diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 4d0549981..28bd17c7c 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -4,7 +4,7 @@
 
 Every asset PdfCraft includes, bundles or uses to build its published material, with its author, source and licence. The policy is in [AGENTS.md](AGENTS.md) §1. The machine-readable list, with SHA-256 hashes, is [ATTRIBUTION.toml](ATTRIBUTION.toml). Licence texts are kept beside the assets and summarised in [NOTICE](NOTICE).
 
-## In this repository (260)
+## In this repository (264)
 
 | Asset | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|
@@ -17,6 +17,7 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/ui-egui/src/i18n/de.tsv` | German interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/te.tsv` | Telugu interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/it.tsv` | Italian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Italian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
+| `crates/ui-egui/src/i18n/pl.tsv` | Polish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Polish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/ru.tsv` | Russian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/hu.tsv` | Hungarian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
 | `crates/ui-egui/src/i18n/bg.tsv` | Bulgarian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources | Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs |
@@ -134,6 +135,7 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `assets/icons/messages-square.svg` | Lucide icon "messages-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/messages-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/mic.svg` | Lucide icon "mic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/minimize.svg` | Lucide icon "minimize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/minimize-2.svg` | Lucide icon "minimize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/minus.svg` | Lucide icon "minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/moon.svg` | Lucide icon "moon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/moon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/mouse-pointer-2.svg` | Lucide icon "mouse-pointer-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mouse-pointer-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
@@ -230,6 +232,8 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `assets/app-icon/pdfcraft-1024.png` | PdfCraft app icon, 1024 px on Apple's icon grid | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Runtime window/Dock icon on macOS (apps/pdfcraft/src/main.rs) |
 | `assets/app-icon/pdfcraft.icns` | PdfCraft app icon (macOS .icns) | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | macOS app bundle icon |
 | `assets/app-icon/pdfcraft.ico` | PdfCraft app icon (Windows .ico, 16-256 px) | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Embedded in pdfcraft.exe by apps/pdfcraft/build.rs (Explorer, taskbar, Start menu, Alt-Tab) |
+| `assets/app-icon/pdfcraft-document.svg` | PdfCraft PDF document icon (master vector) | Lucide Icons and Contributors (document outline); PdfCraft contributors (PDF badge, lettering and composition) | ISC AND (MIT OR Apache-2.0) | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg); contributor-original composition (assets/app-icon/README.md) | Master artwork for the Windows PDF file type icon; rendered by packaging/icons.sh, without fonts or external images |
+| `assets/app-icon/pdfcraft-document.ico` | PdfCraft PDF document icon (Windows .ico, 16-256 px) | Lucide Icons and Contributors (document outline); PdfCraft contributors (PDF badge, lettering and composition) | ISC AND (MIT OR Apache-2.0) | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg); contributor-original composition (assets/app-icon/README.md) | Embedded in pdfcraft.exe as resource 2; the Windows installer uses it for PdfCraft.Document and Applications/pdfcraft.exe PDF file associations |
 | `assets/app-icon/hicolor/16x16/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 16 px | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
 | `assets/app-icon/hicolor/24x24/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 24 px | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
 | `assets/app-icon/hicolor/32x32/apps/ai.storyteller.pdfcraft.png` | PdfCraft app icon, 32 px | PdfCraft contributors (drawn by the project owner in ArtCraft; vectorised with craftrules vectorize_tile.py) | MIT OR Apache-2.0 | Contributor-original (see assets/app-icon/README.md) | Linux hicolor theme icon (packaging/linux/ai.storyteller.pdfcraft.desktop) |
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index b9f908c90..17a90044d 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "5aedd14b5c652b54db8bfb00d32657d690b4601618de1d574919ff8fec161694"
+sha256 = "500ba36d4a37162d935a1b5e2b16eff5b2011c6aa9f9285a87d46807acdb97e6"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "1cf01b46973e74f2df8d3269e6569cf1264ebcca5351a569bd494e9cfcf86b91"
+sha256 = "57c35909b2f19f16ff0497d110abbf1c79a5627d2a98f95706e726c59348d09e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b243b1b0152d1236b99fc375fb42f5810d55786292d3b8d5d2393593a5789a5c"
+sha256 = "abd8d0c409be846fcf48cbc1338def7f77f2d301bd84d863e4ad66434e5f821f"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "e0b6b7d1441501b929f9df6409edda88283d00a4343a0627acdaa126e549286a"
+sha256 = "130059ef7014f1dfb59ec8dc2435657d5158abca2d1825959c6366288d28ea92"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3528e2b18c73c038b0ffc4b364155827ddede69a8cecd5aa0b20bbe409598738"
+sha256 = "c67b49f2caa527fe5a241b1046f582b83f324ac86945319fd489971c038acd9b"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "36b08deba87a7cb9c52a678d37f4f289bb291a0a097615bc1a9a77f2d8b44b2a"
+sha256 = "4e8e7f71dd896c58ad2bcad8d8c57ae8c9933611cff412985eb32845821f8899"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "832a8f15f8402d0bc09a40937fd47feffe7afb002d41c288878c3920996fbd4f"
+sha256 = "09db52c316a7e9312a30d80ce4e385f2c957096563c509b7b6ed2bcc95bf39d8"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "c22c0153196e3e8f6a846e5a2f4210ffe393cc6997a32a4a8214bea222f98d56"
+sha256 = "21767432503afac87196a87557637692dcec76c0eba02a1dcf6bd1294926107a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/it.tsv"
@@ -107,7 +107,18 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Italian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2edbaa97d218efa890043f780268f74ee6d4b4b56512523bbd050f447ced37df"
+sha256 = "58f9514a06c74a7cdf90c6f7fb86ebb092af39857633f0779b44f0867a1c96e0"
+
+[[asset]]
+path = "crates/ui-egui/src/i18n/pl.tsv"
+title = "Polish interface translation catalog"
+author = "PdfCraft contributors"
+source = "Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources"
+licence = "MIT OR Apache-2.0"
+licence_file = "LICENSE-MIT"
+kind = "translation"
+usage = "Polish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
+sha256 = "7052f5ee37d26e0173bc5fe48411c94e1b48e31e0fc8a9188fca2bec54f29e32"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -118,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "64b352359b9b3919e5f04fa0fafa44f9cf1d3759f1829522a754bf391a20bd60"
+sha256 = "e780ffd93f9606c1a762862a961c3a82bde948a8a5f116b46e6f78ba84ac6ff4"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -129,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "3afb05c1bfedaca890e3d79ff27640be200b2174d550ce0474103eb4c33b31fa"
+sha256 = "ebbd6cd7bc586ca253047f7aa3b5c34cd9ecb29645afc3d9d2097c35277ffddc"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -140,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "a91e7153bc3208aafc7705601848666499ae2ac95dc4bd3b9a78ce749693c092"
+sha256 = "b760879b720c1d6de0dc9286ab044bebe4360962dece93060d7041b8955be7b2"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -151,7 +162,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "65927f653a4b33944f981ecef78c2bd81a7840924804063581bd09af94beee22"
+sha256 = "b07366d224bd5a394f705c17fa5d26e4f45d8903927e5dc18ed12e7713751d0a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -162,7 +173,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "d96bb503b25afc2f584f00253b371e8bd0266fa277a0b631d537377742c272cb"
+sha256 = "97c79be066c982347b48556a19b71e0db67a7f46932d1ce342b2ba5d29bf4582"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ar.tsv"
@@ -173,7 +184,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Arabic UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "f33971aa4e215933494fe181b83ee102f6e30178a83bfc944d35f7e7824d7692"
+sha256 = "f5e369934bf2ceca49224bf57f72289f0c82fc4c81b7c6363676d39362750d17"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
@@ -1396,6 +1407,17 @@ kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
 sha256 = "fe917d6144a9aed9a5297cb28addb9e582ac591a8f1c498a55aecea9b5c1783e"
 
+[[asset]]
+path = "assets/icons/minimize-2.svg"
+title = "Lucide icon \"minimize-2\""
+author = "Lucide Contributors (portions Cole Bemis, Feather)"
+source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize-2.svg)"
+licence = "ISC"
+licence_file = "assets/icons/LICENSE-lucide.txt"
+kind = "icon"
+usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
+sha256 = "1150437d5a870321c59b7ebca2e1bc3f6227f0fa03dd10484ab384dfe5110739"
+
 [[asset]]
 path = "assets/icons/minus.svg"
 title = "Lucide icon \"minus\""
@@ -2786,6 +2808,28 @@ kind = "icon"
 usage = "Embedded in pdfcraft.exe by apps/pdfcraft/build.rs (Explorer, taskbar, Start menu, Alt-Tab)"
 sha256 = "56daaaae9ae5389794909570885809adf5e1d9183bef2d9669ed2f9bba3ed6f5"
 
+[[asset]]
+path = "assets/app-icon/pdfcraft-document.svg"
+title = "PdfCraft PDF document icon (master vector)"
+author = "Lucide Icons and Contributors (document outline); PdfCraft contributors (PDF badge, lettering and composition)"
+source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg); contributor-original composition (assets/app-icon/README.md)"
+licence = "ISC AND (MIT OR Apache-2.0)"
+licence_file = "assets/app-icon/LICENSE-document.txt"
+kind = "icon"
+usage = "Master artwork for the Windows PDF file type icon; rendered by packaging/icons.sh, without fonts or external images"
+sha256 = "8da8278c2b89362be0a960879d453ff879d7544d6d58e47d5389574e8dfff77b"
+
+[[asset]]
+path = "assets/app-icon/pdfcraft-document.ico"
+title = "PdfCraft PDF document icon (Windows .ico, 16-256 px)"
+author = "Lucide Icons and Contributors (document outline); PdfCraft contributors (PDF badge, lettering and composition)"
+source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg); contributor-original composition (assets/app-icon/README.md)"
+licence = "ISC AND (MIT OR Apache-2.0)"
+licence_file = "assets/app-icon/LICENSE-document.txt"
+kind = "icon"
+usage = "Embedded in pdfcraft.exe as resource 2; the Windows installer uses it for PdfCraft.Document and Applications/pdfcraft.exe PDF file associations"
+sha256 = "ba3f9128b368fc6d17d376cf62dbdbc22455451c5c8c4779210d7a2a7409b9e6"
+
 [[asset]]
 path = "assets/app-icon/hicolor/16x16/apps/ai.storyteller.pdfcraft.png"
 title = "PdfCraft app icon, 16 px"
diff --git a/CLAUDE.md b/CLAUDE.md
index ccad9e7bd..77d6445b4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -3,8 +3,8 @@
 PdfCraft is a clean-room, open-source, Rust-native PDF application targeting Adobe Acrobat Pro parity. It runs natively on macOS, Windows, Linux and FreeBSD, and on the web via WASM. It is the sibling of `../photocraft` (a Photoshop-class editor) and follows the same conventions.
 
 ## Start every session here
-1. Read `plan/STATUS.md`: the current milestone, the next unchecked task and any blockers. `ROADMAP.md` holds the milestone estimates and progress; update its table and log at the end of every session.
-   - Read `ROADMAP.md` §Honest assessment and §Where we're lacking and where we're going before choosing work. They rank the gaps (own renderer, hardening, fidelity against Acrobat, editing existing content, Pro workflows, 1.0 polish); prefer them over new P2/P3 features, and keep both sections true when things change.
+1. Read `plan/STATUS.md`: the current milestone, the next unchecked task and any blockers. `ROADMAP.md` is the one-page summary (stage, numbers, progress log) and `docs/roadmap.md` the milestone table; at the end of every session update the milestone row and add a line to the ROADMAP.md progress log.
+   - Read `docs/gaps.md` (the ranked gaps: Acrobat interop, the open-issue backlog, the renderer and a fidelity harness, editing existing content, Pro workflows, 1.0 polish) and `docs/target-app-parity.md` (the numbers and how they are measured) before choosing work. Prefer the gaps over new P2/P3 features, and keep both documents true when things change (`docs/` progress docs follow craftrules `standards/progress-docs.md`: status line, revision history).
    - "Shipped" in `parity/` means "exists and tested", not "as good as Acrobat". Don't mark a feature shipped on a generic test, and say in its notes what is still missing.
 2. Read that task in `plan/execution-plan.md` §3, the relevant section of `plan/architecture.md`, and the README of the crate you're touching.
 3. Follow the **autonomous operation protocol** in `plan/execution-plan.md` §7 (orient → plan → implement + test → verify → record → commit). Don't stop to ask unless §7 lists the decision as the user's.
diff --git a/Cargo.lock b/Cargo.lock
index 1ca3786b2..40fc240e9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3648,6 +3648,7 @@ dependencies = [
 name = "pdfcraft-create"
 version = "0.5.0"
 dependencies = [
+ "encoding_rs",
  "hayro-syntax",
  "image",
  "pdfcraft-cos",
@@ -3823,6 +3824,9 @@ dependencies = [
 [[package]]
 name = "pdfcraft-platform"
 version = "0.5.0"
+dependencies = [
+ "zbus",
+]
 
 [[package]]
 name = "pdfcraft-preflight"
diff --git a/NOTICE b/NOTICE
index 62e047ec0..721847793 100644
--- a/NOTICE
+++ b/NOTICE
@@ -13,6 +13,10 @@ This product bundles third-party material under its own licenses, listed below.
 list (author, source, license) is in ATTRIBUTION.md.
 
 - Lucide icons (assets/icons/*.svg) — ISC License. See assets/icons/LICENSE-lucide.txt.
+  The Windows PDF file icon (assets/app-icon/pdfcraft-document.svg and .ico) adapts Lucide's
+  file-text outline and combines it with contributor-original artwork. See
+  assets/app-icon/LICENSE-document.txt (ISC AND (MIT OR Apache-2.0)), packaged as
+  LICENSE-document.txt beside the Windows executables.
 - Inter typeface (assets/fonts/Inter-*.ttf) — SIL Open Font License 1.1. See assets/fonts/OFL-Inter.txt.
 - JetBrains Mono typeface (assets/fonts/JetBrainsMono-*.ttf) — SIL Open Font License 1.1. See assets/fonts/OFL-JetBrainsMono.txt.
 - Dancing Script typeface (assets/fonts/DancingScript.ttf), Copyright 2016 The Dancing Script Project Authors — SIL Open Font License 1.1 (Reserved Font Name "Dancing Script"). See assets/fonts/OFL-DancingScript.txt.
diff --git a/README.md b/README.md
index 29f6636d6..2673229be 100644
--- a/README.md
+++ b/README.md
@@ -412,16 +412,16 @@ Logs, environment variables and other development notes are in [docs/development
 
 PdfCraft is young and moving fast. The aim is a workbench where you can view, organize, annotate, fill, sign and edit PDFs, at parity with Acrobat Pro.
 
-**Where it stands (October 2026), honestly:** about half of Acrobat Pro's offline features are in (88% of the must-haves), but that is roughly a third of the work, because the hardest parts are still ahead.
+**Where it stands (October 2026), honestly:** PdfCraft is **alpha**. Most of Acrobat Pro's offline features exist in some form (57% of all tracked features, 94% of the must-haves). For everyday work (viewing, commenting, filling and signing forms, organizing pages) it is about 55% of the way to replacing Acrobat; against all of Acrobat Pro, about 49%; for someone who only needs the essentials, about 66%. Every everyday workflow can be completed, but converting and sharing is weak: password-protected files Acrobat can't open, no Office-to-PDF, and Word export that loses layout.
 
 - **Good today:** viewing and search; organizing, combining and splitting; most kinds of comment; filling and authoring forms (with sandboxed JavaScript); passwords, redaction and sanitizing; basic digital signatures; printing; the Accessibility Checker; agent control through the CLI and MCP.
 - **Still borrowed:** pages are drawn by the `hayro` crate while our own renderer is built.
-- **Thin or missing:** reliable editing of existing text (especially CJK), OCR beyond Latin script, Office import/export, signature timestamps and long-term validation, PDF/A/X/UA preflight, XFA forms and localization.
+- **Thin or missing:** reliable editing of existing text (especially CJK and right-to-left), OCR beyond Latin script, Office import/export, signature tokens and online long-term validation, Preflight and PDF/X/UA, printing on Windows, and full XFA forms.
 - **Hardening:** fuzzing still turns up crashes and hangs on hostile files; each one is fixed with a regression test. Quality has not yet been compared with Acrobat side by side.
 
-**Next, in order:** our own renderer, hardening and a fidelity harness against Acrobat, editing existing content, then the Pro workflows (signatures, OCR, Office, preflight, XFA) and 1.0 polish.
+**Next, in order:** encrypted files that Acrobat opens, the reported bugs and Windows printing, a fidelity harness against Acrobat and the renderer, editing existing content, then the Pro workflows (OCR, Office, Preflight, signatures, accessibility tagging) and 1.0 polish.
 
-The honest assessment by area, what's lacking and where we're going are in **[ROADMAP.md](ROADMAP.md#honest-assessment-2026-10-05)**, with the full plan, progress and estimates.
+The summary is in **[ROADMAP.md](ROADMAP.md)**; the full assessment by dimension and area is in [docs/target-app-parity.md](docs/target-app-parity.md), the ranked gaps in [docs/gaps.md](docs/gaps.md), and the milestones in [docs/roadmap.md](docs/roadmap.md).
 
 ---
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 62b107043..452c410b0 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,160 +1,175 @@
 # PdfCraft roadmap
 
-The milestones, current progress and time estimates to Acrobat Pro feature parity. Keep this up to date:
-- **Every session:** update the progress column and add a line to the log.
-- **Every milestone:** re-estimate.
+**Stage: alpha** · next: beta, ~26% (ready for real work 49% → 75%) and ~400–700 h away
 
-Detailed task lists and acceptance tests are in `plan/execution-plan.md` (local-only). This file is the public summary.
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** minor (localized shortcut labels, #496; readiness table with hours per audience; full number as weighted sum 49%; earlier: second look: ready 40% → 47%, mainstream 55% added; core-workflow gate applied → alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
-**What "parity" means here:** the offline feature set of Acrobat Pro, milestones M0–M14. It excludes Adobe's cloud services (Document Cloud storage, Adobe Sign, the Adobe AI Assistant). Those have no clean-room equivalent; PdfCraft's alternatives are local-first, plus opt-in providers (M13).
+PdfCraft's one-page summary: how close it is to Adobe Acrobat Pro's offline feature set, and what
+comes next. Adobe's cloud services (Document Cloud, Acrobat Sign requests, shared review, the AI
+Assistant) are out of scope; PdfCraft's alternatives are local-first plus opt-in providers.
 
-## Estimate summary
+| Document | Holds |
+|---|---|
+| [docs/target-app-parity.md](docs/target-app-parity.md) | The authoritative assessment: method, weights, every dimension and area, stage, calibration |
+| [docs/gaps.md](docs/gaps.md) | Every known shortfall, ranked: the work list |
+| [docs/roadmap.md](docs/roadmap.md) | Milestones M0–M14, current focus, upcoming milestones, risks |
+| [docs/pdf-spec-parity.md](docs/pdf-spec-parity.md) | ISO 32000-2 coverage, annotations, actions, signatures, PDF/A/X/UA |
+| [docs/file-format-parity.md](docs/file-format-parity.md) | Every format Acrobat reads or writes, create/export conversions, OCR |
+| [docs/ui-parity.md](docs/ui-parity.md) | Tools, handles, shortcuts, panels, preferences |
+| [docs/hardware-parity.md](docs/hardware-parity.md) | GPU, printers, scanners, smart cards, pen, platforms |
+| [docs/localization-parity.md](docs/localization-parity.md) | Per-language status |
+| [docs/architecture.md](docs/architecture.md) | How PdfCraft is built |
+| `parity/acrobat-features.toml` | The machine-checked checklist (`cargo xtask parity`) |
 
-The unit is **wall-clock hours of agent work** (Claude Opus 5.5 coding continuously; human review time not included).
+**Keep it current:** every session, update the milestone row in [docs/roadmap.md](docs/roadmap.md)
+and add a line to the [progress log](#progress-log); when a gap closes, remove it from
+[docs/gaps.md](docs/gaps.md); re-measure fully when a major arc lands, at least monthly.
 
-**Where we are (2026-10-07, measured by `cargo xtask parity` over 806 tracked Acrobat Pro features; 23 more are Adobe-cloud-only and out of scope):**
+## Headline numbers
 
-| Tier | Features | Shipped | Partial | Shipped % | Weighted % (partial = ½) |
-|---|---|---|---|---|---|
-| P0 (must-have for 1.0) | 251 | 222 | 25 | 88.4% | 93.4% |
-| P1 | 326 | 174 | 38 | 53.4% | 59.2% |
-| P2 | 186 | 14 | 7 | 7.5% | 9.4% |
-| P3 | 43 | 1 | 0 | 2.3% | 2.3% |
-| **All** | **806** | **411** | **70** | **51.0%** | **55.3%** |
-
-**Effort-weighted parity: ≈ 30–35%.** Feature counts overstate progress: the remaining features include the hardest ones (our own renderer and font engine, editing existing text and reflow, OCR beyond Latin, XFA, PDF/A/X/UA preflight, Office export, long-term signature validation). Weighting each milestone by its estimated size gives about a third of the total work done. See **[Honest assessment](#honest-assessment-2026-10-05)** for what the numbers don't show.
-
-**Observed throughput:** about 72k lines of kept, tested Rust (plus 97 agent tools and ≈ 600 tests) in roughly 65–75 agent-hours since 2026-09-30, about 1.0k lines per agent-hour, with corpus, oracle and visual checks. That is faster than the original plan assumed, so the hour estimates below are revised down from the first plan (2,000–4,000 h).
-
-| Scenario | Remaining hours to full parity (M0–M14) | Calendar time |
+| | Value | Kind |
 |---|---|---|
-| One Opus 5.5 agent, continuous | **≈ 600–1,100 h** | ≈ 4–7 weeks |
-| 3–5 agents in parallel on separate crates | **≈ 250–450 h wall clock** | ≈ 2–3 weeks |
-| With human review, integration and pauses | — | ≈ 2–4 months |
+| **Feature breadth** | **≈ 67%** tier-weighted (56.9% unweighted: 423 shipped + 74 partial of 808; P0 94.2%) | measured, `parity/acrobat-features.toml` |
+| Feature breadth, mainstream practitioner | ≈ 70% tier-weighted (63.2% unweighted; P0 95.3%) | measured ([split](docs/target-app-parity.md#mainstream-practitioner-vs-full-acrobat-pro)) |
+| **Ready for real work**, full Acrobat Pro | **≈ 49%** (45–53%) | estimated, weighted sum over [dimensions](#by-dimension) |
+| **Ready for real work**, mainstream practitioner | **≈ 55%** (50–60%) | estimated ([split](docs/target-app-parity.md#mainstream-practitioner-vs-full-acrobat-pro)) |
+| **Ready for real work**, essentials user | **≈ 66%** (60–70%) | estimated ([method](docs/target-app-parity.md#essentials-user)) |
+| Remaining to **beta** | ≈ 400–700 Opus 5.5 agent-hours | estimated |
+| Remaining to **full parity** | ≈ 780–1,400 Opus 5.5 agent-hours (≈ 300–550 h wall clock with 3–5 agents) | estimated, calibrated on this repo's history |
 
-**How the estimate is built:** each milestone's remaining fraction (table below) times its size, re-based on the measured rate. The long poles are M2 (own renderer, ≈ 150–250 h), M7 (editing existing text and images, ≈ 150–250 h), M10 OCR and Office export (≈ 100–150 h), M6 JavaScript engine (≈ 60–100 h), M11 PDF/A/X/UA preflight (≈ 80–140 h) and M12 XFA/compare (≈ 80–140 h). The last 5–10% (odd real-world files, pixel-level polish against Acrobat) costs about as much as a mid-sized milestone.
+**Why alpha:** all six of Acrobat Pro's everyday workflows can be completed end to end on macOS
+(the [alpha gate](docs/roadmap.md#alpha-gate)), and users praise them (7.6k stars, ≈ 217k downloads
+of 0.4–0.5, switching reports such as #179). Two are only partial: editing (no CJK/RTL) and convert
+and share (password-protected files we write don't open in Acrobat or Reader, #774; no in-app
+Office→PDF; Word export loses layout, #773). Those, unmeasured quality against Acrobat, the borrowed
+`hayro` renderer, no printing on Windows (#756) and 245 open issues keep it far from beta.
 
-## Honest assessment (2026-10-05)
+### Readiness by audience
 
-Read this before choosing work. The feature table above counts what exists; this section says how solid it is.
+| Audience | Ready | Opus 5.5 agent-hours to ≈ 95% | Work that dominates |
+|---|---|---|---|
+| Full Acrobat Pro (ready for real work) | ≈ 49% | ≈ 780–1,400 h (≈ 300–550 h wall clock with 3–5 agents; 60–70% parallelizes) | Own renderer and fidelity harness, editing existing content, OCR and Office conversion, Preflight and PDF/A/X/UA, accessibility tagging, signatures for institutions |
+| Mainstream practitioner | ≈ 55% | ≈ 500–900 h (≈ 200–400 h wall clock; ≈ 60% parallelizes) | Rendering fidelity, editing existing text (CJK, RTL, subsets), conversion (Word layout, Excel, PowerPoint, Office→PDF), OCR languages, Windows printing, the bug backlog |
+| Essentials user | ≈ 66% | ≈ 180–330 h (≈ 90–180 h wall clock; ≈ 50% parallelizes) | Rendering fidelity on everyday files, Windows printing, launch and GPU stability, encrypted output Acrobat opens (#774), simple text fixes, Word export layout, Chinese UI glyphs |
 
-| Dimension | State | In one line |
+Hours are calibrated as in [Effort and calibration](docs/target-app-parity.md#effort-and-calibration) (≈ 1k kept lines per agent-hour for new features, 3–10× slower for hardening and fidelity). The audiences are nested subsets, so essentials ≤ mainstream ≤ full.
+
+## By dimension
+
+| Dimension | Ready | Weight | Remaining (h) | Doc |
+|---|---|---|---|---|
+| Features (14 areas) | ≈ 49% depth · 67% breadth | 40% | 610–1,100 | [target-app-parity.md](docs/target-app-parity.md#by-feature-area) |
+| UI/UX fidelity | ≈ 55% | 10% | 30–60 | [ui-parity.md](docs/ui-parity.md) |
+| File formats and conversion | ≈ 40% | 12% | 120–220 (within features) | [file-format-parity.md](docs/file-format-parity.md) |
+| PDF specification and standards | ≈ 60% | 8% | 150–260 (within features) | [pdf-spec-parity.md](docs/pdf-spec-parity.md) |
+| Hardware | ≈ 35% | 4% | 25–50 | [hardware-parity.md](docs/hardware-parity.md) |
+| Localization | ≈ 59% | 5% | 35–60 | [localization-parity.md](docs/localization-parity.md) |
+| Performance | ≈ 40% | 6% | 25–45 | [gaps.md](docs/gaps.md) gap 13 |
+| Stability | ≈ 50% | 8% | 45–80 | [gaps.md](docs/gaps.md) gap 6 |
+| Platforms | ≈ 70% | 5% | 15–30 | [hardware-parity.md](docs/hardware-parity.md#platforms) |
+| Ecosystem and plug-ins | ≈ 30% | 1% | 10–20 (within features) | [gaps.md](docs/gaps.md) |
+| AI features | ≈ 0% (in scope: local providers) | 1% | 20–40 (within features) | [gaps.md](docs/gaps.md) gap 23 |
+| **Total (weighted sum)** | **≈ 49%** | 100% | **≈ 780–1,400** | |
+
+## Features
+
+| Area | Breadth (measured) | Ready (estimated) | Remaining (h) |
+|---|---|---|---|
+| A Core model and fidelity | 76.8% | 70% | 25–45 |
+| B View and navigation | 62.5% | 55% | 110–190 |
+| C Content editing | 53.3% | 30% | 100–180 |
+| D Organize pages | 61.2% | 70% | 12–25 |
+| E Comments and review | 77.7% | 70% | 12–25 |
+| F Forms and JavaScript | 78.5% | 65% | 40–75 |
+| G Protect, redact, sanitize | 58.5% | 55% | 15–30 |
+| H Digital signatures | 62.2% | 45% | 40–70 |
+| I Scan and OCR | 23.1% | 15% | 40–75 |
+| J Create and export | 39.7% | 25% | 55–100 |
+| K Optimize and standards | 34.5% | 20% | 65–115 |
+| L Print | 39.7% | 35% | 30–55 |
+| M Accessibility | 63.1% | 30% | 40–70 |
+| N Automation, preferences, misc | 30.0% | 35% | 25–45 |
+
+What's strong and missing in each: [target-app-parity.md](docs/target-app-parity.md#by-feature-area).
+
+## Languages
+
+Measured from `crates/ui-egui/src/i18n/*.tsv` (2,143 keys). Detail and script notes:
+[localization-parity.md](docs/localization-parity.md).
+
+| Language | Code | Strings | Status |
+|---|---|---|---|
+| English | `en` | 100% | full |
+| Simplified Chinese | `zh-hans` | 97.4% | partial (no Hans UI face in releases, #826) |
+| Spanish | `es` | 95.5% | partial |
+| Hindi | `hi` | 0% | none |
+| Arabic | `ar` | 100% | partial (layout not mirrored) |
+| French | `fr` | 99.3% | partial |
+| Portuguese (Brazil) | `pt-br` | 99.4% | partial |
+| Indonesian | `id` | 0% | none |
+| Japanese | `ja` | 99.1% | partial |
+| German | `de` | 99.3% | partial |
+| Korean | `ko` | 0% | none |
+| Vietnamese | `vi` | 0% | none |
+
+Also shipped: Traditional Chinese, Russian, Bulgarian, Telugu, Hungarian, Ukrainian, Italian
+(94–100%) and Czech (menus only): **8 more languages**.
+
+## Upcoming
+
+Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md).
+
+| Rank | Milestone | Estimate (h) |
 |---|---|---|
-| Feature count | 51.0% shipped (P0 88%, P1 53%, P2 8%, P3 2%) | A typical viewer, annotator, form-filler or page organizer is mostly covered |
-| Effort | ≈ 30–35% | The remaining work is the hardest: M2 15%, M7 17%, M11 18%, M12 23%, M14 0% |
-| Foundations | Weakest | Rendering is still the bootstrap `hayro`; the local #307 candidate reads inspector data lazily through COS with `lopdf` compatibility logic; vendored patches are still carried |
-| Robustness | Early beta | Each 15-minute fuzz run found new out-of-memory crashes or hangs until 2026-10-05 |
-| Acrobat fidelity | Unmeasured | No systematic side-by-side comparison with Acrobat, visual or behavioural |
-| Product readiness | 0.2.1 | No code signing, performance budgets or keyboard-only operation yet; localization has its catalog system (English, partial Japanese) but few strings go through it |
+| 0 | Convert and share: encrypted output opens in Acrobat (#774), Create PDF from Office, Word export that keeps layout (#773) | 40–70 |
+| 1 | Backlog and platform: crash and wrong-result reports, Windows printing (#756), Chinese UI face (#826) | 65–120 |
+| 2 | Fidelity harness against Acrobat and the renderer decision (M2; owner decision on #841) | 110–190 |
+| 3 | Editing existing content (M7) | 100–180 |
+| 4 | OCR languages and Office export/import (M10) | 95–175 |
+| 5 | Preflight and PDF/A/X/UA (M11) | 65–115 |
+| 6 | Signatures for institutions: PKCS #11, timestamp servers, online LTV (M9) | 40–70 |
+| 7 | Accessibility tagging (M12) | 40–70 |
+| 8 | 1.0 polish: performance, right-to-left, missing languages, keyboard-only (M14) | 55–95 |
 
-**By area** (shipped share of each area's features):
+## Progress log
 
-| Area | Shipped | What's strong / what's missing |
-|---|---|---|
-| A Core | 75% | Parser, repair, encryption, incremental saves. Missing: lazy loading (`ByteSource`), own image codecs, PDF 2.0 extras, Arlington validation |
-| F Forms | 71% | Filling, authoring, AF scripts, sandboxed JavaScript, data exchange. Missing: XFA, wider JavaScript object model |
-| E Comments | 71% | Markup types with appearances, XFDF/FDF, summaries, calibrated 2D measuring (single-unit decimal scales). Missing: replace-text proposals, summary layouts, compound/fractional measurement formats |
-| M Accessibility | 62% | Checker (all 32 rules). Missing: autotag, Tags/Order/Content panels, Reading Order tool, keyboard-only operation |
-| B View | 55% | Shell, find, panels, tiles, web build. **Rendering is borrowed (`hayro`)**, so the 7 rendering P0s are only partial |
-| D Organize | 55% | Pages, combine, split, bookmarks, labels. Missing: replace pages, transitions |
-| G Protect | 54% | Passwords, permissions, redaction (including word lists), sanitize. Redaction codes (built-in FOIA and Privacy Act sets). Missing: certificate security, custom redaction code sets |
-| H Sign | 48% | PAdES B-B signing and validation; macOS Keychain and Windows CNG certificate store signing. Missing: timestamps (B-T), LTV (DSS/OCSP/CRL), FieldMDP, smart cards, PKCS #11 |
-| C Edit | 46% | Added text and images stay editable; header/footer/watermark. Missing: robust editing of existing text and images (fonts, subsets, reflow) |
-| L Print | 36% | Acrobat-style sizing, n-up, booklet, CUPS. Missing: Windows and web printing, production options |
-| J Create | 32% | From images, text, clipboard; Word/HTML/RTF export. Missing: Office import, Excel/PowerPoint export |
-| N Misc | 27% | CLI, MCP, UI control channel, Action Wizard. Missing: AI providers, performance budgets |
-| K Optimize | 26% | Reduce File Size, Optimizer. Missing: preflight, PDF/X/UA, transparency/fonts panels |
-| I OCR | 19% | Searchable image for Latin script. Missing: other scripts and accents, editable-text output, deskew |
+Newest first: the date, what moved, and the new overall estimate.
 
-**What "shipped" means, and doesn't.** A feature is shipped when it exists and at least one specific test covers it. 159 of 398 shipped features rest on exactly one test, and only about 5 cite an external oracle (`pdftotext`, `pdfsig`, OpenSSL, a corpus). Shipped does not mean "as good as Acrobat".
+- **2026-10-10 (M14, interface size):** Preferences ▸ Interface size scales the whole interface (50–250 %, setting `ui_scale`, control option `ui-scale`); 50 % brings an interface the system draws at 200 % back to 100 % (#456). Auto, the default, follows the desktop's text scaling: on Linux and the BSDs the desktop app reads GNOME's `text-scaling-factor` once at launch, so with Large Text (1.25) on a 1× display the interface no longer draws 13 px labels that show their pixels next to the system's text. The size is egui's zoom factor, so `pixels_per_point` grows with it and page rasters stay one texel per screen pixel; egui's own ⌘+/⌘− interface zoom is turned off so those keys stay page zoom. Still missing: KDE's font DPI and Windows' "Make text bigger" aren't read (both scale only text there), and egui's text is still greyscale-antialiased without the system's gamma, so small text looks rougher than GTK's at 100 %.
+- **2026-10-10 (M14, #496):** Shortcut displays share a UI formatter across toolbar search, registry menus, command palette, Help and tooltips. Modifier and key names use a dedicated catalog context in every bundled translation; missing entries keep the English key name rather than a command translation. German shows Strg/Umschalt/Entf, macOS retains its symbols, and runtime language changes refresh the display. Regression coverage checks localized layout widths, English/German switching, platform conventions and unchanged command execution. Milestone and effort estimates unchanged.
 
-**Robustness, measured.** `main`'s CI was red for 30+ runs until 2026-10-04 (a clippy lint, Windows line endings, flaky perf tests). Once the nightly fuzz job could finish, three 15-minute runs found 7 out-of-memory crashes (one aborted on every platform) and 11 hangs, 7 of them in our own `cos` parser rather than `hayro`. All are fixed or in review, but expect more: keep the nightly fuzz job green and turn every finding into a synthetic test.
+- **2026-10-10 (M5, shape fill colour, #686):** Rectangles, ovals, polygons and clouds can be filled. The comment quick bar has a Fill colour control for those tools ("No fill" or a swatch; it persists with the other per-tool styles), Comment Properties ▸ Appearance has a Fill colour row (one undo step with the other changes, carried over by Make Current Properties Default), and `comment_edit` takes `fill` (`"none"` removes it). `pdfcraft-annot::set_fill` writes or removes `/IC` and redraws the appearance; lines, ink and locked comments refuse it. Still missing: a custom colour picker (only the comment palette), and a separate fill for line endings.
+- **2026-10-10 (M10, #645):** Export all images and Save image as keep transparency. A JPEG with a soft mask (the usual cut-out photo) was written as the bare JPEG, and soft masks of another size than the image, JPEG-compressed soft masks, stencil `/Mask` images and colour-key `/Mask` arrays were dropped, so cut-outs came out on solid white or black. These images are now PNG with the mask as alpha (soft masks scaled to the image, `/Matte` un-blended); JPEGs without transparency are still written byte for byte. A negative image size no longer overflows in Save image as. JPX/JBIG2/CCITT masks are still left out. Overall estimate unchanged (about 30–35%).
+- **2026-10-10 (M12, XFA rows and areas):** Dynamic XFA forms lay out a repeating subform inside a top-to-bottom container in positioned content (a table in an area) with all its instances, drawn and measured, instead of one; and areas no longer appear in data paths (`pdfcraft_xfa::data_path`), since they are not data scopes. Before, a form whose fields sit in an area read none of the values Adobe's viewers saved, wrote what was filled here under a new element named after the area, which Adobe's viewers would most likely not read, and a FormCalc total looping over the table's rows failed on the rows that were missing. Layout, the script tree, reading and writing the data and the engine's value and row operations share the one path rule. Synthetic tests cover the layout, the path rule and the whole round trip (rows, Adobe-written values, a FormCalc total over all rows, the written data, reopening). Still open for such forms: XFA script objects (`<variables><script>`), which aren't supported. Overall estimate unchanged (about 30–35%).
 
