pending). The redaction audit counts a filled cover that hides half of any one word of a long line (#2662), applied or not. Phone-pattern redaction also matches labelled Italian geographic numbers with `+39` and a slash after the area code (#3205 follow-up); unlabelled international slash numbers remain unsupported. Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
 | M9 | Signatures (PAdES, validation) | 160–280 | 60% | 40–70 | Done: new `sign` crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL.<br>Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites, page validation overlays separate from original signature artwork (baked Not Verified captions remain; #79 open), snapshot tabs that reuse instead of multiplying. Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11 |
 | M10 | OCR, create, export, print | 200–350 | 33% | 120–215 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, the CUPS and Windows spoolers, print-ready PDF).<br>Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; architectural/ANSI/large ISO sheet presets, Match page at 100% and PDF-scale preview (#599 follow-up); Create PDF from multiple files (PDFs, images and text, edited as pages in the grid); OCR can also read pictures on pages that have text, without adding that text twice (#1028). Model staging fetches SHA-256-verified ONNX detection/recognition files after the upstream RTEN URL brownout; runtime discovery prefers complete ONNX pairs per directory, then complete legacy RTEN pairs, without mixing formats or changing directory precedence. Done since: Word invoice export uses borderless inferred tables, floating positioned text/artwork only where text overlaps an image or is rotated, and per-page sizes, covered by synthetic invoice automation regressions (#773); printing on the web through the browser's print dialog, sheets drawn by PdfCraft (gap 4). Lossless image export applies per-component Decode, including Indexed mapping (#1201 partial). Existing 16-bit precision and color-management limits remain. #3532 partial: vector printing retains existing appearances with absent Subtype through a print-owned Form copy; source artwork stays unchanged. #3120: Office export reads form XObjects 50 levels deep, as the renderer does, and up to 50 000 a page; pages past that are listed in `truncated_pages`. Word table cells use the grid columns they span, including cells after a merged cell. Done since: text in a table slot covered by another cell's span remains as paragraph text in Word, HTML, RTF and PowerPoint. Missing: OCR languages beyond Latin, editable-text OCR output, full Office layout fidelity/import. Done since: dotted-leader contents entries stay in separate complete paragraphs (#1757) #2156 candidate: last selected print paper persists across sessions; other print preferences unchanged. Image export applies soft-mask Decode opacity intervals before resizing, including indirect entries and inverted ranges. Vector printing gives annotation appearances unoccupied XObject names so existing page artwork survives. |
-| M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Target-version compatibility is partial: newer content is not detected or converted. Content stream boundaries preserve comments, split operands and graphics state when image fragments merge. Image downsampling includes page-local `/UserUnit` scaling when measuring physical resolution. Done since: reject invalid image and soft-mask dimensions with checked sizing (#2178). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
+| M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Target-version compatibility is partial: newer content is not detected or converted. Content stream boundaries preserve comments, split operands and graphics state when image fragments merge. Image downsampling includes page-local `/UserUnit` scaling when measuring physical resolution. Done since: reject invalid image and soft-mask dimensions with checked sizing (#2178); black-and-white images stored losslessly as CCITT Group 4 when smaller. Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Character encoding accepts Identity-H/V with Adobe CJK collections and predefined CJK CMaps independently (#3673); per-glyph validation and embedded-font extraction remain separate.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded, text-only auto-tag proposal tool for one page. Marking a figure decorative rewrites only that stream (#1324). An XFA radio item whose value contains a space is written back unchanged (#1319). Done since: #2569: Growable multiline XFA text reflows after edits, with undo/redo, save/reopen and print coverage; oversized fields still become read-only page text. Structured-data synchronization warnings retain accepted whitespace without relayout from stale data. Done since: #2572: Every repeated page-master button resolves its own field to the shared XFA click script, including print buttons. Done since: #2570: Dynamic XFA rich-text fields carry exData/maxLength into AcroForm MaxLen for reported and enforced Unicode character limits, retained after save/reopen. Done since: #2589: Active XFA skips PDF-container fallback scripts while retaining requested messages and saved scripts; ordinary/static/unlaid-out documents and explicit console/field calls keep their existing behavior. Missing: writing proposed tags and parent tree, field autotag, visual Tags/Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA<br>Reading colours: pending page backgrounds follow the configured colour (#2059). |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers<br>Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. `text_find` also caps the per-page match ranges it materializes at the remaining result limit plus one continuation match. CLI robustness scans visit each directory once through overlapping roots and symlink aliases. |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Character encoding accepts Identity-H/V with Adobe CJK collections and predefined CJK CMaps independently (#3673); per-glyph validation and embedded-font extraction remain separate.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded text-only auto-tag proposal tool; text-only Apply writes marked content, paragraph tags and a parent tree, then opens the Tags panel for review. Missing: mixed-content and field autotag, heading/list/table/figure classification, Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA<br>Done since: CLI info, text and render use dynamic XFA layout pages, with synthetic count/text/pixel and copy-permission regressions (#1645).<br>Reading colours: pending page backgrounds follow the configured colour (#2059). |
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 6c7920e33c..7bc4ec71e3 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -208,7 +208,7 @@ full parity in that area.
 | H Digital signatures | 45 | 23 | 10 | 62.2% | 45% | 40–70 | PAdES B-B signing and validation (PKCS #12, macOS Keychain, Windows store with PIN prompts), certification, encrypted documents, certificate usage checks; B-T, LTV, OCSP/CRL with caller-supplied evidence. Missing: PKCS #11 and smart cards outside Windows, timestamp-server preferences, online revocation fetching, FieldMDP and field locking, OS trust store, EU Trusted Lists, compare signed version |
 | I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, despeckle, camera images beyond straightening (found or placed corners): orientation, clean-up, MRC compression, scanners |
 | J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Missing: Office/HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
-| K Optimize and standards | 58 | 15 | 10 | 34.5% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2/CCITT |
+| K Optimize and standards | 58 | 17 | 11 | 38.8% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2 and downsampling |
 | L Print | 39 | 15 | 1 | 39.7% | 35% | 30–55 | Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, print-ready PDF, CUPS on macOS/Linux, the Windows spooler (#756) and the browser's print dialog on the web. Missing: print as image, PostScript, all print-production tools (output preview, separations, ink manager, printer marks, colour conversion) |
 | M Accessibility | 61 | 38 | 1 | 63.1% | 30% | 40–70 | Accessibility Checker (all 32 rules, report, fixes), alternate text, title and language. Missing: autotag, Tags/Order/Content panels, Reading Order tool, artifact marking, table editor, Read Out Loud, full keyboard operation of the app, screen-reader audit |
 | N Automation, preferences, misc | 75 | 20 | 5 | 30.0% | 35% | 25–45 | CLI, MCP, UI control channel, 141 automation tools, Action Wizard (run, create), compare (text, visual, report, side by side, Text/Visual filter). Missing: most Preferences pages, Acrobat's finer compare filters, Action Wizard management, custom commands, AI providers, rich media/3D, hosted web app |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index daffc88188..236237e1e9 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), and Export ▸ Images can't export one."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From b76ffe64f1260383682d3ca87012b93e5d84a09d Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:21:14 +0100
Subject: [PATCH 084/132] M11: the decode allowance takes ASCIIHex text broken
 into lines

The optimizer's images decode no further than twice their samples plus
a byte a row, meant for ASCIIHex text under Flate; but hex text broken
into lines, as it usually is, is a little more than twice, so such an
image was left alone as if it were a decompression bomb (a 300 dpi
letter scan stayed Flate). It is three bytes for each now, a separator
for every two digits, and a test stores both images as hex text in
lines of 64 digits.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/src/images.rs     |  7 ++++---
 crates/optimize/tests/optimize.rs | 31 +++++++++++++++++++++++++++++--
 2 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index f516af7319..57e583a078 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -284,10 +284,11 @@ pub(crate) fn pixels(doc: &Document, s: &Stream, n: usize) -> Option<Vec<u8>> {
 }
 
 /// How far an image of `bytes` samples in `rows` rows is decoded: a filter stage may produce up
-/// to twice them (ASCIIHex text under Flate) plus a PNG predictor's byte a row. More can only be a
-/// decompression bomb, and the image is left alone.
+/// to three bytes for each of them and of a PNG predictor's bytes a row (ASCIIHex text under
+/// Flate, its two digits a byte broken into lines or spaced). More can only be a decompression
+/// bomb, and the image is left alone.
 fn allowance(bytes: usize, rows: u32) -> Option<usize> {
-    bytes.checked_add(usize::try_from(rows).ok()?)?.checked_mul(2)?.checked_add(4096)
+    bytes.checked_add(usize::try_from(rows).ok()?)?.checked_mul(3)?.checked_add(4096)
 }
 
 /// Whether the samples of a three-component JPEG are YCbCr, to be converted to RGB (ISO 32000-2
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index e1a088b561..3fce1dadba 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -535,13 +535,14 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
 
 /// An image whose data decodes far past what its samples can need (a decompression bomb) is left
 /// alone rather than decoded up to the 1 GiB limit: a 1-bit one that would become Group 4, and an
-/// eight-bit one that would be resampled, each with a megabyte of zeros after its samples.
+/// eight-bit one that would be resampled, each with four megabytes of zeros after its samples. Stored
+/// as ASCIIHex text under Flate, broken into lines of 64 digits, their samples aren't a bomb.
 #[test]
 fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
     let (w, h) = (1200u32, 480u32);
     let text = bilevel(w, h, false);
     let shades: Vec<u8> = (0..w * h).map(|i| ((i % w) * 255 / w) as u8 ^ ((i / w) as u8 & 0x0F)).collect();
-    for padding in [0, 1 << 20] {
+    for padding in [0, 4 << 20] {
         let mut doc = Document::new_empty();
         let padded = |data: &[u8]| data.iter().copied().chain(std::iter::repeat_n(0, padding)).collect::<Vec<u8>>();
         let grey = |bits: i64| [("BitsPerComponent", bits.into()), ("ColorSpace", Object::name("DeviceGray"))];
@@ -559,6 +560,32 @@ fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
             assert_eq!(after, before);
         }
     }
+    let hex_lines = |data: &[u8]| {
+        let digits: Vec<u8> = data.iter().flat_map(|b| format!("{b:02X}").into_bytes()).collect();
+        let mut text: Vec<u8> = digits.chunks(64).flat_map(|line| line.iter().copied().chain(*b"\n")).collect();
+        text.push(b'>');
+        pdfcraft_filters::encode_flate(&text)
+    };
+    let mut doc = Document::new_empty();
+    let as_hex = |doc: &mut Document, data: &[u8], bits: i64, (w, h): (u32, u32)| {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(bits));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("ASCIIHexDecode")]));
+        doc.add(Object::Stream(Stream::from_raw(d, hex_lines(data))))
+    };
+    // Large enough that its hex text in lines is more than twice its samples and a byte a row
+    // plus 4 KiB: 2560 × 1200, drawn at 400 ppi.
+    let page_scan = bilevel(2560, 1200, false);
+    let one_bit = as_hex(&mut doc, &page_scan, 1, (2560, 1200));
+    let eight_bit = as_hex(&mut doc, &shades, 8, (w, h));
+    page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 460.8 0 0 216 20 500 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
+    optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(stream(&doc, one_bit).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "1-bit hex text in lines: Group 4");
+    assert!(stream(&doc, eight_bit).dict.int(b"Width").is_some_and(|nw| nw < i64::from(w)), "8-bit hex text in lines: resampled");
 }
 
 #[test]

From 656c6ef0f4267277ab72937646c2e64c510849e7 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:21:14 +0100
Subject: [PATCH 085/132] M11: name every reader that doesn't take Group 4 yet;
 count the new partial in the parity tables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Not only Export ▸ Images refuses a CCITT image until #4335: so does
  everything that exports an image through it. Save Image As refuses
  it, Copy Image fails, and Word, PowerPoint and HTML export leave the
  picture out, with the page not reported. The optimize README and the
  mono-compression parity note name them.
- optimize.mono-compression is partial now, so docs/target-app-parity.md
  counts it on the table's own measurement: K Optimize and standards 15
  shipped and 11 partial of 58 (35.3%), breadth 57.0% (423 + 75 of 808),
  mainstream 63.3% (292 + 45 of 497), with a status line and a revision
  row. ROADMAP.md's breadth rows and its K row say the same.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 ROADMAP.md                   |  6 +++---
 crates/optimize/README.md    |  4 +++-
 docs/target-app-parity.md    | 14 ++++++++------
 parity/acrobat-features.toml |  2 +-
 4 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 42f70325bc..87f5b6705f 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -95,8 +95,8 @@ and add a line to the [progress log](#progress-log); when a gap closes, remove i
 
 | | Value | Kind |
 |---|---|---|
-| **Feature breadth** | **≈ 67%** tier-weighted (56.9% unweighted: 423 shipped + 74 partial of 808; P0 94.2%) | measured, `parity/acrobat-features.toml` |
-| Feature breadth, mainstream practitioner | ≈ 70% tier-weighted (63.2% unweighted; P0 95.3%) | measured ([split](docs/target-app-parity.md#mainstream-practitioner-vs-full-acrobat-pro)) |
+| **Feature breadth** | **≈ 67%** tier-weighted (57.0% unweighted: 423 shipped + 75 partial of 808; P0 94.2%) | measured, `parity/acrobat-features.toml` |
+| Feature breadth, mainstream practitioner | ≈ 70% tier-weighted (63.3% unweighted; P0 95.3%) | measured ([split](docs/target-app-parity.md#mainstream-practitioner-vs-full-acrobat-pro)) |
 | **Ready for real work**, full Acrobat Pro | **≈ 50%** (45–53%) | estimated, weighted sum over [dimensions](#by-dimension) |
 | **Ready for real work**, mainstream practitioner | **≈ 55%** (50–60%) | estimated ([split](docs/target-app-parity.md#mainstream-practitioner-vs-full-acrobat-pro)) |
 | **Ready for real work**, essentials user | **≈ 66%** (60–70%) | estimated ([method](docs/target-app-parity.md#essentials-user)) |
@@ -151,7 +151,7 @@ Hours are calibrated as in [Effort and calibration](docs/target-app-parity.md#ef
 | H Digital signatures | 62.2% | 45% | 40–70 |
 | I Scan and OCR | 23.1% | 15% | 40–75 |
 | J Create and export | 39.7% | 25% | 55–100 |
-| K Optimize and standards | 34.5% | 20% | 65–115 |
+| K Optimize and standards | 35.3% | 20% | 65–115 |
 | L Print | 39.7% | 35% | 30–55 |
 | M Accessibility | 63.1% | 30% | 40–70 |
 | N Automation, preferences, misc | 30.0% | 35% | 25–45 |
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index e153de7af0..c3281f00c4 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -42,7 +42,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
   JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
   than 32,767 samples. Redaction doesn't decode Group 4 yet: a mark over part of an image stored
-  this way removes the whole image (nothing leaks), and Export ▸ Images can't export one.
+  this way removes the whole image (nothing leaks). Nor does anything that exports an image:
+  Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML
+  export leave the picture out.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 7bc4ec71e3..d790e98178 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,5 +1,6 @@
 # PdfCraft parity with Adobe Acrobat Pro
 
+> **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (`optimize.mono-compression` partial (CCITT Group 4): K Optimize and standards 15 shipped and 11 partial of 58, 35.3%; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497); estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (localization current state: Arabic logical catalog, explicit RTL direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite. Scores and estimates unchanged)
 
 > **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-13 · **Change:** minor (localization ≈59% → ≈68%; weighted readiness 49.25 → 49.7 ≈ 50%) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
@@ -20,9 +21,9 @@ Approved Trust List) are out of scope: 23 such features are tracked as `na` in
 | | Value | Kind |
 |---|---|---|
 | **Feature breadth**, tier-weighted | **≈ 67%** | measured (checklist; weights below) |
-| Feature breadth, unweighted | 56.9% (423 shipped + 74 partial of 808) | measured (`cargo xtask parity` arithmetic) |
+| Feature breadth, unweighted | 57.0% (423 shipped + 75 partial of 808) | measured (`cargo xtask parity` arithmetic) |
 | Must-have (P0) features | 94.2% (226 + 23 partial of 252) | measured |
-| Feature breadth, mainstream practitioner | ≈ 70% tier-weighted (63.2% unweighted: 292 + 44 partial of 497; P0 95.3%) | measured ([split below](#mainstream-practitioner-vs-full-acrobat-pro)) |
+| Feature breadth, mainstream practitioner | ≈ 70% tier-weighted (63.3% unweighted: 292 + 45 partial of 497; P0 95.3%) | measured ([split below](#mainstream-practitioner-vs-full-acrobat-pro)) |
 | **Ready for real work**, full Acrobat Pro | **≈ 50%** (range 45–53%) | estimated (weighted sum over dimensions, [below](#by-dimension)) |
 | **Ready for real work**, mainstream practitioner | **≈ 55%** (range 50–60%) | estimated ([split below](#mainstream-practitioner-vs-full-acrobat-pro)) |
 | **Ready for real work**, essentials user | **≈ 66%** (range 60–70%) | estimated ([below](#essentials-user)) |
@@ -105,9 +106,9 @@ Splitting it (measured from `parity/acrobat-features.toml`):
 
 | Slice | Features | Shipped | Partial | Unweighted | Tier-weighted | P0 |
 |---|---|---|---|---|---|---|
-| Mainstream: view, comment (without measuring), edit, organize, forms (without XFA and JavaScript tooling), protect and redact, OCR, create and export, compress (Reduce File Size, Optimizer), print (without print production) | 497 | 292 | 44 | 63.2% | ≈ 70% | 95.3% (193) |
+| Mainstream: view, comment (without measuring), edit, organize, forms (without XFA and JavaScript tooling), protect and redact, OCR, create and export, compress (Reduce File Size, Optimizer), print (without print production) | 497 | 292 | 45 | 63.3% | ≈ 70% | 95.3% (193) |
 | Specialist: core internals, digital-signature PKI, accessibility remediation, automation and preferences, Preflight and PDF/A/X/UA, print production, measuring, XFA and JavaScript tooling | 311 | 131 | 30 | 46.9% | ≈ 63% | 90.7% (59) |
-| All | 808 | 423 | 74 | 56.9% | ≈ 67% | 94.2% (252) |
+| All | 808 | 423 | 75 | 57.0% | ≈ 67% | 94.2% (252) |
 
 So the checklist is **not** dominated by niche surface (38% of rows), and the P0 tier, which is
 mostly mainstream, is at 94–95% in both slices. What holds the mainstream number down is P1 depth
@@ -208,11 +209,11 @@ full parity in that area.
 | H Digital signatures | 45 | 23 | 10 | 62.2% | 45% | 40–70 | PAdES B-B signing and validation (PKCS #12, macOS Keychain, Windows store with PIN prompts), certification, encrypted documents, certificate usage checks; B-T, LTV, OCSP/CRL with caller-supplied evidence. Missing: PKCS #11 and smart cards outside Windows, timestamp-server preferences, online revocation fetching, FieldMDP and field locking, OS trust store, EU Trusted Lists, compare signed version |
 | I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, despeckle, camera images beyond straightening (found or placed corners): orientation, clean-up, MRC compression, scanners |
 | J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Missing: Office/HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
-| K Optimize and standards | 58 | 17 | 11 | 38.8% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2 and downsampling |
+| K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2 and downsampling |
 | L Print | 39 | 15 | 1 | 39.7% | 35% | 30–55 | Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, print-ready PDF, CUPS on macOS/Linux, the Windows spooler (#756) and the browser's print dialog on the web. Missing: print as image, PostScript, all print-production tools (output preview, separations, ink manager, printer marks, colour conversion) |
 | M Accessibility | 61 | 38 | 1 | 63.1% | 30% | 40–70 | Accessibility Checker (all 32 rules, report, fixes), alternate text, title and language. Missing: autotag, Tags/Order/Content panels, Reading Order tool, artifact marking, table editor, Read Out Loud, full keyboard operation of the app, screen-reader audit |
 | N Automation, preferences, misc | 75 | 20 | 5 | 30.0% | 35% | 25–45 | CLI, MCP, UI control channel, 141 automation tools, Action Wizard (run, create), compare (text, visual, report, side by side, Text/Visual filter). Missing: most Preferences pages, Acrobat's finer compare filters, Action Wizard management, custom commands, AI providers, rich media/3D, hosted web app |
-| **All** | **808** | **423** | **74** | **56.9%** | **≈ 49%** | **610–1,100** | Plus 175–325 h of cross-cutting work (dimension table) |
+| **All** | **808** | **423** | **75** | **57.0%** | **≈ 49%** | **610–1,100** | Plus 175–325 h of cross-cutting work (dimension table) |
 
 Shipped features rest on thin evidence: 141 of 423 cite exactly one test, and only a handful cite
 an external oracle (`pdftotext`, `pdfsig`, OpenSSL, `qpdf --check`, a corpus).
@@ -294,6 +295,7 @@ licensed OCR or AI model.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | `optimize.mono-compression` became partial (CCITT Group 4), counted on the table's own measurement: K Optimize and standards 15 shipped and 11 partial of 58 (35.3%), no longer listing CCITT as missing; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497). Estimates unchanged. |
 | 2026-10-25 | minor | Localization current state: Arabic catalogs stay logical, Arabic/Kurdish labels take an explicit RTL direction, and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native Simplified Chinese uses LXGW WenKai Lite; the web build has no Hans face. Scores and estimates unchanged. |
 | 2026-10-20 | minor | M12 #3673: the Character encoding rule accepts Identity-H/V fonts with Adobe CJK collections, or a predefined non-Identity CMap, while rejecting unknown names and foreign registries. Synthetic checker and read-only automation regressions passed after failing before the fix; per-glyph mapping validation and embedded-font extraction remain separate. Breadth, readiness and hours unchanged. |
 | 2026-10-12 | minor | Exclusive image crops resize with their pixels across nested states, intervening operators and content streams; shared clips remain fixed. Synthetic engine/tool regressions and private image save/reopen checks; estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 236237e1e9..02d7219aba 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), and Export ▸ Images can't export one."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), nor does anything that exports an image: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 1b7164cab1fc187c5385c30f94449542fe284280 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 18:47:31 +0100
Subject: [PATCH 086/132] M11: the spec parity table says the Optimizer encodes
 CCITT Group 4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

docs/pdf-spec-parity.md's §7.4 row still said there was no CCITT
encoding; it names the Optimizer's Group 4 encoder now, with a status
line and a revision row.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 docs/pdf-spec-parity.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index 8cfe4be471..dba04f6c4c 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-24 · **Change:** minor (§14.3: custom properties edited in Document Properties) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: CCITT Group 4 encoding in the Optimizer; earlier, §14.3: custom properties edited in Document Properties) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -21,7 +21,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 |---|---|---|---|---|
 | §7.2–7.5 | Syntax, objects, file structure, xref tables and streams, object streams, hybrid files, incremental updates | full | **own**, tolerant, repairs damaged files | `crates/cos`; corpus 958 files; fuzzed nightly |
 | §7.4 | Stream filters: Flate, LZW, ASCII85, ASCIIHex, RunLength, predictors | full | **own** | `crates/filters` |
-| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode only) | `core.image-filters` partial; own codecs M1.1/M1.2; no JBIG2/CCITT encoding (Optimizer) |
+| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; the Optimizer encodes CCITT Group 4 (`pdfcraft_filters::encode_g4`, `optimize.mono-compression`); no JBIG2 encoding |
 | §7.5.8 | Linearization | R W | R only | `core.linearization` planned |
 | §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; written files open in Acrobat DC since #836 (#774: Acrobat needs the catalog outside object streams) |
 | §7.6.5 | Public-key security handler | full | none | `core.open-public-key`, `protect.certificate-encryption` planned |
@@ -130,6 +130,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | §7.4: CCITT Group 4 encoding (`fax`) in the Optimizer |
 | 2026-10-14 | minor | §12.4.4: `/Trans` and `/Dur` read into `DocInfo::transitions` and reported by `doc_info` |
 | 2026-10-11 | minor | §7.6.4: encrypted files we write open in Acrobat (#774, fixed by #836) |
 | 2026-10-10 | major | Created from the code, `vendor/README.md` and `parity/acrobat-features.toml`, against ISO 32000-2 and Acrobat Pro 26.002.21931's documented capabilities |

From 9883da3bc33397d522b086fa0035ecbdaa7a4def Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 00:56:00 +0200
Subject: [PATCH 087/132] M11: Create PDF stores black-and-white images at one
 bit, as Group 4 when smaller

A scan saved as a 1-bit PNG decodes to eight-bit grey and was stored
that way, larger than the PNG it came from; a bilevel TIFF was stored at
one bit but with Flate. Now any image of only pure black and white
(1-bit, eight-bit grey, a two-colour palette, RGB without a profile) is
stored at one bit per pixel, as CCITT Group 4 or Flate, whichever is
smaller as stored. A grey profile stays; RGB with a profile keeps its
colours.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 Cargo.lock                 |   2 +
 crates/create/Cargo.toml   |   2 +
 crates/create/src/lib.rs   |  75 ++++++++++++++++-
 crates/create/src/tests.rs | 168 +++++++++++++++++++++++++++++++++++++
 4 files changed, 244 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 42426bc688..e2427a1b0a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4333,9 +4333,11 @@ name = "pdfcraft-create"
 version = "0.15.0"
 dependencies = [
  "encoding_rs",
+ "hayro-ccitt",
  "hayro-syntax",
  "image",
  "pdfcraft-cos",
+ "pdfcraft-filters",
  "pdfcraft-fonts",
  "pdfcraft-model",
  "pdfcraft-xfa",
diff --git a/crates/create/Cargo.toml b/crates/create/Cargo.toml
index 12daad621c..56cebc2af6 100644
--- a/crates/create/Cargo.toml
+++ b/crates/create/Cargo.toml
@@ -10,6 +10,7 @@ workspace = true
 
 [dependencies]
 pdfcraft-cos = { workspace = true }
+pdfcraft-filters = { workspace = true }
 pdfcraft-model = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 # For `image::bmp_with_pixel_offset`, shared with XFA pictures.
@@ -24,5 +25,6 @@ thiserror = { workspace = true }
 encoding_rs = "0.8"
 
 [dev-dependencies]
+hayro-ccitt.workspace = true
 image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg"] }
 hayro-syntax = { workspace = true }
diff --git a/crates/create/src/lib.rs b/crates/create/src/lib.rs
index a6fb28b3d6..36b52d4211 100644
--- a/crates/create/src/lib.rs
+++ b/crates/create/src/lib.rs
@@ -2,7 +2,7 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
-use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream, serialize};
 
 mod extract;
 mod upright_image;
@@ -108,9 +108,42 @@ fn jpeg_icc(mut chunks: Vec<(u8, u8, &[u8])>) -> Option<Vec<u8>> {
     complete.then(|| chunks.iter().flat_map(|c| c.2.iter().copied()).collect())
 }
 
+/// The samples of a black-and-white image packed one bit per pixel (1 for white, each row
+/// starting on a byte): eight-bit grey (`n` 1) or RGB (`n` 3) whose every pixel is pure black or
+/// pure white, or one-bit grey, already packed (a bilevel TIFF). `None` for anything else, found
+/// at its first other pixel.
+fn bilevel(data: &[u8], (w, h): (u32, u32), n: usize, bits: Option<i64>) -> Option<Vec<u8>> {
+    let (w, h) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
+    let stride = w.div_ceil(8);
+    let size = stride.checked_mul(h)?;
+    match (bits, n) {
+        (Some(1), 1) => data.get(..size).map(<[u8]>::to_vec),
+        (Some(8), 1 | 3) if w > 0 => {
+            let samples = data.get(..w.checked_mul(h)?.checked_mul(n)?)?;
+            let mut packed = vec![0u8; size];
+            for (i, px) in samples.chunks_exact(n).enumerate() {
+                let white = match px {
+                    [0] | [0, 0, 0] => false,
+                    [255] | [255, 255, 255] => true,
+                    _ => return None,
+                };
+                if white && let Some(b) = packed.get_mut((i / w) * stride + (i % w) / 8) {
+                    *b |= 0x80 >> (i % w % 8);
+                }
+            }
+            Some(packed)
+        }
+        _ => None,
+    }
+}
+
 /// Add `img` to `doc` as an image XObject. An ICC profile becomes an `/ICCBased` colour space
 /// (with the device space as `/Alternate`); `profiles` shares one object between images that
 /// carry the same profile.
+///
+/// A black-and-white image is stored at one bit per pixel, as CCITT Group 4 when that is smaller
+/// than Flate: losslessly, and several times smaller than the eight bits a scan saved as a 1-bit
+/// PNG decodes to. RGB keeps its colour space when it has a colour profile.
 fn add_image(doc: &mut Document, img: Embedded, profiles: &mut Vec<(Vec<u8>, ObjRef)>) -> ObjRef {
     let mut d = img.dict;
     d.set(b"Type".to_vec(), Object::name("XObject"));
@@ -118,12 +151,48 @@ fn add_image(doc: &mut Document, img: Embedded, profiles: &mut Vec<(Vec<u8>, Obj
     d.set(b"Width".to_vec(), Object::Int(img.px.0 as i64));
     d.set(b"Height".to_vec(), Object::Int(img.px.1 as i64));
     let device = d.name(b"ColorSpace").map(<[u8]>::to_vec);
-    let n = match device.as_deref() {
+    let mut n = match device.as_deref() {
         Some(b"DeviceGray") => 1,
         Some(b"DeviceRGB") => 3,
         Some(b"DeviceCMYK") => 4,
         _ => 0,
     };
+    let (mut data, mut filtered) = (img.data, img.filtered);
+    let profiled_rgb = n == 3 && img.icc.is_some();
+    if !filtered
+        && !profiled_rgb
+        && let Some(packed) = bilevel(&data, img.px, n, d.int(b"BitsPerComponent"))
+    {
+        if n == 3 {
+            d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+            n = 1;
+        }
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+        // The smaller as stored, dictionary included: Group 4's parameters outweigh its saving on
+        // a tiny image.
+        let stored = |d: &Dict, data: &[u8]| {
+            let mut out = Vec::new();
+            serialize(&Object::Dict(d.clone()), &mut out);
+            out.len().saturating_add(data.len())
+        };
+        let mut flate_dict = d.clone();
+        flate_dict.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        let flate = pdfcraft_filters::encode_flate(&packed);
+        (d, data) = match pdfcraft_filters::encode_g4(&packed, img.px.0, img.px.1) {
+            Ok(g4) => {
+                let mut parms = Dict::new();
+                parms.set(b"K".to_vec(), Object::Int(-1));
+                parms.set(b"Columns".to_vec(), Object::Int(i64::from(img.px.0)));
+                parms.set(b"Rows".to_vec(), Object::Int(i64::from(img.px.1)));
+                let mut g4_dict = d.clone();
+                g4_dict.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+                g4_dict.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+                if stored(&g4_dict, &g4) < stored(&flate_dict, &flate) { (g4_dict, g4) } else { (flate_dict, flate) }
+            }
+            Err(_) => (flate_dict, flate),
+        };
+        filtered = true;
+    }
     if let (Some(icc), Some(device)) = (img.icc.and_then(|p| icc_for(p, n)), device) {
         let r = match profiles.iter().find(|(p, _)| *p == icc) {
             Some((_, r)) => *r,
@@ -142,7 +211,7 @@ fn add_image(doc: &mut Document, img: Embedded, profiles: &mut Vec<(Vec<u8>, Obj
         let mr = doc.add(Object::Stream(Stream::flate(m, &alpha)));
         d.set(b"SMask".to_vec(), Object::Ref(mr));
     }
-    let stream = if img.filtered { Stream::from_raw(d, img.data) } else { Stream::flate(d, &img.data) };
+    let stream = if filtered { Stream::from_raw(d, data) } else { Stream::flate(d, &data) };
     doc.add(Object::Stream(stream))
 }
 
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 5cd34a0f1a..f94fc020a1 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1338,3 +1338,171 @@ fn a_tiny_gif_on_a_huge_screen_is_refused() {
     let doc = reopen(&from_images(&[("small.gif".into(), gif_on_screen(40, 30))]).unwrap());
     assert_eq!(media(&pages(&doc)[0]), [0.0, 0.0, 40.0, 30.0]);
 }
+
+/// A PNG of `w` × `h` samples `data` in `color` at `depth`, with a palette or an ICC profile.
+fn png_of(w: u32, h: u32, color: png::ColorType, depth: png::BitDepth, data: &[u8], palette: Option<Vec<u8>>, icc: Option<Vec<u8>>) -> Vec<u8> {
+    let mut out = Vec::new();
+    {
+        let mut info = png::Info::with_size(w, h);
+        info.color_type = color;
+        info.bit_depth = depth;
+        info.palette = palette.map(Into::into);
+        info.icc_profile = icc.map(Into::into);
+        let mut writer = png::Encoder::with_info(&mut out, info).unwrap().write_header().unwrap();
+        writer.write_image_data(data).unwrap();
+    }
+    out
+}
+
+/// Rows of `w` one-bit samples (1 white), each on a new byte: lines of glyphs drawn from a few
+/// shapes at uneven spacing, whose edges move a pixel now and then, as a scan of text has them.
+/// (Clean, evenly spaced strokes favour Flate over Group 4.)
+fn strokes(w: u32, h: u32) -> Vec<u8> {
+    let stride = (w as usize).div_ceil(8);
+    let mut data = vec![0xFF; stride * h as usize];
+    let mut seed = 0x9E37_79B9_7F4A_7C15u64;
+    let mut next = move || {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        seed
+    };
+    let (w, h) = (w as usize, h as usize);
+    for line in (4..h.saturating_sub(18)).step_by(24) {
+        let mut x = 8;
+        while x + 16 < w {
+            let wide = 5 + (next() % 4) as usize;
+            let shape = next() % 4;
+            let mut fill = |x0: usize, x1: usize, y0: usize, y1: usize| {
+                for y in line + y0..line + y1 {
+                    let ragged = |r: u64| match r % 8 {
+                        0 => 0,
+                        1 => 2,
+                        _ => 1,
+                    };
+                    let (left, right) = ((x + x0 + 1).saturating_sub(ragged(next())), x + x1 + ragged(next()));
+                    for xx in left..right.saturating_sub(1).min(w) {
+                        data[y * stride + xx / 8] &= !(0x80 >> (xx % 8));
+                    }
+                }
+            };
+            match shape {
+                0 => fill(0, 2, 0, 14),
+                1 => {
+                    fill(0, wide, 4, 6);
+                    fill(0, wide, 12, 14);
+                    fill(0, 2, 4, 14);
+                    fill(wide - 2, wide, 4, 14);
+                }
+                2 => {
+                    fill(0, 2, 4, 14);
+                    fill(wide - 2, wide, 6, 14);
+                    fill(0, wide - 1, 4, 6);
+                }
+                _ => {
+                    fill(0, 2, 7, 14);
+                    fill(0, 2, 2, 4);
+                }
+            }
+            x += wide + 2 + (next() % 2) as usize + if next() % 6 == 0 { 7 } else { 0 };
+        }
+    }
+    data
+}
+
+/// The one-bit samples (true for white) a Group 4 image stream decodes to, through an
+/// independent decoder.
+fn g4_rows(s: &Stream) -> Vec<Vec<bool>> {
+    struct Rows(Vec<Vec<bool>>, Vec<bool>, usize);
+    impl hayro_ccitt::Decoder for Rows {
+        fn push_pixel(&mut self, white: bool) {
+            self.1.push(white);
+        }
+        fn push_pixel_chunk(&mut self, white: bool, chunks: u32) {
+            self.1.extend(std::iter::repeat_n(white, chunks as usize * 8));
+        }
+        fn next_line(&mut self) {
+            let mut row = std::mem::take(&mut self.1);
+            row.truncate(self.2);
+            self.0.push(row);
+        }
+    }
+    let (w, h) = (s.dict.int(b"Width").unwrap() as u32, s.dict.int(b"Height").unwrap() as u32);
+    let settings = hayro_ccitt::DecodeSettings {
+        columns: w,
+        rows: h,
+        end_of_block: true,
+        end_of_line: false,
+        rows_are_byte_aligned: false,
+        encoding: hayro_ccitt::EncodingMode::Group4,
+        invert_black: false,
+    };
+    let mut out = Rows(Vec::new(), Vec::new(), w as usize);
+    hayro_ccitt::decode(&s.raw, &mut out, &mut hayro_ccitt::DecoderContext::new(settings)).unwrap();
+    out.0
+}
+
+fn image_stream(doc: &Document, page: usize) -> Stream {
+    let p = &pages(doc)[page];
+    let res = doc.resolve(p.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+    let xo = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+    match &*doc.resolve(xo.get(b"Im0").unwrap()) {
+        Object::Stream(s) => s.clone(),
+        _ => panic!("not an image"),
+    }
+}
+
+/// Black-and-white pictures are stored at one bit per pixel, as CCITT Group 4 when that is
+/// smaller, whichever way the file holds them: a 1-bit PNG (which decodes to eight bits), eight-bit
+/// grey of only black and white, a two-colour palette, black-and-white RGB. The bits are the
+/// picture's. A grey profile stays; a picture with any other shade, colour, or an RGB profile is
+/// stored as before.
+#[test]
+fn black_and_white_images_are_stored_at_one_bit() {
+    use png::{BitDepth, ColorType};
+    let (w, h) = (1200u32, 240u32);
+    let bits = strokes(w, h);
+    let stride = (w as usize).div_ceil(8);
+    let white = |x: usize, y: usize| bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0;
+    let expected: Vec<Vec<bool>> = (0..h as usize).map(|y| (0..w as usize).map(|x| white(x, y)).collect()).collect();
+    let grey: Vec<u8> = expected.iter().flatten().map(|&wh| if wh { 255 } else { 0 }).collect();
+    let rgb: Vec<u8> = grey.iter().flat_map(|&v| [v, v, v]).collect();
+    let pictures = [
+        png_of(w, h, ColorType::Grayscale, BitDepth::One, &bits, None, None),
+        png_of(w, h, ColorType::Grayscale, BitDepth::Eight, &grey, None, None),
+        png_of(w, h, ColorType::Indexed, BitDepth::One, &bits.iter().map(|b| !b).collect::<Vec<_>>(), Some(vec![255, 255, 255, 0, 0, 0]), None),
+        png_of(w, h, ColorType::Rgb, BitDepth::Eight, &rgb, None, None),
+        png_of(w, h, ColorType::Grayscale, BitDepth::One, &bits, None, Some(icc_profile(b"GRAY"))),
+    ];
+    let files: Vec<(String, Vec<u8>)> = pictures.into_iter().enumerate().map(|(i, p)| (format!("{i}.png"), p)).collect();
+    let doc = reopen(&from_images(&files).unwrap());
+    for page in 0..5 {
+        let s = image_stream(&doc, page);
+        assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])), "page {page}");
+        assert_eq!(g4_rows(&s), expected, "page {page}");
+        assert!(s.raw.len() < bits.len(), "page {page}: {} bytes, smaller than its one-bit samples", s.raw.len());
+    }
+    assert_eq!(image_of(&doc, 3).name(b"ColorSpace"), Some(&b"DeviceGray"[..]), "black-and-white RGB becomes grey");
+    assert_eq!(icc_of(&doc, &image_of(&doc, 4)).map(|(n, ..)| n), Some(1), "the grey profile stays");
+
+    // Another shade, colour, an RGB profile: as before. A tiny picture: one bit, but Flate.
+    let mut shaded = grey.clone();
+    shaded[5] = 128;
+    let mut coloured = rgb.clone();
+    coloured[0] = 200;
+    let others = [
+        png_of(w, h, ColorType::Grayscale, BitDepth::Eight, &shaded, None, None),
+        png_of(w, h, ColorType::Rgb, BitDepth::Eight, &coloured, None, None),
+        png_of(w, h, ColorType::Rgb, BitDepth::Eight, &rgb, None, Some(icc_profile(b"RGB "))),
+        png_of(2, 2, ColorType::Grayscale, BitDepth::Eight, &[0, 255, 255, 0], None, None),
+    ];
+    let files: Vec<(String, Vec<u8>)> = others.into_iter().enumerate().map(|(i, p)| (format!("o{i}.png"), p)).collect();
+    let doc = reopen(&from_images(&files).unwrap());
+    let kept: Vec<(Option<i64>, Option<Vec<u8>>)> =
+        (0..4).map(|p| (image_of(&doc, p).int(b"BitsPerComponent"), image_of(&doc, p).name(b"Filter").map(<[u8]>::to_vec))).collect();
+    assert_eq!(
+        kept[..3],
+        [(Some(8), Some(b"FlateDecode".to_vec())), (Some(8), Some(b"FlateDecode".to_vec())), (Some(8), Some(b"FlateDecode".to_vec()))]
+    );
+    assert_eq!(kept[3], (Some(1), Some(b"FlateDecode".to_vec())), "Group 4 isn't smaller for 2 × 2");
+}

From 3d6e11ecdb7f6af30bbb8f6e06baa2e30845742c Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 00:56:00 +0200
Subject: [PATCH 088/132] M11: the optimizer stores eight-bit black-and-white
 grey images at one bit

An eight-bit grey image whose samples are all 0 or 255 is packed to one
bit per pixel and then stored as Monochrome Images asks (Group 4, or
JBIG2 with #4320), when that is smaller as stored; its decode array
stays. Indexed images, a colour-key /Mask and Retain are left alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/optimize/src/images.rs     | 55 +++++++++++++++++++++++-
 crates/optimize/tests/optimize.rs | 70 +++++++++++++++++++++++++++++++
 2 files changed, 124 insertions(+), 1 deletion(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 57e583a078..33e60256e0 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -604,6 +604,59 @@ fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stre
     (crate::stored_len(&new)? < crate::stored_len(s)?).then_some(new)
 }
 
+/// An eight-bit grey image whose every sample is 0 or 255, stored at one bit per pixel and then as
+/// `compression` asks (see [`mono`]), if that is smaller as stored. Lossless: a decode array maps
+/// 0 and 255 at eight bits as it maps 0 and 1 at one bit, so it stays. Left alone: indexed images
+/// (their samples are palette indices), a colour-key `/Mask` (its ranges are in eight-bit values),
+/// and everything when `compression` is Retain.
+fn bilevel_grey(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stream> {
+    if compression == MonoCompression::Retain {
+        return None;
+    }
+    let d = &s.dict;
+    let indexed = |cs: &Object| match &*doc.resolve(cs) {
+        Object::Array(a) => matches!(a.first().and_then(Object::as_name), Some(b"Indexed" | b"I")),
+        _ => false,
+    };
+    let colour_key = d.get(b"Mask").is_some_and(|m| doc.resolve(m).as_array().is_some());
+    if d.int(b"BitsPerComponent") != Some(8)
+        || matches!(d.get(b"ImageMask"), Some(Object::Bool(true)))
+        || colour_key
+        || !d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs) && !indexed(cs))
+    {
+        return None;
+    }
+    // Through u32 first, as everywhere here, so the product can't overflow.
+    let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
+    if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_PIXELS {
+        return None;
+    }
+    let (w, h) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
+    let samples = s.decoded().ok()?;
+    let samples = samples.get(..w.checked_mul(h)?)?;
+    let stride = w.div_ceil(8);
+    let mut packed = vec![0u8; stride.checked_mul(h)?];
+    for (i, v) in samples.iter().enumerate() {
+        match v {
+            0 => {}
+            255 => {
+                if let Some(b) = packed.get_mut((i / w) * stride + (i % w) / 8) {
+                    *b |= 0x80 >> (i % w % 8);
+                }
+            }
+            _ => return None,
+        }
+    }
+    let mut one_bit = d.clone();
+    for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
+        one_bit.remove(k);
+    }
+    one_bit.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    let one_bit = Stream::flate(one_bit, &packed);
+    let best = mono(doc, &one_bit, compression).unwrap_or(one_bit);
+    (crate::stored_len(&best)? < crate::stored_len(s)?).then_some(best)
+}
+
 pub(crate) fn run(
     doc: &mut Document,
     pages: &[ObjRef],
@@ -630,7 +683,7 @@ pub(crate) fn run(
         let obj = doc.get(r);
         let Object::Stream(s) = &*obj else { continue };
         report.images += 1;
-        if let Some(new) = mono(doc, s, settings.mono) {
+        if let Some(new) = mono(doc, s, settings.mono).or_else(|| bilevel_grey(doc, s, settings.mono)) {
             report.image_bytes_before += s.raw.len();
             report.image_bytes_after += new.raw.len();
             report.images_recompressed += 1;
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 3fce1dadba..8993c598f8 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -588,6 +588,76 @@ fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
     assert!(stream(&doc, eight_bit).dict.int(b"Width").is_some_and(|nw| nw < i64::from(w)), "8-bit hex text in lines: resampled");
 }
 
+/// Eight-bit samples (0 or 255) from rows of one-bit ones.
+fn eight_bit(bits: &[u8], w: u32, h: u32) -> Vec<u8> {
+    let stride = (w as usize).div_ceil(8);
+    (0..h as usize).flat_map(|y| (0..w as usize).map(move |x| if bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0 { 255 } else { 0 })).collect()
+}
+
+/// Eight-bit grey images of only black and white (as some scanners and converters write scans)
+/// become one-bit Group 4, losslessly: the page looks the same, an inverting decode array
+/// included. Not touched by this: a grey image with any other shade, an indexed image (its samples
+/// are palette indices), one masked by colour key, and everything with `mono: Retain`.
+#[test]
+fn eight_bit_black_and_white_images_become_one_bit() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200, 480);
+    let grey = eight_bit(&bilevel(w, h, false), w, h);
+    let image = |doc: &mut Document, data: &[u8], entries: &[(&str, Object)]| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w as i64));
+        d.set(b"Height".to_vec(), Object::Int(h as i64));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        for (k, v) in entries {
+            d.set(k.as_bytes().to_vec(), v.clone());
+        }
+        doc.add(Object::Stream(Stream::flate(d, data)))
+    };
+    let gray_cs = ("ColorSpace", Object::name("DeviceGray"));
+    let plain = image(&mut doc, &grey, std::slice::from_ref(&gray_cs));
+    let decode = Object::Array(vec![1.into(), 0.into()]);
+    let inverted = image(&mut doc, &grey, &[gray_cs.clone(), ("Decode", decode.clone())]);
+    let mut shaded = grey.clone();
+    shaded[1000] = 128;
+    let shade = image(&mut doc, &shaded, std::slice::from_ref(&gray_cs));
+    let palette = Object::Array(vec![
+        Object::name("Indexed"),
+        Object::name("DeviceGray"),
+        255.into(),
+        Object::String(pdfcraft_cos::PdfString::literal((0..=255u8).rev().collect::<Vec<_>>())),
+    ]);
+    let indexed = image(&mut doc, &grey, &[("ColorSpace", palette)]);
+    let keyed = image(&mut doc, &grey, &[gray_cs, ("Mask", Object::Array(vec![0.into(), 0.into()]))]);
+    page(
+        &mut doc,
+        &[("A", plain), ("B", inverted), ("C", shade), ("D", indexed), ("E", keyed)],
+        "q 300 0 0 120 20 660 cm /A Do Q q 300 0 0 120 320 660 cm /B Do Q q 300 0 0 120 20 520 cm /C Do Q \
+         q 300 0 0 120 320 520 cm /D Do Q q 300 0 0 120 20 380 cm /E Do Q",
+    );
+    let before = render(&doc);
+    let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
+    // Grey settings that leave grey images alone, so only this conversion acts.
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    let settings = Settings { gray: keep, ..Settings::default() };
+
+    let mut kept = doc.clone();
+    let r = optimize(&mut kept, &Settings { mono: MonoCompression::Retain, ..settings.clone() }).unwrap();
+    assert_eq!(r.images_recompressed, 0, "Retain keeps every image as it is");
+
+    let untouched = [shade, indexed, keyed].map(|r| raw(&doc, r));
+    let r = optimize(&mut doc, &settings).unwrap();
+    assert_eq!(r.images_recompressed, 2);
+    for i in [plain, inverted] {
+        let s = stream(&doc, i);
+        assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])));
+    }
+    assert_eq!(stream(&doc, inverted).dict.get(b"Decode"), Some(&decode), "the decode array stays");
+    assert_eq!([shade, indexed, keyed].map(|r| raw(&doc, r)), untouched);
+    assert!(render(&doc) == before, "the page looks the same");
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();

From 4712abaabb78ac94b6260be1b27c468b710de4fd Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 01:03:01 +0200
Subject: [PATCH 089/132] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20de?=
 =?UTF-8?q?codes=20CCITT=20fax=20images?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Group 4 images (now written by Create PDF and the optimizer) would
otherwise stop exporting: they were reported as "can't be exported
yet". A CCITT fax image (its only filter) is decoded through
hayro-ccitt with its /DecodeParms (K, Columns, Rows, EndOfBlock,
EndOfLine, EncodedByteAlign, BlackIs1), masks included; /Columns has to
be the image's width, so a hostile value can't size the buffers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 ROADMAP.md                               |  1 +
 crates/automation/src/tools.rs           |  2 +-
 crates/automation/tests/it/automation.rs | 49 ++++++++++++
 crates/create/Cargo.toml                 |  3 +-
 crates/create/README.md                  |  6 +-
 crates/create/src/extract.rs             | 95 ++++++++++++++++++++++--
 crates/create/src/tests.rs               | 57 ++++++++++++++
 crates/optimize/README.md                |  7 +-
 docs/roadmap.md                          |  2 +
 parity/acrobat-features.toml             | 12 +--
 10 files changed, 216 insertions(+), 18 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 87f5b6705f..9d6b7a43fe 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,6 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
+- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit, and Export ▸ Images reads CCITT fax images.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 2760be9298..15530229fd 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1274,7 +1274,7 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("ocr.recognize")
             .with(schema(json!({}), &[])),
-        t("doc_export_all_images", "Export all images", "Write the images that pages use into a folder (`<name>_Page_<n>_Image_<k>.jpg|png`, n zero-padded to the page count's digits), each once: JPEG images unchanged, others as PNG with their soft mask as alpha. min_size skips images with fewer pixels on their shorter side. Images that can't be decoded yet (JPEG 2000, JBIG2, CCITT, separations) are listed under skipped. Includes unsaved edits.")
+        t("doc_export_all_images", "Export all images", "Write the images that pages use into a folder (`<name>_Page_<n>_Image_<k>.jpg|png`, n zero-padded to the page count's digits), each once: JPEG images unchanged, others as PNG with their soft mask as alpha. min_size skips images with fewer pixels on their shorter side. Images that can't be decoded yet (JPEG 2000, JBIG2, separations) are listed under skipped. Includes unsaved edits.")
             .cmd("export.all_images")
             .with(schema(
                 json!({
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index dcd321eddb..ea943eff79 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6431,6 +6431,55 @@ fn scanned_page() -> Vec<u8> {
     write_full(&doc, &SaveOptions::default()).unwrap()
 }
 
+/// A scan saved as a 1-bit PNG becomes a page whose picture stays one bit per pixel (not the eight
+/// bits the PNG decodes to), and Export all images gives the picture back.
+#[test]
+fn a_one_bit_scan_stays_one_bit_and_exports() {
+    let dir = workdir("bilevel");
+    let (w, h) = (800u32, 200u32);
+    let stride = (w as usize).div_ceil(8);
+    let mut bits = vec![0xFFu8; stride * h as usize];
+    for y in 0..h as usize {
+        for x in 0..w as usize {
+            if y % 25 >= 6 && y % 25 < 18 && (x * 7 + y / 25 * 13) % 11 < 4 {
+                bits[y * stride + x / 8] &= !(0x80 >> (x % 8));
+            }
+        }
+    }
+    let mut png_bytes = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png_bytes, w, h);
+        enc.set_color(png::ColorType::Grayscale);
+        enc.set_depth(png::BitDepth::One);
+        enc.write_header().unwrap().write_image_data(&bits).unwrap();
+    }
+    std::fs::write(dir.join("scan.png"), &png_bytes).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_create", json!({ "from": "images", "paths": ["scan.png"] }))["doc"].as_u64().unwrap();
+    ok(&mut a, "doc_save", json!({ "doc": doc, "path": "scan.pdf" }));
+    let saved = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join("scan.pdf")).unwrap())).unwrap();
+    let images: Vec<Option<i64>> = saved
+        .object_numbers()
+        .into_iter()
+        .filter_map(|num| match &*saved.get(pdfcraft_cos::ObjRef { num, generation: saved.generation(num) }) {
+            pdfcraft_cos::Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => Some(s.dict.int(b"BitsPerComponent")),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(images, [Some(1)]);
+    let r = ok(&mut a, "doc_export_all_images", json!({ "doc": doc, "folder": "out" }));
+    let files = r["files"].as_array().unwrap();
+    assert_eq!(files.len(), 1, "{r}");
+    let exported = std::fs::read(files[0]["path"].as_str().unwrap()).unwrap();
+    let mut reader = png::Decoder::new(std::io::Cursor::new(exported)).read_info().unwrap();
+    let mut buf = vec![0; reader.output_buffer_size().unwrap()];
+    let frame = reader.next_frame(&mut buf).unwrap();
+    let white: Vec<bool> = buf[..frame.buffer_size()].as_chunks::<3>().0.iter().map(|p| *p == [255, 255, 255]).collect();
+    let expected: Vec<bool> =
+        (0..h as usize).flat_map(|y| (0..w as usize).map(move |x| (y, x))).map(|(y, x)| bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0).collect();
+    assert_eq!(white, expected);
+}
+
 /// A scan's black-and-white image is stored as CCITT Group 4 by default, and kept as it is with
 /// `mono: { compression: retain }`.
 #[test]
diff --git a/crates/create/Cargo.toml b/crates/create/Cargo.toml
index 56cebc2af6..e60e554ba8 100644
--- a/crates/create/Cargo.toml
+++ b/crates/create/Cargo.toml
@@ -11,6 +11,8 @@ workspace = true
 [dependencies]
 pdfcraft-cos = { workspace = true }
 pdfcraft-filters = { workspace = true }
+# Already in the graph through hayro: decodes CCITT fax images for Export ▸ Images.
+hayro-ccitt.workspace = true
 pdfcraft-model = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 # For `image::bmp_with_pixel_offset`, shared with XFA pictures.
@@ -25,6 +27,5 @@ thiserror = { workspace = true }
 encoding_rs = "0.8"
 
 [dev-dependencies]
-hayro-ccitt.workspace = true
 image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg"] }
 hayro-syntax = { workspace = true }
diff --git a/crates/create/README.md b/crates/create/README.md
index d1561a6333..e8ed9a872c 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -6,7 +6,9 @@ Layer L4. Create a PDF (Acrobat's Create a PDF tool), execution plan M10.2:
 - `from_images(&[(name, bytes)])`: one page per image, sized from the image's resolution
   (PNG `pHYs`, JPEG JFIF density; 72 dpi when absent). JPEG data is embedded as is
   (`/DCTDecode`, grey, RGB or Adobe-inverted CMYK); PNG is decoded and stored with Flate,
-  with transparency as a soft mask. An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
+  with transparency as a soft mask. A picture of only pure black and white (a 1-bit PNG or TIFF,
+  eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as
+  CCITT Group 4 or Flate, whichever is smaller as stored (`pdfcraft_filters::encode_g4`). An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
   `iCCP`) that matches the image's colour space is kept as an `/ICCBased` colour space with
   the device space as `/Alternate`; images with the same profile share one profile object.
   JPEG metadata scanning skips marker fill bytes and reads application segments after the
@@ -31,3 +33,5 @@ Soft-mask Decode intervals map samples to opacity before the mask is resized, in
 The existing 16-bit path still uses each sample's high byte.
 JPEG image Decode handling remains limited.
 ICC transforms and calibrated color conversion remain outside this export path.
+CCITT fax images (Group 3 and 4) are decoded for export through `hayro-ccitt` with their `/DecodeParms`
+(`/Columns` has to be the image's width); JPEG 2000 and JBIG2 images are still reported, not exported.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 7828952edc..16ecd5d8d4 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -100,6 +100,92 @@ fn filters(s: &Stream) -> Vec<Vec<u8>> {
     }
 }
 
+/// The samples of image `s`, decoded: through its filters, or, for a CCITT fax image (its only
+/// filter), through a CCITT decoder, as rows of one-bit samples each starting on a byte, with black
+/// as 0 unless `/BlackIs1` says 1, as `CCITTFaxDecode` gives them (ISO 32000-2 §7.4.6).
+fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
+    match filters(s).as_slice() {
+        [f] if f == b"CCITTFaxDecode" || f == b"CCF" => ccitt(doc, s),
+        _ => s.decoded().map_err(|e| e.to_string()),
+    }
+}
+
+/// [`decoded`] for a CCITT fax image, with its `/DecodeParms` (Table 11 defaults). `/Columns` has to
+/// be the image's width; pixels past it and rows past the image's height are dropped, so the output
+/// is bounded by the size the caller already checked. A stream that ends early gives fewer rows,
+/// which the caller refuses.
+fn ccitt(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
+    struct Rows {
+        out: Vec<u8>,
+        row: Vec<u8>,
+        x: usize,
+        columns: usize,
+        rows: usize,
+        black_is_1: bool,
+    }
+    impl Rows {
+        fn push(&mut self, white: bool, count: usize) {
+            for _ in 0..count {
+                if self.x < self.columns
+                    && white != self.black_is_1
+                    && let Some(b) = self.row.get_mut(self.x / 8)
+                {
+                    *b |= 0x80 >> (self.x % 8);
+                }
+                self.x = self.x.saturating_add(1);
+            }
+        }
+    }
+    impl hayro_ccitt::Decoder for Rows {
+        fn push_pixel(&mut self, white: bool) {
+            self.push(white, 1);
+        }
+        fn push_pixel_chunk(&mut self, white: bool, chunks: u32) {
+            self.push(white, (chunks as usize).saturating_mul(8));
+        }
+        fn next_line(&mut self) {
+            if self.out.len() / self.row.len().max(1) < self.rows {
+                self.out.extend_from_slice(&self.row);
+            }
+            self.row.fill(0);
+            self.x = 0;
+        }
+    }
+    let p = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().cloned()).unwrap_or_default();
+    let flag = |key: &[u8], default: bool| match p.get(key).map(|v| doc.resolve(v)).as_deref() {
+        Some(Object::Bool(b)) => *b,
+        _ => default,
+    };
+    let k = p.int(b"K").unwrap_or(0);
+    // A row is the image's width: that was checked against the export's size limit, so a hostile
+    // /Columns can't size the buffers.
+    let columns = u32::try_from(p.int(b"Columns").unwrap_or(1728)).ok().filter(|c| *c > 0).ok_or("the fax image has no columns")?;
+    if s.dict.int(b"Width") != Some(i64::from(columns)) {
+        return Err("the fax image's columns aren't its width".into());
+    }
+    let height = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
+    let rows = p.int(b"Rows").and_then(|r| u32::try_from(r).ok()).filter(|r| *r > 0).unwrap_or(height).min(height);
+    let settings = hayro_ccitt::DecodeSettings {
+        columns,
+        rows,
+        end_of_block: flag(b"EndOfBlock", true),
+        end_of_line: flag(b"EndOfLine", false),
+        rows_are_byte_aligned: flag(b"EncodedByteAlign", false),
+        encoding: match k {
+            ..0 => hayro_ccitt::EncodingMode::Group4,
+            0 => hayro_ccitt::EncodingMode::Group3_1D,
+            k => hayro_ccitt::EncodingMode::Group3_2D { k: u32::try_from(k).unwrap_or(u32::MAX) },
+        },
+        invert_black: false,
+    };
+    let stride = (columns as usize).div_ceil(8);
+    let mut out =
+        Rows { out: Vec::new(), row: vec![0; stride], x: 0, columns: columns as usize, rows: rows as usize, black_is_1: flag(b"BlackIs1", false) };
+    // Rows decoded before damaged data are kept; too few rows are refused by the caller.
+    let _ = hayro_ccitt::decode(&s.raw, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
+    Ok(out.out)
+}
+
 /// The file for one image: its JPEG data as is, or a PNG. An image with transparency (a soft
 /// mask, a stencil `/Mask` or a colour-key `/Mask`) is always a PNG with that transparency as
 /// alpha, JPEG images included, so cut-out images keep their transparent background.
@@ -109,7 +195,6 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
     match f.last().map(Vec::as_slice) {
         Some(b"JPXDecode") => return Err("JPEG 2000 images can't be exported yet".into()),
         Some(b"JBIG2Decode") => return Err("JBIG2 images can't be exported yet".into()),
-        Some(b"CCITTFaxDecode" | b"CCF") => return Err("CCITT fax images can't be exported yet".into()),
         Some(b"DCTDecode" | b"DCT") if !jpeg => return Err("JPEG images inside other filters can't be exported yet".into()),
         _ => {}
     }
@@ -148,7 +233,7 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
         space = decoded;
         (samples, 8)
     } else {
-        let data = s.decoded().map_err(|e| e.to_string())?;
+        let data = decoded(doc, s)?;
         let bpc = if mask { 1 } else { s.dict.int(b"BitsPerComponent").unwrap_or(8) };
         let bpc = match bpc {
             1 => 1,
@@ -466,7 +551,7 @@ fn stencil_mask(doc: &Document, s: &Stream, w: usize, h: usize) -> Option<Vec<u8
 }
 
 /// A one-component mask image as 8-bit values (its `/Decode` interval applied), scaled to
-/// `w` × `h`. `None` when it can't be decoded (JPEG 2000, JBIG2 and CCITT masks).
+/// `w` × `h`. `None` when it can't be decoded (JPEG 2000 and JBIG2 masks).
 fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>> {
     let (mw, mh) = size(m.dict.int(b"Width")?, m.dict.int(b"Height")?)?;
     let stencil = m.dict.get(b"ImageMask").is_some_and(|v| matches!(&*doc.resolve(v), Object::Bool(true)));
@@ -476,7 +561,7 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>>
             let img = image::load_from_memory_with_format(&m.raw, image::ImageFormat::Jpeg).ok()?.into_luma8();
             (img.width() as usize == mw && img.height() as usize == mh).then(|| img.into_raw())?
         }
-        Some(b"DCTDecode" | b"DCT" | b"JPXDecode" | b"JBIG2Decode" | b"CCITTFaxDecode" | b"CCF") => return None,
+        Some(b"DCTDecode" | b"DCT" | b"JPXDecode" | b"JBIG2Decode") => return None,
         _ => {
             let bpc = if stencil { 1 } else { m.dict.int(b"BitsPerComponent").unwrap_or(8) };
             let bpc = match bpc {
@@ -488,7 +573,7 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>>
                 _ => return None,
             };
             let max = (1u32 << bpc.min(8)) - 1;
-            unpack(&m.decoded().ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
+            unpack(&decoded(doc, m).ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
         }
     };
     if let Some([lo, hi]) = decode(doc, m, 1).and_then(|pairs| pairs.first().copied()) {
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index f94fc020a1..9716470abb 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1506,3 +1506,60 @@ fn black_and_white_images_are_stored_at_one_bit() {
     );
     assert_eq!(kept[3], (Some(1), Some(b"FlateDecode".to_vec())), "Group 4 isn't smaller for 2 × 2");
 }
+
+/// The pixels of an exported PNG (RGB), as true for white.
+fn exported_white(png_data: &[u8]) -> Vec<bool> {
+    let mut reader = png::Decoder::new(std::io::Cursor::new(png_data.to_vec())).read_info().unwrap();
+    let mut buf = vec![0; reader.output_buffer_size().unwrap()];
+    let frame = reader.next_frame(&mut buf).unwrap();
+    assert_eq!(frame.color_type, png::ColorType::Rgb);
+    buf[..frame.buffer_size()].as_chunks::<3>().0.iter().map(|p| *p == [255, 255, 255]).collect()
+}
+
+/// Export ▸ Images reads CCITT fax images: a page created from a 1-bit PNG (Group 4 now) exports as
+/// the picture, as does the picture coded the other way round with /BlackIs1. One whose /Columns
+/// aren't its width is skipped, not misread.
+#[test]
+fn ccitt_fax_images_export_as_their_picture() {
+    use png::{BitDepth, ColorType};
+    let (w, h) = (1200u32, 240u32);
+    let bits = strokes(w, h);
+    let stride = (w as usize).div_ceil(8);
+    let picture: Vec<bool> =
+        (0..h as usize).flat_map(|y| (0..w as usize).map(move |x| (y, x))).map(|(y, x)| bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0).collect();
+    let mut doc = from_images(&[("scan.png".into(), png_of(w, h, ColorType::Grayscale, BitDepth::One, &bits, None, None))]).unwrap();
+    assert_eq!(image_of(&doc, 0).name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    assert_eq!(exported_white(&out.images[0].data), picture);
+
+    // The same picture coded with 1 for black, which /BlackIs1 says.
+    let r = {
+        let page = pdfcraft_model::pages(&doc)[0].clone();
+        let res = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+        let xo = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+        xo.get(b"Im0").and_then(Object::as_ref).unwrap()
+    };
+    let base = image_of(&doc, 0);
+    let with = |black_is_1: bool, columns: i64, data: Vec<u8>| {
+        let mut d = base.clone();
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(-1));
+        parms.set(b"Columns".to_vec(), Object::Int(columns));
+        parms.set(b"Rows".to_vec(), Object::Int(i64::from(h)));
+        parms.set(b"BlackIs1".to_vec(), Object::Bool(black_is_1));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        d.remove(b"Length");
+        Stream::from_raw(d, data)
+    };
+    let inverted: Vec<u8> = bits.iter().map(|b| !b).collect();
+    let stream = with(true, i64::from(w), pdfcraft_filters::encode_g4(&inverted, w, h).unwrap());
+    doc.set(r, Object::Stream(stream));
+    let out = extract_images(&doc, &[0], 0);
+    assert_eq!(exported_white(&out.images[0].data), picture, "BlackIs1");
+
+    let stream = with(false, i64::from(w) + 8, pdfcraft_filters::encode_g4(&bits, w, h).unwrap());
+    doc.set(r, Object::Stream(stream));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.images.is_empty() && out.skipped.len() == 1, "columns other than the width: skipped");
+}
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index c3281f00c4..bfd3dad7de 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -37,14 +37,13 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
 - **Monochrome images** (`Settings::mono`, CCITT Group 4 by default): a 1-bit image with one
   colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
   general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
-  that is smaller as stored. It is lossless: the samples decode to the same bits, so the colour
+  that is smaller as stored. An eight-bit grey image of only 0 and 255 is packed to one bit first
+  (not an indexed image, whose samples are palette indices, nor one with a colour-key `/Mask`). It is lossless: the samples decode to the same bits, so the colour
   space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
   JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
   than 32,767 samples. Redaction doesn't decode Group 4 yet: a mark over part of an image stored
-  this way removes the whole image (nothing leaks). Nor does anything that exports an image:
-  Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML
-  export leave the picture out.
+  this way removes the whole image (nothing leaks).
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 75be8e3833..1ebbb025ad 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,6 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white pictures stay one bit when PDFs are created and optimized; CCITT images export; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
@@ -256,6 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them; Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 02d7219aba..e7c515e610 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -6884,8 +6884,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["create.images"]
 tools = ["doc_create"]
-evidence = ["crates/create/src/tests.rs::jpeg_2000_images_are_embedded_as_is", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::embedded_icc_profiles_tag_the_image_colour_space"]
-notes = "PNG, JPEG, TIFF (multi-page), GIF (first frame), BMP, and JPEG 2000 (JP2 or codestream, embedded as JPXDecode with its capture resolution). JPEG and PNG ICC profiles are kept as /ICCBased; TIFF profiles are not read yet"
+evidence = ["crates/create/src/tests.rs::black_and_white_images_are_stored_at_one_bit", "crates/create/src/tests.rs::jpeg_2000_images_are_embedded_as_is", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::embedded_icc_profiles_tag_the_image_colour_space"]
+notes = "PNG, JPEG, TIFF (multi-page), GIF (first frame), BMP, and JPEG 2000 (JP2 or codestream, embedded as JPXDecode with its capture resolution). JPEG and PNG ICC profiles are kept as /ICCBased; TIFF profiles are not read yet. A picture of only pure black and white (a 1-bit PNG or TIFF, eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as CCITT Group 4 or Flate, whichever is smaller"
 
 [[feature]]
 id = "create.from-multipage-tiff"
@@ -7164,8 +7164,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["export.all_images"]
 tools = ["doc_export_all_images"]
-evidence = ["crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps"]
-notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2/CCITT masks are left out (image exported opaque); JPX/JBIG2/CCITT/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported."
+evidence = ["crates/create/src/tests.rs::ccitt_fax_images_export_as_their_picture", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps"]
+notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2 masks are left out (image exported opaque); JPX/JBIG2/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported. CCITT fax images (Group 3 and 4, with their /DecodeParms) export as their picture, masks included."
 
 [[feature]]
 id = "create.export-html"
@@ -7384,8 +7384,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
-evidence = ["crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks), nor does anything that exports an image: Export ▸ Images and Save Image As refuse it, Copy Image fails, and Word, PowerPoint and HTML export leave the picture out."
+evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside). Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 3204051c3b21b0c0d327c81512f9c94303fb3be1 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 01:35:31 +0200
Subject: [PATCH 090/132] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20re?=
 =?UTF-8?q?ads=20CCITT=20parameters=20given=20in=20an=20array?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A CCITT image whose /DecodeParms is a one-element array (common beside
/Filter [/CCITTFaxDecode]) was decoded with the default parameters: K 0
and 1728 columns. Wider scans were skipped, and a fax 1728 wide could be
misread. The parameters are now read from a dictionary or the one in an
array (ISO 32000-2 §7.4.2). The module doc no longer lists CCITT as
undecodable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/create/src/extract.rs | 17 +++++++++++++++--
 crates/create/src/tests.rs   | 13 +++++++++++--
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 16ecd5d8d4..a32b42556b 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -1,7 +1,7 @@
 //! Export a PDF ▸ Image ▸ Export all images, and Edit ▸ Save image as: the images that pages
 //! use, as files. JPEG images are written unchanged; other images, and JPEG images with
 //! transparency or with CMYK samples a viewer would read inverted, are decoded and written as PNG with their soft mask, stencil mask or colour
-//! key as alpha. Images PdfCraft can't decode yet (JPEG 2000, JBIG2, CCITT, separations) are
+//! key as alpha. Images PdfCraft can't decode yet (JPEG 2000, JBIG2, separations) are
 //! reported, never silently left out.
 
 use std::collections::HashSet;
@@ -110,6 +110,19 @@ fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
     }
 }
 
+/// The `/DecodeParms` of a stream with one filter: a dictionary, or the one in an array (7.4.2).
+fn decode_parms(doc: &Document, s: &Stream) -> Dict {
+    let Some(p) = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)) else { return Dict::default() };
+    let p = match &*p {
+        Object::Array(a) => match a.first() {
+            Some(first) => doc.resolve(first),
+            None => return Dict::default(),
+        },
+        _ => p,
+    };
+    p.as_dict().cloned().unwrap_or_default()
+}
+
 /// [`decoded`] for a CCITT fax image, with its `/DecodeParms` (Table 11 defaults). `/Columns` has to
 /// be the image's width; pixels past it and rows past the image's height are dropped, so the output
 /// is bounded by the size the caller already checked. A stream that ends early gives fewer rows,
@@ -151,7 +164,7 @@ fn ccitt(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
             self.x = 0;
         }
     }
-    let p = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().cloned()).unwrap_or_default();
+    let p = decode_parms(doc, s);
     let flag = |key: &[u8], default: bool| match p.get(key).map(|v| doc.resolve(v)).as_deref() {
         Some(Object::Bool(b)) => *b,
         _ => default,
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 9716470abb..3f47d6d6d6 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1517,8 +1517,8 @@ fn exported_white(png_data: &[u8]) -> Vec<bool> {
 }
 
 /// Export ▸ Images reads CCITT fax images: a page created from a 1-bit PNG (Group 4 now) exports as
-/// the picture, as does the picture coded the other way round with /BlackIs1. One whose /Columns
-/// aren't its width is skipped, not misread.
+/// the picture, as does the picture coded the other way round with /BlackIs1, and the picture with
+/// its filter and parameters in arrays. One whose /Columns aren't its width is skipped, not misread.
 #[test]
 fn ccitt_fax_images_export_as_their_picture() {
     use png::{BitDepth, ColorType};
@@ -1558,6 +1558,15 @@ fn ccitt_fax_images_export_as_their_picture() {
     let out = extract_images(&doc, &[0], 0);
     assert_eq!(exported_white(&out.images[0].data), picture, "BlackIs1");
 
+    let mut stream = with(false, i64::from(w), pdfcraft_filters::encode_g4(&bits, w, h).unwrap());
+    let parms = stream.dict.get(b"DecodeParms").cloned().unwrap();
+    stream.dict.set(b"DecodeParms".to_vec(), Object::Array(vec![parms]));
+    stream.dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("CCITTFaxDecode")]));
+    doc.set(r, Object::Stream(stream));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    assert_eq!(exported_white(&out.images[0].data), picture, "in arrays");
+
     let stream = with(false, i64::from(w) + 8, pdfcraft_filters::encode_g4(&bits, w, h).unwrap());
     doc.set(r, Object::Stream(stream));
     let out = extract_images(&doc, &[0], 0);

From 66b5ad2ab7771ee2bc4489b759439c4742ab0d56 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 02:10:57 +0200
Subject: [PATCH 091/132] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20re?=
 =?UTF-8?q?ads=20CCITT=20numbers=20given=20by=20reference,=20and=20decodes?=
 =?UTF-8?q?=20up=20to=20the=20image's=20height?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A CCITT image whose /K, /Columns or /Rows is an indirect integer was read
with the defaults (K 0, 1728 columns), and one whose /Rows is below its
/Height was cut short and skipped. The numbers are now resolved, and the
image is decoded up to its /Height rows whatever /Rows says, still bounded
by the size the export checked (review of #4335).

The doc comment of the optimizer's bilevel step now says what Retain
leaves to the grey settings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/create/src/extract.rs  | 10 ++++++----
 crates/create/src/tests.rs    | 16 ++++++++++++++--
 crates/optimize/src/images.rs |  3 ++-
 3 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index a32b42556b..1053df2d78 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -169,15 +169,17 @@ fn ccitt(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
         Some(Object::Bool(b)) => *b,
         _ => default,
     };
-    let k = p.int(b"K").unwrap_or(0);
+    let int = |key: &[u8]| p.get(key).and_then(|v| doc.resolve(v).as_int());
+    let k = int(b"K").unwrap_or(0);
     // A row is the image's width: that was checked against the export's size limit, so a hostile
     // /Columns can't size the buffers.
-    let columns = u32::try_from(p.int(b"Columns").unwrap_or(1728)).ok().filter(|c| *c > 0).ok_or("the fax image has no columns")?;
+    let columns = u32::try_from(int(b"Columns").unwrap_or(1728)).ok().filter(|c| *c > 0).ok_or("the fax image has no columns")?;
     if s.dict.int(b"Width") != Some(i64::from(columns)) {
         return Err("the fax image's columns aren't its width".into());
     }
-    let height = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
-    let rows = p.int(b"Rows").and_then(|r| u32::try_from(r).ok()).filter(|r| *r > 0).unwrap_or(height).min(height);
+    // As many rows as the image has, whatever /Rows says: one below /Height would cut the picture
+    // short, and rows past /Height aren't drawn.
+    let rows = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
     let settings = hayro_ccitt::DecodeSettings {
         columns,
         rows,
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 3f47d6d6d6..8ad8a54cd8 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1517,8 +1517,9 @@ fn exported_white(png_data: &[u8]) -> Vec<bool> {
 }
 
 /// Export ▸ Images reads CCITT fax images: a page created from a 1-bit PNG (Group 4 now) exports as
-/// the picture, as does the picture coded the other way round with /BlackIs1, and the picture with
-/// its filter and parameters in arrays. One whose /Columns aren't its width is skipped, not misread.
+/// the picture, as does the picture coded the other way round with /BlackIs1, the picture with its
+/// filter and parameters in arrays, with /K and /Columns given by reference, and with a /Rows below
+/// its height. One whose /Columns aren't its width is skipped, not misread.
 #[test]
 fn ccitt_fax_images_export_as_their_picture() {
     use png::{BitDepth, ColorType};
@@ -1567,6 +1568,17 @@ fn ccitt_fax_images_export_as_their_picture() {
     assert!(out.skipped.is_empty(), "{:?}", out.skipped);
     assert_eq!(exported_white(&out.images[0].data), picture, "in arrays");
 
+    let mut stream = with(false, i64::from(w), pdfcraft_filters::encode_g4(&bits, w, h).unwrap());
+    let mut parms = stream.dict.get(b"DecodeParms").and_then(Object::as_dict).cloned().unwrap();
+    parms.set(b"K".to_vec(), Object::Ref(doc.add(Object::Int(-1))));
+    parms.set(b"Columns".to_vec(), Object::Ref(doc.add(Object::Int(i64::from(w)))));
+    parms.set(b"Rows".to_vec(), Object::Int(1));
+    stream.dict.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+    doc.set(r, Object::Stream(stream));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    assert_eq!(exported_white(&out.images[0].data), picture, "/K and /Columns by reference, /Rows 1");
+
     let stream = with(false, i64::from(w) + 8, pdfcraft_filters::encode_g4(&bits, w, h).unwrap());
     doc.set(r, Object::Stream(stream));
     let out = extract_images(&doc, &[0], 0);
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 33e60256e0..7367f6d0db 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -608,7 +608,8 @@ fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stre
 /// `compression` asks (see [`mono`]), if that is smaller as stored. Lossless: a decode array maps
 /// 0 and 255 at eight bits as it maps 0 and 1 at one bit, so it stays. Left alone: indexed images
 /// (their samples are palette indices), a colour-key `/Mask` (its ranges are in eight-bit values),
-/// and everything when `compression` is Retain.
+/// and everything when `compression` is Retain: such an image is then a grey image like any other,
+/// which the grey settings handle as they did before.
 fn bilevel_grey(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stream> {
     if compression == MonoCompression::Retain {
         return None;

From 7ca7e01f921f40d12270e2621c688344beb26013 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 09:08:33 +0200
Subject: [PATCH 092/132] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20de?=
 =?UTF-8?q?codes=20CCITT=20fax=20images=20behind=20other=20filters?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A fax image with /Filter [/ASCII85Decode /CCITTFaxDecode], say, was
skipped: only a lone CCITT filter went to the CCITT decoder. Now the
filters before it are undone first, and its parameters are the
/DecodeParms entry at its own place in the array (ISO 32000-2 §7.4.1),
not the first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/create/README.md      |  2 +-
 crates/create/src/extract.rs | 48 +++++++++++++++++++++++-------------
 crates/create/src/tests.rs   | 24 ++++++++++++++++--
 parity/acrobat-features.toml |  2 +-
 4 files changed, 55 insertions(+), 21 deletions(-)

diff --git a/crates/create/README.md b/crates/create/README.md
index e8ed9a872c..8e0bdc68be 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -34,4 +34,4 @@ The existing 16-bit path still uses each sample's high byte.
 JPEG image Decode handling remains limited.
 ICC transforms and calibrated color conversion remain outside this export path.
 CCITT fax images (Group 3 and 4) are decoded for export through `hayro-ccitt` with their `/DecodeParms`
-(`/Columns` has to be the image's width); JPEG 2000 and JBIG2 images are still reported, not exported.
+(`/Columns` has to be the image's width), behind other filters such as `ASCII85Decode` too; JPEG 2000 and JBIG2 images are still reported, not exported.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 1053df2d78..c67d80bd8b 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -4,6 +4,7 @@
 //! key as alpha. Images PdfCraft can't decode yet (JPEG 2000, JBIG2, separations) are
 //! reported, never silently left out.
 
+use std::borrow::Cow;
 use std::collections::HashSet;
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
@@ -100,34 +101,48 @@ fn filters(s: &Stream) -> Vec<Vec<u8>> {
     }
 }
 
-/// The samples of image `s`, decoded: through its filters, or, for a CCITT fax image (its only
-/// filter), through a CCITT decoder, as rows of one-bit samples each starting on a byte, with black
-/// as 0 unless `/BlackIs1` says 1, as `CCITTFaxDecode` gives them (ISO 32000-2 §7.4.6).
+/// The samples of image `s`, decoded: through its filters, or, for a CCITT fax image (its last
+/// filter), through the filters before it and then a CCITT decoder, as rows of one-bit samples
+/// each starting on a byte, with black as 0 unless `/BlackIs1` says 1, as `CCITTFaxDecode` gives
+/// them (ISO 32000-2 §7.4.6).
 fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
-    match filters(s).as_slice() {
-        [f] if f == b"CCITTFaxDecode" || f == b"CCF" => ccitt(doc, s),
+    let names = filters(s);
+    match names.split_last() {
+        Some((f, outer)) if f == b"CCITTFaxDecode" || f == b"CCF" => {
+            // Such as ASCII85Decode, undone first (7.4.1).
+            let chain = s.filters();
+            let data = match chain.split_last() {
+                Some((_, before)) if !before.is_empty() => {
+                    Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, pdfcraft_cos::MAX_DECODED).map_err(|e| e.to_string())?.0)
+                }
+                _ => Cow::Borrowed(&s.raw[..]),
+            };
+            ccitt(doc, s, &data, decode_parms(doc, s, outer.len()))
+        }
         _ => s.decoded().map_err(|e| e.to_string()),
     }
 }
 
-/// The `/DecodeParms` of a stream with one filter: a dictionary, or the one in an array (7.4.2).
-fn decode_parms(doc: &Document, s: &Stream) -> Dict {
+/// The `/DecodeParms` of filter `index` of a stream: the dictionary of a stream with one filter,
+/// or that entry of an array (7.4.2).
+fn decode_parms(doc: &Document, s: &Stream, index: usize) -> Dict {
     let Some(p) = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)) else { return Dict::default() };
     let p = match &*p {
-        Object::Array(a) => match a.first() {
-            Some(first) => doc.resolve(first),
+        Object::Array(a) => match a.get(index) {
+            Some(entry) => doc.resolve(entry),
             None => return Dict::default(),
         },
-        _ => p,
+        _ if index == 0 => p,
+        _ => return Dict::default(),
     };
     p.as_dict().cloned().unwrap_or_default()
 }
 
-/// [`decoded`] for a CCITT fax image, with its `/DecodeParms` (Table 11 defaults). `/Columns` has to
-/// be the image's width; pixels past it and rows past the image's height are dropped, so the output
-/// is bounded by the size the caller already checked. A stream that ends early gives fewer rows,
-/// which the caller refuses.
-fn ccitt(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
+/// [`decoded`] for a CCITT fax image: `data`, coded with parameters `p` (Table 11 defaults).
+/// `/Columns` has to be the image's width; pixels past it and rows past the image's height are
+/// dropped, so the output is bounded by the size the caller already checked. A stream that ends
+/// early gives fewer rows, which the caller refuses.
+fn ccitt(doc: &Document, s: &Stream, data: &[u8], p: Dict) -> Result<Vec<u8>, String> {
     struct Rows {
         out: Vec<u8>,
         row: Vec<u8>,
@@ -164,7 +179,6 @@ fn ccitt(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
             self.x = 0;
         }
     }
-    let p = decode_parms(doc, s);
     let flag = |key: &[u8], default: bool| match p.get(key).map(|v| doc.resolve(v)).as_deref() {
         Some(Object::Bool(b)) => *b,
         _ => default,
@@ -197,7 +211,7 @@ fn ccitt(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
     let mut out =
         Rows { out: Vec::new(), row: vec![0; stride], x: 0, columns: columns as usize, rows: rows as usize, black_is_1: flag(b"BlackIs1", false) };
     // Rows decoded before damaged data are kept; too few rows are refused by the caller.
-    let _ = hayro_ccitt::decode(&s.raw, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
+    let _ = hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
     Ok(out.out)
 }
 
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 8ad8a54cd8..dd9414dc68 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1518,8 +1518,8 @@ fn exported_white(png_data: &[u8]) -> Vec<bool> {
 
 /// Export ▸ Images reads CCITT fax images: a page created from a 1-bit PNG (Group 4 now) exports as
 /// the picture, as does the picture coded the other way round with /BlackIs1, the picture with its
-/// filter and parameters in arrays, with /K and /Columns given by reference, and with a /Rows below
-/// its height. One whose /Columns aren't its width is skipped, not misread.
+/// filter and parameters in arrays, with /K and /Columns given by reference, with a /Rows below its
+/// height, and behind another filter. One whose /Columns aren't its width is skipped, not misread.
 #[test]
 fn ccitt_fax_images_export_as_their_picture() {
     use png::{BitDepth, ColorType};
@@ -1579,6 +1579,26 @@ fn ccitt_fax_images_export_as_their_picture() {
     assert!(out.skipped.is_empty(), "{:?}", out.skipped);
     assert_eq!(exported_white(&out.images[0].data), picture, "/K and /Columns by reference, /Rows 1");
 
+    // Behind another filter, with its parameters second in the array, as 7.4.1 pairs them.
+    let g4 = pdfcraft_filters::encode_g4(&bits, w, h).unwrap();
+    let hex = g4.iter().map(|b| format!("{b:02x}")).chain([">".to_string()]).collect::<String>().into_bytes();
+    for (outer, data) in [("ASCIIHexDecode", hex), ("FlateDecode", pdfcraft_filters::encode_flate(&g4))] {
+        let mut stream = with(false, i64::from(w), data);
+        let parms = stream.dict.get(b"DecodeParms").cloned().unwrap();
+        stream.dict.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Null, parms]));
+        stream.dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name(outer), Object::name("CCITTFaxDecode")]));
+        doc.set(r, Object::Stream(stream));
+        let out = extract_images(&doc, &[0], 0);
+        assert!(out.skipped.is_empty(), "{outer}: {:?}", out.skipped);
+        assert_eq!(exported_white(&out.images[0].data), picture, "behind {outer}");
+    }
+    // CCITT before another filter isn't a picture yet.
+    let mut stream = with(false, i64::from(w), pdfcraft_filters::encode_flate(&g4));
+    stream.dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("CCITTFaxDecode"), Object::name("FlateDecode")]));
+    doc.set(r, Object::Stream(stream));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.images.is_empty() && out.skipped.len() == 1, "CCITT, then Flate: skipped");
+
     let stream = with(false, i64::from(w) + 8, pdfcraft_filters::encode_g4(&bits, w, h).unwrap());
     doc.set(r, Object::Stream(stream));
     let out = extract_images(&doc, &[0], 0);
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index e7c515e610..bf96832b16 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7165,7 +7165,7 @@ status = "shipped"
 commands = ["export.all_images"]
 tools = ["doc_export_all_images"]
 evidence = ["crates/create/src/tests.rs::ccitt_fax_images_export_as_their_picture", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps"]
-notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2 masks are left out (image exported opaque); JPX/JBIG2/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported. CCITT fax images (Group 3 and 4, with their /DecodeParms) export as their picture, masks included."
+notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2 masks are left out (image exported opaque); JPX/JBIG2/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported. CCITT fax images (Group 3 and 4, with their /DecodeParms, behind other filters too) export as their picture, masks included."
 
 [[feature]]
 id = "create.export-html"

From 8af04af01b4fe121f681188973f1ec5a02642a22 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 10:18:48 +0200
Subject: [PATCH 093/132] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20re?=
 =?UTF-8?q?ads=20/DecodeParms=20given=20by=20reference?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Stream::decoded reads only direct parameter dictionaries, so an image
behind [/FlateDecode /CCITTFaxDecode] whose Flate entry is a reference
lost its predictor, and the CCITT decoder got the predictor's bytes; a
plain Flate image with its predictor given by reference was misread the
same way. Export now decodes through
pdfcraft_cos::Document::with_direct_parms (#4304), as the optimizer
does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/create/src/extract.rs |  2 ++
 crates/create/src/tests.rs   | 19 ++++++++++++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index c67d80bd8b..9b6925d16d 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -106,6 +106,8 @@ fn filters(s: &Stream) -> Vec<Vec<u8>> {
 /// each starting on a byte, with black as 0 unless `/BlackIs1` says 1, as `CCITTFaxDecode` gives
 /// them (ISO 32000-2 §7.4.6).
 fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
+    // Parameters given by reference, which the filters read only once direct.
+    let s = &*doc.with_direct_parms(s);
     let names = filters(s);
     match names.split_last() {
         Some((f, outer)) if f == b"CCITTFaxDecode" || f == b"CCF" => {
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index dd9414dc68..554dc01ff8 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1519,7 +1519,8 @@ fn exported_white(png_data: &[u8]) -> Vec<bool> {
 /// Export ▸ Images reads CCITT fax images: a page created from a 1-bit PNG (Group 4 now) exports as
 /// the picture, as does the picture coded the other way round with /BlackIs1, the picture with its
 /// filter and parameters in arrays, with /K and /Columns given by reference, with a /Rows below its
-/// height, and behind another filter. One whose /Columns aren't its width is skipped, not misread.
+/// height, and behind another filter (its parameters by reference too). One whose /Columns aren't
+/// its width is skipped, not misread.
 #[test]
 fn ccitt_fax_images_export_as_their_picture() {
     use png::{BitDepth, ColorType};
@@ -1592,6 +1593,22 @@ fn ccitt_fax_images_export_as_their_picture() {
         assert!(out.skipped.is_empty(), "{outer}: {:?}", out.skipped);
         assert_eq!(exported_white(&out.images[0].data), picture, "behind {outer}");
     }
+    // Behind Flate with a PNG predictor, whose parameters are given by reference.
+    let padded: Vec<u8> = g4.iter().copied().chain(std::iter::repeat_n(0, 16 - g4.len() % 16)).collect();
+    let params = pdfcraft_filters::Params { predictor: 12, colors: 1, bits_per_component: 8, columns: 16, early_change: 1 };
+    let predicted = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &padded).unwrap();
+    let mut flate_parms = Dict::new();
+    flate_parms.set(b"Predictor".to_vec(), Object::Int(12));
+    flate_parms.set(b"Columns".to_vec(), Object::Int(16));
+    let flate_parms = doc.add(Object::Dict(flate_parms));
+    let mut stream = with(false, i64::from(w), predicted);
+    let parms = stream.dict.get(b"DecodeParms").cloned().unwrap();
+    stream.dict.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Ref(flate_parms), parms]));
+    stream.dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("CCITTFaxDecode")]));
+    doc.set(r, Object::Stream(stream));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    assert_eq!(exported_white(&out.images[0].data), picture, "behind Flate with a predictor given by reference");
     // CCITT before another filter isn't a picture yet.
     let mut stream = with(false, i64::from(w), pdfcraft_filters::encode_flate(&g4));
     stream.dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("CCITTFaxDecode"), Object::name("FlateDecode")]));

From 546f78c042cd0a93ad38359f06a6a0b2d1f88af1 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 11:32:14 +0200
Subject: [PATCH 094/132] M11: the optimizer reads eight-bit grey through
 /DecodeParms given by reference

Packing eight-bit black-and-white grey to one bit decoded with
Stream::decoded, which ignores /DecodeParms given by reference. With PNG
predictor 10 each row then kept its tag byte, a 0, so the shifted rows
still passed as black and white and were packed and stored skewed. It
now decodes through Document::with_direct_parms (#4304), and the test
of images with their parameters by reference covers this case.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/optimize/src/images.rs     |  4 +++-
 crates/optimize/tests/optimize.rs | 34 ++++++++++++++++++++++---------
 2 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 7367f6d0db..08e65d037c 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -633,7 +633,9 @@ fn bilevel_grey(doc: &Document, s: &Stream, compression: MonoCompression) -> Opt
         return None;
     }
     let (w, h) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
-    let samples = s.decoded().ok()?;
+    // Through its parameters given by reference too: without a PNG predictor's tag bytes taken
+    // off, rows of 0 and 255 would still pass below, each shifted by a byte.
+    let samples = doc.with_direct_parms(s).decoded().ok()?;
     let samples = samples.get(..w.checked_mul(h)?)?;
     let stride = w.div_ceil(8);
     let mut packed = vec![0u8; stride.checked_mul(h)?];
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 8993c598f8..f861da9d20 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -475,9 +475,10 @@ fn group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit() {
 /// An image whose /DecodeParms are a reference, or hold numbers given by reference
 /// (`/Predictor 9 0 R`, which `Dict::int` doesn't follow), is read through them, as one with them
 /// direct: a predictor's tag bytes would otherwise shift every row, and the image would be stored
-/// again wrong. Here a 1-bit image with a PNG predictor (stored again as Group 4) and an eight-bit
-/// grey one with a PNG predictor at 600 ppi (resampled) come out byte for byte as with direct
-/// parameters.
+/// again wrong. Here a 1-bit image with a PNG predictor (stored again as Group 4), an eight-bit
+/// grey one with a PNG predictor at 600 ppi (resampled), and an eight-bit one of only black and
+/// white with PNG predictor 10 (each row's tag a 0, so the shifted rows would still be black and
+/// white; packed to one bit) come out byte for byte as with direct parameters.
 #[test]
 fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
     let build = |how: &str| {
@@ -485,6 +486,7 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
         let (w, h) = (1200u32, 480u32);
         let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
         let one_bit = mono_image(&mut doc, w, h, &bilevel(w, h, false), Some(15), &grey);
+        let black_and_white_samples = eight_bit(&bilevel(w, h, false), w, h);
         let shades: Vec<u8> = (0..w * h).map(|i| ((i % w) * 255 / w) as u8 ^ ((i / w) as u8 & 0x0F)).collect();
         let params = pdfcraft_filters::Params { predictor: 15, colors: 1, bits_per_component: 8, columns: w as i64, early_change: 1 };
         let mut parms = Dict::new();
@@ -500,8 +502,15 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
         d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
         d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
         let coded = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &shades).unwrap();
-        let eight_bit = doc.add(Object::Stream(Stream::from_raw(d, coded)));
-        for r in [one_bit, eight_bit] {
+        let eight_bit = doc.add(Object::Stream(Stream::from_raw(d.clone(), coded)));
+        let params = pdfcraft_filters::Params { predictor: 10, ..params };
+        let mut parms = Dict::new();
+        parms.set(b"Predictor".to_vec(), Object::Int(10));
+        parms.set(b"Columns".to_vec(), Object::Int(w as i64));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        let black_and_white = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &black_and_white_samples).unwrap();
+        let packed = doc.add(Object::Stream(Stream::from_raw(d, black_and_white)));
+        for r in [one_bit, eight_bit, packed] {
             let mut s = stream(&doc, r);
             let Some(Object::Dict(mut parms)) = s.dict.get(b"DecodeParms").cloned() else { panic!("{:?}", s.dict) };
             let made = match how {
@@ -519,13 +528,18 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
             doc.set(r, Object::Stream(s));
         }
         // 300 × 120 pt is 288 ppi; 144 × 57.6 pt is 600 ppi.
-        page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
-        let before = [one_bit, eight_bit].map(|r| stream(&doc, r).raw);
+        page(
+            &mut doc,
+            &[("A", one_bit), ("B", eight_bit), ("C", packed)],
+            "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q q 300 0 0 120 20 200 cm /C Do Q",
+        );
+        let before = [one_bit, eight_bit, packed].map(|r| stream(&doc, r).raw);
         let r = optimize(&mut doc, &Settings::default()).unwrap();
-        assert_eq!((r.images_resampled, r.images_recompressed), (1, 1), "{r:?}");
-        let after = [one_bit, eight_bit].map(|r| stream(&doc, r));
-        assert!(before.iter().zip(&after).all(|(b, a)| *b != a.raw), "both stored again");
+        assert_eq!((r.images_resampled, r.images_recompressed), (1, 2), "{r:?}");
+        let after = [one_bit, eight_bit, packed].map(|r| stream(&doc, r));
+        assert!(before.iter().zip(&after).all(|(b, a)| *b != a.raw), "all stored again");
         assert_eq!(after[0].dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
+        assert_eq!((after[2].dict.int(b"BitsPerComponent"), after[2].dict.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])));
         after.map(|s| s.raw)
     };
     let direct = build("direct");

From f33227886d1729b756795126422e8c0b8fdad338 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:00:50 +0100
Subject: [PATCH 095/132] M11: eight-bit black-and-white grey takes the smaller
 of one bit and the grey settings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An eight-bit grey image of only black and white was packed to one bit
and stored, and the grey settings never saw it. For a dithered scan that
is bigger than what Reduce File Size made of it before, downsampled to
JPEG: 1-bit Flate can't shrink the dots (a 1200 × 1500 dither at 300 ppi
was 157 KB packed, 67 KB as before). Both are made now, and the smaller
as stored wins, counting a soft mask resampled with the image. Clean
text still packs to one bit. The packing also decodes no further than
its samples can need, as the other image steps do now.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/README.md         |  4 +-
 crates/optimize/src/images.rs     | 32 +++++++++++--
 crates/optimize/tests/optimize.rs | 77 ++++++++++++++++++++++++++++---
 parity/acrobat-features.toml      |  2 +-
 4 files changed, 101 insertions(+), 14 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index bfd3dad7de..518910fea4 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -38,7 +38,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
   general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
   that is smaller as stored. An eight-bit grey image of only 0 and 255 is packed to one bit first
-  (not an indexed image, whose samples are palette indices, nor one with a colour-key `/Mask`). It is lossless: the samples decode to the same bits, so the colour
+  (not an indexed image, whose samples are palette indices, nor one with a colour-key `/Mask`),
+  unless the grey settings make it smaller still, as they can a dithered scan by downsampling it
+  to JPEG. It is lossless: the samples decode to the same bits, so the colour
   space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
   JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 08e65d037c..8550affb5c 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -635,7 +635,7 @@ fn bilevel_grey(doc: &Document, s: &Stream, compression: MonoCompression) -> Opt
     let (w, h) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
     // Through its parameters given by reference too: without a PNG predictor's tag bytes taken
     // off, rows of 0 and 255 would still pass below, each shifted by a byte.
-    let samples = doc.with_direct_parms(s).decoded().ok()?;
+    let samples = doc.with_direct_parms(s).decoded_within(allowance(w.checked_mul(h)?, u32::try_from(h).ok()?)?).ok()?;
     let samples = samples.get(..w.checked_mul(h)?)?;
     let stride = w.div_ceil(8);
     let mut packed = vec![0u8; stride.checked_mul(h)?];
@@ -686,16 +686,38 @@ pub(crate) fn run(
         let obj = doc.get(r);
         let Object::Stream(s) = &*obj else { continue };
         report.images += 1;
-        if let Some(new) = mono(doc, s, settings.mono).or_else(|| bilevel_grey(doc, s, settings.mono)) {
+        if let Some(new) = mono(doc, s, settings.mono) {
             report.image_bytes_before += s.raw.len();
             report.image_bytes_after += new.raw.len();
             report.images_recompressed += 1;
             doc.set(r, Object::Stream(new));
             continue;
         }
-        let Some(n) = s.dict.get(b"ColorSpace").and_then(|cs| components(doc, cs)) else { continue };
-        let st = if n == 1 { &settings.gray } else { &settings.color };
-        let Some((new, smask)) = process(doc, s, ppi, st, n) else { continue };
+        let packed = bilevel_grey(doc, s, settings.mono);
+        let n = s.dict.get(b"ColorSpace").and_then(|cs| components(doc, cs));
+        let processed = n.and_then(|n| process(doc, s, ppi, if n == 1 { &settings.gray } else { &settings.color }, n));
+        // An image packed from eight bits is lossless at one bit, but the grey settings can make it
+        // smaller still (a dithered scan, downsampled and JPEG-compressed): the smaller wins,
+        // counting a soft mask resampled with it.
+        let smask_len = |smask: Option<&(ObjRef, Stream)>| match smask {
+            Some((_, m)) => Some(m.raw.len()),
+            None => s.dict.reference(b"SMask").map(|m| match &*doc.get(m) {
+                Object::Stream(m) => m.raw.len(),
+                _ => 0,
+            }),
+        };
+        let total = |new: &Stream, smask: Option<&(ObjRef, Stream)>| Some(crate::stored_len(new)?.saturating_add(smask_len(smask).unwrap_or(0)));
+        let packed_wins = packed.as_ref().is_some_and(|p| {
+            processed.as_ref().is_none_or(|(new, smask)| total(p, None).zip(total(new, smask.as_ref())).is_some_and(|(a, b)| a <= b))
+        });
+        if let Some(new) = packed.filter(|_| packed_wins) {
+            report.image_bytes_before += s.raw.len();
+            report.image_bytes_after += new.raw.len();
+            report.images_recompressed += 1;
+            doc.set(r, Object::Stream(new));
+            continue;
+        }
+        let Some((new, smask)) = processed else { continue };
         let resized = new.dict.int(b"Width") != s.dict.int(b"Width") || new.dict.int(b"Height") != s.dict.int(b"Height");
         report.image_bytes_before += s.raw.len();
         report.image_bytes_after += new.raw.len();
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index f861da9d20..73ed54d6b1 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -548,9 +548,10 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
 }
 
 /// An image whose data decodes far past what its samples can need (a decompression bomb) is left
-/// alone rather than decoded up to the 1 GiB limit: a 1-bit one that would become Group 4, and an
-/// eight-bit one that would be resampled, each with four megabytes of zeros after its samples. Stored
-/// as ASCIIHex text under Flate, broken into lines of 64 digits, their samples aren't a bomb.
+/// alone rather than decoded up to the 1 GiB limit: a 1-bit one that would become Group 4, an
+/// eight-bit one that would be resampled, and an eight-bit one of only black and white that would
+/// be packed to one bit, each with four megabytes of zeros after its samples. Stored as ASCIIHex
+/// text under Flate, broken into lines of 64 digits, their samples aren't a bomb.
 #[test]
 fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
     let (w, h) = (1200u32, 480u32);
@@ -562,13 +563,18 @@ fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
         let grey = |bits: i64| [("BitsPerComponent", bits.into()), ("ColorSpace", Object::name("DeviceGray"))];
         let one_bit = mono_image(&mut doc, w, h, &padded(&text), None, &grey(1));
         let eight_bit = mono_image(&mut doc, w, h, &padded(&shades), None, &grey(8));
+        let packed = mono_image(&mut doc, w, h, &padded(&self::eight_bit(&text, w, h)), None, &grey(8));
         // 300 × 120 pt is 288 ppi; 144 × 57.6 pt is 600 ppi.
-        page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
-        let before = [one_bit, eight_bit].map(|r| stream(&doc, r).raw);
+        page(
+            &mut doc,
+            &[("A", one_bit), ("B", eight_bit), ("C", packed)],
+            "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q q 300 0 0 120 20 200 cm /C Do Q",
+        );
+        let before = [one_bit, eight_bit, packed].map(|r| stream(&doc, r).raw);
         let r = optimize(&mut doc, &Settings::default()).unwrap();
-        let after = [one_bit, eight_bit].map(|r| stream(&doc, r).raw);
+        let after = [one_bit, eight_bit, packed].map(|r| stream(&doc, r).raw);
         if padding == 0 {
-            assert_eq!((r.images_resampled, r.images_recompressed), (1, 1), "{r:?}");
+            assert_eq!((r.images_resampled, r.images_recompressed), (1, 2), "{r:?}");
         } else {
             assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "{r:?}");
             assert_eq!(after, before);
@@ -608,6 +614,63 @@ fn eight_bit(bits: &[u8], w: u32, h: u32) -> Vec<u8> {
     (0..h as usize).flat_map(|y| (0..w as usize).map(move |x| if bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0 { 255 } else { 0 })).collect()
 }
 
+/// Eight-bit samples of only 0 and 255, dithered (Floyd–Steinberg) from a smooth picture as a
+/// scanner's halftone mode gives them: no shade but black and white, in short runs.
+fn dithered(w: u32, h: u32) -> Vec<u8> {
+    let (w, h) = (w as usize, h as usize);
+    let mut level: Vec<f32> = (0..w * h).map(|i| 127.5 + 127.5 * ((i % w) as f32 / 37.0).sin() * ((i / w) as f32 / 53.0).cos()).collect();
+    let mut out = vec![0u8; w * h];
+    for y in 0..h {
+        for x in 0..w {
+            let i = y * w + x;
+            let v = if level[i] < 128.0 { 0.0 } else { 255.0 };
+            out[i] = v as u8;
+            let e = level[i] - v;
+            if x + 1 < w {
+                level[i + 1] += e * 7.0 / 16.0;
+            }
+            if y + 1 < h {
+                if x > 0 {
+                    level[i + w - 1] += e * 3.0 / 16.0;
+                }
+                level[i + w] += e * 5.0 / 16.0;
+                if x + 1 < w {
+                    level[i + w + 1] += e / 16.0;
+                }
+            }
+        }
+    }
+    out
+}
+
+/// A dithered scan stored as eight-bit grey of only black and white is smaller downsampled and
+/// JPEG-compressed by the grey settings than packed to one bit, which can't shrink its dots: the
+/// smaller wins, so Reduce File Size makes it no larger than with Monochrome Images on Retain.
+/// Clean text is still packed to one bit at the same resolution.
+#[test]
+fn eight_bit_black_and_white_takes_the_smaller_of_one_bit_and_the_grey_settings() {
+    let (w, h) = (1200u32, 1500u32);
+    for (what, samples) in [("dither", dithered(w, h)), ("text", eight_bit(&bilevel(w, h, false), w, h))] {
+        let build = || {
+            let mut doc = Document::new_empty();
+            let img = mono_image(&mut doc, w, h, &samples, None, &[("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+            // 288 × 360 pt is 300 ppi, above where the grey settings downsample.
+            page(&mut doc, &[("A", img)], "q 288 0 0 360 20 400 cm /A Do Q");
+            (doc, img)
+        };
+        let (mut doc, img) = build();
+        optimize(&mut doc, &Settings::default()).unwrap();
+        let (mut retained, _) = build();
+        optimize(&mut retained, &Settings { mono: MonoCompression::Retain, ..Settings::default() }).unwrap();
+        let (s, kept) = (stream(&doc, img), stream(&retained, img));
+        let bits = if what == "dither" { 8 } else { 1 };
+        assert_eq!(s.dict.int(b"BitsPerComponent"), Some(bits), "{what}: {} bytes, {} with Retain", s.raw.len(), kept.raw.len());
+        if what == "dither" {
+            assert!(s.raw.len() <= kept.raw.len(), "{what}: {} bytes, {} with Retain", s.raw.len(), kept.raw.len());
+        }
+    }
+}
+
 /// Eight-bit grey images of only black and white (as some scanners and converters write scans)
 /// become one-bit Group 4, losslessly: the page looks the same, an inverting decode array
 /// included. Not touched by this: a grey image with any other shade, an indexed image (its samples
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index bf96832b16..81c971dbc8 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside). Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still (a dithered scan downsampled to JPEG). Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 096f6431c7d5557fbfe1af5b8f812811db1b2c9f Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:05:28 +0100
Subject: [PATCH 096/132] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20re?=
 =?UTF-8?q?ads=20a=20lookup=20table's=20/DecodeParms=20given=20by=20refere?=
 =?UTF-8?q?nce;=20tests=20for=20its=20claims?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- An indexed image's lookup table given as a stream was decoded without
  its /DecodeParms when they came by reference, so a PNG predictor's tag
  bytes ran into the colours (red and blue came out [2,255,0] and black).
  It decodes through with_direct_parms now, as the samples do. This was
  already so on main; #4320 makes the same change.
- Tests for what this PR claims and no test held: Group 3 one-
  dimensional data exports as its picture (mapping /K 0 to Group 4 gave
  all white and passed); CCITT soft and stencil masks export as the same
  masks in Flate (decoding them plainly dropped them and passed); a
  Flate image's predictor given by reference reads as direct; and a
  1-bit TIFF is stored as Group 4 (the TIFF test said "a 1-bit one" but
  wrote eight bits; its comment now says what it writes).

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/create/src/extract.rs |   8 +-
 crates/create/src/tests.rs   | 161 ++++++++++++++++++++++++++++++++++-
 2 files changed, 165 insertions(+), 4 deletions(-)

diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 9b6925d16d..d9895ffdd2 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -519,9 +519,11 @@ fn space(doc: &Document, cs: Option<&Object>) -> Result<Space, String> {
                 };
                 let table = match a.get(3).map(|t| doc.resolve(t)).as_deref() {
                     Some(Object::String(s)) => s.bytes.clone(),
-                    Some(Object::Stream(t)) => {
-                        t.decoded_within(MAX_LOOKUP).map_err(|_| "an indexed colour space with an oversized or damaged lookup table".to_string())?
-                    }
+                    // Through its parameters given by reference too, as the image's samples.
+                    Some(Object::Stream(t)) => doc
+                        .with_direct_parms(t)
+                        .decoded_within(MAX_LOOKUP)
+                        .map_err(|_| "an indexed colour space with an oversized or damaged lookup table".to_string())?,
                     _ => return Err("an indexed colour space without a lookup table".into()),
                 };
                 Ok(Space::Indexed(Box::new(base), hival, table))
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 554dc01ff8..7bb1b80066 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -186,7 +186,7 @@ fn bmp_gif_and_multi_page_tiff_images() {
         let mut enc = image::codecs::gif::GifEncoder::new(&mut gif);
         enc.encode(img.as_raw(), 2, 2, image::ExtendedColorType::Rgba8).unwrap();
     }
-    // TIFF: two pages, an 8-bit gray one at 144 dpi and a 1-bit one.
+    // TIFF: two 8-bit gray pages, one at 144 dpi and one of only black and white.
     let mut tif = std::io::Cursor::new(Vec::new());
     {
         let mut enc = tiff::encoder::TiffEncoder::new(&mut tif).unwrap();
@@ -1295,6 +1295,48 @@ fn a_cyclic_indexed_colour_space_is_refused() {
     assert_eq!(out.skipped.len(), 1, "{:?}", out.skipped);
 }
 
+/// A baseline TIFF of one uncompressed strip of 1-bit samples, `packed` rows each starting on a
+/// byte, 0 for black (BlackIsZero; TIFF 6.0, section 3): the `tiff` crate writes no 1-bit images.
+fn one_bit_tiff(w: u32, h: u32, packed: &[u8]) -> Vec<u8> {
+    // Tag, type (3 SHORT, 4 LONG), value; the strip follows the IFD.
+    let entries: [(u16, u16, u32); 8] =
+        [(256, 4, w), (257, 4, h), (258, 3, 1), (259, 3, 1), (262, 3, 1), (273, 4, 0), (278, 4, h), (279, 4, packed.len() as u32)];
+    let strip = 8 + 2 + entries.len() as u32 * 12 + 4;
+    let mut out = b"II*\0".to_vec();
+    out.extend(8u32.to_le_bytes());
+    out.extend((entries.len() as u16).to_le_bytes());
+    for (tag, kind, value) in entries {
+        let value = if tag == 273 { strip } else { value };
+        out.extend(tag.to_le_bytes());
+        out.extend(kind.to_le_bytes());
+        out.extend(1u32.to_le_bytes());
+        match kind {
+            3 => out.extend((value as u16).to_le_bytes().into_iter().chain([0, 0])),
+            _ => out.extend(value.to_le_bytes()),
+        }
+    }
+    out.extend(0u32.to_le_bytes());
+    out.extend_from_slice(packed);
+    out
+}
+
+/// A bilevel TIFF (one bit a sample) stays one bit, stored as Group 4 when that is smaller, and
+/// exports as its picture.
+#[test]
+fn a_one_bit_tiff_is_stored_as_group_4() {
+    let (w, h) = (1200u32, 240u32);
+    let bits = strokes(w, h);
+    let stride = (w as usize).div_ceil(8);
+    let picture: Vec<bool> =
+        (0..(w * h) as usize).map(|i| bits[i / w as usize * stride + i % w as usize / 8] & (0x80 >> (i % w as usize % 8)) != 0).collect();
+    let doc = from_images(&[("scan.tif".into(), one_bit_tiff(w, h, &bits))]).unwrap();
+    let im = image_of(&doc, 0);
+    assert_eq!((im.int(b"BitsPerComponent"), im.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    assert_eq!(exported_white(&out.images[0].data), picture);
+}
+
 /// A TIFF of `pages` 64×64 gray pages, then (with `unreadable`) one whose samples Create can't read.
 fn gray_tiff(pages: usize, unreadable: bool) -> Vec<u8> {
     let mut tif = std::io::Cursor::new(Vec::new());
@@ -1621,3 +1663,120 @@ fn ccitt_fax_images_export_as_their_picture() {
     let out = extract_images(&doc, &[0], 0);
     assert!(out.images.is_empty() && out.skipped.len() == 1, "columns other than the width: skipped");
 }
+
+/// Group 3 data: rows of run lengths, white first, coded one-dimensionally (ITU-T T.4) with no
+/// end-of-line codes, from the few codes these runs need.
+fn group_3(rows: &[&[u32]]) -> Vec<u8> {
+    let code = |white: bool, run: u32| match (white, run) {
+        (true, 16) => "101010",
+        (true, 32) => "00011011",
+        (false, 16) => "0000010111",
+        (false, 32) => "000001101010",
+        _ => panic!("no code here for a run of {run}"),
+    };
+    let bits: String = rows.iter().flat_map(|row| row.iter().enumerate().map(|(i, run)| code(i % 2 == 0, *run))).collect();
+    bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
+}
+
+/// What Export ▸ Images claims for CCITT and for parameters given by reference, each checked
+/// against the same picture stored another way: Group 3 one-dimensional data (`/K 0`) exports as
+/// its picture; a CCITT soft mask and a CCITT stencil `/Mask` export as the same masks in Flate;
+/// and a Flate image's PNG predictor, and an indexed image's lookup table stream with one, read
+/// the same with their `/DecodeParms` given by reference as direct.
+#[test]
+fn group_3_ccitt_masks_and_parameters_by_reference_export_as_their_picture() {
+    use png::{BitDepth, ColorType};
+    let (w, h) = (64u32, 16u32);
+    let rows: Vec<&[u32]> = (0..h).map(|y| if y % 2 == 0 { &[32u32, 32][..] } else { &[16, 16, 32][..] }).collect();
+    let mut bits = vec![0u8; 8 * h as usize];
+    for (y, runs) in rows.iter().enumerate() {
+        let mut x = 0;
+        for (i, run) in runs.iter().enumerate() {
+            if i % 2 == 0 {
+                (x..x + *run as usize).for_each(|xx| bits[y * 8 + xx / 8] |= 0x80 >> (xx % 8));
+            }
+            x += *run as usize;
+        }
+    }
+    let picture: Vec<bool> = (0..(w * h) as usize).map(|i| bits[i / 8] & (0x80 >> (i % 8)) != 0).collect();
+    let mut doc = from_images(&[("scan.png".into(), png_of(w, h, ColorType::Grayscale, BitDepth::One, &bits, None, None))]).unwrap();
+    let r = {
+        let page = pdfcraft_model::pages(&doc)[0].clone();
+        let res = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+        let xo = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+        xo.get(b"Im0").and_then(Object::as_ref).unwrap()
+    };
+    let image = |entries: &[(&str, Object)]| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        for (k, v) in entries {
+            d.set(k.as_bytes().to_vec(), v.clone());
+        }
+        d
+    };
+    let fax = |k: i64| {
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(k));
+        parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+        parms.set(b"Rows".to_vec(), Object::Int(h.into()));
+        [("Filter", Object::name("CCITTFaxDecode")), ("DecodeParms", Object::Dict(parms))]
+    };
+    let grey = |bits: i64| [("BitsPerComponent", Object::Int(bits)), ("ColorSpace", Object::name("DeviceGray"))];
+
+    let d = image(&[&grey(1)[..], &fax(0)].concat());
+    doc.set(r, Object::Stream(Stream::from_raw(d, group_3(&rows))));
+    let out = extract_images(&doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    assert_eq!(exported_white(&out.images[0].data), picture, "Group 3");
+
+    // A grey picture under the same bits as a soft mask, then as a stencil mask: CCITT against Flate.
+    let g4 = pdfcraft_filters::encode_g4(&bits, w, h).unwrap();
+    for (key, mask) in [("SMask", grey(1).to_vec()), ("Mask", vec![("ImageMask", Object::Bool(true))])] {
+        let mut exported = Vec::new();
+        for coded in [true, false] {
+            let m = if coded { Stream::from_raw(image(&[&mask[..], &fax(-1)].concat()), g4.clone()) } else { Stream::flate(image(&mask), &bits) };
+            let m = doc.add(Object::Stream(m));
+            let d = image(&[&grey(8)[..], &[(key, Object::Ref(m))]].concat());
+            doc.set(r, Object::Stream(Stream::flate(d, &vec![100u8; (w * h) as usize])));
+            exported.push(exported_rgba(&doc));
+        }
+        assert!(exported[0].1.chunks(4).any(|p| p[3] == 0), "{key}: masked somewhere");
+        assert_eq!(exported[0], exported[1], "{key}: CCITT as Flate");
+    }
+
+    // A PNG predictor given by reference, for the samples and for a lookup table.
+    let predicted = |rows: &[u8], columns: i64| {
+        let params = pdfcraft_filters::Params { predictor: 12, colors: 1, bits_per_component: 8, columns, early_change: 1 };
+        let mut parms = Dict::new();
+        parms.set(b"Predictor".to_vec(), Object::Int(12));
+        parms.set(b"Columns".to_vec(), Object::Int(columns));
+        (pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, rows).unwrap(), parms)
+    };
+    let shades: Vec<u8> = (0..w * h).map(|i| (i * 7 % 256) as u8).collect();
+    let (table, table_parms) = predicted(&[255, 0, 0, 0, 0, 255], 3);
+    let indices: Vec<u8> = (0..w * h).map(|i| (i % 3 % 2) as u8).collect();
+    let mut exported = Vec::new();
+    for by_reference in [false, true] {
+        let parms = |doc: &mut Document, p: &Dict| if by_reference { Object::Ref(doc.add(Object::Dict(p.clone()))) } else { Object::Dict(p.clone()) };
+        let (samples, sample_parms) = predicted(&shades, w.into());
+        let sample_parms = parms(&mut doc, &sample_parms);
+        let d = image(&[&grey(8)[..], &[("Filter", Object::name("FlateDecode")), ("DecodeParms", sample_parms)]].concat());
+        doc.set(r, Object::Stream(Stream::from_raw(d, samples)));
+        let plain = exported_rgba(&doc);
+
+        let mut lookup = Dict::new();
+        lookup.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        lookup.set(b"DecodeParms".to_vec(), parms(&mut doc, &table_parms));
+        let lookup = doc.add(Object::Stream(Stream::from_raw(lookup, table.clone())));
+        let cs = Object::Array(vec![Object::name("Indexed"), Object::name("DeviceRGB"), 1.into(), Object::Ref(lookup)]);
+        let d = image(&[("BitsPerComponent", Object::Int(8)), ("ColorSpace", cs)]);
+        doc.set(r, Object::Stream(Stream::flate(d, &indices)));
+        exported.push((plain, exported_rgba(&doc)));
+    }
+    assert_eq!(exported[0].0.1.chunks(4).map(|p| p[0]).collect::<Vec<_>>(), shades, "the samples, direct");
+    assert_eq!(exported[0].1.1.get(..8), Some(&[255, 0, 0, 255, 0, 0, 255, 255][..]), "red, then blue");
+    assert_eq!(exported[1], exported[0], "by reference as direct");
+}

From a4058c92425d84162263b73439d4c74f5f32ff00 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:05:28 +0100
Subject: [PATCH 097/132] M11: say redaction removes Create PDF's Group 4
 pictures whole for now

Redaction doesn't decode CCITT yet, so a mark over part of a picture
Create PDF stored as Group 4 removes the whole picture (nothing leaks);
before this PR such pictures were eight-bit Flate and had only the
covered pixels cleared. The create README and the image-to-PDF parity
note say so; #4384 adds CCITT to redaction. The workspace's comment on
hayro-ccitt says Export uses it, not only tests.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 Cargo.toml                   | 3 ++-
 crates/create/README.md      | 4 +++-
 parity/acrobat-features.toml | 2 +-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 5a92b67475..b2380a7496 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -67,7 +67,8 @@ flate2 = { version = "1.1", default-features = false, features = ["rust_backend"
 weezl = "0.2"
 # CCITT Group 4 encoding (pdfcraft-filters); already in the tree through tiff.
 fax = "0.2.7"
-# An independent CCITT decoder, for round-trip tests; already in the tree through hayro.
+# A CCITT decoder: Export ▸ Images decodes fax images with it, and the encoder's round-trip tests
+# check against it; already in the tree through hayro.
 hayro-ccitt = "0.3"
 
 # foundation
diff --git a/crates/create/README.md b/crates/create/README.md
index 8e0bdc68be..14d42e0a18 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -8,7 +8,9 @@ Layer L4. Create a PDF (Acrobat's Create a PDF tool), execution plan M10.2:
   (`/DCTDecode`, grey, RGB or Adobe-inverted CMYK); PNG is decoded and stored with Flate,
   with transparency as a soft mask. A picture of only pure black and white (a 1-bit PNG or TIFF,
   eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as
-  CCITT Group 4 or Flate, whichever is smaller as stored (`pdfcraft_filters::encode_g4`). An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
+  CCITT Group 4 or Flate, whichever is smaller as stored (`pdfcraft_filters::encode_g4`).
+  Redaction doesn't decode Group 4 yet: a mark over part of such a picture removes the whole
+  picture (nothing leaks). An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
   `iCCP`) that matches the image's colour space is kept as an `/ICCBased` colour space with
   the device space as `/Alternate`; images with the same profile share one profile object.
   JPEG metadata scanning skips marker fill bytes and reads application segments after the
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 81c971dbc8..7310893697 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -6885,7 +6885,7 @@ status = "shipped"
 commands = ["create.images"]
 tools = ["doc_create"]
 evidence = ["crates/create/src/tests.rs::black_and_white_images_are_stored_at_one_bit", "crates/create/src/tests.rs::jpeg_2000_images_are_embedded_as_is", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::embedded_icc_profiles_tag_the_image_colour_space"]
-notes = "PNG, JPEG, TIFF (multi-page), GIF (first frame), BMP, and JPEG 2000 (JP2 or codestream, embedded as JPXDecode with its capture resolution). JPEG and PNG ICC profiles are kept as /ICCBased; TIFF profiles are not read yet. A picture of only pure black and white (a 1-bit PNG or TIFF, eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as CCITT Group 4 or Flate, whichever is smaller"
+notes = "PNG, JPEG, TIFF (multi-page), GIF (first frame), BMP, and JPEG 2000 (JP2 or codestream, embedded as JPXDecode with its capture resolution). JPEG and PNG ICC profiles are kept as /ICCBased; TIFF profiles are not read yet. A picture of only pure black and white (a 1-bit PNG or TIFF, eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as CCITT Group 4 or Flate, whichever is smaller. Redaction doesn't decode Group 4 yet: a mark over part of such a picture removes it whole (nothing leaks)"
 
 [[feature]]
 id = "create.from-multipage-tiff"

From d2c3bda6b52d84bc0001b4b0862d7d919b912318 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:26:10 +0100
Subject: [PATCH 098/132] M11: tests for the soft mask in "the smaller wins",
 the byte totals and Group 3's options

- Eight-bit black-and-white text under a noisy soft mask: the grey
  settings win, as they shrink the mask far more than packing saves.
  Counting the packed image without its mask passed every test before.
- The packing test checks the report's byte totals exactly.
- Export reads Group 3 with end-of-line codes, with rows on a byte
  (EncodedByteAlign), with both, and mixed (/K 1, each row tagged
  one-dimensional) with end-of-line codes and without. Decoding /K 1 as
  one-dimensional, or ignoring EncodedByteAlign, now fails a test.
  /EndOfLine is passed to the decoder, but no input here tells it apart:
  the decoder accepts end-of-line codes either way, as ISO 32000-2
  (Table 11) requires.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/create/src/tests.rs        | 40 ++++++++++++++++++++++++-------
 crates/optimize/tests/optimize.rs | 31 ++++++++++++++++++++++++
 2 files changed, 62 insertions(+), 9 deletions(-)

diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 7bb1b80066..212fa3ca71 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1664,9 +1664,11 @@ fn ccitt_fax_images_export_as_their_picture() {
     assert!(out.images.is_empty() && out.skipped.len() == 1, "columns other than the width: skipped");
 }
 
-/// Group 3 data: rows of run lengths, white first, coded one-dimensionally (ITU-T T.4) with no
-/// end-of-line codes, from the few codes these runs need.
-fn group_3(rows: &[&[u32]]) -> Vec<u8> {
+/// Group 3 data: rows of run lengths, white first, coded one-dimensionally (ITU-T T.4), from the
+/// few codes these runs need. Each row starts with an end-of-line code with `eol`, then with
+/// `tag` a 1 bit (the next row one-dimensional, as `/K` above 0 has it). With `align` each row
+/// starts on a byte, its end-of-line code too.
+fn group_3(rows: &[&[u32]], eol: bool, tag: bool, align: bool) -> Vec<u8> {
     let code = |white: bool, run: u32| match (white, run) {
         (true, 16) => "101010",
         (true, 32) => "00011011",
@@ -1674,7 +1676,19 @@ fn group_3(rows: &[&[u32]]) -> Vec<u8> {
         (false, 32) => "000001101010",
         _ => panic!("no code here for a run of {run}"),
     };
-    let bits: String = rows.iter().flat_map(|row| row.iter().enumerate().map(|(i, run)| code(i % 2 == 0, *run))).collect();
+    let mut bits = String::new();
+    for row in rows {
+        while align && !bits.len().is_multiple_of(8) {
+            bits.push('0');
+        }
+        if eol {
+            bits.push_str("000000000001");
+        }
+        if tag {
+            bits.push('1');
+        }
+        row.iter().enumerate().for_each(|(i, run)| bits.push_str(code(i % 2 == 0, *run)));
+    }
     bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
 }
 
@@ -1726,11 +1740,19 @@ fn group_3_ccitt_masks_and_parameters_by_reference_export_as_their_picture() {
     };
     let grey = |bits: i64| [("BitsPerComponent", Object::Int(bits)), ("ColorSpace", Object::name("DeviceGray"))];
 
-    let d = image(&[&grey(1)[..], &fax(0)].concat());
-    doc.set(r, Object::Stream(Stream::from_raw(d, group_3(&rows))));
-    let out = extract_images(&doc, &[0], 0);
-    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
-    assert_eq!(exported_white(&out.images[0].data), picture, "Group 3");
+    // One-dimensional (/K 0) plain, with end-of-line codes, with each row on a byte, and with
+    // both; mixed (/K 1, each row tagged one-dimensional) with end-of-line codes and without.
+    for (k, eol, align) in [(0, false, false), (0, true, false), (0, false, true), (0, true, true), (1, true, false), (1, false, false)] {
+        let mut d = image(&[&grey(1)[..], &fax(k)].concat());
+        if let Some(Object::Dict(parms)) = d.get_mut(b"DecodeParms") {
+            parms.set(b"EndOfLine".to_vec(), Object::Bool(eol));
+            parms.set(b"EncodedByteAlign".to_vec(), Object::Bool(align));
+        }
+        doc.set(r, Object::Stream(Stream::from_raw(d, group_3(&rows, eol, k > 0, align))));
+        let out = extract_images(&doc, &[0], 0);
+        assert!(out.skipped.is_empty(), "/K {k}, EndOfLine {eol}, EncodedByteAlign {align}: {:?}", out.skipped);
+        assert_eq!(exported_white(&out.images[0].data), picture, "/K {k}, EndOfLine {eol}, EncodedByteAlign {align}");
+    }
 
     // A grey picture under the same bits as a soft mask, then as a stencil mask: CCITT against Flate.
     let g4 = pdfcraft_filters::encode_g4(&bits, w, h).unwrap();
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 73ed54d6b1..c9a5203ab6 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -671,6 +671,34 @@ fn eight_bit_black_and_white_takes_the_smaller_of_one_bit_and_the_grey_settings(
     }
 }
 
+/// The smaller of one bit and the grey settings counts the soft mask each leaves: packed, the
+/// image keeps its mask as it is; resampled by the grey settings, the mask is resampled with it.
+/// Here clean text, which packs to well under its JPEG, under a noisy mask the grey settings
+/// shrink by far more than the image's saving: the grey settings win.
+#[test]
+fn eight_bit_black_and_white_with_a_soft_mask_counts_the_mask() {
+    let (w, h) = (1200u32, 1500u32);
+    let mut doc = Document::new_empty();
+    let mut seed = 0x2545_F491_4F6C_DD1Du64;
+    let noise: Vec<u8> = (0..w * h)
+        .map(|_| {
+            seed ^= seed << 13;
+            seed ^= seed >> 7;
+            seed ^= seed << 17;
+            (seed >> 24) as u8
+        })
+        .collect();
+    let mask = mono_image(&mut doc, w, h, &noise, None, &[("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+    let grey = [("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray")), ("SMask", Object::Ref(mask))];
+    let img = mono_image(&mut doc, w, h, &eight_bit(&bilevel(w, h, false), w, h), None, &grey);
+    // 288 × 360 pt is 300 ppi, above where the grey settings downsample.
+    page(&mut doc, &[("A", img)], "q 288 0 0 360 20 400 cm /A Do Q");
+    optimize(&mut doc, &Settings::default()).unwrap();
+    let s = stream(&doc, img);
+    assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), (Some(8), Some(&b"DCTDecode"[..])), "{:?}", s.dict);
+    assert!(stream(&doc, mask).raw.len() < (w * h) as usize / 2, "the mask resampled with it");
+}
+
 /// Eight-bit grey images of only black and white (as some scanners and converters write scans)
 /// become one-bit Group 4, losslessly: the page looks the same, an inverting decode array
 /// included. Not touched by this: a grey image with any other shade, an indexed image (its samples
@@ -724,8 +752,11 @@ fn eight_bit_black_and_white_images_become_one_bit() {
     assert_eq!(r.images_recompressed, 0, "Retain keeps every image as it is");
 
     let untouched = [shade, indexed, keyed].map(|r| raw(&doc, r));
+    let old: usize = [plain, inverted].map(|r| raw(&doc, r).len()).iter().sum();
     let r = optimize(&mut doc, &settings).unwrap();
     assert_eq!(r.images_recompressed, 2);
+    let new: usize = [plain, inverted].map(|r| raw(&doc, r).len()).iter().sum();
+    assert_eq!((r.image_bytes_before, r.image_bytes_after), (old, new), "the byte totals count both");
     for i in [plain, inverted] {
         let s = stream(&doc, i);
         assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])));

From 2c7bbbae05fc4cc3915d35a57fb96c52a703d5fa Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:26:10 +0100
Subject: [PATCH 099/132] M11: the progress logs say eight-bit black-and-white
 packs unless the grey settings make it smaller

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 ROADMAP.md      | 2 +-
 docs/roadmap.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 9d6b7a43fe..9013e526ea 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,7 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
-- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit, and Export ▸ Images reads CCITT fax images.
+- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller (a dithered scan), and Export ▸ Images reads CCITT fax images.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 1ebbb025ad..a5d6627fbc 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -257,7 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them; Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
+| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller (a dithered scan); Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |

From e8f3c6bc3efa61d878b83069a2dd0ffab1407391 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:54:03 +0100
Subject: [PATCH 100/132] =?UTF-8?q?M11:=20Export=20=E2=96=B8=20Images=20re?=
 =?UTF-8?q?ads=20byte-aligned=20Group=203=20whichever=20way=20its=20fill?=
 =?UTF-8?q?=20falls?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With /EncodedByteAlign and end-of-line codes, the fill may start each
code on a byte or end it on one (T.4's fill, as TIFF writes it); the
second was misread, and the image refused as short. With end-of-line
codes the decoder now reads unaligned, as the codes mark the rows either
way (probed black-box for /K 0, 1 and 2); codes laid out so under
/EndOfLine false are still misread. The Group 3 test covers both
layouts, /EncodedByteAlign given by reference, and a /BlackIs1 that
inverts the picture given by reference (with_direct_parms resolves both
before the decoder reads them).

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/create/src/extract.rs | 48 ++++++++++++++++++++++--------------
 crates/create/src/tests.rs   | 48 +++++++++++++++++++++++++++++-------
 2 files changed, 69 insertions(+), 27 deletions(-)

diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index d9895ffdd2..95019467b0 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -196,25 +196,37 @@ fn ccitt(doc: &Document, s: &Stream, data: &[u8], p: Dict) -> Result<Vec<u8>, St
     // As many rows as the image has, whatever /Rows says: one below /Height would cut the picture
     // short, and rows past /Height aren't drawn.
     let rows = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
-    let settings = hayro_ccitt::DecodeSettings {
-        columns,
-        rows,
-        end_of_block: flag(b"EndOfBlock", true),
-        end_of_line: flag(b"EndOfLine", false),
-        rows_are_byte_aligned: flag(b"EncodedByteAlign", false),
-        encoding: match k {
-            ..0 => hayro_ccitt::EncodingMode::Group4,
-            0 => hayro_ccitt::EncodingMode::Group3_1D,
-            k => hayro_ccitt::EncodingMode::Group3_2D { k: u32::try_from(k).unwrap_or(u32::MAX) },
-        },
-        invert_black: false,
-    };
     let stride = (columns as usize).div_ceil(8);
-    let mut out =
-        Rows { out: Vec::new(), row: vec![0; stride], x: 0, columns: columns as usize, rows: rows as usize, black_is_1: flag(b"BlackIs1", false) };
-    // Rows decoded before damaged data are kept; too few rows are refused by the caller.
-    let _ = hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
-    Ok(out.out)
+    let decode = |aligned: bool| {
+        let settings = hayro_ccitt::DecodeSettings {
+            columns,
+            rows,
+            end_of_block: flag(b"EndOfBlock", true),
+            end_of_line: flag(b"EndOfLine", false),
+            rows_are_byte_aligned: aligned,
+            encoding: match k {
+                ..0 => hayro_ccitt::EncodingMode::Group4,
+                0 => hayro_ccitt::EncodingMode::Group3_1D,
+                k => hayro_ccitt::EncodingMode::Group3_2D { k: u32::try_from(k).unwrap_or(u32::MAX) },
+            },
+            invert_black: false,
+        };
+        let mut out = Rows {
+            out: Vec::new(),
+            row: vec![0; stride],
+            x: 0,
+            columns: columns as usize,
+            rows: rows as usize,
+            black_is_1: flag(b"BlackIs1", false),
+        };
+        // Rows decoded before damaged data are kept; too few rows are refused by the caller.
+        let _ = hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
+        out.out
+    };
+    // Byte-aligned rows with end-of-line codes may have the fill end each code on a byte (T.4's
+    // fill, as TIFF writes it) rather than start it on one; read unaligned, the codes mark the rows
+    // either way. Codes laid out so under `/EndOfLine false` are misread.
+    Ok(decode(flag(b"EncodedByteAlign", false) && !flag(b"EndOfLine", false)))
 }
 
 /// The file for one image: its JPEG data as is, or a PNG. An image with transparency (a soft
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 212fa3ca71..19a7e76e37 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1666,9 +1666,9 @@ fn ccitt_fax_images_export_as_their_picture() {
 
 /// Group 3 data: rows of run lengths, white first, coded one-dimensionally (ITU-T T.4), from the
 /// few codes these runs need. Each row starts with an end-of-line code with `eol`, then with
-/// `tag` a 1 bit (the next row one-dimensional, as `/K` above 0 has it). With `align` each row
-/// starts on a byte, its end-of-line code too.
-fn group_3(rows: &[&[u32]], eol: bool, tag: bool, align: bool) -> Vec<u8> {
+/// `tag` a 1 bit (the next row one-dimensional, as `/K` above 0 has it). Fill bits (0s) go where
+/// `fill` says.
+fn group_3(rows: &[&[u32]], eol: bool, tag: bool, fill: Fill) -> Vec<u8> {
     let code = |white: bool, run: u32| match (white, run) {
         (true, 16) => "101010",
         (true, 32) => "00011011",
@@ -1678,7 +1678,9 @@ fn group_3(rows: &[&[u32]], eol: bool, tag: bool, align: bool) -> Vec<u8> {
     };
     let mut bits = String::new();
     for row in rows {
-        while align && !bits.len().is_multiple_of(8) {
+        // The end-of-line code is 12 bits.
+        let ends_code = if fill == Fill::CodeEnd && eol { 12 } else { 0 };
+        while fill != Fill::None && !(bits.len() + ends_code).is_multiple_of(8) {
             bits.push('0');
         }
         if eol {
@@ -1692,6 +1694,15 @@ fn group_3(rows: &[&[u32]], eol: bool, tag: bool, align: bool) -> Vec<u8> {
     bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
 }
 
+/// Where [`group_3`] puts fill bits: none; so each row, its end-of-line code first, starts on a
+/// byte; or so each end-of-line code ends on one (T.4's fill, as TIFF writes it).
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Fill {
+    None,
+    RowStart,
+    CodeEnd,
+}
+
 /// What Export ▸ Images claims for CCITT and for parameters given by reference, each checked
 /// against the same picture stored another way: Group 3 one-dimensional data (`/K 0`) exports as
 /// its picture; a CCITT soft mask and a CCITT stencil `/Mask` export as the same masks in Flate;
@@ -1742,16 +1753,35 @@ fn group_3_ccitt_masks_and_parameters_by_reference_export_as_their_picture() {
 
     // One-dimensional (/K 0) plain, with end-of-line codes, with each row on a byte, and with
     // both; mixed (/K 1, each row tagged one-dimensional) with end-of-line codes and without.
-    for (k, eol, align) in [(0, false, false), (0, true, false), (0, false, true), (0, true, true), (1, true, false), (1, false, false)] {
+    // Byte-aligned with end-of-line codes either way: each code starting on a byte, or ending on
+    // one (T.4's fill, as TIFF writes it). /EncodedByteAlign is given by reference once, and so is
+    // a /BlackIs1 that inverts the picture.
+    let inverted: Vec<bool> = picture.iter().map(|white| !white).collect();
+    for (k, eol, fill, align_by_reference, black_is_1) in [
+        (0, false, Fill::None, false, false),
+        (0, true, Fill::None, false, false),
+        (0, false, Fill::RowStart, true, false),
+        (0, true, Fill::RowStart, false, false),
+        (0, true, Fill::CodeEnd, false, false),
+        (1, true, Fill::None, false, false),
+        (1, false, Fill::None, false, false),
+        (1, true, Fill::CodeEnd, false, false),
+        (0, false, Fill::None, false, true),
+    ] {
         let mut d = image(&[&grey(1)[..], &fax(k)].concat());
+        let align = Object::Bool(fill != Fill::None);
+        let align = if align_by_reference { Object::Ref(doc.add(align)) } else { align };
+        let inverts = Object::Ref(doc.add(Object::Bool(black_is_1)));
         if let Some(Object::Dict(parms)) = d.get_mut(b"DecodeParms") {
             parms.set(b"EndOfLine".to_vec(), Object::Bool(eol));
-            parms.set(b"EncodedByteAlign".to_vec(), Object::Bool(align));
+            parms.set(b"EncodedByteAlign".to_vec(), align);
+            parms.set(b"BlackIs1".to_vec(), inverts);
         }
-        doc.set(r, Object::Stream(Stream::from_raw(d, group_3(&rows, eol, k > 0, align))));
+        doc.set(r, Object::Stream(Stream::from_raw(d, group_3(&rows, eol, k > 0, fill))));
+        let case = format!("/K {k}, EndOfLine {eol}, fill {fill:?}, BlackIs1 {black_is_1}");
         let out = extract_images(&doc, &[0], 0);
-        assert!(out.skipped.is_empty(), "/K {k}, EndOfLine {eol}, EncodedByteAlign {align}: {:?}", out.skipped);
-        assert_eq!(exported_white(&out.images[0].data), picture, "/K {k}, EndOfLine {eol}, EncodedByteAlign {align}");
+        assert!(out.skipped.is_empty(), "{case}: {:?}", out.skipped);
+        assert_eq!(exported_white(&out.images[0].data), if black_is_1 { inverted.clone() } else { picture.clone() }, "{case}");
     }
 
     // A grey picture under the same bits as a soft mask, then as a stencil mask: CCITT against Flate.

From ec4b265b57fa0a40c91b7f6b5e18ba9bf910875b Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:54:04 +0100
Subject: [PATCH 101/132] M11: "the smaller wins" counts the soft mask in the
 tests and the docs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- A noisy 640 × 800 soft mask under 1200 × 1500 text: resampled to the
  image's new size it shrinks only a little, by less than the grey
  settings' JPEG adds over the packed image, so packing wins; not
  counting the new mask passed every test before.
- The hex-text half of the bomb test also stores eight-bit
  black-and-white, which must pack, as its comment says.
- The optimize README, the mono-compression parity note and both
  progress logs say the soft mask counts.
- The Copy Image parity note no longer lists CCITT as missing: it
  copies through Export's decoder, which reads CCITT now.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 ROADMAP.md                        |  2 +-
 crates/optimize/README.md         |  4 +--
 crates/optimize/tests/optimize.rs | 53 ++++++++++++++++++-------------
 docs/roadmap.md                   |  2 +-
 parity/acrobat-features.toml      |  4 +--
 5 files changed, 37 insertions(+), 28 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 9013e526ea..0d1332e862 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,7 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
-- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller (a dithered scan), and Export ▸ Images reads CCITT fax images.
+- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller, soft mask counted (a dithered scan), and Export ▸ Images reads CCITT fax images.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 518910fea4..1f184f0ffb 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -39,8 +39,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
   that is smaller as stored. An eight-bit grey image of only 0 and 255 is packed to one bit first
   (not an indexed image, whose samples are palette indices, nor one with a colour-key `/Mask`),
-  unless the grey settings make it smaller still, as they can a dithered scan by downsampling it
-  to JPEG. It is lossless: the samples decode to the same bits, so the colour
+  unless the grey settings make it smaller still, its soft mask counted (resampled with it there,
+  kept as it is here), as they can a dithered scan by downsampling it to JPEG. It is lossless: the samples decode to the same bits, so the colour
   space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
   on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
   JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index c9a5203ab6..9e82858776 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -602,10 +602,16 @@ fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
     let page_scan = bilevel(2560, 1200, false);
     let one_bit = as_hex(&mut doc, &page_scan, 1, (2560, 1200));
     let eight_bit = as_hex(&mut doc, &shades, 8, (w, h));
-    page(&mut doc, &[("A", one_bit), ("B", eight_bit)], "q 460.8 0 0 216 20 500 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q");
+    let packed = as_hex(&mut doc, &self::eight_bit(&text, w, h), 8, (w, h));
+    page(
+        &mut doc,
+        &[("A", one_bit), ("B", eight_bit), ("C", packed)],
+        "q 460.8 0 0 216 20 500 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q q 300 0 0 120 20 200 cm /C Do Q",
+    );
     optimize(&mut doc, &Settings::default()).unwrap();
     assert_eq!(stream(&doc, one_bit).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "1-bit hex text in lines: Group 4");
     assert!(stream(&doc, eight_bit).dict.int(b"Width").is_some_and(|nw| nw < i64::from(w)), "8-bit hex text in lines: resampled");
+    assert_eq!(stream(&doc, packed).dict.int(b"BitsPerComponent"), Some(1), "8-bit black-and-white hex text in lines: packed");
 }
 
 /// Eight-bit samples (0 or 255) from rows of one-bit ones.
@@ -673,30 +679,33 @@ fn eight_bit_black_and_white_takes_the_smaller_of_one_bit_and_the_grey_settings(
 
 /// The smaller of one bit and the grey settings counts the soft mask each leaves: packed, the
 /// image keeps its mask as it is; resampled by the grey settings, the mask is resampled with it.
-/// Here clean text, which packs to well under its JPEG, under a noisy mask the grey settings
-/// shrink by far more than the image's saving: the grey settings win.
+/// Clean text, 1200 × 1500 at 300 ppi, under a noisy mask. A mask as large: the grey settings
+/// shrink it by far more than packing saves on the image, and win. A mask of 640 × 800 (a soft
+/// mask may be another size than its image): resampled to the image's new size it shrinks only a
+/// little, by less than the grey settings' JPEG adds over the packed image, and packing wins.
 #[test]
 fn eight_bit_black_and_white_with_a_soft_mask_counts_the_mask() {
     let (w, h) = (1200u32, 1500u32);
-    let mut doc = Document::new_empty();
-    let mut seed = 0x2545_F491_4F6C_DD1Du64;
-    let noise: Vec<u8> = (0..w * h)
-        .map(|_| {
-            seed ^= seed << 13;
-            seed ^= seed >> 7;
-            seed ^= seed << 17;
-            (seed >> 24) as u8
-        })
-        .collect();
-    let mask = mono_image(&mut doc, w, h, &noise, None, &[("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray"))]);
-    let grey = [("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray")), ("SMask", Object::Ref(mask))];
-    let img = mono_image(&mut doc, w, h, &eight_bit(&bilevel(w, h, false), w, h), None, &grey);
-    // 288 × 360 pt is 300 ppi, above where the grey settings downsample.
-    page(&mut doc, &[("A", img)], "q 288 0 0 360 20 400 cm /A Do Q");
-    optimize(&mut doc, &Settings::default()).unwrap();
-    let s = stream(&doc, img);
-    assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), (Some(8), Some(&b"DCTDecode"[..])), "{:?}", s.dict);
-    assert!(stream(&doc, mask).raw.len() < (w * h) as usize / 2, "the mask resampled with it");
+    for ((mw, mh), grey_wins) in [((w, h), true), ((640, 800), false)] {
+        let mut doc = Document::new_empty();
+        let mut seed = 0x2545_F491_4F6C_DD1Du64;
+        let noise: Vec<u8> = (0..mw * mh)
+            .map(|_| {
+                seed ^= seed << 13;
+                seed ^= seed >> 7;
+                seed ^= seed << 17;
+                (seed >> 24) as u8
+            })
+            .collect();
+        let mask = mono_image(&mut doc, mw, mh, &noise, None, &[("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray"))]);
+        let grey = [("BitsPerComponent", 8.into()), ("ColorSpace", Object::name("DeviceGray")), ("SMask", Object::Ref(mask))];
+        let img = mono_image(&mut doc, w, h, &eight_bit(&bilevel(w, h, false), w, h), None, &grey);
+        page(&mut doc, &[("A", img)], "q 288 0 0 360 20 400 cm /A Do Q");
+        optimize(&mut doc, &Settings::default()).unwrap();
+        let s = stream(&doc, img);
+        let expected = if grey_wins { (Some(8), Some(&b"DCTDecode"[..])) } else { (Some(1), Some(&b"CCITTFaxDecode"[..])) };
+        assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), expected, "mask {mw} × {mh}: {:?}", s.dict);
+    }
 }
 
 /// Eight-bit grey images of only black and white (as some scanners and converters write scans)
diff --git a/docs/roadmap.md b/docs/roadmap.md
index a5d6627fbc..c4efe2f004 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -257,7 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller (a dithered scan); Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
+| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller, soft mask counted (a dithered scan); Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 7310893697..6b593363c7 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1599,7 +1599,7 @@ status = "partial"
 commands = []
 tools = []
 evidence = ["crates/ui-egui/tests/it/viewer.rs::a_clicked_picture_is_selected_and_copied_in_its_original_format", "crates/ui-egui/tests/it/viewer.rs::right_click_on_a_picture_copies_it_at_full_size", "crates/ui-egui/tests/it/viewer.rs::a_picture_inside_form_artwork_under_text_is_selected_and_copied", "crates/engine/src/tests.rs::copy_image_finds_a_picture_inside_form_artwork_under_text"]
-notes = "Select tool: a click selects a raster image (also inside Form artwork or under text) and ⌘C copies it as a file in its original format (JPEG as stored, else PNG); right-click ▸ Copy Image copies its pixels at full resolution. Missing: inline images (BI/ID/EI), JPEG 2000/JBIG2/CCITT images, multi-format clipboard (file and bitmap at once), the web build"
+notes = "Select tool: a click selects a raster image (also inside Form artwork or under text) and ⌘C copies it as a file in its original format (JPEG as stored, else PNG); right-click ▸ Copy Image copies its pixels at full resolution. Missing: inline images (BI/ID/EI), JPEG 2000/JBIG2 images, multi-format clipboard (file and bitmap at once), the web build"
 
 [[feature]]
 id = "view.rulers"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still (a dithered scan downsampled to JPEG). Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, its soft mask counted (a dithered scan downsampled to JPEG). Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 8c720e480844649e782c7a2617d6376b0f7bb818 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 18:49:05 +0100
Subject: [PATCH 102/132] M11: Export reads byte-aligned Group 3 by the codes
 in its data
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Export ▸ Images reads byte-aligned Group 3 whichever way its fill
falls" read byte-aligned rows unaligned whenever /EndOfLine was set.
That broke byte-aligned Group 4 with /EndOfLine (refused); read Group 3
that says /EndOfLine but has no codes unaligned, and wrongly; and read
codes with the fill before them, but no /EndOfLine, on bytes: every row,
the wrong picture, nothing said. Now:
- Group 4, and rows not on bytes, read as the parameters say;
- Group 3 rows on bytes are read by the data: T.4 sends an end-of-line
  code before the first row when it sends them at all, and no other code
  starts with more than eight zeros. Data that starts with 11 zeros or
  more (fill included) and a 1 has codes, and is read unaligned, where
  the codes mark the rows whether the fill starts each code on a byte or
  ends it on one; other data is read on bytes, whatever /EndOfLine says.
  A reading that comes up short is reported rather than tried the other
  way, where data cut short would read as other rows.