-## Where we're lacking and where we're going
-
-The gaps that matter most, in priority order. Agents: prefer these over adding P2/P3 features, and check `parity/acrobat-features.toml` notes for the specifics of each.
-
-1. **Our own renderer (M2).** Replace `hayro` with the `model` crate, our font engine and the DisplayList devices (ADR-0004). It turns the 7 rendering P0 partials into shipped features and removes most vendored patches. The largest single lever.
-2. **Hardening.** Keep the nightly fuzz job green; fix every crash and hang with a synthetic regression test; finish lazy loading so large files aren't read whole; set performance budgets (`misc.performance-budgets`).
-3. **Measure fidelity against Acrobat.** Build a side-by-side harness (render, text, form behaviour) over synthetic fixtures (`plan/acrobat/`, clean-room rules apply). Until then, parity numbers count features, not quality.
-4. **Editing existing content (M7).** Fonts, subsets, reflow and CJK. The most visible gap for Pro users.
-5. **Pro workflows.** Signatures with timestamps and LTV (M9), OCR beyond Latin (M10), Office import/export (M10), preflight and PDF/A/X/UA (M11), XFA (M12).
-6. **1.0 polish (M14).** Code-signed installers, localization (the catalog system is in place and French, German, Spanish, Japanese, Russian and both Chinese catalogs cover the UI; Czech and Brazilian Portuguese still cover menus only), keyboard-only operation, a full screen-reader audit.
-6. **1.0 polish (M14).** Code-signed installers, localization (the catalog system is in place and French, Spanish, Japanese, Russian, Ukrainian and both Chinese catalogs cover the UI; Czech and Brazilian Portuguese still cover menus only), keyboard-only operation, a full screen-reader audit.
-6. **1.0 polish (M14).** Code-signed installers, localization (the catalog system is in place and French, Spanish, Italian, Japanese, Russian and both Chinese catalogs cover the UI; Czech and Brazilian Portuguese still cover menus only), keyboard-only operation, a full screen-reader audit.
-
-Decided against for now (owner, 2026-10-05): self-installing updates and an update check at start. Help ▸ Check for updates is manual only.
-
-## Milestones
-
-Hours are for a single agent (low–high). "Done" is the estimated fraction of that milestone's *acceptance criteria* that are met. It is not a count of lines of code.
-
-| M | Milestone | Est. hours | Done | Remaining (h) | Notes |
-|---|---|---|---|---|---|
-| M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 92% | 2–4 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
-| M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro |
-| M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 78% | 25–45 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
-| M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 78% | 25–45 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
-| M2 | Model, render, text | 200–350 | 15% | 170–300 | hayro bootstrap renderer (vendored patches). Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
-| M3 | Viewer app (native + web) | 80–150 | 88% | 10–19 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel. |
-| M3 | Viewer app (native + web) | 80–150 | 88% | 10–19 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; reusable icon catalog/buttons with keyboard focus indication; late browser startup downloads preserve the current document and Save target (#171). |
-| M4 | Engine, history, save, organize | 100–180 | 95% | 9–17 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web |
-| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 15–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export; flatten; Fill & Sign; agent tools. Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
-| M6 | Forms + JavaScript | 160–320 | 45% | 95–185 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done. Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA |
-| M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 17% | 210–420 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
-| M8 | Security + redaction | 100–180 | 66% | 35–65 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize. Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
-| M9 | Signatures (PAdES, validation) | 160–280 | 55% | 70–125 | Done: new `sign` crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL. Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites. Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11 |
-| M10 | OCR, create, export, print | 200–350 | 33% | 130–235 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, CUPS spooler, print-ready PDF). Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; Create PDF from multiple files (PDFs, images and text, edited as pages in the grid). Missing: OCR languages beyond Latin, editable-text OCR output, Office export/import, Windows/web printing |
-| M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 165–290 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
-| M12 | Accessibility, compare, measure, search, XFA | 200–380 | 23% | 155–295 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export. Missing: autotag, Tags/Order/Content panels, Reading Order tool, alt-text workflow, compare, geospatial/3D measurement, search index, XFA |
-| M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 33–66 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
-| M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Hungarian and Ukrainian catalogs have ≈1,800–2,100 entries each; Simplified Chinese, French, German, Hungarian and Ukrainian coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog; Ukrainian locales (`uk`, `uk_UA`) follow the Ukrainian one; its certificate and accessibility wording has a dictionary-checked follow-up. #307 (bounded large-PDF memory): share resource indexes and native parser metadata, inspect structure lazily, bound scan/full-save caches and raster storage, and reuse signature discovery safely. Three Linux trials retain full-save workflow RSS at 1.06 GiB (previously 3.69 GiB); rebased engine navigation uses 821 MiB (previously 997 MiB). With the RSS guard removed, the unmodified baseline was kernel OOM-killed in a 15 GiB container; rebased optimized inspection completed at 497.7 MiB in 1.78 s. Strict Clippy, 1,336 workspace tests and 30 WASM crate checks pass. The larger-host follow-up is closed. File-backed input, global memory budgets and Windows validation remain pending. Missing: more catalogs filled in, installers, performance budgets |
-| M14 | 1.0 polish: performance, localization, installers | 120–250 | 5% | 115–240 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`; Japanese, Traditional Chinese, Simplified Chinese, Russian, Spanish, French and Italian catalogs have ≈1,800 entries each; Simplified Chinese and French coverage is checked against the UI source; Czech and Brazilian Portuguese for menus. French locales (`fr`, `fr_FR`, `fr_CA`) follow the French catalog; Italian locales (`it`, `it_IT`) the Italian one. Arabic (`ar`, every `ar-*` locale) has a full catalog whose labels are reordered for display; the layout itself is still left to right. Missing: a right-to-left layout for Arabic, more catalogs filled in, installers, performance budgets |
-| | **Total (original plan sizing)** | **2,085–3,840** | **≈ 35%** | **≈ 1,350–2,500 at the planned rate; ≈ 600–1,100 at the measured rate** | |
-
-**Overall progress: about 30–35% of the effort (51.0% of features shipped).** The viewer and the core are far ahead of the editing features, because the viewer was built first so progress could be seen; rendering itself is still borrowed from `hayro`. See [Honest assessment](#honest-assessment-2026-10-05).
-
-## Critical path
-
-M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run in parallel across crates. The long poles are M7 (content editing), M9 (signatures) and M12 (XFA).
-
-## Risks most likely to push estimates up
-
-- Fidelity of text editing: fonts, subsets, reflow.
-- XFA dynamic layout.
-- Real-world signature chains and revocation checks.
-- The rendering long tail: Type3 fonts, broken fonts, shadings.
-- Correctness of PDF/A and PDF/UA conversion.
-- CPU rendering performance on the web.
-- Hostile input: every fuzz run so far has found new crashes or hangs.
-- Unmeasured fidelity: without an Acrobat comparison harness, quality gaps surface as user reports.
-
-## Log
+- **2026-10-10 (M9, #179 follow-up):** A Windows store certificate that can't sign is no longer left out of the Sign dialog silently: `windows::list` names it with the reason and Windows error code (no private key, a P-521/Brainpool/Ed25519 key, a key CNG can't open), the picker shows it greyed and unselectable, and `sign_windows_ids` returns it under `unusable`. A key that needs a permission prompt to open is listed instead of skipped. Reported by a user whose CA-issued identity showed in Acrobat but not here; a plain .p12 import into the CNG and legacy Microsoft providers was verified to list, so the next report will carry the reason. Store test adds a key-less certificate; overall estimate unchanged (about 30–35%).
+- **2026-10-10 (M10.2, JPEG scanning follow-up to #729):** Skip marker fill bytes and keep reading JFIF, APP14 and ICC metadata after the frame header, stopping before scan data or at EOI. Invalid segment lengths return errors; damaged or mismatched ICC profiles retain #729's device-space fallback. Synthetic regression cases added but not run at the contributor's request. Estimates unchanged.
+- **2026-10-10 (M13, desktop action outputs):** Desktop Action Wizard keeps every result when input basenames repeat, or when the destination already has a result from an earlier run. It preserves the original filename and extension for a free name and adds numbered suffixes for occupied names; the bounded search returns an error rather than reusing an occupied path. A real-shell regression drives Start twice and reopens the three-page and one-page results, checking that the original inputs and earlier output remain intact. This covers the desktop writer separately from the CLI/MCP action_run repair in #877. Milestone and effort estimates unchanged.
 
+- **2026-10-10 (M3, #740):** Column select, as in Acrobat: holding Alt (Option on macOS) when a drag starts selects only the text inside the rectangle, with the Select tool, the text markup tools and Redact; Edit ▸ Column select does it with a plain drag, for Linux desktops whose window manager takes Alt-drag (Xfce, Cinnamon, MATE, KDE Plasma 5 by default). Copy gives rows top to bottom with tab-separated cells (right to left in right-to-left rows, reading order for vertical text); `text_extract` takes the same rectangle as `rect`. The new label is in all 15 catalogs. Also repaired `parity/acrobat-features.toml`, which #650 had left unparseable (duplicate keys on `form.field-list`). Still missing: column selection across pages and ⇧-click extension. Estimates unchanged.
+- **2026-10-10 (progress docs, hours per audience):** Each readiness number gets its own hours to ≈ 95%: full ≈ 49% / 780–1,400 h, mainstream ≈ 55% / 500–900 h, essentials ≈ 66% / 180–330 h. The full number is now the standard's additive weighted sum over the dimensions (written weights), 47% → 49%: method aligned with the standard, no new evidence. Beta ≈ 26 points, ≈ 400–700 h.
+- **2026-10-10 (progress docs, gate consistency check):** Re-judged the convert-and-share row with the rule applied across all Crafting Apps (a workflow blocks only when it can't be completed at all; lossy exchange and missing sub-cases are beta items, as for FilmCraft's .prproj or VectorCraft's .ai). Unencrypted sharing works, encryption interop (#774) and Office→PDF are sub-cases, Word export is lossy rather than absent: partial, not blocking. **Stage pre-alpha → alpha**; numbers unchanged (47%, mainstream 55%; beta ≈ 400–700 h). Added an essentials-user score: ≈ 66% for someone who only opens, reads, comments, fills, signs, prints and rearranges pages.
+- **2026-10-10 (progress docs, second look and alpha gate):** At the owner's request, after practitioners praised PdfCraft, re-examined the numbers. User sentiment: 7,595 stars, 177k + 39k downloads of 0.4.0/0.5.0, 23 user issues with explicit praise and switching reports (#179, #232, #273), issue themes concentrated in core paths (launch/GPU, rendering, editing, CJK, signing, printing). The checklist is not niche-dominated (497 mainstream vs 311 specialist rows; P0 95% / 91%). The first pass's 9-point cross-cutting deduction double-counted Windows printing, interop and glyphs: **ready for real work 40% → 47%**, and **≈ 55% for the mainstream practitioner** (new). The new core-workflow gate (craftrules progress-docs) fails on convert and share (#774, no Office import, #773): **stage alpha → pre-alpha**, ≈ 40–70 h from alpha; beta still ≈ 400–700 h.
+- **2026-10-10 (progress docs, full re-measure):** Re-measured against Acrobat Pro 26.002.21931 (installed bundle inspected: document types, localizations, plug-in and framework names). Checklist: 423 shipped + 74 partial of 808 (56.9%; P0 94.2%), ≈ 67% tier-weighted. Ready for real work ≈ 40%; stage **alpha**; ≈ 400–700 h to beta, ≈ 780–1,400 h to full parity (up from 600–1,100 h: the first public releases surfaced Acrobat interop of encrypted output, Windows printing, Chinese UI glyphs, Word-export layout and a 245-issue backlog). This file restructured to the craftrules progress-docs standard; the honest assessment moved to `docs/target-app-parity.md`, the gap list to `docs/gaps.md`, the milestones (duplicated rows merged) to `docs/roadmap.md`; new `docs/architecture.md`, `docs/localization-parity.md`, `docs/file-format-parity.md`, `docs/pdf-spec-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`.
 - **2026-10-10 (M8, redact word lists):** Find text and redact gains "Multiple words or phrases": a list with one word or phrase per line, typed or imported from a `.txt` file, whose every match is marked in one undo step. Lists are trimmed, deduplicated and bounded (1,000 entries of 256 characters, files up to 1 MB). `redact_mark` takes `words` and reports how many marks each made, so an agent sees which found nothing. Tests cover the list parsing, the tool end to end (mark, undo, apply, invalid lists) and the dialog with an imported list; the new labels are translated in all 13 UI catalogs. `protect.redact-word-lists` is shipped; whole-word and case-sensitive matching and exporting the list are still missing. Estimates unchanged (about 30–35%).
 - **2026-10-10 (M4, bookmarks from structure):** Bookmark options ▸ New bookmarks from structure (command `bookmark.from_structure`, tool `bookmark_from_structure`) turns a tagged document's headings into bookmarks: H1–H6 through the role map, a plain H by its section nesting, nested by level under a new first "Untitled" bookmark as in Acrobat, each linked to its structure element (/SE). Titles come from /ActualText, the marked text on the page (decoded through the font's ToUnicode or encoding), /Alt or /T. The walk is bounded (depth, visits, heading and title caps, cycle-safe), an untagged document gets a clear error, and the edit is one undo step. Tests cover role maps, nesting, ToUnicode text, a self-referencing heading, the tool, undo and the panel. Still missing: Acrobat's element-type choice and destinations at the heading's position. The M4 row no longer lists Replace pages as missing (it shipped earlier). Overall estimate unchanged (about 30–35%).
 - **2026-10-10 (M9, signing encrypted documents):** Digital signatures, certification and document timestamps work on password-protected PDFs instead of failing with "not supported: signing encrypted documents". `pdfcraft-cos` no longer encrypts or decrypts a signature dictionary's `/Contents` (§7.6.2; by `/Type /Sig|/DocTimeStamp` or `/Contents` + `/ByteRange`), so the placeholder is patched after hashing as in a plain file and existing signatures in encrypted files read their real CMS (which also fixes their DSS `/VRI` keys and keeps them intact in a full rewrite). Opened with the user password, the signer applies the document's permissions (fill-forms for existing fields and timestamps, annotate + modify for new fields, modify for certifying) and names the permissions password when it refuses. Synthetic tests cover all four algorithms, counter-signing, tampering, permissions and the automation tools. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-10 (M9, signer certificate usage):** A trusted signer's certificate must also allow signing documents (RFC 5280 §4.2.1.3, §4.2.1.12, §4.2). A key usage without digitalSignature or nonRepudiation, an extended key usage with no document-signing purpose (any, emailProtection, codeSigning, RFC 9336 documentSigning, Adobe Authentic Documents, Microsoft document signing), or a critical extension PdfCraft doesn't process makes the verdict Unknown instead of Valid, and the details say which. Certificate policies are accepted as any policy. In-process certificates test each refusal and the accepted cases; a signed PDF from a trusted TLS-server certificate was Valid before and is Unknown now. Still missing: name constraints, and unknown critical extensions on issuer certificates. Overall estimate unchanged (about 30–35%).
 - **2026-10-10 (M14, side panel width):** The side panel keeps the width it is dragged to. The Bookmarks search row was 2 px wider than the panel, and a resizable egui panel keeps the width its content used, so every repaint (any pointer move) widened it up to 520 px. The Comments reply row did the same in languages with a longer "Post" (Russian, Spanish, …); Post now sits under a full-width reply field. Tests hold both panels' widths steady across 30 repaints. Overall estimate unchanged (about 30–35%).
 - **2026-10-10 (M8):** Redaction codes. Redaction properties offers "Custom text" or "Redaction code" under "Use overlay text": pick the U.S. FOIA (5 U.S.C. 552(b)) or U.S. Privacy Act (552a) set and tick codes, and new marks carry them as overlay text in the set's order ("(b)(6), (b)(7)(C)"). `redact_mark` takes `code_set` and `codes`, rejecting unknown sets and codes with the allowed list. Tests cover the code sets, the tool end to end (mark, apply, text) and the dialog; the new label is translated in all 13 UI catalogs. `protect.redaction-codes` is partial: Edit Codes, custom sets and their import/export are still missing. Estimates unchanged.
 - **2026-10-10 (M14, platform shortcut labels):** View ▸ Zoom and Page navigation, the rail, find-bar, toolbar and bookmark tooltips, and Help ▸ Keyboard shortcuts write shortcuts for the platform (`Ctrl+1`, `Ctrl+Shift++` off macOS) instead of hard-coded ⌘. Labels follow egui's detected OS, so the web build in a Linux or Windows browser shows Ctrl too. Fit visible is listed once in View. Translated tooltips take a `{key}` placeholder. Overall estimate unchanged (about 30–35%).
 - **2026-10-10 (M14):** Arabic interface language: a 2,137-entry catalog (`ar.tsv`, six CLDR plural forms, Arabic month and weekday names for dates), selected by `ar` and every `ar-*` locale. egui joins Arabic letters but places words left to right, so the catalog is put into display order when it loads (`bidi::display_rtl`: placeholders, keyboard shortcuts, edge spaces and caption colons are kept in place), and the command search matches a multi-word Arabic query word by word. Arabic glyphs come from the craft-fonts `Arab` face (kept in the web build); the CI and release pin of craft-fonts moves to the revision that has it, and `crates/fonts/build.rs` now refuses to embed the Noto Sans CJK SC that revision also carries (AGENTS.md §1.1). Not done: the layout is not mirrored, a wrapped Arabic paragraph breaks at the wrong end, and text typed into fields is not reordered; these need bidi support in the text layout itself.
 - **2026-10-10 (M6, #95):** Prepare a form edits shared General, Appearance and applicable Options properties in one atomic undo step. Explicit opt-in controls keep mixed values unchanged; partial appearance patches preserve custom font resources, each widget's style, indirect dictionary contents and unknown keys. Ctrl/Command+A selects the current page; rectangle selection and the Fields panel support multi-selection, with panel double-click opening properties. CLI/MCP `form_set_props` accepts a bounded, unique `fields` list. Regression tests cover save/reopen, undo/redo, locked-field rollback, stale dialogs, invalid arguments and selection. Names, positions, choices/defaults and script tabs remain individual GUI edits. Integrated upstream 0.5.0 and completed Portuguese/Italian catalogs without losing translator credit; shared-property labels now cover all 14 bundled translations. Kept the new Italian interface and Fill & Sign date-language registries aligned, including accented date output; the About-dialog regression waits for the larger contributor list to settle before clicking. Milestone and overall effort estimates unchanged (about 30–35%).
-
 - **2026-10-09 (M5, line-ending labels):** Comment properties names each line ending in words ("Reverse open arrow", "Butt", …) and those labels are translated. The PDF `/LE` token is unchanged. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M3, #171):** A browser startup `?file=` download opens in a background tab once the user has started working, so it cannot switch the active document or the next Save. Deliberate opens still activate their tab; Home, Combine files, workspace choices and another file's password prompt are preserved. Initial-view geometry is applied to the background document, and its script notices wait until its tab is selected. Synthetic shell tests cover the race, saving the local edit, tab switching, encrypted arrivals, errors and converted text. Milestone and overall effort estimates unchanged (about 30–35%).
-
 - **2026-10-09 (never-crash, #378):** On Windows the window is drawn on the GPU that drives the primary display, as on Linux: `EnumDisplayDevices` (through the safe `winsafe` crate) says which adapter shows each desktop display, and `pick_adapter` matches it to the wgpu adapters by PCI ids. Before, the low-power preference chose a Ryzen integrated GPU with no monitor on a desktop whose monitors hang off an NVIDIA card, and presenting across adapters took the AMD display driver down for two minutes. The log now names the GPU chosen. Synthetic tests for the Windows device-id parser and the primary-display rule; a live test on the running machine. Overall unchanged.
 - **2026-10-09 (page preview resolution):** The page view draws whole pages at twice the screen density when that bitmap still fits, then filters it down, so type and fine lines keep more detail. Print preview, page thumbnails, alternate-text figures and the page behind a moving signature are rendered at the size they are shown instead of being stretched up from a small image. Milestone and effort estimates unchanged.
 - **2026-10-09 (M5, line endings):** Lines, connected lines and callouts draw all ten standard line-ending styles. `comment_add` accepts `endings`, and Comment properties can change them in one undo step. An unknown name is left undrawn, and a non-finite direction is rejected. Cloudy borders remain polygon-only, so `comment.line-endings` stays partial. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M6, field rotation):** Regenerated form appearances honour `/MK /R` (0, 90, 180, 270). Filling or restyling a rotated field keeps the text, check mark and button caption turned, and Field Properties ▸ Position and `form_set_props` `rotation` set it, swapping width and height around the field's center when the axis changes. `form.appearance-regeneration` stays partial (Helvetica metrics are still approximate). Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M2, JPX sample normalization):** JPEG 2000 rescaling uses bounded integer arithmetic for supported 1–32-bit samples, including the 32-bit boundary that previously shifted past the integer width. Zero-sized rows are refused before scaling. Small contributor-original codestreams exercise decoding and rendering; endpoint and standard-depth regressions cover the same helper. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (M14, #577):** The desktop GPU setup enables the selected adapter's supported 2D texture extent instead of egui-wgpu's fixed 8192-pixel extent. This removes the artificial surface ceiling behind a mixed-DPI Windows startup crash when opening Outlook PDF attachments. Synthetic regressions cover the observed 8600 × 3423 surface, downlevel adapters and preservation of other device limits. Hardware resolution limits still apply; milestone and overall effort estimates are unchanged.
 - **2026-10-09 (M14, #577 follow-up):** A window larger than the GPU's texture limit no longer closes PdfCraft. Vendored egui-wgpu 0.36.2 fits the window's surface within `max_texture_dimension_2d` and draws egui at the matching scale, on every path that sizes a surface (start-up restore, resize, maximise, DPI change, a recreated surface); upstream is emilk/egui#8361. Root cause of the Outlook-only trigger: winit creates the window on the launching app's monitor and converts the restored size at that monitor's scale. Unit tests cover the 8600 × 3423 case and edge sizes; a Windows Sandbox (WARP) run of a window one pixel over the limit panicked before and kept drawing after. Estimates unchanged.
 - **2026-10-09 (M14, #519):** A GPU that can't configure the window's surface at launch no longer panics, so PdfCraft's OpenGL retry runs. Vendored egui-wgpu configures a new window's surface inside wgpu error scopes (`winit::catch_errors`) and returns a failure as an error, so eframe returns `Error::Wgpu` and the existing OpenGL retry (#530) runs (a device lost during that configure still panics, on the first frame). Before, wgpu's default handler panicked: on a 2015 Intel GPU with no D3D12 driver wgpu picked the GL adapter over WARP and timed out in `Surface::configure` (`GpuWaitTimeout`). A real-device regression test (a wgpu validation error inside `catch_errors`) panicked with the scopes removed; in Windows Sandbox a forced configure failure panicked unpatched and retried with OpenGL patched (Sandbox has no OpenGL 2.0, so the OpenGL window itself was not shown there). Defaulting Windows to DX12 only (WARP instead of wgpu's GL backend) is left to the maintainers. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (M5, Fill & Sign flatten on save):** Preferences and `doc_save` can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M3.9, native control lifecycle):** The opt-in UI control channel can request bounded window sizes, report observed dimensions, focus accessible widgets and inspect actual keyboard focus. Graceful quit uses the existing unsaved-work prompt, including uncommitted typing; force/discard parameters are rejected. Tests cover resize validation, Tab/Shift-Tab traversal, keyboard activation, invalid focus targets and quit cancellation with retained edits. Focused buttons preserve document undo/redo shortcuts, while text editors keep their own undo history. No milestone percentage change.
 
@@ -164,103 +179,61 @@ M0 → M1 → M2 → M3 → M4 must happen in order. After M4, M5–M12 can run
 