The Group 3 test exports nine pictures, stripes and eight of random
text-like runs (how a misreading comes out depends on the picture),
coded with T.4's terminating codes at /K 0 and 1: no codes, with
/EndOfLine and without; codes each starting on a byte or ending on one,
with /EndOfLine and without. Each exports as its picture, and each a
byte short is reported; at /K 1, codes with none before the first row
(not as T.4 sends them) export as their picture or are reported.
Byte-aligned Group 4 still reads with and without /EndOfLine. The
create.export-all-images parity note says what is still limited: such
codes may export wrong at /K 0, as the create README says. A rule tried
first, reading both ways and refusing an image that gave every row both
ways differently, failed on the stripes without codes (TIFF's Modified
Huffman layout): its unaligned reading gives every row too, wrongly. So
did one that read the other way when the first reading came up short: it
drew data cut short as other rows. cargo-mutants leaves no mutant of the
new lines alive.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/create/README.md      |   7 +-
 crates/create/src/extract.rs |  23 +++++--
 crates/create/src/tests.rs   | 128 +++++++++++++++++++++++++++++++----
 parity/acrobat-features.toml |   4 +-
 4 files changed, 142 insertions(+), 20 deletions(-)

diff --git a/crates/create/README.md b/crates/create/README.md
index 14d42e0a18..b63dc933b0 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -36,4 +36,9 @@ The existing 16-bit path still uses each sample's high byte.
 JPEG image Decode handling remains limited.
 ICC transforms and calibrated color conversion remain outside this export path.
 CCITT fax images (Group 3 and 4) are decoded for export through `hayro-ccitt` with their `/DecodeParms`
-(`/Columns` has to be the image's width), behind other filters such as `ASCII85Decode` too; JPEG 2000 and JBIG2 images are still reported, not exported.
+(`/Columns` has to be the image's width), behind other filters such as `ASCII85Decode` too.
+Byte-aligned Group 3 rows are read by their end-of-line codes, whether the fill starts each code on
+a byte or ends it on one, when the data starts with one (T.4 sends one before the first row), and on
+bytes otherwise, whatever `/EndOfLine` says; data that comes up short is reported. Data with codes
+but none before the first row is read on bytes, and is reported or, at `/K 0`, may come out wrong.
+JPEG 2000 and JBIG2 images are still reported, not exported.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 95019467b0..814b68aea2 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -223,10 +223,25 @@ fn ccitt(doc: &Document, s: &Stream, data: &[u8], p: Dict) -> Result<Vec<u8>, St
         let _ = hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
         out.out
     };
-    // Byte-aligned rows with end-of-line codes may have the fill end each code on a byte (T.4's
-    // fill, as TIFF writes it) rather than start it on one; read unaligned, the codes mark the rows
-    // either way. Codes laid out so under `/EndOfLine false` are misread.
-    Ok(decode(flag(b"EncodedByteAlign", false) && !flag(b"EndOfLine", false)))
+    let aligned = flag(b"EncodedByteAlign", false);
+    // Group 4 reads as its parameters say, and so do rows not on bytes.
+    if k < 0 || !aligned {
+        return Ok(decode(aligned));
+    }
+    // Group 3 rows on bytes may have end-of-line codes whatever /EndOfLine says (the filter always
+    // accepts them), with the fill starting each code on a byte or ending it on one (T.4's fill, as
+    // TIFF writes it). Read unaligned, the codes mark the rows either way; without codes, the rows
+    // are read on bytes. A reading that comes up short isn't tried the other way: data cut short
+    // would then read as other rows, and is refused instead.
+    Ok(decode(!starts_with_end_of_line(data)))
+}
+
+/// Whether CCITT fax `data` starts with an end-of-line code: a 1 after 11 zeros or more, fill
+/// included. T.4 sends one before the first row when it sends them at all, and no other code starts
+/// with more than eight zeros.
+fn starts_with_end_of_line(data: &[u8]) -> bool {
+    let Some((i, b)) = data.iter().enumerate().find(|(_, b)| **b != 0) else { return false };
+    i.saturating_mul(8).saturating_add(b.leading_zeros() as usize) >= 11
 }
 
 /// The file for one image: its JPEG data as is, or a PNG. An image with transparency (a soft
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 19a7e76e37..fc47e78adf 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -1664,18 +1664,29 @@ fn ccitt_fax_images_export_as_their_picture() {
     assert!(out.images.is_empty() && out.skipped.len() == 1, "columns other than the width: skipped");
 }
 
-/// Group 3 data: rows of run lengths, white first, coded one-dimensionally (ITU-T T.4), from the
-/// few codes these runs need. Each row starts with an end-of-line code with `eol`, then with
-/// `tag` a 1 bit (the next row one-dimensional, as `/K` above 0 has it). Fill bits (0s) go where
-/// `fill` says.
-fn group_3(rows: &[&[u32]], eol: bool, tag: bool, fill: Fill) -> Vec<u8> {
-    let code = |white: bool, run: u32| match (white, run) {
-        (true, 16) => "101010",
-        (true, 32) => "00011011",
-        (false, 16) => "0000010111",
-        (false, 32) => "000001101010",
-        _ => panic!("no code here for a run of {run}"),
-    };
+/// Group 3 data: rows of run lengths below 64, white first, coded one-dimensionally with T.4's
+/// terminating codes (ITU-T T.4 Tables 2 and 3). Each row starts with an end-of-line code with
+/// `eol`, then with `tag` a 1 bit (the next row one-dimensional, as `/K` above 0 has it). Fill bits
+/// (0s) go where `fill` says.
+fn group_3(rows: &[impl AsRef<[u32]>], eol: bool, tag: bool, fill: Fill) -> Vec<u8> {
+    // The codes for runs 0 to 63, in order.
+    const WHITE: &str = concat!(
+        "00110101 000111 0111 1000 1011 1100 1110 1111 10011 10100 00111 01000 001000 000011 110100 110101 101010 101011 ",
+        "0100111 0001100 0001000 0010111 0000011 0000100 0101000 0101011 0010011 0100100 0011000 00000010 00000011 00011010 ",
+        "00011011 00010010 00010011 00010100 00010101 00010110 00010111 00101000 00101001 00101010 00101011 00101100 00101101 ",
+        "00000100 00000101 00001010 00001011 01010010 01010011 01010100 01010101 00100100 00100101 01011000 01011001 01011010 ",
+        "01011011 01001010 01001011 00110010 00110011 00110100",
+    );
+    const BLACK: &str = concat!(
+        "0000110111 010 11 10 011 0011 0010 00011 000101 000100 0000100 0000101 0000111 00000100 00000111 000011000 0000010111 ",
+        "0000011000 0000001000 00001100111 00001101000 00001101100 00000110111 00000101000 00000010111 00000011000 ",
+        "000011001010 000011001011 000011001100 000011001101 000001101000 000001101001 000001101010 000001101011 000011010010 ",
+        "000011010011 000011010100 000011010101 000011010110 000011010111 000001101100 000001101101 000011011010 000011011011 ",
+        "000001010100 000001010101 000001010110 000001010111 000001100100 000001100101 000001010010 000001010011 000000100100 ",
+        "000000110111 000000111000 000000100111 000000101000 000001011000 000001011001 000000101011 000000101100 000001011010 ",
+        "000001100110 000001100111",
+    );
+    let code = |white: bool, run: u32| (if white { WHITE } else { BLACK }).split(' ').nth(run as usize).expect("a run below 64");
     let mut bits = String::new();
     for row in rows {
         // The end-of-line code is 12 bits.
@@ -1689,11 +1700,50 @@ fn group_3(rows: &[&[u32]], eol: bool, tag: bool, fill: Fill) -> Vec<u8> {
         if tag {
             bits.push('1');
         }
-        row.iter().enumerate().for_each(|(i, run)| bits.push_str(code(i % 2 == 0, *run)));
+        row.as_ref().iter().enumerate().for_each(|(i, run)| bits.push_str(code(i % 2 == 0, *run)));
     }
     bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
 }
 
+/// `count` text-like pictures `w` by `h` for [`group_3`], from a fixed seed: rows of random runs,
+/// long white ones and short black ones, and a row may start black.
+fn random_pictures(w: u32, h: u32, count: usize) -> Vec<Vec<Vec<u32>>> {
+    let mut seed = 0x9E37_79B9_7F4A_7C15u64;
+    let mut random = |n: u64| {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        (seed % n) as u32
+    };
+    let mut row = || {
+        let (mut runs, mut left) = (Vec::new(), w);
+        while left > 0 {
+            let run = match runs.len() % 2 {
+                0 if runs.is_empty() => random(31),
+                0 => 1 + random(30),
+                _ => 1 + random(5),
+            };
+            runs.push(run.min(left));
+            left -= run.min(left);
+        }
+        runs
+    };
+    (0..count).map(|_| (0..h).map(|_| row()).collect()).collect()
+}
+
+/// The picture `rows` of runs (white first) make, `w` by `h`, true where white.
+fn white_of(rows: &[Vec<u32>], w: u32, h: u32) -> Vec<bool> {
+    let mut white = vec![false; (w * h) as usize];
+    for (y, row) in rows.iter().enumerate() {
+        let mut x = y * w as usize;
+        for (i, run) in row.iter().enumerate() {
+            white[x..x + *run as usize].fill(i % 2 == 0);
+            x += *run as usize;
+        }
+    }
+    white
+}
+
 /// Where [`group_3`] puts fill bits: none; so each row, its end-of-line code first, starts on a
 /// byte; or so each end-of-line code ends on one (T.4's fill, as TIFF writes it).
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -1783,6 +1833,58 @@ fn group_3_ccitt_masks_and_parameters_by_reference_export_as_their_picture() {
         assert!(out.skipped.is_empty(), "{case}: {:?}", out.skipped);
         assert_eq!(exported_white(&out.images[0].data), if black_is_1 { inverted.clone() } else { picture.clone() }, "{case}");
     }
+    // Byte-aligned rows against /EndOfLine, over several pictures, as how a misreading comes out
+    // depends on the picture: no codes (as TIFF's Modified Huffman has it), and /EndOfLine without
+    // them; codes, each starting on a byte or ending on one, /EndOfLine or not. Each exports as its
+    // picture, and a byte short is reported. The first picture is stripes, every row 32 white then
+    // 32 black; the others are text-like rows of random runs.
+    let image_with = |doc: &mut Document, k: i64, eol: bool, data: Vec<u8>| {
+        let mut d = image(&[&grey(1)[..], &fax(k)].concat());
+        if let Some(Object::Dict(parms)) = d.get_mut(b"DecodeParms") {
+            parms.set(b"EndOfLine".to_vec(), Object::Bool(eol));
+            parms.set(b"EncodedByteAlign".to_vec(), Object::Bool(true));
+        }
+        doc.set(r, Object::Stream(Stream::from_raw(d, data)));
+        extract_images(doc, &[0], 0)
+    };
+    let mut pictures = vec![vec![vec![32u32, 32]; h as usize]];
+    pictures.extend(random_pictures(w, h, 8));
+    for (n, runs) in pictures.iter().enumerate() {
+        let white = white_of(runs, w, h);
+        for k in [0, 1] {
+            for (codes, fill, eol) in [
+                (false, Fill::RowStart, false),
+                (false, Fill::RowStart, true),
+                (true, Fill::RowStart, false),
+                (true, Fill::RowStart, true),
+                (true, Fill::CodeEnd, false),
+                (true, Fill::CodeEnd, true),
+            ] {
+                let out = image_with(&mut doc, k, eol, group_3(runs, codes, k > 0, fill));
+                let case = format!("picture {n}, /K {k}, codes {codes}, fill {fill:?}, /EndOfLine {eol}");
+                assert!(out.skipped.is_empty(), "{case}: {:?}", out.skipped);
+                assert_eq!(exported_white(&out.images[0].data), white, "{case}");
+                // A byte short, it is reported, not read the other way into other rows.
+                let mut short = group_3(runs, codes, k > 0, fill);
+                short.pop();
+                let out = image_with(&mut doc, k, eol, short);
+                assert!(out.images.is_empty() && out.skipped.len() == 1, "{case}, a byte short: {:?}", out.skipped);
+                // At /K 1, codes with none before the first row (the first code and its fill are 2
+                // bytes here) are read on bytes: the picture or reported, never another picture.
+                if k == 1 && fill == Fill::CodeEnd {
+                    let out = image_with(&mut doc, k, eol, group_3(runs, codes, true, fill).split_off(2));
+                    assert!(out.images.iter().all(|i| exported_white(&i.data) == white), "{case}, no code first");
+                }
+            }
+        }
+    }
+    // Group 4 rows on bytes keep their aligned read, /EndOfLine or not: here white rows, each the
+    // one code 1 (vertical, no change) and its fill.
+    for eol in [false, true] {
+        let out = image_with(&mut doc, -1, eol, vec![0x80; h as usize]);
+        assert!(out.skipped.is_empty(), "byte-aligned Group 4, /EndOfLine {eol}: {:?}", out.skipped);
+        assert!(exported_white(&out.images[0].data).iter().all(|white| *white), "byte-aligned Group 4, /EndOfLine {eol}");
+    }
 
     // A grey picture under the same bits as a soft mask, then as a stencil mask: CCITT against Flate.
     let g4 = pdfcraft_filters::encode_g4(&bits, w, h).unwrap();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 6b593363c7..6c5547c06e 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7164,8 +7164,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["export.all_images"]
 tools = ["doc_export_all_images"]
-evidence = ["crates/create/src/tests.rs::ccitt_fax_images_export_as_their_picture", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps"]
-notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2 masks are left out (image exported opaque); JPX/JBIG2/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported. CCITT fax images (Group 3 and 4, with their /DecodeParms, behind other filters too) export as their picture, masks included."
+evidence = ["crates/create/src/tests.rs::ccitt_fax_images_export_as_their_picture", "crates/create/src/tests.rs::group_3_ccitt_masks_and_parameters_by_reference_export_as_their_picture", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/create/src/tests.rs::soft_mask_decode_ranges_become_exported_alpha", "crates/create/src/tests.rs::soft_mask_decode_maps_packed_and_jpeg_masks_before_resizing", "crates/automation/tests/it/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/it/export.rs::export_dialogs_write_images_and_text", "crates/create/src/tests.rs::lossless_decode_maps_each_component_before_colour_conversion", "crates/create/src/tests.rs::lossless_indexed_decode_rounds_in_index_units_then_clamps"]
+notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2 masks are left out (image exported opaque); JPX/JBIG2/separations reported as skipped; minimum size filter. Lossless images apply per-component Decode; Indexed values round and clip before palette lookup. Missing, null or malformed Decode arrays keep the default mapping. Soft-mask Decode intervals preserve opacity before resizing, including indirect arrays and endpoints. Still limited: 16-bit samples use high bytes; general JPEG image Decode, ICC transforms, and calibrated colors remain unsupported. CCITT fax images (Group 3 and 4, with their /DecodeParms, behind other filters too) export as their picture, masks included; byte-aligned Group 3 is read by the end-of-line codes when the data starts with one and on bytes otherwise, and one cut short is reported. Still limited: byte-aligned Group 3 with codes but none before the first row (not as T.4 sends them) is reported, or at /K 0 may export wrong."
 
 [[feature]]
 id = "create.export-html"

From 907a9fa917da5174a59fae5f3c5babba051d9baa Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 02:24:54 +0200
Subject: [PATCH 103/132] M11: monochrome downsampling: black-and-white images
 above 450 ppi are averaged down to 300
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The PDF Optimizer and Reduce File Size downsampled colour and grey images
but not black-and-white ones. Settings::mono is now MonoSettings {
downsample, target_ppi, above_ppi, compression }, 300 ppi above 450 ppi
and CCITT Group 4 by default (Monochrome Images ▸ Downsample to;
doc_optimize mono: { downsample, ppi, above_ppi, compression }).

A 1-bit image or image mask (no filter, general-purpose filters, or CCITT
fax after any of them) and eight-bit grey of only black and white are averaged by
area: each new pixel takes the sample covering more of it, a tie 0, so a
dark line half a new pixel wide stays. They are stored as Group 4, or as
1-bit Flate when that is smaller; with Retain a resampled image keeps its
kind of compression. Images with a soft mask keep their size.

CCITT decoding moves from Export ▸ Images into pdfcraft-filters
(decode_ccitt, CcittParams, through hayro-ccitt), and
pdfcraft_cos::Document::decoded_image reads a fax image's /DecodeParms
for it (undoing filters before CCITT, such as ASCII85Decode, with any
/DecodeParms given by reference made direct first), so export
and the optimizer share one reader, and Group 4 scans can be
downsampled. A 600 ppi text page went from 79 KB to 40 KB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 Cargo.lock                                  |   1 +
 Cargo.toml                                  |   4 +-
 ROADMAP.md                                  |   1 +
 crates/automation/src/documents.rs          |  25 +-
 crates/automation/src/tools.rs              |   2 +-
 crates/automation/tests/it/automation.rs    |  40 ++-
 crates/cos/README.md                        |   6 +-
 crates/cos/src/document.rs                  |   2 +-
 crates/cos/src/document/objects.rs          |  56 +++-
 crates/cos/src/document/tests.rs            |  77 +++++
 crates/cos/src/object.rs                    |   2 +-
 crates/create/Cargo.toml                    |   4 +-
 crates/create/README.md                     |  13 +-
 crates/create/src/extract.rs                | 148 +--------
 crates/filters/Cargo.toml                   |   3 +-
 crates/filters/README.md                    |  10 +-
 crates/filters/src/ccitt.rs                 | 178 ++++++++++-
 crates/filters/src/lib.rs                   |   2 +-
 crates/optimize/Cargo.toml                  |   1 +
 crates/optimize/README.md                   |  36 ++-
 crates/optimize/src/images.rs               | 332 ++++++++++++++------
 crates/optimize/src/lib.rs                  |  28 +-
 crates/optimize/tests/optimize.rs           | 158 +++++++++-
 crates/ui-egui/src/workflows/optimize_ui.rs |  19 +-
 crates/ui-egui/tests/it/create.rs           |   6 +-
 docs/pdf-spec-parity.md                     |   5 +-
 docs/roadmap.md                             |   3 +-
 parity/acrobat-features.toml                |  10 +-
 28 files changed, 867 insertions(+), 305 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e2427a1b0a..f9280eff06 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4511,6 +4511,7 @@ dependencies = [
  "pdfcraft-filters",
  "pdfcraft-model",
  "pdfcraft-render",
+ "proptest",
  "thiserror 2.0.21",
  "zune-jpeg",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index b2380a7496..f0995622b9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -67,8 +67,8 @@ flate2 = { version = "1.1", default-features = false, features = ["rust_backend"
 weezl = "0.2"
 # CCITT Group 4 encoding (pdfcraft-filters); already in the tree through tiff.
 fax = "0.2.7"
-# A CCITT decoder: Export ▸ Images decodes fax images with it, and the encoder's round-trip tests
-# check against it; already in the tree through hayro.
+# CCITT fax decoding (pdfcraft-filters' decode_ccitt), also the independent decoder in its
+# encoder's round-trip tests; already in the tree through hayro.
 hayro-ccitt = "0.3"
 
 # foundation
diff --git a/ROADMAP.md b/ROADMAP.md
index 2b2f785167..baae83997d 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,6 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
+- **2026-10-24 (M11, monochrome downsampling):** The PDF Optimizer and Reduce File Size average black-and-white images above 450 ppi down to 300 ppi (Monochrome Images ▸ Downsample to), Group 4 scans included, so a 600 ppi text page goes from 79 KB to 40 KB. CCITT decoding moved into `pdfcraft-filters` (`decode_ccitt`), shared by Export ▸ Images and the optimizer through `Document::decoded_image`.
 - **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller, as they can a dithered scan, soft mask counted, and Export ▸ Images reads CCITT fax images.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index 40aa4ac522..5d2c416ee5 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -280,6 +280,7 @@ impl Automation {
 
     pub(crate) fn doc_optimize(&mut self, a: &Args) -> Result<Value> {
         use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, MonoCompression, Preset};
+        const MONO_KEYS: [&str; 4] = ["downsample", "ppi", "above_ppi", "compression"];
         let id = self.doc(a)?.id;
         let before = self.doc(a)?.bytes.len();
         let path = self.resolve(a.str("path")?, true)?;
@@ -319,13 +320,29 @@ impl Automation {
         settings.gray = images("gray", settings.gray)?;
         if let Some(mono) = a.get("mono") {
             let unknown = |c: &Value| ToolError::InvalidArgs(format!("unknown mono compression {c} (ccitt_g4, retain)"));
-            let mono = mono.as_object().ok_or_else(|| ToolError::InvalidArgs("mono must be an object: { compression: ccitt_g4|retain }".into()))?;
+            let mono = mono.as_object().ok_or_else(|| {
+                ToolError::InvalidArgs("mono must be an object: { downsample, ppi, above_ppi, compression: ccitt_g4|retain }".into())
+            })?;
             // A misspelled key would otherwise leave the preset's setting in place unnoticed.
-            if let Some(key) = mono.keys().find(|k| *k != "compression") {
-                return Err(ToolError::InvalidArgs(format!("unknown mono key {key:?} (compression)")));
+            if let Some(key) = mono.keys().find(|k| !MONO_KEYS.contains(&k.as_str())) {
+                return Err(ToolError::InvalidArgs(format!("unknown mono key {key:?} ({})", MONO_KEYS.join(", "))));
             }
+            let m = &mut settings.mono;
+            if let Some(d) = mono.get("downsample") {
+                m.downsample = d.as_bool().ok_or_else(|| ToolError::InvalidArgs(format!("mono downsample must be true or false, not {d}")))?;
+            }
+            for (key, ppi) in [("ppi", &mut m.target_ppi), ("above_ppi", &mut m.above_ppi)] {
+                if let Some(p) = mono.get(key) {
+                    *ppi = p
+                        .as_f64()
+                        .filter(|p| p.is_finite())
+                        .ok_or_else(|| ToolError::InvalidArgs(format!("mono {key} must be a number, not {p}")))?
+                        .clamp(9.0, 2400.0);
+                }
+            }
+            m.above_ppi = m.above_ppi.max(m.target_ppi);
             if let Some(c) = mono.get("compression") {
-                settings.mono = match c.as_str() {
+                m.compression = match c.as_str() {
                     Some("ccitt_g4" | "ccitt" | "g4") => MonoCompression::CcittG4,
                     Some("retain") => MonoCompression::Retain,
                     _ => return Err(unknown(c)),
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 15530229fd..79555f1548 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1433,7 +1433,7 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { compression: ccitt_g4|retain } (default ccitt_g4: black-and-white images and image masks are stored losslessly as CCITT Group 4 when that is smaller; counted in images_recompressed). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 when that is smaller, counted in images_recompressed; retain resamples only, keeping each image's kind of compression). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index ea943eff79..e68da784d6 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6375,6 +6375,11 @@ fn lzw_streams_are_stored_with_flate_through_tools() {
 /// A one-page PDF drawing a 1-bit scan of text (glyph strokes with ragged edges, as a scanner
 /// leaves them) of 1000 × 400 samples, stored with Flate.
 fn scanned_page() -> Vec<u8> {
+    scan_drawn(b"q 500 0 0 200 50 500 cm /Scan Do Q")
+}
+
+/// [`scanned_page`]'s scan, drawn by `content` (which names it `/Scan`).
+fn scan_drawn(content: &[u8]) -> Vec<u8> {
     use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_full};
     let (w, h) = (1000usize, 400usize);
     let stride = w.div_ceil(8);
@@ -6415,7 +6420,7 @@ fn scanned_page() -> Vec<u8> {
     x.set(b"Scan".to_vec(), Object::Ref(image));
     let mut res = Dict::new();
     res.set(b"XObject".to_vec(), Object::Dict(x));
-    let content = doc.add(Object::Stream(Stream::from_raw(Dict::new(), b"q 500 0 0 200 50 500 cm /Scan Do Q".to_vec())));
+    let content = doc.add(Object::Stream(Stream::from_raw(Dict::new(), content.to_vec())));
     let mut p = Dict::new();
     p.set(b"Type".to_vec(), Object::name("Page"));
     p.set(b"Parent".to_vec(), Object::Ref(pages));
@@ -6511,6 +6516,39 @@ fn doc_optimize_stores_black_and_white_images_as_ccitt_group_4() {
     }
 }
 
+/// A scan drawn at 600 ppi is averaged down to 300 ppi by default. `mono: { downsample: false }`
+/// keeps its size, `ppi` and `above_ppi` choose others, and values of the wrong type are refused.
+#[test]
+fn doc_optimize_averages_black_and_white_scans_down() {
+    let dir = workdir("optimize-mono-downsample");
+    // 1000 × 400 samples on 120 × 48 pt: 600 ppi.
+    std::fs::write(dir.join("scan.pdf"), scan_drawn(b"q 120 0 0 48 50 500 cm /Scan Do Q")).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "scan.pdf" }))["doc"].as_u64().unwrap();
+    let sizes = |name: &str| -> Vec<(Option<i64>, Option<i64>)> {
+        let written = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join(name)).unwrap())).unwrap();
+        written
+            .object_numbers()
+            .into_iter()
+            .filter_map(|num| match &*written.get(pdfcraft_cos::ObjRef { num, generation: written.generation(num) }) {
+                pdfcraft_cos::Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => Some((s.dict.int(b"Width"), s.dict.int(b"Height"))),
+                _ => None,
+            })
+            .collect()
+    };
+    let r = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "small.pdf" }));
+    assert_eq!(r["images_resampled"].as_u64(), Some(1), "{r}");
+    assert_eq!(sizes("small.pdf"), [(Some(500), Some(200))]);
+    let r = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "kept.pdf", "mono": { "downsample": false } }));
+    assert_eq!(r["images_resampled"].as_u64(), Some(0), "{r}");
+    assert_eq!(sizes("kept.pdf"), [(Some(1000), Some(400))]);
+    ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "200.pdf", "mono": { "ppi": 200, "above_ppi": 250 } }));
+    assert_eq!(sizes("200.pdf"), [(Some(333), Some(133))]);
+    for mono in [json!({ "downsample": "yes" }), json!({ "ppi": "300" }), json!({ "above": 450 })] {
+        assert!(matches!(a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "mono": mono })), Err(ToolError::InvalidArgs(_))), "{mono}");
+    }
+}
+
 /// A one-page PDF whose page picture is drawn as `rows` grey images one pixel row high, 600 px
 /// wide on a 72 pt square (600 ppi), as some PDF printers write it.
 fn printed_in_strips(rows: usize) -> Vec<u8> {
diff --git a/crates/cos/README.md b/crates/cos/README.md
index 89b6826a8a..8358a220a0 100644
--- a/crates/cos/README.md
+++ b/crates/cos/README.md
@@ -25,6 +25,7 @@ let real = doc.resolve(&obj);                        // follow one indirect refe
 let d    = doc.dict(&obj);                           // Option<Dict>, resolving first
 let data = stream.decoded()?;                        // filters applied on demand
 let data = doc.with_direct_parms(&stream).decoded()?; // /DecodeParms given by reference too
+let px   = doc.decoded_image(&stream)?;              // an image's samples, a CCITT fax image's too
 
 doc.set(r, Object::Dict(d));                         // edit: lands in the overlay
 let r = doc.add(obj);                                // append a new object
@@ -88,5 +89,6 @@ recognisable in a diff and byte-stable when re-serialized.
 - Linearized output, Fast Web View (`core.linearization`, M11).
 - Structural validation against the Arlington model (`core.arlington-validation`), which will live
   in the reserved `arlington` crate.
-- Image codecs. `pdfcraft-filters` carries the non-image filters; DCT, JPX, JBIG2 and CCITT are
-  still decoded through the bootstrap renderer (`core.image-filters`, M2.6).
+- Image codecs. `pdfcraft-filters` carries the non-image filters and CCITT fax decoding
+  (`Document::decoded_image`); DCT, JPX and JBIG2 are still decoded through the bootstrap renderer
+  (`core.image-filters`, M2.6).
diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index 4c7748cc95..0d9b84b749 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -10,7 +10,7 @@ use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::{Arc, Mutex, Weak};
 
 use crate::CosError;
-use crate::object::{Dict, ObjRef, Object, Stream};
+use crate::object::{Dict, MAX_DECODED, ObjRef, Object, Stream};
 use crate::parser::{EndstreamIndex, Lexer, is_whitespace, parse_indirect, parse_indirect_shared};
 
 mod objects;
diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index fb20b50cf1..bcbf8bbf41 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -1,7 +1,7 @@
 use super::reader::find;
 use super::state::{LENGTHS, LoadGuard, ObjStm, ObjectReader, ReadState, Slot, SourceIdentity, objstm_member, owned_bytes};
 use super::xref::{Revision, XrefEntry};
-use super::{Arc, CosError, Cow, Dict, Document, Lexer, ObjRef, Object, Stream, is_whitespace, parse_indirect_shared};
+use super::{Arc, CosError, Cow, Dict, Document, Lexer, MAX_DECODED, ObjRef, Object, Stream, is_whitespace, parse_indirect_shared};
 
 impl Document {
     pub fn bytes(&self) -> &Arc<Vec<u8>> {
@@ -224,6 +224,60 @@ impl Document {
         self.resolve(o).as_dict().cloned()
     }
 
+    /// The samples of image `s`, decoded: through its filters ([`Stream::decoded`]), or, for a
+    /// CCITT fax image (its last filter), through the filters before it and then
+    /// [`pdfcraft_filters::decode_ccitt`] with its `/DecodeParms` (resolved; the dictionary of a
+    /// lone filter, or its entry in an array), as `CCITTFaxDecode` gives them (ISO 32000-2 §7.4.6).
+    /// Parameters given by reference count, for every filter ([`Document::with_direct_parms`]).
+    /// A fax image's `/Columns` has to be its `/Width`. Up to its `/Height` rows are decoded,
+    /// whatever `/Rows` says, within [`MAX_DECODED`] bytes; damaged data gives fewer, so a caller
+    /// checks it has the rows it needs.
+    pub fn decoded_image(&self, s: &Stream) -> Result<Vec<u8>, CosError> {
+        let s = &*self.with_direct_parms(s);
+        let chain = s.readable_filters().map_err(|e| CosError::Filter(e.to_string()))?;
+        let Some(((pdfcraft_filters::Filter::CcittFax, _), before)) = chain.split_last() else { return s.decoded() };
+        // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1).
+        let index = match s.dict.get(b"Filter") {
+            Some(Object::Array(a)) => a.len().saturating_sub(1),
+            _ => 0,
+        };
+        let parms = match s.dict.get(b"DecodeParms").map(|p| self.resolve(p)).as_deref() {
+            Some(Object::Array(a)) => a.get(index).and_then(|p| self.dict(p)),
+            Some(p) if index == 0 => p.as_dict().cloned(),
+            _ => None,
+        }
+        .unwrap_or_default();
+        let int = |key: &[u8], default: i64| parms.get(key).and_then(|v| self.resolve(v).as_int()).unwrap_or(default);
+        let flag = |key: &[u8], default: bool| match parms.get(key).map(|v| self.resolve(v)).as_deref() {
+            Some(Object::Bool(b)) => *b,
+            _ => default,
+        };
+        let d = pdfcraft_filters::CcittParams::default();
+        let p = pdfcraft_filters::CcittParams {
+            k: int(b"K", d.k),
+            columns: int(b"Columns", d.columns),
+            // As many rows as the image has: a /Rows below /Height would cut the picture short,
+            // and rows past /Height aren't drawn.
+            rows: 0,
+            end_of_line: flag(b"EndOfLine", d.end_of_line),
+            encoded_byte_align: flag(b"EncodedByteAlign", d.encoded_byte_align),
+            end_of_block: flag(b"EndOfBlock", d.end_of_block),
+            black_is_1: flag(b"BlackIs1", d.black_is_1),
+        };
+        if s.dict.int(b"Width") != Some(p.columns) {
+            return Err(CosError::Filter("a fax image's /Columns aren't its /Width".into()));
+        }
+        let height = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
+        let stride = usize::try_from(p.columns).unwrap_or(usize::MAX).div_ceil(8).max(1);
+        let rows = u32::try_from(MAX_DECODED / stride).unwrap_or(u32::MAX).min(height);
+        // The filters before it, such as ASCII85Decode, are undone first.
+        let data = match before {
+            [] => Cow::Borrowed(&s.raw[..]),
+            _ => Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, MAX_DECODED).map_err(|e| CosError::Filter(e.to_string()))?.0),
+        };
+        pdfcraft_filters::decode_ccitt(&data, &p, rows).map_err(|e| CosError::Filter(e.to_string()))
+    }
+
     pub fn try_get(&self, num: u32) -> Result<Arc<Object>, CosError> {
         match self.overlay.get(&num) {
             Some(Slot::Set(_, o)) => return Ok(o.clone()),
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index d8d75c4af1..49baeccec8 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -79,6 +79,83 @@ fn decode_parms_given_by_reference_are_read_once_direct() {
     }
 }
 
+/// A CCITT fax image reads through its /DecodeParms, given directly, in an array or by
+/// reference (its numbers too), with /BlackIs1, and behind other filters; one whose /Columns
+/// aren't its /Width is refused, /Height rows are decoded whatever /Rows says, and other images
+/// decode through their filters.
+#[test]
+fn fax_images_decode_with_their_parameters() {
+    // 10 × 3: the first five samples of each row white, the rest black.
+    let bits = [0b1111_1000, 0, 0b1111_1000, 0, 0b1111_1000, 0];
+    let coded = pdfcraft_filters::encode_g4(&bits, 10, 3).unwrap();
+    let mut doc = Document::new_empty();
+    let mut parms = Dict::new();
+    parms.set(b"K".to_vec(), Object::Int(-1));
+    parms.set(b"Columns".to_vec(), Object::Int(10));
+    let indirect = doc.add(Object::Dict(parms.clone()));
+    let image = |doc: &Document, parms: Option<Object>, width: i64, height: i64| {
+        let mut d = Dict::new();
+        d.set(b"Width".to_vec(), Object::Int(width));
+        d.set(b"Height".to_vec(), Object::Int(height));
+        d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+        if let Some(p) = parms {
+            d.set(b"DecodeParms".to_vec(), p);
+        }
+        doc.decoded_image(&Stream::from_raw(d, coded.clone()))
+    };
+    for p in [
+        Object::Dict(parms.clone()),
+        Object::Array(vec![Object::Dict(parms.clone())]),
+        Object::Ref(indirect),
+        Object::Array(vec![Object::Ref(indirect)]),
+    ] {
+        assert_eq!(image(&doc, Some(p.clone()), 10, 3).unwrap(), bits, "{p:?}");
+    }
+    let mut inverted = parms.clone();
+    inverted.set(b"BlackIs1".to_vec(), Object::Bool(true));
+    assert_eq!(
+        image(&doc, Some(Object::Dict(inverted)), 10, 3).unwrap(),
+        [0b0000_0111, 0b1100_0000, 0b0000_0111, 0b1100_0000, 0b0000_0111, 0b1100_0000]
+    );
+    assert_eq!(image(&doc, Some(Object::Dict(parms.clone())), 10, 2).unwrap(), bits[..4], "at most /Height rows");
+    let mut by_reference = Dict::new();
+    by_reference.set(b"K".to_vec(), Object::Ref(doc.add(Object::Int(-1))));
+    by_reference.set(b"Columns".to_vec(), Object::Ref(doc.add(Object::Int(10))));
+    assert_eq!(image(&doc, Some(Object::Dict(by_reference)), 10, 3).unwrap(), bits, "/K and /Columns by reference");
+    let mut understated = parms.clone();
+    understated.set(b"Rows".to_vec(), Object::Int(1));
+    assert_eq!(image(&doc, Some(Object::Dict(understated)), 10, 3).unwrap(), bits, "/Height rows, whatever /Rows says");
+    assert!(matches!(image(&doc, Some(Object::Dict(parms.clone())), 12, 3), Err(CosError::Filter(_))), "/Columns other than /Width");
+    assert!(matches!(image(&doc, None, 10, 3), Err(CosError::Filter(_))), "the default 1728 /Columns");
+    let mut plain = Dict::new();
+    plain.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+    assert_eq!(doc.decoded_image(&Stream::from_raw(plain, pdfcraft_filters::encode_flate(&bits))).unwrap(), bits);
+
+    // Behind other filters, its parameters at its own place in the array (/Crypt counts).
+    let behind = |filters: &[Object], parms: &[Object], data: Vec<u8>| {
+        let mut d = Dict::new();
+        d.set(b"Width".to_vec(), Object::Int(10));
+        d.set(b"Height".to_vec(), Object::Int(3));
+        d.set(b"Filter".to_vec(), Object::Array(filters.to_vec()));
+        d.set(b"DecodeParms".to_vec(), Object::Array(parms.to_vec()));
+        doc.decoded_image(&Stream::from_raw(d, data))
+    };
+    let (fax, null, own) = (Object::name("CCITTFaxDecode"), Object::Null, Object::Dict(parms.clone()));
+    let hex = coded.iter().map(|b| format!("{b:02x}")).chain([">".to_string()]).collect::<String>().into_bytes();
+    let flated = pdfcraft_filters::encode_flate(&coded);
+    let ahx = [Object::name("AHx"), fax.clone()];
+    assert_eq!(behind(&ahx, &[null.clone(), Object::Ref(indirect)], hex.clone()).unwrap(), bits, "behind ASCIIHexDecode");
+    assert_eq!(
+        behind(&[Object::name("FlateDecode"), Object::name("CCF")], &[null.clone(), own.clone()], flated.clone()).unwrap(),
+        bits,
+        "behind Flate"
+    );
+    assert_eq!(behind(&[Object::name("Crypt"), fax.clone()], &[null.clone(), own.clone()], coded.clone()).unwrap(), bits, "after /Crypt");
+    assert!(behind(&ahx, &[own.clone(), null.clone()], hex).is_err(), "the first entry is the other filter's");
+    assert!(behind(&[fax.clone(), Object::name("FlateDecode")], &[own.clone(), null.clone()], flated).is_err(), "CCITT, then Flate");
+    assert!(behind(&[Object::Int(5), fax], &[null, own], coded.clone()).is_err(), "a /Filter entry that isn't a name");
+}
+
 #[test]
 fn a_read_state_matches_a_clone_and_no_changed_document() {
     let mut doc = Document::new_empty();
diff --git a/crates/cos/src/object.rs b/crates/cos/src/object.rs
index c9b2ff9a36..17ee7844cf 100644
--- a/crates/cos/src/object.rs
+++ b/crates/cos/src/object.rs
@@ -261,7 +261,7 @@ impl Stream {
     /// [`Stream::filters`], or an error when `/Filter` is present but is not a name or an
     /// array of names (an indirect reference, say): the data is not unfiltered, so it must not
     /// read as decoded.
-    fn readable_filters(&self) -> Result<Vec<(Filter, Params)>, pdfcraft_filters::FilterError> {
+    pub(crate) fn readable_filters(&self) -> Result<Vec<(Filter, Params)>, pdfcraft_filters::FilterError> {
         let readable = match self.dict.get(b"Filter") {
             None | Some(Object::Null | Object::Name(_)) => true,
             Some(Object::Array(a)) => a.iter().all(|f| f.as_name().is_some()),
diff --git a/crates/create/Cargo.toml b/crates/create/Cargo.toml
index e60e554ba8..3648c3be00 100644
--- a/crates/create/Cargo.toml
+++ b/crates/create/Cargo.toml
@@ -11,8 +11,6 @@ workspace = true
 [dependencies]
 pdfcraft-cos = { workspace = true }
 pdfcraft-filters = { workspace = true }
-# Already in the graph through hayro: decodes CCITT fax images for Export ▸ Images.
-hayro-ccitt.workspace = true
 pdfcraft-model = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 # For `image::bmp_with_pixel_offset`, shared with XFA pictures.
@@ -27,5 +25,7 @@ thiserror = { workspace = true }
 encoding_rs = "0.8"
 
 [dev-dependencies]
+# An independent CCITT decoder, to check Create PDF's Group 4 images.
+hayro-ccitt.workspace = true
 image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg"] }
 hayro-syntax = { workspace = true }
diff --git a/crates/create/README.md b/crates/create/README.md
index b63dc933b0..05131d9038 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -35,10 +35,9 @@ Soft-mask Decode intervals map samples to opacity before the mask is resized, in
 The existing 16-bit path still uses each sample's high byte.
 JPEG image Decode handling remains limited.
 ICC transforms and calibrated color conversion remain outside this export path.
-CCITT fax images (Group 3 and 4) are decoded for export through `hayro-ccitt` with their `/DecodeParms`
-(`/Columns` has to be the image's width), behind other filters such as `ASCII85Decode` too.
-Byte-aligned Group 3 rows are read by their end-of-line codes, whether the fill starts each code on
-a byte or ends it on one, when the data starts with one (T.4 sends one before the first row), and on
-bytes otherwise, whatever `/EndOfLine` says; data that comes up short is reported. Data with codes
-but none before the first row is read on bytes, and is reported or, at `/K 0`, may come out wrong.
-JPEG 2000 and JBIG2 images are still reported, not exported.
+CCITT fax images (Group 3 and 4) are decoded for export through `pdfcraft_cos::Document::decoded_image` with their
+`/DecodeParms` (`/Columns` has to be the image's width; up to `/Height` rows, whatever `/Rows` says), behind other filters such as
+`ASCII85Decode` too. Byte-aligned Group 3 rows are read by their end-of-line codes, whether the fill starts each code on a byte or
+ends it on one, when the data starts with one (T.4 sends one before the first row), and on bytes otherwise, whatever `/EndOfLine`
+says; data that comes up short is reported. Data with codes but none before the first row is read on bytes, and is reported or,
+at `/K 0`, may come out wrong. JPEG 2000 and JBIG2 images are still reported, not exported.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 814b68aea2..e62eae31d2 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -4,7 +4,6 @@
 //! key as alpha. Images PdfCraft can't decode yet (JPEG 2000, JBIG2, separations) are
 //! reported, never silently left out.
 
-use std::borrow::Cow;
 use std::collections::HashSet;
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
@@ -101,149 +100,6 @@ fn filters(s: &Stream) -> Vec<Vec<u8>> {
     }
 }
 
-/// The samples of image `s`, decoded: through its filters, or, for a CCITT fax image (its last
-/// filter), through the filters before it and then a CCITT decoder, as rows of one-bit samples
-/// each starting on a byte, with black as 0 unless `/BlackIs1` says 1, as `CCITTFaxDecode` gives
-/// them (ISO 32000-2 §7.4.6).
-fn decoded(doc: &Document, s: &Stream) -> Result<Vec<u8>, String> {
-    // Parameters given by reference, which the filters read only once direct.
-    let s = &*doc.with_direct_parms(s);
-    let names = filters(s);
-    match names.split_last() {
-        Some((f, outer)) if f == b"CCITTFaxDecode" || f == b"CCF" => {
-            // Such as ASCII85Decode, undone first (7.4.1).
-            let chain = s.filters();
-            let data = match chain.split_last() {
-                Some((_, before)) if !before.is_empty() => {
-                    Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, pdfcraft_cos::MAX_DECODED).map_err(|e| e.to_string())?.0)
-                }
-                _ => Cow::Borrowed(&s.raw[..]),
-            };
-            ccitt(doc, s, &data, decode_parms(doc, s, outer.len()))
-        }
-        _ => s.decoded().map_err(|e| e.to_string()),
-    }
-}
-
-/// The `/DecodeParms` of filter `index` of a stream: the dictionary of a stream with one filter,
-/// or that entry of an array (7.4.2).
-fn decode_parms(doc: &Document, s: &Stream, index: usize) -> Dict {
-    let Some(p) = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)) else { return Dict::default() };
-    let p = match &*p {
-        Object::Array(a) => match a.get(index) {
-            Some(entry) => doc.resolve(entry),
-            None => return Dict::default(),
-        },
-        _ if index == 0 => p,
-        _ => return Dict::default(),
-    };
-    p.as_dict().cloned().unwrap_or_default()
-}
-
-/// [`decoded`] for a CCITT fax image: `data`, coded with parameters `p` (Table 11 defaults).
-/// `/Columns` has to be the image's width; pixels past it and rows past the image's height are
-/// dropped, so the output is bounded by the size the caller already checked. A stream that ends
-/// early gives fewer rows, which the caller refuses.
-fn ccitt(doc: &Document, s: &Stream, data: &[u8], p: Dict) -> Result<Vec<u8>, String> {
-    struct Rows {
-        out: Vec<u8>,
-        row: Vec<u8>,
-        x: usize,
-        columns: usize,
-        rows: usize,
-        black_is_1: bool,
-    }
-    impl Rows {
-        fn push(&mut self, white: bool, count: usize) {
-            for _ in 0..count {
-                if self.x < self.columns
-                    && white != self.black_is_1
-                    && let Some(b) = self.row.get_mut(self.x / 8)
-                {
-                    *b |= 0x80 >> (self.x % 8);
-                }
-                self.x = self.x.saturating_add(1);
-            }
-        }
-    }
-    impl hayro_ccitt::Decoder for Rows {
-        fn push_pixel(&mut self, white: bool) {
-            self.push(white, 1);
-        }
-        fn push_pixel_chunk(&mut self, white: bool, chunks: u32) {
-            self.push(white, (chunks as usize).saturating_mul(8));
-        }
-        fn next_line(&mut self) {
-            if self.out.len() / self.row.len().max(1) < self.rows {
-                self.out.extend_from_slice(&self.row);
-            }
-            self.row.fill(0);
-            self.x = 0;
-        }
-    }
-    let flag = |key: &[u8], default: bool| match p.get(key).map(|v| doc.resolve(v)).as_deref() {
-        Some(Object::Bool(b)) => *b,
-        _ => default,
-    };
-    let int = |key: &[u8]| p.get(key).and_then(|v| doc.resolve(v).as_int());
-    let k = int(b"K").unwrap_or(0);
-    // A row is the image's width: that was checked against the export's size limit, so a hostile
-    // /Columns can't size the buffers.
-    let columns = u32::try_from(int(b"Columns").unwrap_or(1728)).ok().filter(|c| *c > 0).ok_or("the fax image has no columns")?;
-    if s.dict.int(b"Width") != Some(i64::from(columns)) {
-        return Err("the fax image's columns aren't its width".into());
-    }
-    // As many rows as the image has, whatever /Rows says: one below /Height would cut the picture
-    // short, and rows past /Height aren't drawn.
-    let rows = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
-    let stride = (columns as usize).div_ceil(8);
-    let decode = |aligned: bool| {
-        let settings = hayro_ccitt::DecodeSettings {
-            columns,
-            rows,
-            end_of_block: flag(b"EndOfBlock", true),
-            end_of_line: flag(b"EndOfLine", false),
-            rows_are_byte_aligned: aligned,
-            encoding: match k {
-                ..0 => hayro_ccitt::EncodingMode::Group4,
-                0 => hayro_ccitt::EncodingMode::Group3_1D,
-                k => hayro_ccitt::EncodingMode::Group3_2D { k: u32::try_from(k).unwrap_or(u32::MAX) },
-            },
-            invert_black: false,
-        };
-        let mut out = Rows {
-            out: Vec::new(),
-            row: vec![0; stride],
-            x: 0,
-            columns: columns as usize,
-            rows: rows as usize,
-            black_is_1: flag(b"BlackIs1", false),
-        };
-        // Rows decoded before damaged data are kept; too few rows are refused by the caller.
-        let _ = hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
-        out.out
-    };
-    let aligned = flag(b"EncodedByteAlign", false);
-    // Group 4 reads as its parameters say, and so do rows not on bytes.
-    if k < 0 || !aligned {
-        return Ok(decode(aligned));
-    }
-    // Group 3 rows on bytes may have end-of-line codes whatever /EndOfLine says (the filter always
-    // accepts them), with the fill starting each code on a byte or ending it on one (T.4's fill, as
-    // TIFF writes it). Read unaligned, the codes mark the rows either way; without codes, the rows
-    // are read on bytes. A reading that comes up short isn't tried the other way: data cut short
-    // would then read as other rows, and is refused instead.
-    Ok(decode(!starts_with_end_of_line(data)))
-}
-
-/// Whether CCITT fax `data` starts with an end-of-line code: a 1 after 11 zeros or more, fill
-/// included. T.4 sends one before the first row when it sends them at all, and no other code starts
-/// with more than eight zeros.
-fn starts_with_end_of_line(data: &[u8]) -> bool {
-    let Some((i, b)) = data.iter().enumerate().find(|(_, b)| **b != 0) else { return false };
-    i.saturating_mul(8).saturating_add(b.leading_zeros() as usize) >= 11
-}
-
 /// The file for one image: its JPEG data as is, or a PNG. An image with transparency (a soft
 /// mask, a stencil `/Mask` or a colour-key `/Mask`) is always a PNG with that transparency as
 /// alpha, JPEG images included, so cut-out images keep their transparent background.
@@ -291,7 +147,7 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
         space = decoded;
         (samples, 8)
     } else {
-        let data = decoded(doc, s)?;
+        let data = doc.decoded_image(s).map_err(|e| e.to_string())?;
         let bpc = if mask { 1 } else { s.dict.int(b"BitsPerComponent").unwrap_or(8) };
         let bpc = match bpc {
             1 => 1,
@@ -633,7 +489,7 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>>
                 _ => return None,
             };
             let max = (1u32 << bpc.min(8)) - 1;
-            unpack(&decoded(doc, m).ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
+            unpack(&doc.decoded_image(m).ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
         }
     };
     if let Some([lo, hi]) = decode(doc, m, 1).and_then(|pairs| pairs.first().copied()) {
diff --git a/crates/filters/Cargo.toml b/crates/filters/Cargo.toml
index 2ed64eb8bd..91b5d3d578 100644
--- a/crates/filters/Cargo.toml
+++ b/crates/filters/Cargo.toml
@@ -12,10 +12,11 @@ workspace = true
 
 [dependencies]
 fax.workspace = true
+# CCITT fax decoding (`decode_ccitt`); already in the tree through hayro.
+hayro-ccitt.workspace = true
 flate2.workspace = true
 thiserror.workspace = true
 
 [dev-dependencies]
-hayro-ccitt.workspace = true
 proptest.workspace = true
 weezl.workspace = true
diff --git a/crates/filters/README.md b/crates/filters/README.md
index 413dff37c1..b59b170c90 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -3,7 +3,7 @@
 PDF stream filters: the decoders and encoders behind `/Filter` and `/DecodeParms`.
 
 - **Layer:** L0, standalone. No dependency on any other PdfCraft crate. `cos` depends on it (architecture §3 rule 3).
-- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder.
+- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder; CCITT decoding (T.4 and T.6) is the `hayro-ccitt` crate's (MIT OR Apache-2.0, already in the tree through hayro), bounded here.
 - `#![forbid(unsafe_code)]`. Builds for `wasm32-unknown-unknown`.
 