 - **2026-10-09 (M5.7, #434 partial):** Natural-size image stamps placed at a click or through `stamp_custom` remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.
 - **2026-10-09 (M1, raw-stream decoding limits):** COS checks unfiltered decoded data against the caller and per-stream limits before copying it, including empty filter arrays and streams whose Crypt filter was applied on load. Strict decoding uses the same raw-data guard. Tiny synthetic regressions cover exceeded, exact and zero-byte limits while retaining the filtered decoder behavior. Milestone and overall effort estimates unchanged (about 30–35%).
-
 - **2026-10-09 (M2, bounded page labels):** Inspector number trees have shared work, depth, and cycle limits; prefixes are bounded before decoding and complete custom labels have per-label and aggregate UTF-8 byte caps. A refused tree leaves physical page numbers intact and records one warning, with custom labels applied only after every range succeeds. Pure COS Roman and repeated-letter formatters are shared with Organize; label queries and edits return errors for unsupported output before changing the stored tree, while ordinary labels and prefix-only ranges remain supported. Synthetic tests cover safe just-over-limit cases, large first numbers, aliases, cycles, wide/deep trees, UTF-16/UTF-8 boundaries, aggregate output, and unchanged refused edits. Milestone and overall effort estimates unchanged (about 30–35%).
-
 - **2026-10-09 (M4, page grid zoom):** The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).
-
-- **2026-10-08 (M14, #307, upstream integration):** Rebased the local candidate onto main `a6bc63a`, preserving render-request deduplication, pixel-aligned rasters, signature editing and organizer insertion controls. Regressions cover inactive signature-preview cleanup, insertion gaps under virtualization, and canceled/reintroduced render requests. All 1,336 workspace tests pass (6 ignored), 193 parser tests pass (2 missing-fixture tests filtered), strict workspace/all-target Clippy passes without allowances, and 30 WASM crate checks pass. All 1,010 navigation frames, 12 workflow artifacts and eight 100-page external PDF checks match; 1×/2× desktop protocols pass again. Inspection is 497.7 MiB / 1.78 s, full-save 1.06 GiB / 29.64 s, and fresh desktop navigation/close/reopen 877 MiB. The desktop result is higher than the pre-rebase 832 MiB, while remaining 21.9% below the earlier bounded-writer stage. Windows, cold-start latency and global memory budgets remain open; no milestone percentage increase.
-
 - **2026-10-09 (M7, grouped artwork):** Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).
-
-- **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
-- **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
-- **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
-
-- **2026-10-08 (M5.7, signature placement):** Image signatures and initials preview at the pointer at their actual page size, including zoom and document/view rotation. A successful placement switches to Select with the new annotation selected; stamp resize handles use the existing engine edit, automation tool and undo history while preserving the appearance. Synthetic rendered UI and automation tests verify positioning, one placement per selection, resizing, undo/redo and save/reopen. Milestone and overall effort estimates unchanged.
-- **2026-10-08 (M5.7, image signatures):** Fill & Sign imports local PNG/JPEG signatures and initials through the Image tab, with previews, local persistence and undoable placement. The shared engine validates bounded images and preserves transparency and orientation; `fill_sign_add` accepts an image path. Synthetic UI and automation tests cover cancellation, invalid input, settings, undo/redo and save/reopen rendering. Overall effort estimate unchanged (about 30–35%).
-- **2026-10-08 (M14, #307, confirmed baseline OOM):** Removed the benchmark RSS guard and ran the frozen original and optimized CLI binaries in separate containers with a verified 15 GiB kernel memory limit, no swap and four CPUs. The unmodified baseline was kernel OOM-killed after 20.06 s with 14.97 GiB observed RSS; Docker recorded `OOMKilled=true`, exit 137 and an `oom` event. The optimized build completed the same 9,156-page inspection at 497.5 MiB in 1.75 s with unchanged metadata and no warnings. The original RSS remains a lower bound and elapsed time is time to failure. The kernel limit still constrains this experiment; no remote run was needed. No product changes or milestone percentage increase.
-
-- **2026-10-08 (M14, #307, original-baseline cutoff):** Repeated original unmodified CLI inspection with a 14 GiB RSS guard, up from 10 GiB, on the unchanged 9,156-page PDF. It reached 14,682,080 KiB and was stopped after 48.21 s before completion; no cgroup OOM kill occurred. The optimized build completed the same inspection at 495.7 MiB in 1.70 s. The original measurement is a lower bound, not a completed peak or timing. This guarded run failed before completion without an OS OOM kill. The user closed the larger-host follow-up; the prepared benchmark is retained as evidence. The later local guard-free experiment is recorded above. No product changes or milestone percentage increase.
-
-- **2026-10-08 (M14, #307, shared parsing and raster budgets):** Native render workers share a lazily initialized parser after cold-load/repair concurrency and watchdog recovery fixes, while retaining private render caches. Pages, organizer and Print request current visible thumbnails; retained active-view textures are limited to 24/128/128 MiB for thumbnails/pages/tiles and completed raster storage to 32 MiB/32 results, allowing one oversized result alone. Signature discovery uses a bounded source/edit-aware cache; the writer borrows unchanged objects and reuses xref rows. Engine navigation drops from 997 to 807 MiB with all 1,010 frame hashes unchanged. Three-trial full/incremental-save workflow times improve to 29.92/16.35 s at unchanged 1.06/1.08 GiB peaks; full serialization remains slower than before bounded saving, and the single mixed workflow takes 67.99 s versus 65.52 s. All 1,158 workspace tests pass (6 ignored in the regular run), 193 vendor tests pass (2 missing-fixture tests filtered), eight outputs pass 100-page external checks, and 29 WASM crate checks pass. Existing strict workspace Clippy warnings remain; UI lint validation explicitly allows the existing collapsible-match category. Fresh desktop navigation/close/reopen falls from 1,123 to 832 MiB; 1x/2x GUI runs pass visible-demand and texture-budget checks on original 10,000-page fixtures and the real file. Output-capacity and LRU experiments did not justify production changes. These are local Linux results and specific storage budgets, not global RAM limits or Windows validation. No parity or milestone percentage increase.
-
-- **2026-10-08 (M14, #307, bounded saving):** Full rewriting now uses private temporary caches and packs objects in batches limited by count and serialized bytes, preserving unknown objects, reference identity and encryption behavior without populating undo snapshots. Native render workers initialize only on a live request, avoiding unused parser copies during refresh/rebase. Three same-file Linux trials reduce rotate/full-save/close/reopen peak RSS from 3.69 to 1.06 GiB (35.53 to 32.51 s); incremental workflow RSS falls from 1.56 to 1.08 GiB. All 1,114 workspace tests pass (4 ignored); eight saved outputs pass external text/raster checks on 100 sampled pages each, and 1,010 navigation frames match. First use of each worker now pays parser initialization; steady-state viewing remains about 1 GiB. Single oversized objects, whole source/output buffers, and Windows behavior remain outside a global budget claim. No parity or milestone percentage increase.
-
-- **2026-10-08 (M14, #307, research/comparison):** Added a local external-reference suite outside the repository, using the same 9,156-page PDF with MuPDF, PDFium, Poppler and qpdf. Three Linux trials put the candidate's single-renderer 102-frame peak at 392 MiB, versus 348/347 MiB for MuPDF/PDFium with whole-file bytes (164/163 MiB with file input). The rotate/full-save/close/reopen workflow peaks at 3.69 GiB during serialization; incremental saving peaks at 1.56 GiB during rebasing. Different UI features, input/cache policies and writer compression settings prevent treating these as app rankings. Next targets are bounded object-stream packing, parsed-object lifetimes, snapshot overlap and file-backed input. No further runtime optimization or milestone percentage increase in this research step.
-
-- **2026-10-08 (M14, #307, local candidate):** Validated the 192.9 MB, 9,156-page VMware document in Linux. The original CLI exceeded a 10 GiB measurement cutoff before finishing inspection; the candidate inspects in about 1.8 s at 496 MiB and a 1,000-page navigation/close/reopen probe peaks at 990 MiB. It shares validated large resource indexes within each parser, reads panel structure on demand through COS with the previous inspector as a compatibility fallback, and scans standalone timestamps with temporary caches instead of retaining every object in the editor. Inspection output and 104 common sampled page renders match the handoff candidate. This is a different PDF revision from the original Windows issue; Windows GUI private memory and responsiveness remain unverified. No parity or milestone percentage increase.
-
-- **2026-10-08 (M9, #179):** Windows Current User Personal certificate store identities join file-based digital IDs, signing through CNG without exporting keys. RSA-2048 and ECDSA P-256 round trips use temporary certificates with cleanup guards; enumeration, missing identities, automation errors and the password-free UI have regression coverage. Smart cards and PKCS #11 remain planned; overall effort estimate unchanged.
-
-Newest first. One line per session: the date, what moved, and the new overall percentage.
-
 - **2026-10-09 (M9, review of #144):** Chain building checks what an issuer may do. `x509::build_chain` linked certificates by name and signature only, so an ordinary subscriber certificate embedded in a PDF, or one in the trusted list, could "issue" a certificate for any identity and chain to a trusted root. An issuer now needs basicConstraints CA:TRUE (an old v1 self-signed root without constraints still anchors), keyCertSign when it has a key usage, a pathLenConstraint that allows the CAs below it, and validity at the signing time (or the trusted timestamp/token time) when known; the signature's details say why an issuer was refused. Negative tests issue certificates in-process and cover each refusal, plus a signed PDF whose signer chains through an end-entity certificate (Unknown, not Valid). Still missing: key usage and extended key usage of the signer, name constraints and unknown critical extensions. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (M9):** A document timestamp stored as a signature field (Documenso writes `Timestamp_1` that way, its `/V` a `/Type /DocTimeStamp` dictionary) was read as a CMS signature and reported "altered or corrupted since the signature was applied" on an untouched file. A field value with `/SubFilter /ETSI.RFC3161` is validated as a timestamp now, and standalone timestamps are found by `/DocTimeStamp` (ISO 32000-2 §12.8.5) as well as the `/Type /Sig` older writers used; `timestamp_document` writes `/DocTimeStamp`. Regression tests build the same structure with a test TSA. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (M9, signatures as DocuSign and Documenso write them, #144):** A real DocuSign + Telekom qualified-signature PDF showed "DER signature wrong" although Acrobat validates it: both CMS blobs use BER indefinite lengths. The CMS is read with the BER reader that #453 added (`Tlv::parse_ber`: indefinite lengths, segmented OCTET STRINGs, depth-bounded) while certificates and signed attributes are still verified over their own exact bytes, and the details say the signature was BER; tests build the nesting bombs a crafted /Contents could hold. Behind that, later revisions that add DSS data (indirect `/Certs`, `/VRI`) or rewrite the catalog's XMP were classified as disallowed changes; they are permitted now, narrowly (review by echelon on #144): only objects reached through `/DSS` `/Certs|CRLs|OCSPs|VRI` with the shape of their role, and new or only grown since signing, count as the store, and only the catalog's `/Metadata` is the document's XMP. A `/DSS` entry naming a page's contents, or a `/Type /DSS` or `/Type /Metadata` label on an existing dictionary or stream, makes nothing permitted. Six of the new tests fail on the previous code, among them a Form XObject labelled `/Type /Metadata` before signing that could be rewritten under a Valid signature. Negative tests at every DocMDP level. Cross-checked with pdfsig (both signatures valid). Still missing: AATL/EUTL trust lists (a separate change: they need CA-constraint checks in chain building first). Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (M9, signature algorithms, #386):** Validation reads what real signers write. Digests SHA-224, SHA-512/224, SHA-512/256, SHA3-224/256/384/512 and RIPEMD-160 (beside SHA-1/2); RSA PKCS#1 with or without the DigestInfo's NULL (checked by building the one expected encoding and comparing it byte for byte, in `rsa_pad`, for every digest; a bare digest without any DigestInfo is refused, it doesn't say which hash it uses); RSA-PSS with the hash, MGF1 hash and salt length the signature declares; ECDSA as DER, non-minimal DER or raw r‖s on P-256, P-384, P-521 and brainpoolP256r1/P384r1/P512r1 (the last hand-written on `crypto-bigint`, no RustCrypto crate exists); Ed25519 (RFC 8419); the legacy `adbe.x509.rsa_sha1` format. Algorithms PdfCraft can't check give Unknown instead of Invalid. Review of #386 (echelon): an RSA signature value must be below the modulus (RFC 8017 §5.2.2; `s` and `s + n` both verified before), and SHA-1 and RIPEMD-160 signatures still validate but the signature's details now say the algorithm is weak (wording pinned by tests). Found on the way, each with a regression test that failed first: a brainpoolP512r1 key with a coordinate not reduced modulo p panicked inside the bigint arithmetic (the certificate comes from the PDF), now refused, and the point at infinity is an invalid signature rather than an error. Tolerated encodings are listed in the signature's details. Vectors made with OpenSSL; cross-checked with pdfsig. Still missing: Ed448/DSA, signing with the new digests. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (M14, German interface follow-up):** Follow the merged German catalog with shorter search/action labels, corrected callout/accessibility wording and a distinct certificate Subject context. Localized tool names retain their capitalization and comment composer titles go through the catalog. Search hints reserve shortcut space and Home cards bound text with full hover text; layout, context and German Preferences/search control regression tests cover these changes. Overall effort estimate remains about 30–35%.
-
 - **2026-10-09 (M2, PDF-function hardening):** Vendored function construction has a shared 64-level/10,000-node limit and path cycle detection; calculator parsing and evaluation have shared depth/work budgets. Calculator integer division, logical shifts, rotations and indices avoid input-driven panics, and fixed-size stack errors propagate. Synthetic tests exercise exact/over limits, shared children and cyclic references, with invalid shading calculations preserving later page content. Limits return the existing optional failure and log their reason when logging is enabled. Milestone/overall effort estimates remain unchanged (about 30–35%).
-
 - **2026-10-09 (community, destinations):** Bookmarks and links go to their destination's position, not just its page (ISO 32000-2 §12.3.2.2): `/XYZ` puts (left, top) at the window's top-left and applies a non-zero zoom; `/Fit`, `/FitH` and `/FitV` switch to fit page, width and height with `top` or `left` at the window's edge; `/FitR` zooms to fit the rectangle, centred. Named destinations resolve the same way; crop-box origin, `/Rotate` and view rotation are accounted for; malformed or non-finite operands fall back to the top of the page. Not yet: the `/FitB*` content box (read as the page). Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (M2, image resampling bounds):** Image resampling checks source buffers, finite transforms, target RGBA sizes, intermediate scratch dimensions and estimated filter work before planning or allocating; wide valid sources may shrink before backend side limits. Oversized or failed resampling retains the original pixels and placement when the source fits the backend; invalid sources, unrepresentable fallbacks and failed staging/output reserves are skipped with a logged warning. Small synthetic metadata regressions and an anisotropically transformed image cover the guards and fallback. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (community, M14, Hungarian):** Magyar (`hu`) is a complete interface catalog (2,036 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for `hu` and `hu_HU`, and from Preferences. Informal "te"; commands are nouns (Mentés, Megnyitás). After a numeral the noun stays singular, so both plural forms match. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names; the bundled Latin faces cover Hungarian diacritics including ő and ű. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M14, Windows Auto):** Neutral launcher locales (`C`, `C.UTF-8`, `POSIX`) no longer select English ahead of the Windows preferred display-language list. Explicit supported locale overrides retain their priority. Regression tests use existing catalogs and cover neutral/mixed overrides, unsupported first display tags and multiple preferred Windows languages. Catalogs and other platforms are unchanged; overall effort estimate remains about 30–35%.
-
 - **2026-10-09 (community, M14, German):** Deutsch (`de`) is a complete interface catalog (2,035 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for `de`, `de_DE`, `de_AT`, `de_CH` and other German locales, and from Preferences. Informal "du", infinitive for commands. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names; the bundled Latin faces cover umlauts, ß and German quotes. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (community, M7, Arabic added text):** Add text writes Arabic into the PDF instead of `?`. The text is shaped with the craft-fonts `Arab` face through harfrust (already in the tree via egui): joining forms, ligatures and mark positions. Each line is laid out in display order by the Unicode bidirectional algorithm, so Arabic mixed with Latin words, European or Arabic-Indic digits and brackets reads correctly; justified right-to-left paragraphs end at the right edge. Each cluster (a letter with its dots or marks) becomes one glyph of a Type 3 font built from the face's outlines, with a ToUnicode entry, so `text_extract`, copy and search get every letter once and no font file is embedded. Wrapping measures shaped words. Each item has its own fonts under names free on the page (a full save renumbers objects but not resource names); updating or deleting the item removes them. Without the face, adding Arabic text returns a clear error and changes nothing, while an existing item holding Arabic still moves and retypes, drawn as `?` as before. Tests cover shaping, display order, ToUnicode, font names and clean-up on one page, and odd input (empty lines, direction controls, lone marks, 18,000 characters). Not yet: bold/italic Arabic, Hebrew, right-to-left typing in the box (misc.rtl-ui), editing existing Arabic text (edit.rtl-cjk-editing). The craft-fonts revision pinned for releases predates its Arabic face, so release builds report the missing font until the pin moves. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (M2, predictor hardening):** Empty PNG predictor frames return without row buffers. Packed TIFF Predictor 2 rows reject overflowing dimensions and size per-component scratch to the samples present in the input, aligned with upstream lopdf#589. Synthetic regressions cover malformed dimensions, partial rows, 1/2/4-bit decoding and padding. Overall estimate unchanged (about 30–35%).
 - **2026-10-09 (community, document inspection):** Annotation dates preserve non-date Unicode text instead of panicking while opening; failed auxiliary structure inspection keeps renderer page geometry and reports a warning. Synthetic UTF16BE annotation, UTF8-boundary and independent panic regressions cover the fix. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (community, M14, #503):** Ukrainian (Українська, `uk`) adds 2,047 original catalog entries covering commands, tools, dialogs, panels, notices, history and contributor controls. Auto resolves `uk`/`uk_UA`; the manual preference persists. Integer plurals distinguish one/few/many, including 11–14 and large counts; fixed-count templates use count-neutral wording. Calendar dates use genitive month names; Home cards fit wrapped text and the search hint keeps clear of its shortcut. Coverage checks scan UI literals, and font checks use bundled Inter and JetBrains Mono, including ґ/є/і/ї. Control tests check translated Preferences, command search, error framing and language switching with unsaved documents. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (community, M5, #158):** Fill & Sign date format. Preferences ▸ Date format sets the pattern Fill & Sign dates use: 12 presets or any pattern in Acrobat date letters (with `\` escapes), checked and previewed as typed, remembered, and settable through `fill_sign_date_format`, `fill_sign_add` `format`/`language` and `ui set date-format`/`date-language`. Month and weekday names come in the interface languages (Czech in the genitive after a day), following the interface language unless one is picked. Fill & Sign text is still Helvetica/WinAnsi, so a date with other letters (Czech ř, Japanese, Chinese) is refused with a warning rather than saved as "?". This goes past Acrobat, whose Fill & Sign has no format setting. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (M14, #503 follow-up):** Reviewed the complete Ukrainian catalog with VESUM 6.8.6 and manually checked the labels added when #509 landed. Certificate Subject now names the certificate holder separately from the document topic; certificate types and fingerprints, equal field sizes, keyboard/assistive-technology guidance and table sections use clearer contextual wording. Reviewed technical compounds and abbreviations remain unchanged. Overall effort estimate remains about 30–35%.
-
 - **2026-10-09 (community, Home pinned folders):** Home gets a Folders section: File ▸ Pin folder to Home… (or "Pin a folder…" on Home) pins up to 8 folders, and each lists its newest PDFs (name, how long ago, size; 8 at first, up to 100 with Show more), one click to open, Unpin to remove. Folders are read on a worker thread and listed again every few seconds while Home shows, so new scans appear without reopening anything; a folder that can't be read (moved, offline synced drive) stays pinned and says so. Each folder is described by where it is ("iCloud Drive", "OneDrive · Contoso", "Documents › Work") rather than its full path, so two folders called "Scans" can be told apart. Cloud drives work through their local synced folder; nothing is read through a provider's API. Settings keep only absolute paths, without duplicates. Command label translated in every catalog; Home strings in French, Spanish, Japanese and both Chinese catalogs. Not yet: subfolders, search inside a pinned folder, the web build. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (community, M14, Telugu):** Telugu (తెలుగు, `te`) as a complete catalog of 1,984 entries covering every command, All tools entry, dialog, panel and notice; `te` and `te_IN` locales follow it. Telugu text is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, storytold/craft-fonts#10), kept in the web build too, after the CJK and Arabic faces; egui shapes its conjuncts. Commands use the plain imperative and sentences the polite form. The craft-fonts revision pinned for releases has no Telugu face yet, so release builds show Telugu as replacement boxes until the pin moves. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-09 (M14, Simplified Chinese About):** The About tabs, contributor controls and statistics, and model table now have Simplified Chinese translations, along with multiline link-privacy and cut-and-stack guidance. Coverage checks include direct `i18n::t` calls, multiline literals and dynamic credit labels; UI control checks exercise the translated About tabs and tables. Chinese font delivery remains incomplete; overall ≈ 30–35% (unchanged).
-
 - **2026-10-09 (M14, #305):** Windows MSI rejects per-user installation overrides while allowing removal of legacy per-user installs and keeps its progress message visible. README documents unattended deployment without a desktop shortcut. Compiled x64 MSI checks pass; ARM64 install regressions added for CI. Overall estimate unchanged (about 30–35%).
-
+- **2026-10-09 (M13, MCP #451):** common command, batch, inspection and bounded preview tools share the existing confined automation path. MCP tools carry complete hints and reject unknown top-level keys as invalid parameters.
+- **2026-10-08 (M14, #307, upstream integration):** Rebased the local candidate onto main `a6bc63a`, preserving render-request deduplication, pixel-aligned rasters, signature editing and organizer insertion controls. Regressions cover inactive signature-preview cleanup, insertion gaps under virtualization, and canceled/reintroduced render requests. All 1,336 workspace tests pass (6 ignored), 193 parser tests pass (2 missing-fixture tests filtered), strict workspace/all-target Clippy passes without allowances, and 30 WASM crate checks pass. All 1,010 navigation frames, 12 workflow artifacts and eight 100-page external PDF checks match; 1×/2× desktop protocols pass again. Inspection is 497.7 MiB / 1.78 s, full-save 1.06 GiB / 29.64 s, and fresh desktop navigation/close/reopen 877 MiB. The desktop result is higher than the pre-rebase 832 MiB, while remaining 21.9% below the earlier bounded-writer stage. Windows, cold-start latency and global memory budgets remain open; no milestone percentage increase.
+- **2026-10-08 (M5.7, signature resize proportions):** Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.
+- **2026-10-08 (M5.7, live signature adjustment):** Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and `comment_image_preview` tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.
+- **2026-10-08 (M10/M4, create from multiple files):** Create a PDF ▸ Multiple files is live. The picked PDFs, images and `.txt` files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into `pdfcraft-create` (`source_kind`), with one engine entry point (`Session::convert_to_pdf`) shared by Open, Insert, Create and the new `doc_create_multiple` tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).
+- **2026-10-08 (M5.7, signature placement):** Image signatures and initials preview at the pointer at their actual page size, including zoom and document/view rotation. A successful placement switches to Select with the new annotation selected; stamp resize handles use the existing engine edit, automation tool and undo history while preserving the appearance. Synthetic rendered UI and automation tests verify positioning, one placement per selection, resizing, undo/redo and save/reopen. Milestone and overall effort estimates unchanged.
+- **2026-10-08 (M5.7, image signatures):** Fill & Sign imports local PNG/JPEG signatures and initials through the Image tab, with previews, local persistence and undoable placement. The shared engine validates bounded images and preserves transparency and orientation; `fill_sign_add` accepts an image path. Synthetic UI and automation tests cover cancellation, invalid input, settings, undo/redo and save/reopen rendering. Overall effort estimate unchanged (about 30–35%).
+- **2026-10-08 (M14, #307, confirmed baseline OOM):** Removed the benchmark RSS guard and ran the frozen original and optimized CLI binaries in separate containers with a verified 15 GiB kernel memory limit, no swap and four CPUs. The unmodified baseline was kernel OOM-killed after 20.06 s with 14.97 GiB observed RSS; Docker recorded `OOMKilled=true`, exit 137 and an `oom` event. The optimized build completed the same 9,156-page inspection at 497.5 MiB in 1.75 s with unchanged metadata and no warnings. The original RSS remains a lower bound and elapsed time is time to failure. The kernel limit still constrains this experiment; no remote run was needed. No product changes or milestone percentage increase.
+- **2026-10-08 (M14, #307, original-baseline cutoff):** Repeated original unmodified CLI inspection with a 14 GiB RSS guard, up from 10 GiB, on the unchanged 9,156-page PDF. It reached 14,682,080 KiB and was stopped after 48.21 s before completion; no cgroup OOM kill occurred. The optimized build completed the same inspection at 495.7 MiB in 1.70 s. The original measurement is a lower bound, not a completed peak or timing. This guarded run failed before completion without an OS OOM kill. The user closed the larger-host follow-up; the prepared benchmark is retained as evidence. The later local guard-free experiment is recorded above. No product changes or milestone percentage increase.
+- **2026-10-08 (M14, #307, shared parsing and raster budgets):** Native render workers share a lazily initialized parser after cold-load/repair concurrency and watchdog recovery fixes, while retaining private render caches. Pages, organizer and Print request current visible thumbnails; retained active-view textures are limited to 24/128/128 MiB for thumbnails/pages/tiles and completed raster storage to 32 MiB/32 results, allowing one oversized result alone. Signature discovery uses a bounded source/edit-aware cache; the writer borrows unchanged objects and reuses xref rows. Engine navigation drops from 997 to 807 MiB with all 1,010 frame hashes unchanged. Three-trial full/incremental-save workflow times improve to 29.92/16.35 s at unchanged 1.06/1.08 GiB peaks; full serialization remains slower than before bounded saving, and the single mixed workflow takes 67.99 s versus 65.52 s. All 1,158 workspace tests pass (6 ignored in the regular run), 193 vendor tests pass (2 missing-fixture tests filtered), eight outputs pass 100-page external checks, and 29 WASM crate checks pass. Existing strict workspace Clippy warnings remain; UI lint validation explicitly allows the existing collapsible-match category. Fresh desktop navigation/close/reopen falls from 1,123 to 832 MiB; 1x/2x GUI runs pass visible-demand and texture-budget checks on original 10,000-page fixtures and the real file. Output-capacity and LRU experiments did not justify production changes. These are local Linux results and specific storage budgets, not global RAM limits or Windows validation. No parity or milestone percentage increase.
+- **2026-10-08 (M14, #307, bounded saving):** Full rewriting now uses private temporary caches and packs objects in batches limited by count and serialized bytes, preserving unknown objects, reference identity and encryption behavior without populating undo snapshots. Native render workers initialize only on a live request, avoiding unused parser copies during refresh/rebase. Three same-file Linux trials reduce rotate/full-save/close/reopen peak RSS from 3.69 to 1.06 GiB (35.53 to 32.51 s); incremental workflow RSS falls from 1.56 to 1.08 GiB. All 1,114 workspace tests pass (4 ignored); eight saved outputs pass external text/raster checks on 100 sampled pages each, and 1,010 navigation frames match. First use of each worker now pays parser initialization; steady-state viewing remains about 1 GiB. Single oversized objects, whole source/output buffers, and Windows behavior remain outside a global budget claim. No parity or milestone percentage increase.
+- **2026-10-08 (M14, #307, research/comparison):** Added a local external-reference suite outside the repository, using the same 9,156-page PDF with MuPDF, PDFium, Poppler and qpdf. Three Linux trials put the candidate's single-renderer 102-frame peak at 392 MiB, versus 348/347 MiB for MuPDF/PDFium with whole-file bytes (164/163 MiB with file input). The rotate/full-save/close/reopen workflow peaks at 3.69 GiB during serialization; incremental saving peaks at 1.56 GiB during rebasing. Different UI features, input/cache policies and writer compression settings prevent treating these as app rankings. Next targets are bounded object-stream packing, parsed-object lifetimes, snapshot overlap and file-backed input. No further runtime optimization or milestone percentage increase in this research step.
+- **2026-10-08 (M14, #307, local candidate):** Validated the 192.9 MB, 9,156-page VMware document in Linux. The original CLI exceeded a 10 GiB measurement cutoff before finishing inspection; the candidate inspects in about 1.8 s at 496 MiB and a 1,000-page navigation/close/reopen probe peaks at 990 MiB. It shares validated large resource indexes within each parser, reads panel structure on demand through COS with the previous inspector as a compatibility fallback, and scans standalone timestamps with temporary caches instead of retaining every object in the editor. Inspection output and 104 common sampled page renders match the handoff candidate. This is a different PDF revision from the original Windows issue; Windows GUI private memory and responsiveness remain unverified. No parity or milestone percentage increase.
+- **2026-10-08 (M9, #179):** Windows Current User Personal certificate store identities join file-based digital IDs, signing through CNG without exporting keys. RSA-2048 and ECDSA P-256 round trips use temporary certificates with cleanup guards; enumeration, missing identities, automation errors and the password-free UI have regression coverage. Smart cards and PKCS #11 remain planned; overall effort estimate unchanged.
 - **2026-10-08 (M4, Combine files):** Combine files is now its own tab instead of a dialog: a table of the files (name, pages, size, modified, warnings) whose columns sort, resize and move, with the layout kept in the settings. Files, folders (optionally with subfolders) and open documents can be added, or dropped on the tab; rows select like a file manager (Ctrl/Shift), move as a block by toolbar, Alt+arrows or drag, and every change undoes with ⌘Z. Problems show before Combine: password-protected files, security settings that withhold page assembly, bad page ranges (checked as typed), duplicates; protected files unlock with their open or permissions password, also headlessly (`doc_combine` `passwords`). The result is never encrypted, and the list says so. `organize.combine-sort` shipped; `organize.combine-options` partial (open files). Still missing: protecting the result in the same step, file-size and PDF/A options. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-08 (M14, French):** Français (`fr`) is a complete interface catalog (about 1,880 entries), selected automatically for `fr`, `fr_FR`, `fr_CA` and other French locales, and from Preferences. Coverage tests check commands, All tools labels and every `tl!` literal; history labels keep captured names. Latin UI faces cover the catalog. Localization remains partial for Czech and Brazilian Portuguese; overall ≈ 30–35% (unchanged).
-
 - **2026-10-08 (M14, right-to-left file names):** A tab with an Arabic or Hebrew file name showed replacement boxes. The interface now takes an `Arab` face from craft-fonts when the build input has one, and on desktop falls back to one font installed on the machine for characters no embedded face has (`PDFCRAFT_SYSTEM_FONTS=0` turns that off; README screenshots do). File names and paths in the tab strip, the recent-files list and Properties are put in display order, since egui joins the letters but does not reorder runs. Still missing: multi-line text (bookmarks, comments, search results), text input and a mirrored layout, so `misc.rtl-ui` stays planned; the craft-fonts revision pinned for releases predates its Arabic face, so release builds rely on the installed font until the pin moves. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-08 (community, M3, #214):** In single-page view, when the whole page fits, the wheel turns pages: one per wheel notch, one per trackpad swipe including its momentum. The rail gets a Page display button between rotate and zoom with Acrobat's view choices (Fit to width scrolling, Fit one full page, Actual size, Zoom to page level, Fit visible, Read mode, Full screen) and the page layouts. Preferences gets Default page display and Default zoom, which every new tab uses. In continuous view, Fit page and Fit height fit the largest page, so mixed page sizes no longer jump while scrolling. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-08 (M14, Windows Chinese Auto):** Auto now reads the Windows display language after locale environment overrides, selecting Simplified or Traditional Chinese through the existing locale mapping. Added Chinese region/script and Windows query regressions. Chinese font delivery remains incomplete. Localization remains partial; overall ≈ 30–35% (unchanged).
-
 - **2026-10-08 (M3, themes):** Toolbar and Display theme now share System, Light and Dark preferences, one command path and persistent settings; the duplicate View toggle is removed. Effective colours track the OS only in System mode, with egui popup styles kept in sync. Overall estimate unchanged (about 30–35%).
-
 - **2026-10-08 (M14, Simplified Chinese):** Added 208 translations, bringing the catalog from 1,625 to 1,833 entries. PhotoCraft-style coverage checks protect registered commands, All tools labels and UI `tl!` literals; generated history and diagnostic regressions preserve user values. Chinese font delivery remains incomplete: the release-pinned craft-fonts input has no Hans face and the web build only embeds the Japanese UI face (see #112 and #140). Localization remains partial; overall ≈ 30–35% (unchanged).
-
+- **2026-10-08 (community, #135):** CLI output exits cleanly when a pipe reader closes early. Other stdout errors return a failure instead of panicking, and command/file errors keep their diagnostics. Synthetic subprocess regressions cover closed pipes and a reader stopping after one line. Parity counts and effort estimate unchanged (≈ 30–35%).
+- **2026-10-08 (community):** Cut and stack in Print > Multiple: single-sided n-up sheets can be cut into cell piles and restacked in selected page order, with aligned gutter marks and blanks kept in their cells. Available through doc_print; duplex is refused. Grid-size overflow returns an error. No change to the parity count or the overall estimate (about 30–35%).
 - **2026-10-07 (community, #208):** Measure: distance, perimeter and area annotations (standard LineDimension/PolyLineDimension/PolygonDimension with rectilinear /Measure), persistent viewport scales with two-point calibration, vector snapping (endpoints, midpoints, intersections, paths) through nested forms, live readings, CSV export, and eight `measure_*` agent tools. Hardened on landing: snap extraction caps segments and snap targets page-wide and skips undecodable streams and over-deep `q` instead of failing; unsupported imported measurements (compound ft-in, fractional, invalid geometry) are listed as unsupported rather than failing the list; non-ASCII units ("m²") are allowed and rendered in WinAnsi; a closing duplicate polygon vertex counts as closed. Distance and scale are partial (single-unit decimal formats only; Acrobat interop untested). 51.0% shipped; ≈ 30–35% effort.
 - **2026-10-07 (community, #190):** Create PDF from Images offers embedded resolution, 72 DPI, or custom DPI (1–1200) without resampling. The engine and doc_create share the choice; Windows image context menus open the chooser through --create-images. Overall estimate unchanged (about 30–35%).
-
-- **2026-10-08 (community, #135):** CLI output exits cleanly when a pipe reader closes early. Other stdout errors return a failure instead of panicking, and command/file errors keep their diagnostics. Synthetic subprocess regressions cover closed pipes and a reader stopping after one line. Parity counts and effort estimate unchanged (≈ 30–35%).
-
-- **2026-10-08 (community):** Cut and stack in Print > Multiple: single-sided n-up sheets can be cut into cell piles and restacked in selected page order, with aligned gutter marks and blanks kept in their cells. Available through doc_print; duplex is refused. Grid-size overflow returns an error. No change to the parity count or the overall estimate (about 30–35%).
 - **2026-10-07 (community, #161):** The "Save changes?" prompt keeps a long file name inside the modal: the title wraps to the dialog width, so the centered panel no longer stretches past the viewport, clips its message and pushes Save/Cancel off-screen (Windows report). The password prompt's file-name line wraps the same way, and a regression test pins the title and all three buttons inside a 1365×719 screen. Parity counts unchanged; ≈ 30–35%.
 - **2026-10-07 (community, #143):** Windows MSI gets a full-UI welcome dialog with a "Create a desktop shortcut" checkbox (on by default; `INSTALLDESKTOPSHORTCUT=0` for unattended installs), progress, files in use, repair/remove, and a "Setup completed successfully" screen with Finish (plus distinct failed/cancelled screens). Start Menu and desktop shortcuts are now plain links to `pdfcraft.exe` instead of advertised MSI shortcuts. Packaging checks the compiled MSI's shortcut, checkbox and dialog tables; the ARM64 smoke test checks both links' targets, their removal on uninstall, and the opt-out. Installer polish only; feature counts unchanged. ≈ 30–35%.
 - **2026-10-07 (localization):** The interface translates through the same system as PhotoCraft: one TSV catalog per language (`crates/ui-egui/src/i18n/ja.tsv`), the `tl!` macro, entries keyed by command id or with plural forms, and catalog tests (format, duplicates, placeholders, command ids). Catalogs are validated strictly (unknown escapes, reserved contexts, placeholders, ellipses, plural forms), a bad line is skipped and logged at run time, `fmt` substitutes in one pass, the drawing language is per thread, and each `.tsv` is an attributed asset (`kind = "translation"`, checked by `cargo xtask assets`); validation, attribution and the language-switch control test folded in from #175. The 49 existing Japanese strings moved over unchanged, plus `Auto`. The `language` preference now defaults to `auto` (follow the system language; English when it has no catalog); `en`/`ja` still persist, and unknown values are rejected. Not covered: dialogs and panels, Windows system-language detection. ≈ 30–35% (unchanged).
 - **2026-10-07 (session 16):** PrintCraft is renamed PdfCraft: repo `storytold/pdfcraft`, crates and binaries `pdfcraft*`, bundle id `ai.storyteller.pdfcraft`. On first launch the app moves the old PrintCraft settings and crash-recovery folders to the new name, so upgrades keep recent files, preferences and unsaved work. No feature change. ≈ 30–35%.
 - **2026-10-07 (community, #163):** Fill & Sign shows saved signature/initials previews with add, change and remove controls in the quick picker and left panel. The editor loads the saved typed text or drawn strokes; Apply replaces future placements and Cancel preserves the saved value. Existing annotations stay unchanged. Long typed names shrink to the placement width and include glyph overhangs in preview/PDF bounds. Regression coverage includes persistence, removal/recreation, long names and the opt-in UI control channel. Parity counts and effort estimate unchanged (50.2% shipped, ≈ 30–35% effort).
-
 - **2026-10-07 (fork, default-workspace-mode):** Preferences ▸ Documents and view remembers the workspace used for newly opened PDFs. All Tools remains the default; explicit CLI/control mode overrides last for the session and PDF Initial View metadata stays independent. Overall estimate unchanged (≈ 30–35%).
-
 - **2026-10-07 (community, M14, #112):** Simplified Chinese (简体中文, `zh-hans`) as a catalog of about 1,600 entries; `zh`, `zh_CN` and `zh-Hans` locales follow it. In Simplified Chinese the craft-fonts `Hans` faces come before the Japanese ones, so Simplified-only characters don't sit on a different baseline.
 - **2026-10-07 (community, M14, #140):** Traditional Chinese (繁體中文, `zh-hant`, Taiwan vocabulary) as a catalog of about 1,800 entries; `zh_TW`, `zh_HK`, `zh_MO` and `zh-Hant` locales follow it. Drawn with the craft-fonts CJK faces (missing characters show replacement boxes).
 - **2026-10-07 (community, M14, #141):** Every dialog, panel, notice, shortcut list and native-picker title goes through the catalog (`tl!`, `i18n::fmt`), and Japanese grows from 49 to about 1,800 entries (`ja.tsv`); worker threads (export, OCR, actions) write their summaries in the UI language; history labels keep captured file and field names; the command palette searches translated and English labels and ids. Engine and OS error text is no longer matched against English templates: it is shown as is, inside a translated frame. Localization remains partial for other languages.
@@ -269,7 +242,6 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 - **2026-10-06 (session 14):** Issues: move and resize existing text boxes in Edit text (#59, closes #40); Windows release builds open no console window and the Start Menu shortcut has its icon (#58, #57; rolled out to every Craft app); native Windows ARM64 installers, installed and run on an ARM64 runner in CI (#66, #71; the intermittent ARM64 test crash was a WARP shader-JIT race between parallel GPU-rendering tests, not our code); XFA forms are detected and explained instead of failing silently (#65, #60 stays open for real XFA). Also: squiggly underline tool, comment opacity, Preferences ▸ Identity, drag-and-drop/hover tests; community table export to Word/HTML/RTF (#62, with linear-time detection and a column cap). #63 (timestamps/LTV with outbound network) held for review fixes and an owner decision on network access. ≈ 30–35% (unchanged).
 - **2026-10-06 (community, #68):** Interface language: Czech (Čeština, `ui.set language=cs`) joins English and Japanese. It translates every registered File/Edit/Pages/View/Help command and every label routed through the translation table, with tests that fail when a menu label lacks Czech; the interface fonts are tested to cover Czech diacritics. Dialogs and panels remain English (misc.prefs-language: partial).
 - **2026-10-06:** M1: invalid object-number ranges in xref tables and streams take the existing reconstruction path, with the reason recorded, instead of overflowing or aliasing another object. Synthetic open/repair regression added. Overall estimate unchanged (≈ 30–35%).
-
 - **2026-10-05 (session 13, later):** FreeBSD: CI builds and tests the workspace in a FreeBSD 14.3 VM (#45) and the release ships a FreeBSD x86_64 tarball, checked in CI (#42); README lists FreeBSD. Fuzzing: the nightly job's 11 hangs fixed (#41: our parser's exponential retries, inline images, Type 3 fan-out), plus a JBIG2 hang (#43, vendored hayro-jbig2) and a Type 1 font stack overflow (#46, skrifa 0.47); a full run now finds 0 crashes. Landed community PRs #36 (text editing, Japanese replacements), #47 (English/Japanese interface) and #48 (XFDF colour crash). Windows launch crash with Intel's Vulkan driver fixed by using Direct3D 12 (#49, issue #37); one copy of the Japanese font instead of two (#51, −8.3 MB); full screen and About get real tests (#50). P0 88%, P1 52%. ≈ 30–35%.
 - **2026-10-05 (community, #47):** Interface language: Preferences ▸ Interface language switches English/Japanese and persists (`ui.set language=ja|en`, reported by `ui.state`). Core menu labels are translated; dialogs, panels and more languages remain open (misc.prefs-language: partial).
 - **2026-10-05 (session 13):** Landed community PRs #3–#7 and the never-crash rollout (#11–#25); CI green on every job for the first time in 30+ runs (clippy 1.99, Windows line endings, perf-test noise); nightly fuzz job made to finish (child memory cap) and its findings fixed: 7 out-of-memory crashes (#27, #29, #30) and 11 hangs (in review); issue #8 (integrated GPU, keyboard save prompt); Help ▸ Check for updates (manual only). Added the honest assessment and gap list above. P0 88%, P1 52%; 804 features 49.5% shipped (53.3% weighted). ≈ 30–35%.
@@ -277,7 +249,6 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 - **2026-10-03 (session 12):** Edit text and images in place (lines, paragraphs, formatting, existing images), Scan & OCR (new `ocr` crate on ocrs with CC-BY-SA models fetched by `cargo xtask models`: searchable image, page ranges, multiple files), Acrobat JavaScript (new `js` crate on boa: custom field scripts in Acrobat's event order, button scripts, document JavaScripts, console, Enable JavaScript preference, sandbox limits). 110+ tools; P0 88%, P1 48%; 803 features 47.9% shipped (51.1% weighted). ≈ 37%.
 - **2026-10-02 (session 11, later):** Sign with macOS Keychain identities, Add alternate text, Advanced Search panel, space audit and link clean-up in the Optimizer, hybrid-reference files, signed documents protected from rewrites, redaction cleans the tags, custom stamps, image fields, Combine files with page choice. 97 tools; P0 82%, P1 45%. ≈ 30%.
 - **2026-10-02 (session 11):** Accessibility Checker (new `a11y` crate: all 32 rules, report, fixes, options dialog and results panel), MCP resources for page images and text, revisions (list, open an earlier one), export all images, fit visible, form Preview and locked fields, document title in the window; plus attachment comments, eraser, date picker, duplicate/align/distribute fields. 91 tools; P0 80%, P1 43%. ≈ 29%.
-
 - **2026-10-02 (session 10, last):** Manual tab order, backgrounds/watermarks from files (PDF pages as forms, images), Initial View and reading options (honoured on open), bookmarks expand/collapse, make-default comment properties, required-field borders, cut/copy/paste pages, marquee zoom, snapshot. 85 tools; P0 80%, P1 ≈ 27%.
 - **2026-10-02 (session 10, latest):** PDF Optimizer and real Reduce File Size (new `optimize` crate: effective-resolution image downsampling, recompression, discards), Field Properties ▸ Options for every field type, Redaction Properties overlay styling, drag-to-reorder pages, repair notice and log; signature revalidation made incremental (comment edit on a 120 MB signed file 84 → 6 ms). 84 tools; P0 parity ≈ 80%. ≈ 27%.
 - **2026-10-02 (session 10, later):** Digital signatures (new `sign` crate: PKCS #12, X.509, CMS; PAdES B-B signing incl. certification; validation with trust store and DocMDP-aware change detection; Signatures panel, message bar, sign and digital ID dialogs; signed documents keep incremental saves), polygon/cloud/connected-lines/callout/caret comments, Create PDF from clipboard, comment filters by colour and checkmark. Verified against pdfsig and OpenSSL. 83 tools; P0 parity 78%, P1 22.5%. ≈ 26%.
@@ -298,14 +269,12 @@ Newest first. One line per session: the date, what moved, and the new overall pe
   - Fixed: the Hand tool did not pan.
   - 50 agent tools.
   - Overall ≈ 16%.
-
 - **2026-10-01 (session 7):**
   - Bookmark editing and page numbering (Number pages), with undo, agent tools and UI.
   - A render watchdog: pathological pages are skipped after 20 s instead of spinning forever.
   - The agent control channel no longer reports success when the window is hidden.
   - Community links: Discord button in the title bar, plus Home, About, Help menu, CLI and README.
   - Overall ≈ 10%.
-
 - **2026-10-01 (session 6):**
   - UI control channel: agents can inspect the widget tree, click, type, press keys, run commands and take screenshots of the running app. Off unless the app is started with `--control`; loopback only, token-authenticated.
   - Combine and insert store identical fonts, images and other resources once. 40 copies of the showcase: 130 MB → 3.9 MB, 3× faster, pixel-identical.
@@ -313,14 +282,12 @@ Newest first. One line per session: the date, what moved, and the new overall pe
   - Fuzzing (`cargo xtask fuzz`, nightly in CI): about 150,000 mutated files tried. Seven crash and hang bugs found and fixed, each with a regression test: two in our code, five in the temporary renderer.
   - Parity checklist: 826 Acrobat Pro features tracked in `parity/acrobat-features.toml`; `cargo xtask parity` checks every claim against code and tests. 11.8% shipped overall, 31.6% of P0.
   - Overall ≈ 9.5%.
-
 - **2026-09-30 (session 5, after a machine crash; no work lost):**
   - Agent control: new `pdfcraft-automation` crate with 20 JSON-Schema tools, an opt-in MCP server (`pdfcraft-cli mcp`, stdio only, can be compiled out), and `pdfcraft-cli run`/`tools`.
   - Text on rotated pages now reads along its lines; the pdf.js oracle is unchanged at median 0.980.
   - Finding text in 520 pages: 17.9 s → 3.7 s (parallel), about 20 ms when repeated (cached).
   - CI: dependency licence audit (`deny.toml`, `xtask deny`) and a GitHub workflow for macOS, Windows, Linux and wasm.
   - Overall ≈ 8%.
-
 - **2026-09-30 (session 4):**
   - Combine, extract and split, with links, named destinations, fields, layers, attachments and nested bookmarks all carried over. Combined pages render pixel-identical to their sources.
   - Fixed a precision bug in how reals were written.
@@ -343,3 +310,15 @@ Newest first. One line per session: the date, what moved, and the new overall pe
 
 - M13: common command, batch, inspection and bounded preview tools share the existing confined automation path. MCP tools carry complete hints and reject unknown top-level keys as invalid parameters.
 - **2026-10-10 (UI docking):** Tools and Inspector can be regrouped, split beside the PDF, or floated inside the app window. Existing toggles reopen panels at their saved locations; UI commands arrange/reset panels, and preferences retain their layout. Read/full-screen modes preserve the focused document view. No milestone percentage change.
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | minor | Readiness table with hours per audience; full number restated as the additive weighted sum over dimensions (47% → 49%; method aligned with the standard, no new evidence) |
+| 2026-10-10 | minor | Essentials-user score added (≈ 66%) |
+| 2026-10-10 | minor | Gate consistency check: convert and share re-judged partial, not blocking; stage pre-alpha → alpha |
+| 2026-10-10 | minor | Second look: ready 40% → 47% (cross-cutting double count removed), mainstream-practitioner numbers and user sentiment added; core-workflow alpha gate applied, stage alpha → pre-alpha |
+| 2026-10-10 | major | Restructured to the progress-docs standard (stage, two numbers, dimensions, features, languages, upcoming, log); full re-measure; assessment, gaps and milestones moved to `docs/`; log sorted newest first and a stray merged entry dated |
+| 2026-10-07 | minor | 806 tracked features, 51.0% shipped, effort-weighted ≈ 30–35%, 600–1,100 h |
+| 2026-10-05 | major | Honest assessment and "Where we're lacking" added |
diff --git a/apps/pdfcraft-web/Cargo.toml b/apps/pdfcraft-web/Cargo.toml
index a8d472d4f..a64d729dc 100644
--- a/apps/pdfcraft-web/Cargo.toml
+++ b/apps/pdfcraft-web/Cargo.toml
@@ -16,5 +16,5 @@ egui = { workspace = true }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 wasm-bindgen-futures = "0.4"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlCanvasElement", "HtmlElement", "Location", "Url", "UrlSearchParams", "Response"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlCanvasElement", "HtmlElement", "Location", "Url", "UrlSearchParams", "Response", "Event", "MessageEvent", "EventTarget"] }
 js-sys = "0.3"
diff --git a/apps/pdfcraft-web/src/main.rs b/apps/pdfcraft-web/src/main.rs
index 1899c2982..a46a4674b 100644
--- a/apps/pdfcraft-web/src/main.rs
+++ b/apps/pdfcraft-web/src/main.rs
@@ -51,16 +51,55 @@ fn main() {
                             ctx.request_repaint();
                         });
                     }
+                    // eframe never raises a close request on a browser reload or tab close, so `guard_quit` never
+                    // prompts; ask the browser to confirm instead while a document has unsaved work (#812).
+                    warn_before_unload(app.unsaved_flag.clone());
+                    // `?host=parent`: a same-origin page embedding PdfCraft in an iframe (such
+                    // as the Nextcloud app) passes files in and takes saves back (`host` below).
+                    if query_param("host").as_deref() == Some("parent")
+                        && let Some(bridge) = host::Bridge::new()
+                    {
+                        // `?author=`: the host's name for the user signs their comments,
+                        // unless they chose a name in PdfCraft (the web default is "Guest").
+                        if let Some(author) = query_param("author").map(|a| a.trim().to_string()).filter(|a| !a.is_empty())
+                            && app.comment_prefs.author == "Guest"
+                        {
+                            app.comment_prefs.author = author.chars().take(200).collect();
+                        }
+                        bridge.listen(app.startup_inbox.clone(), cc.egui_ctx.clone());
+                        app.host_save = Some(bridge.save_fn());
+                        app.host_dirty = Some(bridge.dirty_fn());
+                        bridge.post_ready();
+                    }
                     Ok(Box::new(app))
                 }),
             )
             .await;
         if let Err(e) = started {
             eframe::web_sys::console::error_1(&e);
+            if query_param("host").as_deref() == Some("parent")
+                && let Some(bridge) = host::Bridge::new()
+            {
+                bridge.post_failed(&e.as_string().unwrap_or_else(|| format!("{e:?}")));
+            }
         }
     });
 }
 
+#[cfg(target_arch = "wasm32")]
+fn warn_before_unload(unsaved: std::sync::Arc<std::sync::atomic::AtomicBool>) {
+    use eframe::wasm_bindgen::{JsCast, closure::Closure};
+    let Some(window) = web_sys::window() else { return };
+    let handler = Closure::<dyn FnMut(web_sys::Event)>::new(move |event: web_sys::Event| {
+        if unsaved.load(std::sync::atomic::Ordering::Relaxed) {
+            event.prevent_default();
+        }
+    });
+    if window.add_event_listener_with_callback("beforeunload", handler.as_ref().unchecked_ref()).is_ok() {
+        handler.forget();
+    }
+}
+
 #[cfg(target_arch = "wasm32")]
 fn query_param(key: &str) -> Option<String> {
     let search = web_sys::window()?.location().search().ok()?;
@@ -80,6 +119,132 @@ async fn fetch_bytes(url: &str) -> Result<Vec<u8>, String> {
     Ok(js_sys::Uint8Array::new(&buf).to_vec())
 }
 
+/// The `postMessage` bridge to a same-origin parent page. Messages are plain objects with a
+/// `type`:
+///
+/// - `pdfcraft:ready` (to the parent): the app is listening; send files now.
+/// - `pdfcraft:open` (from the parent): `{ name, bytes }`, where `bytes` is an `ArrayBuffer` or
+///   `Uint8Array` holding a PDF. It opens in a tab, like a `?file=` URL.
+/// - `pdfcraft:save` (to the parent): `{ name, saveAs, bytes }` when the user saves; `bytes` is
+///   a transferred `ArrayBuffer`. The parent stores the file (and reports its own errors).
+/// - `pdfcraft:dirty` (to the parent): `{ dirty }` whenever unsaved work appears or goes away.
+/// - `pdfcraft:failed` (to the parent): `{ error }` when the app couldn't start.
+///
+/// Only the parent window on the app's own origin is heard or answered.
+#[cfg(target_arch = "wasm32")]
+mod host {
+    use eframe::wasm_bindgen::{JsCast, JsValue, closure::Closure};
+
+    #[derive(Clone)]
+    pub struct Bridge {
+        window: web_sys::Window,
+        parent: web_sys::Window,
+        origin: String,
+    }
+
+    impl Bridge {
+        /// `None` when the page isn't framed (there is no parent to talk to).
+        pub fn new() -> Option<Self> {
+            let window = web_sys::window()?;
+            let parent = window.parent().ok().flatten()?;
+            if js_sys::Object::is(&parent, &window) {
+                return None;
+            }
+            let origin = window.location().origin().ok()?;
+            Some(Self { window, parent, origin })
+        }
+
+        fn post(&self, message: &js_sys::Object, transfer: Option<&JsValue>) -> Result<(), String> {
+            let sent = match transfer {
+                Some(t) => self.parent.post_message_with_transfer(message, &self.origin, &js_sys::Array::of1(t)),
+                None => self.parent.post_message(message, &self.origin),
+            };
+            sent.map_err(|e| e.as_string().unwrap_or_else(|| format!("{e:?}")))
+        }
+
+        pub fn post_ready(&self) {
+            if let Some(m) = message(&[("type", "pdfcraft:ready".into()), ("version", env!("CARGO_PKG_VERSION").into())]) {
+                let _ = self.post(&m, None);
+            }
+        }
+
+        /// The app couldn't start (no WebGL, for example): let the parent say so.
+        pub fn post_failed(&self, error: &str) {
+            if let Some(m) = message(&[("type", "pdfcraft:failed".into()), ("error", error.into())]) {
+                let _ = self.post(&m, None);
+            }
+        }
+
+        /// Hear `pdfcraft:open` from the parent and queue the file like a `?file=` download.
+        pub fn listen(&self, inbox: pdfcraft_ui_egui::Inbox, ctx: egui::Context) {
+            let parent = self.parent.clone();
+            let origin = self.origin.clone();
+            let on_message = Closure::<dyn FnMut(web_sys::MessageEvent)>::new(move |event: web_sys::MessageEvent| {
+                if event.origin() != origin || !event.source().is_some_and(|s| js_sys::Object::is(&s, &parent)) {
+                    return;
+                }
+                let data = event.data();
+                if string(&data, "type").as_deref() != Some("pdfcraft:open") {
+                    return;
+                }
+                let name = string(&data, "name").filter(|n| !n.trim().is_empty()).unwrap_or_else(|| "document.pdf".to_string());
+                let Ok(bytes) = js_sys::Reflect::get(&data, &JsValue::from_str("bytes")) else { return };
+                let bytes = if let Some(array) = bytes.dyn_ref::<js_sys::Uint8Array>() {
+                    array.to_vec()
+                } else if bytes.is_instance_of::<js_sys::ArrayBuffer>() {
+                    js_sys::Uint8Array::new(&bytes).to_vec()
+                } else {
+                    return;
+                };
+                if let Ok(mut q) = inbox.lock() {
+                    q.push((name, bytes));
+                }
+                ctx.request_repaint();
+            });
+            if self.window.add_event_listener_with_callback("message", on_message.as_ref().unchecked_ref()).is_ok() {
+                // The listener lives as long as the page.
+                on_message.forget();
+            }
+        }
+
+        pub fn save_fn(&self) -> pdfcraft_ui_egui::HostSaveFn {
+            let bridge = self.clone();
+            Box::new(move |name: &str, bytes: &[u8], save_as: bool| {
+                let buffer = js_sys::Uint8Array::from(bytes).buffer();
+                let m =
+                    message(&[("type", "pdfcraft:save".into()), ("name", name.into()), ("saveAs", save_as.into()), ("bytes", buffer.clone().into())])
+                        .ok_or_else(|| "couldn't build the message".to_string())?;
+                bridge.post(&m, Some(&buffer))
+            })
+        }
+
+        pub fn dirty_fn(&self) -> pdfcraft_ui_egui::HostDirtyFn {
+            let bridge = self.clone();
+            let mut last = false;
+            Box::new(move |dirty: bool| {
+                if dirty != last {
+                    last = dirty;
+                    if let Some(m) = message(&[("type", "pdfcraft:dirty".into()), ("dirty", dirty.into())]) {
+                        let _ = bridge.post(&m, None);
+                    }
+                }
+            })
+        }
+    }
+
+    fn message(fields: &[(&str, JsValue)]) -> Option<js_sys::Object> {
+        let m = js_sys::Object::new();
+        for (key, value) in fields {
+            js_sys::Reflect::set(&m, &JsValue::from_str(key), value).ok()?;
+        }
+        Some(m)
+    }
+
+    fn string(data: &JsValue, key: &str) -> Option<String> {
+        js_sys::Reflect::get(data, &JsValue::from_str(key)).ok()?.as_string()
+    }
+}
+
 #[cfg(not(target_arch = "wasm32"))]
 fn main() {
     eprintln!("pdfcraft-web targets wasm32: run `trunk serve` or `trunk build --release` in apps/pdfcraft-web");
diff --git a/apps/pdfcraft/build.rs b/apps/pdfcraft/build.rs
index 2f61ed5c7..35d519d99 100644
--- a/apps/pdfcraft/build.rs
+++ b/apps/pdfcraft/build.rs
@@ -1,5 +1,6 @@
 //! Windows only: embed the app icon and version info (VERSIONINFO) into `pdfcraft.exe`, so it
-//! shows in Explorer, the taskbar, the Start menu and Alt-Tab.
+//! shows in Explorer, the taskbar, the Start menu and Alt-Tab. A separate PDF document icon
+//! uses resource ID 2; the installer references it as `pdfcraft.exe,-2`.
 //!
 //! On every other target this does nothing. A missing resource compiler is a warning, so a
 //! cross-compile from macOS or Linux still links, unless `PDFCRAFT_REQUIRE_WINRES=1` turns it
@@ -11,6 +12,7 @@ mod windows_manifest;
 fn main() {
     println!("cargo:rerun-if-changed=build.rs");
     println!("cargo:rerun-if-changed=../../assets/app-icon/pdfcraft.ico");
+    println!("cargo:rerun-if-changed=../../assets/app-icon/pdfcraft-document.ico");
     println!("cargo:rerun-if-changed=src/windows_manifest.rs");
     println!("cargo:rerun-if-env-changed=PDFCRAFT_REQUIRE_WINRES");
     if std::env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("windows") {
@@ -18,6 +20,7 @@ fn main() {
     }
     let mut res = winresource::WindowsResource::new();
     res.set_icon("../../assets/app-icon/pdfcraft.ico")
+        .set_icon_with_id("../../assets/app-icon/pdfcraft-document.ico", "2")
         .set_manifest(windows_manifest::WINDOWS_MANIFEST)
         .set("ProductName", "PdfCraft")
         .set("FileDescription", "PdfCraft PDF workbench")
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index cdebc1ed7..9d6f5fcb7 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -7,7 +7,8 @@
 //! `--page N  --zoom 150  --layout continuous|two-up|single  --panel comments|bookmarks|pages|fields|layers|attachments|none
 //!  --theme light|dark|system  --language auto|<code>  --mode all|read|edit|convert|sign  --tool <catalogue id>  --left open|closed
 //!  --organize on  --fields on  --dialog properties|shortcuts|about  --palette <query>  --home on
-//!  --cover on|off  --default-layout continuous|two-up|single  --default-zoom fit-width|fit-page|<percent>`
+//!  --cover on|off  --default-layout continuous|two-up|single  --default-zoom fit-width|fit-page|<percent>
+//!  --combine-view grid|list  --combine-zoom 60..200`
 //!
 //! `--new-window` opens a window of its own. Without it, on Windows, a launch that only names files
 //! hands them to the PdfCraft already running, where they open as tabs (`single_instance`).
@@ -32,6 +33,7 @@ use pdfcraft_ui_egui::PdfCraftApp;
 mod apple_events;
 mod logging;
 mod single_instance;
+mod text_scale;
 mod updates;
 #[cfg(test)]
 #[path = "windows_manifest.rs"]
@@ -301,6 +303,7 @@ fn app_creator<'a>(
             app.restore(&json);
         }
         app.integrated_titlebar = integrated;
+        app.system_text_scale = text_scale::system();
         app.update_source = Some(std::sync::Arc::new(updates::latest_release));
         app.os_key_store_ids = cfg!(any(target_os = "macos", target_os = "windows"));
         #[cfg(target_os = "macos")]
diff --git a/apps/pdfcraft/src/single_instance.rs b/apps/pdfcraft/src/single_instance.rs
index 73147d4a2..9d15f5b26 100644
--- a/apps/pdfcraft/src/single_instance.rs
+++ b/apps/pdfcraft/src/single_instance.rs
@@ -135,17 +135,16 @@ pub fn claim(files: &[String], may_hand_off: bool) -> Claim {
     }
 }
 