 ## API
@@ -23,6 +23,8 @@ decode_tolerant_counted(chain, data, max_output) -> Result<(Vec<u8>, bool /*part
 encode(filter, params, data) -> Result<Vec<u8>, FilterError>
 encode_flate(data) -> Vec<u8>   // zlib, level 6
 encode_g4(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows as CCITT Group 4; columns <= MAX_G4_COLUMNS
+pub struct CcittParams { k, columns, rows, end_of_line, encoded_byte_align, end_of_block, black_is_1 }  // Table 11; Default = its defaults
+decode_ccitt(data, &params, max_rows) -> Result<Vec<u8>, FilterError>   // CCITT fax as CCITTFaxDecode gives it; columns <= MAX_CCITT_COLUMNS
 ```
 
 - `chain` is applied first to last, as in a `/Filter` array.
@@ -41,16 +43,16 @@ encode_g4(data, columns, rows) -> Result<Vec<u8>, FilterError>   // 1-bit rows a
 | ASCIIHexDecode | white space ignored, odd digit padded with 0, `>` EOD (optional), other characters → Corrupt | upper case, newline every 64 digits, `>` |
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
-| CCITTFaxDecode | not here (`Unsupported`; renderers decode it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
+| CCITTFaxDecode | not in a chain (`Unsupported`); `decode_ccitt` decodes Group 3 and Group 4 on its own, as rows of 1-bit samples each on a new byte, black 0 unless `black_is_1`, at most `max_rows` rows (fewer with `/Rows`), the rows before any damage, up to 1,048,576 samples a row (`pdfcraft_cos::Document::decoded_image` calls it for a fax image, after the filters before it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
 
 ## Tests
 
 - Unit tests per filter with hand-computed vectors (the ISO 32000-2 LZW example, RFC 1951 stored blocks, PNG/TIFF rows).
 - LZW is cross-checked against `weezl` (dev-dependency) in both directions for both early-change settings.
 - `tests/proptests.rs`: encode→decode round trips for every encodable filter × predictor × colors × bpc × columns, two-filter chains, output-limit checks, and fuzz-style no-panic tests (random bytes, random/nonsense params, bit-flipped valid streams).
-- `ccitt.rs`: Group 4 output decoded by `hayro-ccitt` (dev-dependency, an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
+- `ccitt.rs`: `decode_ccitt` gives back the rows `encode_g4` was given (with `/BlackIs1`, `/Rows` and a row limit), refuses bad widths, and bounds its output for any input. Group 4 output decoded by `hayro-ccitt` (an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
 
-M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2, CCITT G3/G4 decode, DCT encode), CCITT Group 3 encoding and Flate encode levels other than 6.
+M1.1/M1.2 for the general-purpose filters are done. Not yet here: the image codecs (DCT via zune-jpeg, JPX via hayro-jpeg2000, JBIG2, DCT encode), CCITT Group 3 encoding and Flate encode levels other than 6.
diff --git a/crates/filters/src/ccitt.rs b/crates/filters/src/ccitt.rs
index 3c8018525a..731a1a6de5 100644
--- a/crates/filters/src/ccitt.rs
+++ b/crates/filters/src/ccitt.rs
@@ -1,5 +1,6 @@
-//! CCITT Group 4 (ITU-T T.6) encoding, for `CCITTFaxDecode` with `/K -1` (ISO 32000-2 §7.4.6).
-//! The coding is the `fax` crate's; this module checks what it is given.
+//! CCITT fax for `CCITTFaxDecode` (ISO 32000-2 §7.4.6): Group 4 (ITU-T T.6) encoding, with `/K -1`,
+//! and decoding of Group 3 (T.4) and Group 4. The coding is the `fax` crate's and the decoding the
+//! `hayro-ccitt` crate's; this module checks what they are given and bounds what they give.
 
 use fax::encoder::Encoder;
 use fax::{Color, VecWriter};
@@ -49,6 +50,133 @@ pub fn encode_g4(data: &[u8], columns: u32, rows: u32) -> Result<Vec<u8>, Filter
     }
 }
 
+/// The widest row [`decode_ccitt`] decodes: its row buffer stays within 128 KiB.
+pub const MAX_CCITT_COLUMNS: u32 = 1 << 20;
+
+/// A `CCITTFaxDecode` stream's `/DecodeParms` (ISO 32000-2 Table 11). [`Default`] gives the
+/// table's defaults.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct CcittParams {
+    /// `/K`: negative for Group 4, 0 for Group 3 one-dimensional, positive for Group 3 mixed.
+    pub k: i64,
+    pub columns: i64,
+    /// `/Rows`: 0 when not given.
+    pub rows: i64,
+    pub end_of_line: bool,
+    pub encoded_byte_align: bool,
+    pub end_of_block: bool,
+    pub black_is_1: bool,
+}
+
+impl Default for CcittParams {
+    fn default() -> Self {
+        CcittParams { k: 0, columns: 1728, rows: 0, end_of_line: false, encoded_byte_align: false, end_of_block: true, black_is_1: false }
+    }
+}
+
+/// CCITT fax `data` decoded as `CCITTFaxDecode` gives it: rows of `columns` 1-bit samples, most
+/// significant bit first, each starting on a new byte, with black as 0 (as 1 with `black_is_1`).
+///
+/// At most `max_rows` rows are decoded (fewer when `rows` says so), so the output is bounded by
+/// the caller. Damaged data gives the rows decoded before the damage, as viewers show them: a
+/// caller that needs a number of rows checks it got them.
+///
+/// Group 3 rows on bytes (`k` from 0, `encoded_byte_align`) are read by their end-of-line codes,
+/// whether the fill starts each code on a byte or ends it on one, when `data` starts with one (T.4
+/// sends one before the first row when it sends them at all), and on bytes otherwise, whatever
+/// `end_of_line` says. Group 4 is read as its parameters say.
+///
+/// Errors: `columns` that aren't from 1 to [`MAX_CCITT_COLUMNS`] ([`FilterError::Unsupported`]).
+pub fn decode_ccitt(data: &[u8], p: &CcittParams, max_rows: u32) -> Result<Vec<u8>, FilterError> {
+    let columns = u32::try_from(p.columns)
+        .ok()
+        .filter(|c| (1..=MAX_CCITT_COLUMNS).contains(c))
+        .ok_or_else(|| FilterError::Unsupported(format!("CCITT fax rows {} samples wide", p.columns)))?;
+    let rows = u32::try_from(p.rows).ok().filter(|r| *r > 0).map_or(max_rows, |r| r.min(max_rows));
+    if rows == 0 {
+        return Ok(Vec::new());
+    }
+    let settings = hayro_ccitt::DecodeSettings {
+        columns,
+        rows,
+        end_of_block: p.end_of_block,
+        end_of_line: p.end_of_line,
+        // Group 3 rows on bytes may have end-of-line codes whatever `end_of_line` says (the filter
+        // always accepts them), with the fill starting each code on a byte or ending it on one (T.4's
+        // fill, as TIFF writes it). Read unaligned, the codes mark the rows either way; without
+        // codes, the rows are read on bytes. A reading that comes up short isn't tried the other
+        // way: data cut short would then read as other rows.
+        rows_are_byte_aligned: p.encoded_byte_align && (p.k < 0 || !starts_with_end_of_line(data)),
+        encoding: match p.k {
+            ..0 => hayro_ccitt::EncodingMode::Group4,
+            0 => hayro_ccitt::EncodingMode::Group3_1D,
+            k => hayro_ccitt::EncodingMode::Group3_2D { k: u32::try_from(k).unwrap_or(u32::MAX) },
+        },
+        invert_black: false,
+    };
+    // u32 to usize: wasm32 and up have at least 32-bit usize.
+    let mut out = Rows::new(columns as usize, rows as usize, p.black_is_1);
+    // The rows decoded before damaged data are kept.
+    let _ = hayro_ccitt::decode(data, &mut out, &mut hayro_ccitt::DecoderContext::new(settings));
+    Ok(out.out)
+}
+
+/// Whether CCITT fax `data` starts with an end-of-line code: a 1 after 11 zeros or more, fill
+/// included. T.4 sends one before the first row when it sends them at all, and no other code starts
+/// with more than eight zeros.
+fn starts_with_end_of_line(data: &[u8]) -> bool {
+    let Some((i, b)) = data.iter().enumerate().find(|(_, b)| **b != 0) else { return false };
+    i.saturating_mul(8).saturating_add(b.leading_zeros() as usize) >= 11
+}
+
+/// Rows of 1-bit samples filled from a decoder's pixels: `columns` a row, each row on a new byte, at
+/// most `rows` rows. Pixels past a row's end and rows past the last are dropped.
+struct Rows {
+    out: Vec<u8>,
+    row: Vec<u8>,
+    x: usize,
+    columns: usize,
+    rows: usize,
+    done: usize,
+    black_is_1: bool,
+}
+
+impl Rows {
+    fn new(columns: usize, rows: usize, black_is_1: bool) -> Self {
+        Rows { out: Vec::new(), row: vec![0; columns.div_ceil(8)], x: 0, columns, rows, done: 0, black_is_1 }
+    }
+
+    /// `count` pixels, white or black.
+    fn push(&mut self, white: bool, count: usize) {
+        let end = self.x.saturating_add(count);
+        if white != self.black_is_1 {
+            for x in self.x..end.min(self.columns) {
+                if let Some(b) = self.row.get_mut(x / 8) {
+                    *b |= 0x80 >> (x % 8);
+                }
+            }
+        }
+        self.x = end;
+    }
+}
+
+impl hayro_ccitt::Decoder for Rows {
+    fn push_pixel(&mut self, white: bool) {
+        self.push(white, 1);
+    }
+    fn push_pixel_chunk(&mut self, white: bool, chunks: u32) {
+        self.push(white, (chunks as usize).saturating_mul(8));
+    }
+    fn next_line(&mut self) {
+        if self.done < self.rows {
+            self.out.extend_from_slice(&self.row);
+            self.done += 1;
+        }
+        self.row.fill(0);
+        self.x = 0;
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -159,8 +287,40 @@ mod tests {
         data
     }
 
+    fn g4(columns: u32) -> CcittParams {
+        CcittParams { k: -1, columns: i64::from(columns), ..CcittParams::default() }
+    }
+
+    #[test]
+    fn decoding_gives_the_rows_back() {
+        // 3 columns, padded with anything: the decoded padding is 0.
+        let data = [0b1010_1111, 0b0101_0000, 0b1110_1010];
+        let coded = encode_g4(&data, 3, 3).unwrap();
+        assert_eq!(decode_ccitt(&coded, &g4(3), 3).unwrap(), [0b1010_0000, 0b0100_0000, 0b1110_0000]);
+        // /BlackIs1 gives black as 1.
+        let p = CcittParams { black_is_1: true, ..g4(3) };
+        assert_eq!(decode_ccitt(&coded, &p, 3).unwrap(), [0b0100_0000, 0b1010_0000, 0b0000_0000]);
+        // At most /Rows rows, and at most max_rows.
+        assert_eq!(decode_ccitt(&coded, &CcittParams { rows: 2, ..g4(3) }, 3).unwrap().len(), 2);
+        assert_eq!(decode_ccitt(&coded, &g4(3), 1).unwrap().len(), 1);
+        assert_eq!(decode_ccitt(&coded, &CcittParams { rows: 3, ..g4(3) }, 1).unwrap().len(), 1, "max_rows bounds /Rows");
+        assert_eq!(decode_ccitt(&coded, &g4(3), 0).unwrap(), [0u8; 0]);
+        // Damaged data gives the rows before the damage; none here.
+        assert!(decode_ccitt(&coded[..1], &g4(3), 3).unwrap().len() < 3);
+    }
+
+    #[test]
+    fn what_it_cannot_decode_is_an_error() {
+        for columns in [0, -1, i64::from(MAX_CCITT_COLUMNS) + 1, i64::MAX] {
+            let p = CcittParams { columns, ..CcittParams::default() };
+            assert!(matches!(decode_ccitt(&[0; 8], &p, 4), Err(FilterError::Unsupported(_))), "{columns}");
+        }
+        assert_eq!(CcittParams::default().columns, 1728, "Table 11");
+    }
+
     proptest::proptest! {
-        /// Any bitmap, of noise or of runs, decodes to its own bits through an independent decoder.
+        /// Any bitmap, of noise or of runs, decodes to its own bits, through an independent decoder
+        /// and through `decode_ccitt`.
         #[test]
         fn bitmaps_round_trip(
             columns in 1u32..400,
@@ -169,14 +329,20 @@ mod tests {
             noise in proptest::bool::ANY,
         ) {
             let data = bitmap(columns, rows, &runs, noise);
-            let g4 = encode_g4(&data, columns, rows).unwrap();
-            proptest::prop_assert_eq!(decode(&g4, columns, rows), unpack(&data, columns, rows));
+            let coded = encode_g4(&data, columns, rows).unwrap();
+            proptest::prop_assert_eq!(decode(&coded, columns, rows), unpack(&data, columns, rows));
+            let decoded = decode_ccitt(&coded, &g4(columns), rows).unwrap();
+            proptest::prop_assert_eq!(unpack(&decoded, columns, rows), unpack(&data, columns, rows));
         }
 
         /// Whatever it is given, it returns.
         #[test]
-        fn any_input_returns(data in proptest::collection::vec(0u8..=255, 0..600), columns in 0u32..40_000, rows in 0u32..80) {
+        fn any_input_returns(data in proptest::collection::vec(0u8..=255, 0..600), columns in 0u32..40_000, rows in 0u32..80, k in -2i64..3) {
             let _ = encode_g4(&data, columns, rows);
+            let p = CcittParams { k, columns: i64::from(columns), ..CcittParams::default() };
+            if let Ok(out) = decode_ccitt(&data, &p, rows) {
+                proptest::prop_assert!(out.len() <= (columns as usize).div_ceil(8) * rows as usize);
+            }
         }
     }
 }
diff --git a/crates/filters/src/lib.rs b/crates/filters/src/lib.rs
index b9461435eb..63daefc4ea 100644
--- a/crates/filters/src/lib.rs
+++ b/crates/filters/src/lib.rs
@@ -24,7 +24,7 @@ mod runlength;
 
 use std::borrow::Cow;
 
-pub use ccitt::{MAX_G4_COLUMNS, encode_g4};
+pub use ccitt::{CcittParams, MAX_CCITT_COLUMNS, MAX_G4_COLUMNS, decode_ccitt, encode_g4};
 
 /// A PDF stream filter, identified by its `/Filter` name.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
diff --git a/crates/optimize/Cargo.toml b/crates/optimize/Cargo.toml
index 456ab4c991..d1a759d468 100644
--- a/crates/optimize/Cargo.toml
+++ b/crates/optimize/Cargo.toml
@@ -24,3 +24,4 @@ zune-jpeg = "0.5"
 
 [dev-dependencies]
 pdfcraft-render = { workspace = true }
+proptest.workspace = true
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 1f184f0ffb..ba71eb38f5 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -34,18 +34,30 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   alone, since readers differ on which wins. Samples are read with `/DecodeParms` given by
   reference too, the numbers inside included (`Document::with_direct_parms`), here and below:
   without them a predictor's tag bytes would shift every row of an image written back.
-- **Monochrome images** (`Settings::mono`, CCITT Group 4 by default): a 1-bit image with one
-  colour component (grey, indexed, a separation) or an image mask, stored with no filter or with
-  general-purpose ones, is stored again as CCITT Group 4 (`pdfcraft_filters::encode_g4`) when
-  that is smaller as stored. An eight-bit grey image of only 0 and 255 is packed to one bit first
-  (not an indexed image, whose samples are palette indices, nor one with a colour-key `/Mask`),
-  unless the grey settings make it smaller still, its soft mask counted (resampled with it there,
-  kept as it is here), as they can a dithered scan by downsampling it to JPEG. It is lossless: the samples decode to the same bits, so the colour
-  space, decode array and masks stay. Group 4 wins on scans, whose ragged edges defeat Flate;
-  on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet:
-  JBIG2, monochrome downsampling, inline images, soft masks and `/Mask` images, and rows wider
-  than 32,767 samples. Redaction doesn't decode Group 4 yet: a mark over part of an image stored
-  this way removes the whole image (nothing leaks).
+- **Monochrome images** (`Settings::mono`, `MonoSettings::REDUCE` by default: to 300 ppi above
+  450 ppi, CCITT Group 4). Black-and-white images are a 1-bit image with one colour component
+  (grey, indexed, a separation) or an image mask, stored with no filter, with general-purpose ones
+  or with CCITT fax after any of those (decoded by `Document::decoded_image`), and an eight-bit grey image of
+  only 0 and 255, packed to one bit (not an indexed image, whose samples are palette indices, nor
+  one with a colour-key `/Mask`) unless the grey settings make it smaller still, its soft mask counted
+  (resampled with it there, kept as it is here), as they can a dithered scan by downsampling it to
+  JPEG.
+  - **Downsampling:** one whose effective resolution is above `above_ppi` is averaged down to
+    `target_ppi`: each new pixel takes the sample covering more of its area, a 0 (black in grey)
+    on a tie, so a dark line half a new pixel wide stays. Not one with a soft mask, whose own size
+    would have to follow. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
+  - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
+    smaller, which only a resampled image or one packed from eight bits may be: a 1-bit image that
+    is only stored again becomes Group 4 or stays. A CCITT image is only decoded to be resampled,
+    unless another filter such as `ASCII85Decode` wraps it, which storing it again drops. With Retain, a resampled image keeps its kind of
+    compression (CCITT, or Flate) and nothing else changes; eight-bit grey is then left to the grey
+    settings. Every change is kept only when it is smaller as stored.
+  - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
+    space, decode array and `/Mask` stay. Group 4 wins on scans, whose ragged edges defeat Flate;
+    on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, Group 3 to Group 4
+    without resampling, inline images, and Group 4 for rows wider than 32,767 samples. Redaction
+    doesn't decode Group 4 yet: a mark over part of an image stored this way removes the whole
+    image (nothing leaks).
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 8550affb5c..f6fd5e5770 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -5,7 +5,7 @@ use std::collections::{HashMap, HashSet};
 use pdfcraft_content::{Matrix, Pieces};
 use pdfcraft_cos::{DecodeBudget, Dict, Document, ObjRef, Object, Stream};
 
-use crate::{Compression, ImageSettings, MonoCompression, OptimizeError, Report, Settings, Stage};
+use crate::{Compression, ImageSettings, MonoCompression, MonoSettings, OptimizeError, Report, Settings, Stage};
 
 /// Images with more pixels than this are left alone (memory).
 const MAX_PIXELS: u64 = 80_000_000;
@@ -562,102 +562,172 @@ fn one_component(doc: &Document, cs: &Object) -> bool {
     }
 }
 
-/// A black-and-white image (one bit per pixel, or an image mask) stored again as CCITT Group 4,
-/// if `compression` asks for that and the result is smaller as stored. Only images whose samples
-/// PdfCraft decodes (no filter, or general-purpose filters: image codecs don't decode here)
-/// qualify. The samples decode to the same bits, so the colour space, decode array and masks stay
-/// as they are.
-fn mono(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stream> {
-    if compression != MonoCompression::CcittG4 {
-        return None;
-    }
+/// The samples of a black-and-white image, as rows of 1-bit samples each starting on a new byte,
+/// with its width and height, and whether they were packed from eight bits. Two kinds count:
+/// - one bit per pixel in one colour component, or an image mask, stored with no filter, with
+///   general-purpose ones, or with CCITT fax last ([`Document::decoded_image`]);
+/// - with `eight_bit`, eight-bit grey whose every sample is 0 or 255. A decode array maps 0 and 255
+///   at eight bits as it maps 0 and 1 at one bit, so it stays. Left out: indexed images (their
+///   samples are palette indices) and a colour-key `/Mask` (its ranges are in eight-bit values).
+fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32, u32, bool)> {
     let d = &s.dict;
-    let bits = d.int(b"BitsPerComponent");
-    let qualifies = if matches!(d.get(b"ImageMask"), Some(Object::Bool(true))) {
-        bits.is_none_or(|b| b == 1)
-    } else {
-        bits == Some(1) && d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs))
-    };
-    if !qualifies {
-        return None;
-    }
-    let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
-    if w == 0 || h == 0 || w > pdfcraft_filters::MAX_G4_COLUMNS || u64::from(w) * u64::from(h) > MAX_PIXELS {
-        return None;
-    }
-    // Through its parameters given by reference too, as `pixels` reads, and no further than its
-    // rows can need.
-    let bytes = usize::try_from(w).ok()?.div_ceil(8).checked_mul(usize::try_from(h).ok()?)?;
-    let g4 = pdfcraft_filters::encode_g4(&doc.with_direct_parms(s).decoded_within(allowance(bytes, h)?).ok()?, w, h).ok()?;
-    let mut new = d.clone();
-    for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
-        new.remove(k);
-    }
-    let mut parms = Dict::new();
-    parms.set(b"K".to_vec(), Object::Int(-1));
-    parms.set(b"Columns".to_vec(), Object::Int(i64::from(w)));
-    parms.set(b"Rows".to_vec(), Object::Int(i64::from(h)));
-    new.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
-    new.set(b"DecodeParms".to_vec(), Object::Dict(parms));
-    let new = Stream::from_raw(new, g4);
-    // Smaller as stored, counting the larger dictionary: a tiny image can lose by it.
-    (crate::stored_len(&new)? < crate::stored_len(s)?).then_some(new)
-}
-
-/// An eight-bit grey image whose every sample is 0 or 255, stored at one bit per pixel and then as
-/// `compression` asks (see [`mono`]), if that is smaller as stored. Lossless: a decode array maps
-/// 0 and 255 at eight bits as it maps 0 and 1 at one bit, so it stays. Left alone: indexed images
-/// (their samples are palette indices), a colour-key `/Mask` (its ranges are in eight-bit values),
-/// and everything when `compression` is Retain: such an image is then a grey image like any other,
-/// which the grey settings handle as they did before.
-fn bilevel_grey(doc: &Document, s: &Stream, compression: MonoCompression) -> Option<Stream> {
-    if compression == MonoCompression::Retain {
-        return None;
-    }
-    let d = &s.dict;
-    let indexed = |cs: &Object| match &*doc.resolve(cs) {
-        Object::Array(a) => matches!(a.first().and_then(Object::as_name), Some(b"Indexed" | b"I")),
-        _ => false,
-    };
-    let colour_key = d.get(b"Mask").is_some_and(|m| doc.resolve(m).as_array().is_some());
-    if d.int(b"BitsPerComponent") != Some(8)
-        || matches!(d.get(b"ImageMask"), Some(Object::Bool(true)))
-        || colour_key
-        || !d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs) && !indexed(cs))
-    {
-        return None;
-    }
     // Through u32 first, as everywhere here, so the product can't overflow.
     let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
     if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_PIXELS {
         return None;
     }
-    let (w, h) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
+    let (wu, hu) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
+    let stride = wu.div_ceil(8);
+    let bits = d.int(b"BitsPerComponent");
+    let mask = matches!(d.get(b"ImageMask"), Some(Object::Bool(true)));
+    if (mask && bits.is_none_or(|b| b == 1)) || (bits == Some(1) && d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs))) {
+        // A fax image through its decoder; any other no further than its rows can need.
+        let len = stride.checked_mul(hu)?;
+        let mut data = match s.filters().last() {
+            Some((pdfcraft_filters::Filter::CcittFax, _)) => doc.decoded_image(s),
+            _ => doc.with_direct_parms(s).decoded_within(allowance(len, h)?),
+        }
+        .ok()?;
+        if data.len() < len {
+            return None;
+        }
+        data.truncate(len);
+        return Some((data, w, h, false));
+    }
+    let indexed = |cs: &Object| match &*doc.resolve(cs) {
+        Object::Array(a) => matches!(a.first().and_then(Object::as_name), Some(b"Indexed" | b"I")),
+        _ => false,
+    };
+    let colour_key = d.get(b"Mask").is_some_and(|m| doc.resolve(m).as_array().is_some());
+    if !eight_bit || bits != Some(8) || mask || colour_key || !d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs) && !indexed(cs)) {
+        return None;
+    }
     // Through its parameters given by reference too: without a PNG predictor's tag bytes taken
     // off, rows of 0 and 255 would still pass below, each shifted by a byte.
-    let samples = doc.with_direct_parms(s).decoded_within(allowance(w.checked_mul(h)?, u32::try_from(h).ok()?)?).ok()?;
-    let samples = samples.get(..w.checked_mul(h)?)?;
-    let stride = w.div_ceil(8);
-    let mut packed = vec![0u8; stride.checked_mul(h)?];
+    let samples = doc.with_direct_parms(s).decoded_within(allowance(wu.checked_mul(hu)?, h)?).ok()?;
+    let samples = samples.get(..wu.checked_mul(hu)?)?;
+    let mut packed = vec![0u8; stride.checked_mul(hu)?];
     for (i, v) in samples.iter().enumerate() {
         match v {
             0 => {}
             255 => {
-                if let Some(b) = packed.get_mut((i / w) * stride + (i % w) / 8) {
-                    *b |= 0x80 >> (i % w % 8);
+                if let Some(b) = packed.get_mut((i / wu) * stride + (i % wu) / 8) {
+                    *b |= 0x80 >> (i % wu % 8);
                 }
             }
             _ => return None,
         }
     }
-    let mut one_bit = d.clone();
-    for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
-        one_bit.remove(k);
+    Some((packed, w, h, true))
+}
+
+/// `w` × `h` 1-bit rows (each starting on a new byte) averaged down to `nw` × `nh`, no larger:
+/// each new pixel takes the sample that covers more of its area, and a 0 when the two tie. A 0 is
+/// black in grey and the painted part of an image mask, so a dark line half a new pixel wide stays.
+/// `None` when the rows are short or the new size isn't smaller in both directions or empty.
+pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32) -> Option<Vec<u8>> {
+    if nw == 0 || nh == 0 || nw > w || nh > h {
+        return None;
     }
-    one_bit.set(b"BitsPerComponent".to_vec(), Object::Int(1));
-    let one_bit = Stream::flate(one_bit, &packed);
-    let best = mono(doc, &one_bit, compression).unwrap_or(one_bit);
-    (crate::stored_len(&best)? < crate::stored_len(s)?).then_some(best)
+    let (stride, nstride) = (usize::try_from(w).ok()?.div_ceil(8), usize::try_from(nw).ok()?.div_ceil(8));
+    let data = data.get(..stride.checked_mul(usize::try_from(h).ok()?)?)?;
+    let mut out = vec![0u8; nstride.checked_mul(usize::try_from(nh).ok()?)?];
+    // In units of 1/nw of a source column, source column x spans [x·nw, (x+1)·nw) and new column i
+    // spans [i·w, (i+1)·w); rows likewise with h and nh. A new pixel's area is then w·h.
+    let (w, h, nw, nh) = (u64::from(w), u64::from(h), u64::from(nw), u64::from(nh));
+    let overlap = |a0: u64, a1: u64, b0: u64, b1: u64| a1.min(b1).saturating_sub(a0.max(b0));
+    // Per source column, the area its 1 samples cover in the new row.
+    let mut ones = vec![0u64; usize::try_from(w).ok()?];
+    for j in 0..nh {
+        ones.fill(0);
+        let (y0, y1) = (j * h, (j + 1) * h);
+        for y in y0 / nh..y1.div_ceil(nh).min(h) {
+            let weight = overlap(y0, y1, y * nh, (y + 1) * nh);
+            let row = data.get(usize::try_from(y).ok()? * stride..)?;
+            for (x, sum) in ones.iter_mut().enumerate() {
+                if row.get(x / 8).is_some_and(|b| b & (0x80 >> (x % 8)) != 0) {
+                    *sum += weight;
+                }
+            }
+        }
+        let out_row = out.get_mut(usize::try_from(j).ok()? * nstride..)?;
+        for i in 0..nw {
+            let (x0, x1) = (i * w, (i + 1) * w);
+            let covered: u64 = (x0 / nw..x1.div_ceil(nw).min(w))
+                .map(|x| overlap(x0, x1, x * nw, (x + 1) * nw) * usize::try_from(x).ok().and_then(|x| ones.get(x)).copied().unwrap_or(0))
+                .sum();
+            // More than half of w·h, which can't overflow (w·h < 2^64 for u32 sizes).
+            if covered > w * h / 2 {
+                let i = usize::try_from(i).ok()?;
+                *out_row.get_mut(i / 8)? |= 0x80 >> (i % 8);
+            }
+        }
+    }
+    Some(out)
+}
+
+/// A black-and-white image (see [`one_bit`]) resampled and stored again per `settings`, if that is
+/// smaller as stored; `ppi` is its effective resolution. Also says whether it was resampled.
+///
+/// - **Resampled** ([`downsample_bits`]) when its resolution is above `above_ppi`, to `target_ppi`,
+///   unless it has a soft mask, whose own size would then have to follow.
+/// - **Stored** as CCITT Group 4 with `CcittG4`, or as 1-bit Flate when that is smaller, which only
+///   a resampled image or one packed from eight bits may be: a 1-bit image that is only stored again
+///   becomes Group 4 or stays. With `Retain`, a resampled image keeps its kind of compression
+///   (CCITT, or Flate), and nothing else changes: eight-bit grey stays a grey image like any
+///   other, which the grey settings handle.
+///
+/// The samples keep their meaning, so the colour space, decode array and `/Mask` stay as they are.
+fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option<(Stream, bool)> {
+    let d = &s.dict;
+    let downsample = settings.downsample && ppi.is_finite() && ppi > settings.above_ppi && settings.target_ppi > 0.0 && !d.contains(b"SMask");
+    let retain = settings.compression == MonoCompression::Retain;
+    let chain = s.filters();
+    // Its kind of compression, which Retain keeps, behind any other filters.
+    let ccitt = matches!(chain.last(), Some((pdfcraft_filters::Filter::CcittFax, _)));
+    // A fax image is only worth decoding to resample it; behind ASCII85Decode, say, storing it
+    // again as Group 4 also drops that filter.
+    let fax_alone = ccitt && chain.len() == 1;
+    if (retain || fax_alone) && !downsample {
+        return None;
+    }
+    let (data, w, h, eight_bit) = one_bit(doc, s, !retain)?;
+    let k = settings.target_ppi / ppi;
+    // At most `w` × `h`, as k < 1: no overflow.
+    let (nw, nh) =
+        if downsample && k < 1.0 { (((f64::from(w) * k).round() as u32).max(1), ((f64::from(h) * k).round() as u32).max(1)) } else { (w, h) };
+    let resampled = (nw, nh) != (w, h);
+    if (retain || fax_alone) && !resampled {
+        return None;
+    }
+    let data = if resampled { downsample_bits(&data, w, h, nw, nh)? } else { data };
+    let mut dict = d.clone();
+    for key in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
+        dict.remove(key);
+    }
+    dict.set(b"Width".to_vec(), Object::Int(i64::from(nw)));
+    dict.set(b"Height".to_vec(), Object::Int(i64::from(nh)));
+    if eight_bit {
+        dict.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    }
+    let g4 = if settings.compression == MonoCompression::CcittG4 || (retain && ccitt) {
+        pdfcraft_filters::encode_g4(&data, nw, nh).ok().map(|coded| {
+            let mut dict = dict.clone();
+            let mut parms = Dict::new();
+            parms.set(b"K".to_vec(), Object::Int(-1));
+            parms.set(b"Columns".to_vec(), Object::Int(i64::from(nw)));
+            parms.set(b"Rows".to_vec(), Object::Int(i64::from(nh)));
+            dict.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+            dict.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+            Stream::from_raw(dict, coded)
+        })
+    } else {
+        None
+    };
+    let flate = ((resampled || eight_bit) && !(retain && ccitt)).then(|| Stream::flate(dict, &data));
+    // Smaller as stored, counting the dictionary: a tiny image can lose by Group 4's parameters.
+    let best = [g4, flate].into_iter().flatten().filter_map(|c| Some((crate::stored_len(&c)?, c))).min_by_key(|(len, _)| *len)?;
+    (best.0 < crate::stored_len(s)?).then_some((best.1, resampled))
 }
 
 pub(crate) fn run(
@@ -686,19 +756,28 @@ pub(crate) fn run(
         let obj = doc.get(r);
         let Object::Stream(s) = &*obj else { continue };
         report.images += 1;
-        if let Some(new) = mono(doc, s, settings.mono) {
+        // Packed from more bits a sample, it is lossless at one bit, but the grey settings can
+        // make it smaller still (below).
+        let packed_from_more = s.dict.int(b"BitsPerComponent").is_some_and(|b| b > 1);
+        let (packed, mono) = match mono(doc, s, ppi, &settings.mono) {
+            Some(m) if packed_from_more => (Some(m), None),
+            m => (None, m),
+        };
+        if let Some((new, resampled)) = mono {
             report.image_bytes_before += s.raw.len();
             report.image_bytes_after += new.raw.len();
-            report.images_recompressed += 1;
+            if resampled {
+                report.images_resampled += 1;
+            } else {
+                report.images_recompressed += 1;
+            }
             doc.set(r, Object::Stream(new));
             continue;
         }
-        let packed = bilevel_grey(doc, s, settings.mono);
         let n = s.dict.get(b"ColorSpace").and_then(|cs| components(doc, cs));
         let processed = n.and_then(|n| process(doc, s, ppi, if n == 1 { &settings.gray } else { &settings.color }, n));
-        // An image packed from eight bits is lossless at one bit, but the grey settings can make it
-        // smaller still (a dithered scan, downsampled and JPEG-compressed): the smaller wins,
-        // counting a soft mask resampled with it.
+        // A dithered scan, say, downsampled and JPEG-compressed: the smaller wins, counting a soft
+        // mask resampled with it.
         let smask_len = |smask: Option<&(ObjRef, Stream)>| match smask {
             Some((_, m)) => Some(m.raw.len()),
             None => s.dict.reference(b"SMask").map(|m| match &*doc.get(m) {
@@ -707,13 +786,17 @@ pub(crate) fn run(
             }),
         };
         let total = |new: &Stream, smask: Option<&(ObjRef, Stream)>| Some(crate::stored_len(new)?.saturating_add(smask_len(smask).unwrap_or(0)));
-        let packed_wins = packed.as_ref().is_some_and(|p| {
+        let packed_wins = packed.as_ref().is_some_and(|(p, _)| {
             processed.as_ref().is_none_or(|(new, smask)| total(p, None).zip(total(new, smask.as_ref())).is_some_and(|(a, b)| a <= b))
         });
-        if let Some(new) = packed.filter(|_| packed_wins) {
+        if let Some((new, resampled)) = packed.filter(|_| packed_wins) {
             report.image_bytes_before += s.raw.len();
             report.image_bytes_after += new.raw.len();
-            report.images_recompressed += 1;
+            if resampled {
+                report.images_resampled += 1;
+            } else {
+                report.images_recompressed += 1;
+            }
             doc.set(r, Object::Stream(new));
             continue;
         }
@@ -788,3 +871,76 @@ mod tests {
         assert!(data.is_none_or(|d| d.len() <= MAX_PAGE_DECODED + 300));
     }
 }
+
+#[cfg(test)]
+mod downsample_tests {
+    use super::downsample_bits;
+
+    /// [`downsample_bits`] the slow way: each new pixel's area against every source pixel's.
+    fn naive(data: &[u8], w: u32, h: u32, nw: u32, nh: u32) -> Vec<u8> {
+        let (stride, nstride) = ((w as usize).div_ceil(8), (nw as usize).div_ceil(8));
+        let (w, h, nw, nh) = (u64::from(w), u64::from(h), u64::from(nw), u64::from(nh));
+        let mut out = vec![0u8; nstride * nh as usize];
+        for j in 0..nh {
+            for i in 0..nw {
+                let mut ones = 0;
+                for y in 0..h {
+                    for x in 0..w {
+                        let across = ((i + 1) * w).min((x + 1) * nw).saturating_sub((i * w).max(x * nw));
+                        let down = ((j + 1) * h).min((y + 1) * nh).saturating_sub((j * h).max(y * nh));
+                        if data[y as usize * stride + x as usize / 8] & (0x80 >> (x % 8)) != 0 {
+                            ones += across * down;
+                        }
+                    }
+                }
+                if 2 * ones > w * h {
+                    out[j as usize * nstride + i as usize / 8] |= 0x80 >> (i % 8);
+                }
+            }
+        }
+        out
+    }
+
+    #[test]
+    fn each_new_pixel_takes_the_sample_covering_more_of_it() {
+        // 4 × 2 to 2 × 1: three 1s of four on the left, none on the right.
+        assert_eq!(downsample_bits(&[0b1100_0000, 0b1000_0000], 4, 2, 2, 1), Some(vec![0b1000_0000]));
+        // A tie gives 0: black in grey, so a black line half a new pixel wide stays (the second
+        // of four white columns is black); a white one that thin on black doesn't.
+        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1), Some(vec![0b0100_0000]));
+        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1), Some(vec![0]));
+        // The same size gives the same bits; padding bits are 0.
+        assert_eq!(downsample_bits(&[0b1010_1111], 3, 1, 3, 1), Some(vec![0b1010_0000]));
+        // 3 to 2 across: the middle column counts half to each new one.
+        assert_eq!(downsample_bits(&[0b1100_0000], 3, 1, 2, 1), Some(vec![0b1000_0000]));
+    }
+
+    #[test]
+    fn what_it_cannot_resample_is_none() {
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 5, 1), None, "wider");
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 2, 3), None, "taller");
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 0, 1), None);
+        assert_eq!(downsample_bits(&[0; 1], 4, 2, 2, 1), None, "short rows");
+        assert_eq!(downsample_bits(&[], u32::MAX, u32::MAX, 1, 1), None);
+    }
+
+    proptest::proptest! {
+        /// Any bitmap, to any size no larger, gives what the slow way gives; all 1s stay all 1s.
+        #[test]
+        fn it_matches_the_slow_way(
+            w in 1u32..40,
+            h in 1u32..16,
+            nw_part in 0.0f64..1.0,
+            nh_part in 0.0f64..1.0,
+            seed in proptest::collection::vec(0u8..=255, 1..64),
+        ) {
+            let (nw, nh) = (1 + (f64::from(w - 1) * nw_part) as u32, 1 + (f64::from(h - 1) * nh_part) as u32);
+            let len = (w as usize).div_ceil(8) * h as usize;
+            let data: Vec<u8> = seed.iter().cycle().take(len).copied().collect();
+            proptest::prop_assert_eq!(downsample_bits(&data, w, h, nw, nh), Some(naive(&data, w, h, nw, nh)));
+            let white = downsample_bits(&vec![0xFF; len], w, h, nw, nh).unwrap();
+            proptest::prop_assert_eq!(white, naive(&vec![0xFF; len], w, h, nw, nh));
+            proptest::prop_assert!(naive(&vec![0xFF; len], w, h, nw, nh).iter().any(|b| *b != 0));
+        }
+    }
+}
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index f4f7baf988..e911055941 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -10,8 +10,9 @@
 //!   A new image replaces the old one only if it is smaller. Images PdfCraft can't decode
 //!   faithfully (CMYK and other colour spaces, masks, decode arrays other than the default,
 //!   JPEG 2000, JBIG2, CCITT, other than 8 bits, JPEGs whose Adobe marker and `/ColorTransform`
-//!   disagree) are left alone. Black-and-white (1-bit) images are stored again as CCITT Group 4,
-//!   losslessly, when that is smaller.
+//!   disagree) are left alone. Black-and-white images (1-bit, CCITT fax among them, and eight-bit
+//!   grey of only black and white) above a threshold are averaged down to a target resolution, and
+//!   are stored as CCITT Group 4 when that is smaller.
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings.
 //! - **Clean up:** drop images and forms that pages list but never draw (such as a deleted
@@ -128,6 +129,23 @@ pub enum MonoCompression {
     Retain,
 }
 
+/// How black-and-white images (1-bit, CCITT fax among them, and eight-bit grey of only black
+/// and white), and image masks, are resampled and stored.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct MonoSettings {
+    /// Average images whose effective resolution is above `above_ppi` down to `target_ppi`.
+    pub downsample: bool,
+    pub target_ppi: f64,
+    pub above_ppi: f64,
+    pub compression: MonoCompression,
+}
+
+impl MonoSettings {
+    /// Reduce File Size and the presets: to 300 ppi above 450 ppi, CCITT Group 4. Text in a scan
+    /// stays sharp at 300 ppi.
+    pub const REDUCE: MonoSettings = MonoSettings { downsample: true, target_ppi: 300.0, above_ppi: 450.0, compression: MonoCompression::CcittG4 };
+}
+
 /// Acrobat's JPEG quality steps.
 pub const QUALITIES: [(&str, u8); 5] = [("Minimum", 25), ("Low", 45), ("Medium", 60), ("High", 80), ("Maximum", 95)];
 
@@ -157,8 +175,8 @@ pub struct Settings {
     pub merge_fragments: bool,
     pub color: ImageSettings,
     pub gray: ImageSettings,
-    /// Black-and-white (1-bit) images, and image masks.
-    pub mono: MonoCompression,
+    /// Black-and-white images, and image masks.
+    pub mono: MonoSettings,
     pub discard_thumbnails: bool,
     pub discard_alternate_images: bool,
     pub discard_tags: bool,
@@ -193,7 +211,7 @@ impl Default for Settings {
             merge_fragments: true,
             color: ImageSettings::REDUCE,
             gray: ImageSettings::REDUCE,
-            mono: MonoCompression::CcittG4,
+            mono: MonoSettings::REDUCE,
             discard_thumbnails: true,
             discard_alternate_images: true,
             discard_tags: false,
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 9e82858776..e904088d24 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -5,7 +5,8 @@ use std::sync::Arc;
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, SaveOptions, Stream, write_full};
 use pdfcraft_filters::{Filter, Params};
 use pdfcraft_optimize::{
-    Compatibility, Compression, ImageSettings, MonoCompression, OptimizeError, Settings, SpaceCategory, audit_space, effective_resolutions, optimize,
+    Compatibility, Compression, ImageSettings, MonoCompression, MonoSettings, OptimizeError, Settings, SpaceCategory, audit_space,
+    effective_resolutions, optimize,
 };
 
 fn image(doc: &mut Document, w: u32, h: u32, n: usize, jpeg: bool, smask: Option<ObjRef>) -> ObjRef {
@@ -394,7 +395,7 @@ fn black_and_white_images_become_ccitt_group_4() {
     let untouched = [noise, rgb, wide, tiny, named].map(|r| raw(&doc, r));
 
     let mut kept = doc.clone();
-    let r = optimize(&mut kept, &Settings { mono: MonoCompression::Retain, ..Settings::default() }).unwrap();
+    let r = optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
     assert_eq!(r.images_recompressed, 0, "Retain keeps every image as it is");
     assert!([gray, mask, indexed, predicted].iter().all(|i| raw(&kept, *i) == raw(&doc, *i)));
 
@@ -456,7 +457,16 @@ fn group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit() {
     let past_limit = mono_image(&mut doc, 10_000, 8_001, &bilevel(10_000, 8_001, false), None, &grey);
     let all = [icc_1, icc_3, spot, two_spots, mask_1, mask_8, at_limit, past_limit];
     let names: Vec<String> = (0..all.len()).map(|i| format!("Im{i}")).collect();
-    let content: String = (0..all.len()).map(|i| format!("q 200 0 0 80 {} {} cm /Im{i} Do Q ", 6 + 200 * (i % 3), 690 - 100 * (i / 3))).collect();
+    // 200 × 80 pt is 432 ppi, 1800 × 1440 pt 400 ppi: below where monochrome downsampling starts.
+    let content: String = (0..all.len())
+        .map(|i| {
+            if i < 6 {
+                format!("q 200 0 0 80 {} {} cm /Im{i} Do Q ", 6 + 200 * (i % 3), 690 - 100 * (i / 3))
+            } else {
+                format!("q 1800 0 0 1440 0 0 cm /Im{i} Do Q ")
+            }
+        })
+        .collect();
     page(&mut doc, &names.iter().map(String::as_str).zip(all).collect::<Vec<_>>(), &content);
     let converted = [icc_1, spot, mask_1, at_limit];
     let left = [icc_3, two_spots, mask_8, past_limit];
@@ -614,6 +624,9 @@ fn images_whose_data_decodes_far_past_their_samples_are_left_alone() {
     assert_eq!(stream(&doc, packed).dict.int(b"BitsPerComponent"), Some(1), "8-bit black-and-white hex text in lines: packed");
 }
 
+/// Monochrome Images keeping each image's compression (and resampling as by default).
+const RETAIN: MonoSettings = MonoSettings { compression: MonoCompression::Retain, ..MonoSettings::REDUCE };
+
 /// Eight-bit samples (0 or 255) from rows of one-bit ones.
 fn eight_bit(bits: &[u8], w: u32, h: u32) -> Vec<u8> {
     let stride = (w as usize).div_ceil(8);
@@ -667,7 +680,7 @@ fn eight_bit_black_and_white_takes_the_smaller_of_one_bit_and_the_grey_settings(
         let (mut doc, img) = build();
         optimize(&mut doc, &Settings::default()).unwrap();
         let (mut retained, _) = build();
-        optimize(&mut retained, &Settings { mono: MonoCompression::Retain, ..Settings::default() }).unwrap();
+        optimize(&mut retained, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
         let (s, kept) = (stream(&doc, img), stream(&retained, img));
         let bits = if what == "dither" { 8 } else { 1 };
         assert_eq!(s.dict.int(b"BitsPerComponent"), Some(bits), "{what}: {} bytes, {} with Retain", s.raw.len(), kept.raw.len());
@@ -757,7 +770,7 @@ fn eight_bit_black_and_white_images_become_one_bit() {
     let settings = Settings { gray: keep, ..Settings::default() };
 
     let mut kept = doc.clone();
-    let r = optimize(&mut kept, &Settings { mono: MonoCompression::Retain, ..settings.clone() }).unwrap();
+    let r = optimize(&mut kept, &Settings { mono: RETAIN, ..settings.clone() }).unwrap();
     assert_eq!(r.images_recompressed, 0, "Retain keeps every image as it is");
 
     let untouched = [shade, indexed, keyed].map(|r| raw(&doc, r));
@@ -775,6 +788,141 @@ fn eight_bit_black_and_white_images_become_one_bit() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// Black-and-white images above 450 ppi are averaged down to 300 ppi, by default: 1-bit Flate, CCITT
+/// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays) and
+/// eight-bit grey of only black and white, all drawn at 600 ppi, are stored at half the size (as
+/// Group 4, or 1-bit Flate when that is smaller, as it is on this clean text), each new pixel the
+/// majority of the 2 × 2 it covers (a tie black). Left at their size: an image at 400 ppi (stored
+/// again as Group 4), a Group 4 one at 400 ppi (not even decoded), one behind ASCIIHexDecode at
+/// 400 ppi (stored again as Group 4 alone), and one with a soft mask. The page looks the same at
+/// screen size. With `downsample` off nothing is resampled; with Retain, Flate stays Flate, CCITT
+/// stays CCITT, and eight-bit grey is left to the grey settings.
+#[test]
+fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200u32, 480u32);
+    let text = bilevel(w, h, false);
+    let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
+    let g4 = |doc: &mut Document, entries: &[(&str, Object)]| {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("CCITTFaxDecode")]));
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(-1));
+        parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+        d.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Dict(parms)]));
+        for (k, v) in entries {
+            d.set(k.as_bytes().to_vec(), v.clone());
+        }
+        doc.add(Object::Stream(Stream::from_raw(d, pdfcraft_filters::encode_g4(&text, w, h).unwrap())))
+    };
+    // Group 4 behind ASCIIHexDecode, its parameters second in the array.
+    let behind_hex = |doc: &mut Document| {
+        let r = g4(doc, &grey);
+        let s = stream(doc, r);
+        let mut d = s.dict.clone();
+        let parms = d.get(b"DecodeParms").and_then(Object::as_array).and_then(|a| a.first()).cloned().unwrap();
+        d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("ASCIIHexDecode"), Object::name("CCITTFaxDecode")]));
+        d.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Null, parms]));
+        let hex = s.raw.iter().map(|b| format!("{b:02x}")).chain([">".to_string()]).collect::<String>().into_bytes();
+        doc.set(r, Object::Stream(Stream::from_raw(d, hex)));
+        r
+    };
+    let flate = mono_image(&mut doc, w, h, &text, None, &grey);
+    let fax = g4(&mut doc, &grey);
+    let hex_fax = behind_hex(&mut doc);
+    let hex_at_400 = behind_hex(&mut doc);
+    let decode = Object::Array(vec![1.into(), 0.into()]);
+    let mask = mono_image(&mut doc, w, h, &text, None, &[("ImageMask", Object::Bool(true)), ("Decode", decode.clone())]);
+    let mut d = Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w.into()));
+    d.set(b"Height".to_vec(), Object::Int(h.into()));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    let eight = doc.add(Object::Stream(Stream::flate(d, &eight_bit(&text, w, h))));
+    let at_400 = mono_image(&mut doc, w, h, &text, None, &grey);
+    let fax_at_400 = g4(&mut doc, &grey);
+    let mut sm = Dict::new();
+    sm.set(b"Subtype".to_vec(), Object::name("Image"));
+    sm.set(b"Width".to_vec(), Object::Int(2));
+    sm.set(b"Height".to_vec(), Object::Int(1));
+    sm.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    sm.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    let smask = doc.add(Object::Stream(Stream::flate(sm, &[255, 200])));
+    let soft = mono_image(&mut doc, w, h, &text, None, &[grey[0].clone(), grey[1].clone(), ("SMask", Object::Ref(smask))]);
+    // 144 × 57.6 pt is 2 × 0.8 in: 600 ppi. 216 × 86.4 pt is 400 ppi.
+    page(
+        &mut doc,
+        &[("A", flate), ("B", fax), ("C", mask), ("D", eight), ("E", at_400), ("F", fax_at_400), ("G", soft), ("H", hex_fax), ("I", hex_at_400)],
+        "q 144 0 0 57.6 20 700 cm /A Do Q q 144 0 0 57.6 200 700 cm /B Do Q q 0 0 1 rg 144 0 0 57.6 380 700 cm /C Do Q \
+         q 144 0 0 57.6 20 600 cm /D Do Q q 216 0 0 86.4 200 580 cm /E Do Q q 216 0 0 86.4 20 480 cm /F Do Q \
+         q 144 0 0 57.6 260 480 cm /G Do Q q 144 0 0 57.6 430 600 cm /H Do Q q 216 0 0 86.4 20 360 cm /I Do Q",
+    );
+    let before = render(&doc);
+    let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
+    let size = |doc: &Document, r: ObjRef| {
+        let d = stream(doc, r).dict;
+        (d.int(b"Width").unwrap(), d.int(b"Height").unwrap())
+    };
+    // Each new pixel: 1 when more than two of the 2 × 2 it covers are.
+    let stride = (w as usize).div_ceil(8);
+    let bit = |x: usize, y: usize| text[y * stride + x / 8] & (0x80 >> (x % 8)) != 0;
+    let mut halved = vec![0u8; (w as usize / 2).div_ceil(8) * h as usize / 2];
+    for y in 0..h as usize / 2 {
+        for x in 0..w as usize / 2 {
+            let ones = [(0, 0), (1, 0), (0, 1), (1, 1)].iter().filter(|(dx, dy)| bit(2 * x + dx, 2 * y + dy)).count();
+            if ones > 2 {
+                halved[y * (w as usize / 2).div_ceil(8) + x / 8] |= 0x80 >> (x % 8);
+            }
+        }
+    }
+
+    // The grey settings left alone too: an eight-bit image would otherwise take them when smaller.
+    let mut off = doc.clone();
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    let mono = MonoSettings { downsample: false, ..MonoSettings::REDUCE };
+    let r = optimize(&mut off, &Settings { mono, gray: keep, ..Settings::default() }).unwrap();
+    assert_eq!(r.images_resampled, 0, "{r:?}");
+    assert!([flate, fax, mask, eight, hex_fax].iter().all(|i| size(&off, *i) == (1200, 480)));
+
+    let mut kept = doc.clone();
+    let r = optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
+    assert_eq!(r.images_resampled, 5, "{r:?}");
+    assert_eq!(stream(&kept, flate).dict.name(b"Filter"), Some(&b"FlateDecode"[..]), "Retain: Flate stays Flate");
+    for i in [fax, hex_fax] {
+        assert_eq!(stream(&kept, i).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "and CCITT stays CCITT: {i:?}");
+    }
+    assert_eq!(raw(&kept, hex_at_400), raw(&doc, hex_at_400), "and nothing else changes");
+    for i in [flate, fax, hex_fax] {
+        assert_eq!((size(&kept, i), kept.decoded_image(&stream(&kept, i)).unwrap()), ((600, 240), halved.clone()), "{i:?}");
+    }
+    assert_eq!(stream(&kept, eight).dict.int(b"BitsPerComponent"), Some(8), "Retain leaves eight bits to the grey settings");
+
+    let untouched = [fax_at_400].map(|r| raw(&doc, r));
+    let hex_len = raw(&doc, hex_at_400).len();
+    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!((r.images_resampled, r.images_recompressed), (5, 3), "{r:?}");
+    for i in [flate, fax, mask, eight, hex_fax] {
+        let s = stream(&doc, i);
+        assert_eq!((size(&doc, i), s.dict.int(b"BitsPerComponent")), ((600, 240), if i == mask { None } else { Some(1) }));
+        assert!(matches!(s.dict.name(b"Filter"), Some(b"CCITTFaxDecode" | b"FlateDecode")), "{i:?}");
+        assert_eq!(doc.decoded_image(&s).unwrap(), halved, "{i:?}");
+    }
+    assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
+    for i in [at_400, soft, hex_at_400] {
+        assert_eq!((size(&doc, i), stream(&doc, i).dict.name(b"Filter")), ((1200, 480), Some(&b"CCITTFaxDecode"[..])), "{i:?}");
+    }
+    assert!(raw(&doc, hex_at_400).len() < hex_len, "the ASCIIHexDecode is dropped");
+    assert_eq!(doc.decoded_image(&stream(&doc, hex_at_400)).unwrap(), text, "and the picture kept");
+    assert_eq!([fax_at_400].map(|r| raw(&doc, r)), untouched);
+    let after = render(&doc);
+    let differ = before.iter().zip(&after).filter(|(a, b)| a.abs_diff(**b) > 64).count();
+    assert!(differ * 200 < before.len(), "{differ} of {} channel values differ visibly", before.len());
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();
diff --git a/crates/ui-egui/src/workflows/optimize_ui.rs b/crates/ui-egui/src/workflows/optimize_ui.rs
index d3a5cfd4a1..d937592aba 100644
--- a/crates/ui-egui/src/workflows/optimize_ui.rs
+++ b/crates/ui-egui/src/workflows/optimize_ui.rs
@@ -8,7 +8,7 @@
 use std::sync::{Arc, Mutex};
 
 use egui::{Align, Layout, RichText};
-use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, MonoCompression, Preset, QUALITIES, Settings};
+use pdfcraft_engine::optimize::{Compatibility, Compression, ImageSettings, MonoCompression, MonoSettings, Preset, QUALITIES, Settings};
 use pdfcraft_engine::optimizer::{OptimizeStage, Optimized};
 use pdfcraft_engine::{DocId, EditError, Hidden, OptimizeReport};
 
@@ -143,18 +143,25 @@ fn image_row(ui: &mut egui::Ui, id: &str, title: &str, s: &mut ImageSettings) {
     ui.add_space(8.0);
 }
 
-/// Monochrome Images: how 1-bit images and image masks are stored.
-fn mono_row(ui: &mut egui::Ui, m: &mut MonoCompression) {
+/// Monochrome Images: how black-and-white images and image masks are resampled and stored.
+fn mono_row(ui: &mut egui::Ui, m: &mut MonoSettings) {
     ui.label(egui::RichText::new(tl!("Monochrome Images")).font(theme::semibold(13.0)));
+    ui.horizontal(|ui| {
+        ui.add(widgets::checkbox(&mut m.downsample, tl!("Downsample to")));
+        ui.add_enabled(m.downsample, egui::DragValue::new(&mut m.target_ppi).range(9.0..=2400.0).suffix(" ppi"));
+        ui.label(tl!("for images above"));
+        ui.add_enabled(m.downsample, egui::DragValue::new(&mut m.above_ppi).range(9.0..=2400.0).suffix(" ppi"));
+    });
+    m.above_ppi = m.above_ppi.max(m.target_ppi);
     ui.horizontal(|ui| {
         ui.label(tl!("Compression"));
-        let label = match m {
+        let label = match m.compression {
             MonoCompression::CcittG4 => tl!("CCITT Group 4"),
             MonoCompression::Retain => tl!("Retain existing"),
         };
         craft_ui::ComboBox::from_id_salt(("mono", "compression")).selected_text(label).show_ui(ui, |ui| {
-            ui.selectable_value(m, MonoCompression::CcittG4, tl!("CCITT Group 4"));
-            ui.selectable_value(m, MonoCompression::Retain, tl!("Retain existing"));
+            ui.selectable_value(&mut m.compression, MonoCompression::CcittG4, tl!("CCITT Group 4"));
+            ui.selectable_value(&mut m.compression, MonoCompression::Retain, tl!("Retain existing"));
         });
     });
     ui.add_space(8.0);
diff --git a/crates/ui-egui/tests/it/create.rs b/crates/ui-egui/tests/it/create.rs
index 22ac8503e7..1c9a757651 100644
--- a/crates/ui-egui/tests/it/create.rs
+++ b/crates/ui-egui/tests/it/create.rs
@@ -188,7 +188,11 @@ fn the_pdf_optimizer_dialog_saves_an_optimized_copy() {
     h.get_by_label("PDF Optimizer");
     h.get_by_label("Color Images");
     h.get_by_label("Monochrome Images");
-    assert_eq!(h.state().optimize_draft.settings.mono, pdfcraft_engine::optimize::MonoCompression::CcittG4);
+    assert_eq!(h.state().optimize_draft.settings.mono, pdfcraft_engine::optimize::MonoSettings::REDUCE);
+    // Monochrome Images ▸ Downsample to can be turned off.
+    h.get_by_label("Downsample to").click();
+    h.run_steps(2);
+    assert!(!h.state().optimize_draft.settings.mono.downsample);
     h.get_by_label("Discard Objects").click();
     h.run_steps(2);
     h.get_by_label("Discard document tags").click();
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index dba04f6c4c..6ed9eba7c1 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: CCITT Group 4 encoding in the Optimizer; earlier, §14.3: custom properties edited in Document Properties) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: CCITT decoding in `pdfcraft-filters`; earlier, §7.4: CCITT Group 4 encoding in the Optimizer) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -21,7 +21,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 |---|---|---|---|---|
 | §7.2–7.5 | Syntax, objects, file structure, xref tables and streams, object streams, hybrid files, incremental updates | full | **own**, tolerant, repairs damaged files | `crates/cos`; corpus 958 files; fuzzed nightly |
 | §7.4 | Stream filters: Flate, LZW, ASCII85, ASCIIHex, RunLength, predictors | full | **own** | `crates/filters` |
-| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; the Optimizer encodes CCITT Group 4 (`pdfcraft_filters::encode_g4`, `optimize.mono-compression`); no JBIG2 encoding |
+| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; CCITT decoding in `pdfcraft-filters` (`decode_ccitt`, through `hayro-ccitt`) for export and the Optimizer, which encodes Group 4 (`optimize.mono-compression`); no JBIG2 encoding |
 | §7.5.8 | Linearization | R W | R only | `core.linearization` planned |
 | §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; written files open in Acrobat DC since #836 (#774: Acrobat needs the catalog outside object streams) |
 | §7.6.5 | Public-key security handler | full | none | `core.open-public-key`, `protect.certificate-encryption` planned |
@@ -130,6 +130,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | §7.4: CCITT decoding (`hayro-ccitt`) in `pdfcraft-filters`, for export and the Optimizer |
 | 2026-10-26 | minor | §7.4: CCITT Group 4 encoding (`fax`) in the Optimizer |
 | 2026-10-14 | minor | §12.4.4: `/Trans` and `/Dur` read into `DocInfo::transitions` and reported by `doc_info` |
 | 2026-10-11 | minor | §7.6.4: encrypted files we write open in Acrobat (#774, fixed by #836) |
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 3e4c971b2f..6d12e87564 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,7 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
-> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white pictures stay one bit when PDFs are created and optimized; CCITT images export; estimates unchanged)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white images above 450 ppi are averaged down to 300 ppi by the optimizer; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
@@ -257,6 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-24 | minor | M11: monochrome downsampling: the PDF Optimizer and Reduce File Size average black-and-white images (1-bit, CCITT fax, eight-bit black-and-white grey) above 450 ppi down to 300 ppi, by area with ties black, as Monochrome Images ▸ Downsample to and `doc_optimize` `mono: { downsample, ppi, above_ppi }`; CCITT decoding moves into `pdfcraft-filters` (`decode_ccitt`) behind `Document::decoded_image`. Estimates unchanged. |
 | 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller, as they can a dithered scan, soft mask counted; Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 376131a974..9a8597e520 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -130,8 +130,8 @@ milestone = "M1"
 status = "partial"
 commands = []
 tools = []
-evidence = []
-notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2"
+evidence = ["crates/filters/src/ccitt.rs::decoding_gives_the_rows_back", "crates/cos/src/document/tests.rs::fax_images_decode_with_their_parameters"]
+notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images and the optimizer"
 
 [[feature]]
 id = "core.decompression-limits"
@@ -7360,8 +7360,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
-evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome not yet"
+evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie black, then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), Group 3 to Group 4 without resampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 151ca1d6ad4d8f1d7fb569585badef02335ff6b5 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 11:45:33 +0200
Subject: [PATCH 104/132] M11: monochrome downsampling: a tie goes to the dark
 sample, after the decode array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A 2 × 2 tie always gave sample 0, black in grey and the painted part of
an image mask with the default decode array. With an inverting one,
[1 0], 0 is white or unpainted, and in a separation 0 is no ink, so a
line half a new pixel wide could vanish. dark_is_one says which sample
is dark from the colour space and decode array: 0 in grey and of a
mask, 1 in a separation or a DeviceN of one colourant, each the other
way round when the decode array inverts; an indexed image keeps entry
0, as its palette, not the decode array, says which is darker.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/optimize/README.md         |   6 +-
 crates/optimize/src/images.rs     | 118 +++++++++++++++++++++++-------
 crates/optimize/tests/optimize.rs |  26 ++++---
 parity/acrobat-features.toml      |   2 +-
 4 files changed, 112 insertions(+), 40 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index ba71eb38f5..a76fb54c04 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -43,8 +43,10 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   (resampled with it there, kept as it is here), as they can a dithered scan by downsampling it to
   JPEG.
   - **Downsampling:** one whose effective resolution is above `above_ppi` is averaged down to
-    `target_ppi`: each new pixel takes the sample covering more of its area, a 0 (black in grey)
-    on a tie, so a dark line half a new pixel wide stays. Not one with a soft mask, whose own size
+    `target_ppi`: each new pixel takes the sample covering more of its area, and the dark one on a
+    tie, so a dark line half a new pixel wide stays: black in grey and the painted part of an image
+    mask (a 0, or a 1 with an inverting decode array), full ink in a separation (a 1, or a 0), and
+    entry 0 of an indexed image, whose palette says which is darker. Not one with a soft mask, whose own size
     would have to follow. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
   - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
     smaller, which only a resampled image or one packed from eight bits may be: a 1-bit image that
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index f6fd5e5770..dc78b109ac 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -621,11 +621,34 @@ fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32,
     Some((packed, w, h, true))
 }
 
+/// Whether sample 1 is the dark one of the 1-bit image `d` describes, after its decode array
+/// (`[0 1]` when it has none of two numbers): the painted part of an image mask and black in grey
+/// decode to 0, and full ink in a separation (or a DeviceN of one colourant) to 1. An indexed image
+/// says 0, as its palette, not its decode array, says which entry is darker.
+fn dark_is_one(doc: &Document, d: &Dict) -> bool {
+    let number = |v: Option<&Object>| v.and_then(|v| doc.resolve(v).as_f64());
+    let (d0, d1) = match d.get(b"Decode").map(|v| doc.resolve(v)).as_deref() {
+        Some(Object::Array(a)) => number(a.first()).zip(number(a.get(1))).unwrap_or((0.0, 1.0)),
+        _ => (0.0, 1.0),
+    };
+    if matches!(d.get(b"ImageMask"), Some(Object::Bool(true))) {
+        return d1 < d0;
+    }
+    match d.get(b"ColorSpace").map(|cs| doc.resolve(cs)).as_deref() {
+        Some(Object::Array(a)) => match a.first().and_then(Object::as_name) {
+            Some(b"Indexed" | b"I") => false,
+            Some(b"Separation" | b"DeviceN") => d1 > d0,
+            _ => d1 < d0,
+        },
+        _ => d1 < d0,
+    }
+}
+
 /// `w` × `h` 1-bit rows (each starting on a new byte) averaged down to `nw` × `nh`, no larger:
-/// each new pixel takes the sample that covers more of its area, and a 0 when the two tie. A 0 is
-/// black in grey and the painted part of an image mask, so a dark line half a new pixel wide stays.
-/// `None` when the rows are short or the new size isn't smaller in both directions or empty.
-pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32) -> Option<Vec<u8>> {
+/// each new pixel takes the sample that covers more of its area, and the dark one when the two tie
+/// (1 if `dark_is_one`, see [`dark_is_one`]), so a dark line half a new pixel wide stays. `None`
+/// when the rows are short or the new size isn't smaller in both directions or empty.
+pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dark_is_one: bool) -> Option<Vec<u8>> {
     if nw == 0 || nh == 0 || nw > w || nh > h {
         return None;
     }
@@ -656,8 +679,10 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32) ->
             let covered: u64 = (x0 / nw..x1.div_ceil(nw).min(w))
                 .map(|x| overlap(x0, x1, x * nw, (x + 1) * nw) * usize::try_from(x).ok().and_then(|x| ones.get(x)).copied().unwrap_or(0))
                 .sum();
-            // More than half of w·h, which can't overflow (w·h < 2^64 for u32 sizes).
-            if covered > w * h / 2 {
+            // Against what the 0 samples cover: covered is at most w·h, which can't overflow
+            // (w·h < 2^64 for u32 sizes).
+            let zeros = w * h - covered;
+            if covered > zeros || (dark_is_one && covered == zeros) {
                 let i = usize::try_from(i).ok()?;
                 *out_row.get_mut(i / 8)? |= 0x80 >> (i % 8);
             }
@@ -700,7 +725,7 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     if (retain || fax_alone) && !resampled {
         return None;
     }
-    let data = if resampled { downsample_bits(&data, w, h, nw, nh)? } else { data };
+    let data = if resampled { downsample_bits(&data, w, h, nw, nh, dark_is_one(doc, d))? } else { data };
     let mut dict = d.clone();
     for key in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
         dict.remove(key);
@@ -874,10 +899,11 @@ mod tests {
 
 #[cfg(test)]
 mod downsample_tests {
-    use super::downsample_bits;
+    use super::{dark_is_one, downsample_bits};
+    use pdfcraft_cos::{Dict, Document, Object};
 
     /// [`downsample_bits`] the slow way: each new pixel's area against every source pixel's.
-    fn naive(data: &[u8], w: u32, h: u32, nw: u32, nh: u32) -> Vec<u8> {
+    fn naive(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dark_one: bool) -> Vec<u8> {
         let (stride, nstride) = ((w as usize).div_ceil(8), (nw as usize).div_ceil(8));
         let (w, h, nw, nh) = (u64::from(w), u64::from(h), u64::from(nw), u64::from(nh));
         let mut out = vec![0u8; nstride * nh as usize];
@@ -893,7 +919,7 @@ mod downsample_tests {
                         }
                     }
                 }
-                if 2 * ones > w * h {
+                if 2 * ones > w * h || (dark_one && 2 * ones == w * h) {
                     out[j as usize * nstride + i as usize / 8] |= 0x80 >> (i % 8);
                 }
             }
@@ -904,28 +930,65 @@ mod downsample_tests {
     #[test]
     fn each_new_pixel_takes_the_sample_covering_more_of_it() {
         // 4 × 2 to 2 × 1: three 1s of four on the left, none on the right.
-        assert_eq!(downsample_bits(&[0b1100_0000, 0b1000_0000], 4, 2, 2, 1), Some(vec![0b1000_0000]));
-        // A tie gives 0: black in grey, so a black line half a new pixel wide stays (the second
-        // of four white columns is black); a white one that thin on black doesn't.
-        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1), Some(vec![0b0100_0000]));
-        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1), Some(vec![0]));
+        assert_eq!(downsample_bits(&[0b1100_0000, 0b1000_0000], 4, 2, 2, 1, false), Some(vec![0b1000_0000]));
+        // A tie gives the dark sample: 0, black in grey, so a black line half a new pixel wide
+        // stays (the second of four white columns is black); a white one that thin on black doesn't.
+        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1, false), Some(vec![0b0100_0000]));
+        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1, false), Some(vec![0]));
+        // With 1 the dark sample (an inverting decode array, a separation), that line is a 1.
+        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1, true), Some(vec![0b1000_0000]));
+        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1, true), Some(vec![0b1100_0000]));
         // The same size gives the same bits; padding bits are 0.
-        assert_eq!(downsample_bits(&[0b1010_1111], 3, 1, 3, 1), Some(vec![0b1010_0000]));
+        assert_eq!(downsample_bits(&[0b1010_1111], 3, 1, 3, 1, false), Some(vec![0b1010_0000]));
         // 3 to 2 across: the middle column counts half to each new one.
-        assert_eq!(downsample_bits(&[0b1100_0000], 3, 1, 2, 1), Some(vec![0b1000_0000]));
+        assert_eq!(downsample_bits(&[0b1100_0000], 3, 1, 2, 1, false), Some(vec![0b1000_0000]));
+    }
+
+    /// The dark sample: 0 in grey and of an image mask, 1 in a separation, each the other way round
+    /// with an inverting decode array; 0 for an indexed image, whatever its decode array.
+    #[test]
+    fn the_dark_sample_follows_the_colour_space_and_decode_array() {
+        let doc = Document::new_empty();
+        let image = |entries: &[(&str, Object)]| {
+            let mut d = Dict::new();
+            for (k, v) in entries {
+                d.set(k.as_bytes().to_vec(), v.clone());
+            }
+            d
+        };
+        let inverted = ("Decode", Object::Array(vec![1.into(), 0.into()]));
+        let grey = ("ColorSpace", Object::name("DeviceGray"));
+        let mask = ("ImageMask", Object::Bool(true));
+        let separation =
+            ("ColorSpace", Object::Array(vec![Object::name("Separation"), Object::name("Spot"), Object::name("DeviceCMYK"), Object::Null]));
+        let indexed = ("ColorSpace", Object::Array(vec![Object::name("Indexed"), Object::name("DeviceGray"), 1.into(), Object::Null]));
+        for (entries, dark_one) in [
+            (vec![grey.clone()], false),
+            (vec![grey, inverted.clone()], true),
+            (vec![mask.clone()], false),
+            (vec![mask, inverted.clone()], true),
+            (vec![separation.clone()], true),
+            (vec![separation, inverted.clone()], false),
+            (vec![indexed.clone()], false),
+            (vec![indexed, inverted], false),
+            (vec![("ColorSpace", Object::name("DeviceGray")), ("Decode", Object::Array(vec![Object::name("x"), 0.into()]))], false),
+        ] {
+            assert_eq!(dark_is_one(&doc, &image(&entries)), dark_one, "{entries:?}");
+        }
     }
 
     #[test]
     fn what_it_cannot_resample_is_none() {
-        assert_eq!(downsample_bits(&[0; 2], 4, 2, 5, 1), None, "wider");
-        assert_eq!(downsample_bits(&[0; 2], 4, 2, 2, 3), None, "taller");
-        assert_eq!(downsample_bits(&[0; 2], 4, 2, 0, 1), None);
-        assert_eq!(downsample_bits(&[0; 1], 4, 2, 2, 1), None, "short rows");
-        assert_eq!(downsample_bits(&[], u32::MAX, u32::MAX, 1, 1), None);
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 5, 1, false), None, "wider");
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 2, 3, false), None, "taller");
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 0, 1, false), None);
+        assert_eq!(downsample_bits(&[0; 1], 4, 2, 2, 1, false), None, "short rows");
+        assert_eq!(downsample_bits(&[], u32::MAX, u32::MAX, 1, 1, true), None);
     }
 
     proptest::proptest! {
-        /// Any bitmap, to any size no larger, gives what the slow way gives; all 1s stay all 1s.
+        /// Any bitmap, to any size no larger, with either sample the dark one, gives what the slow
+        /// way gives; all 1s stay all 1s.
         #[test]
         fn it_matches_the_slow_way(
             w in 1u32..40,
@@ -933,14 +996,15 @@ mod downsample_tests {
             nw_part in 0.0f64..1.0,
             nh_part in 0.0f64..1.0,
             seed in proptest::collection::vec(0u8..=255, 1..64),
+            dark_one: bool,
         ) {
             let (nw, nh) = (1 + (f64::from(w - 1) * nw_part) as u32, 1 + (f64::from(h - 1) * nh_part) as u32);
             let len = (w as usize).div_ceil(8) * h as usize;
             let data: Vec<u8> = seed.iter().cycle().take(len).copied().collect();
-            proptest::prop_assert_eq!(downsample_bits(&data, w, h, nw, nh), Some(naive(&data, w, h, nw, nh)));
-            let white = downsample_bits(&vec![0xFF; len], w, h, nw, nh).unwrap();
-            proptest::prop_assert_eq!(white, naive(&vec![0xFF; len], w, h, nw, nh));
-            proptest::prop_assert!(naive(&vec![0xFF; len], w, h, nw, nh).iter().any(|b| *b != 0));
+            proptest::prop_assert_eq!(downsample_bits(&data, w, h, nw, nh, dark_one), Some(naive(&data, w, h, nw, nh, dark_one)));
+            let white = downsample_bits(&vec![0xFF; len], w, h, nw, nh, dark_one).unwrap();
+            proptest::prop_assert_eq!(white, naive(&vec![0xFF; len], w, h, nw, nh, dark_one));
+            proptest::prop_assert!(naive(&vec![0xFF; len], w, h, nw, nh, dark_one).iter().any(|b| *b != 0));
         }
     }
 }
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index e904088d24..ea2961513b 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -792,7 +792,7 @@ fn eight_bit_black_and_white_images_become_one_bit() {
 /// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays) and
 /// eight-bit grey of only black and white, all drawn at 600 ppi, are stored at half the size (as
 /// Group 4, or 1-bit Flate when that is smaller, as it is on this clean text), each new pixel the
-/// majority of the 2 × 2 it covers (a tie black). Left at their size: an image at 400 ppi (stored
+/// majority of the 2 × 2 it covers (a tie black, or for the mask painted). Left at their size: an image at 400 ppi (stored
 /// again as Group 4), a Group 4 one at 400 ppi (not even decoded), one behind ASCIIHexDecode at
 /// 400 ppi (stored again as Group 4 alone), and one with a soft mask. The page looks the same at
 /// screen size. With `downsample` off nothing is resampled; with Retain, Flate stays Flate, CCITT
@@ -867,18 +867,24 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
         let d = stream(doc, r).dict;
         (d.int(b"Width").unwrap(), d.int(b"Height").unwrap())
     };
-    // Each new pixel: 1 when more than two of the 2 × 2 it covers are.
+    // Each new pixel: 1 when more than two of the 2 × 2 it covers are, or two when 1 is the dark
+    // sample (the mask's decode array inverts it, so its painted part is 1).
     let stride = (w as usize).div_ceil(8);
     let bit = |x: usize, y: usize| text[y * stride + x / 8] & (0x80 >> (x % 8)) != 0;
-    let mut halved = vec![0u8; (w as usize / 2).div_ceil(8) * h as usize / 2];
-    for y in 0..h as usize / 2 {
-        for x in 0..w as usize / 2 {
-            let ones = [(0, 0), (1, 0), (0, 1), (1, 1)].iter().filter(|(dx, dy)| bit(2 * x + dx, 2 * y + dy)).count();
-            if ones > 2 {
-                halved[y * (w as usize / 2).div_ceil(8) + x / 8] |= 0x80 >> (x % 8);
+    let halve = |dark_one: bool| {
+        let mut out = vec![0u8; (w as usize / 2).div_ceil(8) * h as usize / 2];
+        for y in 0..h as usize / 2 {
+            for x in 0..w as usize / 2 {
+                let ones = [(0, 0), (1, 0), (0, 1), (1, 1)].iter().filter(|(dx, dy)| bit(2 * x + dx, 2 * y + dy)).count();
+                if ones > 2 || (dark_one && ones == 2) {
+                    out[y * (w as usize / 2).div_ceil(8) + x / 8] |= 0x80 >> (x % 8);
+                }
             }
         }
-    }
+        out
+    };
+    let (halved, halved_mask) = (halve(false), halve(true));
+    assert_ne!(halved, halved_mask, "the picture has ties");
 
     // The grey settings left alone too: an eight-bit image would otherwise take them when smaller.
     let mut off = doc.clone();
@@ -909,7 +915,7 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
         let s = stream(&doc, i);
         assert_eq!((size(&doc, i), s.dict.int(b"BitsPerComponent")), ((600, 240), if i == mask { None } else { Some(1) }));
         assert!(matches!(s.dict.name(b"Filter"), Some(b"CCITTFaxDecode" | b"FlateDecode")), "{i:?}");
-        assert_eq!(doc.decoded_image(&s).unwrap(), halved, "{i:?}");
+        assert_eq!(doc.decoded_image(&s).unwrap(), if i == mask { halved_mask.clone() } else { halved.clone() }, "{i:?}");
     }
     assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
     for i in [at_400, soft, hex_at_400] {
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 9a8597e520..41266cb293 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7361,7 +7361,7 @@ status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
 evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie black, then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"

From ba1a741471ca00bcad1e0e064feb4755ec536330 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 10:20:23 +0100
Subject: [PATCH 105/132] M11: a fax image's /DecodeParms entry is its own when
 a /Crypt follows it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

decoded_image paired the fax filter with the last /DecodeParms entry,
but Stream::filters leaves /Crypt out wherever it stands, so with
[/CCITTFaxDecode /Crypt] the fax filter got the Crypt entry and lost
its /K, /Columns and /BlackIs1. Its entry is now that of the last
filter but a /Crypt. /Crypt belongs first (ISO 32000-2 §7.4.10), so
only a malformed file had it (from CodeRabbit's review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/cos/src/document/objects.rs | 5 +++--
 crates/cos/src/document/tests.rs   | 2 ++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index bcbf8bbf41..06d488d7c2 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -236,9 +236,10 @@ impl Document {
         let s = &*self.with_direct_parms(s);
         let chain = s.readable_filters().map_err(|e| CosError::Filter(e.to_string()))?;
         let Some(((pdfcraft_filters::Filter::CcittFax, _), before)) = chain.split_last() else { return s.decoded() };
-        // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1).
+        // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1): the
+        // last filter but a /Crypt, which `filters` leaves out wherever it stands.
         let index = match s.dict.get(b"Filter") {
-            Some(Object::Array(a)) => a.len().saturating_sub(1),
+            Some(Object::Array(a)) => a.iter().rposition(|f| f.as_name() != Some(b"Crypt".as_slice())).unwrap_or(0),
             _ => 0,
         };
         let parms = match s.dict.get(b"DecodeParms").map(|p| self.resolve(p)).as_deref() {
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index 49baeccec8..aeb5184729 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -151,6 +151,8 @@ fn fax_images_decode_with_their_parameters() {
         "behind Flate"
     );
     assert_eq!(behind(&[Object::name("Crypt"), fax.clone()], &[null.clone(), own.clone()], coded.clone()).unwrap(), bits, "after /Crypt");
+    // A /Crypt belongs first (§7.4.10); one after the fax filter leaves it its own entry.
+    assert_eq!(behind(&[fax.clone(), Object::name("Crypt")], &[own.clone(), null.clone()], coded.clone()).unwrap(), bits, "before /Crypt");
     assert!(behind(&ahx, &[own.clone(), null.clone()], hex).is_err(), "the first entry is the other filter's");
     assert!(behind(&[fax.clone(), Object::name("FlateDecode")], &[own.clone(), null.clone()], flated).is_err(), "CCITT, then Flate");
     assert!(behind(&[Object::Int(5), fax], &[null, own], coded.clone()).is_err(), "a /Filter entry that isn't a name");

From 9fca1d44f0f164e9795aed5cd44079dd0113c76b Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 10:20:23 +0100
Subject: [PATCH 106/132] M11: monochrome downsampling: say an indexed image's
 tie goes to entry 0, its palette unread

The README said an indexed image's palette decides which entry is the
dark one on a tie, but dark_is_one never reads the palette: entry 0
wins whatever its colour. The README, the function's comment and the
parity note now say so (from FredApps' review).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/optimize/README.md     | 5 +++--
 crates/optimize/src/images.rs | 3 ++-
 parity/acrobat-features.toml  | 2 +-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index a76fb54c04..ae6c749ef3 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -46,8 +46,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     `target_ppi`: each new pixel takes the sample covering more of its area, and the dark one on a
     tie, so a dark line half a new pixel wide stays: black in grey and the painted part of an image
     mask (a 0, or a 1 with an inverting decode array), full ink in a separation (a 1, or a 0), and
-    entry 0 of an indexed image, whose palette says which is darker. Not one with a soft mask, whose own size
-    would have to follow. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
+    entry 0 of an indexed image, whatever colour its palette gives it (the palette isn't read yet).
+    Not one with a soft mask, whose own size would have to follow. On a 600 ppi text page, Group 4
+    at 300 ppi is half the size.
   - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
     smaller, which only a resampled image or one packed from eight bits may be: a 1-bit image that
     is only stored again becomes Group 4 or stays. A CCITT image is only decoded to be resampled,
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index dc78b109ac..4c20c1b3e7 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -624,7 +624,8 @@ fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32,
 /// Whether sample 1 is the dark one of the 1-bit image `d` describes, after its decode array
 /// (`[0 1]` when it has none of two numbers): the painted part of an image mask and black in grey
 /// decode to 0, and full ink in a separation (or a DeviceN of one colourant) to 1. An indexed image
-/// says 0, as its palette, not its decode array, says which entry is darker.
+/// says 0: its palette, not its decode array, says which entry is darker, and the palette isn't
+/// read yet, so a tie goes to entry 0 whatever its colour.
 fn dark_is_one(doc: &Document, d: &Dict) -> bool {
     let number = |v: Option<&Object>| v.and_then(|v| doc.resolve(v).as_f64());
     let (d0, d1) = match d.get(b"Decode").map(|v| doc.resolve(v)).as_deref() {
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 41266cb293..d2ef8f4f75 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7361,7 +7361,7 @@ status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
 evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"

From 6a99d26c7d641228c2628c8d2457db551532d534 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 13:59:36 +0100
Subject: [PATCH 107/132] M11: redaction reads /DecodeParms given by reference
 before clearing pixels

Stream::decoded_within reads /DecodeParms only when it is direct, so an
image whose PNG predictor was given by reference decoded with its row
tags still in the data. The cleared bytes then drifted one byte further
from the covered pixels each row, and the covered samples survived in
the redacted copy, recoverable by applying the predictor. Parameters
are now made direct first (Document::with_direct_parms).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock                 |  1 +
 crates/redact/Cargo.toml   |  1 +
 crates/redact/src/image.rs |  3 +++
 crates/redact/src/tests.rs | 26 ++++++++++++++++++++++++++
 4 files changed, 31 insertions(+)

diff --git a/Cargo.lock b/Cargo.lock
index f9280eff06..c6ee963a34 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4572,6 +4572,7 @@ dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
  "pdfcraft-edit",
+ "pdfcraft-filters",
  "pdfcraft-fonts",
  "pdfcraft-forms",
  "pdfcraft-model",
diff --git a/crates/redact/Cargo.toml b/crates/redact/Cargo.toml
index 49593855e2..8d1515d8a4 100644
--- a/crates/redact/Cargo.toml
+++ b/crates/redact/Cargo.toml
@@ -20,4 +20,5 @@ pdfcraft-xfa = { workspace = true }
 thiserror = { workspace = true }
 
 [dev-dependencies]
+pdfcraft-filters = { workspace = true }
 pdfcraft-testkit = { workspace = true }
diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index 601700f257..4e26fbd1fc 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -45,6 +45,9 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     if s.dict.contains(b"SMask") || s.dict.contains(b"Mask") {
         return None;
     }
+    // `Stream::decoded*` reads `/DecodeParms` only when it is direct: a predictor given by
+    // reference would be skipped, and the cleared bytes would then miss the covered pixels.
+    let s = &*doc.with_direct_parms(s);
     let supported = |n: &[u8]| {
         matches!(
             n,
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index c072d19db7..6db9cec8c7 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -549,6 +549,32 @@ fn redaction_clears_pixels_intersected_without_covering_their_centres() {
     }
 }
 
+/// An image whose PNG predictor is given by reference has its covered pixel cleared, and only
+/// that one: `Stream::decoded` reads only a direct `/DecodeParms`, so the row tags stayed in the
+/// data, the cleared byte drifted off the covered pixel and the covered sample survived.
+#[test]
+fn an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared() {
+    // Two rows of four grey samples, each behind a PNG "None" row tag.
+    let predicted = pdfcraft_filters::encode_flate(&[0, 10, 20, 30, 40, 0, 50, 60, 70, 80]);
+    let mut doc = one_page(
+        b"q 40 0 0 20 0 0 cm /Im Do Q",
+        "/XObject << /Im 7 0 R >>",
+        vec![
+            stream(
+                "/Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /FlateDecode /DecodeParms 8 0 R",
+                predicted,
+            ),
+            b"<< /Predictor 15 /Colors 1 /BitsPerComponent 8 /Columns 4 >>".to_vec(),
+        ],
+    );
+    // The top row's second sample.
+    mark(&mut doc, 0, &[[12.0, 12.0, 18.0, 18.0]], "");
+    let report = apply(&mut doc, None).unwrap();
+    assert_eq!(report.images_cleared, 1);
+    let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+    assert_eq!(named_image(&saved, 0, b"PCRedacted1"), Some(vec![10, 0, 30, 40, 50, 60, 70, 80]));
+}
+
 /// Apply Redactions gives the page its own pruned /Resources, but the dictionary it drew through
 /// before (inherited from the /Pages node, or shared with another page) still named the removed
 /// image and form, so a full-rewrite save kept them.

From e3b9e175b5c5148cf9cfce63a02358090db76e18 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 14:00:49 +0100
Subject: [PATCH 108/132] M11: redaction clears pixels in CCITT fax images
 instead of removing them whole

Create PDF and the optimizer now store black-and-white scans as Group 4,
and redaction couldn't decode CCITT, so redacting one word on such a
scan removed the whole page image. A CCITT image (the last filter,
after any others) now decodes through Document::decoded_image and is
cleared in a Flate copy like any other image; one that can't be decoded
in full is still removed whole.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/create/README.md      |  4 +---
 crates/optimize/README.md    |  4 +---
 crates/redact/README.md      | 11 ++++++-----
 crates/redact/src/image.rs   | 27 ++++++++++++++++++---------
 crates/redact/src/tests.rs   | 34 ++++++++++++++++++++++++++++++++++
 parity/acrobat-features.toml | 10 +++++-----
 6 files changed, 65 insertions(+), 25 deletions(-)

diff --git a/crates/create/README.md b/crates/create/README.md
index 05131d9038..a9aef83493 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -8,9 +8,7 @@ Layer L4. Create a PDF (Acrobat's Create a PDF tool), execution plan M10.2:
   (`/DCTDecode`, grey, RGB or Adobe-inverted CMYK); PNG is decoded and stored with Flate,
   with transparency as a soft mask. A picture of only pure black and white (a 1-bit PNG or TIFF,
   eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as
-  CCITT Group 4 or Flate, whichever is smaller as stored (`pdfcraft_filters::encode_g4`).
-  Redaction doesn't decode Group 4 yet: a mark over part of such a picture removes the whole
-  picture (nothing leaks). An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
+  CCITT Group 4 or Flate, whichever is smaller as stored (`pdfcraft_filters::encode_g4`). An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
   `iCCP`) that matches the image's colour space is kept as an `/ICCBased` colour space with
   the device space as `/Alternate`; images with the same profile share one profile object.
   JPEG metadata scanning skips marker fill bytes and reads application segments after the
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index ae6c749ef3..d0a412a311 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -58,9 +58,7 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay. Group 4 wins on scans, whose ragged edges defeat Flate;
     on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, Group 3 to Group 4
-    without resampling, inline images, and Group 4 for rows wider than 32,767 samples. Redaction
-    doesn't decode Group 4 yet: a mark over part of an image stored this way removes the whole
-    image (nothing leaks).
+    without resampling, inline images, and Group 4 for rows wider than 32,767 samples.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/crates/redact/README.md b/crates/redact/README.md
index 34c9f4fe1f..2b540927d1 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -18,11 +18,12 @@ clear_marks(&mut doc, None)?;                        // remove marks without app
   more than a fifth of its size (or a point) both ways; zero-size text goes when its origin is
   inside;
 - **images**: fully covered → removed; partly covered → a copy with the covered pixels cleared
-  (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx). Codecs PdfCraft can't
-  re-encode (DCT, JPX, JBIG2, CCITT) are removed whole (fail-closed); inline images under an
-  area are removed. Images with separate `/SMask` or `/Mask` data, and images whose data decodes
-  to more than twice their declared raster (plus a byte per row and 4 KiB), are removed whole;
-  cleared copies drop `/Alternates` so alternate pixels cannot survive;
+  (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx, and CCITT fax as the last
+  filter, decoded through `Document::decoded_image`; `/DecodeParms` given by reference count).
+  Codecs PdfCraft can't decode (DCT, JPX, JBIG2) are removed whole (fail-closed); inline images
+  under an area are removed. Images with separate `/SMask` or `/Mask` data, and images whose
+  data decodes to more than twice their declared raster (plus a byte per row and 4 KiB), are
+  removed whole; cleared copies drop `/Alternates` so alternate pixels cannot survive;
 - **vectors**: covered paths are removed; partly covered paths and shadings are clipped so
   nothing paints inside the areas;
 - **form XObjects**: rewritten recursively into new objects (pages sharing the original keep it);
diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index 4e26fbd1fc..2d22cc8174 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -1,8 +1,9 @@
 //! Clearing the pixels of an image under redaction regions. The image is decoded, every pixel
 //! whose footprint intersects a region is set to zero (no ink for image masks), and the result is
 //! written as a new Flate image; the original object is untouched (other pages may use it).
-//! Images whose codec PdfCraft can't decode (DCT, JPX, JBIG2, CCITT) return `None`, and the
-//! caller removes the whole image instead; that is fail-closed.
+//! CCITT fax images decode through `Document::decoded_image`. Images whose codec PdfCraft can't
+//! decode (DCT, JPX, JBIG2) return `None`, and the caller removes the whole image instead; that
+//! is fail-closed.
 
 use pdfcraft_content::{Matrix, overlaps};
 use pdfcraft_cos::{Document, Object, Stream};
@@ -54,11 +55,18 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
             b"FlateDecode" | b"Fl" | b"LZWDecode" | b"LZW" | b"ASCII85Decode" | b"A85" | b"ASCIIHexDecode" | b"AHx" | b"RunLengthDecode" | b"RL"
         )
     };
-    let ok = match s.dict.get(b"Filter") {
-        None => true,
-        Some(Object::Name(n)) => supported(n),
-        Some(Object::Array(a)) => a.iter().all(|f| f.as_name().is_some_and(supported)),
-        _ => false,
+    // A CCITT fax image (its last filter) decodes through `Document::decoded_image`, after the
+    // filters before it, so a scan stored as Group 4 is cleared like any other image.
+    let fax = |f: &Object| f.as_name().is_some_and(|n| matches!(n, b"CCITTFaxDecode" | b"CCF"));
+    let readable = |f: &Object| f.as_name().is_some_and(supported);
+    let (ok, is_fax) = match s.dict.get(b"Filter") {
+        None => (true, false),
+        Some(f @ Object::Name(_)) => (readable(f) || fax(f), fax(f)),
+        Some(Object::Array(a)) => match a.split_last() {
+            Some((last, before)) if fax(last) => (before.iter().all(readable), true),
+            _ => (a.iter().all(readable), false),
+        },
+        _ => (false, false),
     };
     if !ok {
         return None;
@@ -82,9 +90,10 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     bytes.checked_mul(8)?;
     // Decode no further than the raster can need: a filter stage may legitimately produce up to
     // twice it (ASCIIHex text under Flate) plus a PNG predictor's byte per row. Data past that
-    // can only be a decompression bomb; the image is then removed whole.
+    // can only be a decompression bomb; the image is then removed whole. A fax image decodes to
+    // at most its /Height rows (the filters before it within `MAX_DECODED`).
     let allowance = bytes.checked_add(h)?.checked_mul(2)?.checked_add(4096)?;
-    let mut data = s.decoded_within(allowance).ok()?;
+    let mut data = if is_fax { doc.decoded_image(s).ok()? } else { s.decoded_within(allowance).ok()? };
     if data.len() < bytes {
         return None;
     }
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index 6db9cec8c7..760d0727cf 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -575,6 +575,40 @@ fn an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared(
     assert_eq!(named_image(&saved, 0, b"PCRedacted1"), Some(vec![10, 0, 30, 40, 50, 60, 70, 80]));
 }
 
+/// A CCITT fax image (a scan the optimizer or Create PDF stored as Group 4) has its covered
+/// pixels cleared in a copy, like any image PdfCraft can decode, instead of being removed whole:
+/// whether it sits behind another filter, with its parameters given by reference, or is a mask.
+#[test]
+fn a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed() {
+    // 16 × 2, all 1 bits (white), or all 0 bits (a mask painting everywhere); the left half of
+    // the top row is covered.
+    let g4 = pdfcraft_filters::encode_g4(&[0xFF; 4], 16, 2).unwrap();
+    let painted = pdfcraft_filters::encode_g4(&[0x00; 4], 16, 2).unwrap();
+    let hex: Vec<u8> = g4.iter().map(|b| format!("{b:02x}")).collect::<String>().bytes().chain(*b">").collect();
+    let image = "/Type /XObject /Subtype /Image /Width 16 /Height 2 /BitsPerComponent 1";
+    let parms = "<< /K -1 /Columns 16 /Rows 2 >>";
+    for (dict, data, extra, cleared) in [
+        (format!("{image} /ColorSpace /DeviceGray /Filter /CCITTFaxDecode /DecodeParms {parms}"), g4.clone(), vec![], [0x00, 0xFF, 0xFF, 0xFF]),
+        (
+            format!("{image} /ColorSpace /DeviceGray /Filter [/ASCIIHexDecode /CCITTFaxDecode] /DecodeParms [null 8 0 R]"),
+            hex,
+            vec![parms.as_bytes().to_vec()],
+            [0x00, 0xFF, 0xFF, 0xFF],
+        ),
+        // A mask's 0 bits paint: cleared bits are set to 1, which paints nothing.
+        (format!("{image} /ImageMask true /Filter /CCITTFaxDecode /DecodeParms {parms}"), painted, vec![], [0xFF, 0x00, 0x00, 0x00]),
+    ] {
+        let mut objs = vec![stream(&dict, data)];
+        objs.extend(extra);
+        let mut doc = one_page(b"q 160 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", objs);
+        mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        assert_eq!((report.images_cleared, report.images_removed), (1, 0), "{dict}");
+        let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        assert_eq!(named_image(&saved, 0, b"PCRedacted1").as_deref(), Some(&cleared[..]), "{dict}");
+    }
+}
+
 /// Apply Redactions gives the page its own pruned /Resources, but the dictionary it drew through
 /// before (inherited from the /Pages node, or shared with another page) still named the removed
 /// image and form, so a full-rewrite save kept them.
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index d2ef8f4f75..c9ca864d45 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -131,7 +131,7 @@ status = "partial"
 commands = []
 tools = []
 evidence = ["crates/filters/src/ccitt.rs::decoding_gives_the_rows_back", "crates/cos/src/document/tests.rs::fax_images_decode_with_their_parameters"]
-notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images and the optimizer"
+notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images, the optimizer and redaction"
 
 [[feature]]
 id = "core.decompression-limits"
@@ -5792,8 +5792,8 @@ milestone = "M8"
 status = "shipped"
 commands = ["redact.apply"]
 tools = ["redact_apply"]
-evidence = ["crates/redact/src/tests.rs::images_are_removed_or_have_their_pixels_cleared", "crates/redact/src/tests.rs::redaction_clears_pixels_intersected_without_covering_their_centres"]
-notes = "intersected pixel footprints are cleared conservatively in a copy; DCT/JPX/JBIG2/CCITT images removed whole"
+evidence = ["crates/redact/src/tests.rs::images_are_removed_or_have_their_pixels_cleared", "crates/redact/src/tests.rs::redaction_clears_pixels_intersected_without_covering_their_centres", "crates/redact/src/tests.rs::a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed", "crates/redact/src/tests.rs::an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared"]
+notes = "intersected pixel footprints are cleared conservatively in a copy, CCITT fax images (scans stored as Group 4) included; DCT/JPX/JBIG2 images removed whole"
 
 [[feature]]
 id = "protect.redact-vectors"
@@ -6885,7 +6885,7 @@ status = "shipped"
 commands = ["create.images"]
 tools = ["doc_create"]
 evidence = ["crates/create/src/tests.rs::black_and_white_images_are_stored_at_one_bit", "crates/create/src/tests.rs::jpeg_2000_images_are_embedded_as_is", "crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::embedded_icc_profiles_tag_the_image_colour_space"]
-notes = "PNG, JPEG, TIFF (multi-page), GIF (first frame), BMP, and JPEG 2000 (JP2 or codestream, embedded as JPXDecode with its capture resolution). JPEG and PNG ICC profiles are kept as /ICCBased; TIFF profiles are not read yet. A picture of only pure black and white (a 1-bit PNG or TIFF, eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as CCITT Group 4 or Flate, whichever is smaller. Redaction doesn't decode Group 4 yet: a mark over part of such a picture removes it whole (nothing leaks)"
+notes = "PNG, JPEG, TIFF (multi-page), GIF (first frame), BMP, and JPEG 2000 (JP2 or codestream, embedded as JPXDecode with its capture resolution). JPEG and PNG ICC profiles are kept as /ICCBased; TIFF profiles are not read yet. A picture of only pure black and white (a 1-bit PNG or TIFF, eight-bit grey, a two-colour palette, RGB without a profile) is stored at one bit per pixel, as CCITT Group 4 or Flate, whichever is smaller"
 
 [[feature]]
 id = "create.from-multipage-tiff"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), Group 3 to Group 4 without resampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), Group 3 to Group 4 without resampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 832d74b50497196fe4a3c39b32fc498da95d54ef Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 14:05:11 +0100
Subject: [PATCH 109/132] M11: the batch optimize step's ppi reaches
 black-and-white images

The batch step took Reduce File Size's monochrome settings unchanged, so
`ppi: 600` (or `--ppi 600`) kept colour and grey images at 600 ppi but
halved 600 ppi black-and-white scans to 300. Black-and-white images now
go to the larger of ppi and 300 ppi: a higher ppi keeps their
resolution, and a lower one doesn't take scanned text below 300. The
doc_batch description and docs/cli-batch.md say so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/src/batch.rs           | 10 ++++--
 crates/automation/src/tools.rs           |  2 +-
 crates/automation/tests/it/automation.rs | 46 ++++++++++++++++++------
 docs/cli-batch.md                        |  8 +++--
 4 files changed, 49 insertions(+), 17 deletions(-)

diff --git a/crates/automation/src/batch.rs b/crates/automation/src/batch.rs
index 47cf714ec9..decb18d2b7 100644
--- a/crates/automation/src/batch.rs
+++ b/crates/automation/src/batch.rs
@@ -17,6 +17,7 @@ const MAX_INPUT: u64 = 512 * 1024 * 1024;
 struct Recipe<'a> {
     steps: Vec<&'a str>,
     images: optimize::ImageSettings,
+    mono: optimize::MonoSettings,
     ocr: ocr::OcrSettings,
 }
 
@@ -38,12 +39,17 @@ impl<'a> Recipe<'a> {
             }
         }
         let mut images = optimize::ImageSettings::REDUCE;
+        let mut mono = optimize::MonoSettings::REDUCE;
         if let Some(ppi) = args.opt_num("ppi")? {
             if !(9.0..=1600.0).contains(&ppi) {
                 return Err(Args::wrong("ppi", "9 to 1600"));
             }
             images.target_ppi = ppi;
             images.above_ppi = ppi * 1.5;
+            // Black-and-white images keep Reduce File Size's higher resolution, at which text
+            // stays legible, and are never taken below a higher `ppi` asked for.
+            mono.target_ppi = mono.target_ppi.max(ppi);
+            mono.above_ppi = mono.target_ppi * 1.5;
         }
         if let Some(q) = args.opt_int("quality")? {
             if !(1..=100).contains(&q) {
@@ -54,7 +60,7 @@ impl<'a> Recipe<'a> {
         if args.opt_num("dpi")?.is_some_and(|dpi| !(72.0..=600.0).contains(&dpi)) {
             return Err(Args::wrong("dpi", "72 to 600"));
         }
-        Ok(Self { steps, images, ocr: auto.ocr_settings(args)? })
+        Ok(Self { steps, images, mono, ocr: auto.ocr_settings(args)? })
     }
 
     fn accepts(&self, path: &Path) -> bool {
@@ -88,7 +94,7 @@ impl<'a> Recipe<'a> {
                 }
                 "optimize" => {
                     let id = session.open(name, None, bytes.clone(), None).map_err(failed)?;
-                    let settings = optimize::Settings { color: self.images, gray: self.images, ..Default::default() };
+                    let settings = optimize::Settings { color: self.images, gray: self.images, mono: self.mono, ..Default::default() };
                     let (candidate, _) = session.optimized_bytes(id, &settings, &[])?;
                     session.close(id);
                     if candidate.len() < bytes.len() {
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 79555f1548..8767b4dc46 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -121,7 +121,7 @@ pub fn tools() -> Vec<ToolDef> {
     let save_out = json!({ "type": "string", "description": "File to write. Omit to open the result as a new unsaved document instead." });
     let open = json!({ "type": "boolean", "description": "Also open the result as a new document (default: only when out is omitted)." });
     vec![
-        t("doc_batch", "Process files and folders", "Run convert, ocr and/or optimize over files and folders, one file at a time. recursive defaults to false. Preserve paths relative to each selected folder inside out_dir; duplicate inputs run once. Skip unsupported files, links and the output subtree. Existing outputs receive numbered names and are never replaced. Continue after per-file errors unless stop_on_error is true. Return completed/failed/skipped counts and per-file results. Discovery is bounded to 10000 entries and 64 folder levels. Convert must be first; each step can appear once. OCR uses installed models. Optimize uses Reduce File Size settings, optionally overriding target ppi (threshold 1.5 times ppi) and JPEG quality; a larger candidate keeps the original bytes. Sources and open documents are unchanged.")
+        t("doc_batch", "Process files and folders", "Run convert, ocr and/or optimize over files and folders, one file at a time. recursive defaults to false. Preserve paths relative to each selected folder inside out_dir; duplicate inputs run once. Skip unsupported files, links and the output subtree. Existing outputs receive numbered names and are never replaced. Continue after per-file errors unless stop_on_error is true. Return completed/failed/skipped counts and per-file results. Discovery is bounded to 10000 entries and 64 folder levels. Convert must be first; each step can appear once. OCR uses installed models. Optimize uses Reduce File Size settings, optionally overriding target ppi (threshold 1.5 times ppi; black-and-white images go to the larger of ppi and 300) and JPEG quality; a larger candidate keeps the original bytes. Sources and open documents are unchanged.")
             .with(schema(json!({
                 "paths": {"type":"array","items":{"type":"string"},"minItems":1,"maxItems":1000},
                 "out_dir": {"type":"string"},
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index e68da784d6..d17627a951 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -6525,17 +6525,7 @@ fn doc_optimize_averages_black_and_white_scans_down() {
     std::fs::write(dir.join("scan.pdf"), scan_drawn(b"q 120 0 0 48 50 500 cm /Scan Do Q")).unwrap();
     let mut a = auto(&dir);
     let doc = ok(&mut a, "doc_open", json!({ "path": "scan.pdf" }))["doc"].as_u64().unwrap();
-    let sizes = |name: &str| -> Vec<(Option<i64>, Option<i64>)> {
-        let written = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(dir.join(name)).unwrap())).unwrap();
-        written
-            .object_numbers()
-            .into_iter()
-            .filter_map(|num| match &*written.get(pdfcraft_cos::ObjRef { num, generation: written.generation(num) }) {
-                pdfcraft_cos::Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => Some((s.dict.int(b"Width"), s.dict.int(b"Height"))),
-                _ => None,
-            })
-            .collect()
-    };
+    let sizes = |name: &str| image_sizes(&dir.join(name));
     let r = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "small.pdf" }));
     assert_eq!(r["images_resampled"].as_u64(), Some(1), "{r}");
     assert_eq!(sizes("small.pdf"), [(Some(500), Some(200))]);
@@ -6549,6 +6539,40 @@ fn doc_optimize_averages_black_and_white_scans_down() {
     }
 }
 
+/// The width and height of every image in the PDF at `path`.
+fn image_sizes(path: &std::path::Path) -> Vec<(Option<i64>, Option<i64>)> {
+    let written = pdfcraft_cos::Document::open(std::sync::Arc::new(std::fs::read(path).unwrap())).unwrap();
+    written
+        .object_numbers()
+        .into_iter()
+        .filter_map(|num| match &*written.get(pdfcraft_cos::ObjRef { num, generation: written.generation(num) }) {
+            pdfcraft_cos::Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => Some((s.dict.int(b"Width"), s.dict.int(b"Height"))),
+            _ => None,
+        })
+        .collect()
+}
+
+/// The batch optimize step's `ppi` reaches black-and-white images too: they go to the larger of
+/// it and Reduce File Size's 300 ppi. Before, a batch run took every scan to 300 ppi whatever
+/// `ppi` said, so `ppi: 600` halved 600 ppi scans.
+#[test]
+fn batch_ppi_bounds_how_far_black_and_white_scans_are_resampled() {
+    let dir = workdir("batch-mono-ppi");
+    // 1000 × 400 samples on 120 × 48 pt: 600 ppi.
+    std::fs::write(dir.join("scan.pdf"), scan_drawn(b"q 120 0 0 48 50 500 cm /Scan Do Q")).unwrap();
+    let mut a = auto(&dir);
+    for (ppi, size) in [(None, (500, 200)), (Some(600), (1000, 400)), (Some(96), (500, 200))] {
+        let out = format!("out-{ppi:?}");
+        let mut args = json!({ "paths": ["scan.pdf"], "steps": ["optimize"], "out_dir": out });
+        if let Some(ppi) = ppi {
+            args["ppi"] = json!(ppi);
+        }
+        let report = ok(&mut a, "doc_batch", args);
+        assert_eq!(report["completed"], 1, "{report}");
+        assert_eq!(image_sizes(&dir.join(&out).join("scan.pdf")), [(Some(size.0), Some(size.1))], "ppi {ppi:?}");
+    }
+}
+
 /// A one-page PDF whose page picture is drawn as `rows` grey images one pixel row high, 600 px
 /// wide on a 72 pt square (600 ppi), as some PDF printers write it.
 fn printed_in_strips(rows: usize) -> Vec<u8> {
diff --git a/docs/cli-batch.md b/docs/cli-batch.md
index 0892791194..ad2982bb14 100644
--- a/docs/cli-batch.md
+++ b/docs/cli-batch.md
@@ -27,9 +27,11 @@ new engine importers become available here automatically. Without `convert`,
 only `.pdf` inputs are processed. Unsupported extensions are reported as skipped.
 
 - `optimize` uses Reduce File Size settings: JPEG quality 60, resampling to 150 ppi
-  above 225 ppi (black-and-white images stored as CCITT Group 4 when smaller), plus the
-  existing document cleanup. `--ppi` (9–1600) sets the target
-  and a threshold of 1.5 times that value; `--quality` (1–100) sets JPEG quality.
+  above 225 ppi (black-and-white images to 300 ppi above 450 ppi, stored as CCITT
+  Group 4 when smaller), plus the existing document cleanup. `--ppi` (9–1600) sets the
+  target and a threshold of 1.5 times that value; black-and-white images go to the
+  larger of `--ppi` and 300 ppi, so a lower value keeps scanned text legible and a
+  higher one keeps their resolution. `--quality` (1–100) sets JPEG quality.
   These settings can lose image detail. A candidate that is not smaller retains
   the bytes entering that step. This is not an images-only or lossless preset.
 - `ocr` uses the installed engine and its supported languages. `--dpi` (72–600,

From 1f801bf4c987ebff22f6aa868ec926e1c664e316 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 14:23:23 +0100
Subject: [PATCH 110/132] M11: redaction bounds a fax image's decoding; a test
 for numbers inside /DecodeParms given by reference

- Redacting a CCITT image went through decoded_image, which undoes the
  filters before the fax decoder up to MAX_DECODED, so a Flate bomb in
  front of a fax image cost a gigabyte while every other image stops at
  twice its raster. Document::decoded_image_within takes a bound, and
  redaction gives a fax image's code about a byte per pixel. A fax image
  cut short, or behind a bomb, is removed whole; a busy one whose code
  is bigger than twice its raster is still cleared.
- Every image is now decoded through decoded_image_within, which reads
  /DecodeParms through Document::with_direct_parms: given by reference,
  the numbers inside (/Predictor 7 0 R) included. That reading was first
  written here and has moved down to #4304. The predictor test now covers
  the dictionary, an array's entry and the number itself given by
  reference; read without them, the cleared bytes drift off the covered
  pixel and the covered sample stays in the copy.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/cos/src/document/objects.rs | 14 +++--
 crates/redact/README.md            | 11 ++--
 crates/redact/src/image.rs         | 24 +++++----
 crates/redact/src/tests.rs         | 82 +++++++++++++++++++++++-------
 docs/pdf-spec-parity.md            |  5 +-
 5 files changed, 97 insertions(+), 39 deletions(-)

diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index 06d488d7c2..4c03d04243 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -233,9 +233,17 @@ impl Document {
     /// whatever `/Rows` says, within [`MAX_DECODED`] bytes; damaged data gives fewer, so a caller
     /// checks it has the rows it needs.
     pub fn decoded_image(&self, s: &Stream) -> Result<Vec<u8>, CosError> {
+        self.decoded_image_within(s, MAX_DECODED)
+    }
+
+    /// [`Document::decoded_image`] for an image whose decoding has a tighter bound than
+    /// [`MAX_DECODED`]: no stage, the filters before a fax decoder included, may produce more than
+    /// `max` bytes.
+    pub fn decoded_image_within(&self, s: &Stream, max: usize) -> Result<Vec<u8>, CosError> {
+        let max = max.min(MAX_DECODED);
         let s = &*self.with_direct_parms(s);
         let chain = s.readable_filters().map_err(|e| CosError::Filter(e.to_string()))?;
-        let Some(((pdfcraft_filters::Filter::CcittFax, _), before)) = chain.split_last() else { return s.decoded() };
+        let Some(((pdfcraft_filters::Filter::CcittFax, _), before)) = chain.split_last() else { return s.decoded_within(max) };
         // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1): the
         // last filter but a /Crypt, which `filters` leaves out wherever it stands.
         let index = match s.dict.get(b"Filter") {
@@ -270,11 +278,11 @@ impl Document {
         }
         let height = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
         let stride = usize::try_from(p.columns).unwrap_or(usize::MAX).div_ceil(8).max(1);
-        let rows = u32::try_from(MAX_DECODED / stride).unwrap_or(u32::MAX).min(height);
+        let rows = u32::try_from(max / stride).unwrap_or(u32::MAX).min(height);
         // The filters before it, such as ASCII85Decode, are undone first.
         let data = match before {
             [] => Cow::Borrowed(&s.raw[..]),
-            _ => Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, MAX_DECODED).map_err(|e| CosError::Filter(e.to_string()))?.0),
+            _ => Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, max).map_err(|e| CosError::Filter(e.to_string()))?.0),
         };
         pdfcraft_filters::decode_ccitt(&data, &p, rows).map_err(|e| CosError::Filter(e.to_string()))
     }
diff --git a/crates/redact/README.md b/crates/redact/README.md
index 2b540927d1..75648b3cc4 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -19,11 +19,12 @@ clear_marks(&mut doc, None)?;                        // remove marks without app
   inside;
 - **images**: fully covered → removed; partly covered → a copy with the covered pixels cleared
   (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx, and CCITT fax as the last
-  filter, decoded through `Document::decoded_image`; `/DecodeParms` given by reference count).
-  Codecs PdfCraft can't decode (DCT, JPX, JBIG2) are removed whole (fail-closed); inline images
-  under an area are removed. Images with separate `/SMask` or `/Mask` data, and images whose
-  data decodes to more than twice their declared raster (plus a byte per row and 4 KiB), are
-  removed whole; cleared copies drop `/Alternates` so alternate pixels cannot survive;
+  filter, decoded through `Document::decoded_image_within`; `/DecodeParms` given by reference,
+  numbers inside included, count). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
+  whole (fail-closed); inline images under an area are removed. Images with separate `/SMask`
+  or `/Mask` data, and images whose data decodes to more than twice their declared raster (plus
+  a byte per row and 4 KiB; for a fax image's code, about a byte per pixel), are removed whole;
+  cleared copies drop `/Alternates` so alternate pixels cannot survive;
 - **vectors**: covered paths are removed; partly covered paths and shadings are clipped so
   nothing paints inside the areas;
 - **form XObjects**: rewritten recursively into new objects (pages sharing the original keep it);
diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index 2d22cc8174..6568e8015a 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -1,7 +1,7 @@
 //! Clearing the pixels of an image under redaction regions. The image is decoded, every pixel
 //! whose footprint intersects a region is set to zero (no ink for image masks), and the result is
 //! written as a new Flate image; the original object is untouched (other pages may use it).
-//! CCITT fax images decode through `Document::decoded_image`. Images whose codec PdfCraft can't
+//! CCITT fax images decode through `Document::decoded_image_within`. Images whose codec PdfCraft can't
 //! decode (DCT, JPX, JBIG2) return `None`, and the caller removes the whole image instead; that
 //! is fail-closed.
 
@@ -46,16 +46,13 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     if s.dict.contains(b"SMask") || s.dict.contains(b"Mask") {
         return None;
     }
-    // `Stream::decoded*` reads `/DecodeParms` only when it is direct: a predictor given by
-    // reference would be skipped, and the cleared bytes would then miss the covered pixels.
-    let s = &*doc.with_direct_parms(s);
     let supported = |n: &[u8]| {
         matches!(
             n,
             b"FlateDecode" | b"Fl" | b"LZWDecode" | b"LZW" | b"ASCII85Decode" | b"A85" | b"ASCIIHexDecode" | b"AHx" | b"RunLengthDecode" | b"RL"
         )
     };
-    // A CCITT fax image (its last filter) decodes through `Document::decoded_image`, after the
+    // A CCITT fax image (its last filter) decodes through `Document::decoded_image_within`, after the
     // filters before it, so a scan stored as Group 4 is cleared like any other image.
     let fax = |f: &Object| f.as_name().is_some_and(|n| matches!(n, b"CCITTFaxDecode" | b"CCF"));
     let readable = |f: &Object| f.as_name().is_some_and(supported);
@@ -89,11 +86,18 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     let row_bits = row.checked_mul(8)?;
     bytes.checked_mul(8)?;
     // Decode no further than the raster can need: a filter stage may legitimately produce up to
-    // twice it (ASCIIHex text under Flate) plus a PNG predictor's byte per row. Data past that
-    // can only be a decompression bomb; the image is then removed whole. A fax image decodes to
-    // at most its /Height rows (the filters before it within `MAX_DECODED`).
-    let allowance = bytes.checked_add(h)?.checked_mul(2)?.checked_add(4096)?;
-    let mut data = if is_fax { doc.decoded_image(s).ok()? } else { s.decoded_within(allowance).ok()? };
+    // twice it (ASCIIHex text under Flate) plus a PNG predictor's byte per row. A fax image's
+    // code, which the filters before its decoder produce, takes at most about a byte per pixel
+    // plus each row's end. Data past that can only be a decompression bomb; the image is then
+    // removed whole.
+    let allowance = if is_fax {
+        w.checked_mul(h)?.checked_add(h.checked_mul(4)?)?.checked_add(4096)?
+    } else {
+        bytes.checked_add(h)?.checked_mul(2)?.checked_add(4096)?
+    };
+    // Through the document, which reads `/DecodeParms` given by reference (`Stream::decoded*`
+    // alone would skip such a predictor, and the cleared bytes would then miss the covered pixels).
+    let mut data = doc.decoded_image_within(s, allowance).ok()?;
     if data.len() < bytes {
         return None;
     }
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index 760d0727cf..9400391bb5 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -550,29 +550,31 @@ fn redaction_clears_pixels_intersected_without_covering_their_centres() {
 }
 
 /// An image whose PNG predictor is given by reference has its covered pixel cleared, and only
-/// that one: `Stream::decoded` reads only a direct `/DecodeParms`, so the row tags stayed in the
-/// data, the cleared byte drifted off the covered pixel and the covered sample survived.
+/// that one, whichever part is the reference: the dictionary, an array's entry, or the number
+/// itself. `Stream::decoded` reads only a direct `/DecodeParms` with direct numbers, so the row
+/// tags stayed in the data, the cleared byte drifted off the covered pixel and the covered sample
+/// survived.
 #[test]
 fn an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared() {
     // Two rows of four grey samples, each behind a PNG "None" row tag.
     let predicted = pdfcraft_filters::encode_flate(&[0, 10, 20, 30, 40, 0, 50, 60, 70, 80]);
-    let mut doc = one_page(
-        b"q 40 0 0 20 0 0 cm /Im Do Q",
-        "/XObject << /Im 7 0 R >>",
-        vec![
-            stream(
-                "/Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /FlateDecode /DecodeParms 8 0 R",
-                predicted,
-            ),
-            b"<< /Predictor 15 /Colors 1 /BitsPerComponent 8 /Columns 4 >>".to_vec(),
-        ],
-    );
-    // The top row's second sample.
-    mark(&mut doc, 0, &[[12.0, 12.0, 18.0, 18.0]], "");
-    let report = apply(&mut doc, None).unwrap();
-    assert_eq!(report.images_cleared, 1);
-    let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
-    assert_eq!(named_image(&saved, 0, b"PCRedacted1"), Some(vec![10, 0, 30, 40, 50, 60, 70, 80]));
+    let parms = "/Predictor 15 /Colors 1 /BitsPerComponent 8 /Columns 4";
+    for (decode_parms, object8) in [
+        ("8 0 R".to_owned(), format!("<< {parms} >>")),
+        ("[8 0 R]".to_owned(), format!("<< {parms} >>")),
+        ("<< /Predictor 8 0 R /Colors 1 /BitsPerComponent 8 /Columns 4 >>".to_owned(), "15".to_owned()),
+    ] {
+        let image = format!(
+            "/Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /FlateDecode /DecodeParms {decode_parms}"
+        );
+        let mut doc = one_page(b"q 40 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(&image, &predicted), object8.into_bytes()]);
+        // The top row's second sample.
+        mark(&mut doc, 0, &[[12.0, 12.0, 18.0, 18.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        assert_eq!(report.images_cleared, 1, "{decode_parms}");
+        let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+        assert_eq!(named_image(&saved, 0, b"PCRedacted1"), Some(vec![10, 0, 30, 40, 50, 60, 70, 80]), "{decode_parms}");
+    }
 }
 
 /// A CCITT fax image (a scan the optimizer or Create PDF stored as Group 4) has its covered
@@ -609,6 +611,48 @@ fn a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed() {
     }
 }
 
+/// A fax image that can't be decoded in full is removed whole, as any other image is: one whose
+/// code is cut short, and one behind a filter that inflates past what a code for its pixels can
+/// take (a decompression bomb, which `decoded_image` alone would undo up to a gigabyte).
+#[test]
+fn a_fax_image_that_cannot_be_decoded_in_full_is_removed_whole() {
+    let g4 = pdfcraft_filters::encode_g4(&[0xFF; 4], 16, 2).unwrap();
+    // A busy picture's code, cut off in its first row.
+    let busy = pdfcraft_filters::encode_g4(&[0xAA, 0xAA, 0x55, 0x55], 16, 2).unwrap();
+    let short = busy.get(..1).unwrap().to_vec();
+    // The real code, then four megabytes of padding the fax decoder would never read.
+    let mut padded = g4.clone();
+    padded.resize(4 << 20, 0);
+    let bomb = pdfcraft_filters::encode_flate(&padded);
+    let image = "/Type /XObject /Subtype /Image /Width 16 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 1";
+    let parms = "<< /K -1 /Columns 16 /Rows 2 >>";
+    for (filters, data) in [("/CCITTFaxDecode /DecodeParms", short), ("[/FlateDecode /CCITTFaxDecode] /DecodeParms [null", bomb)] {
+        let close = if filters.ends_with("[null") { "]" } else { "" };
+        let dict = format!("{image} /Filter {filters} {parms}{close}");
+        let mut doc = one_page(b"q 160 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(&dict, data)]);
+        mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        assert_eq!((report.images_cleared, report.images_removed), (0, 1), "{dict}");
+    }
+}
+
+/// A busy fax image is cleared, though its code is bigger than twice its raster (the bound for
+/// other images): a code takes up to about a byte per pixel, and the fax image gets that much.
+#[test]
+fn a_busy_fax_image_behind_another_filter_is_cleared() {
+    // A 256 × 256 checkerboard, the worst case for a fax code.
+    let rows: Vec<u8> = (0..256).flat_map(|y| [if y % 2 == 0 { 0xAA } else { 0x55 }; 32]).collect();
+    let g4 = pdfcraft_filters::encode_g4(&rows, 256, 256).unwrap();
+    let raster = 32 * 256;
+    assert!(g4.len() > (raster + 256) * 2 + 4096, "{} bytes: within the bound for other images", g4.len());
+    let dict = "/Type /XObject /Subtype /Image /Width 256 /Height 256 /ColorSpace /DeviceGray /BitsPerComponent 1 \
+                /Filter [/FlateDecode /CCITTFaxDecode] /DecodeParms [null << /K -1 /Columns 256 /Rows 256 >>]";
+    let mut doc = one_page(b"q 256 0 0 256 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(dict, pdfcraft_filters::encode_flate(&g4))]);
+    mark(&mut doc, 0, &[[0.0, 0.0, 10.0, 10.0]], "");
+    let report = apply(&mut doc, None).unwrap();
+    assert_eq!((report.images_cleared, report.images_removed), (1, 0));
+}
+
 /// Apply Redactions gives the page its own pruned /Resources, but the dictionary it drew through
 /// before (inherited from the /Pages node, or shared with another page) still named the removed
 /// image and form, so a full-rewrite save kept them.
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index 6ed9eba7c1..b68c5b641d 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: CCITT decoding in `pdfcraft-filters`; earlier, §7.4: CCITT Group 4 encoding in the Optimizer) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: redaction decodes CCITT fax images; earlier, §7.4: CCITT decoding in `pdfcraft-filters`) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -21,7 +21,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 |---|---|---|---|---|
 | §7.2–7.5 | Syntax, objects, file structure, xref tables and streams, object streams, hybrid files, incremental updates | full | **own**, tolerant, repairs damaged files | `crates/cos`; corpus 958 files; fuzzed nightly |
 | §7.4 | Stream filters: Flate, LZW, ASCII85, ASCIIHex, RunLength, predictors | full | **own** | `crates/filters` |
-| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; CCITT decoding in `pdfcraft-filters` (`decode_ccitt`, through `hayro-ccitt`) for export and the Optimizer, which encodes Group 4 (`optimize.mono-compression`); no JBIG2 encoding |
+| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode); CCITT Group 4 encoding | `core.image-filters` partial; own codecs M1.1/M1.2; CCITT decoding in `pdfcraft-filters` (`decode_ccitt`, through `hayro-ccitt`) for export, redaction and the Optimizer, which encodes Group 4 (`optimize.mono-compression`); no JBIG2 encoding |
 | §7.5.8 | Linearization | R W | R only | `core.linearization` planned |
 | §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; written files open in Acrobat DC since #836 (#774: Acrobat needs the catalog outside object streams) |
 | §7.6.5 | Public-key security handler | full | none | `core.open-public-key`, `protect.certificate-encryption` planned |
@@ -130,6 +130,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | §7.4: redaction clears pixels in CCITT fax images through the CCITT decoder, instead of removing them whole |
 | 2026-10-26 | minor | §7.4: CCITT decoding (`hayro-ccitt`) in `pdfcraft-filters`, for export and the Optimizer |
 | 2026-10-26 | minor | §7.4: CCITT Group 4 encoding (`fax`) in the Optimizer |
 | 2026-10-14 | minor | §12.4.4: `/Trans` and `/Dur` read into `DocInfo::transitions` and reported by `doc_info` |

From 8bd156a4ac0d953ab21283949f3835f513ff312c Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sun, 25 Oct 2026 14:23:23 +0100
Subject: [PATCH 111/132] M11: Reduce File Size's descriptions say
 black-and-white images go to 300 ppi

doc_reduce, the engine's reduced_bytes doc, the optimize README's
presets and the optimize.reduce parity note still said every image
above 225 ppi goes to 150 ppi; black-and-white images go to 300 ppi
above 450 ppi, as CCITT Group 4 when smaller.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/automation/src/tools.rs     | 2 +-
 crates/engine/src/session/files.rs | 9 +++++----
 crates/optimize/README.md          | 4 +++-
 parity/acrobat-features.toml       | 2 +-
 4 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 8767b4dc46..cdf62ebd8e 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1332,7 +1332,7 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["from"],
         )),
-        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images stored as CCITT Group 4 whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
+        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images averaged down to 300 ppi above 450 ppi and each stored as CCITT Group 4 (or 1-bit Flate, once resampled) whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
             .cmd("optimize.reduce")
             .with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
         t("doc_initial_view", "Initial view", "Read or change how the document opens (Document Properties ▸ Initial View) and its reading options: navigation (page, bookmarks, pages, attachments, layers), layout (default, single, continuous, two_up, two_up_continuous, two_up_cover, two_up_continuous_cover), magnification (default, actual, fit_page, fit_width, fit_height, fit_visible, or a percentage), page, window options (fit_window, center_window, full_screen, display_title), interface options (hide_menubar, hide_toolbar, hide_window_ui), language and binding (left, right). Only the given ones change; returns the result. Undoable.").with(schema(
diff --git a/crates/engine/src/session/files.rs b/crates/engine/src/session/files.rs
index 5453163aca..34d75e5c82 100644
--- a/crates/engine/src/session/files.rs
+++ b/crates/engine/src/session/files.rs
@@ -69,10 +69,11 @@ impl Session {
     }
 
     /// Reduce File Size: Acrobat's defaults (colour and grey images above 225 ppi to 150 ppi,
-    /// JPEG medium quality; black-and-white stored as CCITT Group 4 whenever smaller; thumbnails
-    /// dropped), identical resources merged, unused objects dropped, objects packed into
-    /// compressed object streams. Returns the bytes and how many objects were merged. The open
-    /// document is not changed (Acrobat saves the reduced copy as a new file).
+    /// JPEG medium quality; black-and-white averaged down to 300 ppi above 450 ppi, and stored as
+    /// CCITT Group 4 whenever smaller; thumbnails dropped), identical resources merged, unused
+    /// objects dropped, objects packed into compressed object streams. Returns the bytes and how
+    /// many objects were merged. The open document is not changed (Acrobat saves the reduced copy
+    /// as a new file).
     pub fn reduced_bytes(&self, id: DocId) -> Result<(Arc<Vec<u8>>, usize), EditError> {
         let (bytes, report) = self.optimized_bytes(id, &optimize::Settings::default(), &[])?;
         Ok((bytes, report.merged))
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index d0a412a311..3ff33728db 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -11,7 +11,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
 ```
 
 - **Presets:** Standard (Reduce File Size's choices: images above 225 ppi to 150 ppi, JPEG
-  medium) and Mobile (above 144 ppi to 96 ppi, JPEG high), as in Acrobat's Settings menu.
+  medium) and Mobile (above 144 ppi to 96 ppi, JPEG high), as in Acrobat's Settings menu. In
+  both, black-and-white images are averaged down to 300 ppi above 450 ppi, and stored as CCITT
+  Group 4 whenever that is smaller.
 - **Merge image fragments** (`fragments`, on by default): some PDF printers draw a page picture
   as thousands of images one pixel row high. Runs of upright 8-bit grey or RGB images in one
   colour space, sharing their left and right edges and stacked edge to edge (at least four,
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index c9ca864d45..6e67d4aa9a 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7325,7 +7325,7 @@ status = "shipped"
 commands = ["optimize.reduce"]
 tools = ["doc_reduce"]
 evidence = ["crates/ui-egui/tests/it/create.rs::reduce_file_size_writes_a_compact_copy", "crates/ui-egui/tests/it/create.rs::reduce_file_size_saves_nothing_when_the_file_is_already_small", "crates/engine/src/tests.rs::create_and_reduce", "crates/automation/tests/it/automation.rs::creating_and_reducing_through_tools", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::an_identity_decode_array_does_not_stop_reduce"]
-notes = "images above 225 ppi to 150 ppi JPEG medium (after merging page pictures printed as one-pixel strips into one image), black-and-white images to CCITT Group 4 when that is smaller, thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
+notes = "images above 225 ppi to 150 ppi JPEG medium (after merging page pictures printed as one-pixel strips into one image), black-and-white images averaged down to 300 ppi above 450 ppi, and stored as CCITT Group 4 whenever that is smaller, thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
 
 [[feature]]
 id = "optimize.compatibility-level"

From e221d552f9d1e7de65a9c30a15e980b101e0ada8 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 09:54:53 +0200
Subject: [PATCH 112/132] M11: the optimizer stores Group 3 fax images as Group
 4 when smaller

A CCITT fax image that wasn't resampled was left as it was, so Group 3
images (the 1-D and 2-D codings fax software writes) stayed Group 3.
Group 4 codes each row against the one above and is usually much
smaller. Now only Group 4 alone skips decoding; Group 3 is stored again
as Group 4 when that is smaller as stored, and Retain still keeps it.

It reads an image's CCITT parameters (its /DecodeParms entry with Table
11's defaults) through pdfcraft_cos::Document::fax_params, from #4384.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 crates/optimize/README.md         |  9 ++--
 crates/optimize/src/images.rs     | 17 ++++----
 crates/optimize/tests/optimize.rs | 72 +++++++++++++++++++++++++++++++
 parity/acrobat-features.toml      |  4 +-
 4 files changed, 88 insertions(+), 14 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 2c90981770..13aa82aadb 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -61,10 +61,11 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     column. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
   - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
     smaller, which only a resampled image or one packed from eight bits may be: a 1-bit image that
-    is only stored again becomes Group 4 or stays. A CCITT image is only decoded to be resampled,
-    unless another filter such as `ASCII85Decode` wraps it, which storing it again drops. With Retain, a resampled image keeps its kind of
-    compression (CCITT, or Flate) and nothing else changes; eight-bit grey is then left to the grey
-    settings. Every change is kept only when it is smaller as stored.
+    is only stored again becomes Group 4 or stays. Group 4 alone is only decoded to be resampled;
+    Group 3, or Group 4 inside another filter such as `ASCII85Decode`, is stored again as Group 4
+    alone when that is smaller. With Retain, a resampled image keeps its kind of compression (CCITT,
+    or Flate) and nothing else changes; eight-bit grey is then left to the grey settings. Every
+    change is kept only when it is smaller as stored.
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay. Group 4 wins on scans, whose ragged edges defeat Flate;
     on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, a lone Group 3 image to
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index bb768551d5..42c9a742c8 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -705,7 +705,8 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
 ///   covers more would turn its tones solid (a 50% screen black, a 25% one white).
 /// - **Stored** as CCITT Group 4 with `CcittG4`, or as 1-bit Flate when that is smaller, which only
 ///   a resampled image or one packed from eight bits may be: a 1-bit image that is only stored again
-///   becomes Group 4 or stays. With `Retain`, a resampled image keeps its kind of compression
+///   becomes Group 4 or stays. Group 4 alone is only decoded to be resampled; Group 3 is stored
+///   again like any other. With `Retain`, a resampled image keeps its kind of compression
 ///   (CCITT, or Flate), and nothing else changes: eight-bit grey stays a grey image like any
 ///   other, which the grey settings handle.
 ///
@@ -714,13 +715,13 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     let d = &s.dict;
     let downsample = settings.downsample && ppi.is_finite() && ppi > settings.above_ppi && settings.target_ppi > 0.0 && !d.contains(b"SMask");
     let retain = settings.compression == MonoCompression::Retain;
-    let chain = s.filters();
+    let fax = doc.fax_params(s);
     // Its kind of compression, which Retain keeps, behind any other filters.
-    let ccitt = matches!(chain.last(), Some((pdfcraft_filters::Filter::CcittFax, _)));
-    // A fax image is only worth decoding to resample it; behind ASCII85Decode, say, storing it
-    // again as Group 4 also drops that filter.
-    let fax_alone = ccitt && chain.len() == 1;
-    if (retain || fax_alone) && !downsample {
+    let ccitt = fax.is_some();
+    // Group 4 alone is only worth decoding to resample it. Group 3, or Group 4 behind
+    // ASCII85Decode, say, can be smaller stored again as Group 4 alone.
+    let g4_alone = fax.is_some_and(|p| p.k < 0) && s.filters().len() == 1;
+    if (retain || g4_alone) && !downsample {
         return None;
     }
     let (data, w, h, eight_bit) = one_bit(doc, s, !retain)?;
@@ -747,7 +748,7 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
         Some(out) => (out, nw, nh),
         None => (data, w, h),
     };
-    if (retain || fax_alone) && !resampled {
+    if (retain || g4_alone) && !resampled {
         return None;
     }
     let mut dict = d.clone();
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index f9676144c4..f1e5015761 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1116,6 +1116,78 @@ fn monochrome_images_keep_what_they_should() {
     assert_eq!((s.dict.int(b"Width"), s.dict.name(b"Filter")), (Some(600), Some(&b"FlateDecode"[..])), "Retain: Flate stays Flate: {r:?}");
 }
 
+/// `rows` coded as CCITT Group 3, one-dimensional (`/K 0`): each row its runs in turn, white first,
+/// with ITU-T T.4's terminating codes for the few lengths used here.
+fn group_3(rows: &[&[u32]]) -> Vec<u8> {
+    let code = |white: bool, run: u32| match (white, run) {
+        (true, 0) => "00110101",
+        (true, 8) => "10011",
+        (true, 16) => "101010",
+        (true, 32) => "00011011",
+        (false, 8) => "000101",
+        (false, 16) => "0000010111",
+        (false, 32) => "000001101010",
+        _ => panic!("no code here for a run of {run}"),
+    };
+    let bits: String = rows.iter().flat_map(|row| row.iter().enumerate().map(|(i, run)| code(i % 2 == 0, *run))).collect();
+    bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
+}
+
+/// A Group 3 fax image is stored again as Group 4 when that is smaller, the same picture (to the
+/// pixel on the page); with Retain it stays Group 3.
+#[test]
+fn group_3_fax_images_become_group_4() {
+    let (w, h) = (64u32, 64u32);
+    let runs: Vec<&[u32]> = [&[32, 32][..], &[16; 4], &[8; 8], &[0, 16, 16, 32]].into_iter().flat_map(|r| std::iter::repeat_n(r, 16)).collect();
+    // White is 1, as CCITTFaxDecode gives it without /BlackIs1.
+    let mut bits = Vec::new();
+    for row in &runs {
+        let mut packed = [0u8; 8];
+        let mut x = 0;
+        for (i, run) in row.iter().enumerate() {
+            for p in x..x + *run as usize {
+                if i % 2 == 0 {
+                    packed[p / 8] |= 0x80 >> (p % 8);
+                }
+            }
+            x += *run as usize;
+        }
+        bits.extend(packed);
+    }
+    let g3 = group_3(&runs);
+    let p = pdfcraft_filters::CcittParams { k: 0, columns: w.into(), ..Default::default() };
+    assert_eq!(pdfcraft_filters::decode_ccitt(&g3, &p, h).unwrap(), bits, "the Group 3 data is the picture");
+
+    let mut doc = Document::new_empty();
+    let mut d = Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w.into()));
+    d.set(b"Height".to_vec(), Object::Int(h.into()));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+    let mut parms = Dict::new();
+    parms.set(b"K".to_vec(), Object::Int(0));
+    parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+    parms.set(b"Rows".to_vec(), Object::Int(h.into()));
+    d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+    let fax = doc.add(Object::Stream(Stream::from_raw(d, g3.clone())));
+    page(&mut doc, &[("A", fax)], "q 64 0 0 64 100 600 cm /A Do Q");
+    let before = render(&doc);
+
+    let mut kept = doc.clone();
+    optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
+    assert_eq!(stream(&kept, fax).raw[..], g3[..], "Retain keeps Group 3");
+
+    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!((r.images_resampled, r.images_recompressed), (0, 1), "{r:?}");
+    let s = stream(&doc, fax);
+    assert_eq!(doc.fax_params(&s).map(|p| p.k), Some(-1), "Group 4");
+    assert!(s.raw.len() < g3.len(), "{} bytes, from {}", s.raw.len(), g3.len());
+    assert_eq!(doc.decoded_image(&s).unwrap(), bits, "the same picture");
+    assert!(render(&doc) == before, "the page looks the same");
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index ea60fc2857..ecadea7b64 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7384,8 +7384,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
-evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), a lone Group 3 image to Group 4 without resampling (one behind another filter is stored again as Group 4; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From bd5693679564017e5ec529430000c0d51010877b Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:19:30 +0100
Subject: [PATCH 113/132] M11: redaction reads an image mask's /Decode given by
 reference

Redaction clears an image mask's covered samples to the value that
paints nothing, which an inverting /Decode [1 0] flips. It read the
array only when direct, so given by reference (or with its first number
so) the cleared samples painted instead: the covered area came out
inked. That was already so on main, and this PR sends CCITT masks
through it. The array and its first number are resolved now, as export
and the optimizer read them; the fax test covers all three forms.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/redact/src/image.rs |  5 ++++-
 crates/redact/src/tests.rs | 17 ++++++++++++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index 6568e8015a..a1bf022df1 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -104,7 +104,10 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     data.truncate(bytes);
     // Image masks: a sample of 0 paints unless /Decode is [1 0]; cleared samples must not paint.
     let clear_bit = if mask {
-        let inverted = s.dict.get(b"Decode").and_then(Object::as_array).and_then(|d| d.first()).and_then(Object::as_f64) == Some(1.0);
+        // The array, and its first number, given by reference too.
+        let decode = s.dict.get(b"Decode").map(|d| doc.resolve(d));
+        let first = decode.as_deref().and_then(Object::as_array).and_then(|d| d.first()).map(|v| doc.resolve(v));
+        let inverted = first.as_deref().and_then(Object::as_f64) == Some(1.0);
         !inverted
     } else {
         false
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index 9400391bb5..c6885eaf11 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -579,7 +579,8 @@ fn an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared(
 
 /// A CCITT fax image (a scan the optimizer or Create PDF stored as Group 4) has its covered
 /// pixels cleared in a copy, like any image PdfCraft can decode, instead of being removed whole:
-/// whether it sits behind another filter, with its parameters given by reference, or is a mask.
+/// whether it sits behind another filter, with its parameters given by reference, or is a mask,
+/// its decode array inverting it given directly, by reference or with its first number so.
 #[test]
 fn a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed() {
     // 16 × 2, all 1 bits (white), or all 0 bits (a mask painting everywhere); the left half of
@@ -599,6 +600,20 @@ fn a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed() {
         ),
         // A mask's 0 bits paint: cleared bits are set to 1, which paints nothing.
         (format!("{image} /ImageMask true /Filter /CCITTFaxDecode /DecodeParms {parms}"), painted, vec![], [0xFF, 0x00, 0x00, 0x00]),
+        // With /Decode [1 0] a mask's 1 bits paint, and cleared bits are 0.
+        (format!("{image} /ImageMask true /Decode [1 0] /Filter /CCITTFaxDecode /DecodeParms {parms}"), g4.clone(), vec![], [0x00, 0xFF, 0xFF, 0xFF]),
+        (
+            format!("{image} /ImageMask true /Decode 8 0 R /Filter /CCITTFaxDecode /DecodeParms {parms}"),
+            g4.clone(),
+            vec![b"[1 0]".to_vec()],
+            [0x00, 0xFF, 0xFF, 0xFF],
+        ),
+        (
+            format!("{image} /ImageMask true /Decode [8 0 R 0] /Filter /CCITTFaxDecode /DecodeParms {parms}"),
+            g4.clone(),
+            vec![b"1".to_vec()],
+            [0x00, 0xFF, 0xFF, 0xFF],
+        ),
     ] {
         let mut objs = vec![stream(&dict, data)];
         objs.extend(extra);

From 76236edf1e56caa51eb012e86cc2513593ff5df7 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Sat, 24 Oct 2026 10:10:21 +0200
Subject: [PATCH 114/132] M11: the optimizer packs black-and-white RGB and
 indexed images to one bit

Monochrome Images only took eight-bit grey of only black and white
besides 1-bit images, so the same scan written as RGB, or as an indexed
image of two palette entries, stayed at eight bits (and RGB went to the
colour settings, as JPEG). Now these are packed to one bit first:

- eight-bit DeviceRGB whose every pixel is black or white becomes
  DeviceGray; a decode array the same for each component becomes that
  pair, another stops it. Calibrated RGB and RGB with a profile stay.
- an indexed image of 2, 4 or 8 bits that uses only palette entries 0
  and 1 keeps its palette, whatever the two colours; a decode array
  other than the default stops it.

Colour-key masks still stop all of them, and Retain leaves them to the
grey and colour settings. They are decoded through /DecodeParms given
by reference too (Document::with_direct_parms), and when downsampled a
tie goes to the dark sample of the image as packed: packed RGB is grey,
with grey's decode pair.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BfMGHQNgdq5yf5tKZHGR3z
---
 ROADMAP.md                        |   1 +
 crates/optimize/README.md         |  14 +-
 crates/optimize/src/images.rs     | 164 +++++++++++++++++------
 crates/optimize/tests/optimize.rs | 208 ++++++++++++++++++++++++++----
 docs/roadmap.md                   |   2 +
 parity/acrobat-features.toml      |   6 +-
 6 files changed, 326 insertions(+), 69 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index baae83997d..5a441aa553 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,6 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
+- **2026-10-24 (M11, more black-and-white images):** The optimizer re-stores Group 3 fax images as Group 4 when that is smaller, instead of leaving any CCITT image it doesn't resample as it is. Black-and-white images stored as eight-bit RGB (as some phone and scanner apps write them) become one-bit grey, and indexed images that use only their first two palette entries become one bit with their palette, so Monochrome Images compresses and downsamples them too.
 - **2026-10-24 (M11, monochrome downsampling):** The PDF Optimizer and Reduce File Size average black-and-white images above 450 ppi down to 300 ppi (Monochrome Images ▸ Downsample to), Group 4 scans included, so a 600 ppi text page goes from 79 KB to 40 KB. CCITT decoding moved into `pdfcraft-filters` (`decode_ccitt`), shared by Export ▸ Images and the optimizer through `Document::decoded_image`.
 - **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller, as they can a dithered scan, soft mask counted, and Export ▸ Images reads CCITT fax images.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 13aa82aadb..0b159229a0 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -43,12 +43,14 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   or with CCITT fax after any of those (decoded by `Document::decoded_image_within`, no further
   than its rows can need; byte-aligned Group 3 with end-of-line codes but none before the first
   row, not as T.4 sends them, is read as PdfCraft draws it, which at `/K 0` may be other rows than
-  were coded, and an image resampled, or stored again as Group 4 from behind another filter,
-  keeps them), and an eight-bit grey image of
-  only 0 and 255, packed to one bit (not an indexed image, whose samples are palette indices, nor
-  one with a colour-key `/Mask`) unless the grey settings make it smaller still, its soft mask counted
-  (resampled with it there, kept as it is here), as they can a dithered scan by downsampling it to
-  JPEG.
+  were coded, and an image stored again keeps them). Packed to one bit first, unless a colour-key `/Mask` is in the image's
+  own values: eight-bit grey of only 0 and 255; eight-bit `DeviceRGB` of only black and white,
+  which becomes `DeviceGray` (not calibrated RGB or RGB with a profile); and an indexed image of 2,
+  4 or 8 bits that uses only palette entries 0 and 1, which keeps its palette, whatever its two
+  colours. A decode array stays when it means the same at one bit (grey's, or RGB's if the same
+  for each component, as grey's); otherwise the image is left alone. The grey or colour settings
+  take a packed image instead when they make it smaller still, its soft mask counted (resampled
+  with it there, kept as it is here), as they can a dithered scan by downsampling it to JPEG.
   - **Downsampling:** one whose effective resolution is above `above_ppi` is averaged down to
     `target_ppi`: each new pixel takes the sample covering more of its area, and the dark one on a
     tie, so a dark line half a new pixel wide stays: black in grey and the painted part of an image
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 42c9a742c8..8b55d4aeb2 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -562,14 +562,26 @@ fn one_component(doc: &Document, cs: &Object) -> bool {
     }
 }
 
+/// A pixel's samples as a 1 or a 0, or `None` for a colour that is neither.
+type Pixel = fn(&[u8]) -> Option<bool>;
+
 /// The samples of a black-and-white image, as rows of 1-bit samples each starting on a new byte,
-/// with its width and height, and whether they were packed from eight bits. Two kinds count:
+/// with its width and height, and, when they were packed from more bits, its dictionary as a 1-bit
+/// image. These count:
 /// - one bit per pixel in one colour component, or an image mask, stored with no filter, with
-///   general-purpose ones, or with CCITT fax last ([`Document::decoded_image_within`], no further than its rows can need);
-/// - with `eight_bit`, eight-bit grey whose every sample is 0 or 255. A decode array maps 0 and 255
-///   at eight bits as it maps 0 and 1 at one bit, so it stays. Left out: indexed images (their
-///   samples are palette indices) and a colour-key `/Mask` (its ranges are in eight-bit values).
-fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32, u32, bool)> {
+///   general-purpose ones, or with CCITT fax last ([`Document::decoded_image_within`], no further
+///   than its rows can need);
+/// - with `pack`, and with no colour-key `/Mask` (its ranges are in the image's own values):
+///   - eight-bit grey (one component, not indexed) whose every sample is 0 or 255. A decode array
+///     maps 0 and 255 at eight bits as it maps 0 and 1 at one bit, so it stays;
+///   - eight-bit `DeviceRGB` whose every pixel is black or white, which becomes `DeviceGray`. A
+///     decode array the same for all three components becomes that one pair; another stops it.
+///     Calibrated RGB and RGB with a profile are left out, as the profile could make them other
+///     than black and white;
+///   - an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1, which stay 0 and
+///     1 at one bit, whatever their colours, so the colour space stays. A decode array other than
+///     the default stops it: in index units it would mean something else at one bit.
+fn one_bit(doc: &Document, s: &Stream, pack: bool) -> Option<(Vec<u8>, u32, u32, Option<Dict>)> {
     let d = &s.dict;
     // Through u32 first, as everywhere here, so the product can't overflow.
     let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
@@ -593,33 +605,92 @@ fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32,
             return None;
         }
         data.truncate(len);
-        return Some((data, w, h, false));
+        return Some((data, w, h, None));
     }
-    let indexed = |cs: &Object| match &*doc.resolve(cs) {
-        Object::Array(a) => matches!(a.first().and_then(Object::as_name), Some(b"Indexed" | b"I")),
-        _ => false,
-    };
     let colour_key = d.get(b"Mask").is_some_and(|m| doc.resolve(m).as_array().is_some());
-    if !eight_bit || bits != Some(8) || mask || colour_key || !d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs) && !indexed(cs)) {
+    if !pack || mask || colour_key {
         return None;
     }
-    // Through its parameters given by reference too: without a PNG predictor's tag bytes taken
-    // off, rows of 0 and 255 would still pass below, each shifted by a byte.
-    let samples = doc.with_direct_parms(s).decoded_within(allowance(wu.checked_mul(hu)?, h)?).ok()?;
-    let samples = samples.get(..wu.checked_mul(hu)?)?;
-    let mut packed = vec![0u8; stride.checked_mul(hu)?];
-    for (i, v) in samples.iter().enumerate() {
-        match v {
-            0 => {}
-            255 => {
-                if let Some(b) = packed.get_mut((i / wu) * stride + (i % wu) / 8) {
-                    *b |= 0x80 >> (i % wu % 8);
+    let cs = d.get(b"ColorSpace")?;
+    let decode = d.get(b"Decode").map(|v| doc.resolve(v));
+    let mut packed = d.clone();
+    packed.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    // Components a pixel, bits a component, and a pixel's samples as 1 or 0.
+    let (n, bpc, white): (usize, usize, Pixel) = match &*doc.resolve(cs) {
+        Object::Array(a) if matches!(a.first().and_then(Object::as_name), Some(b"Indexed" | b"I")) => {
+            let bpc = bits.filter(|b| matches!(b, 2 | 4 | 8))?;
+            match decode.as_deref() {
+                None => {}
+                Some(Object::Array(v)) if v[..] == [Object::Int(0), Object::Int((1 << bpc) - 1)] => {
+                    packed.remove(b"Decode");
                 }
+                Some(_) => return None,
+            }
+            (1, usize::try_from(bpc).ok()?, |v| match v {
+                [0] => Some(false),
+                [1] => Some(true),
+                _ => None,
+            })
+        }
+        Object::Name(name) if matches!(name.as_slice(), b"DeviceRGB" | b"RGB") && bits == Some(8) => {
+            match decode.as_deref() {
+                None => {}
+                Some(Object::Array(v)) if v.len() == 6 && v.chunks(2).all(|pair| Some(pair) == v.get(..2)) => {
+                    packed.set(b"Decode".to_vec(), Object::Array(v.get(..2)?.to_vec()));
+                }
+                Some(_) => return None,
+            }
+            packed.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+            (3, 8, |v| match v {
+                [0, 0, 0] => Some(false),
+                [255, 255, 255] => Some(true),
+                _ => None,
+            })
+        }
+        _ if bits == Some(8) && one_component(doc, cs) => (1, 8, |v| match v {
+            [0] => Some(false),
+            [255] => Some(true),
+            _ => None,
+        }),
+        _ => return None,
+    };
+    let row_len = wu.checked_mul(n)?.checked_mul(bpc)?.div_ceil(8);
+    // Through its parameters given by reference too: without a PNG predictor's tag bytes taken
+    // off, rows of 0 and 255 (or palette entries 0 and 1) would still pass below, each shifted.
+    let samples = doc.with_direct_parms(s).decoded_within(allowance(row_len.checked_mul(hu)?, h)?).ok()?;
+    Some((packed_rows(&samples, row_len, wu, hu, (n, bpc, white))?, w, h, Some(packed)))
+}
+
+/// `h` rows of `w` pixels, each row `row_len` bytes of `n` samples a pixel at `bpc` bits (8, or
+/// a divisor of 8 with `n` 1), as rows of 1-bit samples each starting on a new byte: 1 where
+/// `white` says the pixel is white. `None` when a pixel is neither, `samples` is short, or the
+/// rows have another shape: no pixels in a row, other sample sizes, or too few bytes for their
+/// pixels.
+fn packed_rows(samples: &[u8], row_len: usize, w: usize, h: usize, (n, bpc, white): (usize, usize, Pixel)) -> Option<Vec<u8>> {
+    let stride = w.div_ceil(8);
+    let shape = (n > 0 && bpc == 8) || (n == 1 && matches!(bpc, 1 | 2 | 4));
+    if stride == 0 || !shape || row_len < w.checked_mul(n)?.checked_mul(bpc)?.div_ceil(8) {
+        return None;
+    }
+    // From here no row is empty and x·n·bpc stays within one, and the output is no larger than
+    // the samples it is read from.
+    let samples = samples.get(..row_len.checked_mul(h)?)?;
+    let mut out = vec![0u8; stride.checked_mul(h)?];
+    for (row, out_row) in samples.chunks(row_len).zip(out.chunks_mut(stride)) {
+        for x in 0..w {
+            let on = if bpc == 8 {
+                white(row.get(x * n..x * n + n)?)?
+            } else {
+                // Samples narrower than a byte, the first in its high bits; bpc divides 8.
+                let at = x * bpc;
+                white(&[(row.get(at / 8)? >> (8 - bpc - at % 8)) & ((1u8 << bpc) - 1)])?
+            };
+            if on {
+                *out_row.get_mut(x / 8)? |= 0x80 >> (x % 8);
             }
-            _ => return None,
         }
     }
-    Some((packed, w, h, true))
+    Some(out)
 }
 
 /// Whether sample 1 is the dark one of the 1-bit image `d` describes, after its decode array
@@ -704,13 +775,14 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
 ///   dither: most of its new pixels would cover both black and white, and taking the sample that
 ///   covers more would turn its tones solid (a 50% screen black, a 25% one white).
 /// - **Stored** as CCITT Group 4 with `CcittG4`, or as 1-bit Flate when that is smaller, which only
-///   a resampled image or one packed from eight bits may be: a 1-bit image that is only stored again
+///   a resampled image or one packed from more bits may be: a 1-bit image that is only stored again
 ///   becomes Group 4 or stays. Group 4 alone is only decoded to be resampled; Group 3 is stored
 ///   again like any other. With `Retain`, a resampled image keeps its kind of compression
-///   (CCITT, or Flate), and nothing else changes: eight-bit grey stays a grey image like any
-///   other, which the grey settings handle.
+///   (CCITT, or Flate), and nothing else changes: an image of more bits stays as it is, for the
+///   grey or colour settings.
 ///
-/// The samples keep their meaning, so the colour space, decode array and `/Mask` stay as they are.
+/// The samples keep their meaning, so the decode array and `/Mask` stay as they are, and the
+/// colour space too, but for black-and-white RGB, which becomes grey.
 fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option<(Stream, bool)> {
     let d = &s.dict;
     let downsample = settings.downsample && ppi.is_finite() && ppi > settings.above_ppi && settings.target_ppi > 0.0 && !d.contains(b"SMask");
@@ -724,7 +796,8 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     if (retain || g4_alone) && !downsample {
         return None;
     }
-    let (data, w, h, eight_bit) = one_bit(doc, s, !retain)?;
+    let (data, w, h, packed) = one_bit(doc, s, !retain)?;
+    let packed_from_more = packed.is_some();
     let k = settings.target_ppi / ppi;
     // `downsample_bits` keeps a counter for each column: no more columns than a fax row may have,
     // so a hostile strip of 80 million can't make it 640 MB.
@@ -736,7 +809,8 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
         (w, h)
     };
     let averaged = if (nw, nh) != (w, h) {
-        let (out, mixed) = downsample_bits(&data, w, h, nw, nh, dark_is_one(doc, d))?;
+        // The dark sample of the image as it ends up: packed RGB is grey, with grey's decode pair.
+        let (out, mixed) = downsample_bits(&data, w, h, nw, nh, dark_is_one(doc, packed.as_ref().unwrap_or(d)))?;
         // A halftone or dither: most new pixels cover both samples. Text covers both only along
         // its edges.
         (mixed.saturating_mul(2) <= u64::from(nw) * u64::from(nh)).then_some(out)
@@ -751,15 +825,12 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     if (retain || g4_alone) && !resampled {
         return None;
     }
-    let mut dict = d.clone();
+    let mut dict = packed.unwrap_or_else(|| d.clone());
     for key in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
         dict.remove(key);
     }
     dict.set(b"Width".to_vec(), Object::Int(i64::from(nw)));
     dict.set(b"Height".to_vec(), Object::Int(i64::from(nh)));
-    if eight_bit {
-        dict.set(b"BitsPerComponent".to_vec(), Object::Int(1));
-    }
     let g4 = if settings.compression == MonoCompression::CcittG4 || (retain && ccitt) {
         pdfcraft_filters::encode_g4(&data, nw, nh).ok().map(|coded| {
             let mut dict = dict.clone();
@@ -774,7 +845,7 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     } else {
         None
     };
-    let flate = ((resampled || eight_bit) && !(retain && ccitt)).then(|| Stream::flate(dict, &data));
+    let flate = ((resampled || packed_from_more) && !(retain && ccitt)).then(|| Stream::flate(dict, &data));
     // Smaller as stored, counting the dictionary: a tiny image can lose by Group 4's parameters.
     let best = [g4, flate].into_iter().flatten().filter_map(|c| Some((crate::stored_len(&c)?, c))).min_by_key(|(len, _)| *len)?;
     (best.0 < crate::stored_len(s)?).then_some((best.1, resampled))
@@ -1033,3 +1104,24 @@ mod downsample_tests {
         }
     }
 }
+
+#[cfg(test)]
+mod pack_tests {
+    use super::{Pixel, packed_rows};
+
+    /// Rows of one pixel of one bit, 1 white: each packed as it is.
+    const WHITE_IS_1: Pixel = |v| Some(v == [1]);
+
+    /// [`packed_rows`] packs rows it can read whole, and refuses any other shape, without reading
+    /// past a row or allocating more than its samples: no pixels in a row, no components, samples
+    /// of 3 bits, several components under 8 bits, rows shorter than their pixels, and a width far
+    /// past the samples.
+    #[test]
+    fn packed_rows_refuses_rows_it_cannot_read_whole() {
+        let samples = [0x80, 0x00, 0x80, 0x00];
+        assert_eq!(packed_rows(&samples, 1, 1, 4, (1, 1, WHITE_IS_1)), Some(vec![0x80, 0x00, 0x80, 0x00]));
+        for (row_len, w, n, bpc) in [(1, 0, 1, 1), (1, 1, 0, 8), (1, 1, 1, 3), (1, 1, 2, 4), (1, 9, 1, 1), (1, usize::MAX / 8, 1, 1)] {
+            assert_eq!(packed_rows(&samples, row_len, w, 4, (n, bpc, WHITE_IS_1)), None, "row of {row_len} for {w} × {n} × {bpc}");
+        }
+    }
+}
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index f1e5015761..cc8f2f4683 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -486,9 +486,10 @@ fn group_4_takes_images_of_one_bit_a_pixel_up_to_the_pixel_limit() {
 /// (`/Predictor 9 0 R`, which `Dict::int` doesn't follow), is read through them, as one with them
 /// direct: a predictor's tag bytes would otherwise shift every row, and the image would be stored
 /// again wrong. Here a 1-bit image with a PNG predictor (stored again as Group 4), an eight-bit
-/// grey one with a PNG predictor at 600 ppi (resampled), and an eight-bit one of only black and
-/// white with PNG predictor 10 (each row's tag a 0, so the shifted rows would still be black and
-/// white; packed to one bit) come out byte for byte as with direct parameters.
+/// grey one with a PNG predictor at 600 ppi (resampled), an eight-bit one of only black and white
+/// with PNG predictor 10 (each row's tag a 0, so the shifted rows would still be black and white;
+/// packed to one bit), and a two-entry indexed one the same way come out byte for byte as with
+/// direct parameters.
 #[test]
 fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
     let build = |how: &str| {
@@ -519,8 +520,21 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
         parms.set(b"Columns".to_vec(), Object::Int(w as i64));
         d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
         let black_and_white = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &black_and_white_samples).unwrap();
-        let packed = doc.add(Object::Stream(Stream::from_raw(d, black_and_white)));
-        for r in [one_bit, eight_bit, packed] {
+        let packed = doc.add(Object::Stream(Stream::from_raw(d.clone(), black_and_white)));
+        let palette = vec![0, 0, 255, 255, 255, 255];
+        d.set(
+            b"ColorSpace".to_vec(),
+            Object::Array(vec![
+                Object::name("Indexed"),
+                Object::name("DeviceRGB"),
+                1.into(),
+                Object::String(pdfcraft_cos::PdfString::literal(palette)),
+            ]),
+        );
+        let entries = samples_of(&bilevel(w, h, false), w, h, [&[0], &[1]], 8);
+        let entries = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &params, &entries).unwrap();
+        let indexed = doc.add(Object::Stream(Stream::from_raw(d, entries)));
+        for r in [one_bit, eight_bit, packed, indexed] {
             let mut s = stream(&doc, r);
             let Some(Object::Dict(mut parms)) = s.dict.get(b"DecodeParms").cloned() else { panic!("{:?}", s.dict) };
             let made = match how {
@@ -540,16 +554,19 @@ fn images_whose_decode_parms_are_references_come_out_as_with_them_direct() {
         // 300 × 120 pt is 288 ppi; 144 × 57.6 pt is 600 ppi.
         page(
             &mut doc,
-            &[("A", one_bit), ("B", eight_bit), ("C", packed)],
-            "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q q 300 0 0 120 20 200 cm /C Do Q",
+            &[("A", one_bit), ("B", eight_bit), ("C", packed), ("D", indexed)],
+            "q 300 0 0 120 20 600 cm /A Do Q q 144 0 0 57.6 20 400 cm /B Do Q q 300 0 0 120 20 200 cm /C Do Q \
+             q 280 0 0 112 325 200 cm /D Do Q",
         );
-        let before = [one_bit, eight_bit, packed].map(|r| stream(&doc, r).raw);
+        let before = [one_bit, eight_bit, packed, indexed].map(|r| stream(&doc, r).raw);
         let r = optimize(&mut doc, &Settings::default()).unwrap();
-        assert_eq!((r.images_resampled, r.images_recompressed), (1, 2), "{r:?}");
-        let after = [one_bit, eight_bit, packed].map(|r| stream(&doc, r));
+        assert_eq!((r.images_resampled, r.images_recompressed), (1, 3), "{r:?}");
+        let after = [one_bit, eight_bit, packed, indexed].map(|r| stream(&doc, r));
         assert!(before.iter().zip(&after).all(|(b, a)| *b != a.raw), "all stored again");
         assert_eq!(after[0].dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]));
-        assert_eq!((after[2].dict.int(b"BitsPerComponent"), after[2].dict.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])));
+        for s in &after[2..] {
+            assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter")), (Some(1), Some(&b"CCITTFaxDecode"[..])));
+        }
         after.map(|s| s.raw)
     };
     let direct = build("direct");
@@ -788,15 +805,129 @@ fn eight_bit_black_and_white_images_become_one_bit() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// `bits` (1-bit rows) with each 0 as `values[0]` and each 1 as `values[1]`, at `bpc` bits a sample
+/// (each row starting on a new byte).
+fn samples_of(bits: &[u8], w: u32, h: u32, values: [&[u8]; 2], bpc: usize) -> Vec<u8> {
+    let (w, h) = (w as usize, h as usize);
+    let stride = w.div_ceil(8);
+    let mut out = Vec::new();
+    for y in 0..h {
+        let row: Vec<u8> = (0..w).flat_map(|x| values[usize::from(bits[y * stride + x / 8] & (0x80 >> (x % 8)) != 0)].iter().copied()).collect();
+        let mut packed = vec![0u8; (row.len() * bpc).div_ceil(8)];
+        for (i, s) in row.iter().enumerate() {
+            packed[i * bpc / 8] |= if bpc == 8 { *s } else { s << (8 - bpc - i * bpc % 8) };
+        }
+        out.extend(packed);
+    }
+    out
+}
+
+/// Eight-bit RGB of only black and white becomes one-bit grey, and an indexed image that uses only
+/// palette entries 0 and 1 becomes one bit with its palette (here blue and white), at 8 bits or 4,
+/// both as Group 4 and losslessly: the page looks the same to the pixel. An RGB decode array the
+/// same for each component becomes grey's, and an indexed image's default one goes. Not touched:
+/// RGB with any other colour, a decode array that differs between components, a colour-key mask or
+/// calibrated RGB; an indexed image that uses a third entry or has another decode array; and
+/// everything with `mono: Retain`.
+#[test]
+fn rgb_and_two_colour_indexed_black_and_white_images_become_one_bit() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200u32, 480u32);
+    let text = bilevel(w, h, false);
+    let image = |doc: &mut Document, data: &[u8], bpc: i64, cs: Object, entries: &[(&str, Object)]| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(bpc));
+        d.set(b"ColorSpace".to_vec(), cs);
+        for (k, v) in entries {
+            d.set(k.as_bytes().to_vec(), v.clone());
+        }
+        doc.add(Object::Stream(Stream::flate(d, data)))
+    };
+    let rgb_cs = Object::name("DeviceRGB");
+    let rgb_data = samples_of(&text, w, h, [&[0, 0, 0], &[255, 255, 255]], 8);
+    let rgb = image(&mut doc, &rgb_data, 8, rgb_cs.clone(), &[]);
+    let pairs = |p: [i64; 6]| Object::Array(p.into_iter().map(Object::Int).collect());
+    let rgb_inverted = image(&mut doc, &rgb_data, 8, rgb_cs.clone(), &[("Decode", pairs([1, 0, 1, 0, 1, 0]))]);
+    let rgb_mixed = image(&mut doc, &rgb_data, 8, rgb_cs.clone(), &[("Decode", pairs([1, 0, 0, 1, 0, 1]))]);
+    let mut red = rgb_data.clone();
+    red[3000..3003].copy_from_slice(&[255, 0, 0]);
+    let rgb_red = image(&mut doc, &red, 8, rgb_cs.clone(), &[]);
+    let mut white_point = Dict::new();
+    white_point.set(b"WhitePoint".to_vec(), Object::Array(vec![Object::Real(0.9505), 1.into(), Object::Real(1.089)]));
+    let cal_rgb = image(&mut doc, &rgb_data, 8, Object::Array(vec![Object::name("CalRGB"), Object::Dict(white_point)]), &[]);
+    let rgb_keyed = image(&mut doc, &rgb_data, 8, rgb_cs, &[("Mask", pairs([0, 0, 0, 0, 0, 0]))]);
+    let palette = |entries: &[u8]| {
+        Object::Array(vec![
+            Object::name("Indexed"),
+            Object::name("DeviceRGB"),
+            (entries.len() as i64 / 3 - 1).into(),
+            Object::String(pdfcraft_cos::PdfString::literal(entries.to_vec())),
+        ])
+    };
+    let blue_white = palette(&[0, 0, 255, 255, 255, 255]);
+    let indices = samples_of(&text, w, h, [&[0], &[1]], 8);
+    let blue = image(&mut doc, &indices, 8, blue_white.clone(), &[]);
+    let default_decode = Object::Array(vec![0.into(), 255.into()]);
+    let blue_decoded = image(&mut doc, &indices, 8, blue_white.clone(), &[("Decode", default_decode)]);
+    let blue_4 = image(&mut doc, &samples_of(&text, w, h, [&[0], &[1]], 4), 4, blue_white.clone(), &[]);
+    let mut third = indices.clone();
+    third[3000] = 2;
+    let three = image(&mut doc, &third, 8, palette(&[0, 0, 255, 255, 255, 255, 255, 0, 0]), &[]);
+    let other_decode = image(&mut doc, &indices, 8, blue_white.clone(), &[("Decode", Object::Array(vec![0.into(), 1.into()]))]);
+    let all = [rgb, rgb_inverted, rgb_mixed, rgb_red, cal_rgb, rgb_keyed, blue, blue_decoded, blue_4, three, other_decode];
+    // 200 × 80 pt is 432 ppi: below where monochrome downsampling starts.
+    let names: Vec<String> = (0..all.len()).map(|i| format!("Im{i}")).collect();
+    let content: String =
+        (0..all.len()).map(|i| format!("q 200 0 0 80 {} {} cm /Im{i} Do Q ", 6 + 200 * (i % 3), 690 - 100 * (i / 3) as i64)).collect();
+    page(&mut doc, &names.iter().map(String::as_str).zip(all).collect::<Vec<_>>(), &content);
+    let before = render(&doc);
+    let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
+    // Colour and grey settings that leave images alone, so only this conversion acts.
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    let settings = Settings { color: keep, gray: keep, ..Settings::default() };
+
+    let mut kept = doc.clone();
+    let r = optimize(&mut kept, &Settings { mono: RETAIN, ..settings.clone() }).unwrap();
+    assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "Retain keeps every image as it is");
+
+    let untouched = [rgb_mixed, rgb_red, cal_rgb, rgb_keyed, three, other_decode].map(|r| raw(&doc, r));
+    let r = optimize(&mut doc, &settings).unwrap();
+    assert_eq!((r.images_resampled, r.images_recompressed), (0, 5), "{r:?}");
+    for (i, cs) in [
+        (rgb, Object::name("DeviceGray")),
+        (rgb_inverted, Object::name("DeviceGray")),
+        (blue, blue_white.clone()),
+        (blue_decoded, blue_white.clone()),
+        (blue_4, blue_white),
+    ] {
+        let s = stream(&doc, i);
+        assert_eq!(
+            (s.dict.int(b"BitsPerComponent"), s.dict.name(b"Filter"), s.dict.get(b"ColorSpace")),
+            (Some(1), Some(&b"CCITTFaxDecode"[..]), Some(&cs)),
+            "{i:?}"
+        );
+        assert_eq!(doc.decoded_image(&s).unwrap(), text, "{i:?}");
+        let decode = if i == rgb_inverted { Some(Object::Array(vec![1.into(), 0.into()])) } else { None };
+        assert_eq!(s.dict.get(b"Decode").cloned(), decode, "{i:?}");
+    }
+    assert_eq!([rgb_mixed, rgb_red, cal_rgb, rgb_keyed, three, other_decode].map(|r| raw(&doc, r)), untouched);
+    assert!(render(&doc) == before, "the page looks the same");
+}
+
 /// Black-and-white images above 450 ppi are averaged down to 300 ppi, by default: 1-bit Flate, CCITT
-/// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays) and
-/// eight-bit grey of only black and white, all drawn at 600 ppi, are stored at half the size (as
+/// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays), and
+/// eight-bit grey and RGB of only black and white (the RGB also the other way round, with a decode
+/// array that inverts it, so its ties are 1s), all drawn at 600 ppi, are stored at half the size (as
 /// Group 4, or 1-bit Flate when that is smaller, as it is on this clean text), each new pixel the
 /// majority of the 2 × 2 it covers (a tie black, or for the mask painted). Left at their size: an image at 400 ppi (stored
 /// again as Group 4), a Group 4 one at 400 ppi (not even decoded), one behind ASCIIHexDecode at
 /// 400 ppi (stored again as Group 4 alone), and one with a soft mask. The page looks the same at
 /// screen size. With `downsample` off nothing is resampled; with Retain, Flate stays Flate, CCITT
-/// stays CCITT, and eight-bit grey is left to the grey settings.
+/// stays CCITT, and eight-bit grey and RGB are left to the grey and colour settings.
 #[test]
 fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     let mut doc = Document::new_empty();
@@ -842,7 +973,11 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     d.set(b"Height".to_vec(), Object::Int(h.into()));
     d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
     d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
-    let eight = doc.add(Object::Stream(Stream::flate(d, &eight_bit(&text, w, h))));
+    let eight = doc.add(Object::Stream(Stream::flate(d.clone(), &eight_bit(&text, w, h))));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+    let rgb = doc.add(Object::Stream(Stream::flate(d.clone(), &samples_of(&text, w, h, [&[0, 0, 0], &[255, 255, 255]], 8))));
+    d.set(b"Decode".to_vec(), Object::Array([1, 0, 1, 0, 1, 0].map(Object::Int).to_vec()));
+    let rgb_inverted = doc.add(Object::Stream(Stream::flate(d, &samples_of(&text, w, h, [&[255, 255, 255], &[0, 0, 0]], 8))));
     let at_400 = mono_image(&mut doc, w, h, &text, None, &grey);
     let fax_at_400 = g4(&mut doc, &grey);
     let mut sm = Dict::new();
@@ -856,10 +991,23 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     // 144 × 57.6 pt is 2 × 0.8 in: 600 ppi. 216 × 86.4 pt is 400 ppi.
     page(
         &mut doc,
-        &[("A", flate), ("B", fax), ("C", mask), ("D", eight), ("E", at_400), ("F", fax_at_400), ("G", soft), ("H", hex_fax), ("I", hex_at_400)],
+        &[
+            ("A", flate),
+            ("B", fax),
+            ("C", mask),
+            ("D", eight),
+            ("E", at_400),
+            ("F", fax_at_400),
+            ("G", soft),
+            ("H", hex_fax),
+            ("I", hex_at_400),
+            ("J", rgb),
+            ("K", rgb_inverted),
+        ],
         "q 144 0 0 57.6 20 700 cm /A Do Q q 144 0 0 57.6 200 700 cm /B Do Q q 0 0 1 rg 144 0 0 57.6 380 700 cm /C Do Q \
          q 144 0 0 57.6 20 600 cm /D Do Q q 216 0 0 86.4 200 580 cm /E Do Q q 216 0 0 86.4 20 480 cm /F Do Q \
-         q 144 0 0 57.6 260 480 cm /G Do Q q 144 0 0 57.6 430 600 cm /H Do Q q 216 0 0 86.4 20 360 cm /I Do Q",
+         q 144 0 0 57.6 260 480 cm /G Do Q q 144 0 0 57.6 430 600 cm /H Do Q q 216 0 0 86.4 20 360 cm /I Do Q q 144 0 0 57.6 260 380 cm /J Do Q \
+         q 144 0 0 57.6 430 480 cm /K Do Q",
     );
     let before = render(&doc);
     let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
@@ -886,17 +1034,19 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     let (halved, halved_mask) = (halve(false), halve(true));
     assert_ne!(halved, halved_mask, "the picture has ties");
 