-/// The socket in `%LOCALAPPDATA%\PdfCraft` (beside the crash-recovery folder); none for a portable
-/// copy.
+/// The socket in `%LOCALAPPDATA%\PdfCraft` (beside the crash-recovery folder); none when
+/// `%LOCALAPPDATA%` is unset.
 #[cfg(windows)]
 fn socket_path() -> Option<std::path::PathBuf> {
     let name = socket_name(std::env::var("SESSIONNAME").ok().as_deref());
-    // A portable copy may sit in a folder other accounts can write to (`C:\Tools`): a socket
-    // there would let them receive this user's file paths or send it files to open. Portable
-    // launches each open their own window instead, and write nothing outside their folder.
-    if pdfcraft_ui_egui::portable::data_dir().is_some() {
-        return None;
-    }
+    // %LOCALAPPDATA% is private to the user's sign-in, so other accounts can't receive this
+    // user's file paths or send it files to open. A portable copy uses it too (#889), under its
+    // own name so it never hands files to an installed copy (which keeps its settings elsewhere).
+    // Never the portable folder itself: it may sit where other accounts can write (`C:\Tools`).
+    let name = if pdfcraft_ui_egui::portable::data_dir().is_some() { format!("portable-{name}") } else { name };
     std::env::var_os("LOCALAPPDATA").filter(|v| !v.is_empty()).map(|d| std::path::PathBuf::from(d).join("PdfCraft").join(name))
 }
 
diff --git a/apps/pdfcraft/src/text_scale.rs b/apps/pdfcraft/src/text_scale.rs
new file mode 100644
index 000000000..8bb8ea51a
--- /dev/null
+++ b/apps/pdfcraft/src/text_scale.rs
@@ -0,0 +1,68 @@
+//! The desktop's text scaling, for Preferences ▸ Interface size ▸ Auto.
+//!
+//! On Linux and the BSDs, GNOME (and desktops sharing its settings schema) keep it in
+//! `org.gnome.desktop.interface text-scaling-factor` (Settings ▸ Accessibility ▸ Large Text sets
+//! 1.25). It is read once at launch through `gsettings`, which is absent or fails elsewhere, and
+//! anything but a sensible number counts as no scaling. Other systems scale the whole display
+//! instead, which already reaches egui as `pixels_per_point`.
+
+/// How long `gsettings` may take before launch goes on without it.
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd"))]
+const TIMEOUT: std::time::Duration = std::time::Duration::from_millis(500);
+
+/// The text scaling factor, or 1.0.
+pub fn system() -> f32 {
+    #[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd"))]
+    if let Some(output) = gsettings(&["get", "org.gnome.desktop.interface", "text-scaling-factor"]) {
+        return parse(&output);
+    }
+    1.0
+}
+
+/// `gsettings` output (`1.25`) as a factor; 1.0 when it isn't a usable one.
+#[cfg_attr(not(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd")), allow(dead_code))]
+fn parse(output: &str) -> f32 {
+    output.trim().parse::<f64>().ok().and_then(pdfcraft_ui_egui::ui_scale::valid).unwrap_or(1.0)
+}
+
+/// Run `gsettings` and return what it printed, or `None` if it is missing, fails or hangs.
+#[cfg(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd"))]
+fn gsettings(args: &[&str]) -> Option<String> {
+    use std::io::Read;
+    use std::process::{Command, Stdio};
+    let mut child = Command::new("gsettings").args(args).stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::null()).spawn().ok()?;
+    let start = std::time::Instant::now();
+    loop {
+        match child.try_wait() {
+            Ok(Some(status)) if status.success() => break,
+            Ok(None) if start.elapsed() < TIMEOUT => std::thread::sleep(std::time::Duration::from_millis(5)),
+            _ => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return None;
+            }
+        }
+    }
+    let mut out = String::new();
+    // A number fits in far less; a misbehaving `gsettings` can't make launch read without end.
+    child.stdout.take()?.take(256).read_to_string(&mut out).ok()?;
+    Some(out)
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn gsettings_output_parses_or_means_no_scaling() {
+        assert_eq!(super::parse("1.25\n"), 1.25);
+        assert_eq!(super::parse("1.0"), 1.0);
+        for bad in ["", "nan", "inf", "-2", "0", "uint32 0", "100"] {
+            assert_eq!(super::parse(bad), 1.0, "{bad}");
+        }
+    }
+
+    #[test]
+    fn reading_the_system_scale_never_fails() {
+        let f = super::system();
+        assert!(f.is_finite() && (pdfcraft_ui_egui::ui_scale::MIN..=pdfcraft_ui_egui::ui_scale::MAX).contains(&f), "{f}");
+    }
+}
diff --git a/assets/app-icon/LICENSE-document.txt b/assets/app-icon/LICENSE-document.txt
new file mode 100644
index 000000000..74b44ae1f
--- /dev/null
+++ b/assets/app-icon/LICENSE-document.txt
@@ -0,0 +1,31 @@
+PdfCraft PDF document icon (pdfcraft-document.svg and pdfcraft-document.ico).
+SPDX-License-Identifier: ISC AND (MIT OR Apache-2.0)
+
+The document outline and fold are adapted from Lucide file-text (lucide-static 1.49.0):
+https://github.com/lucide-icons/lucide
+The original is kept in assets/icons/file-text.svg.
+
+ISC License
+
+Copyright (c) 2026 Lucide Icons and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+The badge, outlined PDF lettering, colours and composition are original work
+by the PdfCraft contributors. Copyright (c) 2026 PdfCraft contributors.
+Licensed under either the MIT License or the Apache License, Version 2.0,
+at your option. Full texts are LICENSE-MIT and LICENSE-APACHE at the
+repository root, and beside this file in Windows distributions.
+
+The icon uses no typeface or external image. Regenerate the ICO with
+packaging/icons.sh; every asset and its SHA-256 is recorded in ATTRIBUTION.toml.
diff --git a/assets/app-icon/README.md b/assets/app-icon/README.md
index 64eb9a30e..10fb2d4cf 100644
--- a/assets/app-icon/README.md
+++ b/assets/app-icon/README.md
@@ -33,6 +33,8 @@ Licence: [LICENSE.txt](LICENSE.txt) (`MIT OR Apache-2.0`, like the repo).
 | `pdfcraft-1024.png` | 1024 px on Apple's grid; also the runtime Dock icon on macOS |
 | `pdfcraft.icns` | macOS icon (16–1024 px) |
 | `pdfcraft.ico` | Windows icon (16–256 px), embedded in `pdfcraft.exe` by `apps/pdfcraft/build.rs` |
+| `pdfcraft-document.svg` | Windows PDF file icon master: a Lucide document outline, green badge and outlined PDF lettering; no font dependency |
+| `pdfcraft-document.ico` | Windows PDF file icon (16–256 px), embedded as resource 2 in `pdfcraft.exe` |
 | `hicolor/<n>x<n>/apps/ai.storyteller.pdfcraft.png` | Linux hicolor theme, 16–512 px; the 256 px one is the runtime icon on Windows and Linux |
 | `hicolor/scalable/apps/ai.storyteller.pdfcraft.svg` | Linux scalable icon (copy of the master) |
 
@@ -40,6 +42,12 @@ Where it shows: `apps/pdfcraft/src/main.rs` sets the window icon (Dock, taskbar,
 Wayland app id `ai.storyteller.pdfcraft`; `packaging/linux/ai.storyteller.pdfcraft.desktop` names the
 hicolor icon.
 