-    // The grey settings left alone too: an eight-bit image would otherwise take them when smaller.
+    // The grey and colour settings left alone too: an image of more bits would otherwise take
+    // them when smaller.
     let mut off = doc.clone();
     let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
     let mono = MonoSettings { downsample: false, ..MonoSettings::REDUCE };
-    let r = optimize(&mut off, &Settings { mono, gray: keep, ..Settings::default() }).unwrap();
+    let r = optimize(&mut off, &Settings { mono, gray: keep, color: keep, ..Settings::default() }).unwrap();
     assert_eq!(r.images_resampled, 0, "{r:?}");
-    assert!([flate, fax, mask, eight, hex_fax].iter().all(|i| size(&off, *i) == (1200, 480)));
+    assert!([flate, fax, mask, eight, hex_fax, rgb, rgb_inverted].iter().all(|i| size(&off, *i) == (1200, 480)));
 
     let mut kept = doc.clone();
     let r = optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
-    assert_eq!(r.images_resampled, 5, "{r:?}");
+    // Not the inverted RGB: the colour settings leave an image with a decode array alone.
+    assert_eq!(r.images_resampled, 6, "{r:?}");
     assert_eq!(stream(&kept, flate).dict.name(b"Filter"), Some(&b"FlateDecode"[..]), "Retain: Flate stays Flate");
     for i in [fax, hex_fax] {
         assert_eq!(stream(&kept, i).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "and CCITT stays CCITT: {i:?}");
@@ -905,19 +1055,29 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     for i in [flate, fax, hex_fax] {
         assert_eq!((size(&kept, i), kept.decoded_image(&stream(&kept, i)).unwrap()), ((600, 240), halved.clone()), "{i:?}");
     }
-    assert_eq!(stream(&kept, eight).dict.int(b"BitsPerComponent"), Some(8), "Retain leaves eight bits to the grey settings");
+    let bits = [eight, rgb, rgb_inverted].map(|i| stream(&kept, i).dict.int(b"BitsPerComponent"));
+    assert_eq!(bits, [Some(8); 3], "Retain leaves eight bits to the grey and colour settings");
 
     let untouched = [fax_at_400].map(|r| raw(&doc, r));
     let hex_len = raw(&doc, hex_at_400).len();
     let r = optimize(&mut doc, &Settings::default()).unwrap();
-    assert_eq!((r.images_resampled, r.images_recompressed), (5, 3), "{r:?}");
-    for i in [flate, fax, mask, eight, hex_fax] {
+    assert_eq!((r.images_resampled, r.images_recompressed), (7, 3), "{r:?}");
+    assert_eq!(stream(&doc, rgb).dict.get(b"ColorSpace"), Some(&Object::name("DeviceGray")));
+    for i in [flate, fax, mask, eight, hex_fax, rgb] {
         let s = stream(&doc, i);
         assert_eq!((size(&doc, i), s.dict.int(b"BitsPerComponent")), ((600, 240), if i == mask { None } else { Some(1) }));
         assert!(matches!(s.dict.name(b"Filter"), Some(b"CCITTFaxDecode" | b"FlateDecode")), "{i:?}");
         assert_eq!(doc.decoded_image(&s).unwrap(), if i == mask { halved_mask.clone() } else { halved.clone() }, "{i:?}");
     }
     assert_eq!(stream(&doc, mask).dict.get(b"Decode"), Some(&decode), "the decode array stays");
+    // Grey now, with grey's decode pair, which makes 1 black: its ties are black too.
+    let s = stream(&doc, rgb_inverted);
+    let inverting = Object::Array(vec![1.into(), 0.into()]);
+    assert_eq!(
+        (size(&doc, rgb_inverted), s.dict.get(b"ColorSpace"), s.dict.get(b"Decode")),
+        ((600, 240), Some(&Object::name("DeviceGray")), Some(&inverting))
+    );
+    assert_eq!(doc.decoded_image(&s).unwrap(), halved.iter().map(|b| !b).collect::<Vec<u8>>(), "the same picture, ties black");
     for i in [at_400, soft, hex_at_400] {
         assert_eq!((size(&doc, i), stream(&doc, i).dict.name(b"Filter")), ((1200, 480), Some(&b"CCITTFaxDecode"[..])), "{i:?}");
     }
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 56b10853a2..1cef4f5965 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,6 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: the optimizer stores Group 3 fax images as Group 4, and packs black-and-white RGB and two-entry indexed images to one bit; estimates unchanged)
 > **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white images above 450 ppi are averaged down to 300 ppi by the optimizer; estimates unchanged)
 > **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white pictures stay one bit when PDFs are created and optimized; CCITT images export; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
@@ -258,6 +259,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-24 | minor | M11: the PDF Optimizer and Reduce File Size store Group 3 fax images as Group 4 when smaller (`Document::fax_params`), and pack eight-bit `DeviceRGB` of only black and white (as grey) and indexed images of 2, 4 or 8 bits that use only palette entries 0 and 1 (keeping the palette) to one bit, so Monochrome Images compresses and downsamples them. Estimates unchanged. |
 | 2026-10-24 | minor | M11: monochrome downsampling: the PDF Optimizer and Reduce File Size average black-and-white images (1-bit, CCITT fax, eight-bit black-and-white grey) above 450 ppi down to 300 ppi, by area with ties black, as Monochrome Images ▸ Downsample to and `doc_optimize` `mono: { downsample, ppi, above_ppi }`; CCITT decoding moves into `pdfcraft-filters` (`decode_ccitt`) behind `Document::decoded_image`. Estimates unchanged. |
 | 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller, as they can a dithered scan, soft mask counted; Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index ecadea7b64..bc4c68d538 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7361,7 +7361,7 @@ status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
 evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax, and eight-bit black-and-white grey and RGB and indexed images of two palette entries) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"
@@ -7384,8 +7384,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
-evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB and RGB with a profile aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From ff8a07f283757b875179c6b6e773b2ce66c9f682 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:19:30 +0100
Subject: [PATCH 115/132] M11: monochrome downsampling leaves halftones alone;
 bounds; an indexed tie under an inverting decode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Halftones and dithers: most of their new pixels cover both black and
  white, and taking the sample that covers more turned their tones
  solid (a 50% screen black, a 25% one white). An image whose new pixels
  mostly cover both is now left at its resolution; text covers both only
  along its edges and is still averaged down. downsample_bits says how
  many new pixels cover both.
- A counter for each column: an image wider than a fax row
  (MAX_CCITT_COLUMNS) isn't averaged, so a strip of 80 million columns
  can't make the counters 640 MB.
- A fax image's decoding is bounded at about a byte a pixel, as
  redaction's is (decoded_image_within), not 1 GiB; behind a Flate bomb
  it is left alone.
- An indexed image's tie went to sample 0, which an inverting decode
  array maps to entry 1, though the docs say entry 0. It goes to the
  sample that decodes to entry 0 now (ISO 32000-2 §8.9.5.2).

Each has a test that fails without it.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/src/images.rs     | 89 ++++++++++++++++++------------
 crates/optimize/tests/optimize.rs | 90 +++++++++++++++++++++++++++++++
 2 files changed, 146 insertions(+), 33 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 4c20c1b3e7..bb768551d5 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -565,7 +565,7 @@ fn one_component(doc: &Document, cs: &Object) -> bool {
 /// The samples of a black-and-white image, as rows of 1-bit samples each starting on a new byte,
 /// with its width and height, and whether they were packed from eight bits. Two kinds count:
 /// - one bit per pixel in one colour component, or an image mask, stored with no filter, with
-///   general-purpose ones, or with CCITT fax last ([`Document::decoded_image`]);
+///   general-purpose ones, or with CCITT fax last ([`Document::decoded_image_within`], no further than its rows can need);
 /// - with `eight_bit`, eight-bit grey whose every sample is 0 or 255. A decode array maps 0 and 255
 ///   at eight bits as it maps 0 and 1 at one bit, so it stays. Left out: indexed images (their
 ///   samples are palette indices) and a colour-key `/Mask` (its ranges are in eight-bit values).
@@ -581,13 +581,14 @@ fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32,
     let bits = d.int(b"BitsPerComponent");
     let mask = matches!(d.get(b"ImageMask"), Some(Object::Bool(true)));
     if (mask && bits.is_none_or(|b| b == 1)) || (bits == Some(1) && d.get(b"ColorSpace").is_some_and(|cs| one_component(doc, cs))) {
-        // A fax image through its decoder; any other no further than its rows can need.
+        // No further than its rows can need: a fax image's code (the filters before its decoder
+        // produce it) takes at most about a byte a pixel and each row's end, as redaction allows.
         let len = stride.checked_mul(hu)?;
-        let mut data = match s.filters().last() {
-            Some((pdfcraft_filters::Filter::CcittFax, _)) => doc.decoded_image(s),
-            _ => doc.with_direct_parms(s).decoded_within(allowance(len, h)?),
-        }
-        .ok()?;
+        let max = match s.filters().last() {
+            Some((pdfcraft_filters::Filter::CcittFax, _)) => wu.checked_mul(hu)?.checked_add(hu.checked_mul(4)?)?.checked_add(4096)?,
+            _ => allowance(len, h)?,
+        };
+        let mut data = doc.decoded_image_within(s, max).ok()?;
         if data.len() < len {
             return None;
         }
@@ -624,8 +625,9 @@ fn one_bit(doc: &Document, s: &Stream, eight_bit: bool) -> Option<(Vec<u8>, u32,
 /// Whether sample 1 is the dark one of the 1-bit image `d` describes, after its decode array
 /// (`[0 1]` when it has none of two numbers): the painted part of an image mask and black in grey
 /// decode to 0, and full ink in a separation (or a DeviceN of one colourant) to 1. An indexed image
-/// says 0: its palette, not its decode array, says which entry is darker, and the palette isn't
-/// read yet, so a tie goes to entry 0 whatever its colour.
+/// says the sample that decodes to entry 0 (its decode array maps samples to entries, ISO 32000-2
+/// §8.9.5.2): its palette says which entry is darker, and the palette isn't read yet, so a tie goes
+/// to entry 0 whatever its colour.
 fn dark_is_one(doc: &Document, d: &Dict) -> bool {
     let number = |v: Option<&Object>| v.and_then(|v| doc.resolve(v).as_f64());
     let (d0, d1) = match d.get(b"Decode").map(|v| doc.resolve(v)).as_deref() {
@@ -637,7 +639,6 @@ fn dark_is_one(doc: &Document, d: &Dict) -> bool {
     }
     match d.get(b"ColorSpace").map(|cs| doc.resolve(cs)).as_deref() {
         Some(Object::Array(a)) => match a.first().and_then(Object::as_name) {
-            Some(b"Indexed" | b"I") => false,
             Some(b"Separation" | b"DeviceN") => d1 > d0,
             _ => d1 < d0,
         },
@@ -648,8 +649,9 @@ fn dark_is_one(doc: &Document, d: &Dict) -> bool {
 /// `w` × `h` 1-bit rows (each starting on a new byte) averaged down to `nw` × `nh`, no larger:
 /// each new pixel takes the sample that covers more of its area, and the dark one when the two tie
 /// (1 if `dark_is_one`, see [`dark_is_one`]), so a dark line half a new pixel wide stays. `None`
-/// when the rows are short or the new size isn't smaller in both directions or empty.
-pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dark_is_one: bool) -> Option<Vec<u8>> {
+/// when the rows are short or the new size isn't smaller in both directions or empty. Also says
+/// how many new pixels cover both samples.
+pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dark_is_one: bool) -> Option<(Vec<u8>, u64)> {
     if nw == 0 || nh == 0 || nw > w || nh > h {
         return None;
     }
@@ -662,6 +664,7 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
     let overlap = |a0: u64, a1: u64, b0: u64, b1: u64| a1.min(b1).saturating_sub(a0.max(b0));
     // Per source column, the area its 1 samples cover in the new row.
     let mut ones = vec![0u64; usize::try_from(w).ok()?];
+    let mut mixed = 0u64;
     for j in 0..nh {
         ones.fill(0);
         let (y0, y1) = (j * h, (j + 1) * h);
@@ -683,20 +686,23 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
             // Against what the 0 samples cover: covered is at most w·h, which can't overflow
             // (w·h < 2^64 for u32 sizes).
             let zeros = w * h - covered;
+            mixed += u64::from(covered > 0 && zeros > 0);
             if covered > zeros || (dark_is_one && covered == zeros) {
                 let i = usize::try_from(i).ok()?;
                 *out_row.get_mut(i / 8)? |= 0x80 >> (i % 8);
             }
         }
     }
-    Some(out)
+    Some((out, mixed))
 }
 
 /// A black-and-white image (see [`one_bit`]) resampled and stored again per `settings`, if that is
 /// smaller as stored; `ppi` is its effective resolution. Also says whether it was resampled.
 ///
 /// - **Resampled** ([`downsample_bits`]) when its resolution is above `above_ppi`, to `target_ppi`,
-///   unless it has a soft mask, whose own size would then have to follow.
+///   unless it has a soft mask, whose own size would then have to follow, or is a halftone or a
+///   dither: most of its new pixels would cover both black and white, and taking the sample that
+///   covers more would turn its tones solid (a 50% screen black, a 25% one white).
 /// - **Stored** as CCITT Group 4 with `CcittG4`, or as 1-bit Flate when that is smaller, which only
 ///   a resampled image or one packed from eight bits may be: a 1-bit image that is only stored again
 ///   becomes Group 4 or stays. With `Retain`, a resampled image keeps its kind of compression
@@ -719,14 +725,31 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     }
     let (data, w, h, eight_bit) = one_bit(doc, s, !retain)?;
     let k = settings.target_ppi / ppi;
+    // `downsample_bits` keeps a counter for each column: no more columns than a fax row may have,
+    // so a hostile strip of 80 million can't make it 640 MB.
+    let narrow = w <= pdfcraft_filters::MAX_CCITT_COLUMNS;
     // At most `w` × `h`, as k < 1: no overflow.
-    let (nw, nh) =
-        if downsample && k < 1.0 { (((f64::from(w) * k).round() as u32).max(1), ((f64::from(h) * k).round() as u32).max(1)) } else { (w, h) };
-    let resampled = (nw, nh) != (w, h);
+    let (nw, nh) = if downsample && narrow && k < 1.0 {
+        (((f64::from(w) * k).round() as u32).max(1), ((f64::from(h) * k).round() as u32).max(1))
+    } else {
+        (w, h)
+    };
+    let averaged = if (nw, nh) != (w, h) {
+        let (out, mixed) = downsample_bits(&data, w, h, nw, nh, dark_is_one(doc, d))?;
+        // A halftone or dither: most new pixels cover both samples. Text covers both only along
+        // its edges.
+        (mixed.saturating_mul(2) <= u64::from(nw) * u64::from(nh)).then_some(out)
+    } else {
+        None
+    };
+    let resampled = averaged.is_some();
+    let (data, nw, nh) = match averaged {
+        Some(out) => (out, nw, nh),
+        None => (data, w, h),
+    };
     if (retain || fax_alone) && !resampled {
         return None;
     }
-    let data = if resampled { downsample_bits(&data, w, h, nw, nh, dark_is_one(doc, d))? } else { data };
     let mut dict = d.clone();
     for key in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
         dict.remove(key);
@@ -931,18 +954,18 @@ mod downsample_tests {
     #[test]
     fn each_new_pixel_takes_the_sample_covering_more_of_it() {
         // 4 × 2 to 2 × 1: three 1s of four on the left, none on the right.
-        assert_eq!(downsample_bits(&[0b1100_0000, 0b1000_0000], 4, 2, 2, 1, false), Some(vec![0b1000_0000]));
+        assert_eq!(downsample_bits(&[0b1100_0000, 0b1000_0000], 4, 2, 2, 1, false).map(|(out, _)| out), Some(vec![0b1000_0000]));
         // A tie gives the dark sample: 0, black in grey, so a black line half a new pixel wide
         // stays (the second of four white columns is black); a white one that thin on black doesn't.
-        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1, false), Some(vec![0b0100_0000]));
-        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1, false), Some(vec![0]));
+        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1, false).map(|(out, _)| out), Some(vec![0b0100_0000]));
+        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1, false).map(|(out, _)| out), Some(vec![0]));
         // With 1 the dark sample (an inverting decode array, a separation), that line is a 1.
-        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1, true), Some(vec![0b1000_0000]));
-        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1, true), Some(vec![0b1100_0000]));
+        assert_eq!(downsample_bits(&[0b0100_0000, 0b0100_0000], 4, 2, 2, 1, true).map(|(out, _)| out), Some(vec![0b1000_0000]));
+        assert_eq!(downsample_bits(&[0b1011_0000, 0b1011_0000], 4, 2, 2, 1, true).map(|(out, _)| out), Some(vec![0b1100_0000]));
         // The same size gives the same bits; padding bits are 0.
-        assert_eq!(downsample_bits(&[0b1010_1111], 3, 1, 3, 1, false), Some(vec![0b1010_0000]));
+        assert_eq!(downsample_bits(&[0b1010_1111], 3, 1, 3, 1, false).map(|(out, _)| out), Some(vec![0b1010_0000]));
         // 3 to 2 across: the middle column counts half to each new one.
-        assert_eq!(downsample_bits(&[0b1100_0000], 3, 1, 2, 1, false), Some(vec![0b1000_0000]));
+        assert_eq!(downsample_bits(&[0b1100_0000], 3, 1, 2, 1, false).map(|(out, _)| out), Some(vec![0b1000_0000]));
     }
 
     /// The dark sample: 0 in grey and of an image mask, 1 in a separation, each the other way round
@@ -971,7 +994,7 @@ mod downsample_tests {
             (vec![separation.clone()], true),
             (vec![separation, inverted.clone()], false),
             (vec![indexed.clone()], false),
-            (vec![indexed, inverted], false),
+            (vec![indexed, inverted], true),
             (vec![("ColorSpace", Object::name("DeviceGray")), ("Decode", Object::Array(vec![Object::name("x"), 0.into()]))], false),
         ] {
             assert_eq!(dark_is_one(&doc, &image(&entries)), dark_one, "{entries:?}");
@@ -980,11 +1003,11 @@ mod downsample_tests {
 
     #[test]
     fn what_it_cannot_resample_is_none() {
-        assert_eq!(downsample_bits(&[0; 2], 4, 2, 5, 1, false), None, "wider");
-        assert_eq!(downsample_bits(&[0; 2], 4, 2, 2, 3, false), None, "taller");
-        assert_eq!(downsample_bits(&[0; 2], 4, 2, 0, 1, false), None);
-        assert_eq!(downsample_bits(&[0; 1], 4, 2, 2, 1, false), None, "short rows");
-        assert_eq!(downsample_bits(&[], u32::MAX, u32::MAX, 1, 1, true), None);
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 5, 1, false).map(|(out, _)| out), None, "wider");
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 2, 3, false).map(|(out, _)| out), None, "taller");
+        assert_eq!(downsample_bits(&[0; 2], 4, 2, 0, 1, false).map(|(out, _)| out), None);
+        assert_eq!(downsample_bits(&[0; 1], 4, 2, 2, 1, false).map(|(out, _)| out), None, "short rows");
+        assert_eq!(downsample_bits(&[], u32::MAX, u32::MAX, 1, 1, true).map(|(out, _)| out), None);
     }
 
     proptest::proptest! {
@@ -1002,8 +1025,8 @@ mod downsample_tests {
             let (nw, nh) = (1 + (f64::from(w - 1) * nw_part) as u32, 1 + (f64::from(h - 1) * nh_part) as u32);
             let len = (w as usize).div_ceil(8) * h as usize;
             let data: Vec<u8> = seed.iter().cycle().take(len).copied().collect();
-            proptest::prop_assert_eq!(downsample_bits(&data, w, h, nw, nh, dark_one), Some(naive(&data, w, h, nw, nh, dark_one)));
-            let white = downsample_bits(&vec![0xFF; len], w, h, nw, nh, dark_one).unwrap();
+            proptest::prop_assert_eq!(downsample_bits(&data, w, h, nw, nh, dark_one).map(|(out, _)| out), Some(naive(&data, w, h, nw, nh, dark_one)));
+            let white = downsample_bits(&vec![0xFF; len], w, h, nw, nh, dark_one).map(|(out, _)| out).unwrap();
             proptest::prop_assert_eq!(white, naive(&vec![0xFF; len], w, h, nw, nh, dark_one));
             proptest::prop_assert!(naive(&vec![0xFF; len], w, h, nw, nh, dark_one).iter().any(|b| *b != 0));
         }
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index ea2961513b..4efe4072d2 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -929,6 +929,96 @@ fn black_and_white_images_above_450_ppi_are_averaged_down_to_300() {
     assert!(differ * 200 < before.len(), "{differ} of {} channel values differ visibly", before.len());
 }
 
+/// Monochrome downsampling leaves a halftone or a dither at its resolution, as most new pixels
+/// would cover both black and white and taking the sample covering more would turn its tones
+/// solid: a 50% checkerboard, a 25% ordered dither and an error-diffused one, each at 600 ppi.
+/// Text at 600 ppi, which covers both only along its edges, is averaged down. Rows no wider than
+/// a fax row (`MAX_CCITT_COLUMNS`) are averaged down too, but not one column wider: the averaging
+/// keeps a counter for each column.
+#[test]
+fn monochrome_downsampling_leaves_halftones_and_overwide_rows_at_their_resolution() {
+    let (w, h) = (1200u32, 480u32);
+    let stride = (w as usize).div_ceil(8);
+    let pattern = |white: &dyn Fn(usize, usize) -> bool| {
+        let mut data = vec![0u8; stride * h as usize];
+        for y in 0..h as usize {
+            for x in 0..w as usize {
+                if white(x, y) {
+                    data[y * stride + x / 8] |= 0x80 >> (x % 8);
+                }
+            }
+        }
+        data
+    };
+    let diffused = dithered(w, h);
+    let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
+    let mut doc = Document::new_empty();
+    let text = mono_image(&mut doc, w, h, &bilevel(w, h, false), None, &grey);
+    let halftones =
+        [pattern(&|x, y| (x + y) % 2 == 0), pattern(&|x, y| x % 2 == 1 || y % 2 == 1), pattern(&|x, y| diffused[y * w as usize + x] == 255)]
+            .map(|data| mono_image(&mut doc, w, h, &data, None, &grey));
+    // 144 × 57.6 pt is 600 ppi.
+    let names = ["T", "A", "B", "C"];
+    let content: String = (0..4).map(|i| format!("q 144 0 0 57.6 {} 600 cm /{} Do Q ", 6 + 150 * i, names[i])).collect();
+    page(&mut doc, &names.into_iter().zip([text, halftones[0], halftones[1], halftones[2]]).collect::<Vec<_>>(), &content);
+    optimize(&mut doc, &Settings::default()).unwrap();
+    let size = |r: ObjRef| {
+        let d = stream(&doc, r).dict;
+        (d.int(b"Width"), d.int(b"Height"))
+    };
+    assert_eq!(size(text), (Some(600), Some(240)), "text");
+    for (i, r) in halftones.iter().enumerate() {
+        assert_eq!(size(*r), (Some(1200), Some(480)), "halftone {i}");
+    }
+
+    for (columns, resampled) in [(pdfcraft_filters::MAX_CCITT_COLUMNS, 1), (pdfcraft_filters::MAX_CCITT_COLUMNS + 1, 0)] {
+        let mut doc = Document::new_empty();
+        let white = vec![0xFF; (columns as usize).div_ceil(8) * 2];
+        let img = mono_image(&mut doc, columns, 2, &white, None, &grey);
+        // Far above 450 ppi both ways.
+        page(&mut doc, &[("A", img)], "q 612 0 0 0.1 0 400 cm /A Do Q");
+        let r = optimize(&mut doc, &Settings::default()).unwrap();
+        assert_eq!(r.images_resampled, resampled, "{columns} columns: {r:?}");
+    }
+}
+
+/// A fax image behind a decompression bomb is left alone: the filters before its decoder may
+/// produce no more than a fax code of its size can take (about a byte a pixel), not the 1 GiB
+/// limit. Here a Group 4 page at 600 ppi behind Flate, with four megabytes of zeros after its
+/// code; without them it is averaged down.
+#[test]
+fn a_fax_image_behind_a_decompression_bomb_is_left_alone() {
+    let (w, h) = (1200u32, 480u32);
+    let g4 = pdfcraft_filters::encode_g4(&bilevel(w, h, false), w, h).unwrap();
+    for padding in [0, 4 << 20] {
+        let mut doc = Document::new_empty();
+        let mut code = g4.clone();
+        code.resize(g4.len() + padding, 0);
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("CCITTFaxDecode")]));
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(-1));
+        parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+        d.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Null, Object::Dict(parms)]));
+        let img = doc.add(Object::Stream(Stream::from_raw(d, pdfcraft_filters::encode_flate(&code))));
+        // 144 × 57.6 pt is 600 ppi.
+        page(&mut doc, &[("A", img)], "q 144 0 0 57.6 20 600 cm /A Do Q");
+        let before = stream(&doc, img).raw;
+        let r = optimize(&mut doc, &Settings::default()).unwrap();
+        if padding == 0 {
+            assert_eq!(r.images_resampled, 1, "{r:?}");
+        } else {
+            assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "{r:?}");
+            assert_eq!(stream(&doc, img).raw, before);
+        }
+    }
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();

From 450c327c6bcb1abad47d4f9fd52b1f8b34d11799 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 16:45:43 +0100
Subject: [PATCH 116/132] M11: black-and-white RGB stays RGB where grey would
 be drawn otherwise
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Packed to one bit, black-and-white DeviceRGB became DeviceGray. Where
  /DefaultGray or /DefaultRGB is in force (ISO 32000-2 §8.6.5.6), that
  drew it otherwise: through DefaultGray as grey, or no longer through
  DefaultRGB. The page walk now notes the images drawn, on any use, where
  a page's or form's resources (an enclosing one's included) name
  either, and those stay RGB. When a use couldn't be followed, every
  image counts as such.
- One whose soft mask has a /Matte stays RGB too: the matte has one
  number for each of the parent's components, three, and grey has one.
- The optimize README, the mono-compression parity note and doc_reduce's
  description said Group 3 to Group 4 wasn't done yet, that only images
  packed from eight bits could become Flate, and that the colour space
  and decode array always stay. They now match the code.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/automation/src/tools.rs    |  2 +-
 crates/optimize/README.md         | 30 +++++-----
 crates/optimize/src/images.rs     | 75 +++++++++++++++++-------
 crates/optimize/tests/optimize.rs | 97 +++++++++++++++++++++++++++++++
 parity/acrobat-features.toml      |  2 +-
 5 files changed, 169 insertions(+), 37 deletions(-)

diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 3f53a07ff9..838fa57ab4 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1332,7 +1332,7 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["from"],
         )),
-        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images averaged down to 300 ppi above 450 ppi and each stored as CCITT Group 4 (or 1-bit Flate, once resampled) whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
+        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images averaged down to 300 ppi above 450 ppi and each stored as CCITT Group 4 (or 1-bit Flate, once resampled or packed from more bits) whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
             .cmd("optimize.reduce")
             .with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
         t("doc_initial_view", "Initial view", "Read or change how the document opens (Document Properties ▸ Initial View) and its reading options: navigation (page, bookmarks, pages, attachments, layers), layout (default, single, continuous, two_up, two_up_continuous, two_up_cover, two_up_continuous_cover), magnification (default, actual, fit_page, fit_width, fit_height, fit_visible, or a percentage), page, window options (fit_window, center_window, full_screen, display_title), interface options (hide_menubar, hide_toolbar, hide_window_ui), language and binding (left, right). Only the given ones change; returns the result. Undoable.").with(schema(
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 0b159229a0..e26ceba945 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -45,12 +45,15 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   row, not as T.4 sends them, is read as PdfCraft draws it, which at `/K 0` may be other rows than
   were coded, and an image stored again keeps them). Packed to one bit first, unless a colour-key `/Mask` is in the image's
   own values: eight-bit grey of only 0 and 255; eight-bit `DeviceRGB` of only black and white,
-  which becomes `DeviceGray` (not calibrated RGB or RGB with a profile); and an indexed image of 2,
-  4 or 8 bits that uses only palette entries 0 and 1, which keeps its palette, whatever its two
-  colours. A decode array stays when it means the same at one bit (grey's, or RGB's if the same
-  for each component, as grey's); otherwise the image is left alone. The grey or colour settings
-  take a packed image instead when they make it smaller still, its soft mask counted (resampled
-  with it there, kept as it is here), as they can a dithered scan by downsampling it to JPEG.
+  which becomes `DeviceGray` (not calibrated RGB or RGB with a profile, nor one drawn where
+  `/DefaultGray` or `/DefaultRGB` is in force, which would then draw it otherwise, nor one whose
+  soft mask has a `/Matte`); and an indexed image of 2, 4 or 8 bits that uses only palette entries
+  0 and 1, which keeps its palette, whatever its two colours. A decode array stays when it means
+  the same at one bit (grey's, or RGB's if the same for each component, as grey's), and an indexed
+  image's default one goes, as the default at one bit; otherwise the image is left alone. The grey
+  or colour settings take a packed image instead when they make it smaller still, its soft mask
+  counted (resampled with it there, kept as it is here), as they can a dithered scan by
+  downsampling it to JPEG.
   - **Downsampling:** one whose effective resolution is above `above_ppi` is averaged down to
     `target_ppi`: each new pixel takes the sample covering more of its area, and the dark one on a
     tie, so a dark line half a new pixel wide stays: black in grey and the painted part of an image
@@ -62,17 +65,18 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     a fax row (`pdfcraft_filters::MAX_CCITT_COLUMNS`), as the averaging keeps a counter for each
     column. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
   - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
-    smaller, which only a resampled image or one packed from eight bits may be: a 1-bit image that
+    smaller, which only a resampled image or one packed from more bits may be: a 1-bit image that
     is only stored again becomes Group 4 or stays. Group 4 alone is only decoded to be resampled;
     Group 3, or Group 4 inside another filter such as `ASCII85Decode`, is stored again as Group 4
     alone when that is smaller. With Retain, a resampled image keeps its kind of compression (CCITT,
-    or Flate) and nothing else changes; eight-bit grey is then left to the grey settings. Every
-    change is kept only when it is smaller as stored.
+    or Flate) and nothing else changes; an image of more bits is then left to the grey or colour
+    settings. Every change is kept only when it is smaller as stored.
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
-    space, decode array and `/Mask` stay. Group 4 wins on scans, whose ragged edges defeat Flate;
-    on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, a lone Group 3 image to
-    Group 4 without resampling (one behind another filter is stored again as Group 4), inline images, an image's own `/SMask` or `/Mask` image (only images drawn
-    on a page are visited), and Group 4 for rows wider than 32,767 samples.
+    space, decode array and `/Mask` stay, but for packed RGB, which becomes grey with one decode
+    pair. Group 4 wins on scans, whose ragged edges defeat Flate; on clean computer-drawn 1-bit
+    art Flate can be smaller. Not yet: JBIG2, inline images, an image's own `/SMask` or `/Mask`
+    image (only images drawn on a page are visited), and Group 4 for rows wider than 32,767
+    samples.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 8b55d4aeb2..71fa945da4 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -41,9 +41,10 @@ struct Walk<'a> {
     doc: &'a Document,
     /// The forms being walked right now, outermost first: a form drawing one of these is a cycle.
     path: Vec<ObjRef>,
-    /// Forms with their own resources already walked, by the linear part of their matrix. Drawing
-    /// one again at the same scale (only moved) can't change any image's resolution.
-    walked: HashSet<(ObjRef, [u64; 4])>,
+    /// Forms with their own resources already walked, by the linear part of their matrix and
+    /// whether default colour spaces were in force. Drawing one again at the same scale (only
+    /// moved) can't change any image's resolution.
+    walked: HashSet<(ObjRef, [u64; 4], bool)>,
     /// Forms walked at least once.
     seen: HashSet<ObjRef>,
     rewalks: usize,
@@ -52,13 +53,17 @@ struct Walk<'a> {
     /// False once a use may have been missed (depth or work limit).
     complete: bool,
     out: HashMap<ObjRef, f64>,
+    /// Images drawn at least once where `/DefaultGray` or `/DefaultRGB` is in force.
+    defaults: HashSet<ObjRef>,
 }
 
 impl Walk<'_> {
     /// Walk one content stream, recording each image's displayed resolution (pixels per inch, the
-    /// smaller of the two axes) and descending into form XObjects.
-    fn content(&mut self, data: &[u8], resources: &Dict, ctm: Matrix) {
+    /// smaller of the two axes) and descending into form XObjects. `defaults`: an enclosing
+    /// stream's resources remap a device colour space.
+    fn content(&mut self, data: &[u8], resources: &Dict, ctm: Matrix, defaults: bool) {
         let doc = self.doc;
+        let defaults = defaults || remaps_device_spaces(doc, resources);
         let xobjects = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
         let mut stack = vec![ctm];
         for op in pdfcraft_content::parse(data).ops {
@@ -90,8 +95,11 @@ impl Walk<'_> {
                                 let e = self.out.entry(r).or_insert(f64::INFINITY);
                                 *e = e.min(ppi);
                             }
+                            if defaults {
+                                self.defaults.insert(r);
+                            }
                         }
-                        Some(b"Form") => self.form(r, s, resources, top),
+                        Some(b"Form") => self.form(r, s, resources, top, defaults),
                         _ => {}
                     }
                 }
@@ -101,7 +109,7 @@ impl Walk<'_> {
     }
 
     /// Descend into form `r` drawn with `ctm` from a stream whose resources are `resources`.
-    fn form(&mut self, r: ObjRef, s: &Stream, resources: &Dict, ctm: Matrix) {
+    fn form(&mut self, r: ObjRef, s: &Stream, resources: &Dict, ctm: Matrix, defaults: bool) {
         if self.path.contains(&r) {
             return;
         }
@@ -116,7 +124,7 @@ impl Walk<'_> {
         // A form without resources uses its caller's, so the same form can draw other images.
         if own.is_some() {
             let [a, b, c, d, ..] = inner.0;
-            if !self.walked.insert((r, [a.to_bits(), b.to_bits(), c.to_bits(), d.to_bits()])) {
+            if !self.walked.insert((r, [a.to_bits(), b.to_bits(), c.to_bits(), d.to_bits()], defaults)) {
                 return;
             }
         }
@@ -136,17 +144,30 @@ impl Walk<'_> {
             return;
         };
         self.path.push(r);
-        self.content(&data, own.as_ref().unwrap_or(resources), inner);
+        self.content(&data, own.as_ref().unwrap_or(resources), inner, defaults);
         self.path.pop();
     }
 }
 
+/// Whether `resources` remap a device colour space an image may be moved between, so that the
+/// same samples would be drawn otherwise: `/DefaultGray` or `/DefaultRGB` (ISO 32000-2 §8.6.5.6).
+fn remaps_device_spaces(doc: &Document, resources: &Dict) -> bool {
+    let spaces = resources.get(b"ColorSpace").map(|c| doc.resolve(c));
+    spaces.as_deref().and_then(Object::as_dict).is_some_and(|c| c.contains(b"DefaultGray") || c.contains(b"DefaultRGB"))
+}
+
 /// The effective resolution (ppi) of every image drawn by `pages`: the smallest over its uses.
 ///
 /// If forms nest too deeply, are drawn too many times, or a page's content doesn't decode within
 /// its budget, every image is given `INFINITY` (never resampled), since its largest use may be
 /// among those missed.
 pub fn effective_resolutions(doc: &Document, pages: &[ObjRef]) -> HashMap<ObjRef, f64> {
+    walk_pages(doc, pages).0
+}
+
+/// [`effective_resolutions`], and the images drawn where `/DefaultGray` or `/DefaultRGB` is in
+/// force: all of them when a use may have been missed.
+fn walk_pages(doc: &Document, pages: &[ObjRef]) -> (HashMap<ObjRef, f64>, HashSet<ObjRef>) {
     let mut walk = Walk {
         doc,
         path: Vec::new(),
@@ -156,6 +177,7 @@ pub fn effective_resolutions(doc: &Document, pages: &[ObjRef]) -> HashMap<ObjRef
         budget: DecodeBudget::page(),
         complete: true,
         out: HashMap::new(),
+        defaults: HashSet::new(),
     };
     for p in pages {
         let Some(dict) = doc.get(*p).as_dict().cloned() else { continue };
@@ -169,12 +191,13 @@ pub fn effective_resolutions(doc: &Document, pages: &[ObjRef]) -> HashMap<ObjRef
         };
         // Content coordinates are in page units; image resolution is in physical inches.
         let unit = page.user_unit(doc);
-        walk.content(&data, &res, Matrix([unit, 0.0, 0.0, unit, 0.0, 0.0]));
+        walk.content(&data, &res, Matrix([unit, 0.0, 0.0, unit, 0.0, 0.0]), false);
     }
     if !walk.complete {
         walk.out.values_mut().for_each(|v| *v = f64::INFINITY);
+        walk.defaults.extend(walk.out.keys());
     }
-    walk.out
+    (walk.out, walk.defaults)
 }
 
 /// Colour components of a colour space PdfCraft resamples: gray (1) or RGB (3).
@@ -577,11 +600,13 @@ type Pixel = fn(&[u8]) -> Option<bool>;
 ///   - eight-bit `DeviceRGB` whose every pixel is black or white, which becomes `DeviceGray`. A
 ///     decode array the same for all three components becomes that one pair; another stops it.
 ///     Calibrated RGB and RGB with a profile are left out, as the profile could make them other
-///     than black and white;
+///     than black and white; so is one drawn where `/DefaultGray` or `/DefaultRGB` is in force
+///     (`defaults`), which would draw it otherwise as grey, and one whose soft mask has a `/Matte`
+///     of three components;
 ///   - an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1, which stay 0 and
 ///     1 at one bit, whatever their colours, so the colour space stays. A decode array other than
 ///     the default stops it: in index units it would mean something else at one bit.
-fn one_bit(doc: &Document, s: &Stream, pack: bool) -> Option<(Vec<u8>, u32, u32, Option<Dict>)> {
+fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool) -> Option<(Vec<u8>, u32, u32, Option<Dict>)> {
     let d = &s.dict;
     // Through u32 first, as everywhere here, so the product can't overflow.
     let (w, h) = (u32::try_from(d.int(b"Width")?).ok()?, u32::try_from(d.int(b"Height")?).ok()?);
@@ -633,6 +658,10 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool) -> Option<(Vec<u8>, u32, u32,
             })
         }
         Object::Name(name) if matches!(name.as_slice(), b"DeviceRGB" | b"RGB") && bits == Some(8) => {
+            let matte = |m: &Object| matches!(&*doc.resolve(m), Object::Stream(m) if m.dict.contains(b"Matte"));
+            if defaults || d.get(b"SMask").is_some_and(matte) {
+                return None;
+            }
             match decode.as_deref() {
                 None => {}
                 Some(Object::Array(v)) if v.len() == 6 && v.chunks(2).all(|pair| Some(pair) == v.get(..2)) => {
@@ -768,7 +797,8 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
 }
 
 /// A black-and-white image (see [`one_bit`]) resampled and stored again per `settings`, if that is
-/// smaller as stored; `ppi` is its effective resolution. Also says whether it was resampled.
+/// smaller as stored; `ppi` is its effective resolution, and `defaults` says it is drawn where
+/// `/DefaultGray` or `/DefaultRGB` is in force. Also says whether it was resampled.
 ///
 /// - **Resampled** ([`downsample_bits`]) when its resolution is above `above_ppi`, to `target_ppi`,
 ///   unless it has a soft mask, whose own size would then have to follow, or is a halftone or a
@@ -781,9 +811,10 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
 ///   (CCITT, or Flate), and nothing else changes: an image of more bits stays as it is, for the
 ///   grey or colour settings.
 ///
-/// The samples keep their meaning, so the decode array and `/Mask` stay as they are, and the
-/// colour space too, but for black-and-white RGB, which becomes grey.
-fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option<(Stream, bool)> {
+/// The samples keep their meaning, so the colour space, decode array and `/Mask` stay, but for
+/// black-and-white RGB, which becomes grey with one decode pair, and an indexed image's default
+/// decode array, which goes as the default at one bit.
+fn mono(doc: &Document, s: &Stream, ppi: f64, defaults: bool, settings: &MonoSettings) -> Option<(Stream, bool)> {
     let d = &s.dict;
     let downsample = settings.downsample && ppi.is_finite() && ppi > settings.above_ppi && settings.target_ppi > 0.0 && !d.contains(b"SMask");
     let retain = settings.compression == MonoCompression::Retain;
@@ -796,7 +827,7 @@ fn mono(doc: &Document, s: &Stream, ppi: f64, settings: &MonoSettings) -> Option
     if (retain || g4_alone) && !downsample {
         return None;
     }
-    let (data, w, h, packed) = one_bit(doc, s, !retain)?;
+    let (data, w, h, packed) = one_bit(doc, s, !retain, defaults)?;
     let packed_from_more = packed.is_some();
     let k = settings.target_ppi / ppi;
     // `downsample_bits` keeps a counter for each column: no more columns than a fax row may have,
@@ -858,7 +889,7 @@ pub(crate) fn run(
     report: &mut Report,
     progress: &mut dyn FnMut(Stage) -> bool,
 ) -> Result<(), OptimizeError> {
-    let ppi = effective_resolutions(doc, pages);
+    let (ppi, defaults) = walk_pages(doc, pages);
     // Soft masks are processed with their image, not on their own.
     let masks: HashSet<ObjRef> = ppi
         .keys()
@@ -877,10 +908,10 @@ pub(crate) fn run(
         let obj = doc.get(r);
         let Object::Stream(s) = &*obj else { continue };
         report.images += 1;
-        // Packed from more bits a sample, it is lossless at one bit, but the grey settings can
-        // make it smaller still (below).
+        // Packed from more bits a sample, it is lossless at one bit, but the grey or colour
+        // settings can make it smaller still (below).
         let packed_from_more = s.dict.int(b"BitsPerComponent").is_some_and(|b| b > 1);
-        let (packed, mono) = match mono(doc, s, ppi, &settings.mono) {
+        let (packed, mono) = match mono(doc, s, ppi, defaults.contains(&r), &settings.mono) {
             Some(m) if packed_from_more => (Some(m), None),
             m => (None, m),
         };
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index cc8f2f4683..259e11c771 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -918,6 +918,103 @@ fn rgb_and_two_colour_indexed_black_and_white_images_become_one_bit() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// Black-and-white RGB stays RGB where grey would be drawn otherwise: drawn, on any of its uses,
+/// where `/DefaultGray` or `/DefaultRGB` is in force (ISO 32000-2 §8.6.5.6), from a page's
+/// resources or a form's own, as grey would then go through DefaultGray, or no longer through
+/// DefaultRGB; or with a soft mask whose `/Matte` has three components, one for each of RGB's. A
+/// form drawn where they are in force counts too, though it has resources of its own. The same
+/// image drawn plainly, or with a soft mask and no `/Matte`, becomes grey.
+#[test]
+fn black_and_white_rgb_stays_rgb_where_grey_would_be_drawn_otherwise() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200u32, 480u32);
+    let rgb_data = samples_of(&bilevel(w, h, false), w, h, [&[0, 0, 0], &[255, 255, 255]], 8);
+    let image = |doc: &mut Document, cs: &str, data: &[u8], entries: &[(&str, Object)]| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), Object::name(cs));
+        for (k, v) in entries {
+            d.set(k.as_bytes().to_vec(), v.clone());
+        }
+        doc.add(Object::Stream(Stream::flate(d, data)))
+    };
+    let opaque = vec![255u8; (w * h) as usize];
+    let plain_mask = image(&mut doc, "DeviceGray", &opaque, &[]);
+    let matte_mask = image(&mut doc, "DeviceGray", &opaque, &[("Matte", Object::Array(vec![0.into(); 3]))]);
+    let plain = image(&mut doc, "DeviceRGB", &rgb_data, &[]);
+    let masked = image(&mut doc, "DeviceRGB", &rgb_data, &[("SMask", Object::Ref(plain_mask))]);
+    let matted = image(&mut doc, "DeviceRGB", &rgb_data, &[("SMask", Object::Ref(matte_mask))]);
+    let [under_gray, under_rgb, shared, in_form, nested] = [(); 5].map(|_| image(&mut doc, "DeviceRGB", &rgb_data, &[]));
+    let mut white_point = Dict::new();
+    white_point.set(b"WhitePoint".to_vec(), Object::Array(vec![Object::Real(0.9505), 1.into(), Object::Real(1.089)]));
+    let spaces = |key: &str| {
+        let family = if key == "DefaultGray" { "CalGray" } else { "CalRGB" };
+        let mut c = Dict::new();
+        c.set(key.as_bytes().to_vec(), Object::Array(vec![Object::name(family), Object::Dict(white_point.clone())]));
+        Object::Dict(c)
+    };
+    let draw = |names: &[&str]| names.iter().enumerate().map(|(i, n)| format!("q 200 0 0 80 6 {} cm /{n} Do Q ", 690 - 100 * i)).collect::<String>();
+    let form = |doc: &mut Document, im: ObjRef, spaces: Option<Object>| {
+        let mut xobjects = Dict::new();
+        xobjects.set(b"Im".to_vec(), Object::Ref(im));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+        if let Some(spaces) = spaces {
+            resources.set(b"ColorSpace".to_vec(), spaces);
+        }
+        let mut f = Dict::new();
+        f.set(b"Type".to_vec(), Object::name("XObject"));
+        f.set(b"Subtype".to_vec(), Object::name("Form"));
+        f.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 612.into(), 792.into()]));
+        f.set(b"Resources".to_vec(), Object::Dict(resources));
+        doc.add(Object::Stream(Stream::from_raw(f, draw(&["Im"]).into_bytes())))
+    };
+    // Drawn plainly first, then where DefaultGray is in force: the second walk must happen.
+    let plain_form = form(&mut doc, nested, None);
+    page(&mut doc, &[("A", plain), ("B", masked), ("C", matted), ("D", shared), ("E", plain_form)], &draw(&["A", "B", "C", "D", "E"]));
+    for (key, xobjects) in [("DefaultGray", vec![("A", under_gray), ("B", shared), ("C", plain_form)]), ("DefaultRGB", vec![("A", under_rgb)])] {
+        let names: Vec<&str> = xobjects.iter().map(|(n, _)| *n).collect();
+        let p = page(&mut doc, &xobjects, &draw(&names));
+        doc.update_dict(p, |d| {
+            let mut res = d.get(b"Resources").and_then(Object::as_dict).cloned().unwrap();
+            res.set(b"ColorSpace".to_vec(), spaces(key));
+            d.set(b"Resources".to_vec(), Object::Dict(res));
+        })
+        .unwrap();
+    }
+    // A form with its own resources, DefaultGray among them, on a page without any.
+    let gray_form = form(&mut doc, in_form, Some(spaces("DefaultGray")));
+    page(&mut doc, &[("F", gray_form)], "/F Do");
+    let kept = [under_gray, under_rgb, shared, in_form, nested, matted];
+    let before = kept.map(|r| stream(&doc, r));
+    // Colour and grey settings that leave images alone, so only this conversion acts.
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    let settings = Settings { color: keep, gray: keep, ..Settings::default() };
+    let r = optimize(&mut doc, &settings).unwrap();
+    assert_eq!((r.images_resampled, r.images_recompressed), (0, 2), "{r:?}");
+    for i in [plain, masked] {
+        let s = stream(&doc, i);
+        assert_eq!((s.dict.get(b"ColorSpace"), s.dict.int(b"BitsPerComponent")), (Some(&Object::name("DeviceGray")), Some(1)), "{i:?}");
+    }
+    for (i, b) in kept.iter().zip(&before) {
+        let s = stream(&doc, *i);
+        assert_eq!((&s.dict, &s.raw), (&b.dict, &b.raw), "{i:?}");
+    }
+
+    // A use that couldn't be followed (forms nested too deep) may be where DefaultGray is in force.
+    let mut doc = Document::new_empty();
+    let img = image(&mut doc, "DeviceRGB", &rgb_data, &[]);
+    let deep = nested_forms(&mut doc, img, 13);
+    page(&mut doc, &[("Im", img), ("F", deep)], &draw(&["Im", "F"]));
+    let before = stream(&doc, img);
+    optimize(&mut doc, &settings).unwrap();
+    assert_eq!(stream(&doc, img).raw, before.raw, "a use not followed");
+}
+
 /// Black-and-white images above 450 ppi are averaged down to 300 ppi, by default: 1-bit Flate, CCITT
 /// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays), and
 /// eight-bit grey and RGB of only black and white (the RGB also the other way round, with a decode
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index bc4c68d538..048afd9a36 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB and RGB with a profile aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn where /DefaultGray or /DefaultRGB is in force, and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 68c6d4b052e17943bedec0461a295f29362f4718 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:29:04 +0100
Subject: [PATCH 117/132] M11: redaction's decode allowance takes ASCIIHex text
 broken into lines; tests for the bounds

- Redaction decodes an image no further than twice its raster plus a
  byte a row, meant for ASCIIHex text under Flate; hex text broken into
  lines is a little more, so such an image was removed whole instead of
  cleared (already so on main). It is three bytes for each now, as the
  optimizer allows.
- Tests: grey stored as hex text in lines under Flate, and RGB behind a
  filter array (which a fax image's bound would refuse), are cleared;
  decoded_image_within gives a fax image no more rows than its bound
  holds.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/cos/src/document/tests.rs |  7 +++++++
 crates/redact/src/image.rs       |  5 +++--
 crates/redact/src/tests.rs       | 33 ++++++++++++++++++++++++++++++++
 3 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index aeb5184729..53941f02b1 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -118,6 +118,13 @@ fn fax_images_decode_with_their_parameters() {
         [0b0000_0111, 0b1100_0000, 0b0000_0111, 0b1100_0000, 0b0000_0111, 0b1100_0000]
     );
     assert_eq!(image(&doc, Some(Object::Dict(parms.clone())), 10, 2).unwrap(), bits[..4], "at most /Height rows");
+    // Within a bound: no more rows than it holds.
+    let mut bounded = Dict::new();
+    bounded.set(b"Width".to_vec(), Object::Int(10));
+    bounded.set(b"Height".to_vec(), Object::Int(3));
+    bounded.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+    bounded.set(b"DecodeParms".to_vec(), Object::Dict(parms.clone()));
+    assert_eq!(doc.decoded_image_within(&Stream::from_raw(bounded, coded.clone()), 5).unwrap(), bits[..4], "two rows of two bytes in five");
     let mut by_reference = Dict::new();
     by_reference.set(b"K".to_vec(), Object::Ref(doc.add(Object::Int(-1))));
     by_reference.set(b"Columns".to_vec(), Object::Ref(doc.add(Object::Int(10))));
diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index a1bf022df1..297b3510c4 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -86,14 +86,15 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     let row_bits = row.checked_mul(8)?;
     bytes.checked_mul(8)?;
     // Decode no further than the raster can need: a filter stage may legitimately produce up to
-    // twice it (ASCIIHex text under Flate) plus a PNG predictor's byte per row. A fax image's
+    // three bytes for each of it and a PNG predictor's byte per row (ASCIIHex text under Flate,
+    // two digits a byte broken into lines or spaced), as the optimizer allows. A fax image's
     // code, which the filters before its decoder produce, takes at most about a byte per pixel
     // plus each row's end. Data past that can only be a decompression bomb; the image is then
     // removed whole.
     let allowance = if is_fax {
         w.checked_mul(h)?.checked_add(h.checked_mul(4)?)?.checked_add(4096)?
     } else {
-        bytes.checked_add(h)?.checked_mul(2)?.checked_add(4096)?
+        bytes.checked_add(h)?.checked_mul(3)?.checked_add(4096)?
     };
     // Through the document, which reads `/DecodeParms` given by reference (`Stream::decoded*`
     // alone would skip such a predictor, and the cleared bytes would then miss the covered pixels).
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index c6885eaf11..33dc675cdd 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -626,6 +626,39 @@ fn a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed() {
     }
 }
 
+/// Images whose data is more than twice their raster before its last filter are cleared, not
+/// taken for decompression bombs: grey stored as ASCIIHex text broken into lines under Flate (two
+/// digits a byte and a line break every 64), and RGB behind an array of filters, which a fax
+/// image's bound (a byte a pixel) would refuse.
+#[test]
+fn images_behind_ascii_hex_in_lines_or_a_filter_array_are_cleared() {
+    let (w, h) = (1000usize, 200usize);
+    let grey: Vec<u8> = (0..w * h).map(|i| (i % 251) as u8).collect();
+    let digits: Vec<u8> = grey.iter().flat_map(|b| format!("{b:02X}").into_bytes()).collect();
+    let mut lines: Vec<u8> = digits.chunks(64).flat_map(|line| line.iter().copied().chain(*b"\n")).collect();
+    lines.push(b'>');
+    let rgb: Vec<u8> = (0..100 * 100 * 3).map(|i| (i % 253) as u8).collect();
+    let rgb_hex: Vec<u8> = pdfcraft_filters::encode_flate(&rgb).iter().flat_map(|b| format!("{b:02x}").into_bytes()).chain(*b">").collect();
+    for (dict, data) in [
+        (
+            format!(
+                "/Type /XObject /Subtype /Image /Width {w} /Height {h} /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter [/FlateDecode /ASCIIHexDecode]"
+            ),
+            pdfcraft_filters::encode_flate(&lines),
+        ),
+        (
+            "/Type /XObject /Subtype /Image /Width 100 /Height 100 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter [/ASCIIHexDecode /FlateDecode]"
+                .to_string(),
+            rgb_hex,
+        ),
+    ] {
+        let mut doc = one_page(b"q 100 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(&dict, data)]);
+        mark(&mut doc, 0, &[[0.0, 0.0, 10.0, 10.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        assert_eq!((report.images_cleared, report.images_removed), (1, 0), "{dict}");
+    }
+}
+
 /// A fax image that can't be decoded in full is removed whole, as any other image is: one whose
 /// code is cut short, and one behind a filter that inflates past what a code for its pixels can
 /// take (a decompression bomb, which `decoded_image` alone would undo up to a gigabyte).

From cb1e573c081bbda5df72f8ecefd759d11cfca03b Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:38:22 +0100
Subject: [PATCH 118/132] M11: tests for packing in other one-component spaces,
 mixed Group 3 and Flate after resampling

Mutation testing found three behaviours no test held:
- eight-bit black-and-white in calibrated grey, an ICC profile of one
  component or a separation is packed, each keeping its colour space,
  and calibrated RGB of only 0 and 1 isn't (taking every array colour
  space for an indexed one passed every test);
- mixed Group 3 (/K 1, with end-of-line codes) is stored again as
  Group 4 (taking /K above 0 for Group 4 passed);
- a resampled Group 4 image of vertical stripes is stored as 1-bit Flate,
  which is smaller (ruling Flate out for any CCITT image passed).

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/tests/optimize.rs | 152 +++++++++++++++++++++++-------
 1 file changed, 120 insertions(+), 32 deletions(-)

diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 259e11c771..528f43d5fe 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -918,6 +918,83 @@ fn rgb_and_two_colour_indexed_black_and_white_images_become_one_bit() {
     assert!(render(&doc) == before, "the page looks the same");
 }
 
+/// Eight-bit black-and-white images in other one-component spaces are packed too: calibrated
+/// grey, an ICC profile of one component, a separation, each keeping its colour space. Calibrated
+/// RGB whose samples are only 0 and 1 is no indexed image, and stays as it is.
+#[test]
+fn eight_bit_black_and_white_in_other_one_component_spaces_is_packed() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200u32, 480u32);
+    let text = bilevel(w, h, false);
+    let image = |doc: &mut Document, data: &[u8], cs: Object| {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), cs);
+        doc.add(Object::Stream(Stream::flate(d, data)))
+    };
+    let mut white_point = Dict::new();
+    white_point.set(b"WhitePoint".to_vec(), Object::Array(vec![Object::Real(0.9505), 1.into(), Object::Real(1.089)]));
+    let mut profile = Dict::new();
+    profile.set(b"N".to_vec(), Object::Int(1));
+    let profile = doc.add(Object::Stream(Stream::from_raw(profile, Vec::new())));
+    let mut tint = Dict::new();
+    tint.set(b"FunctionType".to_vec(), Object::Int(2));
+    tint.set(b"Domain".to_vec(), Object::Array(vec![0.into(), 1.into()]));
+    tint.set(b"N".to_vec(), Object::Int(1));
+    let spaces = [
+        Object::Array(vec![Object::name("CalGray"), Object::Dict(white_point.clone())]),
+        Object::Array(vec![Object::name("ICCBased"), Object::Ref(profile)]),
+        Object::Array(vec![Object::name("Separation"), Object::name("Spot"), Object::name("DeviceGray"), Object::Dict(tint)]),
+    ];
+    let grey = samples_of(&text, w, h, [&[0], &[255]], 8);
+    let packed = spaces.clone().map(|cs| image(&mut doc, &grey, cs));
+    let cal_rgb = Object::Array(vec![Object::name("CalRGB"), Object::Dict(white_point)]);
+    let cal_rgb = image(&mut doc, &samples_of(&text, w, h, [&[0, 0, 0], &[1, 1, 1]], 8), cal_rgb);
+    let names = ["A", "B", "C", "D"];
+    // 200 × 80 pt is 432 ppi: below where monochrome downsampling starts.
+    let content: String = (0..4).map(|i| format!("q 200 0 0 80 6 {} cm /{} Do Q ", 690 - 100 * i, names[i])).collect();
+    page(&mut doc, &names.into_iter().zip([packed[0], packed[1], packed[2], cal_rgb]).collect::<Vec<_>>(), &content);
+    let untouched = stream(&doc, cal_rgb).raw;
+    // Colour and grey settings that leave images alone, so only the packing acts.
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    optimize(&mut doc, &Settings { color: keep, gray: keep, ..Settings::default() }).unwrap();
+    for (r, cs) in packed.iter().zip(&spaces) {
+        let s = stream(&doc, *r);
+        assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.get(b"ColorSpace")), (Some(1), Some(cs)), "{cs:?}");
+    }
+    assert_eq!(stream(&doc, cal_rgb).raw, untouched, "calibrated RGB");
+}
+
+/// A resampled Group 4 image is stored as 1-bit Flate when that is smaller, as any resampled image
+/// may be: here vertical stripes, whose identical rows Flate takes for almost nothing.
+#[test]
+fn a_resampled_group_4_image_is_stored_as_flate_when_smaller() {
+    let (w, h) = (1200u32, 480u32);
+    let stripes = vec![0x0Fu8; (w as usize).div_ceil(8) * h as usize];
+    let mut doc = Document::new_empty();
+    let mut d = Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w.into()));
+    d.set(b"Height".to_vec(), Object::Int(h.into()));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+    let mut parms = Dict::new();
+    parms.set(b"K".to_vec(), Object::Int(-1));
+    parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+    d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+    let img = doc.add(Object::Stream(Stream::from_raw(d, pdfcraft_filters::encode_g4(&stripes, w, h).unwrap())));
+    // 144 × 57.6 pt is 600 ppi.
+    page(&mut doc, &[("A", img)], "q 144 0 0 57.6 20 600 cm /A Do Q");
+    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(r.images_resampled, 1, "{r:?}");
+    let s = stream(&doc, img);
+    assert_eq!((s.dict.int(b"Width"), s.dict.name(b"Filter")), (Some(600), Some(&b"FlateDecode"[..])));
+}
+
 /// Black-and-white RGB stays RGB where grey would be drawn otherwise: drawn, on any of its uses,
 /// where `/DefaultGray` or `/DefaultRGB` is in force (ISO 32000-2 §8.6.5.6), from a page's
 /// resources or a form's own, as grey would then go through DefaultGray, or no longer through
@@ -1375,7 +1452,7 @@ fn monochrome_images_keep_what_they_should() {
 
 /// `rows` coded as CCITT Group 3, one-dimensional (`/K 0`): each row its runs in turn, white first,
 /// with ITU-T T.4's terminating codes for the few lengths used here.
-fn group_3(rows: &[&[u32]]) -> Vec<u8> {
+fn group_3(rows: &[&[u32]], mixed: bool) -> Vec<u8> {
     let code = |white: bool, run: u32| match (white, run) {
         (true, 0) => "00110101",
         (true, 8) => "10011",
@@ -1386,12 +1463,20 @@ fn group_3(rows: &[&[u32]]) -> Vec<u8> {
         (false, 32) => "000001101010",
         _ => panic!("no code here for a run of {run}"),
     };
-    let bits: String = rows.iter().flat_map(|row| row.iter().enumerate().map(|(i, run)| code(i % 2 == 0, *run))).collect();
+    let mut bits = String::new();
+    for row in rows {
+        // Mixed coding (/K above 0): an end-of-line code, then a 1 bit, the row one-dimensional.
+        if mixed {
+            bits.push_str("0000000000011");
+        }
+        row.iter().enumerate().for_each(|(i, run)| bits.push_str(code(i % 2 == 0, *run)));
+    }
     bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
 }
 
 /// A Group 3 fax image is stored again as Group 4 when that is smaller, the same picture (to the
-/// pixel on the page); with Retain it stays Group 3.
+/// pixel on the page); with Retain it stays Group 3. One-dimensional (/K 0) and mixed (/K 1, with
+/// end-of-line codes) alike.
 #[test]
 fn group_3_fax_images_become_group_4() {
     let (w, h) = (64u32, 64u32);
@@ -1411,38 +1496,41 @@ fn group_3_fax_images_become_group_4() {
         }
         bits.extend(packed);
     }
-    let g3 = group_3(&runs);
-    let p = pdfcraft_filters::CcittParams { k: 0, columns: w.into(), ..Default::default() };
-    assert_eq!(pdfcraft_filters::decode_ccitt(&g3, &p, h).unwrap(), bits, "the Group 3 data is the picture");
+    for k in [0, 1] {
+        let g3 = group_3(&runs, k > 0);
+        let p = pdfcraft_filters::CcittParams { k, columns: w.into(), end_of_line: k > 0, ..Default::default() };
+        assert_eq!(pdfcraft_filters::decode_ccitt(&g3, &p, h).unwrap(), bits, "/K {k}: the Group 3 data is the picture");
 
-    let mut doc = Document::new_empty();
-    let mut d = Dict::new();
-    d.set(b"Subtype".to_vec(), Object::name("Image"));
-    d.set(b"Width".to_vec(), Object::Int(w.into()));
-    d.set(b"Height".to_vec(), Object::Int(h.into()));
-    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
-    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
-    d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
-    let mut parms = Dict::new();
-    parms.set(b"K".to_vec(), Object::Int(0));
-    parms.set(b"Columns".to_vec(), Object::Int(w.into()));
-    parms.set(b"Rows".to_vec(), Object::Int(h.into()));
-    d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
-    let fax = doc.add(Object::Stream(Stream::from_raw(d, g3.clone())));
-    page(&mut doc, &[("A", fax)], "q 64 0 0 64 100 600 cm /A Do Q");
-    let before = render(&doc);
+        let mut doc = Document::new_empty();
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+        let mut parms = Dict::new();
+        parms.set(b"K".to_vec(), Object::Int(k));
+        parms.set(b"EndOfLine".to_vec(), Object::Bool(k > 0));
+        parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+        parms.set(b"Rows".to_vec(), Object::Int(h.into()));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        let fax = doc.add(Object::Stream(Stream::from_raw(d, g3.clone())));
+        page(&mut doc, &[("A", fax)], "q 64 0 0 64 100 600 cm /A Do Q");
+        let before = render(&doc);
 
-    let mut kept = doc.clone();
-    optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
-    assert_eq!(stream(&kept, fax).raw[..], g3[..], "Retain keeps Group 3");
+        let mut kept = doc.clone();
+        optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
+        assert_eq!(stream(&kept, fax).raw[..], g3[..], "/K {k}: Retain keeps Group 3");
 
-    let r = optimize(&mut doc, &Settings::default()).unwrap();
-    assert_eq!((r.images_resampled, r.images_recompressed), (0, 1), "{r:?}");
-    let s = stream(&doc, fax);
-    assert_eq!(doc.fax_params(&s).map(|p| p.k), Some(-1), "Group 4");
-    assert!(s.raw.len() < g3.len(), "{} bytes, from {}", s.raw.len(), g3.len());
-    assert_eq!(doc.decoded_image(&s).unwrap(), bits, "the same picture");
-    assert!(render(&doc) == before, "the page looks the same");
+        let r = optimize(&mut doc, &Settings::default()).unwrap();
+        assert_eq!((r.images_resampled, r.images_recompressed), (0, 1), "/K {k}: {r:?}");
+        let s = stream(&doc, fax);
+        assert_eq!(doc.fax_params(&s).map(|p| p.k), Some(-1), "/K {k}: Group 4");
+        assert!(s.raw.len() < g3.len(), "{} bytes, from {}", s.raw.len(), g3.len());
+        assert_eq!(doc.decoded_image(&s).unwrap(), bits, "/K {k}: the same picture");
+        assert!(render(&doc) == before, "/K {k}: the page looks the same");
+    }
 }
 
 #[test]

From d92ec2101a75ce1b097d26e383f64c5b0c546995 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:30:23 +0100
Subject: [PATCH 119/132] M11: monochrome downsampling's docs: halftones, the
 column cap, mask streams, what is left alone

- The optimize README, the crate doc and both parity notes say a
  halftone or dither, and an image wider than a fax row, isn't averaged
  down.
- The README's "Left alone" list is the colour and grey settings'; image
  masks, decode arrays and CCITT go to Monochrome Images now. Its
  monochrome "Not yet" names an image's own /SMask or /Mask image again
  (only images drawn on a page are visited), as the parity note does;
  the parity note's row limit is Group 4's.
- docs/architecture.md says CCITT decodes through pdfcraft-filters for
  export, redaction and the optimizer, not only the renderer.
- docs/target-app-parity.md no longer lists monochrome downsampling as
  missing.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/README.md    | 18 ++++++++++++------
 crates/optimize/src/lib.rs   | 13 +++++++------
 docs/architecture.md         |  6 ++++--
 docs/target-app-parity.md    |  4 +++-
 parity/acrobat-features.toml |  4 ++--
 5 files changed, 28 insertions(+), 17 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 3ff33728db..4709111278 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -29,8 +29,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   measured (forms nested deeper, or drawn too many times), no image is resampled. Colour and grayscale images above a
   threshold are resampled with a bicubic (Catmull-Rom) filter to a target resolution and
   stored as JPEG (Acrobat's quality steps) or ZIP; soft masks are resampled with their image.
-  An image is replaced only if the result is smaller. Left alone: CMYK and other colour spaces,
-  image masks, decode arrays, more than 8 bits, JPEG 2000, JBIG2 and CCITT. A JPEG is read with
+  An image is replaced only if the result is smaller. Left alone by these colour and grey
+  settings: CMYK and other colour spaces, image masks, decode arrays, more than 8 bits, JPEG 2000,
+  JBIG2 and CCITT (black-and-white images, CCITT among them, are below). A JPEG is read with
   its colour transform (an Adobe marker's, else `/ColorTransform`, ISO 32000-2 §7.4.8), so one
   stored untransformed keeps its colours; one whose marker and `/ColorTransform` disagree is left
   alone, since readers differ on which wins. Samples are read with `/DecodeParms` given by
@@ -39,7 +40,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
 - **Monochrome images** (`Settings::mono`, `MonoSettings::REDUCE` by default: to 300 ppi above
   450 ppi, CCITT Group 4). Black-and-white images are a 1-bit image with one colour component
   (grey, indexed, a separation) or an image mask, stored with no filter, with general-purpose ones
-  or with CCITT fax after any of those (decoded by `Document::decoded_image`), and an eight-bit grey image of
+  or with CCITT fax after any of those (decoded by `Document::decoded_image_within`, no further
+  than its rows can need), and an eight-bit grey image of
   only 0 and 255, packed to one bit (not an indexed image, whose samples are palette indices, nor
   one with a colour-key `/Mask`) unless the grey settings make it smaller still, its soft mask counted
   (resampled with it there, kept as it is here), as they can a dithered scan by downsampling it to
@@ -49,8 +51,11 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     tie, so a dark line half a new pixel wide stays: black in grey and the painted part of an image
     mask (a 0, or a 1 with an inverting decode array), full ink in a separation (a 1, or a 0), and
     entry 0 of an indexed image, whatever colour its palette gives it (the palette isn't read yet).
-    Not one with a soft mask, whose own size would have to follow. On a 600 ppi text page, Group 4
-    at 300 ppi is half the size.
+    Not one with a soft mask, whose own size would have to follow; not a halftone or a dither,
+    most of whose new pixels would cover both black and white, so that taking the sample covering
+    more would turn its tones solid (a 50% screen black, a 25% one white); and not one wider than
+    a fax row (`pdfcraft_filters::MAX_CCITT_COLUMNS`), as the averaging keeps a counter for each
+    column. On a 600 ppi text page, Group 4 at 300 ppi is half the size.
   - **Compression:** CCITT Group 4 (`pdfcraft_filters::encode_g4`), or 1-bit Flate when that is
     smaller, which only a resampled image or one packed from eight bits may be: a 1-bit image that
     is only stored again becomes Group 4 or stays. A CCITT image is only decoded to be resampled,
@@ -60,7 +65,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay. Group 4 wins on scans, whose ragged edges defeat Flate;
     on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, Group 3 to Group 4
-    without resampling, inline images, and Group 4 for rows wider than 32,767 samples.
+    without resampling, inline images, an image's own `/SMask` or `/Mask` image (only images drawn
+    on a page are visited), and Group 4 for rows wider than 32,767 samples.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
   layer, that layer is removed when the result is smaller (the inner filters keep their encoded
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index e911055941..a8a24b6aed 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -7,12 +7,13 @@
 //! - **Images:** each image's effective resolution is measured where pages draw it (the
 //!   smallest over its uses, through form XObjects); colour and grayscale images above a
 //!   threshold are resampled (bicubic) to a target resolution and recompressed as JPEG or Flate.
-//!   A new image replaces the old one only if it is smaller. Images PdfCraft can't decode
-//!   faithfully (CMYK and other colour spaces, masks, decode arrays other than the default,
-//!   JPEG 2000, JBIG2, CCITT, other than 8 bits, JPEGs whose Adobe marker and `/ColorTransform`
-//!   disagree) are left alone. Black-and-white images (1-bit, CCITT fax among them, and eight-bit
-//!   grey of only black and white) above a threshold are averaged down to a target resolution, and
-//!   are stored as CCITT Group 4 when that is smaller.
+//!   A new image replaces the old one only if it is smaller. The colour and grey settings leave
+//!   alone images they can't decode faithfully (CMYK and other colour spaces, masks, decode arrays
+//!   other than the default, JPEG 2000, JBIG2, CCITT, other than 8 bits, JPEGs whose Adobe marker
+//!   and `/ColorTransform` disagree). Black-and-white images (1-bit, image masks
+//!   and CCITT fax among them, and eight-bit grey of only black and white) above a threshold are
+//!   averaged down to a target resolution, halftones and dithers aside, and are stored as CCITT
+//!   Group 4 when that is smaller.
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings.
 //! - **Clean up:** drop images and forms that pages list but never draw (such as a deleted
diff --git a/docs/architecture.md b/docs/architecture.md
index 07448054bd..008cae903d 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -71,8 +71,10 @@ The PDF object graph *is* the model (`crates/engine/README.md` §The editing mod
 ## File I/O
 