+Windows PDF files use resource 2 (`"pdfcraft.exe",-2`) when PdfCraft is chosen as the default
+reader; the app keeps resource 1. The document outline is adapted from Lucide `file-text`
+1.49.0 (ISC); its badge and outlined lettering are original (`MIT OR Apache-2.0`), covered by
+[LICENSE-document.txt](LICENSE-document.txt). Both icons are embedded, requiring no runtime
+sidecar. This provides a file type icon; first-page thumbnails still need a thumbnail provider.
+
 ## Regenerate
 
 ```sh
diff --git a/assets/app-icon/pdfcraft-document.ico b/assets/app-icon/pdfcraft-document.ico
new file mode 100644
index 000000000..79967a800
Binary files /dev/null and b/assets/app-icon/pdfcraft-document.ico differ
diff --git a/assets/app-icon/pdfcraft-document.svg b/assets/app-icon/pdfcraft-document.svg
new file mode 100644
index 000000000..603a74015
--- /dev/null
+++ b/assets/app-icon/pdfcraft-document.svg
@@ -0,0 +1,16 @@
+<!-- Document outline: Lucide file-text, lucide-static 1.49.0, ISC.
+     PDF badge and outlined lettering: PdfCraft contributors, MIT OR Apache-2.0.
+     No fonts or external images. See LICENSE-document.txt and ATTRIBUTION.toml. -->
+<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64" viewBox="0 0 64 64">
+  <g transform="translate(-2 -2) scale(2.8)" stroke="#0b0b0c" stroke-width="1" stroke-linecap="round" stroke-linejoin="round">
+    <path fill="#efe9dc" d="M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z" />
+    <path fill="#c8ece4" d="M14 2v5a1 1 0 0 0 1 1h5" />
+    <path fill="none" stroke="#12a58a" d="M8 12h8M8 15h5" />
+  </g>
+  <rect x="3" y="34" width="56" height="23" rx="4" fill="#087f6b" />
+  <g fill="none" stroke="#fff" stroke-width="2.8" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M13 50V41h5a3 3 0 0 1 0 6h-5" />
+    <path d="M27 41v9h3a4.5 4.5 0 0 0 0-9z" />
+    <path d="M42 50V41h8M42 45h6" />
+  </g>
+</svg>
diff --git a/assets/icons/minimize-2.svg b/assets/icons/minimize-2.svg
new file mode 100644
index 000000000..f15d72cd4
--- /dev/null
+++ b/assets/icons/minimize-2.svg
@@ -0,0 +1,16 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="m14 10 7-7" />
+  <path d="M20 10h-6V4" />
+  <path d="m3 21 7-7" />
+  <path d="M4 14h6v6" />
+</svg>
diff --git a/contributors/people.toml b/contributors/people.toml
index 8ba666cc4..c685b5840 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -71,3 +71,6 @@ sync_github_name = true
 [people.Hathor875]
 real_name = "Krzysztof Cieślik"
 sync_github_name = true
+
+[people.jay-tau]
+sync_github_name = true
diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index 4e8aceb2a..dce287ade 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -1593,8 +1593,9 @@ pub fn move_annotation(doc: &mut Document, page: usize, index: usize, dx: f64, d
     Ok(())
 }
 
-/// Resize a rectangle, oval, text box or stamp to `rect`. Stamps keep their appearance,
-/// which PDF viewers scale from its bounding box into the new rectangle.
+/// Resize a rectangle, oval, text box, stamp or drawing to `rect`. Stamps keep their appearance,
+/// which PDF viewers scale from its bounding box into the new rectangle; drawings scale their
+/// strokes and get a new one.
 pub fn set_rect(doc: &mut Document, page: usize, index: usize, rect: [f64; 4], meta: &Meta) -> Result<(), AnnotError> {
     let (_, r) = annot_ref(doc, page, index)?;
     unlocked(doc, r)?;
@@ -1611,12 +1612,61 @@ pub fn set_rect(doc: &mut Document, page: usize, index: usize, rect: [f64; 4], m
         })?;
         return Ok(());
     }
+    if subtype == "Ink" {
+        return resize_ink(doc, r, normalize(rect), meta);
+    }
     if !matches!(subtype.as_str(), "Square" | "Circle" | "FreeText") {
         return Err(AnnotError::Invalid(format!("{subtype} comments can't be resized")));
     }
     apply_text_box(doc, r, rect, meta)
 }
 
+/// Scale a drawing's strokes into `rect`. The margin between the strokes and the old `/Rect` (half
+/// the line width and a little more) stays the same on each side, so the line isn't clipped.
+fn resize_ink(doc: &mut Document, r: ObjRef, rect: [f64; 4], meta: &Meta) -> Result<(), AnnotError> {
+    let d = annot_dict(doc, r);
+    let strokes: Vec<Vec<[f64; 2]>> = d
+        .get(b"InkList")
+        .map(|l| doc.resolve(l))
+        .and_then(|l| l.as_array().cloned())
+        .unwrap_or_default()
+        .iter()
+        .map(|s| {
+            let v: Vec<f64> = doc.resolve(s).as_array().map(|a| a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect()).unwrap_or_default();
+            v.as_chunks::<2>().0.iter().map(|p| [p[0], p[1]]).collect()
+        })
+        .collect();
+    let Some(inner) = bounds(strokes.iter().flatten().copied()) else {
+        return Err(AnnotError::Invalid("the drawing has no strokes".into()));
+    };
+    let old = d.get(b"Rect").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default();
+    let old: Vec<f64> = old.iter().filter_map(|v| doc.resolve(v).as_f64()).collect();
+    let old = match old[..] {
+        [a, b, c, e] => normalize([a, b, c, e]),
+        _ => inner,
+    };
+    let margin = [inner[0] - old[0], inner[1] - old[1], old[2] - inner[2], old[3] - inner[3]].map(|m| m.max(0.0));
+    let target = [rect[0] + margin[0], rect[1] + margin[1], rect[2] - margin[2], rect[3] - margin[3]];
+    if !finite(&rect) || target[2] < target[0] || target[3] < target[1] || rect[2] - rect[0] < 1.0 || rect[3] - rect[1] < 1.0 {
+        return Err(AnnotError::Invalid("invalid rectangle (too small)".into()));
+    }
+    // An axis with no extent (a straight stroke) is centred rather than scaled.
+    let axis = |v: f64, a0: f64, a1: f64, b0: f64, b1: f64| if a1 > a0 { b0 + (v - a0) / (a1 - a0) * (b1 - b0) } else { (b0 + b1) / 2.0 };
+    let scaled: Vec<Vec<[f64; 2]>> = strokes
+        .iter()
+        .map(|s| {
+            s.iter().map(|p| [axis(p[0], inner[0], inner[2], target[0], target[2]), axis(p[1], inner[1], inner[3], target[1], target[3])]).collect()
+        })
+        .collect();
+    doc.update_dict(r, |d| {
+        d.set(b"InkList".to_vec(), Object::Array(scaled.iter().map(|s| num_array(&s.concat())).collect()));
+        d.set(b"Rect".to_vec(), num_array(&rect));
+        touch(d, meta);
+    })?;
+    set_appearance(doc, r)?;
+    Ok(())
+}
+
 /// Store `rect` as a FreeText annotation's text box (or a square's/oval's rectangle): a callout's
 /// leader line re-attaches and `/Rect` grows to hold it, and the appearance is redrawn.
 fn apply_text_box(doc: &mut Document, r: ObjRef, rect: [f64; 4], meta: &Meta) -> Result<(), AnnotError> {
@@ -1728,6 +1778,41 @@ pub fn set_style(
     set_appearance(doc, r)
 }
 
+/// Whether a comment of this subtype has an interior that can be filled (`/IC`: rectangles,
+/// ovals, polygons and clouds, §12.5.6.8–9).
+pub fn fillable(subtype: &str) -> bool {
+    matches!(subtype, "Square" | "Circle" | "Polygon")
+}
+
+/// Fill a rectangle, oval or polygon comment with `fill`, or remove its fill (`None`), and
+/// redraw its appearance (Acrobat: Properties ▸ Fill Color).
+pub fn set_fill(doc: &mut Document, page: usize, index: usize, fill: Option<Rgb>, meta: &Meta) -> Result<(), AnnotError> {
+    let (_, r) = annot_ref(doc, page, index)?;
+    unlocked(doc, r)?;
+    let d = annot_dict(doc, r);
+    let subtype = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
+    if !fillable(&subtype) {
+        return Err(AnnotError::Invalid("only rectangles, ovals and polygons can be filled".into()));
+    }
+    // Check before changing anything: a stale appearance would contradict the new fill.
+    if appearance::build(&d).is_none() {
+        return Err(AnnotError::Unsupported(subtype));
+    }
+    if fill.is_some_and(|c| !finite(&c)) {
+        return Err(AnnotError::Invalid("invalid fill colour".into()));
+    }
+    doc.update_dict(r, |d| {
+        match fill {
+            Some(c) => d.set(b"IC".to_vec(), rgb(c)),
+            None => {
+                d.remove(b"IC");
+            }
+        }
+        touch(d, meta);
+    })?;
+    set_appearance(doc, r)
+}
+
 /// Grow a line or polyline's rectangle so a non-`None` ending is not clipped. Idempotent.
 fn ensure_ending_room(d: &mut Dict) {
     let subtype = d.name(b"Subtype").unwrap_or_default();
@@ -1784,6 +1869,8 @@ pub struct Summary {
     pub quads: Vec<[f32; 8]>,
     pub locked: bool,
     pub intent: Option<String>,
+    /// A Fill & Sign mark ([`is_fill_sign`]).
+    pub fill_sign: bool,
 }
 
 fn text_value(doc: &Document, d: &Dict, key: &[u8]) -> Option<String> {
@@ -1854,6 +1941,7 @@ pub fn summaries(doc: &Document) -> Vec<Summary> {
                 quads,
                 locked: annotation_flags(doc, d) & FLAG_LOCKED != 0,
                 intent: d.get(b"IT").and_then(|o| doc.resolve(o).as_name().map(|n| String::from_utf8_lossy(n).into_owned())),
+                fill_sign: is_fill_sign(doc, d),
             });
         }
     }
@@ -1916,6 +2004,10 @@ pub struct Props {
     pub locked: bool,
     /// `/LE`: two names for a line or polyline (`None` when unset), one for a callout.
     pub endings: Option<Vec<LineEnding>>,
+    /// Rectangles, ovals and polygons: their interior can be filled (see [`fillable`]).
+    pub fillable: bool,
+    /// `/IC`, the interior colour (`None`: no fill).
+    pub fill: Option<Rgb>,
 }
 
 /// The current properties of the comment at `(page, index)`.
@@ -1939,11 +2031,25 @@ pub fn props(doc: &Document, page: usize, index: usize) -> Option<Props> {
         modified: text_value(doc, d, b"M"),
         restylable: appearance::build(d).is_some(),
         locked: annotation_flags(doc, d) & FLAG_LOCKED != 0,
+        fillable: fillable(&subtype),
+        fill: fill_of(d),
         subtype,
         endings: line_endings_of(d),
     })
 }
 
+/// `/IC` as an RGB colour. An empty array means no fill; grey and CMYK fills are converted.
+fn fill_of(d: &Dict) -> Option<Rgb> {
+    let c: Vec<f64> = d.get(b"IC")?.as_array()?.iter().filter_map(|x| x.as_f64()).collect();
+    let rgb = match c.as_slice() {
+        [g] => [*g; 3],
+        [r, g, b] => [*r, *g, *b],
+        [c, m, y, k] => [(1.0 - c) * (1.0 - k), (1.0 - m) * (1.0 - k), (1.0 - y) * (1.0 - k)],
+        _ => return None,
+    };
+    finite(&rgb).then(|| rgb.map(|x| x.clamp(0.0, 1.0)))
+}
+
 /// `/LE` for a line, polyline or callout. Unknown names yield `None` so the control stays hidden.
 fn line_endings_of(d: &Dict) -> Option<Vec<LineEnding>> {
     let parse = |name: &[u8]| std::str::from_utf8(name).ok().and_then(LineEnding::parse);
diff --git a/crates/annot/src/links.rs b/crates/annot/src/links.rs
index 3d8d6d4d1..f5ba6fb1c 100644
--- a/crates/annot/src/links.rs
+++ b/crates/annot/src/links.rs
@@ -299,27 +299,29 @@ pub fn remove_all(doc: &mut Document, pages: Option<&[usize]>) -> Result<usize,
 /// Find web addresses in text: `http(s)://…`, `www.…` and bare e-mail addresses become
 /// `mailto:`. Returns character ranges and the URI for each.
 pub fn find_urls(chars: &[char]) -> Vec<(std::ops::Range<usize>, String)> {
-    let text: String = chars.iter().collect();
-    let lower = text.to_lowercase();
-    let lc: Vec<char> = lower.chars().collect();
-    let mut out = Vec::new();
     let url_char = |c: char| !c.is_whitespace() && !"<>\"'()[]{}".contains(c);
+    // Case-insensitive prefix test that never steps past the end. Comparing against the original
+    // characters keeps every offset in `chars`'s own index space: case-folding a copy can change
+    // its length (U+0130 becomes "i" plus a combining dot), so a folded copy must never supply
+    // offsets into the source (that mismatch panicked; #816).
+    let starts_with =
+        |start: usize, pat: &str| pat.chars().enumerate().all(|(k, p)| chars.get(start + k).is_some_and(|c| c.eq_ignore_ascii_case(&p)));
+    let mut out = Vec::new();
     let mut i = 0;
-    while i < lc.len() {
-        let at = |s: &str| lc[i..].iter().take(s.chars().count()).copied().eq(s.chars());
-        let boundary = i == 0 || !lc[i - 1].is_alphanumeric();
-        if boundary && (at("http://") || at("https://") || at("www.")) {
+    while i < chars.len() {
+        let boundary = i == 0 || chars.get(i - 1).is_some_and(|c| !c.is_alphanumeric());
+        if boundary && (starts_with(i, "http://") || starts_with(i, "https://") || starts_with(i, "www.")) {
             let mut j = i;
-            while j < chars.len() && url_char(chars[j]) {
+            while chars.get(j).is_some_and(|c| url_char(*c)) {
                 j += 1;
             }
             // Trailing punctuation belongs to the sentence.
-            while j > i && ".,;:!?".contains(chars[j - 1]) {
+            while j > i && chars.get(j - 1).is_some_and(|c| ".,;:!?".contains(*c)) {
                 j -= 1;
             }
-            let s: String = chars[i..j].iter().collect();
+            let s: String = chars.get(i..j).map(|c| c.iter().collect()).unwrap_or_default();
             if s.len() > 6 && s.contains('.') {
-                let uri = if s.to_lowercase().starts_with("www.") { format!("http://{s}") } else { s };
+                let uri = if s.get(..4).is_some_and(|p| p.eq_ignore_ascii_case("www.")) { format!("http://{s}") } else { s };
                 out.push((i..j, uri));
                 i = j;
                 continue;
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index e7091c512..7f47b592f 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -283,6 +283,50 @@ fn restyle_and_resize_redraw_the_appearance() {
     assert!(matches!(set_rect(&mut doc, 0, l, [0.0, 0.0, 5.0, 5.0], &meta("")), Err(AnnotError::Invalid(_))));
 }
 
+#[test]
+fn shapes_can_be_filled_and_unfilled() {
+    let mut doc = fixture();
+    let r = add_annotation(&mut doc, &new(0, Shape::Rectangle { rect: [10.0, 10.0, 110.0, 60.0] }), &meta("r")).unwrap();
+    let p = props(&doc, 0, r).unwrap();
+    assert!(p.fillable);
+    assert_eq!(p.fill, None);
+    set_fill(&mut doc, 0, r, Some([0.0, 0.5, 1.0]), &meta("")).unwrap();
+    let doc2 = reopen(&doc);
+    let d = &list(&doc2, 0)[r];
+    let ap = ap_content(&doc2, d);
+    assert!(ap.contains("0 0.5 1 rg") && ap.contains("\nB\n"), "filled and stroked: {ap}");
+    assert_eq!(props(&doc2, 0, r).unwrap().fill, Some([0.0, 0.5, 1.0]));
+    // No fill again: /IC goes and the appearance only strokes.
+    set_fill(&mut doc, 0, r, None, &meta("")).unwrap();
+    let doc2 = reopen(&doc);
+    let d = &list(&doc2, 0)[r];
+    assert!(d.get(b"IC").is_none());
+    let ap = ap_content(&doc2, d);
+    assert!(!ap.contains(" rg") && ap.contains("\nS\n"), "stroked only: {ap}");
+    assert_eq!(props(&doc2, 0, r).unwrap().fill, None);
+    // Ovals and polygons fill too.
+    let o = add_annotation(&mut doc, &new(0, Shape::Oval { rect: [10.0, 10.0, 60.0, 60.0] }), &meta("o")).unwrap();
+    set_fill(&mut doc, 0, o, Some([1.0, 1.0, 0.0]), &meta("")).unwrap();
+    assert!(ap_content(&doc, &list(&doc, 0)[o]).contains("1 1 0 rg"));
+    let vertices = vec![[0.0, 0.0], [50.0, 0.0], [25.0, 40.0]];
+    let g = add_annotation(&mut doc, &new(0, Shape::Polygon { vertices, cloud: false }), &meta("g")).unwrap();
+    set_fill(&mut doc, 0, g, Some([1.0, 0.0, 0.0]), &meta("")).unwrap();
+    assert!(ap_content(&doc, &list(&doc, 0)[g]).contains("1 0 0 rg"));
+    // Lines have no interior, and bad colours change nothing.
+    let l = add_annotation(
+        &mut doc,
+        &new(0, Shape::Line { from: [0.0, 0.0], to: [10.0, 10.0], start: LineEnding::None, end: LineEnding::None }),
+        &meta("l"),
+    )
+    .unwrap();
+    assert!(!props(&doc, 0, l).unwrap().fillable);
+    assert!(matches!(set_fill(&mut doc, 0, l, Some([1.0; 3]), &meta("")), Err(AnnotError::Invalid(_))));
+    let before = list(&doc, 0)[r].clone();
+    assert!(matches!(set_fill(&mut doc, 0, r, Some([f64::NAN, 0.0, 0.0]), &meta("")), Err(AnnotError::Invalid(_))));
+    assert_eq!(list(&doc, 0)[r], before);
+    assert!(set_fill(&mut doc, 0, 99, None, &meta("")).is_err());
+}
+
 #[test]
 fn text_box_text_and_colour_changes_are_drawn() {
     let mut doc = fixture();
@@ -537,6 +581,31 @@ fn urls_are_found_in_text() {
     assert_eq!(found, ["https://example.org/a?b=1", "http://www.rust-lang.org"]);
 }
 
+#[test]
+fn urls_are_found_after_length_changing_lowercase() {
+    // U+0130 (İ) lowercases to "i" plus a combining dot above, so a case-folded copy is longer
+    // than the source. The old matcher took the address offset from that copy and sliced the
+    // source with it, panicking at `chars[i..j]` (#816).
+    let mut text = "\u{130}".repeat(20);
+    text.push_str(" http://example.com");
+    let chars: Vec<char> = text.chars().collect();
+    let found = crate::links::find_urls(&chars);
+    assert_eq!(found.len(), 1, "{found:?}");
+    let (range, uri) = found.into_iter().next().unwrap();
+    assert_eq!(uri, "http://example.com");
+    assert_eq!(range, 21..39, "range is in source-character indices");
+}
+
+#[test]
+fn url_scheme_and_www_match_case_insensitively() {
+    let t: Vec<char> = "HTTP://Example.COM".chars().collect();
+    let found: Vec<String> = crate::links::find_urls(&t).into_iter().map(|(_, u)| u).collect();
+    assert_eq!(found, ["HTTP://Example.COM"]);
+    let t: Vec<char> = "\u{130} www.Example.org".chars().collect();
+    let found: Vec<String> = crate::links::find_urls(&t).into_iter().map(|(_, u)| u).collect();
+    assert_eq!(found, ["http://www.Example.org"]);
+}
+
 #[test]
 fn polygons_clouds_connected_lines_callouts_and_carets_are_drawn() {
     let mut doc = fixture();
@@ -989,3 +1058,41 @@ fn non_markup_annotations_are_not_comments() {
         assert!(is_comment_subtype(s), "{s}");
     }
 }
+
+/// A drawing (a drawn Fill & Sign signature is one) resizes by scaling its strokes into the new
+/// rectangle, keeping each side's stroke margin, and gets a fresh appearance.
+#[test]
+fn drawings_resize_by_scaling_their_strokes() {
+    let mut doc = fixture();
+    let strokes = vec![vec![[100.0, 400.0], [150.0, 460.0], [200.0, 410.0]], vec![[120.0, 420.0], [180.0, 430.0]]];
+    let i = add_annotation(&mut doc, &new(0, Shape::Ink { strokes }), &meta("i")).unwrap();
+    let nums = |o: &Object| -> Vec<f64> { o.as_array().unwrap().iter().map(|v| v.as_f64().unwrap()).collect() };
+    let points = |doc: &Document| -> Vec<[f64; 2]> {
+        let d = &list(doc, 0)[i];
+        d.get(b"InkList").unwrap().as_array().unwrap().iter().flat_map(|s| nums(s).as_chunks::<2>().0.to_vec()).collect()
+    };
+    let before = points(&doc);
+    let r0 = nums(list(&doc, 0)[i].get(b"Rect").unwrap());
+    let lo = |k: usize| before.iter().map(|p| p[k]).fold(f64::MAX, f64::min);
+    let hi = |k: usize| before.iter().map(|p| p[k]).fold(f64::MIN, f64::max);
+    let margin = [lo(0) - r0[0], lo(1) - r0[1], r0[2] - hi(0), r0[3] - hi(1)];
+    assert!(margin.iter().all(|m| *m > 0.0), "{margin:?}");
+    // Twice the size, bottom-left corner fixed.
+    let rect = [r0[0], r0[1], r0[0] + 2.0 * (r0[2] - r0[0]), r0[1] + 2.0 * (r0[3] - r0[1])];
+    set_rect(&mut doc, 0, i, rect, &meta("r")).unwrap();
+    let d = &list(&doc, 0)[i];
+    let r1 = nums(d.get(b"Rect").unwrap());
+    assert!(r1.iter().zip(rect).all(|(a, b)| (a - b).abs() < 1e-6), "{r1:?} != {rect:?}");
+    // Each point keeps its place relative to the drawing's bounds, inside the same margin.
+    let inner = |r: &[f64]| [r[0] + margin[0], r[1] + margin[1], r[2] - margin[2], r[3] - margin[3]];
+    let (a, b) = (inner(&r0), inner(&r1));
+    for (p, q) in before.iter().zip(points(&doc)) {
+        let expected = [b[0] + (p[0] - a[0]) / (a[2] - a[0]) * (b[2] - b[0]), b[1] + (p[1] - a[1]) / (a[3] - a[1]) * (b[3] - b[1])];
+        assert!((q[0] - expected[0]).abs() < 1e-6 && (q[1] - expected[1]).abs() < 1e-6, "{q:?} != {expected:?}");
+    }
+    let ap = ap_content(&doc, d);
+    let first = points(&doc)[0];
+    assert!(ap.contains(&format!("{} {} m", n(first[0]), n(first[1]))), "appearance redrawn at the new size: {ap}");
+    // Too small to hold the stroke margin.
+    assert!(matches!(set_rect(&mut doc, 0, i, [100.0, 400.0, 101.0, 401.0], &meta("")), Err(AnnotError::Invalid(_))));
+}
diff --git a/crates/automation/README.md b/crates/automation/README.md
index 75f9ee21c..02c081149 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -60,6 +60,14 @@ Implemented: `initialize` (protocol 2025-06-18, 2025-03-26, 2024-11-05), `ping`,
 4. Add an end-to-end test in `tests/automation.rs`. `tool_table_is_well_formed` checks names, schemas and command links.
 
 
+## Moving several page objects
+
+`object_list {doc, page}` inventories recognised paragraphs, Image/Form artwork and added items
+with generation-scoped kind/index references. `object_move {doc, page, objects, offset, generation?}`
+moves 1–1000 references atomically in displayed points (right/down), preserving source glyph bytes
+and fonts. A refusal changes nothing; success is one undo step. See
+[the selection and movement guide](../../docs/editing-multiple-objects.md) for limits and examples.
+
 ## Common command tools
 
 Following FilmCraft's MCP conventions, `command_list {doc?, filter?, enabled_only?}` keeps its
diff --git a/crates/automation/src/a11y.rs b/crates/automation/src/a11y.rs
index 2a853083c..81f79d14e 100644
--- a/crates/automation/src/a11y.rs
+++ b/crates/automation/src/a11y.rs
@@ -3,7 +3,7 @@
 use pdfcraft_engine::a11y::{Category, Options, Report, Rule, Status};
 use serde_json::{Value, json};
 
-use crate::{Args, Automation, Result, ToolError, child, failed, write_atomic};
+use crate::{Args, Automation, Result, ToolError, child, failed, unused, write_atomic};
 
 fn status_id(s: Status) -> &'static str {
     match s {
@@ -156,10 +156,16 @@ impl Automation {
     pub(crate) fn ocr_recognize_files(&mut self, a: &Args) -> Result<Value> {
         let settings = self.ocr_settings(a)?;
         let folder = self.resolve(a.str("folder")?, true)?;
+        // A path that leaves the root refuses the whole call before any work starts, like the
+        // other tools (the write check passes missing files, which stay per-file errors below).
+        let paths = a.strs("paths")?;
+        for p in &paths {
+            self.resolve(p, true)?;
+        }
         std::fs::create_dir_all(&folder).map_err(|e| failed(e.to_string()))?;
         let ocr = pdfcraft_engine::ocr::engine().map_err(failed)?;
         let mut out = Vec::new();
-        for p in a.strs("paths")? {
+        for p in paths {
             let name = std::path::Path::new(p).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "document.pdf".into());
             let result =
                 self.resolve(p, false).map_err(|e| e.to_string()).and_then(|src| std::fs::read(&src).map_err(|e| e.to_string())).and_then(|bytes| {
@@ -341,6 +347,16 @@ impl Automation {
             out.push(match result {
                 Ok(r) => {
                     let target = child(&folder, &name);
+                    let target = if target.exists() {
+                        let stem =
+                            std::path::Path::new(&name).file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_else(|| "document".into());
+                        unused(&folder, &stem)
+                    } else {
+                        target
+                    };
+                    if target.exists() {
+                        return Err(failed(format!("{}: no unused output name available", target.display())));
+                    }
                     write_atomic(&target, &r.bytes)?;
                     json!({ "path": p, "output": target.to_string_lossy(), "log": r.log })
                 }
diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index b7f83c2f1..4aac6ac55 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -191,8 +191,21 @@ impl Automation {
             .filter(|c| c.in_reply_to.is_none() && only.is_none_or(|p| c.page == p))
             .map(|c| {
                 let mut v = view(c);
-                let thread: Vec<&Annotation> = match &c.name {
-                    Some(nm) => all.iter().filter(|r| r.in_reply_to.as_deref() == Some(nm.as_str())).collect(),
+                // Every reply under this comment, at any depth, in document order. A reply to a
+                // reply keeps its `/IRT` on the direct parent, so following one level would drop it.
+                let descends_from = |r: &Annotation, root: &str| -> bool {
+                    let mut parent = r.in_reply_to.as_deref();
+                    for _ in 0..64 {
+                        let Some(nm) = parent else { return false };
+                        if nm == root {
+                            return true;
+                        }
+                        parent = all.iter().find(|x| x.name.as_deref() == Some(nm)).and_then(|x| x.in_reply_to.as_deref());
+                    }
+                    false
+                };
+                let thread: Vec<&Annotation> = match c.name.as_deref() {
+                    Some(nm) => all.iter().filter(|r| r.in_reply_to.is_some() && descends_from(r, nm)).collect(),
                     None => Vec::new(),
                 };
                 let status = thread.iter().rev().filter(|r| !r.is_mark()).find_map(|r| r.state.clone());
@@ -565,6 +578,10 @@ impl Automation {
         if color.is_some() || opacity.is_some() || width.is_some() {
             edits.push(Edit::StyleAnnotation { page, index, color, opacity, width, endings: None });
         }
+        if let Some(f) = a.opt_str("fill")? {
+            let fill = if f.eq_ignore_ascii_case("none") { None } else { Some(parse_color(f)?) };
+            edits.push(Edit::FillAnnotation { page, index, fill });
+        }
         if let Some(r) = a.nums::<4>("rect")? {
             edits.push(Edit::ResizeAnnotation { page, index, rect: rect_to_user(&info, r) });
         }
diff --git a/crates/automation/src/content.rs b/crates/automation/src/content.rs
index 9a0448856..39cdaf964 100644
--- a/crates/automation/src/content.rs
+++ b/crates/automation/src/content.rs
@@ -200,3 +200,71 @@ impl Automation {
         self.apply(a, Edit::DeleteContent { page, index })
     }
 }
+
+impl Automation {
+    /// One mixed inventory, with exact source references and the current document generation.
+    pub(crate) fn object_list(&self, a: &Args) -> Result<Value> {
+        let page = self.page(a)?;
+        let doc = self.doc(a)?;
+        let info = doc.info.pages.get(page).ok_or_else(|| bad("the page no longer exists"))?;
+        let objects = doc.editable_objects(page).map_err(failed)?;
+        let items = objects
+            .iter()
+            .map(|o| {
+                let rect = crate::comments::rect_to_view(info, o.rect.map(|v| v as f32));
+                json!({"kind":o.target.kind.as_str(),"index":o.target.index.saturating_add(1),"type":o.content_type,
+                "rect":rect.map(|v|(f64::from(v)*100.0).round()/100.0),"text":o.text})
+            })
+            .collect::<Vec<_>>();
+        Ok(json!({"page":page+1,"generation":doc.edit_generation(),"count":items.len(),"objects":items}))
+    }
+
+    pub(crate) fn object_move(&mut self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::{MAX_MOVE_OBJECTS, ObjectKind, ObjectTarget};
+        let page = self.page(a)?;
+        let rows = a
+            .get("objects")
+            .and_then(Value::as_array)
+            .filter(|r| !r.is_empty() && r.len() <= MAX_MOVE_OBJECTS)
+            .ok_or_else(|| bad("objects must contain 1–1000 references from object_list"))?;
+        let mut targets = Vec::with_capacity(rows.len());
+        for row in rows {
+            let row = row.as_object().ok_or_else(|| bad("each object must contain kind and index"))?;
+            if row.keys().any(|k| k != "kind" && k != "index") {
+                return Err(bad("an object reference accepts only kind and index"));
+            }
+            let kind = match row.get("kind").and_then(Value::as_str) {
+                Some("added") => ObjectKind::Added,
+                Some("text") => ObjectKind::Text,
+                Some("image") => ObjectKind::Image,
+                _ => return Err(bad("object kind must be added, text or image (see object_list)")),
+            };
+            let index = row
+                .get("index")
+                .and_then(Value::as_u64)
+                .and_then(|i| i.checked_sub(1))
+                .and_then(|i| usize::try_from(i).ok())
+                .ok_or_else(|| bad("object index must be a positive integer from object_list"))?;
+            targets.push(ObjectTarget { kind, index });
+        }
+        let delta = a
+            .get("offset")
+            .and_then(Value::as_array)
+            .filter(|v| v.len() == 2)
+            .and_then(|v| Some([v.first()?.as_f64()?, v.get(1)?.as_f64()?]))
+            .filter(|v| v.iter().all(|n| n.is_finite() && n.abs() <= 1e9))
+            .ok_or_else(|| bad("offset must contain two finite numbers [dx, dy] in displayed points"))?;
+        let doc = self.doc(a)?;
+        if let Some(g) = a.get("generation") {
+            let g = g.as_u64().ok_or_else(|| bad("generation must be a non-negative integer from object_list"))?;
+            if g != doc.edit_generation() {
+                return Err(failed("the document changed; call object_list again before moving"));
+            }
+        }
+        let offset = doc.object_move_offset(page, delta).map_err(failed)?;
+        let count = targets.len();
+        let mut result = self.apply(a, Edit::MoveObjects { page, objects: targets, offset })?;
+        result["moved"] = json!(count);
+        Ok(result)
+    }
+}
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index 746c19ab8..eec1f4360 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -29,7 +29,7 @@ use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
-use pdfcraft_engine::{DocId, Document, Edit, Session, commands};
+use pdfcraft_engine::{CombineSource, DocId, Document, Edit, Session, commands};
 use pdfcraft_platform::staging::{StagingName, create_staging, staging_suffixes};
 use pdfcraft_render::{PageRenderer, PageText, RenderConfig, RenderRequest, RequestKind};
 use serde_json::{Value, json};
@@ -77,6 +77,10 @@ fn failed(e: impl std::fmt::Display) -> ToolError {
 const DEFAULT_DPI: f64 = 96.0;
 const MAX_DPI: f64 = 600.0;
 
+/// Bookmarks in one page of the bookmark list, by default and at most.
+const BOOKMARK_PAGE: usize = 100;
+const MAX_BOOKMARK_PAGE: usize = 1000;
+
 /// Page texts of one document version: (the working bytes, one slot per page).
 type TextCache = (Arc<Vec<u8>>, Vec<Option<Arc<PageText>>>);
 
@@ -242,7 +246,7 @@ impl Automation {
                 out["labels"] = json!(self.doc(&a)?.info.pages.iter().map(|p| p.label.clone()).collect::<Vec<_>>());
                 out
             }
-            "bookmark_list" => json!({ "bookmarks": bookmark_tree(&self.doc(&a)?.info.outline, &[]) }),
+            "bookmark_list" => self.bookmark_listing(&a)?,
             "bookmark_add" => {
                 let page = self.page(&a)?;
                 let parent = a.opt_path("parent")?.unwrap_or_default();
@@ -270,7 +274,9 @@ impl Automation {
             }
             "bookmark_from_structure" => {
                 let mut out = self.apply(&a, Edit::BookmarksFromStructure)?;
-                out["bookmarks"] = json!(bookmark_tree(&self.doc(&a)?.info.outline, &[]));
+                let listing = self.bookmark_listing(&a)?;
+                out["bookmarks"] = listing["bookmarks"].clone();
+                out["next"] = listing["next"].clone();
                 out
             }
             "doc_protect" => self.doc_protect(&a)?,
@@ -303,8 +309,12 @@ impl Automation {
                 let before = self.doc(&a)?.bytes.len();
                 let path = self.resolve(a.str("path")?, true)?;
                 let (bytes, merged) = self.session.reduced_bytes(id).map_err(failed)?;
-                write_atomic(&path, &bytes)?;
-                json!({ "path": path.to_string_lossy(), "bytes_before": before, "bytes_after": bytes.len(), "merged_objects": merged })
+                // As in the app, a copy that isn't smaller is not written (#490).
+                let written = bytes.len() < before;
+                if written {
+                    write_atomic(&path, &bytes)?;
+                }
+                json!({ "path": path.to_string_lossy(), "written": written, "bytes_before": before, "bytes_after": bytes.len(), "merged_objects": merged })
             }
             "doc_optimize" => self.doc_optimize(&a)?,
             "doc_initial_view" => self.doc_initial_view(&a)?,
@@ -533,6 +543,8 @@ impl Automation {
             "link_delete" => self.link_delete(&a)?,
             "links_from_urls" => self.links_from_urls(&a)?,
             "links_remove" => self.links_remove(&a)?,
+            "object_list" => self.object_list(&a)?,
+            "object_move" => self.object_move(&a)?,
             "content_list" => self.content_list(&a)?,
             "page_add_text" => self.page_add_text(&a)?,
             "page_add_image" => self.page_add_image(&a)?,
@@ -596,14 +608,23 @@ impl Automation {
             }
             "sign_windows_ids" => {
                 #[cfg(target_os = "windows")]
-                let ids: Vec<Value> = pdfcraft_engine::sign::windows::identities()
-                    .map_err(failed)?
-                    .iter()
-                    .map(|id| json!({ "id": pdfcraft_engine::sign::windows::reference(&id.certificate), "certificate": signing::cert_json(&id.certificate) }))
-                    .collect();
+                let (ids, unusable): (Vec<Value>, Vec<Value>) = {
+                    let listing = pdfcraft_engine::sign::windows::list().map_err(failed)?;
+                    let ids = listing
+                        .ids
+                        .iter()
+                        .map(|id| json!({ "id": pdfcraft_engine::sign::windows::reference(&id.certificate), "certificate": signing::cert_json(&id.certificate) }))
+                        .collect();
+                    let unusable = listing
+                        .unusable
+                        .iter()
+                        .map(|u| json!({ "subject": u.subject, "sha256": u.fingerprint, "reason": u.reason, "no_private_key": u.no_private_key }))
+                        .collect();
+                    (ids, unusable)
+                };
                 #[cfg(not(target_os = "windows"))]
-                let ids: Vec<Value> = Vec::new();
-                json!({ "count": ids.len(), "ids": ids })
+                let (ids, unusable): (Vec<Value>, Vec<Value>) = (Vec::new(), Vec::new());
+                json!({ "count": ids.len(), "ids": ids, "unusable": unusable })
             }
             "sign_trust" => self.sign_trust(&a)?,
             "comment_mark" => self.comment_mark(&a)?,
@@ -619,6 +640,24 @@ impl Automation {
 
     // ---- documents ---------------------------------------------------------------------------
 
+    /// One page of a document's bookmarks: `offset` (from 0) and `limit` (1 to `MAX_BOOKMARK_PAGE`).
+    fn bookmark_listing(&self, a: &Args) -> Result<Value> {
+        let id = a.int("doc")?;
+        let id = DocId(u64::try_from(id).map_err(|_| ToolError::InvalidArgs("doc must be positive".into()))?);
+        let offset = a.opt_int("offset")?.unwrap_or(0);
+        let offset = usize::try_from(offset).map_err(|_| ToolError::InvalidArgs("offset must be 0 or more".into()))?;
+        let limit = a.opt_int("limit")?.unwrap_or(BOOKMARK_PAGE as i64);
+        let limit = usize::try_from(limit)
+            .ok()
+            .filter(|l| (1..=MAX_BOOKMARK_PAGE).contains(l))
+            .ok_or_else(|| ToolError::InvalidArgs(format!("limit must be from 1 to {MAX_BOOKMARK_PAGE}")))?;
+        let page = self
+            .session
+            .bookmark_page(id, offset, limit)
+            .ok_or_else(|| ToolError::Failed(format!("no open document with id {} (see doc_list)", id.0)))?;
+        Ok(json!({ "bookmarks": nest_rows(&page.rows), "next": page.next, "truncated": page.truncated }))
+    }
+
     fn doc(&self, a: &Args) -> Result<&Document> {
         let id = a.int("doc")?;
         let id = u64::try_from(id).map_err(|_| ToolError::InvalidArgs("doc must be positive".into()))?;
@@ -851,6 +890,7 @@ impl Automation {
             "invalid_links": o.invalid_links,
             "invalid_bookmarks": o.invalid_bookmarks,
             "unreferenced_dests": o.unreferenced_dests,
+            "unused_xobjects": o.unused_xobjects,
             "merged_objects": r.merged,
             "discarded": r.discarded.iter().map(|(h, n)| json!({ "category": h.id(), "count": n })).collect::<Vec<_>>(),
         }))
@@ -1032,7 +1072,7 @@ impl Automation {
                     (None, Some(p)) => {
                         let path = self.resolve(p, false)?;
                         let t = std::fs::read(&path).map_err(|e| failed(format!("{}: {e}", path.display())))?;
-                        (path.file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_default(), String::from_utf8_lossy(&t).into_owned())
+                        (path.file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_default(), pdfcraft_engine::decode_text(&t))
                     }
                     (None, None) => return Err(ToolError::InvalidArgs("text needs `text` or `path`".into())),
                 };
@@ -1280,15 +1320,58 @@ impl Automation {
             }
             Some(_) => return Err(ToolError::InvalidArgs("passwords must list a password (or null) for each path".into())),
         };
-        let mut sources = Vec::new();
-        for (p, range) in paths.into_iter().zip(ranges) {
+        // Entries sharing a group number are one file split into parts placed apart.
+        let groups: Option<Vec<Option<u64>>> = match a.get("groups") {
+            None | Some(Value::Null) => None,
+            Some(Value::Array(v)) if v.len() == paths.len() && v.iter().all(|x| x.is_u64() || x.is_null()) => {
+                Some(v.iter().map(Value::as_u64).collect())
+            }
+            Some(_) => return Err(ToolError::InvalidArgs("groups must list a number (or null) for each path".into())),
+        };
+        let mut sources: Vec<CombineSource> = Vec::new();
+        let mut firsts: Vec<(u64, PathBuf, usize)> = Vec::new();
+        for (i, (p, range)) in paths.into_iter().zip(ranges).enumerate() {
             let path = self.resolve(p, false)?;
-            let bytes = std::fs::read(&path).map_err(|e| failed(format!("{}: {e}", path.display())))?;
+            let group = groups.as_ref().and_then(|g| g.get(i).copied().flatten());
+            let first = group.and_then(|g| firsts.iter().find(|f| f.0 == g));
+            let bytes = match first {
+                Some((g, first_path, at)) => {
+                    if *first_path != path {
+                        return Err(ToolError::InvalidArgs(format!("groups[{i}]: group {g} is {}, not {}", first_path.display(), path.display())));
+                    }
+                    sources.get(*at).map(|s| s.1.clone()).ok_or_else(|| failed("group source missing"))?
+                }
+                None => {
+                    if let Some(g) = group {
+                        firsts.push((g, path.clone(), sources.len()));
+                    }
+                    Arc::new(std::fs::read(&path).map_err(|e| failed(format!("{}: {e}", path.display())))?)
+                }
+            };
             let name = path.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-            sources.push((name, Arc::new(bytes), range));
+            sources.push((name, bytes, range));
         }
         let passwords: Vec<Option<&str>> = passwords.iter().map(Option::as_deref).collect();
-        let bytes = self.session.combine_unlocked(&sources, &passwords).map_err(failed)?;
+        let bytes = match groups {
+            None => self.session.combine_unlocked(&sources, &passwords),
+            Some(groups) => {
+                // A path without a group is a file of its own: give it a key no group uses.
+                let mut next = groups.iter().flatten().max().map_or(Some(0), |m| m.checked_add(1));
+                let mut keys = Vec::with_capacity(groups.len());
+                for g in &groups {
+                    keys.push(match g {
+                        Some(g) => *g,
+                        None => {
+                            let own = next.ok_or_else(|| ToolError::InvalidArgs("group numbers are too large".into()))?;
+                            next = own.checked_add(1);
+                            own
+                        }
+                    });
+                }
+                self.session.combine_grouped(&sources, &keys, &passwords)
+            }
+        }
+        .map_err(failed)?;
         self.deliver(a, "Combined", bytes)
     }
 
@@ -1328,13 +1411,21 @@ impl Automation {
         let dir = self.resolve(a.str("out_dir")?, true)?;
         std::fs::create_dir_all(&dir).map_err(|e| failed(format!("{}: {e}", dir.display())))?;
         let mut files = Vec::new();
+        let mut used = std::collections::HashSet::new();
         for (i, (first, last, bytes)) in parts.iter().enumerate() {
             let safe = |t: &str| t.chars().map(|c| if c.is_alphanumeric() || " -_.,()".contains(c) { c } else { '_' }).collect::<String>();
             let file = match titles.iter().find(|t| t.0 + 1 == *first) {
                 Some((_, t)) => format!("{stem}-{}.pdf", safe(t)),
                 None => format!("{stem}-part{}.pdf", i + 1),
             };
-            let path = child(&dir, &file);
+            // Equal titles (or titles that sanitize alike) get -2, -3, ... so no part overwrites another; compared case-insensitively.
+            let mut unique = file.clone();
+            let mut n = 1;
+            while !used.insert(unique.to_lowercase()) {
+                n += 1;
+                unique = format!("{}-{n}.pdf", file.trim_end_matches(".pdf"));
+            }
+            let path = child(&dir, &unique);
             write_atomic(&path, bytes)?;
             files.push(json!({ "path": path.to_string_lossy(), "first_page": first, "last_page": last }));
         }
@@ -1431,8 +1522,14 @@ impl Automation {
             Some(_) => self.pages(a, "pages")?,
             None => (0..doc.info.pages.len()).collect(),
         };
+        // Column select (#740): only the text inside the rectangle, row by row.
+        let rect = a.nums::<4>("rect")?.map(|r| r.map(|v| v as f32));
         let texts = self.page_texts(id, &pages)?;
-        let out: Vec<Value> = pages.iter().zip(texts).map(|(p, t)| json!({ "page": p + 1, "text": t.plain_text() })).collect();
+        let text = |t: &PageText| match rect {
+            Some(r) => t.column_text(&t.glyphs_in(r)),
+            None => t.plain_text(),
+        };
+        let out: Vec<Value> = pages.iter().zip(texts).map(|(p, t)| json!({ "page": p + 1, "text": text(&t) })).collect();
         Ok(json!({ "pages": out }))
     }
 
@@ -1633,17 +1730,36 @@ impl Args<'_> {
     }
 }
 
-/// The bookmark tree as JSON, with 1-based paths and pages.
-fn bookmark_tree(items: &[pdfcraft_render::OutlineItem], parent: &[usize]) -> Vec<Value> {
-    items
-        .iter()
-        .enumerate()
-        .map(|(i, o)| {
-            let mut path = parent.to_vec();
-            path.push(i + 1);
-            json!({ "path": path, "title": o.title, "page": o.page.map(|p| p + 1), "open": o.open, "children": bookmark_tree(&o.children, &path) })
-        })
-        .collect()
+/// Bookmark rows in listing order as JSON: a row holds the rows that follow it on the page at the
+/// next level down in `children`, and paths and pages are 1-based.
+fn nest_rows(rows: &[pdfcraft_engine::BookmarkRow]) -> Vec<Value> {
+    // The open rows, outermost first, with their depth and the children gathered so far.
+    let mut open: Vec<(usize, Value, Vec<Value>)> = Vec::new();
+    let mut roots = Vec::new();
+    for row in rows {
+        let depth = row.path.len().saturating_sub(1);
+        while open.last().is_some_and(|(d, _, _)| *d >= depth) {
+            close_row(&mut open, &mut roots);
+        }
+        let path: Vec<usize> = row.path.iter().map(|p| p.saturating_add(1)).collect();
+        let fields = json!({ "path": path, "title": row.title, "page": row.page.map(|p| p.saturating_add(1)), "open": row.open });
+        open.push((depth, fields, Vec::new()));
+    }
+    while !open.is_empty() {
+        close_row(&mut open, &mut roots);
+    }
+    roots
+}
+
+/// Closes the innermost open row: it joins the row above it as a child, or the top level.
+fn close_row(open: &mut Vec<(usize, Value, Vec<Value>)>, roots: &mut Vec<Value>) {
+    if let Some((_, mut fields, children)) = open.pop() {
+        fields["children"] = Value::Array(children);
+        match open.last_mut() {
+            Some((_, _, siblings)) => siblings.push(fields),
+            None => roots.push(fields),
+        }
+    }
 }
 
 fn one_based(pages: &[i64]) -> Result<Vec<usize>> {
@@ -1713,6 +1829,7 @@ fn info(d: &Document) -> Value {
             "page": n + 1, "label": p.label, "width": p.width, "height": p.height, "rotation": p.rotation,
         })).collect::<Vec<_>>(),
         "outline": outline(&i.outline),
+        "outline_more": i.outline_more,
         // Rectangles use the tools' convention (top-left of the displayed page, like
         // comment_list and link_list), not raw PDF user space, so they can be fed back to
         // geometry-taking tools (#129).
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index 16b820b80..f5771d68c 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -150,9 +150,24 @@ pub fn tools() -> Vec<ToolDef> {
         t("page_render", "Render a page", "Render one page to a PNG image (default 96 dpi, at most 600).")
             .ro()
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 }, "dpi": { "type": "number", "minimum": 1, "maximum": 600 } }), &["doc", "page"])),
-        t("text_extract", "Extract text", "Extract the text of some or all pages, in reading order.")
+        t("object_list", "List editable objects", "List existing paragraphs, Image/Form artwork and added content once, with source kind/index references, displayed rectangles and document generation. Indexes change when content changes; use generation in object_move to reject stale references.")
+            .ro().with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1}}), &["doc","page"])),
+        t("object_move", "Move objects together", "Atomically translate 1–1000 mixed references from object_list by [dx, dy] in displayed points (right/down). Preserves glyph codes, fonts, image data and relative spacing; success is one undo step. Clipping and vertical text are refused. A bad/stale reference refuses the entire move.")
+            .with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1},
+                "objects":{"type":"array","minItems":1,"maxItems":1000,"uniqueItems":true,"items":{
+                    "type":"object","properties":{"kind":{"type":"string","enum":["added","text","image"]},"index":{"type":"integer","minimum":1}},"required":["kind","index"],"additionalProperties":false}},
+                "offset":{"type":"array","items":{"type":"number"},"minItems":2,"maxItems":2},
+                "generation":{"type":"integer","minimum":0,"description":"Use generation returned by object_list to reject a stale selection."}}), &["doc","page","objects","offset"])),
+        t("text_extract", "Extract text", "Extract the text of some or all pages, in reading order. With rect, only the text inside that rectangle on each page, as Column select takes it: one row per visual line, side-by-side pieces (table cells) separated by a tab.")
             .ro()
-            .with(schema(json!({ "doc": doc(), "pages": pages("to extract (default: all)") }), &["doc"])),
+            .cmd("edit.column_select")
+            .with(schema(
+                json!({
+                    "doc": doc(), "pages": pages("to extract (default: all)"),
+                    "rect": { "type": "array", "items": { "type": "number" }, "minItems": 4, "maxItems": 4, "description": "Column select: [x0, y0, x1, y1] in points from the top-left of the displayed page; a glyph counts when its centre is inside." }
+                }),
+                &["doc"],
+            )),
         t("text_find", "Find text", "Find a phrase (case-insensitive, whitespace-normalised) and return each match with its page and line rectangles in points (origin top-left).")
             .ro()
             .cmd("edit.find")
@@ -190,13 +205,14 @@ pub fn tools() -> Vec<ToolDef> {
                 json!({ "doc": doc(), "pages": pages("to extract"), "out": save_out.clone(), "open": open.clone(), "separate": { "type": "boolean" }, "out_dir": { "type": "string" }, "delete": { "type": "boolean" } }),
                 &["doc", "pages"],
             )),
-        t("doc_combine", "Combine files", "Combine PDFs, in order, into one (bookmarks are kept under one entry per file). pages optionally chooses each file's pages, in step with paths: a range such as \"1-3, 6\" or null for all pages. passwords, also in step with paths, opens encrypted files (the open password, or the permissions password where a file's security doesn't allow copying pages; null for none). The result is not encrypted. Passwords are never echoed back.")
+        t("doc_combine", "Combine files", "Combine PDFs, in order, into one (bookmarks are kept under one entry per file). pages optionally chooses each file's pages, in step with paths: a range such as \"1-3, 6\" or null for all pages. passwords, also in step with paths, opens encrypted files (the open password, or the permissions password where a file's security doesn't allow copying pages; null for none). The result is not encrypted. Passwords are never echoed back. groups, also in step with paths, splits a file around others: entries with the same number (they must name the same path) are one file, copied once, so it keeps one bookmark at its first page, its links and its form fields; null for a file of its own. A group uses its first entry's password.")
             .cmd("page.combine")
             .with(schema(
                 json!({
                     "paths": { "type": "array", "items": { "type": "string" }, "minItems": 2 },
                     "pages": { "type": "array", "items": { "type": ["string", "null"] } },
                     "passwords": { "type": "array", "items": { "type": ["string", "null"] } },
+                    "groups": { "type": "array", "items": { "type": ["integer", "null"], "minimum": 0 } },
                     "out": save_out,
                     "open": open,
                 }),
@@ -215,15 +231,26 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["paths"],
             )),
-        t("doc_split", "Split a document", "Split into several files written to out_dir: every N pages, before given pages, at top-level bookmarks (bookmarks: true; files named after them), or by file size (max_mb). Files are <name>-partK.pdf.")
+        t("doc_split", "Split a document", "Split into several files written to out_dir: every N pages, before given pages, at top-level bookmarks (bookmarks: true; files named after them, repeated titles get -2, -3), or by file size (max_mb). Files are <name>-partK.pdf.")
             .cmd("page.split")
             .with(schema(
                 json!({ "doc": doc(), "every": { "type": "integer", "minimum": 1 }, "before": pages("that start a new part"), "bookmarks": { "type": "boolean" }, "max_mb": { "type": "number", "exclusiveMinimum": 0 }, "out_dir": { "type": "string" } }),
                 &["doc", "out_dir"],
             )),
-        t("bookmark_list", "List bookmarks", "The bookmark tree with each bookmark's path, title, target page and open state.")
-            .ro()
-            .with(schema(json!({ "doc": doc() }), &["doc"])),
+        t(
+            "bookmark_list",
+            "List bookmarks",
+            "The bookmarks in outline order, one page at a time: each with its path (1-based, as the other bookmark tools take it), title, target page and open state, and its children on the same page. next is the offset of the following page, or null at the end. Bookmarks nested deeper than 33 levels are not listed.",
+        )
+        .ro()
+        .with(schema(
+            json!({
+                "doc": doc(),
+                "offset": { "type": "integer", "minimum": 0, "description": "Where the page starts, counted from 0 (the previous page's next)" },
+                "limit": { "type": "integer", "minimum": 1, "maximum": 1000, "description": "Bookmarks in the page (default 100)" }
+            }),
+            &["doc"],
+        )),
         t("bookmark_add", "Add a bookmark", "Add a bookmark that goes to a page, under a parent bookmark (or at the top level), at a position. Undoable.").with(schema(
             json!({ "doc": doc(), "title": { "type": "string", "minLength": 1 }, "page": { "type": "integer", "minimum": 1 }, "parent": path("Parent bookmark (omit for the top level)"), "position": { "type": "integer", "minimum": 1, "description": "1-based position among the parent's children (default: last)." } }),
             &["doc", "title", "page"],
@@ -242,7 +269,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "bookmark_from_structure",
             "New bookmarks from structure",
-            "Make bookmarks from the document's tagged headings (H, H1-H6), nested by level under a new first bookmark titled \"Untitled\". Fails if the document has no tagged headings. Returns the bookmark tree. Undoable.",
+            "Make bookmarks from the document's tagged headings (H, H1-H6), nested by level under a new first bookmark titled \"Untitled\". Fails if the document has no tagged headings. Returns the first page of the bookmark tree (see bookmark_list). Undoable.",
         )
         .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("page_number", "Number pages", "Label a range of pages (e.g. i, ii, iii for front matter, or A-1, A-2 for an appendix). Later pages keep their labels. Undoable.").with(schema(
@@ -609,7 +636,7 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["name", "password", "path"],
         )),
-        t("sign_windows_ids", "List Windows store digital IDs", "Windows: signing identities in the Current User Personal certificate store (certificate details and the windows: reference sign_document takes). Private keys remain in CNG; Windows may ask permission to use them.")
+        t("sign_windows_ids", "List Windows store digital IDs", "Windows: signing identities in the Current User Personal certificate store (certificate details and the windows: reference sign_document takes). Private keys remain in CNG; Windows may ask permission to use them. `unusable` lists the store's other certificates with why they can't sign (no private key, an unsupported key type, a key CNG can't open).")
             .ro()
             .cmd("sign.digital")
             .with(schema(json!({}), &[])),
@@ -656,12 +683,13 @@ pub fn tools() -> Vec<ToolDef> {
                 json!({ "doc": doc(), "sort": { "type": "string", "enum": ["page", "author", "date", "type"] }, "out": save_out, "open": open }),
                 &["doc"],
             )),
-        t("comment_edit", "Edit a comment", "Change a comment's text, colour, opacity, line width, rectangle (rectangle/oval/text box/stamp) or position (`move` [dx, dy] in points). Stamps keep their original appearance when resized. One undo step.").with(schema(
+        t("comment_edit", "Edit a comment", "Change a comment's text, colour, opacity, line width, fill (rectangle/oval/polygon; \"none\" removes it), rectangle (rectangle/oval/text box/stamp) or position (`move` [dx, dy] in points). Stamps keep their original appearance when resized. One undo step.").with(schema(
             comment_ref(json!({
                 "contents": { "type": "string" },
                 "color": color(),
                 "opacity": { "type": "number", "minimum": 0, "maximum": 1 },
                 "width": { "type": "number", "minimum": 0 },
+                "fill": { "type": "string", "description": "Interior colour of a rectangle, oval or polygon: #RRGGBB, a colour name, or \"none\" for no fill." },
                 "rect": { "type": "array", "items": { "type": "number" }, "minItems": 4, "maxItems": 4 },
                 "move": point(),
             })),
@@ -971,7 +999,7 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["from"],
         )),
-        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. The open document is unchanged.")
+        t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
             .cmd("optimize.reduce")
             .with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
         t("doc_initial_view", "Initial view", "Read or change how the document opens (Document Properties ▸ Initial View) and its reading options: navigation (page, bookmarks, pages, attachments, layers), layout (default, single, continuous, two_up, two_up_continuous, two_up_cover, two_up_continuous_cover), magnification (default, actual, fit_page, fit_width, fit_height, fit_visible, or a percentage), page, window options (fit_window, center_window, full_screen, display_title), interface options (hide_menubar, hide_toolbar, hide_window_ui), language and binding (left, right). Only the given ones change; returns the result. Undoable.").with(schema(
@@ -1052,7 +1080,7 @@ pub fn tools() -> Vec<ToolDef> {
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
             .with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
-        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); remove_invalid_links and remove_unreferenced_dests (true). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+        t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
             .cmd("optimize.advanced")
             .with(schema(
                 json!({
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index e83e2125c..26bc2b26f 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -181,6 +181,34 @@ fn combine_extract_and_split() {
     assert!(matches!(a.call("doc_combine", &json!({ "paths": ["a.pdf", "b.pdf"], "pages": ["9", null] })), Err(ToolError::Failed(_))));
     assert!(matches!(a.call("doc_combine", &json!({ "paths": ["a.pdf", "b.pdf"], "pages": ["1"] })), Err(ToolError::InvalidArgs(_))));
 
+    // A file split around another, as the Combine files grid makes it: copied once, one bookmark.
+    let split = ok(
+        &mut a,
+        "doc_combine",
+        json!({ "paths": ["a.pdf", "b.pdf", "a.pdf"], "pages": ["1", null, "3, 2"], "groups": [4, null, 4], "open": true }),
+    );
+    let split_doc = split["document"]["doc"].as_u64().unwrap();
+    assert_eq!(page_text(&mut a, split_doc), ["Page 1", "Page 1", "Page 2", "Page 3", "Page 2"]);
+    let marks = ok(&mut a, "bookmark_list", json!({ "doc": split_doc }))["bookmarks"].clone();
+    let marks: Vec<_> = marks.as_array().unwrap().iter().map(|b| (b["title"].as_str().unwrap().to_string(), b["page"].as_u64().unwrap())).collect();
+    assert_eq!(marks, [("a".to_string(), 1), ("b".to_string(), 2)]);
+    // Without groups the same paths are separate files, each with its own bookmark.
+    let apart = ok(&mut a, "doc_combine", json!({ "paths": ["a.pdf", "b.pdf", "a.pdf"], "pages": ["1", null, "3, 2"], "open": true }));
+    let apart = ok(&mut a, "bookmark_list", json!({ "doc": apart["document"]["doc"].as_u64().unwrap() }))["bookmarks"].clone();
+    assert_eq!(apart.as_array().unwrap().len(), 3);
+    // A group names one file; groups must be in step with paths and whole numbers.
+    let not_same = a.call("doc_combine", &json!({ "paths": ["a.pdf", "b.pdf"], "groups": [1, 1] }));
+    assert!(matches!(not_same, Err(ToolError::InvalidArgs(e)) if e.contains("group 1")));
+    for groups in [json!([1]), json!([1, -1]), json!([1, 1.5]), json!(["1", null]), json!(7)] {
+        let bad = a.call("doc_combine", &json!({ "paths": ["a.pdf", "b.pdf"], "groups": groups }));
+        assert!(matches!(bad, Err(ToolError::InvalidArgs(_))), "{groups}");
+    }
+    // The largest group number still leaves a key for a file of its own, or says why not.
+    let max = ok(&mut a, "doc_combine", json!({ "paths": ["a.pdf", "b.pdf"], "groups": [u64::MAX - 1, null], "open": true }));
+    assert_eq!(max["document"]["pages"], 5);
+    let full = a.call("doc_combine", &json!({ "paths": ["a.pdf", "b.pdf"], "groups": [u64::MAX, null] }));
+    assert!(matches!(full, Err(ToolError::InvalidArgs(_))));
+
     let ex = ok(&mut a, "page_extract", json!({ "doc": doc, "pages": [2, 4] }));
     let ex_doc = ex["document"]["doc"].as_u64().unwrap();
     assert_eq!(page_text(&mut a, ex_doc), ["Page 2", "Page 1"]);
@@ -898,6 +926,51 @@ fn bookmarks_through_tools() {
     assert_eq!((list[0]["title"].as_str(), list[0]["children"][0]["title"].as_str()), (Some("Body"), Some("Details")));
 }
 
+/// A flat outline of `n` top-level bookmarks, `Item 0` to `Item n-1`, on one page.
+fn flat_outline_pdf(n: usize) -> Vec<u8> {
+    let mut objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /Outlines 3 0 R >>".into(),
+        "<< /Type /Pages /Kids [4 0 R] /Count 1 /MediaBox [0 0 300 400] >>".into(),
+        format!("<< /Type /Outlines /First 5 0 R /Last {} 0 R /Count {n} >>", 4 + n),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+    ];
+    for k in 0..n {
+        let prev = if k == 0 { String::new() } else { format!(" /Prev {} 0 R", 4 + k) };
+        let next = if k + 1 == n { String::new() } else { format!(" /Next {} 0 R", 6 + k) };
+        objs.push(format!("<< /Title (Item {k}) /Parent 3 0 R{prev}{next} /Dest [4 0 R /Fit] >>"));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, body) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+#[test]
+fn bookmark_list_pages_reach_bookmarks_past_the_hundred_thousandth() {
+    let dir = workdir("bookmarks-large");
+    std::fs::write(dir.join("large.pdf"), flat_outline_pdf(100_005)).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "large.pdf" }))["doc"].as_u64().unwrap();
+    // The default call is the first page of 100, with the offset of the next one.
+    let first = ok(&mut a, "bookmark_list", json!({ "doc": doc }));
+    assert_eq!((first["bookmarks"].as_array().unwrap().len(), first["next"].clone()), (100, json!(100)));
+    assert_eq!((first["bookmarks"][0]["title"].clone(), first["bookmarks"][0]["path"].clone()), (json!("Item 0"), json!([1])));
+    let late = ok(&mut a, "bookmark_list", json!({ "doc": doc, "offset": 100_000, "limit": 100 }));
+    let titles: Vec<&str> = late["bookmarks"].as_array().unwrap().iter().filter_map(|b| b["title"].as_str()).collect();
+    assert_eq!((titles.first().copied(), titles.last().copied(), late["next"].clone()), (Some("Item 100000"), Some("Item 100004"), json!(null)));
+    assert!(matches!(a.call("bookmark_list", &json!({ "doc": doc, "limit": 1001 })), Err(ToolError::InvalidArgs(_))));
+    assert!(matches!(a.call("bookmark_list", &json!({ "doc": doc, "offset": -1 })), Err(ToolError::InvalidArgs(_))));
+}
+
 #[test]
 fn bookmarks_from_structure_through_tools() {
     let dir = workdir("bookmarks-structure");
@@ -989,6 +1062,15 @@ fn comments_through_tools() {
     let undo = ok(&mut a, "edit_undo", json!({ "doc": doc }));
     assert_eq!(undo["undone"], "Edit comment");
     ok(&mut a, "edit_redo", json!({ "doc": doc }));
+    // Rectangles, ovals and polygons take a fill (#686); "none" removes it. Lines have none.
+    ok(&mut a, "comment_edit", json!({ "doc": doc, "page": page, "index": index, "fill": "yellow" }));
+    ok(&mut a, "comment_edit", json!({ "doc": doc, "page": page, "index": index, "fill": "none" }));
+    assert!(matches!(a.call("comment_edit", &json!({ "doc": doc, "page": page, "index": index, "fill": "mauve" })), Err(ToolError::InvalidArgs(_))));
+    let arrow = ok(&mut a, "comment_list", json!({ "doc": doc, "page": 3 }))["comments"][0].clone();
+    assert!(matches!(
+        a.call("comment_edit", &json!({ "doc": doc, "page": arrow["page"], "index": arrow["index"], "fill": "red" })),
+        Err(ToolError::Failed(_))
+    ));
 
     // Editing a text box re-fits its rectangle to the new text: the wrap width and top edge
     // stay, the height follows the wrapped lines.
@@ -1023,6 +1105,29 @@ fn comments_through_tools() {
     assert_eq!(ok(&mut b, "comment_list", json!({ "doc": re }))["count"], 5);
 }
 
+/// #806: a reply to another reply stays in the listing, at any depth.
+#[test]
+fn nested_replies_stay_in_the_listing() {
+    let dir = workdir("nested-replies");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let root = ok(&mut a, "comment_add", json!({ "doc": doc, "page": 1, "type": "note", "at": [40, 40], "contents": "ROOT_NOTE", "author": "A" }));
+    let root_id = root["comment"]["id"].as_str().unwrap().to_string();
+    ok(&mut a, "comment_reply", json!({ "doc": doc, "id": root_id, "text": "DIRECT_REPLY", "author": "B" }));
+    let listed = ok(&mut a, "comment_list", json!({ "doc": doc }));
+    let root_comment = listed["comments"].as_array().unwrap().iter().find(|c| c["contents"] == "ROOT_NOTE").unwrap().clone();
+    let direct_id =
+        root_comment["replies"].as_array().unwrap().iter().find(|r| r["contents"] == "DIRECT_REPLY").unwrap()["id"].as_str().unwrap().to_string();
+    ok(&mut a, "comment_reply", json!({ "doc": doc, "id": direct_id, "text": "NESTED_REPLY", "author": "C" }));
+    ok(&mut a, "comment_add", json!({ "doc": doc, "page": 1, "type": "note", "at": [120, 120], "contents": "CONTROL_NOTE", "author": "D" }));
+
+    let list = ok(&mut a, "comment_list", json!({ "doc": doc }));
+    assert_eq!(list["count"], 2, "the two notes stay roots: {list}");
+    let root = list["comments"].as_array().unwrap().iter().find(|c| c["contents"] == "ROOT_NOTE").unwrap().clone();
+    let replies: Vec<&str> = root["replies"].as_array().unwrap().iter().filter_map(|r| r["contents"].as_str()).collect();
+    assert!(replies.contains(&"DIRECT_REPLY") && replies.contains(&"NESTED_REPLY"), "the nested reply is listed: {replies:?}");
+}
+
 #[test]
 fn protecting_through_tools() {
     let dir = workdir("protect");
@@ -1768,8 +1873,11 @@ fn creating_and_reducing_through_tools() {
     let t = ok(&mut a, "doc_create", json!({ "from": "text", "path": "notes.txt" }))["doc"].as_u64().unwrap();
     assert_eq!(page_text(&mut a, t), ["Meeting notes\nAction items"]);
     ok(&mut a, "doc_save", json!({ "doc": t, "path": "notes.pdf" }));
+    // A new text PDF is already compact: Reduce writes nothing rather than a copy no smaller.
     let r = ok(&mut a, "doc_reduce", json!({ "doc": t, "path": "notes-small.pdf" }));
-    assert!(r["bytes_after"].as_u64().unwrap() > 0 && dir.join("notes-small.pdf").exists());
+    assert!(r["bytes_after"].as_u64().unwrap() >= r["bytes_before"].as_u64().unwrap(), "{r}");
+    assert_eq!(r["written"], false);
+    assert!(!dir.join("notes-small.pdf").exists());
     assert!(matches!(a.call("doc_create", &json!({ "from": "images", "paths": ["notes.txt"] })), Err(ToolError::Failed(_))));
 }
 
@@ -2311,6 +2419,27 @@ fn stamps_through_tools() {
     assert!(matches!(a.call("stamp_custom", &json!({ "doc": doc, "page": 1, "path": "nope.png", "at": [1, 1] })), Err(ToolError::Failed(_))));
 }
 
+#[test]
+fn bookmark_split_with_equal_titles_keeps_every_part() {
+    let dir = workdir("organize_dup_titles");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "bookmark_add", json!({ "doc": doc, "title": "Same", "page": 1 }));
+    ok(&mut a, "bookmark_add", json!({ "doc": doc, "title": "Same", "page": 2 }));
+    ok(&mut a, "bookmark_add", json!({ "doc": doc, "title": "same", "page": 3 }));
+    let s = ok(&mut a, "doc_split", json!({ "doc": doc, "bookmarks": true, "out_dir": "parts" }));
+    let files: Vec<String> = s["files"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|f| std::path::Path::new(f["path"].as_str().unwrap()).file_name().unwrap().to_string_lossy().into_owned())
+        .collect();
+    assert_eq!(files, ["a-Same.pdf", "a-Same-2.pdf", "a-same-3.pdf"]);
+    for f in &files {
+        assert!(dir.join("parts").join(f).exists(), "{f} missing");
+    }
+}
+
 #[test]
 fn organizing_with_filters_bookmark_splits_and_extract_options() {
     let dir = workdir("organize2");
@@ -2708,8 +2837,11 @@ fn digital_ids_signing_and_validation_through_tools() {
     let ids = store["ids"].as_array().unwrap();
     assert_eq!(store["count"].as_u64().unwrap(), ids.len() as u64);
     assert!(ids.iter().all(|id| id["id"].as_str().unwrap().starts_with("windows:")));
+    // Store certificates that can't sign are explained, not dropped (issue #179).
+    let unusable = store["unusable"].as_array().unwrap();
+    assert!(unusable.iter().all(|u| u["subject"].is_string() && !u["reason"].as_str().unwrap().is_empty() && u["no_private_key"].is_boolean()));
     #[cfg(not(windows))]
-    assert!(ids.is_empty());
+    assert!(ids.is_empty() && unusable.is_empty());
     assert!(matches!(
         a.call("sign_document", &json!({ "doc": doc, "id": "ada.p12", "password": "wrong!", "out": "signed.pdf" })),
         Err(ToolError::InvalidArgs(_))
@@ -2780,6 +2912,8 @@ fn optimizing_through_tools() {
     assert_eq!(small["pages"], 1);
     let reduced = ok(&mut a, "doc_reduce", json!({ "doc": doc, "path": "reduced.pdf" }));
     assert!(reduced["bytes_after"].as_u64().unwrap() < reduced["bytes_before"].as_u64().unwrap());
+    assert_eq!(reduced["written"], true);
+    assert_eq!(std::fs::metadata(dir.join("reduced.pdf")).unwrap().len(), reduced["bytes_after"].as_u64().unwrap());
     assert!(matches!(
         a.call("doc_optimize", &json!({ "doc": doc, "path": "x.pdf", "color": { "compression": "gif" } })),
         Err(ToolError::InvalidArgs(_))
@@ -2829,6 +2963,18 @@ fn ocr_tools_make_a_scan_searchable() {
     assert!(matches!(a.call("ocr_recognize", &json!({ "doc": scan, "language": "xx" })), Err(ToolError::InvalidArgs(_))));
 }
 
+#[test]
+fn ocr_recognize_files_refuses_paths_outside_the_root() {
+    let dir = workdir("ocr-files-root");
+    let mut a = auto(&dir);
+    // Refused before anything else, with or without the OCR models installed.
+    for path in ["../outside.pdf", "sub/../../outside.pdf", "/outside.pdf"] {
+        let r = a.call("ocr_recognize_files", &json!({ "paths": ["a.pdf", path], "folder": "out" }));
+        assert!(matches!(&r, Err(e) if e.to_string().contains("outside the allowed directory")), "{path}: {r:?}");
+    }
+    assert!(!dir.join("out").exists(), "nothing was started");
+}
+
 #[test]
 fn ocr_recognize_files_writes_searchable_copies() {
     let dir = workdir("ocr-files");
@@ -2991,6 +3137,36 @@ fn actions_through_tools() {
     assert!(a.call("action_run", &json!({ "steps": [{ "step": "fly" }], "paths": ["a.pdf"], "folder": "x" })).is_err());
 }
 
+#[test]
+fn action_run_keeps_outputs_with_duplicate_input_basenames() {
+    let dir = workdir("action-duplicate-basenames");
+    std::fs::create_dir_all(dir.join("left")).unwrap();
+    std::fs::create_dir_all(dir.join("right")).unwrap();
+    std::fs::write(dir.join("left/report.pdf"), fixture(1)).unwrap();
+    std::fs::write(dir.join("right/report.pdf"), fixture(2)).unwrap();
+    let mut a = auto(&dir);
+    let args = json!({
+        "steps": [{ "step": "set_title", "arg": "Processed" }],
+        "paths": ["left/report.pdf", "right/report.pdf"],
+        "folder": "results"
+    });
+    let result = ok(&mut a, "action_run", args.clone());
+    let files = result["files"].as_array().unwrap();
+    assert_eq!(files.len(), 2);
+    let first_path = files[0]["output"].as_str().unwrap();
+    let second_path = files[1]["output"].as_str().unwrap();
+    assert!(first_path.ends_with("report.pdf"), "{first_path}");
+    assert!(second_path.ends_with("report (2).pdf"), "{second_path}");
+    let first_bytes = std::fs::read(first_path).unwrap();
+    assert_eq!(ok(&mut a, "doc_open", json!({ "path": first_path }))["pages"], 1);
+    assert_eq!(ok(&mut a, "doc_open", json!({ "path": second_path }))["pages"], 2);
+
+    let repeated = ok(&mut a, "action_run", args);
+    assert!(repeated["files"][0]["output"].as_str().unwrap().ends_with("report (3).pdf"));
+    assert!(repeated["files"][1]["output"].as_str().unwrap().ends_with("report (4).pdf"));
+    assert_eq!(std::fs::read(first_path).unwrap(), first_bytes, "an earlier output must not be replaced");
+}
+
 #[test]
 fn pdfa_through_tools() {
     let dir = workdir("pdfa");
@@ -3593,3 +3769,151 @@ fn command_batch_refuses_more_than_a_thousand_steps() {
     let err = a.call("command_batch", &json!({"steps": steps})).unwrap_err();
     assert!(err.to_string().contains("at most 1000 steps"), "{err}");
 }
+
+#[test]
+fn mixed_objects_move_through_tools_with_generation_and_one_undo() {
+    let dir = workdir("mixed-object-move");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({"path":"a.pdf"}))["doc"].as_u64().unwrap();
+    ok(&mut a, "page_add_text", json!({"doc":doc,"page":1,"text":"Added label","rect":[20,20,130,45]}));
+    ok(&mut a, "doc_save", json!({"doc":doc,"path":"before.pdf"}));
+    let inventory = ok(&mut a, "object_list", json!({"doc":doc,"page":1}));
+    assert_eq!(inventory["count"], 2);
+    let objects: Vec<_> = inventory["objects"].as_array().unwrap().iter().map(|o| json!({"kind":o["kind"],"index":o["index"]})).collect();
+    let moved = ok(&mut a, "object_move", json!({"doc":doc,"page":1,"generation":inventory["generation"],"objects":objects,"offset":[18,27]}));
+    assert_eq!(moved["moved"], 2);
+    let after = ok(&mut a, "object_list", json!({"doc":doc,"page":1}));
+    for (old, new) in inventory["objects"].as_array().unwrap().iter().zip(after["objects"].as_array().unwrap()) {
+        for i in 0..4 {
+            assert!((new["rect"][i].as_f64().unwrap() - old["rect"][i].as_f64().unwrap() - if i % 2 == 0 { 18.0 } else { 27.0 }).abs() < 0.02);
+        }
+        assert_eq!(old["text"], new["text"]);
+    }
+    assert!(a.call("object_move", &json!({"doc":doc,"page":1,"generation":inventory["generation"],"objects":objects,"offset":[1,1]})).is_err());
+    let stable = ok(&mut a, "object_list", json!({"doc":doc,"page":1}));
+    assert_eq!(stable, after, "a stale generation cannot edit");
+    ok(&mut a, "edit_undo", json!({"doc":doc}));
+    assert_eq!(ok(&mut a, "object_list", json!({"doc":doc,"page":1}))["objects"], inventory["objects"]);
+    ok(&mut a, "edit_redo", json!({"doc":doc}));
+    ok(&mut a, "doc_save", json!({"doc":doc,"path":"moved.pdf"}));
+    let reopened = ok(&mut a, "doc_open", json!({"path":"moved.pdf"}))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "object_list", json!({"doc":reopened,"page":1}))["objects"], after["objects"]);
+    assert!(page_text(&mut a, reopened)[0].contains("Added label"));
+}
+
+#[test]
+fn object_move_rejects_invalid_nested_references_without_any_change() {
+    let dir = workdir("object-move-refusals");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({"path":"a.pdf"}))["doc"].as_u64().unwrap();
+    let before = ok(&mut a, "object_list", json!({"doc":doc,"page":1}));
+    for objects in [
+        json!([]),
+        json!([{"kind":"text","index":0}]),
+        json!([{"kind":"path","index":1}]),
+        json!([{"kind":"text","index":1,"extra":true}]),
+        json!([{"kind":"text","index":1.5}]),
+        json!([{"kind":"text","index":1},{"kind":"text","index":1}]),
+        json!([{"kind":"text","index":1},{"kind":"image","index":99}]),
+        json!(vec![json!({"kind":"text","index":1}); 1001]),
+    ] {
+        assert!(a.call("object_move", &json!({"doc":doc,"page":1,"objects":objects,"offset":[10,20]})).is_err());
+        assert_eq!(ok(&mut a, "object_list", json!({"doc":doc,"page":1})), before);
+    }
+    for offset in [json!([0, 0]), json!([1]), json!([1, 2, 3]), json!(["1", 2]), json!([1e30, 1])] {
+        assert!(a.call("object_move", &json!({"doc":doc,"page":1,"objects":[{"kind":"text","index":1}],"offset":offset})).is_err());
+        assert_eq!(ok(&mut a, "object_list", json!({"doc":doc,"page":1})), before);
+    }
+}
+
+#[test]
+fn a_deleted_image_is_not_kept_by_reduce_or_optimize() {
+    let dir = workdir("deleted-image");
+    let (w, h) = (600u32, 400u32);
+    let px: Vec<u8> = (0..w * h).flat_map(|i| [(i % w * 255 / w) as u8 ^ (i & 7) as u8, (i / w * 255 / h) as u8, 128]).collect();
+    let mut photo = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut photo, w, h);
+        enc.set_color(png::ColorType::Rgb);
+        enc.set_depth(png::BitDepth::Eight);
+        enc.write_header().unwrap().write_image_data(&px).unwrap();
+    }
+    std::fs::write(dir.join("photo.png"), photo).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_create", json!({ "from": "images", "paths": ["photo.png"] }))["doc"].as_u64().unwrap();
+    ok(&mut a, "image_edit", json!({ "doc": doc, "page": 1, "image": 1, "action": "delete" }));
+    assert_eq!(ok(&mut a, "page_images", json!({ "doc": doc, "page": 1 }))["count"], 0);
+    // The page is blank, so the copies are tiny: the picture's data is not carried along.
+    let r = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "optimized.pdf" }));
+    assert_eq!(r["unused_xobjects"], 1, "{r}");
+    assert!(r["bytes_after"].as_u64().unwrap() < 4_000, "{r}");
+    let r = ok(&mut a, "doc_reduce", json!({ "doc": doc, "path": "reduced.pdf" }));
+    assert!(r["bytes_after"].as_u64().unwrap() < 4_000, "{r}");
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "reduced.pdf" }));
+    assert_eq!(reopened["pages"], 1);
+}
+
+/// A two-page PDF with the same three-row table ("Name Qty / Apple 12 / Pear 7"); the second
+/// page is turned with /Rotate 90.
+fn table_pdf() -> Vec<u8> {
+    let body = "BT /F1 12 Tf 20 250 Td (Name) Tj 130 0 Td (Qty) Tj -130 -20 Td (Apple) Tj 130 0 Td (12) Tj -130 -20 Td (Pear) Tj 130 0 Td (7) Tj ET";
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [4 0 R 5 0 R] /Count 2 /MediaBox [0 0 300 300] >>".to_string(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /Contents 6 0 R /Resources << /Font << /F1 3 0 R >> >> >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /Rotate 90 /Contents 6 0 R /Resources << /Font << /F1 3 0 R >> >> >>".to_string(),
+        format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// Issue #740: `text_extract` with `rect` takes what Column select takes, in the displayed-page
+/// coordinates `text_find` reports, on upright and turned pages alike.
+#[test]
+fn text_extract_with_a_rect_takes_one_column() {
+    let dir = workdir("column");
+    std::fs::write(dir.join("table.pdf"), table_pdf()).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "table.pdf" }))["doc"].as_u64().unwrap();
+    let reading = ok(&mut a, "text_extract", json!({ "doc": doc, "pages": [1] }));
+    assert_eq!(reading["pages"][0]["text"], "Name\nApple\nPear\nQty\n12\n7", "reading order is column by column");
+
+    for page in [1u64, 2] {
+        // The box around "Qty" and "7", as text_find reports them on this page.
+        let rect_of = |a: &mut Automation, q: &str| -> [f64; 4] {
+            let found = ok(a, "text_find", json!({ "doc": doc, "query": q }));
+            let m = found["matches"].as_array().unwrap().iter().find(|m| m["page"] == page).unwrap().clone();
+            let r: Vec<f64> = m["rects"][0].as_array().unwrap().iter().map(|v| v.as_f64().unwrap()).collect();
+            [r[0], r[1], r[2], r[3]]
+        };
+        let (qty, seven) = (rect_of(&mut a, "Qty"), rect_of(&mut a, "7"));
+        let rect = [qty[0].min(seven[0]) - 2.0, qty[1].min(seven[1]) - 2.0, qty[2].max(seven[2]) + 2.0, qty[3].max(seven[3]) + 2.0];
+        let column = ok(&mut a, "text_extract", json!({ "doc": doc, "pages": [page], "rect": rect }));
+        assert_eq!(column["pages"][0]["text"], "Qty\n12\n7", "page {page}, rect {rect:?}");
+    }
+
+    // The whole table, row by row with tab-separated cells (upright page).
+    let all = ok(&mut a, "text_extract", json!({ "doc": doc, "pages": [1], "rect": [0, 0, 300, 300] }));
+    assert_eq!(all["pages"][0]["text"], "Name\tQty\nApple\t12\nPear\t7");
+    // Nothing inside: empty text, not an error.
+    let none = ok(&mut a, "text_extract", json!({ "doc": doc, "pages": [1], "rect": [0, 0, 5, 5] }));
+    assert_eq!(none["pages"][0]["text"], "");
+    // A rect that is not four numbers is refused.
+    for bad in [json!([1, 2, 3]), json!("0 0 1 1"), json!([0, 0, "a", 1])] {
+        let e = a.call("text_extract", &json!({ "doc": doc, "rect": bad })).unwrap_err();
+        assert!(matches!(e, ToolError::InvalidArgs(_)), "{bad}: {e}");
+    }
+}
diff --git a/crates/cos/src/lib.rs b/crates/cos/src/lib.rs
index 7aa560795..b6fe827e4 100644
--- a/crates/cos/src/lib.rs
+++ b/crates/cos/src/lib.rs
@@ -25,7 +25,7 @@ pub use bytes::Bytes;
 pub use document::{Document, Revision, SourceIdentity, XrefEntry};
 pub use object::{Dict, MAX_DECODED, Name, ObjRef, Object, PdfString, Stream};
 pub use parser::{Lexer, parse_indirect};
-pub use pdfcraft_crypt::{Algorithm, Auth, Method as CryptMethod, NewEncryption, Permissions, SecurityHandler};
+pub use pdfcraft_crypt::{Algorithm, Auth, Method as CryptMethod, NewEncryption, Permissions, SecurityHandler, pdfdoc_byte, pdfdoc_char};
 pub use writer::{SaveOptions, pdf_date, serialize, write_full, write_incremental};
 
 #[derive(Debug, thiserror::Error, Clone, PartialEq)]
diff --git a/crates/cos/src/object.rs b/crates/cos/src/object.rs
index a805648e2..7053fd2f2 100644
--- a/crates/cos/src/object.rs
+++ b/crates/cos/src/object.rs
@@ -66,27 +66,13 @@ impl PdfString {
             b => match std::str::from_utf8(b) {
                 // Pure ASCII is identical either way; only non-ASCII UTF-8 needs the switch.
                 Ok(utf8) if !b.is_ascii() => utf8.to_owned(),
-                _ => b.iter().map(|&c| pdfdoc_char(c)).collect(),
+                _ => b.iter().map(|&c| pdfcraft_crypt::pdfdoc_char(c)).collect(),
             },
         };
         if s.starts_with('\u{FEFF}') { s.trim_start_matches('\u{FEFF}').to_owned() } else { s }
     }
 }
 
-/// PDFDocEncoding → Unicode (ISO 32000-2 Annex D). Bytes 0x18–0x1F and 0x80–0xA0 differ from Latin-1.
-fn pdfdoc_char(c: u8) -> char {
-    const HIGH: [char; 33] = [
-        '•', '†', '‡', '…', '—', '–', 'ƒ', '⁄', '‹', '›', '−', '‰', '„', '“', '”', '‘', '’', '‚', '™', 'fi', 'fl', 'Ł', 'Œ', 'Š', 'Ÿ', 'Ž', 'ı', 'ł',
-        'œ', 'š', 'ž', '\u{FFFD}', '€',
-    ];
-    const LOW: [char; 8] = ['˘', 'ˇ', 'ˆ', '˙', '˝', '˛', '˚', '˜'];
-    match c {
-        0x18..=0x1F => LOW[(c - 0x18) as usize],
-        0x80..=0xA0 => HIGH[(c - 0x80) as usize],
-        _ => c as char,
-    }
-}
-
 /// A name object (without the leading `/`, with `#xx` escapes already decoded).
 pub type Name = Vec<u8>;
 
diff --git a/crates/cos/src/writer.rs b/crates/cos/src/writer.rs
index c8e2e0040..26dcfc46f 100644
--- a/crates/cos/src/writer.rs
+++ b/crates/cos/src/writer.rs
@@ -284,13 +284,18 @@ pub fn write_full(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>, CosErro
             collect_refs(&reader.get(r), &mut |x| pending.push(x));
         }
     }
+    // Acrobat refuses an encrypted file whose catalog sits in an object stream ("the file is
+    // damaged and could not be repaired", before it even asks for the password), while other
+    // readers accept it. qpdf keeps the catalog out of object streams too. Verified with
+    // Acrobat DC on macOS (#774).
+    let root_outside = if reader.document.output_security().0.is_some() { trailer_in.reference(b"Root") } else { None };
     let mut rows: BTreeMap<u32, Row> = BTreeMap::new();
     // Keep only references, not renamed copies of the entire object graph. Standalone
     // objects still precede object streams, preserving the established output order.
     let mut packed: Vec<(u32, ObjRef)> = Vec::new();
     for (i, (r, is_stream)) in order.iter().enumerate() {
         let num = output_number(i)?;
-        let in_stream = opts.object_streams && !is_stream && !encryption_objects.contains(r);
+        let in_stream = opts.object_streams && !is_stream && !encryption_objects.contains(r) && root_outside != Some(*r);
         if in_stream {
             packed.push((num, *r));
         } else {
diff --git a/crates/cos/tests/writer.rs b/crates/cos/tests/writer.rs
index 4be398bf2..448cf3577 100644
--- a/crates/cos/tests/writer.rs
+++ b/crates/cos/tests/writer.rs
@@ -152,6 +152,35 @@ fn qpdf_accepts_object_stream_output() {
     assert!(check.status.success() && report.contains("No syntax or stream encoding errors"), "{report}");
 }
 
+#[test]
+fn the_catalog_of_an_encrypted_document_stays_outside_object_streams() {
+    // Acrobat reports an encrypted file as damaged when its catalog is in an object stream,
+    // before asking for the password (#774). Unencrypted output still packs the catalog.
+    fn root_is_packed(bytes: &[u8], password: Option<&str>) -> bool {
+        let doc = Document::open_with_password(Arc::new(bytes.to_vec()), password).unwrap();
+        let root = doc.trailer().reference(b"Root").unwrap();
+        let direct = format!("\n{} 0 obj", root.num);
+        !bytes.windows(direct.len()).any(|w| w == direct.as_bytes())
+    }
+    let plain = Document::open(Arc::new(fixture())).unwrap();
+    assert!(root_is_packed(&write_full(&plain, &SaveOptions::default()).unwrap(), None), "unencrypted: catalog in an object stream");
+    let mut enc = plain.clone();
+    enc.set_encryption(&pdfcraft_cos::NewEncryption {
+        algorithm: pdfcraft_cos::Algorithm::Aes256,
+        user_password: "user",
+        owner_password: "owner",
+        permissions: -4,
+        encrypt_metadata: true,
+        seed: [7; 32],
+    })
+    .unwrap();
+    let packed = write_full(&enc, &SaveOptions::default()).unwrap();
+    assert!(!root_is_packed(&packed, Some("user")), "encrypted: catalog must be a standalone object");
+    let back = Document::open_with_password(Arc::new(packed.clone()), Some("user")).expect("reopens");
+    assert!(back.repair_log().is_empty(), "{:?}", back.repair_log());
+    assert_eq!(title(&back), b"Caf\xe9 (draft)");
+}
+
 #[test]
 fn objects_referenced_by_the_encrypt_dictionary_stay_outside_object_streams() {
     // Encrypt a document, then move its crypt filters into indirect objects, as some producers
diff --git a/crates/create/Cargo.toml b/crates/create/Cargo.toml
index 9ee7d8498..7c915ae93 100644
--- a/crates/create/Cargo.toml
+++ b/crates/create/Cargo.toml
@@ -14,9 +14,11 @@ pdfcraft-model = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 png = "0.18"
 tiff = "0.11"
-image = { version = "0.25", default-features = false, features = ["bmp", "gif"] }
+image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg"] }
 thiserror = { workspace = true }
+# Already in the graph through lopdf; used only to read plain-text files (decode_text).
+encoding_rs = "0.8"
 
 [dev-dependencies]
-image = { version = "0.25", default-features = false, features = ["bmp", "gif"] }
+image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg"] }
 hayro-syntax = { workspace = true }
diff --git a/crates/create/README.md b/crates/create/README.md
index cd20f1959..7cd682775 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -8,7 +8,10 @@ Layer L4. Create a PDF (Acrobat's Create a PDF tool), execution plan M10.2:
   (`/DCTDecode`, grey, RGB or Adobe-inverted CMYK); PNG is decoded and stored with Flate,
   with transparency as a soft mask. An ICC profile in the file (JPEG `APP2 ICC_PROFILE`, PNG
   `iCCP`) that matches the image's colour space is kept as an `/ICCBased` colour space with
-  the device space as `/Alternate`; images with the same profile share one profile object;
+  the device space as `/Alternate`; images with the same profile share one profile object.
+  JPEG metadata scanning skips marker fill bytes and reads application segments after the
+  frame header, stopping at the first scan or end marker. Broken or mismatched ICC profiles
+  still fall back to the device colour space;
 - `from_images_with_resolution(images, ImageResolution::Dpi(dpi))`: override the page
   resolution (1–1200 dpi), without resampling or recompressing image pixels. Use 72 dpi
   for one point per pixel, or `ImageResolution::Embedded` for the same behavior as
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 6503216f0..199dbd818 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -1,7 +1,8 @@
 //! Export a PDF ▸ Image ▸ Export all images, and Edit ▸ Save image as: the images that pages
-//! use, as files. JPEG images are written unchanged; other images are decoded and written as
-//! PNG (with their soft mask as alpha). Images PdfCraft can't decode yet (JPEG 2000, JBIG2,
-//! CCITT, separations) are reported, never silently left out.
+//! use, as files. JPEG images are written unchanged; other images, and JPEG images with
+//! transparency, are decoded and written as PNG with their soft mask, stencil mask or colour
+//! key as alpha. Images PdfCraft can't decode yet (JPEG 2000, JBIG2, CCITT, separations) are
+//! reported, never silently left out.
 
 use std::collections::HashSet;
 
@@ -99,42 +100,75 @@ fn filters(s: &Stream) -> Vec<Vec<u8>> {
     }
 }
 
-/// The file for one image: its JPEG data as is, or a PNG.
+/// The file for one image: its JPEG data as is, or a PNG. An image with transparency (a soft
+/// mask, a stencil `/Mask` or a colour-key `/Mask`) is always a PNG with that transparency as
+/// alpha, JPEG images included, so cut-out images keep their transparent background.
 fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String> {
     let f = filters(s);
+    let jpeg = matches!(f.last().map(Vec::as_slice), Some(b"DCTDecode" | b"DCT")) && f.len() == 1;
     match f.last().map(Vec::as_slice) {
-        Some(b"DCTDecode" | b"DCT") if f.len() == 1 => return Ok(("jpg", s.raw.to_vec())),
         Some(b"JPXDecode") => return Err("JPEG 2000 images can't be exported yet".into()),
         Some(b"JBIG2Decode") => return Err("JBIG2 images can't be exported yet".into()),
         Some(b"CCITTFaxDecode" | b"CCF") => return Err("CCITT fax images can't be exported yet".into()),
-        Some(b"DCTDecode" | b"DCT") => return Err("JPEG images inside other filters can't be exported yet".into()),
+        Some(b"DCTDecode" | b"DCT") if !jpeg => return Err("JPEG images inside other filters can't be exported yet".into()),
         _ => {}
     }
-    let (w, h) = (s.dict.int(b"Width").unwrap_or(0) as usize, s.dict.int(b"Height").unwrap_or(0) as usize);
-    if (w as u64) * (h as u64) > MAX_PIXELS {
-        return Err(format!("{w} × {h} is too large to export"));
-    }
-    let data = s.decoded().map_err(|e| e.to_string())?;
+    let as_is = || Ok(("jpg", s.raw.to_vec()));
+    let (w, h) = (s.dict.int(b"Width").unwrap_or(0), s.dict.int(b"Height").unwrap_or(0));
+    let Some((w, h)) = size(w, h) else {
+        return match () {
+            _ if jpeg => as_is(),
+            _ if w <= 0 || h <= 0 => Err("the image has no size".into()),
+            _ => Err(format!("{w} × {h} is too large to export")),
+        };
+    };
     let mask = s.dict.get(b"ImageMask").is_some_and(|m| matches!(&*doc.resolve(m), Object::Bool(true)));
-    let bpc = if mask { 1 } else { s.dict.int(b"BitsPerComponent").unwrap_or(8) as usize };
-    if !matches!(bpc, 1 | 2 | 4 | 8 | 16) {
-        return Err(format!("{bpc} bits per component isn't supported"));
+    // A stencil mask (`ImageMask true`) has no /SMask or /Mask of its own (8.9.6.2).
+    let mut alpha = if mask { None } else { soft_mask(doc, s, w, h).or_else(|| stencil_mask(doc, s, w, h)) };
+    let key = if mask { None } else { colour_key(doc, s) };
+    if jpeg && alpha.is_none() && key.is_none() {
+        return as_is();
     }
-    let space = if mask { Space::Gray } else { space(doc, s.dict.get(b"ColorSpace"))? };
+    let mut space = if mask { Space::Gray } else { space(doc, s.dict.get(b"ColorSpace"))? };
+    let (samples, bpc) = if jpeg {
+        // A JPEG decoder gives grey or RGB (CMYK and YCCK are converted); a JPEG that doesn't
+        // decode, or an indexed one (not valid), is written as is, without its transparency.
+        let Some((samples, decoded)) = jpeg_samples(&s.raw, &space, w, h) else { return as_is() };
+        space = decoded;
+        (samples, 8)
+    } else {
+        let data = s.decoded().map_err(|e| e.to_string())?;
+        let bpc = if mask { 1 } else { s.dict.int(b"BitsPerComponent").unwrap_or(8) };
+        let bpc = match bpc {
+            1 => 1,
+            2 => 2,
+            4 => 4,
+            8 => 8,
+            16 => 16,
+            other => return Err(format!("{other} bits per component isn't supported")),
+        };
+        (unpack(&data, w, h, space.components(), bpc).ok_or("the image data is shorter than its size says")?, bpc)
+    };
     let n = space.components();
-    let samples = unpack(&data, w, h, n, bpc).ok_or("the image data is shorter than its size says")?;
-    // Decode arrays: only inversion ([1 0] per component) is honoured, the common case.
+    if alpha.is_none() {
+        alpha = key.and_then(|k| keyed_alpha(&samples, n, bpc, &k));
+    }
+    if jpeg && alpha.is_none() {
+        return as_is();
+    }
+    // Decode arrays: only inversion ([1 0] per component) is honoured, the common case. A JPEG
+    // decoder has already applied an Adobe JPEG's own inversion.
     let invert = s
         .dict
         .get(b"Decode")
         .map(|d| doc.resolve(d))
         .and_then(|d| d.as_array().map(|a| a.first().and_then(Object::as_f64) > a.get(1).and_then(Object::as_f64)));
-    let invert = invert.unwrap_or(false) ^ mask; // a stencil mask paints its 0 samples
+    let invert = (invert.unwrap_or(false) && !jpeg) ^ mask; // a stencil mask paints its 0 samples