 - PDF in: any revision chain, xref tables or streams, hybrid files, damaged files (repaired and
-  logged), all standard-security revisions. Image codecs (DCT, JPX, JBIG2, CCITT) decode through
-  the bootstrap renderer for display; Export ▸ Images decodes CCITT (`hayro-ccitt`) and JPEG itself.
+  logged), all standard-security revisions. Image codecs (DCT, JPX, JBIG2) decode through the
+  bootstrap renderer; CCITT decodes through `pdfcraft-filters` (`decode_ccitt`, behind
+  `Document::decoded_image`) for export, redaction and the optimizer, and through the renderer
+  for display. Export ▸ Images decodes JPEG itself.
 - PDF out: incremental or full saves, object streams, re-encryption, resource de-duplication when
   combining.
 - Other formats: images and text in (`create`); PNG/JPEG/TIFF, text, RTF, Word and HTML out
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index d790e98178..33eb645155 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,5 +1,6 @@
 # PdfCraft parity with Adobe Acrobat Pro
 
+> **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (K Optimize and standards no longer lists monochrome downsampling as missing; scores and estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-26 · **Change:** minor (`optimize.mono-compression` partial (CCITT Group 4): K Optimize and standards 15 shipped and 11 partial of 58, 35.3%; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497); estimates unchanged)
 > **Last reviewed:** 2026-10-25 · **Last updated:** 2026-10-25 · **Change:** minor (localization current state: Arabic logical catalog, explicit RTL direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite. Scores and estimates unchanged)
 
@@ -209,7 +210,7 @@ full parity in that area.
 | H Digital signatures | 45 | 23 | 10 | 62.2% | 45% | 40–70 | PAdES B-B signing and validation (PKCS #12, macOS Keychain, Windows store with PIN prompts), certification, encrypted documents, certificate usage checks; B-T, LTV, OCSP/CRL with caller-supplied evidence. Missing: PKCS #11 and smart cards outside Windows, timestamp-server preferences, online revocation fetching, FieldMDP and field locking, OS trust store, EU Trusted Lists, compare signed version |
 | I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, despeckle, camera images beyond straightening (found or placed corners): orientation, clean-up, MRC compression, scanners |
 | J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Missing: Office/HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
-| K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2 and downsampling |
+| K Optimize and standards | 58 | 15 | 11 | 35.3% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2 |
 | L Print | 39 | 15 | 1 | 39.7% | 35% | 30–55 | Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, print-ready PDF, CUPS on macOS/Linux, the Windows spooler (#756) and the browser's print dialog on the web. Missing: print as image, PostScript, all print-production tools (output preview, separations, ink manager, printer marks, colour conversion) |
 | M Accessibility | 61 | 38 | 1 | 63.1% | 30% | 40–70 | Accessibility Checker (all 32 rules, report, fixes), alternate text, title and language. Missing: autotag, Tags/Order/Content panels, Reading Order tool, artifact marking, table editor, Read Out Loud, full keyboard operation of the app, screen-reader audit |
 | N Automation, preferences, misc | 75 | 20 | 5 | 30.0% | 35% | 25–45 | CLI, MCP, UI control channel, 141 automation tools, Action Wizard (run, create), compare (text, visual, report, side by side, Text/Visual filter). Missing: most Preferences pages, Acrobat's finer compare filters, Action Wizard management, custom commands, AI providers, rich media/3D, hosted web app |
@@ -295,6 +296,7 @@ licensed OCR or AI model.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-26 | minor | K Optimize and standards no longer lists monochrome downsampling as missing (black-and-white images above 450 ppi are averaged down to 300). Scores and estimates unchanged. |
 | 2026-10-26 | minor | `optimize.mono-compression` became partial (CCITT Group 4), counted on the table's own measurement: K Optimize and standards 15 shipped and 11 partial of 58 (35.3%), no longer listing CCITT as missing; breadth 57.0% unweighted (423 + 75 of 808), mainstream 63.3% (292 + 45 of 497). Estimates unchanged. |
 | 2026-10-25 | minor | Localization current state: Arabic catalogs stay logical, Arabic/Kurdish labels take an explicit RTL direction, and stock chrome mirrors; native/browser RTL input, IME and complex workflows remain unqualified. Native Simplified Chinese uses LXGW WenKai Lite; the web build has no Hans face. Scores and estimates unchanged. |
 | 2026-10-20 | minor | M12 #3673: the Character encoding rule accepts Identity-H/V fonts with Adobe CJK collections, or a predefined non-Identity CMap, while rejecting unknown names and foreign registries. Synthetic checker and read-only automation regressions passed after failing before the fix; per-glyph mapping validation and embedded-font extraction remain separate. Breadth, readiness and hours unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 6e67d4aa9a..d656b51a22 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7361,7 +7361,7 @@ status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
 evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax and eight-bit black-and-white grey) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), Group 3 to Group 4 without resampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), Group 3 to Group 4 without resampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 740bb874a4c5b998d49e08cbc3e4fe6dfe13ddce Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 17:38:22 +0100
Subject: [PATCH 120/132] M11: say damaged Group 3 with end-of-line codes is
 stored as the decoder recovers it

With end-of-line codes, the CCITT decoder picks a bad row up again at
the next code and reports no damage (an invalid code, a row of too many
pixels: probed as a black box), so such an image is stored again as
Group 4 the way it decodes. Without them, damage stops the decoding,
too few rows come out, and the image is left alone. Telling damage
apart would take a Group 3 parser of our own; the optimize README and
the mono-compression parity note say so instead.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/README.md    | 9 ++++++---
 parity/acrobat-features.toml | 2 +-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index e26ceba945..6383510c96 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -68,9 +68,12 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     smaller, which only a resampled image or one packed from more bits may be: a 1-bit image that
     is only stored again becomes Group 4 or stays. Group 4 alone is only decoded to be resampled;
     Group 3, or Group 4 inside another filter such as `ASCII85Decode`, is stored again as Group 4
-    alone when that is smaller. With Retain, a resampled image keeps its kind of compression (CCITT,
-    or Flate) and nothing else changes; an image of more bits is then left to the grey or colour
-    settings. Every change is kept only when it is smaller as stored.
+    alone when that is smaller. Damaged Group 3 with end-of-line codes is stored as the decoder
+    recovers it, a bad row picked up again at the next code, as it reports no damage there; without
+    them, damage stops the decoding and the image is left alone. With Retain, a resampled image
+    keeps its kind of compression (CCITT, or Flate) and nothing else changes; an image of more bits
+    is then left to the grey or colour settings. Every change is kept only when it is smaller as
+    stored.
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay, but for packed RGB, which becomes grey with one decode
     pair. Group 4 wins on scans, whose ragged edges defeat Flate; on clean computer-drawn 1-bit
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 048afd9a36..6cc4f4797c 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn where /DefaultGray or /DefaultRGB is in force, and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn where /DefaultGray or /DefaultRGB is in force, and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 5f3fde33d69da18575ef285e4fc878bf0b8acd3d Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 18:07:40 +0100
Subject: [PATCH 121/132] M11: tests for what Monochrome Images keeps, and for
 the fax bounds; Retain's wording

Mutation testing found behaviour no test held, now covered:
- a Group 4 halftone above 450 ppi isn't resampled and stays byte for
  byte, alone by default and behind ASCIIHexDecode with Retain;
- under Retain a resampled Flate scan stays Flate, though Group 4 would
  be smaller (ragged bands);
- sixteen-bit grey of only 0x0000 and 0xFFFF keeps its bytes;
- a busy Group 4 image behind ASCIIHexDecode, whose code is over three
  times its raster, decodes within the fax bound and is stored again as
  Group 4 alone. Redaction's busy-fax test is that busy again: since the
  bound for other images is three times the raster, the old checkerboard
  fitted it, and dropping the fax bound passed.
The redaction README says three times, and doc_optimize's description
says what Retain keeps: CCITT stays CCITT, anything else becomes Flate.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/automation/src/tools.rs    |  2 +-
 crates/optimize/tests/optimize.rs | 97 +++++++++++++++++++++++++++++++
 crates/redact/README.md           |  5 +-
 crates/redact/src/tests.rs        | 11 ++--
 4 files changed, 107 insertions(+), 8 deletions(-)

diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index cdf62ebd8e..3f53a07ff9 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1433,7 +1433,7 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 when that is smaller, counted in images_recompressed; retain resamples only, keeping each image's kind of compression). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 when that is smaller, counted in images_recompressed; retain resamples only, a CCITT image staying CCITT and any other becoming Flate). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 4efe4072d2..f9676144c4 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1019,6 +1019,103 @@ fn a_fax_image_behind_a_decompression_bomb_is_left_alone() {
     }
 }
 
+/// A CCITT image `w` × `h` coded as Group 4 from `bits`, behind ASCIIHexDecode when `hex`.
+fn g4_image(doc: &mut Document, bits: &[u8], (w, h): (u32, u32), hex: bool) -> ObjRef {
+    let g4 = pdfcraft_filters::encode_g4(bits, w, h).unwrap();
+    let mut d = Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w.into()));
+    d.set(b"Height".to_vec(), Object::Int(h.into()));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    let mut parms = Dict::new();
+    parms.set(b"K".to_vec(), Object::Int(-1));
+    parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+    let data = if hex {
+        d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("ASCIIHexDecode"), Object::name("CCITTFaxDecode")]));
+        d.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Null, Object::Dict(parms)]));
+        g4.iter().flat_map(|b| format!("{b:02x}").into_bytes()).chain(*b">").collect()
+    } else {
+        d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+        d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+        g4
+    };
+    doc.add(Object::Stream(Stream::from_raw(d, data)))
+}
+
+/// What Monochrome Images leaves alone and what it may still do. A Group 4 halftone above 450 ppi
+/// isn't resampled, so it stays byte for byte: alone, by default; behind ASCIIHexDecode, with
+/// Retain (by default it is stored again as Group 4 alone). Under Retain a resampled Flate scan
+/// stays Flate though Group 4 would be smaller. A busy Group 4 image behind ASCIIHexDecode, whose
+/// code is more than three times its raster, decodes within a fax code's bound and is stored
+/// again as Group 4 alone. Sixteen-bit grey of only 0x0000 and 0xFFFF isn't eight-bit black and
+/// white, and keeps its bytes.
+#[test]
+fn monochrome_images_keep_what_they_should() {
+    let (w, h) = (1200u32, 480u32);
+    let stride = (w as usize).div_ceil(8);
+    let checker: Vec<u8> = (0..h as usize).flat_map(|y| vec![if y % 2 == 0 { 0xAA } else { 0x55 }; stride]).collect();
+    let mut seed = 0x2545_F491_4F6C_DD1Du64;
+    let mut next = move || {
+        seed ^= seed << 13;
+        seed ^= seed >> 7;
+        seed ^= seed << 17;
+        seed
+    };
+    // Twelve dark bands a row, their edges ragged by up to five samples, as a scan's are.
+    let mut ragged = vec![0xFFu8; stride * h as usize];
+    for y in 0..h as usize {
+        for band in 0..12 {
+            let (x0, x1) = (band * 100 + (next() % 5) as usize, band * 100 + 50 + (next() % 5) as usize);
+            for x in x0..x1.min(w as usize) {
+                ragged[y * stride + x / 8] &= !(0x80 >> (x % 8));
+            }
+        }
+    }
+    let busy: Vec<u8> = (0..256).flat_map(|y| [if y % 2 == 0 { 0xAA } else { 0xFF }; 32]).collect();
+    let build = || {
+        let mut doc = Document::new_empty();
+        let alone = g4_image(&mut doc, &checker, (w, h), false);
+        let wrapped = g4_image(&mut doc, &checker, (w, h), true);
+        let grey = [("BitsPerComponent", 1.into()), ("ColorSpace", Object::name("DeviceGray"))];
+        let scan = mono_image(&mut doc, w, h, &ragged, None, &grey);
+        let fax = g4_image(&mut doc, &busy, (256, 256), true);
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(16));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        let samples: Vec<u8> = eight_bit(&bilevel(w, h, false), w, h).iter().flat_map(|v| [*v, *v]).collect();
+        let deep = doc.add(Object::Stream(Stream::flate(d, &samples)));
+        // 144 × 57.6 pt is 600 ppi; 46.08 pt for 256 samples is 400 ppi.
+        page(
+            &mut doc,
+            &[("A", alone), ("B", wrapped), ("C", scan), ("D", fax), ("E", deep)],
+            "q 144 0 0 57.6 20 700 cm /A Do Q q 144 0 0 57.6 200 700 cm /B Do Q q 144 0 0 57.6 20 600 cm /C Do Q \
+             q 46.08 0 0 46.08 200 600 cm /D Do Q q 144 0 0 57.6 20 500 cm /E Do Q",
+        );
+        (doc, [alone, wrapped, scan, fax, deep])
+    };
+    let raw = |doc: &Document, r: ObjRef| stream(doc, r).raw;
+    let filters = |doc: &Document, r: ObjRef| stream(doc, r).filters().len();
+
+    let (mut doc, [alone, wrapped, scan, fax, deep]) = build();
+    let before = [alone, deep].map(|r| raw(&doc, r));
+    optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!([alone, deep].map(|r| raw(&doc, r)), before, "a Group 4 halftone alone, and sixteen-bit grey");
+    assert_eq!(filters(&doc, wrapped), 1, "a wrapped Group 4 halftone is stored again alone by default");
+    assert_eq!(stream(&doc, scan).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "the scan: Group 4 is smaller");
+    assert_eq!((stream(&doc, fax).dict.name(b"Filter"), filters(&doc, fax)), (Some(&b"CCITTFaxDecode"[..]), 1), "the busy fax image");
+
+    let (mut doc, [_, wrapped, scan, _, _]) = build();
+    let before = raw(&doc, wrapped);
+    let r = optimize(&mut doc, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
+    assert_eq!(raw(&doc, wrapped), before, "Retain: a wrapped Group 4 halftone stays as it is");
+    let s = stream(&doc, scan);
+    assert_eq!((s.dict.int(b"Width"), s.dict.name(b"Filter")), (Some(600), Some(&b"FlateDecode"[..])), "Retain: Flate stays Flate: {r:?}");
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();
diff --git a/crates/redact/README.md b/crates/redact/README.md
index 75648b3cc4..6d273c2341 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -22,8 +22,9 @@ clear_marks(&mut doc, None)?;                        // remove marks without app
   filter, decoded through `Document::decoded_image_within`; `/DecodeParms` given by reference,
   numbers inside included, count). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
   whole (fail-closed); inline images under an area are removed. Images with separate `/SMask`
-  or `/Mask` data, and images whose data decodes to more than twice their declared raster (plus
-  a byte per row and 4 KiB; for a fax image's code, about a byte per pixel), are removed whole;
+  or `/Mask` data, and images whose data decodes to more than three times their declared raster
+  and a byte per row, plus 4 KiB (ASCIIHex text broken into lines under Flate is a little over
+  twice; for a fax image's code, about a byte per pixel), are removed whole;
   cleared copies drop `/Alternates` so alternate pixels cannot survive;
 - **vectors**: covered paths are removed; partly covered paths and shadings are clipped so
   nothing paints inside the areas;
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index 33dc675cdd..ffa02d939c 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -684,15 +684,16 @@ fn a_fax_image_that_cannot_be_decoded_in_full_is_removed_whole() {
     }
 }
 
-/// A busy fax image is cleared, though its code is bigger than twice its raster (the bound for
-/// other images): a code takes up to about a byte per pixel, and the fax image gets that much.
+/// A busy fax image is cleared, though its code is bigger than three times its raster (the bound
+/// for other images): a code takes up to about a byte per pixel, and the fax image gets that much.
 #[test]
 fn a_busy_fax_image_behind_another_filter_is_cleared() {
-    // A 256 × 256 checkerboard, the worst case for a fax code.
-    let rows: Vec<u8> = (0..256).flat_map(|y| [if y % 2 == 0 { 0xAA } else { 0x55 }; 32]).collect();
+    // 256 × 256, rows of a one-pixel checkerboard between white ones: each checkered row is coded
+    // afresh against the white one above it, about four bits a pixel.
+    let rows: Vec<u8> = (0..256).flat_map(|y| [if y % 2 == 0 { 0xAA } else { 0xFF }; 32]).collect();
     let g4 = pdfcraft_filters::encode_g4(&rows, 256, 256).unwrap();
     let raster = 32 * 256;
-    assert!(g4.len() > (raster + 256) * 2 + 4096, "{} bytes: within the bound for other images", g4.len());
+    assert!(g4.len() > (raster + 256) * 3 + 4096, "{} bytes: within the bound for other images", g4.len());
     let dict = "/Type /XObject /Subtype /Image /Width 256 /Height 256 /ColorSpace /DeviceGray /BitsPerComponent 1 \
                 /Filter [/FlateDecode /CCITTFaxDecode] /DecodeParms [null << /K -1 /Columns 256 /Rows 256 >>]";
     let mut doc = one_page(b"q 256 0 0 256 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", vec![stream(dict, pdfcraft_filters::encode_flate(&g4))]);

From 2cbbae458c189a278d58eede9c96bc2291946727 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 18:12:37 +0100
Subject: [PATCH 122/132] M11: decode arrays read as numbers however written;
 Retain keeps a Group 3 halftone

- Packing compared an indexed image's decode array, and RGB's pairs, as
  written: [0 255.0], an entry by reference or a real among RGB's pairs
  stopped it, though they mean the same as integers. Each entry is
  resolved and read as a number now, as is_identity_decode and
  dark_is_one read them; RGB's pair is written back direct.
- A test holds that Retain stores nothing again it doesn't resample: a
  Group 3 halftone above 450 ppi, which isn't averaged down, stays Group
  3 byte for byte (the guard's || as && passed every test).

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/src/images.rs     | 15 ++++--
 crates/optimize/tests/optimize.rs | 79 +++++++++++++++++++++++++++++++
 2 files changed, 90 insertions(+), 4 deletions(-)

diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 71fa945da4..a9e87e1afc 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -637,7 +637,13 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool) -> Option<(Ve
         return None;
     }
     let cs = d.get(b"ColorSpace")?;
-    let decode = d.get(b"Decode").map(|v| doc.resolve(v));
+    // The decode array's numbers, each given directly or by reference, as integers or reals; `None`
+    // when it has something else.
+    let decode = match d.get(b"Decode").map(|v| doc.resolve(v)).as_deref() {
+        None => None,
+        Some(Object::Array(v)) => Some(v.iter().map(|e| doc.resolve(e).as_f64()).collect::<Option<Vec<f64>>>()?),
+        Some(_) => return None,
+    };
     let mut packed = d.clone();
     packed.set(b"BitsPerComponent".to_vec(), Object::Int(1));
     // Components a pixel, bits a component, and a pixel's samples as 1 or 0.
@@ -646,7 +652,7 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool) -> Option<(Ve
             let bpc = bits.filter(|b| matches!(b, 2 | 4 | 8))?;
             match decode.as_deref() {
                 None => {}
-                Some(Object::Array(v)) if v[..] == [Object::Int(0), Object::Int((1 << bpc) - 1)] => {
+                Some([d0, d1]) if *d0 == 0.0 && *d1 == f64::from((1u32 << bpc) - 1) => {
                     packed.remove(b"Decode");
                 }
                 Some(_) => return None,
@@ -664,8 +670,9 @@ fn one_bit(doc: &Document, s: &Stream, pack: bool, defaults: bool) -> Option<(Ve
             }
             match decode.as_deref() {
                 None => {}
-                Some(Object::Array(v)) if v.len() == 6 && v.chunks(2).all(|pair| Some(pair) == v.get(..2)) => {
-                    packed.set(b"Decode".to_vec(), Object::Array(v.get(..2)?.to_vec()));
+                Some(v @ [d0, d1, ..]) if v.len() == 6 && v.chunks(2).all(|pair| pair == [*d0, *d1]) => {
+                    let number = |n: f64| if n.fract() == 0.0 { Object::Int(n as i64) } else { Object::Real(n) };
+                    packed.set(b"Decode".to_vec(), Object::Array(vec![number(*d0), number(*d1)]));
                 }
                 Some(_) => return None,
             }
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 528f43d5fe..28ccca1874 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -995,6 +995,83 @@ fn a_resampled_group_4_image_is_stored_as_flate_when_smaller() {
     assert_eq!((s.dict.int(b"Width"), s.dict.name(b"Filter")), (Some(600), Some(&b"FlateDecode"[..])));
 }
 
+/// A decode array is read as numbers, whichever way they are written: an indexed image's default
+/// as `[0 255.0]` or with an entry by reference, and RGB's inverting pairs with a real among them,
+/// pack as when written as integers.
+#[test]
+fn decode_arrays_read_as_numbers_however_written() {
+    let mut doc = Document::new_empty();
+    let (w, h) = (1200u32, 480u32);
+    let text = bilevel(w, h, false);
+    let image = |doc: &mut Document, data: &[u8], cs: Object, decode: Object| {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), cs);
+        d.set(b"Decode".to_vec(), decode);
+        doc.add(Object::Stream(Stream::flate(d, data)))
+    };
+    let palette = Object::Array(vec![
+        Object::name("Indexed"),
+        Object::name("DeviceRGB"),
+        1.into(),
+        Object::String(pdfcraft_cos::PdfString::literal(vec![0, 0, 255, 255, 255, 255])),
+    ]);
+    let indices = samples_of(&text, w, h, [&[0], &[1]], 8);
+    let max = doc.add(Object::Int(255));
+    let real = image(&mut doc, &indices, palette.clone(), Object::Array(vec![0.into(), Object::Real(255.0)]));
+    let referred = image(&mut doc, &indices, palette, Object::Array(vec![0.into(), Object::Ref(max)]));
+    let rgb = samples_of(&text, w, h, [&[0, 0, 0], &[255, 255, 255]], 8);
+    let pairs = Object::Array(vec![1.into(), 0.into(), 1.into(), 0.into(), Object::Real(1.0), 0.into()]);
+    let inverted = image(&mut doc, &rgb, Object::name("DeviceRGB"), pairs);
+    page(
+        &mut doc,
+        &[("A", real), ("B", referred), ("C", inverted)],
+        "q 200 0 0 80 6 690 cm /A Do Q q 200 0 0 80 6 590 cm /B Do Q q 200 0 0 80 6 490 cm /C Do Q",
+    );
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    optimize(&mut doc, &Settings { color: keep, gray: keep, ..Settings::default() }).unwrap();
+    for r in [real, referred] {
+        let s = stream(&doc, r);
+        assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.get(b"Decode")), (Some(1), None), "{r:?}");
+    }
+    let s = stream(&doc, inverted);
+    let decode = Object::Array(vec![1.into(), 0.into()]);
+    assert_eq!((s.dict.int(b"BitsPerComponent"), s.dict.get(b"Decode")), (Some(1), Some(&decode)));
+}
+
+/// With Retain, a Group 3 halftone above 450 ppi, which isn't resampled, stays Group 3 byte for
+/// byte: Retain stores nothing again that it doesn't resample.
+#[test]
+fn retain_keeps_a_group_3_halftone_as_it_is() {
+    let (w, h) = (64u32, 64u32);
+    let a: Vec<u32> = vec![1; 64];
+    let b: Vec<u32> = std::iter::once(0).chain(std::iter::repeat_n(1, 64)).collect();
+    let runs: Vec<&[u32]> = (0..h).map(|y| if y % 2 == 0 { &a[..] } else { &b[..] }).collect();
+    let g3 = group_3(&runs, false);
+    let mut doc = Document::new_empty();
+    let mut d = Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w.into()));
+    d.set(b"Height".to_vec(), Object::Int(h.into()));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+    d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+    d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+    let mut parms = Dict::new();
+    parms.set(b"K".to_vec(), Object::Int(0));
+    parms.set(b"Columns".to_vec(), Object::Int(w.into()));
+    d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+    let fax = doc.add(Object::Stream(Stream::from_raw(d, g3.clone())));
+    // 7.68 pt for 64 samples is 600 ppi.
+    page(&mut doc, &[("A", fax)], "q 7.68 0 0 7.68 100 600 cm /A Do Q");
+    assert_eq!(doc.decoded_image(&stream(&doc, fax)).unwrap().len(), 64 * 8, "the fixture decodes");
+    let r = optimize(&mut doc, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
+    assert_eq!((r.images_resampled, r.images_recompressed), (0, 0), "{r:?}");
+    assert_eq!(stream(&doc, fax).raw[..], g3[..]);
+}
+
 /// Black-and-white RGB stays RGB where grey would be drawn otherwise: drawn, on any of its uses,
 /// where `/DefaultGray` or `/DefaultRGB` is in force (ISO 32000-2 §8.6.5.6), from a page's
 /// resources or a form's own, as grey would then go through DefaultGray, or no longer through
@@ -1455,6 +1532,8 @@ fn monochrome_images_keep_what_they_should() {
 fn group_3(rows: &[&[u32]], mixed: bool) -> Vec<u8> {
     let code = |white: bool, run: u32| match (white, run) {
         (true, 0) => "00110101",
+        (true, 1) => "000111",
+        (false, 1) => "010",
         (true, 8) => "10011",
         (true, 16) => "101010",
         (true, 32) => "00011011",

From f98a5033e2fd9be2473b8b0de1ab859a427a2869 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 20:12:13 +0100
Subject: [PATCH 123/132] M11: decode_ccitt: tests for byte-aligned Group 3
 read by the codes in its data
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The rule came into decode_ccitt with the decoding it moved from Export ▸
Images (#4335's "Export reads byte-aligned Group 3 by the codes in its
data"), where the create test checks it through the export. Here it gets
tests of its own:
- 32 seeded text-like pictures, 8 to 207 samples wide, at k 0 and 1, in
  each layout (no codes, with end_of_line and without; codes, each
  starting on a byte or ending on one, with and without). Each decodes to
  its picture and, a byte short, to fewer rows, not to other rows read
  another way.
- Group 4 rows on bytes keep their aligned read, end_of_line or not.
- The any-input property varies end_of_line and encoded_byte_align too.

With the rule this replaced (rows on bytes read unaligned under
end_of_line, aligned otherwise) the test fails; cargo-mutants leaves no
mutant of the rule's lines alive. The filters README says how rows on
bytes are read.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/filters/README.md    |   2 +-
 crates/filters/src/ccitt.rs | 140 +++++++++++++++++++++++++++++++++++-
 2 files changed, 139 insertions(+), 3 deletions(-)

diff --git a/crates/filters/README.md b/crates/filters/README.md
index b59b170c90..b8a4c53727 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -43,7 +43,7 @@ decode_ccitt(data, &params, max_rows) -> Result<Vec<u8>, FilterError>   // CCITT
 | ASCIIHexDecode | white space ignored, odd digit padded with 0, `>` EOD (optional), other characters → Corrupt | upper case, newline every 64 digits, `>` |
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
-| CCITTFaxDecode | not in a chain (`Unsupported`); `decode_ccitt` decodes Group 3 and Group 4 on its own, as rows of 1-bit samples each on a new byte, black 0 unless `black_is_1`, at most `max_rows` rows (fewer with `/Rows`), the rows before any damage, up to 1,048,576 samples a row (`pdfcraft_cos::Document::decoded_image` calls it for a fax image, after the filters before it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
+| CCITTFaxDecode | not in a chain (`Unsupported`); `decode_ccitt` decodes Group 3 and Group 4 on its own, as rows of 1-bit samples each on a new byte, black 0 unless `black_is_1`, at most `max_rows` rows (fewer with `/Rows`), the rows before any damage, up to 1,048,576 samples a row; Group 3 rows on bytes are read by their end-of-line codes when the data starts with one and on bytes otherwise, whatever `end_of_line` says (`pdfcraft_cos::Document::decoded_image` calls it for a fax image, after the filters before it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
 
 ## Tests
 
diff --git a/crates/filters/src/ccitt.rs b/crates/filters/src/ccitt.rs
index 731a1a6de5..7a2a310775 100644
--- a/crates/filters/src/ccitt.rs
+++ b/crates/filters/src/ccitt.rs
@@ -318,6 +318,135 @@ mod tests {
         assert_eq!(CcittParams::default().columns, 1728, "Table 11");
     }
 
+    /// Group 3 data: rows of run lengths below 64, white first, coded one-dimensionally with T.4's
+    /// terminating codes (ITU-T T.4 Tables 2 and 3). Each row starts with an end-of-line code with
+    /// `eol`, then with `tag` a 1 bit (the next row one-dimensional, as `k` above 0 has it). Fill
+    /// bits (0s) go where `fill` says.
+    fn group_3(rows: &[Vec<u32>], eol: bool, tag: bool, fill: Fill) -> Vec<u8> {
+        // The codes for runs 0 to 63, in order.
+        const WHITE: &str = concat!(
+            "00110101 000111 0111 1000 1011 1100 1110 1111 10011 10100 00111 01000 001000 000011 110100 110101 101010 101011 ",
+            "0100111 0001100 0001000 0010111 0000011 0000100 0101000 0101011 0010011 0100100 0011000 00000010 00000011 00011010 ",
+            "00011011 00010010 00010011 00010100 00010101 00010110 00010111 00101000 00101001 00101010 00101011 00101100 00101101 ",
+            "00000100 00000101 00001010 00001011 01010010 01010011 01010100 01010101 00100100 00100101 01011000 01011001 01011010 ",
+            "01011011 01001010 01001011 00110010 00110011 00110100",
+        );
+        const BLACK: &str = concat!(
+            "0000110111 010 11 10 011 0011 0010 00011 000101 000100 0000100 0000101 0000111 00000100 00000111 000011000 0000010111 ",
+            "0000011000 0000001000 00001100111 00001101000 00001101100 00000110111 00000101000 00000010111 00000011000 ",
+            "000011001010 000011001011 000011001100 000011001101 000001101000 000001101001 000001101010 000001101011 000011010010 ",
+            "000011010011 000011010100 000011010101 000011010110 000011010111 000001101100 000001101101 000011011010 000011011011 ",
+            "000001010100 000001010101 000001010110 000001010111 000001100100 000001100101 000001010010 000001010011 000000100100 ",
+            "000000110111 000000111000 000000100111 000000101000 000001011000 000001011001 000000101011 000000101100 000001011010 ",
+            "000001100110 000001100111",
+        );
+        let code = |white: bool, run: u32| (if white { WHITE } else { BLACK }).split(' ').nth(run as usize).expect("a run below 64");
+        let mut bits = String::new();
+        for row in rows {
+            // The end-of-line code is 12 bits.
+            let ends_code = if fill == Fill::CodeEnd && eol { 12 } else { 0 };
+            while fill != Fill::None && !(bits.len() + ends_code).is_multiple_of(8) {
+                bits.push('0');
+            }
+            if eol {
+                bits.push_str("000000000001");
+            }
+            if tag {
+                bits.push('1');
+            }
+            row.iter().enumerate().for_each(|(i, run)| bits.push_str(code(i % 2 == 0, *run)));
+        }
+        bits.as_bytes().chunks(8).map(|c| c.iter().enumerate().fold(0u8, |b, (i, d)| b | (u8::from(*d == b'1') << (7 - i)))).collect()
+    }
+
+    /// Where [`group_3`] puts fill bits: none; so each row, its end-of-line code first, starts on a
+    /// byte; or so each end-of-line code ends on one (T.4's fill, as TIFF writes it).
+    #[derive(Clone, Copy, Debug, PartialEq)]
+    enum Fill {
+        None,
+        RowStart,
+        CodeEnd,
+    }
+
+    /// `rows` text-like rows of `columns` samples as runs, white first, from `seed`: long white runs
+    /// and short black ones; a row may start black.
+    fn text_like(seed: u64, columns: u32, rows: u32) -> Vec<Vec<u32>> {
+        let mut seed = seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1;
+        let mut random = |n: u64| {
+            seed ^= seed << 13;
+            seed ^= seed >> 7;
+            seed ^= seed << 17;
+            (seed % n) as u32
+        };
+        (0..rows)
+            .map(|_| {
+                let (mut runs, mut left) = (Vec::new(), columns);
+                while left > 0 {
+                    let run = match runs.len() % 2 {
+                        0 if runs.is_empty() => random(31),
+                        0 => 1 + random(30),
+                        _ => 1 + random(5),
+                    };
+                    runs.push(run.min(left));
+                    left -= run.min(left);
+                }
+                runs
+            })
+            .collect()
+    }
+
+    /// Rows of runs, white first, packed as `decode_ccitt` gives them (white 1).
+    fn pack(runs: &[Vec<u32>], columns: u32) -> Vec<u8> {
+        let stride = (columns as usize).div_ceil(8);
+        let mut out = vec![0u8; stride * runs.len()];
+        for (y, row) in runs.iter().enumerate() {
+            let mut x = 0;
+            for (i, run) in row.iter().enumerate() {
+                if i % 2 == 0 {
+                    (x..x + *run as usize).for_each(|x| out[y * stride + x / 8] |= 0x80 >> (x % 8));
+                }
+                x += *run as usize;
+            }
+        }
+        out
+    }
+
+    /// Group 3 rows on bytes in each layout, over many pictures, as how a misreading comes out
+    /// depends on the picture: no codes (as TIFF's Modified Huffman has it), and `end_of_line`
+    /// without them; codes, each starting on a byte or ending on one, `end_of_line` or not. Each
+    /// decodes to its picture, and a byte short to fewer rows, not to other rows read another way.
+    /// Group 4 rows on bytes keep their aligned read, `end_of_line` or not.
+    #[test]
+    fn group_3_rows_on_bytes_read_by_the_codes_in_the_data() {
+        for seed in 0..32u64 {
+            let (columns, rows) = (8 + (seed as u32 * 37) % 200, 2 + seed as u32 % 20);
+            let runs = text_like(seed, columns, rows);
+            let picture = pack(&runs, columns);
+            for k in [0, 1] {
+                for (codes, fill, end_of_line) in [
+                    (false, Fill::RowStart, false),
+                    (false, Fill::RowStart, true),
+                    (true, Fill::RowStart, false),
+                    (true, Fill::RowStart, true),
+                    (true, Fill::CodeEnd, false),
+                    (true, Fill::CodeEnd, true),
+                ] {
+                    let p = CcittParams { k, columns: i64::from(columns), end_of_line, encoded_byte_align: true, ..CcittParams::default() };
+                    let mut data = group_3(&runs, codes, k > 0, fill);
+                    let case = format!("seed {seed}, {columns} × {rows}, k {k}, codes {codes}, fill {fill:?}, end_of_line {end_of_line}");
+                    assert_eq!(decode_ccitt(&data, &p, rows).unwrap(), picture, "{case}");
+                    data.pop();
+                    assert!(decode_ccitt(&data, &p, rows).unwrap().len() < picture.len(), "{case}, a byte short");
+                }
+            }
+        }
+        // White rows, each the one code 1 (vertical, no change) and its fill.
+        for end_of_line in [false, true] {
+            let p = CcittParams { k: -1, columns: 64, end_of_line, encoded_byte_align: true, ..CcittParams::default() };
+            assert_eq!(decode_ccitt(&[0x80; 16], &p, 16).unwrap(), [0xFF; 8 * 16], "Group 4, end_of_line {end_of_line}");
+        }
+    }
+
     proptest::proptest! {
         /// Any bitmap, of noise or of runs, decodes to its own bits, through an independent decoder
         /// and through `decode_ccitt`.
@@ -337,9 +466,16 @@ mod tests {
 
         /// Whatever it is given, it returns.
         #[test]
-        fn any_input_returns(data in proptest::collection::vec(0u8..=255, 0..600), columns in 0u32..40_000, rows in 0u32..80, k in -2i64..3) {
+        fn any_input_returns(
+            data in proptest::collection::vec(0u8..=255, 0..600),
+            columns in 0u32..40_000,
+            rows in 0u32..80,
+            k in -2i64..3,
+            end_of_line in proptest::bool::ANY,
+            encoded_byte_align in proptest::bool::ANY,
+        ) {
             let _ = encode_g4(&data, columns, rows);
-            let p = CcittParams { k, columns: i64::from(columns), ..CcittParams::default() };
+            let p = CcittParams { k, columns: i64::from(columns), end_of_line, encoded_byte_align, ..CcittParams::default() };
             if let Ok(out) = decode_ccitt(&data, &p, rows) {
                 proptest::prop_assert!(out.len() <= (columns as usize).div_ceil(8) * rows as usize);
             }

From abae2472d3240dd3e5cc9f67e672e7ac5c5655b5 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 18:12:37 +0100
Subject: [PATCH 124/132] M11: the crate docs, doc_optimize's mono and the M11
 row name what the black-and-white step does now

The optimize crate doc and MonoSettings named only 1-bit, CCITT and
eight-bit grey images; doc_optimize's mono said Group 4 only; the M11
milestone row stopped at Group 4 compression. They now include
downsampling (halftones aside), Group 3 to Group 4, 1-bit Flate, and
black-and-white RGB and indexed images that use only palette entries 0
and 1, packed to one bit. That last isn't "two-entry", as the roadmap and
the downsampling parity note had it: an indexed image packs whatever its
palette's size, when its samples are 0 and 1. The mono-compression note
says byte-aligned Group 3 with end-of-line codes but none before the
first row is stored again as PdfCraft draws it, which at /K 0 may be
other rows than were coded.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/automation/src/tools.rs |  2 +-
 crates/optimize/src/lib.rs     | 14 ++++++++------
 docs/roadmap.md                |  4 ++--
 parity/acrobat-features.toml   |  4 ++--
 4 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 838fa57ab4..45471f47df 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -1433,7 +1433,7 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 when that is smaller, counted in images_recompressed; retain resamples only, a CCITT image staying CCITT and any other becoming Flate). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 (or 1-bit Flate, once resampled or packed from more bits) when that is smaller, Group 3 fax images, black-and-white RGB and indexed images using only palette entries 0 and 1 among them, counted in images_recompressed; retain resamples only, a CCITT image staying CCITT and any other becoming Flate). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index a8a24b6aed..3a920d1f13 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -10,10 +10,11 @@
 //!   A new image replaces the old one only if it is smaller. The colour and grey settings leave
 //!   alone images they can't decode faithfully (CMYK and other colour spaces, masks, decode arrays
 //!   other than the default, JPEG 2000, JBIG2, CCITT, other than 8 bits, JPEGs whose Adobe marker
-//!   and `/ColorTransform` disagree). Black-and-white images (1-bit, image masks
-//!   and CCITT fax among them, and eight-bit grey of only black and white) above a threshold are
-//!   averaged down to a target resolution, halftones and dithers aside, and are stored as CCITT
-//!   Group 4 when that is smaller.
+//!   and `/ColorTransform` disagree). Black-and-white images (1-bit, image masks and CCITT fax,
+//!   Group 3 among them; and eight-bit grey and RGB of only black and white, and indexed images
+//!   that use only palette entries 0 and 1, packed to one bit) above a threshold are averaged down to a
+//!   target resolution, halftones and dithers aside, and are stored as CCITT Group 4, or 1-bit
+//!   Flate once resampled or packed, when that is smaller.
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings.
 //! - **Clean up:** drop images and forms that pages list but never draw (such as a deleted
@@ -130,8 +131,9 @@ pub enum MonoCompression {
     Retain,
 }
 
-/// How black-and-white images (1-bit, CCITT fax among them, and eight-bit grey of only black
-/// and white), and image masks, are resampled and stored.
+/// How black-and-white images (1-bit, CCITT fax among them; and eight-bit grey and RGB of only black
+/// and white, and indexed images that use only palette entries 0 and 1, packed to one bit), and
+/// image masks, are resampled and stored.
 #[derive(Clone, Copy, Debug, PartialEq)]
 pub struct MonoSettings {
     /// Average images whose effective resolution is above `above_ppi` down to `target_ppi`.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 1cef4f5965..f5d3d1b44b 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,7 +2,7 @@
 
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
-> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: the optimizer stores Group 3 fax images as Group 4, and packs black-and-white RGB and two-entry indexed images to one bit; estimates unchanged)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: the optimizer stores Group 3 fax images as Group 4, and packs black-and-white RGB and indexed images that use only palette entries 0 and 1 to one bit; estimates unchanged)
 > **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white images above 450 ppi are averaged down to 300 ppi by the optimizer; estimates unchanged)
 > **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white pictures stay one bit when PDFs are created and optimized; CCITT images export; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
@@ -199,7 +199,7 @@ total matches the parity estimate.
 | M8 | Security + redaction | 100–180 | 68% | 15–30 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize.<br>Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Redaction cleans indirect and form structure references, preserving surviving form tags. Redaction retires inherited resource dictionaries, so a parent `/Pages` can't keep a removed XObject reachable; unredacted pages are left untouched. Image redaction removes alternate images and unsupported masks only on affected images. Changed marked-content spans lose replacement descriptions; untouched spans keep theirs. Hidden-text cleanup retires unused named descriptions across inherited/shared page and form resources (64 focused tests and scoped Rust 1.96 Clippy/wasm checks pass; publication CI pending). The redaction audit counts a filled cover that hides half of any one word of a long line (#2662), applied or not. Phone-pattern redaction also matches labelled Italian geographic numbers with `+39` and a slash after the area code (#3205 follow-up); unlabelled international slash numbers remain unsupported. Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
 | M9 | Signatures (PAdES, validation) | 160–280 | 60% | 40–70 | Done: new `sign` crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL.<br>Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites, page validation overlays separate from original signature artwork (baked Not Verified captions remain; #79 open), snapshot tabs that reuse instead of multiplying. Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11 |
 | M10 | OCR, create, export, print | 200–350 | 33% | 120–215 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, the CUPS and Windows spoolers, print-ready PDF).<br>Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; architectural/ANSI/large ISO sheet presets, Match page at 100% and PDF-scale preview (#599 follow-up); Create PDF from multiple files (PDFs, images and text, edited as pages in the grid); OCR can also read pictures on pages that have text, without adding that text twice (#1028). Model staging fetches SHA-256-verified ONNX detection/recognition files after the upstream RTEN URL brownout; runtime discovery prefers complete ONNX pairs per directory, then complete legacy RTEN pairs, without mixing formats or changing directory precedence. Done since: Word invoice export uses borderless inferred tables, floating positioned text/artwork only where text overlaps an image or is rotated, and per-page sizes, covered by synthetic invoice automation regressions (#773); printing on the web through the browser's print dialog, sheets drawn by PdfCraft (gap 4). Lossless image export applies per-component Decode, including Indexed mapping (#1201 partial). Existing 16-bit precision and color-management limits remain. #3532 partial: vector printing retains existing appearances with absent Subtype through a print-owned Form copy; source artwork stays unchanged. #3120: Office export reads form XObjects 50 levels deep, as the renderer does, and up to 50 000 a page; pages past that are listed in `truncated_pages`. Word table cells use the grid columns they span, including cells after a merged cell. Done since: text in a table slot covered by another cell's span remains as paragraph text in Word, HTML, RTF and PowerPoint. Missing: OCR languages beyond Latin, editable-text OCR output, full Office layout fidelity/import. Done since: dotted-leader contents entries stay in separate complete paragraphs (#1757) #2156 candidate: last selected print paper persists across sessions; other print preferences unchanged. Image export applies soft-mask Decode opacity intervals before resizing, including indirect entries and inverted ranges. Vector printing gives annotation appearances unoccupied XObject names so existing page artwork survives. |
-| M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Target-version compatibility is partial: newer content is not detected or converted. Content stream boundaries preserve comments, split operands and graphics state when image fragments merge. Image downsampling includes page-local `/UserUnit` scaling when measuring physical resolution. Done since: reject invalid image and soft-mask dimensions with checked sizing (#2178); black-and-white images stored losslessly as CCITT Group 4 when smaller. Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
+| M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Target-version compatibility is partial: newer content is not detected or converted. Content stream boundaries preserve comments, split operands and graphics state when image fragments merge. Image downsampling includes page-local `/UserUnit` scaling when measuring physical resolution. Done since: reject invalid image and soft-mask dimensions with checked sizing (#2178); black-and-white images stored losslessly as CCITT Group 4 when smaller, averaged down to 300 ppi above 450 (halftones aside), Group 3 stored again as Group 4, and black-and-white RGB and indexed images that use only palette entries 0 and 1 packed to one bit. Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Character encoding accepts Identity-H/V with Adobe CJK collections and predefined CJK CMaps independently (#3673); per-glyph validation and embedded-font extraction remain separate.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded, text-only auto-tag proposal tool for one page. Marking a figure decorative rewrites only that stream (#1324). An XFA radio item whose value contains a space is written back unchanged (#1319). Done since: #2569: Growable multiline XFA text reflows after edits, with undo/redo, save/reopen and print coverage; oversized fields still become read-only page text. Structured-data synchronization warnings retain accepted whitespace without relayout from stale data. Done since: #2572: Every repeated page-master button resolves its own field to the shared XFA click script, including print buttons. Done since: #2570: Dynamic XFA rich-text fields carry exData/maxLength into AcroForm MaxLen for reported and enforced Unicode character limits, retained after save/reopen. Done since: #2589: Active XFA skips PDF-container fallback scripts while retaining requested messages and saved scripts; ordinary/static/unlaid-out documents and explicit console/field calls keep their existing behavior. Missing: writing proposed tags and parent tree, field autotag, visual Tags/Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA<br>Reading colours: pending page backgrounds follow the configured colour (#2059). |
 | M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers<br>Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. `text_find` also caps the per-page match ranges it materializes at the remaining result limit plus one continuation match. CLI robustness scans visit each directory once through overlapping roots and symlink aliases. |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Character encoding accepts Identity-H/V with Adobe CJK collections and predefined CJK CMaps independently (#3673); per-glyph validation and embedded-font extraction remain separate.<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded text-only auto-tag proposal tool; text-only Apply writes marked content, paragraph tags and a parent tree, then opens the Tags panel for review. Missing: mixed-content and field autotag, heading/list/table/figure classification, Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA<br>Done since: CLI info, text and render use dynamic XFA layout pages, with synthetic count/text/pixel and copy-permission regressions (#1645).<br>Reading colours: pending page backgrounds follow the configured colour (#2059). |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 6cc4f4797c..99deb812bc 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7361,7 +7361,7 @@ status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
 evidence = ["crates/optimize/tests/optimize.rs::images_are_measured_where_drawn_and_downsampled", "crates/optimize/tests/optimize.rs::settings_choose_what_happens", "crates/automation/tests/it/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::a_page_picture_printed_as_one_pixel_strips_is_merged_into_one_image", "crates/optimize/tests/optimize.rs::images_that_do_not_tile_a_picture_are_left_alone", "crates/optimize/tests/optimize.rs::a_deeply_nested_form_is_measured_at_its_largest_use", "crates/optimize/tests/optimize.rs::images_are_not_resampled_when_some_uses_could_not_be_measured", "crates/optimize/tests/optimize.rs::image_resolution_uses_the_pages_physical_unit", "crates/optimize/tests/optimize.rs::optimization_retains_an_image_below_threshold_on_a_scaled_page", "crates/optimize/tests/optimize.rs::shared_forms_are_measured_in_each_pages_physical_units", "crates/optimize/tests/optimize.rs::black_and_white_images_above_450_ppi_are_averaged_down_to_300", "crates/optimize/src/images.rs::it_matches_the_slow_way", "crates/automation/tests/it/automation.rs::doc_optimize_averages_black_and_white_scans_down", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax, and eight-bit black-and-white grey and RGB and indexed images of two palette entries) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
+notes = "colour and grayscale, bicubic, effective resolution measured where drawn (every use, with page-local UserUnit scaling, through nested forms up to 12 deep; when a use can't be measured, nothing is resampled); image fragments stacked edge to edge are merged first (side-by-side tiles not yet); monochrome (1-bit, CCITT fax, and eight-bit black-and-white grey and RGB, and indexed images that use only palette entries 0 and 1) averaged by area to 300 ppi above 450 ppi by default, a tie to the dark sample (black in grey, painted in a mask, ink in a separation, after the decode array; an indexed image's entry 0, its palette not read yet), then stored as Group 4 or 1-bit Flate (Monochrome Images ▸ Downsample to; doc_optimize mono); not monochrome images with a soft mask, halftones and dithers (most of their new pixels would cover both black and white, and their tones turn solid), or images wider than a fax row (1,048,576 samples), and Acrobat's bicubic and subsampling choices for monochrome aren't offered"
 
 [[feature]]
 id = "optimize.recompress-images"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn where /DefaultGray or /DefaultRGB is in force, and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn where /DefaultGray or /DefaultRGB is in force, and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From aaa3d815c18b2b822f4a9b7f207d4ee03f6b8741 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 20:38:49 +0100
Subject: [PATCH 125/132] M11: say where Group 3 with no code before the first
 row is written back as read

decode_ccitt reads byte-aligned Group 3 whose data has end-of-line codes
but none before the first row (not as T.4 sends them) on bytes. At /K 0
with the fill ending each code on a byte, about one small picture in
five is then read as other rows; at fax width almost none are, as such
pages come out short and are refused. Export already said so. The
optimizer, when it resamples such an image or stores it again as Group 4
from behind another filter, and redaction, when it clears pixels in one,
write those rows back, and nothing said that.

Black-box, PdfCraft's renderer draws such an image exactly as
decode_ccitt reads it (all 42 misread of 200 seeded pictures, behind
ASCII85Decode too), so the written image is what PdfCraft showed before.
Refusing such data instead (a code after nearly every row but none
first) would also refuse some ordinary Modified Huffman images, whose
rows can meet 11 zeros by chance (0.5 to 5% of small ones in a
black-box probe), so the limit is stated rather than guarded: in
decode_ccitt's doc, the filters, optimize and redact READMEs, and the
core.image-filters and mono-compression notes. The optimize README's and
the mono-compression note's "not yet: Group 3 to Group 4 without
resampling" now say a lone Group 3 image: one behind another filter is
stored again as Group 4.

Also from the review: docs/roadmap.md keeps #4335's status line under
this PR's, rather than replacing it; the filters README's tests and the
core.image-filters evidence name the Group 3 layout test; the filters
crate's description names Group 3 and 4 decoding.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/filters/Cargo.toml    | 2 +-
 crates/filters/README.md     | 4 ++--
 crates/filters/src/ccitt.rs  | 4 +++-
 crates/optimize/README.md    | 9 ++++++---
 crates/redact/README.md      | 4 +++-
 docs/roadmap.md              | 1 +
 parity/acrobat-features.toml | 6 +++---
 7 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/crates/filters/Cargo.toml b/crates/filters/Cargo.toml
index 91b5d3d578..fd63ac2b0b 100644
--- a/crates/filters/Cargo.toml
+++ b/crates/filters/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "pdfcraft-filters"
-description = "PDF stream filters (ISO 32000-2 §7.4): Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength, CCITT Group 4 encoding"
+description = "PDF stream filters (ISO 32000-2 §7.4): Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength, CCITT Group 4 encoding and Group 3 and 4 decoding"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
diff --git a/crates/filters/README.md b/crates/filters/README.md
index b8a4c53727..b8c1d22815 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -43,14 +43,14 @@ decode_ccitt(data, &params, max_rows) -> Result<Vec<u8>, FilterError>   // CCITT
 | ASCIIHexDecode | white space ignored, odd digit padded with 0, `>` EOD (optional), other characters → Corrupt | upper case, newline every 64 digits, `>` |
 | ASCII85Decode | `<~` prefix, `z`, white space, `~>` (or bare `~`, or none) EOD, final partial group; `z` inside a group, a 1-char final group, overflow or bad characters → Corrupt | `z` for zero groups, newline every 75 characters, `~>` |
 | RunLengthDecode | 0–127 literal, 129–255 repeat, 128 EOD (optional); truncated run → Corrupt | runs of ≥2 repeat, literals up to 128, 128 |
-| CCITTFaxDecode | not in a chain (`Unsupported`); `decode_ccitt` decodes Group 3 and Group 4 on its own, as rows of 1-bit samples each on a new byte, black 0 unless `black_is_1`, at most `max_rows` rows (fewer with `/Rows`), the rows before any damage, up to 1,048,576 samples a row; Group 3 rows on bytes are read by their end-of-line codes when the data starts with one and on bytes otherwise, whatever `end_of_line` says (`pdfcraft_cos::Document::decoded_image` calls it for a fax image, after the filters before it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
+| CCITTFaxDecode | not in a chain (`Unsupported`); `decode_ccitt` decodes Group 3 and Group 4 on its own, as rows of 1-bit samples each on a new byte, black 0 unless `black_is_1`, at most `max_rows` rows (fewer with `/Rows`), the rows before any damage, up to 1,048,576 samples a row; Group 3 rows on bytes are read by their end-of-line codes when the data starts with one and on bytes otherwise, whatever `end_of_line` says, so data with codes but none before the first row (not as T.4 sends them) is read on bytes, as the renderer draws it, and at `k` 0 may come out as other rows (`pdfcraft_cos::Document::decoded_image` calls it for a fax image, after the filters before it) | `encode_g4`: Group 4 (`/K -1`) with an end-of-block mark, 0 bits coded black so `/BlackIs1 false` decodes the same bits; rows packed MSB first, each on a new byte, padding bits and trailing bytes ignored; up to 32,767 samples a row (the encoder counts positions in 16 bits); no rows or columns, or too wide → Unsupported, too few bytes → Corrupt |
 
 ## Tests
 
 - Unit tests per filter with hand-computed vectors (the ISO 32000-2 LZW example, RFC 1951 stored blocks, PNG/TIFF rows).
 - LZW is cross-checked against `weezl` (dev-dependency) in both directions for both early-change settings.
 - `tests/proptests.rs`: encode→decode round trips for every encodable filter × predictor × colors × bpc × columns, two-filter chains, output-limit checks, and fuzz-style no-panic tests (random bytes, random/nonsense params, bit-flipped valid streams).
-- `ccitt.rs`: `decode_ccitt` gives back the rows `encode_g4` was given (with `/BlackIs1`, `/Rows` and a row limit), refuses bad widths, and bounds its output for any input. Group 4 output decoded by `hayro-ccitt` (an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
+- `ccitt.rs`: `decode_ccitt` gives back the rows `encode_g4` was given (with `/BlackIs1`, `/Rows` and a row limit), refuses bad widths, and bounds its output for any input; byte-aligned Group 3 in each layout, over 32 seeded pictures, decodes to its picture, and a byte short to fewer rows. Group 4 output decoded by `hayro-ccitt` (an independent decoder) matches the input bits: a text-like page, padding bits, the widest row, and property tests over bitmaps of noise and of runs; any input returns rather than panics.
 - `fuzz/`: a detached cargo-fuzz crate (`cargo +nightly fuzz run decode`, run from `crates/filters/`).
 
 ## Status
diff --git a/crates/filters/src/ccitt.rs b/crates/filters/src/ccitt.rs
index 7a2a310775..e87a82fe16 100644
--- a/crates/filters/src/ccitt.rs
+++ b/crates/filters/src/ccitt.rs
@@ -84,7 +84,9 @@ impl Default for CcittParams {
 /// Group 3 rows on bytes (`k` from 0, `encoded_byte_align`) are read by their end-of-line codes,
 /// whether the fill starts each code on a byte or ends it on one, when `data` starts with one (T.4
 /// sends one before the first row when it sends them at all), and on bytes otherwise, whatever
-/// `end_of_line` says. Group 4 is read as its parameters say.
+/// `end_of_line` says. Group 4 is read as its parameters say. Data with codes but none before the
+/// first row is read on bytes, as PdfCraft's renderer draws it; with `k` 0 and the fill ending each
+/// code on a byte, that may be other rows than were coded.
 ///
 /// Errors: `columns` that aren't from 1 to [`MAX_CCITT_COLUMNS`] ([`FilterError::Unsupported`]).
 pub fn decode_ccitt(data: &[u8], p: &CcittParams, max_rows: u32) -> Result<Vec<u8>, FilterError> {
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 4709111278..2c90981770 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -41,7 +41,10 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   450 ppi, CCITT Group 4). Black-and-white images are a 1-bit image with one colour component
   (grey, indexed, a separation) or an image mask, stored with no filter, with general-purpose ones
   or with CCITT fax after any of those (decoded by `Document::decoded_image_within`, no further
-  than its rows can need), and an eight-bit grey image of
+  than its rows can need; byte-aligned Group 3 with end-of-line codes but none before the first
+  row, not as T.4 sends them, is read as PdfCraft draws it, which at `/K 0` may be other rows than
+  were coded, and an image resampled, or stored again as Group 4 from behind another filter,
+  keeps them), and an eight-bit grey image of
   only 0 and 255, packed to one bit (not an indexed image, whose samples are palette indices, nor
   one with a colour-key `/Mask`) unless the grey settings make it smaller still, its soft mask counted
   (resampled with it there, kept as it is here), as they can a dithered scan by downsampling it to
@@ -64,8 +67,8 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
     settings. Every change is kept only when it is smaller as stored.
   - Apart from the downsampling it is lossless: the samples keep their meaning, so the colour
     space, decode array and `/Mask` stay. Group 4 wins on scans, whose ragged edges defeat Flate;
-    on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, Group 3 to Group 4
-    without resampling, inline images, an image's own `/SMask` or `/Mask` image (only images drawn
+    on clean computer-drawn 1-bit art Flate can be smaller. Not yet: JBIG2, a lone Group 3 image to
+    Group 4 without resampling (one behind another filter is stored again as Group 4), inline images, an image's own `/SMask` or `/Mask` image (only images drawn
     on a page are visited), and Group 4 for rows wider than 32,767 samples.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
 - **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
diff --git a/crates/redact/README.md b/crates/redact/README.md
index 6d273c2341..74509a5d06 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -20,7 +20,9 @@ clear_marks(&mut doc, None)?;                        // remove marks without app
 - **images**: fully covered → removed; partly covered → a copy with the covered pixels cleared
   (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx, and CCITT fax as the last
   filter, decoded through `Document::decoded_image_within`; `/DecodeParms` given by reference,
-  numbers inside included, count). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
+  numbers inside included, count; byte-aligned Group 3 with end-of-line codes but none before the
+  first row, not as T.4 sends them, is cleared as PdfCraft draws it, which at `/K 0` may be other
+  rows than were coded). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
   whole (fail-closed); inline images under an area are removed. Images with separate `/SMask`
   or `/Mask` data, and images whose data decodes to more than three times their declared raster
   and a byte per row, plus 4 KiB (ASCIIHex text broken into lines under Flate is a little over
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 6d12e87564..56b10853a2 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -3,6 +3,7 @@
 > **Last reviewed:** 2026-10-27 | **Last updated:** 2026-10-27 | **Change:** minor (M10: OCR model downloads use verified ONNX pairs with legacy discovery fallback; estimates unchanged)
 > **Last reviewed:** 2026-10-25 | **Last updated:** 2026-10-25 | **Change:** minor (M14 localization current state: Arabic logical catalog, explicit RTL label direction and mirrored stock chrome; native/browser RTL workflows unqualified. Native release Hans face via LXGW WenKai Lite; estimates unchanged)
 > **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white images above 450 ppi are averaged down to 300 ppi by the optimizer; estimates unchanged)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-24 · **Change:** minor (M11: black-and-white pictures stay one bit when PDFs are created and optimized; CCITT images export; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: the PDF Optimizer and Reduce File Size store black-and-white images as CCITT Group 4 when smaller; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M7, #2636 partial: pasting added text boxes and images in the engine and through `content_copy`; estimates unchanged)
 > **Last reviewed:** 2026-10-23 · **Last updated:** 2026-10-23 · **Change:** minor (M11: image optimization accounts for page-local UserUnit; estimates unchanged)
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index d656b51a22..8f22714769 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -130,8 +130,8 @@ milestone = "M1"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/filters/src/ccitt.rs::decoding_gives_the_rows_back", "crates/cos/src/document/tests.rs::fax_images_decode_with_their_parameters"]
-notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images, the optimizer and redaction"
+evidence = ["crates/filters/src/ccitt.rs::decoding_gives_the_rows_back", "crates/filters/src/ccitt.rs::group_3_rows_on_bytes_read_by_the_codes_in_the_data", "crates/cos/src/document/tests.rs::fax_images_decode_with_their_parameters"]
+notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images, the optimizer and redaction. Byte-aligned Group 3 is read by its end-of-line codes when the data starts with one and on bytes otherwise; still limited: data with codes but none before the first row (not as T.4 sends them) is read on bytes, as the renderer draws it, and at /K 0 may come out as other rows, which the optimizer and redaction then write back"
 
 [[feature]]
 id = "core.decompression-limits"
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), Group 3 to Group 4 without resampling, inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), a lone Group 3 image to Group 4 without resampling (one behind another filter is stored again as Group 4; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 952eb344e9c552cf5ed62822710baf295e1438aa Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 20:44:04 +0100
Subject: [PATCH 126/132] M11: Group 3 on bytes through the Group 4 step: tests
 against the picture

group_3_fax_images_become_group_4 coded its rows only off bytes. It now
also stores again rows on bytes: Modified Huffman (no end-of-line codes),
and codes whose fill ends each on a byte, as TIFF writes them, at /K 0 and
1 without /EndOfLine, which reading by that flag misread (the test fails
with that rule). Each becomes Group 4, smaller, decoding to the picture.

The page is compared with the picture in Flate rather than with itself
before: PdfCraft's bootstrap renderer draws TIFF's layout (the fill
ending each code on a byte) as other rows, at every /K and with
/EndOfLine or not (black box), so storing it as Group 4 corrects what
PdfCraft shows rather than keeping it. (Redaction removes such images
whole, for that reason, since #4384's "redaction removes Group 3 on
bytes whole".)

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/optimize/tests/optimize.rs | 54 ++++++++++++++++++++-----------
 1 file changed, 36 insertions(+), 18 deletions(-)

diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 28ccca1874..edfb339d72 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1050,7 +1050,7 @@ fn retain_keeps_a_group_3_halftone_as_it_is() {
     let a: Vec<u32> = vec![1; 64];
     let b: Vec<u32> = std::iter::once(0).chain(std::iter::repeat_n(1, 64)).collect();
     let runs: Vec<&[u32]> = (0..h).map(|y| if y % 2 == 0 { &a[..] } else { &b[..] }).collect();
-    let g3 = group_3(&runs, false);
+    let g3 = group_3(&runs, false, None);
     let mut doc = Document::new_empty();
     let mut d = Dict::new();
     d.set(b"Subtype".to_vec(), Object::name("Image"));
@@ -1528,8 +1528,10 @@ fn monochrome_images_keep_what_they_should() {
 }
 
 /// `rows` coded as CCITT Group 3, one-dimensional (`/K 0`): each row its runs in turn, white first,
-/// with ITU-T T.4's terminating codes for the few lengths used here.
-fn group_3(rows: &[&[u32]], mixed: bool) -> Vec<u8> {
+/// with ITU-T T.4's terminating codes for the few lengths used here. With `on_bytes`, each row
+/// starts on a byte: `Some(false)`, with no end-of-line codes (TIFF's Modified Huffman); `Some(true)`,
+/// after an end-of-line code that the fill ends on a byte (T.4's fill, as TIFF writes it).
+fn group_3(rows: &[&[u32]], mixed: bool, on_bytes: Option<bool>) -> Vec<u8> {
     let code = |white: bool, run: u32| match (white, run) {
         (true, 0) => "00110101",
         (true, 1) => "000111",
@@ -1544,9 +1546,19 @@ fn group_3(rows: &[&[u32]], mixed: bool) -> Vec<u8> {
     };
     let mut bits = String::new();
     for row in rows {
-        // Mixed coding (/K above 0): an end-of-line code, then a 1 bit, the row one-dimensional.
+        let codes = mixed || on_bytes == Some(true);
+        if on_bytes.is_some() {
+            // The end-of-line code is 12 bits.
+            while !(bits.len() + if codes { 12 } else { 0 }).is_multiple_of(8) {
+                bits.push('0');
+            }
+        }
+        if codes {
+            bits.push_str("000000000001");
+        }
+        // Mixed coding (/K above 0): a 1 bit after the code, the row one-dimensional.
         if mixed {
-            bits.push_str("0000000000011");
+            bits.push('1');
         }
         row.iter().enumerate().for_each(|(i, run)| bits.push_str(code(i % 2 == 0, *run)));
     }
@@ -1554,8 +1566,9 @@ fn group_3(rows: &[&[u32]], mixed: bool) -> Vec<u8> {
 }
 
 /// A Group 3 fax image is stored again as Group 4 when that is smaller, the same picture (to the
-/// pixel on the page); with Retain it stays Group 3. One-dimensional (/K 0) and mixed (/K 1, with
-/// end-of-line codes) alike.
+/// pixel on the page, against the picture in Flate); with Retain it stays Group 3. One-dimensional (/K 0) and mixed (/K 1, with
+/// end-of-line codes) alike, and rows on bytes, with no codes and with codes the fill ends on a byte
+/// (without `/EndOfLine`, which reading by the flag misread).
 #[test]
 fn group_3_fax_images_become_group_4() {
     let (w, h) = (64u32, 64u32);
@@ -1575,10 +1588,11 @@ fn group_3_fax_images_become_group_4() {
         }
         bits.extend(packed);
     }
-    for k in [0, 1] {
-        let g3 = group_3(&runs, k > 0);
-        let p = pdfcraft_filters::CcittParams { k, columns: w.into(), end_of_line: k > 0, ..Default::default() };
-        assert_eq!(pdfcraft_filters::decode_ccitt(&g3, &p, h).unwrap(), bits, "/K {k}: the Group 3 data is the picture");
+    for (k, on_bytes) in [(0, None), (1, None), (0, Some(false)), (0, Some(true)), (1, Some(true))] {
+        let g3 = group_3(&runs, k > 0, on_bytes);
+        let (end_of_line, encoded_byte_align) = (k > 0 && on_bytes.is_none(), on_bytes.is_some());
+        let p = pdfcraft_filters::CcittParams { k, columns: w.into(), end_of_line, encoded_byte_align, ..Default::default() };
+        assert_eq!(pdfcraft_filters::decode_ccitt(&g3, &p, h).unwrap(), bits, "/K {k}, on bytes {on_bytes:?}: the Group 3 data is the picture");
 
         let mut doc = Document::new_empty();
         let mut d = Dict::new();
@@ -1587,28 +1601,32 @@ fn group_3_fax_images_become_group_4() {
         d.set(b"Height".to_vec(), Object::Int(h.into()));
         d.set(b"BitsPerComponent".to_vec(), Object::Int(1));
         d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        // The page with the picture in Flate, as it should look.
+        let mut control = Document::new_empty();
+        let flate = control.add(Object::Stream(Stream::flate(d.clone(), &bits)));
+        page(&mut control, &[("A", flate)], "q 64 0 0 64 100 600 cm /A Do Q");
         d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
         let mut parms = Dict::new();
         parms.set(b"K".to_vec(), Object::Int(k));
-        parms.set(b"EndOfLine".to_vec(), Object::Bool(k > 0));
+        parms.set(b"EndOfLine".to_vec(), Object::Bool(end_of_line));
+        parms.set(b"EncodedByteAlign".to_vec(), Object::Bool(encoded_byte_align));
         parms.set(b"Columns".to_vec(), Object::Int(w.into()));
         parms.set(b"Rows".to_vec(), Object::Int(h.into()));
         d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
         let fax = doc.add(Object::Stream(Stream::from_raw(d, g3.clone())));
         page(&mut doc, &[("A", fax)], "q 64 0 0 64 100 600 cm /A Do Q");
-        let before = render(&doc);
 
         let mut kept = doc.clone();
         optimize(&mut kept, &Settings { mono: RETAIN, ..Settings::default() }).unwrap();
-        assert_eq!(stream(&kept, fax).raw[..], g3[..], "/K {k}: Retain keeps Group 3");
+        assert_eq!(stream(&kept, fax).raw[..], g3[..], "/K {k}, on bytes {on_bytes:?}: Retain keeps Group 3");
 
         let r = optimize(&mut doc, &Settings::default()).unwrap();
-        assert_eq!((r.images_resampled, r.images_recompressed), (0, 1), "/K {k}: {r:?}");
+        assert_eq!((r.images_resampled, r.images_recompressed), (0, 1), "/K {k}, on bytes {on_bytes:?}: {r:?}");
         let s = stream(&doc, fax);
-        assert_eq!(doc.fax_params(&s).map(|p| p.k), Some(-1), "/K {k}: Group 4");
+        assert_eq!(doc.fax_params(&s).map(|p| p.k), Some(-1), "/K {k}, on bytes {on_bytes:?}: Group 4");
         assert!(s.raw.len() < g3.len(), "{} bytes, from {}", s.raw.len(), g3.len());
-        assert_eq!(doc.decoded_image(&s).unwrap(), bits, "/K {k}: the same picture");
-        assert!(render(&doc) == before, "/K {k}: the page looks the same");
+        assert_eq!(doc.decoded_image(&s).unwrap(), bits, "/K {k}, on bytes {on_bytes:?}: the same picture");
+        assert!(render(&doc) == render(&control), "/K {k}, on bytes {on_bytes:?}: the page looks as the picture does");
     }
 }
 

From 1ad951e25bac86f77e75e060dcce34cc32a0f9a3 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 21:25:07 +0100
Subject: [PATCH 127/132] M11: redaction removes Group 3 on bytes whole, which
 the renderer may draw as other rows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PdfCraft's bootstrap renderer draws byte-aligned Group 3 whose fill ends
each end-of-line code on a byte (as TIFF writes it) as other rows than
decode_ccitt reads (black box, at every /K, with /EndOfLine or not:
mostly the first row, then blank). Redaction cleared pixels in the
picture decode_ccitt reads, so a mark over what PdfCraft showed needn't
cover what was cleared, and content shown blank stayed in the copy. Such
an image (/K 0 or more, /EncodedByteAlign) is now removed whole, as
every CCITT image was before this PR; Group 3 off bytes and Group 4 are
still cleared.

The image's parameters come from Document::fax_params, the reading of a
fax image's /DecodeParms entry that decoded_image already did, now on
its own (it was to come with #4404, which uses it too). The redaction
README, the module doc, the redaction and core.image-filters notes and
the spec parity table's status line and revision row say so, and the
core.image-filters note now records the renderer's misdrawing.

group_3_on_bytes_is_removed_whole_and_other_fax_images_cleared: a white
16 × 2 picture, checked to decode as such, is removed whole on bytes (no
codes; codes at /K 0; at /K 1 with /EncodedByteAlign by reference) and
cleared off bytes and as Group 4 on bytes. It fails without the guard;
cargo-mutants catches every viable mutant of it.