     let max = (1u32 << bpc.min(8)) - 1;
     let mut rgb = Vec::with_capacity(w * h * 3);
     for px in samples.chunks_exact(n) {
         let v = |i: usize| {
-            let x = (px[i] as u32 * 255 / max) as u8;
+            let x = (px.get(i).copied().unwrap_or(0) as u32 * 255 / max) as u8;
             if invert { 255 - x } else { x }
         };
         match &space {
@@ -142,7 +176,7 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
             Space::Rgb => rgb.extend_from_slice(&[v(0), v(1), v(2)]),
             Space::Cmyk => rgb.extend_from_slice(&cmyk(v(0), v(1), v(2), v(3))),
             Space::Indexed(base, table) => {
-                let i = px[0] as usize;
+                let i = px.first().copied().unwrap_or(0) as usize;
                 let k = base.components();
                 let e = table.get(i * k..i * k + k).unwrap_or(&[0, 0, 0, 0][..k]);
                 rgb.extend_from_slice(&match **base {
@@ -153,10 +187,89 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec<u8>), String>
             }
         }
     }
-    let alpha = soft_mask(doc, s, w, h);
+    if let (Some(a), Some(matte)) = (alpha.as_deref(), matte(doc, s, &space)) {
+        unpremultiply(&mut rgb, a, matte);
+    }
     png(w as u32, h as u32, &rgb, alpha.as_deref()).map(|p| ("png", p))
 }
 
+/// Width and height as sizes, when both are positive and the image is at most `MAX_PIXELS`.
+fn size(w: i64, h: i64) -> Option<(usize, usize)> {
+    let (w, h) = (usize::try_from(w).ok()?, usize::try_from(h).ok()?);
+    let pixels = (w as u64).checked_mul(h as u64)?;
+    (w > 0 && h > 0 && pixels <= MAX_PIXELS).then_some((w, h))
+}
+
+/// A JPEG's samples (8 bits): grey for a grey image, else RGB, with the space they are in.
+fn jpeg_samples(data: &[u8], space: &Space, w: usize, h: usize) -> Option<(Vec<u8>, Space)> {
+    if matches!(space, Space::Indexed(..)) {
+        return None;
+    }
+    let img = image::load_from_memory_with_format(data, image::ImageFormat::Jpeg).ok()?;
+    if img.width() as usize != w || img.height() as usize != h {
+        return None;
+    }
+    Some(match space {
+        Space::Gray => (img.into_luma8().into_raw(), Space::Gray),
+        _ => (img.into_rgb8().into_raw(), Space::Rgb),
+    })
+}
+
+/// The colour-key `/Mask` (8.9.6.4): a [min max] pair per colour component, in sample values.
+fn colour_key(doc: &Document, s: &Stream) -> Option<Vec<(u32, u32)>> {
+    let m = doc.resolve(s.dict.get(b"Mask")?);
+    let a = m.as_array()?;
+    let v: Vec<u32> = a.iter().map(|o| doc.resolve(o).as_f64().map(|f| f.clamp(0.0, 65_535.0) as u32)).collect::<Option<_>>()?;
+    (!v.is_empty() && v.len().is_multiple_of(2)).then(|| v.as_chunks::<2>().0.iter().map(|&[lo, hi]| (lo, hi)).collect())
+}
+
+/// Alpha from a colour key: pixels whose every component falls in its range are transparent.
+fn keyed_alpha(samples: &[u8], n: usize, bpc: usize, key: &[(u32, u32)]) -> Option<Vec<u8>> {
+    if key.len() != n {
+        return None;
+    }
+    // 16-bit samples keep their high byte (see `unpack`), so compare the ranges' high bytes.
+    let shift = if bpc == 16 { 8 } else { 0 };
+    Some(
+        samples
+            .chunks_exact(n)
+            .map(|px| {
+                let hidden = px.iter().zip(key).all(|(&c, &(lo, hi))| (lo >> shift..=hi >> shift).contains(&(c as u32)));
+                if hidden { 0 } else { 255 }
+            })
+            .collect(),
+    )
+}
+
+/// The `/Matte` colour of the image's soft mask (11.6.5.3), for grey and RGB images: the colour
+/// the image samples were pre-blended with.
+fn matte(doc: &Document, s: &Stream, space: &Space) -> Option<Vec<u8>> {
+    let r = s.dict.get(b"SMask")?.as_ref()?;
+    let obj = doc.get(r);
+    let Object::Stream(m) = &*obj else { return None };
+    let a = doc.resolve(m.dict.get(b"Matte")?);
+    let v: Vec<u8> =
+        a.as_array()?.iter().map(|o| doc.resolve(o).as_f64().map(|f| (f.clamp(0.0, 1.0) * 255.0).round() as u8)).collect::<Option<_>>()?;
+    match (space, v.len()) {
+        (Space::Gray, 1) => Some(vec![v[0]; 3]),
+        (Space::Rgb, 3) => Some(v),
+        _ => None,
+    }
+}
+
+/// Undo a pre-blend with `matte`: c = m + (c′ − m) / α.
+fn unpremultiply(rgb: &mut [u8], alpha: &[u8], matte: Vec<u8>) {
+    for (px, &a) in rgb.as_chunks_mut::<3>().0.iter_mut().zip(alpha) {
+        if a == 0 {
+            continue;
+        }
+        for (c, &m) in px.iter_mut().zip(&matte) {
+            let v = m as i32 + (*c as i32 - m as i32) * 255 / a as i32;
+            *c = v.clamp(0, 255) as u8;
+        }
+    }
+}
+
 #[derive(Clone, Debug)]
 enum Space {
     Gray,
@@ -249,21 +362,63 @@ fn cmyk(c: u8, m: u8, y: u8, k: u8) -> [u8; 3] {
     [f(c), f(m), f(y)]
 }
 
-/// The soft mask as 8-bit alpha, when it is an 8-bit gray image of the same size.
+/// The soft mask (`/SMask`) as 8-bit alpha, scaled to the image's size when it has another.
 fn soft_mask(doc: &Document, s: &Stream, w: usize, h: usize) -> Option<Vec<u8>> {
     let r = s.dict.get(b"SMask")?.as_ref()?;
     let obj = doc.get(r);
     let Object::Stream(m) = &*obj else { return None };
-    if m.dict.int(b"Width")? as usize != w || m.dict.int(b"Height")? as usize != h {
-        return None;
+    gray_plane(doc, m, w, h)
+}
+
+/// A stencil `/Mask` (an image mask stream, 8.9.6.3) as 8-bit alpha: its 1 samples (0 with
+/// `/Decode [1 0]`) hide the image.
+fn stencil_mask(doc: &Document, s: &Stream, w: usize, h: usize) -> Option<Vec<u8>> {
+    let r = s.dict.get(b"Mask")?.as_ref()?;
+    let obj = doc.get(r);
+    let Object::Stream(m) = &*obj else { return None };
+    Some(gray_plane(doc, m, w, h)?.into_iter().map(|v| 255 - v).collect())
+}
+
+/// A one-component mask image as 8-bit values (its `/Decode` inversion applied), scaled to
+/// `w` × `h`. `None` when it can't be decoded (JPEG 2000, JBIG2 and CCITT masks).
+fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option<Vec<u8>> {
+    let (mw, mh) = size(m.dict.int(b"Width")?, m.dict.int(b"Height")?)?;
+    let stencil = m.dict.get(b"ImageMask").is_some_and(|v| matches!(&*doc.resolve(v), Object::Bool(true)));
+    let f = filters(m);
+    let mut px = match f.last().map(Vec::as_slice) {
+        Some(b"DCTDecode" | b"DCT") if f.len() == 1 => {
+            let img = image::load_from_memory_with_format(&m.raw, image::ImageFormat::Jpeg).ok()?.into_luma8();
+            (img.width() as usize == mw && img.height() as usize == mh).then(|| img.into_raw())?
+        }
+        Some(b"DCTDecode" | b"DCT" | b"JPXDecode" | b"JBIG2Decode" | b"CCITTFaxDecode" | b"CCF") => return None,
+        _ => {
+            let bpc = if stencil { 1 } else { m.dict.int(b"BitsPerComponent").unwrap_or(8) };
+            let bpc = match bpc {
+                1 => 1,
+                2 => 2,
+                4 => 4,
+                8 => 8,
+                16 => 16,
+                _ => return None,
+            };
+            let max = (1u32 << bpc.min(8)) - 1;
+            unpack(&m.decoded().ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
+        }
+    };
+    let invert = m
+        .dict
+        .get(b"Decode")
+        .map(|d| doc.resolve(d))
+        .and_then(|d| d.as_array().map(|a| a.first().and_then(Object::as_f64) > a.get(1).and_then(Object::as_f64)))
+        .unwrap_or(false);
+    if invert {
+        px.iter_mut().for_each(|v| *v = 255 - *v);
     }
-    let bpc = m.dict.int(b"BitsPerComponent").unwrap_or(8) as usize;
-    if !filters(m).iter().all(|f| !matches!(f.as_slice(), b"DCTDecode" | b"JPXDecode" | b"JBIG2Decode" | b"CCITTFaxDecode")) {
-        return None;
+    if (mw, mh) == (w, h) {
+        return Some(px);
     }
-    let px = unpack(&m.decoded().ok()?, w, h, 1, bpc)?;
-    let max = (1u32 << bpc.min(8)) - 1;
-    Some(px.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect())
+    let img = image::GrayImage::from_raw(mw as u32, mh as u32, px)?;
+    Some(image::imageops::resize(&img, w as u32, h as u32, image::imageops::FilterType::Triangle).into_raw())
 }
 
 fn png(w: u32, h: u32, rgb: &[u8], alpha: Option<&[u8]>) -> Result<Vec<u8>, String> {
diff --git a/crates/create/src/lib.rs b/crates/create/src/lib.rs
index 6e325ef69..09b072702 100644
--- a/crates/create/src/lib.rs
+++ b/crates/create/src/lib.rs
@@ -228,18 +228,31 @@ fn jpeg(name: &str, bytes: &[u8]) -> Result<Embedded, CreateError> {
     }
     let (mut i, mut size, mut comps, mut dpi, mut adobe) = (2usize, None, 0u8, (72.0, 72.0), false);
     let mut icc_chunks = Vec::new();
-    while i + 4 <= bytes.len() {
-        if bytes[i] != 0xFF {
+    while let Some(&byte) = bytes.get(i) {
+        if byte != 0xFF {
             i += 1;
             continue;
         }
-        let marker = bytes[i + 1];
+        i += 1;
+        // Markers may be preceded by any number of 0xFF fill bytes.
+        while bytes.get(i) == Some(&0xFF) {
+            i += 1;
+        }
+        let marker = *bytes.get(i).ok_or_else(|| bad("truncated JPEG marker"))?;
+        i += 1;
+        // Metadata ends at the first scan; entropy-coded bytes are not segments.
+        if marker == 0xDA || marker == 0xD9 {
+            break;
+        }
         if marker == 0xD8 || marker == 0x01 || (0xD0..=0xD7).contains(&marker) {
-            i += 2;
             continue;
         }
-        let len = u16::from_be_bytes([bytes[i + 2], bytes[i + 3]]) as usize;
-        let seg = bytes.get(i + 4..i + 2 + len).ok_or_else(|| bad("truncated"))?;
+        let len = usize::from(be16(bytes, i).ok_or_else(|| bad("truncated JPEG segment length"))?);
+        if len < 2 {
+            return Err(bad("invalid JPEG segment length"));
+        }
+        let end = i.checked_add(len).ok_or_else(|| bad("JPEG segment length overflow"))?;
+        let seg = bytes.get(i + 2..end).ok_or_else(|| bad("truncated JPEG segment"))?;
         match marker {
             // APP0 JFIF density.
             0xE0 if seg.starts_with(b"JFIF\0") && seg.len() >= 12 => {
@@ -259,18 +272,16 @@ fn jpeg(name: &str, bytes: &[u8]) -> Result<Embedded, CreateError> {
                     icc_chunks.push((*seq, *count, data));
                 }
             }
-            0xC0..=0xCF if marker != 0xC4 && marker != 0xC8 && marker != 0xCC => {
+            0xC0..=0xCF if marker != 0xC4 && marker != 0xC8 && marker != 0xCC && size.is_none() => {
                 if seg.len() < 6 {
                     return Err(bad("bad frame header"));
                 }
                 size = Some((u16::from_be_bytes([seg[3], seg[4]]) as u32, u16::from_be_bytes([seg[1], seg[2]]) as u32));
                 comps = seg[5];
-                break;
             }
-            0xDA => break,
             _ => {}
         }
-        i += 2 + len;
+        i = end;
     }
     let (w, h) = size.filter(|(w, h)| *w > 0 && *h > 0).ok_or_else(|| bad("no image size"))?;
     let mut d = Dict::new();
@@ -572,6 +583,28 @@ pub fn from_images_with_resolution(images: &[(String, Vec<u8>)], resolution: Ima
 
 // ── text ────────────────────────────────────────────────────────────────────────────────────
 
+/// The text of a plain-text file. A byte order mark picks UTF-8 or UTF-16 (little or big
+/// endian) and is dropped; without one the bytes are UTF-8 when they are valid UTF-8, and
+/// otherwise the Windows code page they most likely are: 1254 (Turkish) or 1252 (Western).
+pub fn decode_text(bytes: &[u8]) -> String {
+    if let Some((encoding, bom)) = encoding_rs::Encoding::for_bom(bytes) {
+        return encoding.decode_without_bom_handling(bytes.get(bom..).unwrap_or_default()).0.into_owned();
+    }
+    if let Ok(text) = std::str::from_utf8(bytes) {
+        return text.to_string();
+    }
+    let encoding = if turkish_code_page(bytes) { encoding_rs::WINDOWS_1254 } else { encoding_rs::WINDOWS_1252 };
+    encoding.decode_without_bom_handling(bytes).0.into_owned()
+}
+
+/// Windows-1254 and 1252 differ only in six bytes: Ğ İ Ş ğ ı ş in 1254 are Ð Ý Þ ð ý þ in 1252.
+/// Of the Western languages only Icelandic and Faroese use those, and both also write á í ó ú,
+/// which Turkish never does.
+fn turkish_code_page(bytes: &[u8]) -> bool {
+    bytes.iter().any(|b| matches!(b, 0xD0 | 0xDD | 0xDE | 0xF0 | 0xFD | 0xFE))
+        && !bytes.iter().any(|b| matches!(b, 0xC1 | 0xCD | 0xD3 | 0xDA | 0xE1 | 0xED | 0xF3 | 0xFA))
+}
+
 /// Plain text set in Helvetica on pages of `page` size with 1-inch margins.
 pub fn from_text(title: &str, text: &str, page: (f64, f64), font_size: f64) -> Result<Document, CreateError> {
     let size = if font_size.is_finite() && font_size > 0.0 { font_size.clamp(4.0, 72.0) } else { 11.0 };
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index e649fdf73..d83cefc5d 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -289,6 +289,28 @@ fn jpeg_2000_images_are_embedded_as_is() {
     assert_eq!(media(&pages(&doc)[0])[2], 64.0);
 }
 
+#[test]
+fn text_files_are_decoded_by_byte_order_mark_then_utf8_then_code_page() {
+    let utf16 = |text: &str, big: bool| -> Vec<u8> {
+        let mut v = if big { vec![0xFE, 0xFF] } else { vec![0xFF, 0xFE] };
+        for u in text.encode_utf16() {
+            v.extend_from_slice(&if big { u.to_be_bytes() } else { u.to_le_bytes() });
+        }
+        v
+    };
+    assert_eq!(decode_text("Kış İstanbul".as_bytes()), "Kış İstanbul");
+    assert_eq!(decode_text(b"\xEF\xBB\xBFMerhaba"), "Merhaba", "a UTF-8 byte order mark is dropped");
+    assert_eq!(decode_text(&utf16("Kış İstanbul\r\nŞubat", false)), "Kış İstanbul\r\nŞubat");
+    assert_eq!(decode_text(&utf16("Grüße 日本", true)), "Grüße 日本");
+    // Not UTF-8: Windows-1254 for Turkish, 1252 for other Western text (Icelandic included).
+    assert_eq!(decode_text(b"K\xFD\xFE \xDDstanbul \xF0\xFC\xE7"), "Kış İstanbul ğüç");
+    assert_eq!(decode_text(b"\xDE\xF3r\xF0ur \xE1 \xEDslandi"), "Þórður á íslandi");
+    assert_eq!(decode_text(b"caf\xE9 \x80 5"), "café € 5");
+    // Odd and broken input never fails.
+    assert_eq!(decode_text(&[0xFF, 0xFE, b'A']), "\u{FFFD}");
+    assert_eq!(decode_text(b""), "");
+}
+
 #[test]
 fn source_kind_tells_pdfs_images_and_text_apart() {
     assert_eq!(source_kind("a.bin", b"%PDF-1.7\n"), Some(SourceKind::Pdf));
@@ -346,6 +368,64 @@ fn icc_of(doc: &Document, image: &Dict) -> Option<(i64, Vec<u8>, Vec<u8>, Object
     Some((s.dict.int(b"N")?, s.dict.name(b"Alternate")?.to_vec(), s.decoded().unwrap(), r))
 }
 
+/// Move the synthetic fixture's frame before its application segments.
+fn jpeg_frame_first(mut bytes: Vec<u8>) -> Vec<u8> {
+    let at = bytes.windows(2).position(|w| w == [0xFF, 0xC0]).unwrap();
+    let len = usize::from(u16::from_be_bytes([bytes[at + 2], bytes[at + 3]]));
+    let frame: Vec<_> = bytes.drain(at..at + 2 + len).collect();
+    bytes.splice(2..2, frame);
+    bytes
+}
+
+#[test]
+fn jpeg_fill_bytes_and_metadata_after_frame_are_preserved() {
+    let profile = icc_profile(b"CMYK");
+    let mut bytes = jpeg_frame_first(cmyk_jpeg_bytes(&profile));
+    // Fill before SOF and APP14, including multiple consecutive fill bytes.
+    bytes.splice(24..24, [0xFF, 0xFF]);
+    bytes.insert(2, 0xFF);
+    let doc = reopen(&from_images(&[("filled.jpg".into(), bytes.clone())]).unwrap());
+    let image = image_of(&doc, 0);
+    let (n, alt, data, _) = icc_of(&doc, &image).unwrap();
+    assert_eq!((n, alt.as_slice(), data), (4, &b"DeviceCMYK"[..], profile));
+    assert!(image.contains(b"Decode"), "APP14 after SOF still inverts CMYK");
+    assert_eq!(extract_images(&doc, &[0], 0).images[0].data, bytes);
+
+    let embedded = jpeg("density.jpg", &jpeg_frame_first(jpeg_bytes())).unwrap();
+    assert_eq!(embedded.px, (3, 2));
+    assert_eq!(embedded.dpi, (300.0, 300.0), "JFIF after SOF is read");
+
+    // A mismatched profile found after SOF still falls back leniently, as in #729.
+    let bytes = jpeg_frame_first(cmyk_jpeg_bytes(&icc_profile(b"RGB ")));
+    let doc = reopen(&from_images(&[("mismatch.jpg".into(), bytes)]).unwrap());
+    assert_eq!(image_of(&doc, 0).name(b"ColorSpace"), Some(&b"DeviceCMYK"[..]));
+}
+
+#[test]
+fn jpeg_segment_scan_stops_at_sos_or_eoi() {
+    let profile = icc_profile(b"CMYK");
+    for marker in [0xDA, 0xD9] {
+        let mut bytes = jpeg_frame_first(cmyk_jpeg_bytes(&profile));
+        bytes.truncate(bytes.len() - 2);
+        // Neither marker needs a segment length to stop metadata scanning. The trailing
+        // invalid APP2 would fail if entropy data or bytes after EOI were walked.
+        bytes.extend_from_slice(&[0xFF, 0xFF, marker, 0xFF, 0xE2, 0, 1]);
+        let embedded = jpeg("boundary.jpg", &bytes).unwrap();
+        assert_eq!(embedded.icc, Some(profile.clone()));
+        assert_eq!(embedded.px, (3, 2));
+    }
+}
+
+#[test]
+fn jpeg_segment_scan_rejects_truncated_or_invalid_lengths() {
+    for tail in [&[0xFF][..], &[0xFF, 0xFF], &[0xFF, 0xE2], &[0xFF, 0xE2, 0], &[0xFF, 0xE2, 0, 0], &[0xFF, 0xE2, 0, 1], &[0xFF, 0xE2, 0, 3]] {
+        let mut bytes = jpeg_bytes();
+        bytes.truncate(bytes.len() - 2);
+        bytes.extend_from_slice(tail);
+        assert!(jpeg("truncated.jpg", &bytes).is_err(), "tail: {tail:?}");
+    }
+}
+
 #[test]
 fn embedded_icc_profiles_tag_the_image_colour_space() {
     // A CMYK JPEG keeps its profile as /ICCBased (N 4), its data byte for byte and its Decode.
@@ -403,3 +483,157 @@ fn embedded_icc_profiles_tag_the_image_colour_space() {
     let Object::Stream(s) = &*doc.get(r) else { panic!() };
     assert_eq!(icc_of(&doc, &s.dict).map(|(n, ..)| n), Some(4));
 }
+
+/// Replaces page 0's image with the stream `image` builds (it can add objects, e.g. a mask).
+fn with_image(doc: &mut Document, image: impl FnOnce(&mut Document) -> Stream) {
+    let page = pdfcraft_model::pages(doc)[0].clone();
+    let res = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+    let xo = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+    let r = xo.iter().next().map(|(_, v)| v.as_ref().unwrap()).unwrap();
+    let s = image(doc);
+    doc.set(r, Object::Stream(s));
+}
+
+fn image_dict(w: i64, h: i64, space: &str, bpc: i64) -> Dict {
+    let mut d = Dict::new();
+    d.set(b"Type".to_vec(), Object::name("XObject"));
+    d.set(b"Subtype".to_vec(), Object::name("Image"));
+    d.set(b"Width".to_vec(), Object::Int(w));
+    d.set(b"Height".to_vec(), Object::Int(h));
+    d.set(b"ColorSpace".to_vec(), Object::name(space));
+    d.set(b"BitsPerComponent".to_vec(), Object::Int(bpc));
+    d
+}
+
+/// The exported file's extension and its pixels as RGBA.
+fn exported_rgba(doc: &Document) -> (&'static str, Vec<u8>) {
+    let out = extract_images(doc, &[0], 0);
+    assert!(out.skipped.is_empty(), "{:?}", out.skipped);
+    let img = &out.images[0];
+    if img.extension == "jpg" {
+        return ("jpg", image::load_from_memory(&img.data).unwrap().into_rgba8().into_raw());
+    }
+    let dec = png::Decoder::new(std::io::Cursor::new(img.data.clone()));
+    let mut r = dec.read_info().unwrap();
+    let mut buf = vec![0; r.output_buffer_size().unwrap()];
+    let info = r.next_frame(&mut buf).unwrap();
+    buf.truncate(info.buffer_size());
+    let rgba = match info.color_type {
+        png::ColorType::Rgba => buf,
+        png::ColorType::Rgb => buf.as_chunks::<3>().0.iter().flat_map(|c| [c[0], c[1], c[2], 255]).collect(),
+        other => panic!("unexpected {other:?}"),
+    };
+    ("png", rgba)
+}
+
+fn alphas(rgba: &[u8]) -> Vec<u8> {
+    rgba.as_chunks::<4>().0.iter().map(|p| p[3]).collect()
+}
+
+/// A 4×2 grey JPEG (mid grey).
+fn real_jpeg() -> Vec<u8> {
+    let mut out = Vec::new();
+    image::codecs::jpeg::JpegEncoder::new_with_quality(&mut out, 95).encode(&[128u8; 8], 4, 2, image::ExtendedColorType::L8).unwrap();
+    out
+}
+
+#[test]
+fn jpeg_images_with_a_soft_mask_export_as_png_with_alpha() {
+    // Issue #645: a cut-out photo (JPEG with an /SMask) lost its transparent background.
+    let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+    with_image(&mut doc, |doc| {
+        let mask = Stream::from_raw(image_dict(4, 2, "DeviceGray", 8), vec![0, 255, 0, 255, 255, 0, 255, 0]);
+        let m = doc.add(Object::Stream(mask));
+        let mut d = image_dict(4, 2, "DeviceGray", 8);
+        d.set(b"Filter".to_vec(), Object::name("DCTDecode"));
+        d.set(b"SMask".to_vec(), Object::Ref(m));
+        Stream::from_raw(d, real_jpeg())
+    });
+    let (ext, rgba) = exported_rgba(&doc);
+    assert_eq!(ext, "png", "a JPEG with transparency is written as a PNG");
+    assert_eq!(alphas(&rgba), [0, 255, 0, 255, 255, 0, 255, 0]);
+    assert!(rgba.as_chunks::<4>().0.iter().all(|p| p[0].abs_diff(128) <= 4 && p[0] == p[1] && p[1] == p[2]), "{rgba:?}");
+    // Without a mask the JPEG is still written as is.
+    let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+    with_image(&mut doc, |_| {
+        let mut d = image_dict(4, 2, "DeviceGray", 8);
+        d.set(b"Filter".to_vec(), Object::name("DCTDecode"));
+        Stream::from_raw(d, real_jpeg())
+    });
+    let out = extract_images(&doc, &[0], 0);
+    assert_eq!((out.images[0].extension, &out.images[0].data), ("jpg", &real_jpeg()));
+}
+
+#[test]
+fn soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha() {
+    // A 2×1 soft mask on a 4×2 image is scaled to the image's size.
+    let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+    with_image(&mut doc, |doc| {
+        let m = doc.add(Object::Stream(Stream::from_raw(image_dict(2, 1, "DeviceGray", 8), vec![0, 255])));
+        let mut d = image_dict(4, 2, "DeviceRGB", 8);
+        d.set(b"SMask".to_vec(), Object::Ref(m));
+        Stream::from_raw(d, vec![10; 24])
+    });
+    let a = alphas(&exported_rgba(&doc).1);
+    assert!(a[0] < 64 && a[3] > 192 && a[4] < 64 && a[7] > 192, "{a:?}");
+
+    // A stencil /Mask: its 1 samples hide the image.
+    let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+    with_image(&mut doc, |doc| {
+        let mut md = Dict::new();
+        md.set(b"Type".to_vec(), Object::name("XObject"));
+        md.set(b"Subtype".to_vec(), Object::name("Image"));
+        md.set(b"Width".to_vec(), Object::Int(4));
+        md.set(b"Height".to_vec(), Object::Int(2));
+        md.set(b"ImageMask".to_vec(), Object::Bool(true));
+        let m = doc.add(Object::Stream(Stream::from_raw(md, vec![0b1100_0000, 0b0011_0000])));
+        let mut d = image_dict(4, 2, "DeviceRGB", 8);
+        d.set(b"Mask".to_vec(), Object::Ref(m));
+        Stream::from_raw(d, vec![10; 24])
+    });
+    assert_eq!(alphas(&exported_rgba(&doc).1), [0, 0, 255, 255, 255, 255, 0, 0]);
+
+    // A colour-key /Mask: pure white pixels are transparent.
+    let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+    with_image(&mut doc, |_| {
+        let mut d = image_dict(2, 1, "DeviceRGB", 8);
+        d.set(b"Mask".to_vec(), Object::Array([250, 255, 250, 255, 250, 255].map(Object::Int).to_vec()));
+        Stream::from_raw(d, vec![255, 255, 255, 255, 0, 0])
+    });
+    assert_eq!(exported_rgba(&doc).1, [255, 255, 255, 0, 255, 0, 0, 255]);
+
+    // A soft mask with /Matte: the colours are un-blended from the matte colour.
+    let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+    with_image(&mut doc, |doc| {
+        let mut md = image_dict(2, 1, "DeviceGray", 8);
+        md.set(b"Matte".to_vec(), Object::Array(vec![Object::Int(1)]));
+        let m = doc.add(Object::Stream(Stream::from_raw(md, vec![255, 128])));
+        let mut d = image_dict(2, 1, "DeviceGray", 8);
+        d.set(b"SMask".to_vec(), Object::Ref(m));
+        // Black at half alpha, pre-blended with white: 255 + (0 − 255) × 128 / 255 ≈ 127.
+        Stream::from_raw(d, vec![0, 127])
+    });
+    let rgba = exported_rgba(&doc).1;
+    assert_eq!(rgba[..4], [0, 0, 0, 255]);
+    assert!(rgba[4] <= 2 && rgba[7] == 128, "{rgba:?}");
+}
+
+#[test]
+fn damaged_masks_and_sizes_never_panic() {
+    for (w, h, mw, mh, data) in [(4, 2, -3, 1, vec![]), (4, 2, i64::MAX, 2, vec![0; 8]), (-4, 2, 4, 2, vec![0; 8]), (4, 2, 4, 2, vec![])] {
+        let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+        with_image(&mut doc, |doc| {
+            let m = doc.add(Object::Stream(Stream::from_raw(image_dict(mw, mh, "DeviceGray", 8), data.clone())));
+            let mut d = image_dict(w, h, "DeviceRGB", 8);
+            d.set(b"SMask".to_vec(), Object::Ref(m));
+            d.set(b"Mask".to_vec(), Object::Array(vec![Object::Real(f64::NAN), Object::Int(-5)]));
+            Stream::from_raw(d, vec![10; 24])
+        });
+        let page = pdfcraft_model::pages(&doc)[0].clone();
+        let res = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+        let xo = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+        let r = xo.iter().next().map(|(_, v)| v.as_ref().unwrap()).unwrap();
+        let _ = extract_images(&doc, &[0], 0);
+        let _ = image_file(&doc, r);
+    }
+}
diff --git a/crates/crypt/src/lib.rs b/crates/crypt/src/lib.rs
index 267c8f1c4..9c2c1dab1 100644
--- a/crates/crypt/src/lib.rs
+++ b/crates/crypt/src/lib.rs
@@ -151,15 +151,19 @@ impl SecurityHandler {
         let mut recovered_user = None;
         let (key, auth) = match dict.r {
             2..=4 => {
-                let legacy = legacy_password(pw);
-                if let Some((k, user)) = owner_key_r4(&dict, id0, &legacy) {
-                    recovered_user = Some(user);
-                    (k, Auth::Owner)
-                } else if let Some(k) = user_key_r4(&dict, id0, &legacy) {
-                    (k, Auth::User)
-                } else {
-                    return Err(CryptError::WrongPassword);
+                let mut found = None;
+                for legacy in legacy_candidates(pw) {
+                    if let Some((k, user)) = owner_key_r4(&dict, id0, &legacy) {
+                        recovered_user = Some(user);
+                        found = Some((k, Auth::Owner));
+                    } else if let Some(k) = user_key_r4(&dict, id0, &legacy) {
+                        found = Some((k, Auth::User));
+                    }
+                    if found.is_some() {
+                        break;
+                    }
                 }
+                found.ok_or(CryptError::WrongPassword)?
             }
             5 | 6 => {
                 let pw = sasl_password(pw);
@@ -300,9 +304,48 @@ impl SecurityHandler {
 
 // ── Passwords ──────────────────────────────────────────────────────────────────────────────────
 
-/// Revisions 2–4 use PDFDocEncoding passwords; characters outside Latin-1 are dropped.
+/// PDFDocEncoding (ISO 32000-2 Annex D) where it differs from Latin-1: bytes 0x18–0x1F and
+/// 0x80–0xA0 (0x9F is undefined). Here rather than in pdfcraft-cos, which decodes text strings
+/// with it, because R2–R4 passwords need it too and cos depends on this crate.
+const PDFDOC_LOW: [char; 8] = ['˘', 'ˇ', 'ˆ', '˙', '˝', '˛', '˚', '˜'];
+const PDFDOC_HIGH: [char; 33] = [
+    '•', '†', '‡', '…', '—', '–', 'ƒ', '⁄', '‹', '›', '−', '‰', '„', '“', '”', '‘', '’', '‚', '™', 'fi', 'fl', 'Ł', 'Œ', 'Š', 'Ÿ', 'Ž', 'ı', 'ł', 'œ',
+    'š', 'ž', '\u{FFFD}', '€',
+];
+
+/// PDFDocEncoding → Unicode.
+pub fn pdfdoc_char(c: u8) -> char {
+    match c {
+        0x18..=0x1F => PDFDOC_LOW[usize::from(c - 0x18)],
+        0x80..=0xA0 => PDFDOC_HIGH[usize::from(c - 0x80)],
+        _ => char::from(c),
+    }
+}
+
+/// Unicode → PDFDocEncoding, `None` for a character it lacks (ğ, ş, İ, Cyrillic, CJK, …).
+pub fn pdfdoc_byte(c: char) -> Option<u8> {
+    let at = |table: &[char], base: u8| table.iter().position(|&t| t == c && t != '\u{FFFD}').and_then(|i| u8::try_from(i).ok()).map(|i| base + i);
+    at(&PDFDOC_LOW, 0x18).or_else(|| at(&PDFDOC_HIGH, 0x80)).or_else(|| match u32::from(c) {
+        0x18..=0x1F | 0x80..=0xA0 => None,
+        n => u8::try_from(n).ok(),
+    })
+}
+
+/// Revisions 2–4: the password in PDFDocEncoding (§7.6.4.3.2, Algorithm 2), at most 32 bytes.
+/// Characters PDFDocEncoding lacks are dropped.
 fn legacy_password(pw: &str) -> Vec<u8> {
-    pw.chars().filter_map(|c| u8::try_from(u32::from(c)).ok()).take(32).collect()
+    pw.chars().filter_map(pdfdoc_byte).take(32).collect()
+}
+
+/// The bytes an R2–R4 password may have been written as: PDFDocEncoding, as the specification
+/// asks; and for a password with characters PDFDocEncoding lacks (ğ, ş, İ, …), which it gives
+/// no bytes, also its UTF-8 bytes, which qpdf and other tools write for such passwords.
+fn legacy_candidates(pw: &str) -> Vec<Vec<u8>> {
+    let mut out = vec![legacy_password(pw)];
+    if pw.chars().any(|c| pdfdoc_byte(c).is_none()) {
+        out.push(pw.bytes().take(32).collect());
+    }
+    out
 }
 
 /// Revisions 5–6: SASLprep (RFC 4013), UTF-8, at most 127 bytes.
diff --git a/crates/crypt/src/tests.rs b/crates/crypt/src/tests.rs
index f93f8c646..dc3a1964b 100644
--- a/crates/crypt/src/tests.rs
+++ b/crates/crypt/src/tests.rs
@@ -163,3 +163,75 @@ fn owner_authentication_recovers_the_user_password() {
     let d = new(Algorithm::Rc4_128, "", "owner", -1).dict().clone();
     assert_eq!(SecurityHandler::open(d, ID, Some("owner")).unwrap().recovered_user_password().as_deref(), Some(&b""[..]));
 }
+
+/// /O, /U and the first /ID of files qpdf 12.4.2 wrote (`--static-id`), with the file keys
+/// `qpdf --show-encryption-key` reports.
+fn qpdf_file(r: i64, o: &str, u: &str) -> EncryptDict {
+    let mut d = EncryptDict {
+        filter: b"Standard".to_vec(),
+        v: if r == 4 { 4 } else { 2 },
+        r,
+        length_bits: 128,
+        o: hex(o),
+        u: hex(u),
+        p: -4,
+        encrypt_metadata: true,
+        ..Default::default()
+    };
+    if r == 4 {
+        d.crypt_filters = vec![(b"StdCF".to_vec(), Method::Aes128)];
+        d.stm_f = b"StdCF".to_vec();
+        d.str_f = b"StdCF".to_vec();
+    }
+    d
+}
+
+const QPDF_ID: &str = "56b57383aafa8314f3f98222995f5604";
+
+#[test]
+fn legacy_passwords_are_pdfdoc_encoded_with_a_utf8_fallback() {
+    let id = hex(QPDF_ID);
+    // R3 RC4: user "ılık€" in PDFDocEncoding (ı = 0x9A, € = 0xA0); owner "Öğretmen", which
+    // PDFDocEncoding can't hold, so qpdf wrote its UTF-8 bytes.
+    let r3 = qpdf_file(
+        3,
+        "d519aa8120ce8c54812b45e5391916fed167b1c84961d90c4ee4c182ad83534b",
+        "4985c03ddfa3eeb8a90c343512913ec40021446990b9e4114071a4d9104984c1",
+    );
+    let user = SecurityHandler::open(r3.clone(), &id, Some("ılık€")).unwrap();
+    assert_eq!((user.auth(), user.file_key().to_vec()), (Auth::User, hex("3564ffcea186122595ad55ee157da71f")));
+    let owner = SecurityHandler::open(r3.clone(), &id, Some("Öğretmen")).unwrap();
+    assert_eq!((owner.auth(), owner.file_key().to_vec()), (Auth::Owner, hex("3564ffcea186122595ad55ee157da71f")));
+    assert_eq!(owner.recovered_user_password(), Some(vec![0x9A, b'l', 0x9A, b'k', 0xA0]));
+    // Dropping ı and € (the old Latin-1 conversion) or a near miss doesn't open it.
+    for wrong in ["lk", "ilik€", "ılık", "Ogretmen"] {
+        assert_eq!(SecurityHandler::open(r3.clone(), &id, Some(wrong)).unwrap_err(), CryptError::WrongPassword, "{wrong}");
+    }
+    // R4 AES-128: user "şifre" (UTF-8 bytes), owner "owner".
+    let r4 = qpdf_file(
+        4,
+        "bb4f8f4bd2236569e765906caf64e4429a4c20d6e996fdef963e9b5080f9e083",
+        "4a965fb91882772cd09ce8bbff2c33270021446990b9e4114071a4d9104984c1",
+    );
+    let user = SecurityHandler::open(r4.clone(), &id, Some("şifre")).unwrap();
+    assert_eq!((user.auth(), user.file_key().to_vec()), (Auth::User, hex("9f19d465cfd8e525d32aa0bdf10acd06")));
+    assert_eq!(SecurityHandler::open(r4.clone(), &id, Some("owner")).unwrap().auth(), Auth::Owner);
+    assert_eq!(SecurityHandler::open(r4, &id, Some("ifre")).unwrap_err(), CryptError::WrongPassword);
+}
+
+#[test]
+fn pdfdoc_encoding_round_trips() {
+    for b in 0..=255u8 {
+        if b != 0x9F {
+            assert_eq!(pdfdoc_byte(pdfdoc_char(b)), Some(b), "{b:#04x}");
+        }
+    }
+    assert_eq!(pdfdoc_byte('ı'), Some(0x9A));
+    assert_eq!(pdfdoc_byte('€'), Some(0xA0));
+    assert_eq!(pdfdoc_byte('ç'), Some(0xE7));
+    for c in ['ğ', 'ş', 'İ', '\u{A0}', '\u{85}', 'Ж', '日'] {
+        assert_eq!(pdfdoc_byte(c), None, "{c}");
+    }
+    assert_eq!(legacy_candidates("Çok"), [vec![0xC7, b'o', b'k']]);
+    assert_eq!(legacy_candidates("şifre"), [b"ifre".to_vec(), "şifre".as_bytes().to_vec()]);
+}
diff --git a/crates/edit/src/flatten.rs b/crates/edit/src/flatten.rs
index dd05dbb7e..134696665 100644
--- a/crates/edit/src/flatten.rs
+++ b/crates/edit/src/flatten.rs
@@ -118,6 +118,23 @@ fn flatten_which(doc: &mut Document, pages: &[usize], which: Which) -> Result<us
             .unwrap_or_default();
         let mut gone: HashSet<ObjRef> = HashSet::new();
         let mut gone_inline: HashSet<usize> = HashSet::new();
+        // A viewer draws many comments from their dictionary even when the file stores no
+        // appearance (notes, FreeText, ink, stamps…). Build the appearance it would show, so
+        // flattening keeps a comment that still has ink on screen instead of deleting it.
+        for entry in &list {
+            let Some(r) = entry.as_ref() else { continue };
+            let d = doc.resolve(entry).as_dict().cloned().unwrap_or_default();
+            let subtype = d.name(b"Subtype").unwrap_or_default();
+            if subtype == b"Widget" || !selected(doc, &d, which) {
+                continue;
+            }
+            let flags = d.get(b"F").and_then(|f| doc.resolve(f).as_int()).unwrap_or(0);
+            if flags & (HIDDEN | NO_VIEW) != 0 || appearance(doc, &d).is_some() {
+                continue;
+            }
+            // A subtype this build cannot draw only fails here; it is still removed below.
+            let _ = pdfcraft_annot::set_appearance(doc, r);
+        }
         for (k, entry) in list.iter().enumerate() {
             let obj = doc.resolve(entry);
             let Some(d) = obj.as_dict() else { continue };
diff --git a/crates/edit/src/images.rs b/crates/edit/src/images.rs
index d9ba9c96a..c6c0cb5d9 100644
--- a/crates/edit/src/images.rs
+++ b/crates/edit/src/images.rs
@@ -304,3 +304,73 @@ pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &Imag
     })?;
     Ok(())
 }
+
+/// Inventory indexes exclude the streams that belong to added content.
+pub(crate) fn selectable_images(
+    doc: &Document,
+    page: usize,
+    excluded: &std::collections::BTreeSet<ObjRef>,
+) -> Result<Vec<(usize, PageImage)>, EditError> {
+    let p = page_of(doc, page)?;
+    let all = streams(doc, &p.dict);
+    Ok(page_images(doc, page)?
+        .into_iter()
+        .enumerate()
+        .filter(|(_, image)| !all.get(image.stream).and_then(|(o, _)| o.as_ref()).is_some_and(|r| excluded.contains(&r)))
+        .collect())
+}
+
+/// Plan all transforms before changing a stream; indexes refer to the original inventory.
+/// Splice only the chosen Do operators and preserve all other bytes and stream dictionaries.
+pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize], offset: [f64; 2]) -> Result<(), EditError> {
+    if indexes.is_empty() {
+        return Ok(());
+    }
+    let images = page_images(doc, page)?;
+    let p = page_of(doc, page)?;
+    let all = streams(doc, &p.dict);
+    let mut plans = std::collections::BTreeMap::new();
+    for index in indexes {
+        let image = images.get(*index).ok_or_else(|| EditError::Invalid("a selected image no longer exists".into()))?;
+        let placement = Matrix(image.draw_matrix);
+        let inverse = placement.invert().ok_or_else(|| EditError::Invalid("a selected image has no area".into()))?;
+        let [a, b, c, d, _, _] = inverse.0;
+        let movement = Matrix([1.0, 0.0, 0.0, 1.0, a * offset[0] + c * offset[1], b * offset[0] + d * offset[1]]);
+        if !movement.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+            return Err(EditError::Invalid("the image move is too large".into()));
+        }
+        plans.insert((image.stream, image.op), movement);
+    }
+    let mut data = Vec::with_capacity(all.len());
+    let mut inside_text = false;
+    for (stream, (_, bytes)) in all.iter().enumerate() {
+        let pieces = pdfcraft_content::Pieces::join(&[bytes.as_slice()]);
+        let ops = pieces.parse().ops;
+        for (index, op) in ops.iter().enumerate() {
+            if op.is("BT") {
+                inside_text = true;
+            } else if op.is("ET") {
+                inside_text = false;
+            } else if inside_text && plans.contains_key(&(stream, index)) {
+                return Err(EditError::Invalid("an image inside a text object cannot be moved in a group".into()));
+            }
+        }
+        let changed = crate::text::splice(&pieces, &ops, |index| {
+            let Some(matrix) = plans.remove(&(stream, index)) else { return (Vec::new(), true) };
+            let original = ops.get(index).cloned().into_iter();
+            // Local translations can be tiny under a large CTM. Preserve their precision
+            // rather than rounding them to zero or amplifying an error on the page.
+            let mut out = vec![Op::new("q", vec![]), Op::new("cm", matrix.0.map(Object::Real).to_vec())];
+            out.extend(original);
+            out.push(Op::new("Q", vec![]));
+            (out, false)
+        });
+        data.push(changed.into_iter().next().unwrap_or_default());
+    }
+    if !plans.is_empty() {
+        return Err(EditError::Invalid("a selected image operation is missing".into()));
+    }
+    let contents = crate::text::rewritten_contents(doc, &all, data);
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+    Ok(())
+}
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 532b32487..467f5dd2b 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -414,6 +414,20 @@ pub fn add_header_footer(doc: &mut Document, pages: &[usize], hf: &HeaderFooter,
     if !(hf.font_size.is_finite() && hf.font_size > 0.0 && hf.font_size <= 200.0 && hf.margins.iter().all(|m| m.is_finite() && *m >= 0.0)) {
         return Err(EditError::Invalid("invalid font size or margins".into()));
     }
+    // Page numbers count up from start_number, so the last selected page needs the most room.
+    // Refuse the whole run before drawing anything: headers applied to some pages and then a
+    // failed page number would leave the document half changed.
+    let last_number = u64::from(hf.start_number)
+        .checked_add(pages.len().saturating_sub(1) as u64)
+        .ok_or_else(|| EditError::Invalid("the header page numbers are too large".into()))?;
+    if last_number > u64::from(u32::MAX) {
+        return Err(EditError::Invalid(format!(
+            "the header start number {} leaves no room for {} pages (page numbers stop at {})",
+            hf.start_number,
+            pages.len(),
+            u32::MAX
+        )));
+    }
     if replace {
         remove_marks(doc, pages, MarkKind::HeaderFooter)?;
     }
@@ -423,7 +437,8 @@ pub fn add_header_footer(doc: &mut Document, pages: &[usize], hf: &HeaderFooter,
     for (k, &i) in pages.iter().enumerate() {
         let page = &all[i];
         let (w, h) = page.display_size(doc);
-        let number = hf.start_number + k as u32;
+        let number =
+            u32::try_from(u64::from(hf.start_number) + k as u64).map_err(|_| EditError::Invalid("the header page numbers are too large".into()))?;
         let bates = bates0 + k as u64;
         let size = hf.font_size;
         let [top, bottom, left, right] = hf.margins;
@@ -611,6 +626,9 @@ pub fn marks_present(doc: &Document) -> Vec<MarkKind> {
     found
 }
 
+pub mod objects;
+pub use objects::{EditableObject, MAX_MOVE_OBJECTS, ObjectKind, ObjectTarget, editable_objects, move_objects};
+
 mod flatten;
 pub use flatten::{flatten, flatten_fill_sign};
 pub mod images;
diff --git a/crates/edit/src/objects.rs b/crates/edit/src/objects.rs
new file mode 100644
index 000000000..169d4a2b5
--- /dev/null
+++ b/crates/edit/src/objects.rs
@@ -0,0 +1,338 @@
+//! Mixed-object inventory and atomic translation in Edit a PDF. Source indexes are resolved
+//! together before mutation. Added content appears once, not again as a paragraph/image.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use pdfcraft_content::{Matrix, Op, Pieces};
+use pdfcraft_cos::{Dict, Document, Object};
+
+use crate::{Content, EditError};
+
+pub const MAX_MOVE_OBJECTS: usize = 1_000;
+const MAX_PAGE_OBJECTS: usize = 10_000;
+const MAX_COORDINATE: f64 = 1e9;
+const MAX_CONTENT_BYTES: usize = 128 * 1024 * 1024;
+
+/// The source inventory of an editable item. Indexes are zero-based within that inventory.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum ObjectKind {
+    Added,
+    Text,
+    Image,
+}
+
+impl ObjectKind {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Added => "added",
+            Self::Text => "text",
+            Self::Image => "image",
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct ObjectTarget {
+    pub kind: ObjectKind,
+    pub index: usize,
+}
+
+/// An item recognised by Edit a PDF. Geometry is in the page's user space; a Form is one
+/// grouped artwork item. Its nested content is kept intact, not selected again separately.
+#[derive(Clone, Debug, PartialEq)]
+pub struct EditableObject {
+    pub target: ObjectTarget,
+    pub rect: [f64; 4],
+    pub content_type: &'static str,
+    pub text: Option<String>,
+}
+
+fn valid_rect(rect: [f64; 4]) -> bool {
+    rect.iter().all(|v| v.is_finite() && v.abs() <= MAX_COORDINATE) && rect[2] > rect[0] && rect[3] > rect[1]
+}
+
+pub fn editable_objects(doc: &Document, page: usize) -> Result<Vec<EditableObject>, EditError> {
+    checked_streams(doc, page)?;
+    let added: Vec<_> = crate::list_added(doc).into_iter().filter(|a| a.page == page).collect();
+    if added.len() > MAX_PAGE_OBJECTS {
+        return Err(EditError::Invalid("this page has too many objects to select together".into()));
+    }
+    let geometry = added_geometry(doc, page)?.1;
+    let excluded = added.iter().map(|a| a.obj).collect();
+    let mut objects = Vec::new();
+    for (index, a) in added.into_iter().enumerate() {
+        let (content_type, text) = match &a.content {
+            Content::Text(t) => ("text", Some(t.text.clone())),
+            Content::Image(_) => ("image", None),
+        };
+        objects.push(EditableObject {
+            target: ObjectTarget { kind: ObjectKind::Added, index },
+            rect: geometry.get(index).ok_or_else(|| EditError::Invalid("an added item has no placement".into()))?.rect,
+            content_type,
+            text,
+        });
+    }
+    for (index, b) in crate::text::selectable_blocks(doc, page, &excluded)? {
+        objects.push(EditableObject {
+            target: ObjectTarget { kind: ObjectKind::Text, index },
+            rect: b.rect,
+            content_type: "text",
+            text: Some(b.text),
+        });
+    }
+    for (index, image) in crate::images::selectable_images(doc, page, &excluded)? {
+        objects.push(EditableObject {
+            target: ObjectTarget { kind: ObjectKind::Image, index },
+            rect: image.rect,
+            content_type: if image.is_form { "form" } else { "image" },
+            text: None,
+        });
+    }
+    if objects.len() > MAX_PAGE_OBJECTS {
+        return Err(EditError::Invalid("this page has too many objects to select together".into()));
+    }
+    if objects.iter().any(|o| !valid_rect(o.rect)) {
+        return Err(EditError::Invalid("an object has invalid geometry".into()));
+    }
+    Ok(objects)
+}
+
+/// Move selected mixed objects by a user-space vector as one atomic operation. All targets
+/// refer to the original inventories. A refusal leaves the graph, including overlay, untouched.
+pub fn move_objects(doc: &mut Document, page: usize, targets: &[ObjectTarget], offset: [f64; 2]) -> Result<(), EditError> {
+    if targets.is_empty() || targets.len() > MAX_MOVE_OBJECTS {
+        return Err(EditError::Invalid("select between 1 and 1000 objects to move".into()));
+    }
+    if !offset.iter().all(|v| v.is_finite() && v.abs() <= MAX_COORDINATE) || offset == [0.0, 0.0] {
+        return Err(EditError::Invalid("the move must be finite and non-zero".into()));
+    }
+    let inventory: BTreeMap<_, _> = editable_objects(doc, page)?.into_iter().map(|o| (o.target, o)).collect();
+    let mut unique = BTreeSet::new();
+    for target in targets {
+        if !unique.insert(*target) {
+            return Err(EditError::Invalid("an object was selected more than once".into()));
+        }
+        let object =
+            inventory.get(target).ok_or_else(|| EditError::Invalid("a selected object no longer exists; select the objects again".into()))?;
+        let r = object.rect;
+        if !valid_rect([r[0] + offset[0], r[1] + offset[1], r[2] + offset[0], r[3] + offset[1]]) {
+            return Err(EditError::Invalid("the object move is too large".into()));
+        }
+    }
+    let indexes = |kind| targets.iter().filter(|t| t.kind == kind).map(|t| t.index).collect::<Vec<_>>();
+    let mut work = doc.clone();
+    crate::text::translate_blocks(&mut work, page, &indexes(ObjectKind::Text), offset)?;
+    crate::images::translate_images(&mut work, page, &indexes(ObjectKind::Image), offset)?;
+    translate_added(&mut work, page, &indexes(ObjectKind::Added), offset)?;
+    // Placement operators add to size/depth/work budgets, and moving paragraphs can change
+    // their grouping. Keep the resulting inventory usable; refuse before swapping otherwise.
+    editable_objects(&work, page)?;
+    *doc = work;
+    Ok(())
+}
+
+struct AddedGeometry {
+    rect: [f64; 4],
+    local_rect: [f64; 4],
+    origin: Matrix,
+    outside: Matrix,
+    current: Matrix,
+    stream: usize,
+    op: usize,
+    params: Dict,
+}
+
+/// An added item's metadata is in the coordinate space it was written in, which can differ
+/// from today's page rotation/crop/UserUnit. Read its original placement, including graphics
+/// state from preceding streams. MoveOrigin retains that basis after a byte-preserving move.
+fn added_geometry(doc: &Document, page: usize) -> Result<(Pieces, Vec<AddedGeometry>), EditError> {
+    let added: Vec<_> = crate::list_added(doc).into_iter().filter(|a| a.page == page).collect();
+    if added.is_empty() {
+        return Ok((Pieces::default(), Vec::new()));
+    }
+    let streams = checked_streams(doc, page)?;
+    let pieces = Pieces::join(&streams.iter().map(|(_, bytes)| bytes.as_slice()).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    let owned: BTreeSet<_> = added.iter().map(|a| a.obj).collect();
+    let mut geometry = BTreeMap::new();
+    let mut first = BTreeMap::new();
+    let mut matrix = Matrix::IDENTITY;
+    let mut stack = Vec::new();
+    for (index, op) in ops.iter().enumerate() {
+        let (stream, end) = pieces.pieces_of(op);
+        let object = streams.get(stream).and_then(|(r, _)| r.as_ref());