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 crates/cos/README.md               |  1 +
 crates/cos/src/document/objects.rs | 69 ++++++++++++++++++------------
 crates/cos/src/document/tests.rs   | 10 ++++-
 crates/redact/README.md            |  8 ++--
 crates/redact/src/image.rs         | 14 ++++--
 crates/redact/src/tests.rs         | 34 +++++++++++++++
 docs/pdf-spec-parity.md            |  4 +-
 parity/acrobat-features.toml       |  6 +--
 8 files changed, 105 insertions(+), 41 deletions(-)

diff --git a/crates/cos/README.md b/crates/cos/README.md
index 8358a220a0..2cf3342954 100644
--- a/crates/cos/README.md
+++ b/crates/cos/README.md
@@ -26,6 +26,7 @@ let d    = doc.dict(&obj);                           // Option<Dict>, resolving
 let data = stream.decoded()?;                        // filters applied on demand
 let data = doc.with_direct_parms(&stream).decoded()?; // /DecodeParms given by reference too
 let px   = doc.decoded_image(&stream)?;              // an image's samples, a CCITT fax image's too
+let fax  = doc.fax_params(&stream);                  // a CCITT fax image's /DecodeParms, Table 11 defaults
 
 doc.set(r, Object::Dict(d));                         // edit: lands in the overlay
 let r = doc.add(obj);                                // append a new object
diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index 4c03d04243..4f05d03ae0 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -224,26 +224,15 @@ impl Document {
         self.resolve(o).as_dict().cloned()
     }
 
-    /// The samples of image `s`, decoded: through its filters ([`Stream::decoded`]), or, for a
-    /// CCITT fax image (its last filter), through the filters before it and then
-    /// [`pdfcraft_filters::decode_ccitt`] with its `/DecodeParms` (resolved; the dictionary of a
-    /// lone filter, or its entry in an array), as `CCITTFaxDecode` gives them (ISO 32000-2 §7.4.6).
-    /// Parameters given by reference count, for every filter ([`Document::with_direct_parms`]).
-    /// A fax image's `/Columns` has to be its `/Width`. Up to its `/Height` rows are decoded,
-    /// whatever `/Rows` says, within [`MAX_DECODED`] bytes; damaged data gives fewer, so a caller
-    /// checks it has the rows it needs.
-    pub fn decoded_image(&self, s: &Stream) -> Result<Vec<u8>, CosError> {
-        self.decoded_image_within(s, MAX_DECODED)
-    }
-
-    /// [`Document::decoded_image`] for an image whose decoding has a tighter bound than
-    /// [`MAX_DECODED`]: no stage, the filters before a fax decoder included, may produce more than
-    /// `max` bytes.
-    pub fn decoded_image_within(&self, s: &Stream, max: usize) -> Result<Vec<u8>, CosError> {
-        let max = max.min(MAX_DECODED);
-        let s = &*self.with_direct_parms(s);
-        let chain = s.readable_filters().map_err(|e| CosError::Filter(e.to_string()))?;
-        let Some(((pdfcraft_filters::Filter::CcittFax, _), before)) = chain.split_last() else { return s.decoded_within(max) };
+    /// The CCITT parameters of image `s` when its last filter is `CCITTFaxDecode`: its
+    /// `/DecodeParms` (resolved; the dictionary of a lone filter, or its entry in an array), with the
+    /// defaults of ISO 32000-2 Table 11 for what that leaves out. `None` for another image, and for
+    /// one whose `/Filter` isn't a name or an array of names.
+    pub fn fax_params(&self, s: &Stream) -> Option<pdfcraft_filters::CcittParams> {
+        let chain = s.readable_filters().ok()?;
+        if !matches!(chain.last(), Some((pdfcraft_filters::Filter::CcittFax, _))) {
+            return None;
+        }
         // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1): the
         // last filter but a /Crypt, which `filters` leaves out wherever it stands.
         let index = match s.dict.get(b"Filter") {
@@ -262,17 +251,38 @@ impl Document {
             _ => default,
         };
         let d = pdfcraft_filters::CcittParams::default();
-        let p = pdfcraft_filters::CcittParams {
+        Some(pdfcraft_filters::CcittParams {
             k: int(b"K", d.k),
             columns: int(b"Columns", d.columns),
-            // As many rows as the image has: a /Rows below /Height would cut the picture short,
-            // and rows past /Height aren't drawn.
-            rows: 0,
+            rows: int(b"Rows", d.rows),
             end_of_line: flag(b"EndOfLine", d.end_of_line),
             encoded_byte_align: flag(b"EncodedByteAlign", d.encoded_byte_align),
             end_of_block: flag(b"EndOfBlock", d.end_of_block),
             black_is_1: flag(b"BlackIs1", d.black_is_1),
-        };
+        })
+    }
+
+    /// The samples of image `s`, decoded: through its filters ([`Stream::decoded`]), or, for a
+    /// CCITT fax image (its last filter), through the filters before it and then
+    /// [`pdfcraft_filters::decode_ccitt`] with its [`Document::fax_params`], as `CCITTFaxDecode`
+    /// gives them (ISO 32000-2 §7.4.6). Parameters given by reference count, for every filter
+    /// ([`Document::with_direct_parms`]). A fax image's `/Columns` has to be its `/Width`. Up to
+    /// its `/Height` rows are decoded, whatever `/Rows` says, within [`MAX_DECODED`] bytes; damaged
+    /// data gives fewer, so a caller checks it has the rows it needs.
+    pub fn decoded_image(&self, s: &Stream) -> Result<Vec<u8>, CosError> {
+        self.decoded_image_within(s, MAX_DECODED)
+    }
+
+    /// [`Document::decoded_image`] for an image whose decoding has a tighter bound than
+    /// [`MAX_DECODED`]: no stage, the filters before a fax decoder included, may produce more than
+    /// `max` bytes.
+    pub fn decoded_image_within(&self, s: &Stream, max: usize) -> Result<Vec<u8>, CosError> {
+        let max = max.min(MAX_DECODED);
+        let s = &*self.with_direct_parms(s);
+        let Some(p) = self.fax_params(s) else { return s.decoded_within(max) };
+        // As many rows as the image has: a /Rows below /Height would cut the picture short, and
+        // rows past /Height aren't drawn.
+        let p = pdfcraft_filters::CcittParams { rows: 0, ..p };
         if s.dict.int(b"Width") != Some(p.columns) {
             return Err(CosError::Filter("a fax image's /Columns aren't its /Width".into()));
         }
@@ -280,9 +290,12 @@ impl Document {
         let stride = usize::try_from(p.columns).unwrap_or(usize::MAX).div_ceil(8).max(1);
         let rows = u32::try_from(max / stride).unwrap_or(u32::MAX).min(height);
         // The filters before it, such as ASCII85Decode, are undone first.
-        let data = match before {
-            [] => Cow::Borrowed(&s.raw[..]),
-            _ => Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, max).map_err(|e| CosError::Filter(e.to_string()))?.0),
+        let chain = s.readable_filters().map_err(|e| CosError::Filter(e.to_string()))?;
+        let data = match chain.split_last() {
+            Some((_, before)) if !before.is_empty() => {
+                Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, max).map_err(|e| CosError::Filter(e.to_string()))?.0)
+            }
+            _ => Cow::Borrowed(&s.raw[..]),
         };
         pdfcraft_filters::decode_ccitt(&data, &p, rows).map_err(|e| CosError::Filter(e.to_string()))
     }
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index 53941f02b1..96b4078342 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -131,7 +131,15 @@ fn fax_images_decode_with_their_parameters() {
     assert_eq!(image(&doc, Some(Object::Dict(by_reference)), 10, 3).unwrap(), bits, "/K and /Columns by reference");
     let mut understated = parms.clone();
     understated.set(b"Rows".to_vec(), Object::Int(1));
-    assert_eq!(image(&doc, Some(Object::Dict(understated)), 10, 3).unwrap(), bits, "/Height rows, whatever /Rows says");
+    assert_eq!(image(&doc, Some(Object::Dict(understated.clone())), 10, 3).unwrap(), bits, "/Height rows, whatever /Rows says");
+    // The parameters as the file gives them, /Rows included, and Table 11's defaults.
+    let mut d = Dict::new();
+    d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+    d.set(b"DecodeParms".to_vec(), Object::Dict(understated));
+    let p = doc.fax_params(&Stream::from_raw(d.clone(), Vec::new())).unwrap();
+    assert_eq!((p.k, p.columns, p.rows, p.end_of_block, p.black_is_1), (-1, 10, 1, true, false));
+    d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+    assert!(doc.fax_params(&Stream::from_raw(d, Vec::new())).is_none(), "not a fax image");
     assert!(matches!(image(&doc, Some(Object::Dict(parms.clone())), 12, 3), Err(CosError::Filter(_))), "/Columns other than /Width");
     assert!(matches!(image(&doc, None, 10, 3), Err(CosError::Filter(_))), "the default 1728 /Columns");
     let mut plain = Dict::new();
diff --git a/crates/redact/README.md b/crates/redact/README.md
index 74509a5d06..8383f0119f 100644
--- a/crates/redact/README.md
+++ b/crates/redact/README.md
@@ -20,10 +20,10 @@ clear_marks(&mut doc, None)?;                        // remove marks without app
 - **images**: fully covered → removed; partly covered → a copy with the covered pixels cleared
   (8/16-bit and 1/2/4-bit images, image masks; Flate/LZW/RL/A85/AHx, and CCITT fax as the last
   filter, decoded through `Document::decoded_image_within`; `/DecodeParms` given by reference,
-  numbers inside included, count; byte-aligned Group 3 with end-of-line codes but none before the
-  first row, not as T.4 sends them, is cleared as PdfCraft draws it, which at `/K 0` may be other
-  rows than were coded). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
-  whole (fail-closed); inline images under an area are removed. Images with separate `/SMask`
+  numbers inside included, count). Codecs redaction doesn't decode (DCT, JPX, JBIG2) are removed
+  whole (fail-closed), and so is Group 3 on bytes (`/K` 0 or more, `/EncodedByteAlign`): PdfCraft's
+  renderer draws some of its layouts (the fill ending each end-of-line code on a byte) as other
+  rows than the decoder reads, so a mark over what is shown needn't cover what is cleared; inline images under an area are removed. Images with separate `/SMask`
   or `/Mask` data, and images whose data decodes to more than three times their declared raster
   and a byte per row, plus 4 KiB (ASCIIHex text broken into lines under Flate is a little over
   twice; for a fax image's code, about a byte per pixel), are removed whole;
diff --git a/crates/redact/src/image.rs b/crates/redact/src/image.rs
index 297b3510c4..f662849c12 100644
--- a/crates/redact/src/image.rs
+++ b/crates/redact/src/image.rs
@@ -1,9 +1,10 @@
 //! Clearing the pixels of an image under redaction regions. The image is decoded, every pixel
 //! whose footprint intersects a region is set to zero (no ink for image masks), and the result is
 //! written as a new Flate image; the original object is untouched (other pages may use it).
-//! CCITT fax images decode through `Document::decoded_image_within`. Images whose codec PdfCraft can't
-//! decode (DCT, JPX, JBIG2) return `None`, and the caller removes the whole image instead; that
-//! is fail-closed.
+//! CCITT fax images decode through `Document::decoded_image_within`, but for Group 3 on bytes,
+//! which PdfCraft's renderer may draw as other rows. Images whose codec PdfCraft can't decode
+//! (DCT, JPX, JBIG2), and Group 3 on bytes, return `None`, and the caller removes the whole image
+//! instead; that is fail-closed.
 
 use pdfcraft_content::{Matrix, overlaps};
 use pdfcraft_cos::{Document, Object, Stream};
@@ -68,6 +69,13 @@ fn decode_and_clear(doc: &Document, s: &Stream, ctm: &Matrix, rects: &[[f64; 4]]
     if !ok {
         return None;
     }
+    // Group 3 on bytes is removed whole for now. The decoder reads it by its end-of-line codes
+    // when the data starts with one, but PdfCraft's renderer draws such rows (the fill ending
+    // each code on a byte) as other rows, so the pixels a mark covers on screen needn't be the
+    // ones cleared.
+    if is_fax && doc.fax_params(s).is_none_or(|p| p.k >= 0 && p.encoded_byte_align) {
+        return None;
+    }
     let (w, h) = (s.dict.int(b"Width")?, s.dict.int(b"Height")?);
     if w <= 0 || h <= 0 || (w as u64) * (h as u64) > MAX_PIXELS {
         return None;
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index ffa02d939c..125f00fc5c 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -684,6 +684,40 @@ fn a_fax_image_that_cannot_be_decoded_in_full_is_removed_whole() {
     }
 }
 
+/// Group 3 on bytes is removed whole: the renderer draws some of its layouts as other rows than
+/// the decoder reads, so the pixels a mark covers on screen needn't be the ones cleared. Group 3
+/// off bytes and Group 4 on bytes are cleared. Each picture is 16 × 2 white, each row a white run
+/// of 16 (`101010`): off bytes; on bytes with no end-of-line codes; on bytes after codes whose fill
+/// ends each on a byte, at `/K 0` and at `/K 1` (a 1 after each code), `/EncodedByteAlign` given by
+/// reference there; and Group 4 rows on bytes, each the one code 1 (vertical, no change).
+#[test]
+fn group_3_on_bytes_is_removed_whole_and_other_fax_images_cleared() {
+    let image = "/Type /XObject /Subtype /Image /Width 16 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 1 /Filter /CCITTFaxDecode";
+    for (k, on_bytes, parms, data, extra, removed) in [
+        (0, false, "<< /K 0 /Columns 16 >>", vec![0xAA, 0xA0], vec![], false),
+        (0, true, "<< /K 0 /Columns 16 /EncodedByteAlign true >>", vec![0xA8, 0xA8], vec![], true),
+        (0, true, "<< /K 0 /Columns 16 /EncodedByteAlign true >>", vec![0x00, 0x01, 0xA8, 0x00, 0x01, 0xA8], vec![], true),
+        (1, true, "<< /K 1 /Columns 16 /EncodedByteAlign 8 0 R >>", vec![0x00, 0x01, 0xD4, 0x00, 0x01, 0xD4], vec![b"true".to_vec()], true),
+        (-1, true, "<< /K -1 /Columns 16 /EncodedByteAlign true >>", vec![0x80, 0x80], vec![], false),
+    ] {
+        let p = pdfcraft_filters::CcittParams { k, columns: 16, encoded_byte_align: on_bytes, ..Default::default() };
+        assert_eq!(pdfcraft_filters::decode_ccitt(&data, &p, 2).unwrap(), [0xFF; 4], "{parms}: the picture is white");
+        let dict = format!("{image} /DecodeParms {parms}");
+        let mut objs = vec![stream(&dict, data)];
+        objs.extend(extra);
+        let mut doc = one_page(b"q 160 0 0 20 0 0 cm /Im Do Q", "/XObject << /Im 7 0 R >>", objs);
+        mark(&mut doc, 0, &[[0.0, 12.0, 75.0, 18.0]], "");
+        let report = apply(&mut doc, None).unwrap();
+        if removed {
+            assert_eq!((report.images_cleared, report.images_removed), (0, 1), "{parms}");
+        } else {
+            assert_eq!((report.images_cleared, report.images_removed), (1, 0), "{parms}");
+            let saved = Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap();
+            assert_eq!(named_image(&saved, 0, b"PCRedacted1").as_deref(), Some(&[0x00, 0xFF, 0xFF, 0xFF][..]), "{parms}");
+        }
+    }
+}
+
 /// A busy fax image is cleared, though its code is bigger than three times its raster (the bound
 /// for other images): a code takes up to about a byte per pixel, and the fax image gets that much.
 #[test]
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index b68c5b641d..458f6a7100 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: redaction decodes CCITT fax images; earlier, §7.4: CCITT decoding in `pdfcraft-filters`) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (§7.4: redaction decodes CCITT fax images, Group 3 on bytes aside; earlier, §7.4: CCITT decoding in `pdfcraft-filters`) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -130,7 +130,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-10-26 | minor | §7.4: redaction clears pixels in CCITT fax images through the CCITT decoder, instead of removing them whole |
+| 2026-10-26 | minor | §7.4: redaction clears pixels in CCITT fax images through the CCITT decoder, instead of removing them whole (Group 4 and Group 3 off bytes; Group 3 on bytes is still removed whole, as the bootstrap renderer may draw it as other rows than the decoder reads) |
 | 2026-10-26 | minor | §7.4: CCITT decoding (`hayro-ccitt`) in `pdfcraft-filters`, for export and the Optimizer |
 | 2026-10-26 | minor | §7.4: CCITT Group 4 encoding (`fax`) in the Optimizer |
 | 2026-10-14 | minor | §12.4.4: `/Trans` and `/Dur` read into `DocInfo::transitions` and reported by `doc_info` |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 8f22714769..ea60fc2857 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -131,7 +131,7 @@ status = "partial"
 commands = []
 tools = []
 evidence = ["crates/filters/src/ccitt.rs::decoding_gives_the_rows_back", "crates/filters/src/ccitt.rs::group_3_rows_on_bytes_read_by_the_codes_in_the_data", "crates/cos/src/document/tests.rs::fax_images_decode_with_their_parameters"]
-notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images, the optimizer and redaction. Byte-aligned Group 3 is read by its end-of-line codes when the data starts with one and on bytes otherwise; still limited: data with codes but none before the first row (not as T.4 sends them) is read on bytes, as the renderer draws it, and at /K 0 may come out as other rows, which the optimizer and redaction then write back"
+notes = "decoded through the hayro bootstrap for display; own codecs are M1.1/M1.2. CCITT fax decoding is in filters (decode_ccitt, through hayro-ccitt), which Document::decoded_image uses for Export ▸ Images, the optimizer and redaction. Byte-aligned Group 3 is read by its end-of-line codes when the data starts with one and on bytes otherwise; still limited: data with codes but none before the first row (not as T.4 sends them) is read on bytes, as the renderer draws it, and at /K 0 may come out as other rows, which the optimizer then writes back. The bootstrap renderer draws byte-aligned Group 3 whose fill ends each end-of-line code on a byte as other rows (black box, at every /K), which decode_ccitt reads right; redaction removes Group 3 on bytes whole"
 
 [[feature]]
 id = "core.decompression-limits"
@@ -5792,8 +5792,8 @@ milestone = "M8"
 status = "shipped"
 commands = ["redact.apply"]
 tools = ["redact_apply"]
-evidence = ["crates/redact/src/tests.rs::images_are_removed_or_have_their_pixels_cleared", "crates/redact/src/tests.rs::redaction_clears_pixels_intersected_without_covering_their_centres", "crates/redact/src/tests.rs::a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed", "crates/redact/src/tests.rs::an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared"]
-notes = "intersected pixel footprints are cleared conservatively in a copy, CCITT fax images (scans stored as Group 4) included; DCT/JPX/JBIG2 images removed whole"
+evidence = ["crates/redact/src/tests.rs::images_are_removed_or_have_their_pixels_cleared", "crates/redact/src/tests.rs::redaction_clears_pixels_intersected_without_covering_their_centres", "crates/redact/src/tests.rs::a_fax_image_has_its_covered_pixels_cleared_instead_of_being_removed", "crates/redact/src/tests.rs::group_3_on_bytes_is_removed_whole_and_other_fax_images_cleared", "crates/redact/src/tests.rs::an_image_whose_predictor_is_given_by_reference_has_the_covered_pixel_cleared"]
+notes = "intersected pixel footprints are cleared conservatively in a copy, CCITT fax images (scans stored as Group 4) included; DCT/JPX/JBIG2 images, and Group 3 on bytes (which the bootstrap renderer may draw as other rows than the decoder reads), removed whole"
 
 [[feature]]
 id = "protect.redact-vectors"

From 210ba20fe69e701286bbfdbd924cfc01d9aaa9f4 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Mon, 26 Oct 2026 19:11:29 +0100
Subject: [PATCH 128/132] M11: the architecture doc says Export decodes CCITT
 and JPEG; the progress logs' wording
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

docs/architecture.md said every image codec decodes through the
bootstrap renderer; Export ▸ Images decodes CCITT (hayro-ccitt) and JPEG
itself. The progress logs' "(a dithered scan)" sat after "soft mask
counted", as if it described the mask, and so did the
optimize.mono-compression note's "(a dithered scan downsampled to JPEG)".

From reviews with the pdfcraft-review skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P6yUtvWGPsJpMLyh6pxSXG
---
 ROADMAP.md                   | 2 +-
 docs/architecture.md         | 2 +-
 docs/roadmap.md              | 2 +-
 parity/acrobat-features.toml | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 0d1332e862..2b2f785167 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -205,7 +205,7 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 - **2026-10-24 (M3, window move on Wayland, #3970 follow-up):** After a move or resize by PdfCraft's own title bar or edges, the button release given back to egui goes before the pointer leaving the window, so hover no longer sticks at the old place until the pointer moves. Found by CodeRabbit in review of #3970; a unit test covers it. Estimates unchanged.
 - **2026-10-24 (M14, #4253):** The annotation quick bar remembers Keep tool selected across restarts, including unpinning. Old and malformed settings keep safe defaults; the opt-in UI control channel reads and changes the same preference. Estimates unchanged.
 
-- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller, soft mask counted (a dithered scan), and Export ▸ Images reads CCITT fax images.
+- **2026-10-24 (M11, black-and-white pictures):** A scan saved as a 1-bit PNG became an eight-bit grey image when made into a PDF, larger than the PNG; Create PDF now stores pictures of only black and white at one bit (Group 4 when smaller), the optimizer packs eight-bit black-and-white grey images to one bit unless the grey settings make them smaller, as they can a dithered scan, soft mask counted, and Export ▸ Images reads CCITT fax images.
 - **2026-10-23 (M11, monochrome compression):** The PDF Optimizer and Reduce File Size store black-and-white images (scans, image masks) losslessly as CCITT Group 4 when that is smaller, with a Monochrome Images setting in the Optimizer and `doc_optimize` `mono`. JBIG2 and monochrome downsampling are next.
 - **2026-10-23 (M7, #4280):** Edit text names each standard stand-in font after its face (`PCEdTimesBold`, ...) instead of one shared `PCEdHelv`. Rewriting a bold paragraph whose subset lacks an accent no longer repoints the paragraphs set earlier in a regular stand-in at Times-Bold, and the editor's frame stays on the paragraph being edited. Pages saved by older builds keep their shared name and are not repaired. Estimates unchanged.
 - **2026-10-23 (M8, #3205 follow-up):** Phone-pattern redaction matches complete labelled Italian geographic numbers such as `Tel. +39 0426/123456`, with synthetic matcher and mark/apply/save/reopen coverage; unlabelled international slash numbers remain unsupported.
diff --git a/docs/architecture.md b/docs/architecture.md
index 40084794b4..07448054bd 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -72,7 +72,7 @@ The PDF object graph *is* the model (`crates/engine/README.md` §The editing mod
 
 - PDF in: any revision chain, xref tables or streams, hybrid files, damaged files (repaired and
   logged), all standard-security revisions. Image codecs (DCT, JPX, JBIG2, CCITT) decode through
-  the bootstrap renderer.
+  the bootstrap renderer for display; Export ▸ Images decodes CCITT (`hayro-ccitt`) and JPEG itself.
 - PDF out: incremental or full saves, object streams, re-encryption, resource de-duplication when
   combining.
 - Other formats: images and text in (`create`); PNG/JPEG/TIFF, text, RTF, Word and HTML out
diff --git a/docs/roadmap.md b/docs/roadmap.md
index c4efe2f004..3e4c971b2f 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -257,7 +257,7 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller, soft mask counted (a dithered scan); Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
+| 2026-10-24 | minor | M11: Create PDF stores pictures of only black and white at one bit (Group 4 or Flate, whichever is smaller) instead of eight-bit grey; the optimizer packs eight-bit black-and-white grey images to one bit before Monochrome Images compresses them, unless the grey settings make them smaller, as they can a dithered scan, soft mask counted; Export ▸ Images decodes CCITT fax images. Estimates unchanged. |
 | 2026-10-23 | minor | M11: black-and-white images (1-bit, and image masks) are stored losslessly as CCITT Group 4 when that is smaller: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size too), `doc_optimize` `mono`; `pdfcraft_filters::encode_g4`. JBIG2 and monochrome downsampling not yet. Estimates unchanged. |
 | 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
 | 2026-10-24 | minor | M3, #3970 follow-up: the button release given back after a window move or resize goes before the pointer leaving, so hover doesn't stick. Estimates unchanged. |
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 6c5547c06e..376131a974 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7385,7 +7385,7 @@ status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
 evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, its soft mask counted (a dithered scan downsampled to JPEG). Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. An eight-bit grey image of only black and white is packed to one bit first, then stored the same way (indexed images and colour-key masks aside), unless the grey settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), monochrome downsampling, inline images, soft masks and /Mask images, rows wider than 32,767 samples. Redaction doesn't decode Group 4 yet (a mark over part of such an image removes it whole; nothing leaks)."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From 2d0a7b22411d4b61f130f6175cec918153858593 Mon Sep 17 00:00:00 2001
From: Grzegorz Martens <gmartens89@gmail.com>
Date: Thu, 29 Oct 2026 22:44:50 +0100
Subject: [PATCH 129/132] M11: black-and-white RGB used beyond the page content
 read stays RGB

Packing makes an RGB image grey for every use at once, but /DefaultGray and
/DefaultRGB were checked only where the walk reads: page content and forms.
An annotation's appearance, a pattern, a Type3 glyph or a soft mask's group
drawing the same image can have other default colour spaces, so its colours
could change there.

The walk now records, by object number, every reference in the resources it
reads (each /XObject entry, drawn or not, an /XObject dictionary under its
resources, resources under a page, page-tree node or form), reading the
resources of every page and of every node above one, each page and node a
root. An image the walk reached stays covered unless an object reachable
from the trailer refers to it, or to an object on its way from a page, other
than through those references, or it is held by one that isn't covered; an
eight-bit DeviceRGB image that isn't covered stays RGB. So resources, an
/XObject dictionary or a form a page shares with an appearance keep it RGB,
as does a reference with another generation, while LibreOffice's layout (one
resources object for a page, its /Pages node, and a form inside it that
names it again) still packs. The scan runs only when packing is on and there
is such an image.

The images drawn or listed where the defaults are in force are kept by
object number too, so one named with another generation there stays RGB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/optimize/README.md         |   9 +-
 crates/optimize/src/images.rs     | 234 ++++++++++++++++++++++---
 crates/optimize/tests/optimize.rs | 281 ++++++++++++++++++++++++++++++
 parity/acrobat-features.toml      |   4 +-
 4 files changed, 498 insertions(+), 30 deletions(-)

diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 6383510c96..dec4178672 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -45,9 +45,12 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   row, not as T.4 sends them, is read as PdfCraft draws it, which at `/K 0` may be other rows than
   were coded, and an image stored again keeps them). Packed to one bit first, unless a colour-key `/Mask` is in the image's
   own values: eight-bit grey of only 0 and 255; eight-bit `DeviceRGB` of only black and white,
-  which becomes `DeviceGray` (not calibrated RGB or RGB with a profile, nor one drawn where
-  `/DefaultGray` or `/DefaultRGB` is in force, which would then draw it otherwise, nor one whose
-  soft mask has a `/Matte`); and an indexed image of 2, 4 or 8 bits that uses only palette entries
+  which becomes `DeviceGray` (not calibrated RGB or RGB with a profile, nor one drawn or listed
+  where `/DefaultGray` or `/DefaultRGB` is in force, which would then draw it otherwise, nor one
+  referred to from anywhere but the page and form resources the optimizer reads, where they may
+  be: an annotation's appearance or a pattern drawing it, directly or through resources or a form
+  it shares with a page, or another image's `/Alternates`; nor one whose soft mask has a
+  `/Matte`); and an indexed image of 2, 4 or 8 bits that uses only palette entries
   0 and 1, which keeps its palette, whatever its two colours. A decode array stays when it means
   the same at one bit (grey's, or RGB's if the same for each component, as grey's), and an indexed
   image's default one goes, as the default at one bit; otherwise the image is left alone. The grey
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index a9e87e1afc..54e382d133 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -12,11 +12,18 @@ const MAX_PIXELS: u64 = 80_000_000;
 
 /// The resources of a page, inherited from the page tree if the page has none.
 pub(crate) fn page_resources(doc: &Document, page: ObjRef) -> Option<Dict> {
+    held_page_resources(doc, page).map(|(resources, _)| resources)
+}
+
+/// [`page_resources`], and the object holding them: the page or the page-tree node they are
+/// written in (inherited from), or the resources dictionary when it is an object of its own.
+fn held_page_resources(doc: &Document, page: ObjRef) -> Option<(Dict, ObjRef)> {
     let mut node = Some(page);
     for _ in 0..64 {
-        let d = doc.get(node?).as_dict()?.clone();
+        let n = node?;
+        let d = doc.get(n).as_dict()?.clone();
         if let Some(r) = d.get(b"Resources") {
-            return doc.resolve(r).as_dict().cloned();
+            return Some((doc.resolve(r).as_dict().cloned()?, r.as_ref().unwrap_or(n)));
         }
         node = d.reference(b"Parent");
     }
@@ -53,18 +60,56 @@ struct Walk<'a> {
     /// False once a use may have been missed (depth or work limit).
     complete: bool,
     out: HashMap<ObjRef, f64>,
-    /// Images drawn at least once where `/DefaultGray` or `/DefaultRGB` is in force.
-    defaults: HashSet<ObjRef>,
+    /// Images drawn or listed at least once where `/DefaultGray` or `/DefaultRGB` is in force, by
+    /// object number: a reference with another generation reaches the same image.
+    defaults: HashSet<u32>,
+    /// The references the walk followed to reach its images, and the pages and page-tree nodes
+    /// whose resources it read.
+    read: Read,
+}
+
+/// Where a walk read a reference: under a name in an `/XObject` dictionary (an image or a form),
+/// as resources' `/XObject` dictionary, or as the `/Resources` of a page, node or form.
+#[derive(Clone, PartialEq, Eq, Hash)]
+enum Entry {
+    Name(Vec<u8>),
+    XObject,
+    Resources,
+}
+
+/// The references a walk followed, by object number: (the object referred to, the object holding
+/// the reference, where in it), and the pages and page-tree nodes whose resources it read.
+#[derive(Default)]
+struct Read {
+    entries: HashSet<(u32, u32, Entry)>,
+    roots: HashSet<u32>,
 }
 
 impl Walk<'_> {
     /// Walk one content stream, recording each image's displayed resolution (pixels per inch, the
-    /// smaller of the two axes) and descending into form XObjects. `defaults`: an enclosing
-    /// stream's resources remap a device colour space.
-    fn content(&mut self, data: &[u8], resources: &Dict, ctm: Matrix, defaults: bool) {
+    /// smaller of the two axes) and descending into form XObjects. `holder` is the object holding
+    /// `resources`. `defaults`: an enclosing stream's resources remap a device colour space.
+    fn content(&mut self, data: &[u8], resources: &Dict, holder: ObjRef, ctm: Matrix, defaults: bool) {
         let doc = self.doc;
         let defaults = defaults || remaps_device_spaces(doc, resources);
         let xobjects = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
+        let xholder = match resources.get(b"XObject").and_then(Object::as_ref) {
+            Some(x) => {
+                self.read.entries.insert((x.num, holder.num, Entry::XObject));
+                x
+            }
+            None => holder,
+        };
+        // Every entry counts as read, drawn here or not: content using these resources (a Type3
+        // glyph without its own, say) draws it under the same defaults.
+        for (name, v) in xobjects.iter() {
+            if let Some(r) = v.as_ref() {
+                self.read.entries.insert((r.num, xholder.num, Entry::Name(name.to_vec())));
+                if defaults {
+                    self.defaults.insert(r.num);
+                }
+            }
+        }
         let mut stack = vec![ctm];
         for op in pdfcraft_content::parse(data).ops {
             let top = stack.last().copied().unwrap_or(ctm);
@@ -96,10 +141,10 @@ impl Walk<'_> {
                                 *e = e.min(ppi);
                             }
                             if defaults {
-                                self.defaults.insert(r);
+                                self.defaults.insert(r.num);
                             }
                         }
-                        Some(b"Form") => self.form(r, s, resources, top, defaults),
+                        Some(b"Form") => self.form(r, s, (resources, holder), top, defaults),
                         _ => {}
                     }
                 }
@@ -108,8 +153,37 @@ impl Walk<'_> {
         }
     }
 
-    /// Descend into form `r` drawn with `ctm` from a stream whose resources are `resources`.
-    fn form(&mut self, r: ObjRef, s: &Stream, resources: &Dict, ctm: Matrix, defaults: bool) {
+    /// Read the resources of page `p` and of each page-tree node above it, each of them a root: a
+    /// node's resources are its inheriting pages' (every page is walked), or no page's.
+    fn resources_above(&mut self, p: ObjRef) {
+        let doc = self.doc;
+        let mut node = Some(p);
+        for _ in 0..64 {
+            let Some(n) = node else { return };
+            // A node met before had its own nodes above it read then.
+            if !self.read.roots.insert(n.num) {
+                return;
+            }
+            let Some(d) = doc.get(n).as_dict().cloned() else { return };
+            if let Some(r) = d.get(b"Resources")
+                && let Some(resources) = doc.resolve(r).as_dict().cloned()
+            {
+                let holder = match r.as_ref() {
+                    Some(res) => {
+                        self.read.entries.insert((res.num, n.num, Entry::Resources));
+                        res
+                    }
+                    None => n,
+                };
+                self.content(&[], &resources, holder, Matrix([1.0, 0.0, 0.0, 1.0, 0.0, 0.0]), false);
+            }
+            node = d.reference(b"Parent");
+        }
+    }
+
+    /// Descend into form `r` drawn with `ctm` from a stream whose resources are `resources`, with
+    /// the object holding them.
+    fn form(&mut self, r: ObjRef, s: &Stream, (resources, holder): (&Dict, ObjRef), ctm: Matrix, defaults: bool) {
         if self.path.contains(&r) {
             return;
         }
@@ -144,7 +218,19 @@ impl Walk<'_> {
             return;
         };
         self.path.push(r);
-        self.content(&data, own.as_ref().unwrap_or(resources), inner, defaults);
+        match &own {
+            Some(own) => {
+                let own_holder = match s.dict.get(b"Resources").and_then(Object::as_ref) {
+                    Some(res) => {
+                        self.read.entries.insert((res.num, r.num, Entry::Resources));
+                        res
+                    }
+                    None => r,
+                };
+                self.content(&data, own, own_holder, inner, defaults);
+            }
+            None => self.content(&data, resources, holder, inner, defaults),
+        }
         self.path.pop();
     }
 }
@@ -165,9 +251,10 @@ pub fn effective_resolutions(doc: &Document, pages: &[ObjRef]) -> HashMap<ObjRef
     walk_pages(doc, pages).0
 }
 
-/// [`effective_resolutions`], and the images drawn where `/DefaultGray` or `/DefaultRGB` is in
-/// force: all of them when a use may have been missed.
-fn walk_pages(doc: &Document, pages: &[ObjRef]) -> (HashMap<ObjRef, f64>, HashSet<ObjRef>) {
+/// [`effective_resolutions`], the images drawn or listed where `/DefaultGray` or `/DefaultRGB` is
+/// in force, by object number (all of them when a use may have been missed), and the references
+/// followed to reach them.
+fn walk_pages(doc: &Document, pages: &[ObjRef]) -> (HashMap<ObjRef, f64>, HashSet<u32>, Read) {
     let mut walk = Walk {
         doc,
         path: Vec::new(),
@@ -178,12 +265,14 @@ fn walk_pages(doc: &Document, pages: &[ObjRef]) -> (HashMap<ObjRef, f64>, HashSe
         complete: true,
         out: HashMap::new(),
         defaults: HashSet::new(),
+        read: Read::default(),
     };
     for p in pages {
         let Some(dict) = doc.get(*p).as_dict().cloned() else { continue };
         let page = pdfcraft_model::Page { obj: *p, dict };
+        walk.resources_above(*p);
         let Some(contents) = page.dict.get(b"Contents") else { continue };
-        let res = page_resources(doc, *p).unwrap_or_default();
+        let (res, holder) = held_page_resources(doc, *p).unwrap_or_else(|| (Dict::default(), *p));
         walk.budget = DecodeBudget::page();
         let Some(data) = content_bytes(doc, contents, &mut walk.budget) else {
             walk.complete = false;
@@ -191,13 +280,103 @@ fn walk_pages(doc: &Document, pages: &[ObjRef]) -> (HashMap<ObjRef, f64>, HashSe
         };
         // Content coordinates are in page units; image resolution is in physical inches.
         let unit = page.user_unit(doc);
-        walk.content(&data, &res, Matrix([unit, 0.0, 0.0, unit, 0.0, 0.0]), false);
+        walk.content(&data, &res, holder, Matrix([unit, 0.0, 0.0, unit, 0.0, 0.0]), false);
     }
     if !walk.complete {
         walk.out.values_mut().for_each(|v| *v = f64::INFINITY);
-        walk.defaults.extend(walk.out.keys());
+        walk.defaults.extend(walk.out.keys().map(|r| r.num));
     }
-    (walk.out, walk.defaults)
+    (walk.out, walk.defaults, walk.read)
+}
+
+/// Whether image `r` is one [`one_bit`] may make grey: eight-bit `DeviceRGB`, not in an image codec.
+fn device_rgb(doc: &Document, r: ObjRef) -> bool {
+    let Object::Stream(s) = &*doc.get(r) else { return false };
+    let cs = s.dict.get(b"ColorSpace").map(|cs| doc.resolve(cs));
+    let codec =
+        s.filters().iter().any(|(f, _)| matches!(f, pdfcraft_filters::Filter::Dct | pdfcraft_filters::Filter::Jpx | pdfcraft_filters::Filter::Jbig2));
+    s.dict.int(b"BitsPerComponent") == Some(8)
+        && !codec
+        && cs.as_deref().and_then(Object::as_name).is_some_and(|n| matches!(n, b"DeviceRGB" | b"RGB"))
+}
+
+/// Call `f` with every reference in `o`, a dictionary's or array's included, a stream's dictionary
+/// too, but not those in objects referred to.
+fn each_ref(o: &Object, mut f: impl FnMut(ObjRef)) {
+    // Direct objects nest finitely (the parser builds trees), so this ends.
+    let mut stack = vec![o];
+    while let Some(o) = stack.pop() {
+        match o {
+            Object::Ref(r) => f(*r),
+            Object::Dict(d) => stack.extend(d.iter().map(|(_, v)| v)),
+            Object::Array(a) => stack.extend(a),
+            Object::Stream(s) => stack.extend(s.dict.iter().map(|(_, v)| v)),
+            _ => {}
+        }
+    }
+}
+
+/// The images among `images` (by object number) that may be drawn beyond what the walk read:
+/// some object the document uses refers to the image, or to an object on the way to it from a
+/// page (an `/XObject` dictionary, resources, a form), other than as the page and form resources
+/// the walk read do. So an annotation's appearance, a pattern, a Type3 glyph or a soft mask's
+/// group drawing it, directly or through resources or a form it shares with a page, counts, as
+/// other default colour spaces may be in force there, and so does any other reference (another
+/// image's `/Alternates`, say). Objects nothing reaches from the trailer don't count.
+fn used_elsewhere(doc: &Document, images: &HashSet<u32>, read: &Read) -> HashSet<u32> {
+    if images.is_empty() {
+        return HashSet::new();
+    }
+    let targets: HashSet<u32> = read.entries.iter().map(|(target, ..)| *target).collect();
+    // References to each object the walk followed, by the object holding them.
+    let mut held: HashMap<u32, HashMap<u32, usize>> = HashMap::new();
+    let mut queue: Vec<u32> = Vec::new();
+    let mut visited = HashSet::new();
+    for (_, v) in doc.trailer().iter() {
+        each_ref(v, |r| queue.push(r.num));
+    }
+    while let Some(num) = queue.pop() {
+        if !visited.insert(num) {
+            continue;
+        }
+        let obj = doc.get(ObjRef::new(num, doc.generation(num)));
+        each_ref(&obj, |r| {
+            if targets.contains(&r.num) {
+                *held.entry(r.num).or_default().entry(num).or_default() += 1;
+            }
+            if !visited.contains(&r.num) {
+                queue.push(r.num);
+            }
+        });
+    }
+    let mut seen: HashMap<(u32, u32), usize> = HashMap::new();
+    for (target, holder, _) in &read.entries {
+        *seen.entry((*target, *holder)).or_default() += 1;
+    }
+    // Covered: every reference to it is one the walk followed, held by a page or node, or by an
+    // object covered in turn. Everything the walk reached starts covered, and whatever has a
+    // reference it didn't follow, or is held by an object taken out, is taken out, until nothing
+    // more is. Content beyond what the walk read has to refer to an object on its way to the
+    // image, which takes out everything after it; a cycle the walk read whole stays covered.
+    let mut holds: HashMap<u32, Vec<u32>> = HashMap::new();
+    for (target, holders) in &held {
+        for h in holders.keys() {
+            holds.entry(*h).or_default().push(*target);
+        }
+    }
+    let mut covered: HashSet<u32> = held.keys().copied().collect();
+    let passes = |t: u32, covered: &HashSet<u32>| {
+        held.get(&t)
+            .is_some_and(|holders| holders.iter().all(|(h, n)| seen.get(&(t, *h)) == Some(n) && (read.roots.contains(h) || covered.contains(h))))
+    };
+    let mut check: Vec<u32> = covered.iter().copied().collect();
+    while let Some(t) = check.pop() {
+        if covered.contains(&t) && !passes(t, &covered) {
+            covered.remove(&t);
+            check.extend(holds.get(&t).into_iter().flatten().copied());
+        }
+    }
+    images.iter().copied().filter(|i| !covered.contains(i)).collect()
 }
 
 /// Colour components of a colour space PdfCraft resamples: gray (1) or RGB (3).
@@ -600,9 +779,9 @@ type Pixel = fn(&[u8]) -> Option<bool>;
 ///   - eight-bit `DeviceRGB` whose every pixel is black or white, which becomes `DeviceGray`. A
 ///     decode array the same for all three components becomes that one pair; another stops it.
 ///     Calibrated RGB and RGB with a profile are left out, as the profile could make them other
-///     than black and white; so is one drawn where `/DefaultGray` or `/DefaultRGB` is in force
-///     (`defaults`), which would draw it otherwise as grey, and one whose soft mask has a `/Matte`
-///     of three components;
+///     than black and white; so is one drawn where `/DefaultGray` or `/DefaultRGB` is or may be in
+///     force (`defaults`), which would draw it otherwise as grey, and one whose soft mask has a
+///     `/Matte` of three components;
 ///   - an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1, which stay 0 and
 ///     1 at one bit, whatever their colours, so the colour space stays. A decode array other than
 ///     the default stops it: in index units it would mean something else at one bit.
@@ -805,7 +984,7 @@ pub(crate) fn downsample_bits(data: &[u8], w: u32, h: u32, nw: u32, nh: u32, dar
 
 /// A black-and-white image (see [`one_bit`]) resampled and stored again per `settings`, if that is
 /// smaller as stored; `ppi` is its effective resolution, and `defaults` says it is drawn where
-/// `/DefaultGray` or `/DefaultRGB` is in force. Also says whether it was resampled.
+/// `/DefaultGray` or `/DefaultRGB` is or may be in force. Also says whether it was resampled.
 ///
 /// - **Resampled** ([`downsample_bits`]) when its resolution is above `above_ppi`, to `target_ppi`,
 ///   unless it has a soft mask, whose own size would then have to follow, or is a halftone or a
@@ -896,7 +1075,12 @@ pub(crate) fn run(
     report: &mut Report,
     progress: &mut dyn FnMut(Stage) -> bool,
 ) -> Result<(), OptimizeError> {
-    let (ppi, defaults) = walk_pages(doc, pages);
+    let (ppi, mut defaults, read) = walk_pages(doc, pages);
+    // Black-and-white RGB becomes grey, which default colour spaces would draw otherwise: one used
+    // where the walk didn't look may be drawn so.
+    let packs = settings.mono.compression != MonoCompression::Retain;
+    let rgb: HashSet<u32> = ppi.keys().filter(|r| packs && device_rgb(doc, **r)).map(|r| r.num).collect();
+    defaults.extend(used_elsewhere(doc, &rgb, &read));
     // Soft masks are processed with their image, not on their own.
     let masks: HashSet<ObjRef> = ppi
         .keys()
@@ -918,7 +1102,7 @@ pub(crate) fn run(
         // Packed from more bits a sample, it is lossless at one bit, but the grey or colour
         // settings can make it smaller still (below).
         let packed_from_more = s.dict.int(b"BitsPerComponent").is_some_and(|b| b > 1);
-        let (packed, mono) = match mono(doc, s, ppi, defaults.contains(&r), &settings.mono) {
+        let (packed, mono) = match mono(doc, s, ppi, defaults.contains(&r.num), &settings.mono) {
             Some(m) if packed_from_more => (Some(m), None),
             m => (None, m),
         };
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index edfb339d72..d8fe601a39 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1169,6 +1169,287 @@ fn black_and_white_rgb_stays_rgb_where_grey_would_be_drawn_otherwise() {
     assert_eq!(stream(&doc, img).raw, before.raw, "a use not followed");
 }
 
+/// An empty document, and a maker of images of only black and white as eight-bit `DeviceRGB`.
+fn rgb_page_fixture() -> (Document, impl Fn(&mut Document) -> ObjRef) {
+    let (w, h) = (1200u32, 480u32);
+    let rgb_data = samples_of(&bilevel(w, h, false), w, h, [&[0, 0, 0], &[255, 255, 255]], 8);
+    let image = move |doc: &mut Document| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w.into()));
+        d.set(b"Height".to_vec(), Object::Int(h.into()));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+        doc.add(Object::Stream(Stream::flate(d, &rgb_data)))
+    };
+    (Document::new_empty(), image)
+}
+
+/// `q … cm /N Do Q` for each name, one under the other.
+fn draw_each(names: &[&str]) -> String {
+    names.iter().enumerate().map(|(i, n)| format!("q 200 0 0 80 6 {} cm /{n} Do Q ", 690 - 100 * i)).collect()
+}
+
+/// An `/XObject` dictionary of `names`.
+fn xobject_dict(names: &[(&str, ObjRef)]) -> Dict {
+    let mut x = Dict::new();
+    for (n, r) in names {
+        x.set(n.as_bytes().to_vec(), Object::Ref(*r));
+    }
+    x
+}
+
+/// A stream drawing `/Im` (or nothing) whose `/Resources` is `resources`, with `extra` in its
+/// dictionary: a form, an appearance or a tiling pattern.
+fn drawing(doc: &mut Document, resources: Option<Object>, extra: &[(&str, Object)]) -> ObjRef {
+    let mut f = Dict::new();
+    f.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 612.into(), 792.into()]));
+    if let Some(resources) = resources {
+        f.set(b"Resources".to_vec(), resources);
+    }
+    for (k, v) in extra {
+        f.set(k.as_bytes().to_vec(), v.clone());
+    }
+    doc.add(Object::Stream(Stream::from_raw(f, draw_each(&["Im"]).into_bytes())))
+}
+
+fn form_entries() -> [(&'static str, Object); 2] {
+    [("Type", Object::name("XObject")), ("Subtype", Object::name("Form"))]
+}
+
+/// Resources of `entries`.
+fn resources_of(entries: Vec<(&str, Object)>) -> Dict {
+    let mut res = Dict::new();
+    for (k, v) in entries {
+        res.set(k.as_bytes().to_vec(), v);
+    }
+    res
+}
+
+/// Give page `p` an annotation whose normal appearance is `appearance`.
+fn annotate(doc: &mut Document, p: ObjRef, appearance: ObjRef) {
+    let mut ap = Dict::new();
+    ap.set(b"N".to_vec(), Object::Ref(appearance));
+    let mut annotation = Dict::new();
+    annotation.set(b"Subtype".to_vec(), Object::name("Square"));
+    annotation.set(b"Rect".to_vec(), Object::Array(vec![0.into(), 0.into(), 100.into(), 100.into()]));
+    annotation.set(b"AP".to_vec(), Object::Dict(ap));
+    let annotation = doc.add(Object::Dict(annotation));
+    let mut annots = doc.get(p).as_dict().and_then(|d| d.get(b"Annots").and_then(|a| a.as_array().cloned())).unwrap_or_default();
+    annots.push(Object::Ref(annotation));
+    doc.update_dict(p, |d| d.set(b"Annots".to_vec(), Object::Array(annots))).unwrap();
+}
+
+/// `/DefaultGray` as a calibrated grey, in a `/ColorSpace` resource dictionary.
+fn default_gray() -> Object {
+    let mut white_point = Dict::new();
+    white_point.set(b"WhitePoint".to_vec(), Object::Array(vec![Object::Real(0.9505), 1.into(), Object::Real(1.089)]));
+    let mut c = Dict::new();
+    c.set(b"DefaultGray".to_vec(), Object::Array(vec![Object::name("CalGray"), Object::Dict(white_point)]));
+    Object::Dict(c)
+}
+
+/// Optimize with colour and grey settings that leave images alone, so only packing acts; the
+/// report's images resampled and stored again.
+fn pack_only(doc: &mut Document) -> (usize, usize) {
+    let keep = ImageSettings { downsample: false, target_ppi: 150.0, above_ppi: 225.0, compression: Compression::Retain };
+    let r = optimize(doc, &Settings { color: keep, gray: keep, ..Settings::default() }).unwrap();
+    (r.images_resampled, r.images_recompressed)
+}
+
+/// Black-and-white RGB becomes grey for every use at once, so it stays RGB, byte for byte, when
+/// any use may be beyond the page content and forms the optimizer reads, where other default
+/// colour spaces may be in force: drawn by an annotation's appearance whose resources make
+/// `/DefaultGray` the grey it would be drawn in; by a tiling pattern; through an `/XObject`
+/// dictionary, or a form, that a page shares with such an appearance;
+/// referred to with another generation by the page than by such an appearance; drawn plainly on
+/// one page and, named with another generation, on a page whose resources set `/DefaultGray`;
+/// drawn plainly and only listed (not drawn) where `/DefaultGray` is in force, under the same
+/// generation or another, as a Type3 glyph without resources could draw it there; or held in an
+/// array elsewhere (another image's `/Alternates`).
+#[test]
+fn black_and_white_rgb_used_beyond_the_page_content_read_stays_rgb() {
+    let (mut doc, image) = rgb_page_fixture();
+    let [in_annotation, in_pattern, shared_xobjects, shared_form, other_generation, generation_under_defaults, listed, listed_as_1, in_array] =
+        [(); 9].map(|_| image(&mut doc));
+    let gray_resources = |im: Object| Some(Object::Dict(resources_of(vec![("XObject", im), ("ColorSpace", default_gray())])));
+    let direct = |im: ObjRef| Object::Dict(xobject_dict(&[("Im", im)]));
+
+    let appearance = drawing(&mut doc, gray_resources(direct(in_annotation)), &form_entries());
+    let pattern_entries =
+        [("PatternType", 1.into()), ("PaintType", 1.into()), ("TilingType", 1.into()), ("XStep", 612.into()), ("YStep", 792.into())];
+    let pattern = drawing(&mut doc, Some(Object::Dict(resources_of(vec![("XObject", direct(in_pattern))]))), &pattern_entries);
+    let p = page(&mut doc, &[("A", in_annotation), ("B", in_pattern)], &(draw_each(&["A", "B"]) + "/Pattern cs /P scn 0 0 10 10 re f"));
+    annotate(&mut doc, p, appearance);
+    doc.update_dict(p, |d| {
+        let mut res = d.get(b"Resources").and_then(Object::as_dict).cloned().unwrap();
+        let mut patterns = Dict::new();
+        patterns.set(b"P".to_vec(), Object::Ref(pattern));
+        res.set(b"Pattern".to_vec(), Object::Dict(patterns));
+        d.set(b"Resources".to_vec(), Object::Dict(res));
+    })
+    .unwrap();
+
+    // An /XObject dictionary of its own, read for a page, and a form drawn by a page, each also
+    // used by an appearance under DefaultGray.
+    let x = doc.add(Object::Dict(xobject_dict(&[("Im", shared_xobjects)])));
+    let q = page(&mut doc, &[], &draw_each(&["Im"]));
+    doc.update_dict(q, |d| d.set(b"Resources".to_vec(), Object::Dict(resources_of(vec![("XObject", Object::Ref(x))])))).unwrap();
+    let appearance = drawing(&mut doc, gray_resources(Object::Ref(x)), &form_entries());
+    annotate(&mut doc, q, appearance);
+    let form = drawing(&mut doc, Some(Object::Dict(resources_of(vec![("XObject", direct(shared_form))]))), &form_entries());
+    let q = page(&mut doc, &[("F", form)], &draw_each(&["F"]));
+    let appearance = drawing(&mut doc, gray_resources(Object::Dict(xobject_dict(&[("Im", form)]))), &form_entries());
+    annotate(&mut doc, q, appearance);
+
+    // The page names it with generation 1 (it is 0); the appearance with 0.
+    let q = page(&mut doc, &[("Im", ObjRef { generation: 1, ..other_generation })], &draw_each(&["Im"]));
+    let appearance = drawing(&mut doc, gray_resources(direct(other_generation)), &form_entries());
+    annotate(&mut doc, q, appearance);
+
+    // Drawn plainly as 0, and as 1 where DefaultGray is in force.
+    page(&mut doc, &[("Im", generation_under_defaults)], &draw_each(&["Im"]));
+    let q = page(&mut doc, &[], &draw_each(&["Im"]));
+    let gray = resources_of(vec![
+        ("XObject", Object::Dict(xobject_dict(&[("Im", ObjRef { generation: 1, ..generation_under_defaults })]))),
+        ("ColorSpace", default_gray()),
+    ]);
+    doc.update_dict(q, |d| d.set(b"Resources".to_vec(), Object::Dict(gray))).unwrap();
+
+    // Drawn plainly, and only listed where DefaultGray is in force, as 0 and as 1.
+    page(&mut doc, &[("A", listed), ("B", listed_as_1)], &draw_each(&["A", "B"]));
+    let q = page(&mut doc, &[], "");
+    let gray = resources_of(vec![
+        ("XObject", Object::Dict(xobject_dict(&[("A", listed), ("B", ObjRef { generation: 1, ..listed_as_1 })]))),
+        ("ColorSpace", default_gray()),
+    ]);
+    doc.update_dict(q, |d| d.set(b"Resources".to_vec(), Object::Dict(gray))).unwrap();
+
+    // Another image drawn on the page lists it as an alternate.
+    let mut alternate = Dict::new();
+    alternate.set(b"Image".to_vec(), Object::Ref(in_array));
+    let holder = image(&mut doc);
+    doc.update_dict(holder, |d| {
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        d.set(b"Alternates".to_vec(), Object::Array(vec![Object::Dict(alternate)]));
+    })
+    .unwrap();
+    page(&mut doc, &[("Im", in_array), ("Alt", holder)], &draw_each(&["Im"]));
+
+    let kept = [in_annotation, in_pattern, shared_xobjects, shared_form, other_generation, generation_under_defaults, listed, listed_as_1, in_array];
+    let before = kept.map(|r| stream(&doc, r));
+    pack_only(&mut doc);
+    for (i, b) in kept.iter().zip(&before) {
+        let s = stream(&doc, *i);
+        assert_eq!((&s.dict, &s.raw), (&b.dict, &b.raw), "{i:?}");
+    }
+}
+
+/// Black-and-white RGB that the page content and forms the optimizer reads are the only uses of
+/// becomes grey, however its resources are written: drawn on two pages, by a form, under two
+/// names on one page; through resources that are an object of their own, shared by two pages,
+/// whose `/XObject` dictionary is one too; through resources an object of their own with a direct
+/// `/XObject` dictionary; through resources a page inherits from the page tree; by a form whose
+/// `/Resources` is a reference; by a form without resources, through its page's; listed under a
+/// second name nothing draws; through resources an object of their own that a page without
+/// content lists too; and with an object nothing in the document reaches referring to it as well.
+#[test]
+fn black_and_white_rgb_drawn_only_where_the_optimizer_reads_becomes_grey() {
+    let (mut doc, image) = rgb_page_fixture();
+    let [everywhere, shared_resources, resources_object, inherited, form_resources_object, no_resources, spare_name, no_contents, unreachable] =
+        [(); 9].map(|_| image(&mut doc));
+    let set_resources = |doc: &mut Document, q: ObjRef, res: Object| doc.update_dict(q, |d| d.set(b"Resources".to_vec(), res)).unwrap();
+
+    let form =
+        drawing(&mut doc, Some(Object::Dict(resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("Im", everywhere)])))]))), &form_entries());
+    page(&mut doc, &[("E", everywhere), ("F", form)], &draw_each(&["E", "F"]));
+    page(&mut doc, &[("E", everywhere), ("G", everywhere)], &draw_each(&["E", "G"]));
+
+    let x = doc.add(Object::Dict(xobject_dict(&[("Im", shared_resources)])));
+    let res = doc.add(Object::Dict(resources_of(vec![("XObject", Object::Ref(x))])));
+    for _ in 0..2 {
+        let q = page(&mut doc, &[], &draw_each(&["Im"]));
+        set_resources(&mut doc, q, Object::Ref(res));
+    }
+    let res = doc.add(Object::Dict(resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("Im", resources_object)])))])));
+    let q = page(&mut doc, &[], &draw_each(&["Im"]));
+    set_resources(&mut doc, q, Object::Ref(res));
+
+    let q = page(&mut doc, &[], &draw_each(&["I"]));
+    doc.update_dict(q, |d| {
+        d.remove(b"Resources");
+    })
+    .unwrap();
+    let pages = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages"))).unwrap();
+    set_resources(&mut doc, pages, Object::Dict(resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("I", inherited)])))])));
+
+    let res = doc.add(Object::Dict(resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("Im", form_resources_object)])))])));
+    let form = drawing(&mut doc, Some(Object::Ref(res)), &form_entries());
+    page(&mut doc, &[("F", form)], &draw_each(&["F"]));
+    let form = drawing(&mut doc, None, &form_entries());
+    page(&mut doc, &[("F", form), ("Im", no_resources)], &draw_each(&["F"]));
+
+    page(&mut doc, &[("C", spare_name), ("D", spare_name)], &draw_each(&["C"]));
+    let res = doc.add(Object::Dict(resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("Im", no_contents)])))])));
+    for drawn in [true, false] {
+        let q = page(&mut doc, &[], &draw_each(&["Im"]));
+        set_resources(&mut doc, q, Object::Ref(res));
+        if !drawn {
+            doc.update_dict(q, |d| {
+                d.remove(b"Contents");
+            })
+            .unwrap();
+        }
+    }
+
+    page(&mut doc, &[("Im", unreachable)], &draw_each(&["Im"]));
+    // A form nothing refers to, drawing it under DefaultGray.
+    let orphan = resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("Im", unreachable)]))), ("ColorSpace", default_gray())]);
+    drawing(&mut doc, Some(Object::Dict(orphan)), &form_entries());
+
+    let grey = [everywhere, shared_resources, resources_object, inherited, form_resources_object, no_resources, spare_name, no_contents, unreachable];
+    assert_eq!(pack_only(&mut doc), (0, grey.len()));
+    for i in grey {
+        let s = stream(&doc, i);
+        assert_eq!((s.dict.get(b"ColorSpace"), s.dict.int(b"BitsPerComponent")), (Some(&Object::name("DeviceGray")), Some(1)), "{i:?}");
+    }
+}
+
+/// LibreOffice writes one resources object for a page and its `/Pages` node, and a transparency
+/// group's form whose `/Resources` is that same object, which the object lists in turn. Black-
+/// and-white RGB in it becomes grey: every reference is one the page walk reads, the cycle
+/// included. Drawn from outside as well, by an appearance under `/DefaultGray` that draws the
+/// form, it stays RGB.
+#[test]
+fn black_and_white_rgb_in_resources_its_page_tree_and_a_form_share_becomes_grey() {
+    for outside in [false, true] {
+        let (mut doc, image) = rgb_page_fixture();
+        let img = image(&mut doc);
+        let res = doc.add(Object::Dict(Dict::new()));
+        let form = drawing(&mut doc, Some(Object::Ref(res)), &form_entries());
+        doc.update_dict(res, |d| d.set(b"XObject".to_vec(), Object::Dict(xobject_dict(&[("Im", img), ("Tr", form)])))).unwrap();
+        let p = page(&mut doc, &[], &draw_each(&["Im", "Tr"]));
+        let pages = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages"))).unwrap();
+        for holder in [p, pages] {
+            doc.update_dict(holder, |d| d.set(b"Resources".to_vec(), Object::Ref(res))).unwrap();
+        }
+        if outside {
+            let gray = resources_of(vec![("XObject", Object::Dict(xobject_dict(&[("Im", form)]))), ("ColorSpace", default_gray())]);
+            let appearance = drawing(&mut doc, Some(Object::Dict(gray)), &form_entries());
+            annotate(&mut doc, p, appearance);
+        }
+        let before = stream(&doc, img);
+        pack_only(&mut doc);
+        let s = stream(&doc, img);
+        if outside {
+            assert_eq!((&s.dict, &s.raw), (&before.dict, &before.raw), "drawn from outside too");
+        } else {
+            assert_eq!((s.dict.get(b"ColorSpace"), s.dict.int(b"BitsPerComponent")), (Some(&Object::name("DeviceGray")), Some(1)));
+        }
+    }
+}
+
 /// Black-and-white images above 450 ppi are averaged down to 300 ppi, by default: 1-bit Flate, CCITT
 /// Group 4 (alone and behind ASCIIHexDecode), an image mask (its inverting decode array stays), and
 /// eight-bit grey and RGB of only black and white (the RGB also the other way round, with a decode
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 99deb812bc..26e94eda01 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -7384,8 +7384,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced", "optimize.reduce"]
 tools = ["doc_optimize", "doc_reduce"]
-evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
-notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn where /DefaultGray or /DefaultRGB is in force, and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
+evidence = ["crates/optimize/tests/optimize.rs::eight_bit_black_and_white_images_become_one_bit", "crates/filters/src/ccitt.rs::bitmaps_round_trip", "crates/filters/src/ccitt.rs::a_page_of_text_like_marks_round_trips_and_shrinks", "crates/filters/src/ccitt.rs::what_it_cannot_encode_is_an_error", "crates/optimize/tests/optimize.rs::black_and_white_images_become_ccitt_group_4", "crates/optimize/tests/optimize.rs::group_3_fax_images_become_group_4", "crates/optimize/tests/optimize.rs::rgb_and_two_colour_indexed_black_and_white_images_become_one_bit", "crates/optimize/tests/optimize.rs::black_and_white_rgb_used_beyond_the_page_content_read_stays_rgb", "crates/optimize/tests/optimize.rs::black_and_white_rgb_drawn_only_where_the_optimizer_reads_becomes_grey", "crates/optimize/tests/optimize.rs::black_and_white_rgb_in_resources_its_page_tree_and_a_form_share_becomes_grey", "crates/automation/tests/it/automation.rs::doc_optimize_stores_black_and_white_images_as_ccitt_group_4", "crates/ui-egui/tests/it/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy"]
+notes = "CCITT Group 4, lossless: PDF Optimizer ▸ Images ▸ Monochrome Images (on by default, so Reduce File Size does it too; doc_optimize mono) stores a 1-bit image of one colour component (grey, indexed, a separation) or an image mask, kept with no filter or general-purpose ones, as Group 4 when that is smaller as stored; the samples decode to the same bits, so colour space, decode array and masks stay. Packed to one bit first, then stored the same way (colour-key masks aside): eight-bit grey of only black and white, eight-bit DeviceRGB of only black and white (as DeviceGray; calibrated RGB, RGB with a profile, RGB drawn or listed where /DefaultGray or /DefaultRGB is in force or referred to from anywhere but the page and form resources read (an annotation's appearance or a pattern drawing it, directly or through resources or a form shared with a page; another image's /Alternates), and RGB whose soft mask has a /Matte aside), and an indexed image of 2, 4 or 8 bits that uses only palette entries 0 and 1 (keeping its palette), unless the grey or colour settings make it smaller still, as they can a dithered scan downsampled to JPEG, its soft mask counted. Group 4 wins on scans; on clean computer-drawn 1-bit art Flate can be smaller, and the image then stays. Group 3 fax images are stored again as Group 4 when that is smaller (damaged Group 3 with end-of-line codes as the decoder recovers it, as it reports no damage there; byte-aligned Group 3 with end-of-line codes but none before the first row, not as T.4 sends them, as PdfCraft draws it, which at /K 0 may be other rows than were coded). CCITT fax images are decoded to be downsampled (optimize.downsample-images), and a resampled image is stored as Group 4 or 1-bit Flate, whichever is smaller. Not yet: JBIG2 (lossless or lossy, which Adobe's help says beats CCITT for monochrome), inline images, soft masks and /Mask images, Group 4 for rows wider than 32,767 samples."
 
 [[feature]]
 id = "optimize.only-if-smaller"

From ee82cf1a72c97ff890584bed782831e9eccd7738 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 08:58:13 +0100
Subject: [PATCH 130/132] Remove extra blank lines after relocating font-size
 controls

---
 crates/ui-egui/src/panels/format_text_ui.rs | 2 --
 1 file changed, 2 deletions(-)

diff --git a/crates/ui-egui/src/panels/format_text_ui.rs b/crates/ui-egui/src/panels/format_text_ui.rs
index 4645ca367b..5807bb1731 100644
--- a/crates/ui-egui/src/panels/format_text_ui.rs
+++ b/crates/ui-egui/src/panels/format_text_ui.rs
@@ -353,8 +353,6 @@ fn typed_font_size(text: &str) -> Option<f64> {
     (value.is_finite() && (1.0..=500.0).contains(&value)).then_some(value)
 }
 
-
-
 #[cfg(test)]
 mod tests {
     #[test]

From 7227eb68ab383e47413f1a980f340f5132cf4144 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:10:05 +0100
Subject: [PATCH 131/132] Name the Pages sidebar keyboard group and record its
 accessible snapshot

---
 crates/ui-egui/src/panels/pages.rs             | 1 +
 crates/ui-egui/tests/it/view.rs                | 1 +
 crates/ui-egui/tests/snapshots/panel_pages.txt | 1 +
 3 files changed, 3 insertions(+)

diff --git a/crates/ui-egui/src/panels/pages.rs b/crates/ui-egui/src/panels/pages.rs
index cda3cb5ec3..1d16331eb9 100644
--- a/crates/ui-egui/src/panels/pages.rs
+++ b/crates/ui-egui/src/panels/pages.rs
@@ -91,6 +91,7 @@ pub(super) fn pages(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, view: &mut cr
     let focus_id = ui.make_persistent_id(("pages-keyboard", view.id));
     view.pages_focus_id = Some(focus_id);
     let keyboard = ui.interact(ui.clip_rect(), focus_id, Sense::focusable_noninteractive());
+    keyboard.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Group, ui.is_enabled(), tl!("Pages")));
     let owns_keyboard = keyboard.has_focus();
     // Escape remains with the panel after the pointer moves away.
     ui.memory_mut(|m| m.set_focus_lock_filter(focus_id, egui::EventFilter { escape: true, ..Default::default() }));
diff --git a/crates/ui-egui/tests/it/view.rs b/crates/ui-egui/tests/it/view.rs
index c04bc16312..b9a01f408f 100644
--- a/crates/ui-egui/tests/it/view.rs
+++ b/crates/ui-egui/tests/it/view.rs
@@ -57,6 +57,7 @@ fn sidebar_key(h: &mut Harness<'static, PdfCraftApp>, key: Key, modifiers: Modif
 fn pages_sidebar_select_all_keeps_current_page_and_keyboard_scope() {
     use egui_kittest::kittest::Queryable;
     let mut h = harness(&[("panel", "pages")]);
+    let _ = h.get_by_role_and_label(egui::accesskit::Role::Group, "Pages");
     h.get_by_label("Page 2").click();
     h.run_steps(3);
     assert_eq!(h.state().views[0].current, 1);
diff --git a/crates/ui-egui/tests/snapshots/panel_pages.txt b/crates/ui-egui/tests/snapshots/panel_pages.txt
index 7f432057d9..e438fe3798 100644
--- a/crates/ui-egui/tests/snapshots/panel_pages.txt
+++ b/crates/ui-egui/tests/snapshots/panel_pages.txt
@@ -7,6 +7,7 @@ Label = "100%"
 Button "Smaller thumbnails" [off]
 Slider "Thumbnail size"
 Button "Larger thumbnails" [off]
+Group "Pages"
 Button "Page 1" [off]
 Label = "1"
 Button "Page 2" [off]

From 4b319bb3835709626c663b8d41b72d2f9574acc0 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:29:42 +0100
Subject: [PATCH 132/132] Keep typed font sizes accessible and within the
 current panel layout

Use a named compact preset arrow beside the field, retain the row alignment/width assertions for the editable control, and open the current colour flyout in the saved-text regression. No accessibility or layout checks are disabled.
---
 crates/ui-egui/src/panels/format_text_ui.rs | 54 ++++++++++++---------
 crates/ui-egui/tests/it/content.rs          |  4 +-
 crates/ui-egui/tests/it/editing.rs          |  2 +
 3 files changed, 35 insertions(+), 25 deletions(-)

diff --git a/crates/ui-egui/src/panels/format_text_ui.rs b/crates/ui-egui/src/panels/format_text_ui.rs
index 5807bb1731..8b36e79846 100644
--- a/crates/ui-egui/src/panels/format_text_ui.rs
+++ b/crates/ui-egui/src/panels/format_text_ui.rs
@@ -320,32 +320,40 @@ fn colour_button(ui: &mut egui::Ui, t: &Tokens, color: [f64; 3]) -> egui::Respon
 /// Commit a typed size once (Enter or leaving the field), rather than one undo step per key.
 /// The bounds match AddedText validation, so the panel also accepts coloured text below 8 pt.
 fn font_size_input(ui: &mut egui::Ui, size: &mut f64) {
-    let id = ui.make_persistent_id("font-size-input");
-    let (previous, mut text) = ui.data(|d| d.get_temp::<(u64, String)>(id)).unwrap_or_else(|| (size.to_bits(), size.to_string()));
-    if previous != size.to_bits() {
-        text = size.to_string();
-    }
-    let response = ui.add(egui::TextEdit::singleline(&mut text).id(id).desired_width(44.0)).accessible_name(tl!("Font size:"));
-    let cancel = (response.has_focus() || response.lost_focus()) && ui.input(|i| i.key_pressed(egui::Key::Escape));
-    if cancel {
-        text = size.to_string();
-        response.surrender_focus();
-    } else if response.lost_focus() || (response.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter))) {
-        if let Some(value) = typed_font_size(&text) {
-            *size = value;
+    ui.scope(|ui| {
+        ui.spacing_mut().item_spacing.x = 2.0;
+        let id = ui.make_persistent_id("font-size-input");
+        let (previous, mut text) = ui.data(|d| d.get_temp::<(u64, String)>(id)).unwrap_or_else(|| (size.to_bits(), size.to_string()));
+        if previous != size.to_bits() {
+            text = size.to_string();
         }
-        text = size.to_string();
-    }
-    let before = *size;
-    craft_ui::ComboBox::from_id_salt("font-size").selected_text("pt").width(28.0).show_ui(ui, |ui| {
-        for value in SIZES {
-            ui.selectable_value(size, value, format!("{value} pt"));
+        let field = egui::TextEdit::singleline(&mut text).id(id).desired_width(40.0);
+        let response = ui.add_sized([40.0, ui.spacing().interact_size.y], field).accessible_name(tl!("Font size:"));
+        let cancel = (response.has_focus() || response.lost_focus()) && ui.input(|i| i.key_pressed(egui::Key::Escape));
+        if cancel {
+            text = size.to_string();
+            response.surrender_focus();
+        } else if response.lost_focus() || (response.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter))) {
+            if let Some(value) = typed_font_size(&text) {
+                *size = value;
+            }
+            text = size.to_string();
         }
+        let before = *size;
+        let list = icons::button(ui, "chevron-down", PRESET_LIST, false, tl!("Font size"));
+        egui::Popup::menu(&list).show(|ui| {
+            for value in SIZES {
+                if ui.selectable_label(*size == value, format!("{value} pt")).clicked() {
+                    *size = value;
+                    ui.close();
+                }
+            }
+        });
+        if *size != before {
+            text = size.to_string();
+        }
+        ui.data_mut(|d| d.insert_temp(id, (size.to_bits(), text)));
     });
-    if *size != before {
-        text = size.to_string();
-    }
-    ui.data_mut(|d| d.insert_temp(id, (size.to_bits(), text)));
 }
 
 fn typed_font_size(text: &str) -> Option<f64> {
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index 4a7927f692..aa832fe2df 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -699,7 +699,7 @@ fn format_text_rows_line_up_and_fit_the_panel() {
     let combo = |h: &Harness<'static, PdfCraftApp>, value: &str| {
         h.query_all_by_role(Role::ComboBox).find(|n| n.value().as_deref() == Some(value)).map(|n| n.rect()).expect(value)
     };
-    let (font, size) = (combo(&h, "Helvetica"), combo(&h, "12"));
+    let (font, size) = (combo(&h, "Helvetica"), h.get_by_label("Font size:").rect());
     let middle = |r: egui::Rect| r.center().y;
     for label in ["Colour", "Alignment"] {
         let other = h.get_by_label(label).rect();
@@ -716,7 +716,7 @@ fn format_text_rows_line_up_and_fit_the_panel() {
     for r in &scale_row {
         assert!((middle(*r) - middle(scale_row[0])).abs() < 0.5, "{scale_row:?}");
     }
-    for r in h.query_all_by_role(Role::ComboBox).map(|n| n.rect()).chain(scale_row) {
+    for r in h.query_all_by_role(Role::ComboBox).map(|n| n.rect()).chain(scale_row).chain([size, h.get_by_label("Font size").rect()]) {
         assert!(r.right() <= font.right() + 0.5, "{r:?} reaches past the panel ({font:?})");
     }
 }
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index 0dc4914b17..b0a8be83d2 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -4166,6 +4166,8 @@ fn typed_small_coloured_text_size_survives_save_and_reopen() {
     h.event(egui::Event::Text("6.5".into()));
     h.key_press(Key::Enter);
     h.run_steps(4);
+    h.get_by_label("Colour").click();
+    h.run_steps(2);
     h.get_by_label("Blue").click();
     h.run_steps(4);
     let id = h.state().views[0].id;