+        if object.is_some_and(|r| owned.contains(&r)) {
+            if let std::collections::btree_map::Entry::Vacant(entry) = first.entry(stream) {
+                if stream != end || !op.is("q") {
+                    return Err(EditError::Invalid("an added item has an unsupported placement".into()));
+                }
+                entry.insert((index, matrix));
+            } else if first.get(&stream).is_some_and(|(i, _)| i.checked_add(1) == Some(index)) {
+                if stream != end || !op.is("cm") {
+                    return Err(EditError::Invalid("an added item has an unsupported placement".into()));
+                }
+                let current = op.nums::<6>().map(Matrix).ok_or_else(|| EditError::Invalid("an added item has invalid geometry".into()))?;
+                let outside = first.get(&stream).map_or(Matrix::IDENTITY, |(_, m)| *m);
+                let params = object
+                    .and_then(|r| doc.get(r).as_dict().and_then(|d| d.get(b"PCAdded")).map(|p| doc.resolve(p)))
+                    .and_then(|p| p.as_dict().cloned())
+                    .ok_or_else(|| EditError::Invalid("an added item has no parameters".into()))?;
+                let origin = match params.get(b"MoveOrigin") {
+                    None => current,
+                    Some(o) => doc
+                        .resolve(o)
+                        .as_array()
+                        .and_then(|a| Matrix::from_operands(a))
+                        .ok_or_else(|| EditError::Invalid("an added item has invalid geometry".into()))?,
+                };
+                let raw = params
+                    .get(b"Rect")
+                    .map(|r| doc.resolve(r))
+                    .and_then(|r| r.as_array().cloned())
+                    .ok_or_else(|| EditError::Invalid("an added item has no rectangle".into()))?;
+                let local_rect = raw
+                    .iter()
+                    .map(Object::as_f64)
+                    .collect::<Option<Vec<_>>>()
+                    .and_then(|r| <[f64; 4]>::try_from(r).ok())
+                    .ok_or_else(|| EditError::Invalid("an added item has invalid geometry".into()))?;
+                if !current.0.iter().chain(origin.0.iter()).chain(outside.0.iter()).all(|v| v.is_finite() && v.abs() <= 1e12)
+                    || !valid_rect(local_rect)
+                {
+                    return Err(EditError::Invalid("an added item has invalid geometry".into()));
+                }
+                geometry.insert(
+                    stream,
+                    AddedGeometry { rect: origin.then(&outside).bbox(local_rect), local_rect, origin, outside, current, stream, op: index, params },
+                );
+            }
+        }
+        match op.op.as_slice() {
+            b"q" => {
+                if stack.len() >= 1024 {
+                    return Err(EditError::Invalid("the page graphics state is nested too deeply".into()));
+                }
+                stack.push(matrix);
+            }
+            b"Q" => matrix = stack.pop().unwrap_or(matrix),
+            b"cm" => {
+                if let Some(m) = op.nums::<6>() {
+                    matrix = Matrix(m).then(&matrix);
+                }
+            }
+            _ => {}
+        }
+    }
+    let geometry: Vec<_> = geometry.into_values().collect();
+    if geometry.len() != added.len() {
+        return Err(EditError::Invalid("an added item has no placement".into()));
+    }
+    Ok((pieces, geometry))
+}
+
+fn translate_added(doc: &mut Document, page: usize, indexes: &[usize], offset: [f64; 2]) -> Result<(), EditError> {
+    if indexes.is_empty() {
+        return Ok(());
+    }
+    let p = pdfcraft_model::pages(doc).into_iter().nth(page).ok_or(EditError::NoSuchPage(page))?;
+    let streams = checked_streams(doc, page)?;
+    let (pieces, geometry) = added_geometry(doc, page)?;
+    let ops = pieces.parse().ops;
+    let mut replacements = BTreeMap::new();
+    let mut parameters = Vec::new();
+    let linear = |inverse: Matrix| {
+        let [a, b, c, d, _, _] = inverse.0;
+        [a * offset[0] + c * offset[1], b * offset[0] + d * offset[1]]
+    };
+    for index in indexes {
+        let g = geometry.get(*index).ok_or_else(|| EditError::Invalid("a selected added item no longer exists".into()))?;
+        let delta = linear(g.origin.then(&g.outside).invert().ok_or_else(|| EditError::Invalid("an added item has no area".into()))?);
+        let outer_delta = linear(g.outside.invert().ok_or_else(|| EditError::Invalid("an added item has no area".into()))?);
+        let current = g.current.then(&Matrix([1.0, 0.0, 0.0, 1.0, outer_delta[0], outer_delta[1]]));
+        let r = g.local_rect;
+        let rect = [r[0] + delta[0], r[1] + delta[1], r[2] + delta[0], r[3] + delta[1]];
+        if !valid_rect(rect) || !current.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+            return Err(EditError::Invalid("the added item move is too large".into()));
+        }
+        let mut params = g.params.clone();
+        params.set(b"MoveOrigin".to_vec(), Object::Array(g.origin.0.map(Object::Real).to_vec()));
+        params.set(b"Rect".to_vec(), Object::Array(rect.map(Object::Real).to_vec()));
+        parameters.push((g.stream, params));
+        replacements.insert(g.op, Op::new("cm", current.0.map(Object::Real).to_vec()));
+    }
+    // A placement replaces exactly one operator. Keep its existing following separator,
+    // rather than adding a blank line every time the item is moved.
+    let edits = replacements
+        .into_iter()
+        .map(|(i, op)| {
+            let original = ops.get(i).ok_or_else(|| EditError::Invalid("an added item placement is missing".into()))?;
+            let mut bytes = pdfcraft_content::serialize_ops(&[op]);
+            if bytes.last() == Some(&b'\n') {
+                bytes.pop();
+            }
+            Ok((original.span.clone(), bytes))
+        })
+        .collect::<Result<Vec<_>, EditError>>()?;
+    let data = pieces.splice(edits);
+    let contents = crate::text::rewritten_contents(doc, &streams, data);
+    let refs = match &contents {
+        Object::Array(a) => a.clone(),
+        one => vec![one.clone()],
+    };
+    for (stream, params) in parameters {
+        let r = refs.get(stream).and_then(Object::as_ref).ok_or_else(|| EditError::Invalid("the added item stream is missing".into()))?;
+        doc.update_dict(r, |d| d.set(b"PCAdded".to_vec(), Object::Dict(params)))?;
+    }
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+    Ok(())
+}
+
+/// A missing or undecodable preceding stream can hide graphics state that affects every
+/// later item. Refuse group editing rather than inventing an inventory from partial data.
+fn checked_streams(doc: &Document, page: usize) -> Result<Vec<(Object, Vec<u8>)>, EditError> {
+    let p = pdfcraft_model::pages(doc).into_iter().nth(page).ok_or(EditError::NoSuchPage(page))?;
+    let contents = match p.dict.get(b"Contents") {
+        None => Vec::new(),
+        Some(c) => match &*doc.resolve(c) {
+            Object::Array(a) => {
+                if a.len() > MAX_PAGE_OBJECTS {
+                    return Err(EditError::Invalid("this page has too many content streams to select objects together".into()));
+                }
+                a.clone()
+            }
+            _ => vec![c.clone()],
+        },
+    };
+    let mut remaining = MAX_CONTENT_BYTES;
+    let mut depth = 0usize;
+    let mut operations = 0usize;
+    let mut streams = Vec::with_capacity(contents.len());
+    for object in contents {
+        let resolved = doc.resolve(&object);
+        let Object::Stream(stream) = &*resolved else {
+            return Err(EditError::Invalid("a page content stream is missing".into()));
+        };
+        let bytes = stream
+            .decoded_within(remaining.min(64 * 1024 * 1024))
+            .map_err(|_| EditError::Invalid("the page content cannot be decoded within its size limit".into()))?;
+        remaining =
+            remaining.checked_sub(bytes.len()).ok_or_else(|| EditError::Invalid("the page content is too large for group selection".into()))?;
+        let parsed = pdfcraft_content::parse(&bytes);
+        operations = operations.saturating_add(parsed.ops.len());
+        if operations > 100_000 {
+            return Err(EditError::Invalid("this page has too many content operations for group selection".into()));
+        }
+        for op in parsed.ops {
+            if op.is("q") {
+                depth = depth.saturating_add(1);
+            } else if op.is("Q") {
+                depth = depth.saturating_sub(1);
+            }
+            if depth > 1024 {
+                return Err(EditError::Invalid("the page graphics state is nested too deeply".into()));
+            }
+        }
+        streams.push((object, bytes));
+    }
+    Ok(streams)
+}
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 54aecc759..d9f7f5481 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -96,6 +96,25 @@ fn header_and_footer_are_drawn_in_display_space_and_wrap_the_original_content()
     assert_eq!(marks_present(&doc), [MarkKind::HeaderFooter]);
 }
 
+#[test]
+fn header_start_number_that_would_wrap_is_refused_without_drawing() {
+    // u32::MAX is a valid start_number on its own, but there is no room for a second page
+    // number after it. The old code wrapped the second page to zero; now the whole run is
+    // refused and the document keeps no header at all.
+    let mut doc = fixture();
+    let hf = HeaderFooter {
+        text: [String::new(), String::new(), "<<1>>".into(), String::new(), String::new(), String::new()],
+        start_number: u32::MAX,
+        ..HeaderFooter::default()
+    };
+    let err = add_header_footer(&mut doc, &[0, 1], &hf, false, &cx()).unwrap_err();
+    assert!(err.to_string().contains("leaves no room"), "{err}");
+    assert!(marks_present(&doc).is_empty(), "nothing is drawn when the run is refused");
+    // A single page still fits the start number itself.
+    add_header_footer(&mut doc, &[0], &hf, false, &cx()).unwrap();
+    assert_eq!(marks_present(&doc).len(), 1);
+}
+
 #[test]
 fn replace_and_remove_restore_the_original_content() {
     let mut doc = fixture();
@@ -175,6 +194,26 @@ fn flattening_draws_appearances_into_the_page_and_removes_the_comments() {
     assert!(marks_present(&doc).is_empty(), "flattened content is not a removable mark");
 }
 
+/// #805: a supported note with no stored appearance is still drawn by viewers. Flattening must
+/// generate that appearance and bake it into the page, not delete a comment that shows an icon.
+#[test]
+fn flattening_keeps_a_note_whose_appearance_is_missing() {
+    let page = stream("", " ");
+    let mut doc = build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << >> /Contents 4 0 R /Annots [5 0 R] >>",
+        &page,
+        "<< /Type /Annot /Subtype /Text /Rect [10 10 30 30] /Contents (Synthetic note) /Name /Comment /Open false /F 0 >>",
+    ]);
+    assert_eq!(flatten(&mut doc, &[0], true, false).unwrap(), 1, "the note icon is drawn");
+    let doc = reopen(&doc);
+    let p = &pdfcraft_model::pages(&doc)[0];
+    assert!(!p.dict.contains(b"Annots"), "the note is gone once its icon is baked in");
+    let flat = streams(&doc, 0).pop().unwrap();
+    assert!(flat.contains("q 1 0 0 1 10 10 cm /PCFl0 Do Q"), "{flat}");
+}
+
 /// Display space is in points, so on a `/UserUnit 2` page an item's box maps to half as many
 /// user-space units. Items record the `/UserUnit` they were written for; one without it was
 /// written when display space was in user-space units, and reads back scaled to points.
@@ -1607,3 +1646,385 @@ fn hostile_form_xobjects_are_read_once() {
     assert_eq!(texts, ["once", "from b", "from a", "inherited", "bad matrix"]);
     assert!(images::reading_images(&doc, 0).unwrap().is_empty());
 }
+
+#[test]
+fn group_moves_preserve_glyph_bytes_and_unselected_text_state() {
+    for content in [
+        "BT /F1 12 Tf 1.3 Tc 2 Tw 80 Tz 14 TL 1 0.2 -0.1 1 50 600 Tm (A\\101) Tj 1 0 0 rg (Neighbour) Tj T* (Next) Tj ET",
+        "BT /F1 12 Tf 14 TL 50 600 Td (Before) Tj 0 0 1 rg (Quoted) ' 1 0 0 rg (After) Tj ET",
+        "BT /F1 12 Tf 14 TL 50 600 Td (Before) Tj 0 0 1 rg 2 1 (Quoted) \" 1 0 0 rg [(After) -120 (wards)] TJ T* (Last) Tj ET",
+        "q 1.2 0.3 -0.1 0.9 20 30 cm BT /F1 12 Tf 50 600 Td [(A) -120 (B)] TJ 1 0 0 rg (After) Tj ET Q %keep-this-comment\n",
+        "BT /F1 12.3456789 Tf 81.23456789 Tz 0.123456789 Ts 14 TL 50 600 Td (Before) Tj 0 0 1 rg 2.123456789 1.987654321 (Quoted) \" 1 0 0 rg (After) Tj ET",
+    ] {
+        let mut doc = text_page(content);
+        let before = text::text_lines(&doc, 0).unwrap();
+        let blocks = text::text_blocks(&doc, 0).unwrap();
+        let index = blocks.iter().position(|b| b.text.contains("Quoted")).unwrap_or(0);
+        let selected: Vec<_> = blocks[index].lines.iter().map(|i| before[*i].text.clone()).collect();
+        let glyph_bytes = |doc: &Document| {
+            pdfcraft_content::parse(&page_content_bytes(doc, 0))
+                .ops
+                .iter()
+                .flat_map(|op| {
+                    op.operands
+                        .iter()
+                        .flat_map(|o| match o {
+                            Object::String(s) => vec![s.bytes.clone()],
+                            Object::Array(a) => a.iter().filter_map(|v| v.as_string().map(|s| s.bytes.clone())).collect(),
+                            _ => Vec::new(),
+                        })
+                        .collect::<Vec<_>>()
+                })
+                .collect::<Vec<_>>()
+        };
+        let original_bytes = glyph_bytes(&doc);
+        let target = ObjectTarget { kind: ObjectKind::Text, index };
+        move_objects(&mut doc, 0, &[target], [35.0, -27.0]).unwrap();
+        let doc = reopen(&doc);
+        assert_eq!(glyph_bytes(&doc), original_bytes, "original codes and kerning strings survive");
+        let after = text::text_lines(&doc, 0).unwrap();
+        assert_eq!(after.len(), before.len(), "{content}");
+        for old in before {
+            let new = after.iter().find(|l| l.text == old.text).unwrap();
+            let expected = if selected.contains(&old.text) {
+                [old.rect[0] + 35.0, old.rect[1] - 27.0, old.rect[2] + 35.0, old.rect[3] - 27.0]
+            } else {
+                old.rect
+            };
+            assert!(new.rect.iter().zip(expected).all(|(a, b)| (a - b).abs() < 1e-6), "{}: {:?} != {:?}", old.text, new.rect, expected);
+            assert_eq!((new.font.clone(), new.color), (old.font, old.color));
+        }
+        if content.contains("%keep-this-comment") {
+            assert!(String::from_utf8_lossy(&page_content_bytes(&doc, 0)).contains("%keep-this-comment"));
+        }
+    }
+}
+
+#[test]
+fn group_moves_preserve_small_offsets_under_large_transforms() {
+    let mut doc = image_page();
+    let page = pdfcraft_model::pages(&doc)[0].obj;
+    let content = doc.add(Object::Stream(Stream::flate(
+        Dict::new(),
+        b"q 100000 0 0 100000 100 100 cm /Im0 Do Q q 10000 0 0 10000 0 0 cm BT /F1 0.00123456789 Tf 0.02 0.06 Td (Small) Tj 1 0 0 rg (Neighbour) Tj ET Q",
+    )));
+    doc.update_dict(page, |d| d.set(b"Contents".to_vec(), Object::Ref(content))).unwrap();
+    let before = editable_objects(&doc, 0).unwrap();
+    let targets = before.iter().filter(|o| o.text.as_deref() != Some("Neighbour")).map(|o| o.target).collect::<Vec<_>>();
+    assert_eq!(targets.len(), 2);
+    let offset = [0.00123456789, -0.00987654321];
+    move_objects(&mut doc, 0, &targets, offset).unwrap();
+    let after = editable_objects(&reopen(&doc), 0).unwrap();
+    for old in before {
+        let new = after.iter().find(|o| o.target == old.target).unwrap();
+        let [dx, dy] = if targets.contains(&old.target) { offset } else { [0.0, 0.0] };
+        assert!(close(new.rect, [old.rect[0] + dx, old.rect[1] + dy, old.rect[2] + dx, old.rect[3] + dy]), "{old:?}: {new:?}");
+    }
+}
+
+#[test]
+fn mixed_object_inventory_does_not_select_added_content_twice() {
+    let mut doc = image_page();
+    add_content(&mut doc, 0, &Content::Text(AddedText { text: "Added label".into(), rect: [50.0, 350.0, 200.0, 380.0], ..AddedText::default() }))
+        .unwrap();
+    let before = editable_objects(&doc, 0).unwrap();
+    assert_eq!(before.len(), 3, "one native paragraph, one native image, one added text");
+    let targets = before.iter().map(|o| o.target).collect::<Vec<_>>();
+    let image = images::page_images(&doc, 0).unwrap()[0].object.unwrap();
+    let original_image = doc.get(image).clone();
+    move_objects(&mut doc, 0, &targets, [20.0, -15.0]).unwrap();
+    let doc = reopen(&doc);
+    let after = editable_objects(&doc, 0).unwrap();
+    assert_eq!(after.len(), before.len());
+    for old in before {
+        let new = after.iter().find(|o| o.target == old.target).unwrap();
+        assert!(close(new.rect, [old.rect[0] + 20.0, old.rect[1] - 15.0, old.rect[2] + 20.0, old.rect[3] - 15.0]));
+        assert_eq!(new.text, old.text);
+    }
+    assert_eq!(doc.get(image).clone(), original_image, "pixel data is shared, not recompressed");
+}
+
+#[test]
+fn group_move_refusals_leave_the_object_graph_untouched() {
+    let mut doc = image_page();
+    let target = editable_objects(&doc, 0).unwrap()[0].target;
+    let original = pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap();
+    for (targets, offset) in [
+        (vec![], [1.0, 2.0]),
+        (vec![target, target], [1.0, 2.0]),
+        (vec![target, ObjectTarget { kind: ObjectKind::Image, index: usize::MAX }], [1.0, 2.0]),
+        (vec![target], [f64::NAN, 2.0]),
+        (vec![target], [f64::INFINITY, 2.0]),
+        (vec![target], [0.0, 0.0]),
+        (vec![target], [1e300, 2.0]),
+        (vec![target; MAX_MOVE_OBJECTS + 1], [1.0, 2.0]),
+    ] {
+        assert!(move_objects(&mut doc, 0, &targets, offset).is_err());
+        assert_eq!(pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap(), original);
+    }
+    let mut clipped = text_page("BT /F1 12 Tf 50 600 Td (Ordinary) Tj ET BT /F1 12 Tf 4 Tr 50 400 Td (Clipping) Tj ET");
+    let targets = editable_objects(&clipped, 0).unwrap().iter().map(|o| o.target).collect::<Vec<_>>();
+    let original = pdfcraft_cos::write_full(&clipped, &SaveOptions::default()).unwrap();
+    assert!(move_objects(&mut clipped, 0, &targets, [10.0, 5.0]).unwrap_err().to_string().contains("clipping"));
+    assert_eq!(pdfcraft_cos::write_full(&clipped, &SaveOptions::default()).unwrap(), original);
+}
+
+#[test]
+fn added_and_native_objects_move_together_on_cropped_rotated_user_unit_pages() {
+    for rotation in [0, 90, 180, 270] {
+        let mut doc = image_page();
+        let page = pdfcraft_model::pages(&doc)[0].obj;
+        doc.update_dict(page, |d| {
+            d.set(b"CropBox".to_vec(), Object::Array([10, 20, 500, 750].map(Object::Int).to_vec()));
+            d.set(b"Rotate".to_vec(), Object::Int(rotation));
+            d.set(b"UserUnit".to_vec(), Object::Int(2));
+        })
+        .unwrap();
+        add_content(&mut doc, 0, &Content::Text(AddedText { text: "Added".into(), rect: [60.0, 100.0, 180.0, 125.0], ..AddedText::default() }))
+            .unwrap();
+        let before = editable_objects(&doc, 0).unwrap();
+        move_objects(&mut doc, 0, &before.iter().map(|o| o.target).collect::<Vec<_>>(), [12.0, -8.0]).unwrap();
+        let after = editable_objects(&reopen(&doc), 0).unwrap();
+        for (a, b) in before.iter().zip(after) {
+            assert!(
+                close(b.rect, [a.rect[0] + 12.0, a.rect[1] - 8.0, a.rect[2] + 12.0, a.rect[3] - 8.0]),
+                "rotation {rotation}: {:?} -> {:?}",
+                a.rect,
+                b.rect
+            );
+        }
+    }
+}
+
+#[test]
+fn group_moves_keep_split_stream_tokens_and_shared_form_resources() {
+    let mut doc = split_streams_page();
+    let before = text::text_lines(&doc, 0).unwrap();
+    let objects: Vec<_> = editable_objects(&doc, 0).unwrap().iter().map(|o| o.target).collect();
+    move_objects(&mut doc, 0, &objects, [30.0, -20.0]).unwrap();
+    let doc = reopen(&doc);
+    let after = text::text_lines(&doc, 0).unwrap();
+    assert_eq!(before.len(), after.len());
+    for (a, b) in before.iter().zip(&after) {
+        assert_eq!(a.text, b.text);
+        assert!(close(b.rect, [a.rect[0] + 30.0, a.rect[1] - 20.0, a.rect[2] + 30.0, a.rect[3] - 20.0]));
+    }
+    let joined = page_content_bytes(&doc, 0);
+    let ops = pdfcraft_content::parse(&joined).ops;
+    assert_eq!(ops.iter().find(|o| o.is("BDC")).unwrap().operands.len(), 2);
+    assert!(ops.iter().any(|o| o.is("EMC")));
+    // Two pages share a content stream and a Form; only one placement on one page moves.
+    let mut doc = fixture();
+    let mut form = Dict::new();
+    form.set(b"Subtype".to_vec(), Object::name("Form"));
+    form.set(b"BBox".to_vec(), Object::Array([0, 0, 60, 30].map(Object::Int).to_vec()));
+    form.set(b"PrivateData".to_vec(), Object::String(pdfcraft_cos::PdfString::literal(b"retain this".to_vec())));
+    let artwork = doc.add(Object::Stream(Stream::flate(form, b"1 0 0 rg 0 0 60 30 re f")));
+    doc.update_dict(pdfcraft_cos::ObjRef::new(6, 0), |d| {
+        let mut xo = Dict::new();
+        xo.set(b"Figure".to_vec(), Object::Ref(artwork));
+        d.set(b"XObject".to_vec(), Object::Dict(xo));
+    })
+    .unwrap();
+    doc.set(
+        pdfcraft_cos::ObjRef::new(7, 0),
+        Object::Stream(Stream::flate(
+            Dict::new(),
+            b"q 1 0 0 1 40 80 cm /Figure Do Q q 1 0 0 1 300 400 cm /Figure Do Q BT /F1 9 Tf 40 160 Td (Caption) Tj ET",
+        )),
+    );
+    let original_form = doc.get(artwork);
+    let source_page = page_content_bytes(&doc, 1);
+    let images = images::page_images(&doc, 0).unwrap();
+    move_objects(
+        &mut doc,
+        0,
+        &[ObjectTarget { kind: ObjectKind::Image, index: 0 }, ObjectTarget { kind: ObjectKind::Text, index: 0 }],
+        [15.0, -10.0],
+    )
+    .unwrap();
+    let after = images::page_images(&doc, 0).unwrap();
+    assert!(close(after[0].rect, [55.0, 70.0, 115.0, 100.0]));
+    assert_eq!(after[1].rect, images[1].rect);
+    assert_eq!(*doc.get(artwork), *original_form);
+    assert_eq!(page_content_bytes(&doc, 1), source_page);
+}
+
+#[test]
+fn group_moves_preserve_encoded_glyphs_and_refuse_vertical_cmaps() {
+    let mut doc = text_page("BT /F1 12 Tf 40 400 Td <004100420043> Tj ET");
+    let mut font = Dict::from_iter([
+        (b"Type".to_vec(), Object::name("Font")),
+        (b"Subtype".to_vec(), Object::name("Type0")),
+        (b"BaseFont".to_vec(), Object::name("SyntheticCID")),
+        (b"Encoding".to_vec(), Object::name("Identity-H")),
+    ]);
+    let unicode = doc.add(Object::Stream(Stream::flate(
+        Dict::new(),
+        b"1 begincodespacerange <0000> <ffff> endcodespacerange 3 beginbfchar <0041> <0041> <0042> <0042> <0043> <0043> endbfchar",
+    )));
+    font.set(b"ToUnicode".to_vec(), Object::Ref(unicode));
+    font.set(
+        b"DescendantFonts".to_vec(),
+        Object::Array(vec![Object::Dict(Dict::from_iter([(b"Subtype".to_vec(), Object::name("CIDFontType2")), (b"DW".to_vec(), Object::Int(600))]))]),
+    );
+    // No external font asset: this synthetic font is enough to exercise raw CID bytes.
+    let p = pdfcraft_model::pages(&doc)[0].obj;
+    let mut resources = Dict::new();
+    let mut fonts = Dict::new();
+    fonts.set(b"F1".to_vec(), Object::Dict(font.clone()));
+    resources.set(b"Font".to_vec(), Object::Dict(fonts));
+    doc.update_dict(p, |d| d.set(b"Resources".to_vec(), Object::Dict(resources.clone()))).unwrap();
+    let original = text::text_lines(&doc, 0).unwrap();
+    assert!(!original.is_empty());
+    move_objects(&mut doc, 0, &[ObjectTarget { kind: ObjectKind::Text, index: 0 }], [25.0, 15.0]).unwrap();
+    let encoded =
+        |doc: &Document| pdfcraft_content::parse(&page_content_bytes(doc, 0)).ops.into_iter().find(|o| o.is("Tj")).unwrap().operands[0].clone();
+    assert_eq!(encoded(&doc).as_string().unwrap().bytes, [0, 65, 0, 66, 0, 67]);
+    let after = text::text_lines(&doc, 0).unwrap();
+    assert_eq!(original[0].text, after[0].text);
+    for encoding in [
+        Object::name("Identity-V"),
+        Object::Stream(Stream::flate(Dict::new(), b"/WMode 1 def")),
+        Object::Stream(Stream::flate(Dict::from_iter([(b"WMode".to_vec(), Object::Int(1))]), b"")),
+    ] {
+        let mut f = font.clone();
+        f.set(b"Encoding".to_vec(), encoding);
+        let mut fonts = Dict::new();
+        fonts.set(b"F1".to_vec(), Object::Dict(f));
+        resources.set(b"Font".to_vec(), Object::Dict(fonts));
+        doc.update_dict(p, |d| d.set(b"Resources".to_vec(), Object::Dict(resources.clone()))).unwrap();
+        let before = pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap();
+        assert!(move_objects(&mut doc, 0, &[ObjectTarget { kind: ObjectKind::Text, index: 0 }], [5.0, 5.0]).is_err());
+        assert_eq!(pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap(), before);
+    }
+}
+
+#[test]
+fn moving_added_content_after_page_rotation_preserves_streams_and_resources() {
+    let mut doc = text_page("BT /F1 12 Tf 40 400 Td (Native) Tj ET");
+    added::add_content(
+        &mut doc,
+        0,
+        &Content::Text(added::AddedText { text: "Added label".into(), rect: [50.0, 300.0, 200.0, 330.0], ..Default::default() }),
+    )
+    .unwrap();
+    let p = pdfcraft_model::pages(&doc)[0].obj;
+    let resources = pdfcraft_model::pages(&doc)[0].dict.get(b"Resources").cloned();
+    let item = added::list_added(&doc)[0].clone();
+    let source = stream_bytes(&doc, &Object::Ref(item.obj)).unwrap();
+    let content_after_cm = |bytes: &[u8]| {
+        let ops = pdfcraft_content::parse(bytes).ops;
+        bytes[ops[1].span.end..].to_vec()
+    };
+    for rotation in [90, 180, 270, 0] {
+        doc.update_dict(p, |d| d.set(b"Rotate".to_vec(), Object::Int(rotation))).unwrap();
+        let before_lines = text::text_lines(&doc, 0).unwrap();
+        let before_objects = editable_objects(&doc, 0).unwrap();
+        let a = before_objects.iter().find(|o| o.target.kind == ObjectKind::Added).unwrap();
+        // The logical added box must contain the actual source glyph geometry after rotation.
+        let label = before_lines.iter().find(|l| l.text == "Added label").unwrap();
+        assert!(
+            label.rect[0] >= a.rect[0] - 0.01
+                && label.rect[2] <= a.rect[2] + 0.01
+                && label.rect[1] >= a.rect[1] - 0.01
+                && label.rect[3] <= a.rect[3] + 0.01
+        );
+        move_objects(&mut doc, 0, &[a.target], [13.0, -17.0]).unwrap();
+        let after_lines = text::text_lines(&doc, 0).unwrap();
+        for (old, new) in before_lines.iter().zip(&after_lines) {
+            let delta = if old.text == "Added label" { [13.0, -17.0] } else { [0.0, 0.0] };
+            assert_eq!(old.text, new.text);
+            assert!(close(new.rect, [old.rect[0] + delta[0], old.rect[1] + delta[1], old.rect[2] + delta[0], old.rect[3] + delta[1]]));
+        }
+        let current = added::list_added(&doc)[0].clone();
+        let bytes = stream_bytes(&doc, &Object::Ref(current.obj)).unwrap();
+        assert_eq!(content_after_cm(&bytes), content_after_cm(&source), "all drawing bytes after the placement, including glyphs, remain identical");
+        assert_eq!(pdfcraft_model::pages(&doc)[0].dict.get(b"Resources").cloned(), resources);
+        doc = reopen(&doc);
+    }
+}
+
+#[test]
+fn group_moves_of_shared_added_streams_change_only_the_selected_page() {
+    let mut doc = fixture();
+    added::add_content(
+        &mut doc,
+        0,
+        &Content::Text(added::AddedText { text: "Shared added label".into(), rect: [40.0, 400.0, 240.0, 420.0], ..Default::default() }),
+    )
+    .unwrap();
+    let pages = pdfcraft_model::pages(&doc);
+    let contents = pages[0].dict.get(b"Contents").cloned().unwrap();
+    doc.update_dict(pages[1].obj, |d| d.set(b"Contents".to_vec(), contents)).unwrap();
+    let doc = reopen(&doc);
+    let mut doc = doc;
+    let other = page_content_bytes(&doc, 1);
+    let before = editable_objects(&doc, 0).unwrap();
+    let target = before.iter().find(|o| o.target.kind == ObjectKind::Added).unwrap().target;
+    move_objects(&mut doc, 0, &[target], [15.0, -20.0]).unwrap();
+    assert_eq!(page_content_bytes(&doc, 1), other, "a shared stream is copied on write");
+    assert_ne!(added::list_added(&doc).iter().find(|a| a.page == 0).unwrap().obj, added::list_added(&doc).iter().find(|a| a.page == 1).unwrap().obj);
+}
+
+#[test]
+fn group_moves_handle_added_content_under_inherited_graphics_state() {
+    let mut doc = text_page("2 0 0 2 10 20 cm BT /F1 12 Tf 40 250 Td (Native) Tj ET");
+    added::add_content(
+        &mut doc,
+        0,
+        &Content::Text(added::AddedText { text: "Added label".into(), rect: [50.0, 100.0, 200.0, 130.0], ..Default::default() }),
+    )
+    .unwrap();
+    let before = text::text_lines(&doc, 0).unwrap();
+    let target = editable_objects(&doc, 0).unwrap().iter().find(|o| o.target.kind == ObjectKind::Added).unwrap().target;
+    move_objects(&mut doc, 0, &[target], [30.0, -20.0]).unwrap();
+    let after = text::text_lines(&doc, 0).unwrap();
+    for (old, new) in before.iter().zip(&after) {
+        let delta = if old.text == "Added label" { [30.0, -20.0] } else { [0.0, 0.0] };
+        assert!(close(new.rect, [old.rect[0] + delta[0], old.rect[1] + delta[1], old.rect[2] + delta[0], old.rect[3] + delta[1]]));
+    }
+}
+
+#[test]
+fn group_selection_refuses_incomplete_content_and_resource_budget_overruns() {
+    for data in [
+        format!("{} BT /F1 12 Tf 40 400 Td (Target) Tj ET", "q ".repeat(1025)),
+        format!("{} BT /F1 12 Tf 40 400 Td (Target) Tj ET", "n ".repeat(100001)),
+    ] {
+        let mut doc = text_page(&data);
+        let before = pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap();
+        assert!(editable_objects(&doc, 0).is_err());
+        assert!(move_objects(&mut doc, 0, &[ObjectTarget { kind: ObjectKind::Text, index: 0 }], [10.0, 10.0]).is_err());
+        assert_eq!(pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap(), before);
+    }
+    let mut doc = text_page("BT /F1 12 Tf 40 400 Td (Target) Tj ET");
+    let page = pdfcraft_model::pages(&doc)[0].obj;
+    doc.update_dict(page, |d| d.set(b"Contents".to_vec(), Object::Ref(pdfcraft_cos::ObjRef::new(999999, 0)))).unwrap();
+    assert!(editable_objects(&doc, 0).is_err(), "a missing stream cannot produce a partial inventory");
+    let mut filter = Dict::new();
+    filter.set(b"Filter".to_vec(), Object::name("NotAFilter"));
+    let broken = doc.add(Object::Stream(Stream::from_raw(filter, vec![1, 2, 3])));
+    doc.update_dict(page, |d| d.set(b"Contents".to_vec(), Object::Ref(broken))).unwrap();
+    assert!(editable_objects(&doc, 0).is_err(), "an undecodable stream is refused");
+}
+
+#[test]
+fn group_move_budget_refusals_keep_the_original_page_selectable() {
+    let text = text_page(&format!("{} BT /F1 12 Tf 40 400 Td (Target) Tj ET", "n ".repeat(99_995)));
+    assert_eq!(pdfcraft_content::parse(&page_content_bytes(&text, 0)).ops.len(), 100_000);
+    let mut image = image_page();
+    let page = pdfcraft_model::pages(&image)[0].obj;
+    let bytes = format!("{} /Im0 Do {}", "q ".repeat(1024), "Q ".repeat(1024));
+    let content = image.add(Object::Stream(Stream::flate(Dict::new(), bytes.as_bytes())));
+    image.update_dict(page, |d| d.set(b"Contents".to_vec(), Object::Ref(content))).unwrap();
+    for mut doc in [text, image] {
+        let objects = editable_objects(&doc, 0).unwrap();
+        assert_eq!(objects.len(), 1);
+        let before = pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap();
+        let error = move_objects(&mut doc, 0, &[objects[0].target], [10.0, 5.0]).unwrap_err();
+        assert!(error.to_string().contains("too many content operations") || error.to_string().contains("nested too deeply"), "{error}");
+        assert_eq!(pdfcraft_cos::write_full(&doc, &SaveOptions::default()).unwrap(), before);
+        assert_eq!(editable_objects(&doc, 0).unwrap(), objects, "refusal retains a usable inventory");
+    }
+}
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index 3168db637..2d1b07f1f 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -148,6 +148,7 @@ struct Ts {
     scale: f64,
     leading: f64,
     rise: f64,
+    render_mode: i64,
 }
 
 fn content_streams(doc: &Document, page: &Dict) -> Vec<(Object, Vec<u8>)> {
@@ -175,7 +176,7 @@ fn content_streams(doc: &Document, page: &Dict) -> Vec<(Object, Vec<u8>)> {
 /// between any two tokens (ISO 32000-2 §7.8.2), so an operator's operands can end one piece and
 /// its keyword start the next; removing or replacing it rewrites every piece it spans. Returns
 /// each piece's new bytes.
-fn splice(pieces: &Pieces, ops: &[Op], mut edit: impl FnMut(usize) -> (Vec<Op>, bool)) -> Vec<Vec<u8>> {
+pub(crate) fn splice(pieces: &Pieces, ops: &[Op], mut edit: impl FnMut(usize) -> (Vec<Op>, bool)) -> Vec<Vec<u8>> {
     let data = pieces.data();
     let mut edits = Vec::new();
     for (i, op) in ops.iter().enumerate() {
@@ -198,7 +199,7 @@ fn splice(pieces: &Pieces, ops: &[Op], mut edit: impl FnMut(usize) -> (Vec<Op>,
 
 /// The page's `/Contents` after a [`splice`]: pieces whose bytes changed become new streams
 /// (keeping their dictionaries), the others stay as they were.
-fn rewritten_contents(doc: &mut Document, streams: &[(Object, Vec<u8>)], new: Vec<Vec<u8>>) -> Object {
+pub(crate) fn rewritten_contents(doc: &mut Document, streams: &[(Object, Vec<u8>)], new: Vec<Vec<u8>>) -> Object {
     let mut contents: Vec<Object> = Vec::with_capacity(streams.len());
     for ((obj, old), data) in streams.iter().zip(new) {
         if *old == data {
@@ -290,6 +291,7 @@ impl Carry {
             scale: 1.0,
             leading: 0.0,
             rise: 0.0,
+            render_mode: 0,
         };
         Carry { ts, stack: Vec::new() }
     }
@@ -356,6 +358,7 @@ fn interpret(
             b"Tz" => ts.scale = op.num(0).unwrap_or(100.0) / 100.0,
             b"TL" => ts.leading = op.num(0).unwrap_or(0.0),
             b"Ts" => ts.rise = op.num(0).unwrap_or(0.0),
+            b"Tr" => ts.render_mode = op.operands.first().and_then(Object::as_int).unwrap_or(-1),
             b"Do" => {
                 if let (Some(list), Some(name)) = (invoked.as_deref_mut(), op.name(0)) {
                     list.push((i, name.to_vec(), ts.clone()));
@@ -405,7 +408,7 @@ fn interpret(
                         Object::String(s) => {
                             for (code, len) in m.codes(&s.bytes) {
                                 match m.text_of(code) {
-                                    Some(t) => text.push_str(t),
+                                    Some(t) => text.push_str(&t),
                                     None => decodable = false,
                                 }
                                 let w = m.width(code) * ts.size + ts.char_spacing + if m.is_space(code, len) { ts.word_spacing } else { 0.0 };
@@ -437,6 +440,11 @@ fn interpret(
                     .iter()
                     .fold([f64::MAX, f64::MAX, f64::MIN, f64::MIN], |b, p| [b[0].min(p.0), b[1].min(p.1), b[2].max(p.0), b[3].max(p.1)]);
                 let size_user = (trm0.0[2].powi(2) + trm0.0[3].powi(2)).sqrt() * ts.size;
+                // A numeric-only TJ adjusts the current text matrix but paints no glyphs.
+                // It must not create a phantom editable line or enlarge its neighbours' boxes.
+                if !pieces.iter().any(|p| matches!(p, Object::String(s) if !s.bytes.is_empty())) {
+                    continue;
+                }
                 out.push(Shown {
                     op: i,
                     tm: Matrix([tm.0[0], tm.0[1], tm.0[2], tm.0[3], tm.0[4] - x_text * tm.0[0], tm.0[5] - x_text * tm.0[1]]),
@@ -1366,6 +1374,173 @@ pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option
     Ok(LineEdit { substituted })
 }
 
+/// Existing paragraph indexes, excluding streams owned by an added-content item.
+pub(crate) fn selectable_blocks(
+    doc: &Document,
+    page: usize,
+    excluded: &std::collections::BTreeSet<pdfcraft_cos::ObjRef>,
+) -> Result<Vec<(usize, TextBlock)>, EditError> {
+    let p = page_dict(doc, page)?;
+    let streams = content_streams(doc, &p.dict);
+    let lines = text_lines(doc, page)?;
+    Ok(group_blocks(&lines)
+        .into_iter()
+        .enumerate()
+        .filter(|(_, b)| {
+            !b.lines
+                .iter()
+                .filter_map(|i| lines.get(*i))
+                .any(|l| streams.get(l.stream).and_then(|(o, _)| o.as_ref()).is_some_and(|r| excluded.contains(&r)))
+        })
+        .collect())
+}
+
+/// Detect vertical CMaps before moving horizontal text. A broken/cyclic embedded CMap is
+/// refused rather than guessing which direction TJ advances its text matrix.
+fn vertical_encoding(doc: &Document, font: &Dict) -> Result<bool, EditError> {
+    if font.name(b"Subtype") != Some(b"Type0") {
+        return Ok(false);
+    }
+    let mut next = font.get(b"Encoding").cloned();
+    let mut seen = std::collections::BTreeSet::new();
+    for _ in 0..8 {
+        let Some(o) = next.take() else { return Ok(false) };
+        if let Some(r) = o.as_ref()
+            && !seen.insert(r)
+        {
+            return Err(EditError::Invalid("the text encoding is cyclic".into()));
+        }
+        match &*doc.resolve(&o) {
+            Object::Name(n) => return Ok(n.ends_with(b"-V")),
+            Object::Stream(stream) => {
+                if let Some(mode) = stream.dict.get(b"WMode") {
+                    match mode.as_int() {
+                        Some(1) => return Ok(true),
+                        Some(0) => {}
+                        _ => return Err(EditError::Invalid("the text writing mode is invalid".into())),
+                    }
+                }
+                let bytes = stream
+                    .decoded_within(8 * 1024 * 1024)
+                    .map_err(|_| EditError::Invalid("the text encoding cannot be decoded within its size limit".into()))?;
+                let ops = parse(&bytes).ops;
+                if let Some(mode) = ops.iter().rev().find(|op| op.is("def") && op.name(0) == Some(b"WMode")) {
+                    return match mode.num(1) {
+                        Some(0.0) => Ok(false),
+                        Some(1.0) => Ok(true),
+                        _ => Err(EditError::Invalid("the text writing mode is invalid".into())),
+                    };
+                }
+                next = stream
+                    .dict
+                    .get(b"UseCMap")
+                    .cloned()
+                    .or_else(|| ops.iter().rev().find(|op| op.is("usecmap")).and_then(|op| op.operands.first().cloned()));
+            }
+            _ => return Err(EditError::Invalid("the text encoding is invalid".into())),
+        }
+    }
+    Err(EditError::Invalid("the text encoding is nested too deeply".into()))
+}
+
+/// Translate paragraphs together without re-encoding glyphs, changing fonts or reflowing.
+/// Numeric TJ offsets and text rise temporarily move each selected show operation, then
+/// restore both advances and rise. The PDF reader advances the original glyph bytes itself:
+/// no approximate font metrics are used to position following, unselected text (§9.4.4).
+pub(crate) fn translate_blocks(doc: &mut Document, page: usize, indexes: &[usize], offset: [f64; 2]) -> Result<(), EditError> {
+    if indexes.is_empty() {
+        return Ok(());
+    }
+    let p = page_dict(doc, page)?;
+    let streams = content_streams(doc, &p.dict);
+    let lines = text_lines(doc, page)?;
+    let blocks = group_blocks(&lines);
+    let mut selected = std::collections::BTreeSet::new();
+    for index in indexes {
+        let b = blocks.get(*index).ok_or_else(|| EditError::Invalid("a selected paragraph no longer exists".into()))?;
+        for line in &b.lines {
+            let l = lines.get(*line).ok_or_else(|| EditError::Invalid("a selected text line no longer exists".into()))?;
+            selected.extend(l.ops.iter().copied());
+        }
+    }
+    let res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let fonts = res.get(b"Font").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let pieces = Pieces::join(&streams.iter().map(|(_, d)| d.as_slice()).collect::<Vec<_>>());
+    let ops = pieces.parse().ops;
+    let shown = interpret(doc, &ops, &fonts, &mut HashMap::new(), &mut Carry::new(), None);
+    let mut patches = HashMap::new();
+    // Keep full precision: a tiny rounded text-space change can be magnified by a CTM,
+    // and restoring rise/spacing must not alter following unselected text.
+    let n = Object::Real;
+    for s in shown.into_iter().filter(|s| selected.contains(&s.op)) {
+        if !(0..=3).contains(&s.state.render_mode) {
+            return Err(EditError::Invalid("text used as a clipping path cannot be moved in a group".into()));
+        }
+        let font = fonts
+            .get(&s.font)
+            .map(|f| doc.resolve(f))
+            .and_then(|f| f.as_dict().cloned())
+            .ok_or_else(|| EditError::Invalid("a selected paragraph has no font".into()))?;
+        if vertical_encoding(doc, &font)? {
+            return Err(EditError::Invalid("vertical text cannot be moved in a group".into()));
+        }
+        let inverse = s.tm.then(&s.state.ctm).invert().ok_or_else(|| EditError::Invalid("a selected paragraph has no area".into()))?;
+        let [a, b, c, d, _, _] = inverse.0;
+        let (dx, dy) = (a * offset[0] + c * offset[1], b * offset[0] + d * offset[1]);
+        let denominator = s.state.size * s.state.scale;
+        let shift = if dx == 0.0 {
+            0.0
+        } else if denominator.abs() > 1e-12 {
+            -1000.0 * dx / denominator
+        } else {
+            return Err(EditError::Invalid("a selected paragraph has no horizontal advance".into()));
+        };
+        let rise = s.state.rise + dy;
+        if ![shift, rise, dx, dy].iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+            return Err(EditError::Invalid("the paragraph move is too large".into()));
+        }
+        let original = ops.get(s.op).ok_or_else(|| EditError::Invalid("a selected text operation is missing".into()))?;
+        let mut replacement = Vec::new();
+        let show = if original.is("'") || original.is("\"") {
+            if original.is("\"") {
+                let spacing = original
+                    .operands
+                    .get(..2)
+                    .filter(|a| a.iter().all(|o| o.as_f64().is_some()))
+                    .ok_or_else(|| EditError::Invalid("a text operation has invalid spacing".into()))?;
+                for (operator, operand) in ["Tw", "Tc"].into_iter().zip(spacing) {
+                    replacement.push(Op::new(operator, vec![operand.clone()]));
+                }
+            }
+            replacement.push(Op::new("T*", vec![]));
+            Op::new("Tj", vec![original.operands.last().cloned().ok_or_else(|| EditError::Invalid("a text operation has no string".into()))?])
+        } else {
+            original.clone()
+        };
+        if dy != 0.0 {
+            replacement.push(Op::new("Ts", vec![n(rise)]));
+        }
+        if shift != 0.0 {
+            replacement.push(Op::new("TJ", vec![Object::Array(vec![n(shift)])]));
+        }
+        replacement.push(show);
+        if shift != 0.0 {
+            replacement.push(Op::new("TJ", vec![Object::Array(vec![n(-shift)])]));
+        }
+        if dy != 0.0 {
+            replacement.push(Op::new("Ts", vec![n(s.state.rise)]));
+        }
+        patches.insert(s.op, replacement);
+    }
+    if patches.len() != selected.len() {
+        return Err(EditError::Invalid("a selected text operation cannot be moved".into()));
+    }
+    let data = splice(&pieces, &ops, |i| patches.remove(&i).map_or((Vec::new(), true), |v| (v, false)));
+    let contents = rewritten_contents(doc, &streams, data);
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index 6489d80fd..1f68eeb1f 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -201,6 +201,10 @@ pub const COMMANDS: &[CommandSpec] = &[
     // View menu (where it would show twice). The palette and ⌘3 still run it.
     c("view.fit_visible", "Fit visible", None, Some(Shortcut::cmd("3")), Document, "scan"),
     c("view.marquee_zoom", "Marquee zoom", VIEW, None, Document, "zoom-in"),
+    // Acrobat's column select: drag a rectangle and select only the text inside it. Alt/Option-
+    // drag with the Select tool does the same; this is the way in where the desktop takes
+    // Alt-drag for moving windows (several Linux window managers).
+    c("edit.column_select", "Column select", EDIT, None, Document, "text-select"),
     c("edit.snapshot", "Take a snapshot", EDIT, None, Document, "camera"),
     c("view.full_screen", "Full screen mode", VIEW, Some(Shortcut::cmd("L")), Document, "maximize"),
     c("view.read_mode", "Read mode", VIEW, Some(Shortcut { command: true, shift: false, mac_ctrl: true, key: "H" }), Document, "book-open"),
diff --git a/crates/engine/src/dates.rs b/crates/engine/src/dates.rs
index 8e7ceb420..d12e812b3 100644
--- a/crates/engine/src/dates.rs
+++ b/crates/engine/src/dates.rs
@@ -56,7 +56,7 @@ const AR_DAYS: [&str; 7] = ["الأحد", "الاثنين", "الثلاثاء",
 
 /// The languages month and weekday names can be written in (Preferences ▸ Date format ▸ Language):
 /// the interface languages, in the same order and with the same names.
-pub const DATE_LANGUAGES: [DateLanguage; 16] = [
+pub const DATE_LANGUAGES: [DateLanguage; 17] = [
     DateLanguage {
         code: "en",
         name: "English",
@@ -241,6 +241,28 @@ pub const DATE_LANGUAGES: [DateLanguage; 16] = [
         days: AR_DAYS,
         days_short: AR_DAYS,
     },
+    DateLanguage {
+        code: "pl",
+        name: "Polski",
+        months: ["styczeń", "luty", "marzec", "kwiecień", "maj", "czerwiec", "lipiec", "sierpień", "wrzesień", "październik", "listopad", "grudzień"],
+        months_with_day: Some([
+            "stycznia",
+            "lutego",
+            "marca",
+            "kwietnia",
+            "maja",
+            "czerwca",
+            "lipca",
+            "sierpnia",
+            "września",
+            "października",
+            "listopada",
+            "grudnia",
+        ]),
+        months_short: ["sty", "lut", "mar", "kwi", "maj", "cze", "lip", "sie", "wrz", "paź", "lis", "gru"],
+        days: ["niedziela", "poniedziałek", "wtorek", "środa", "czwartek", "piątek", "sobota"],
+        days_short: ["niedz.", "pon.", "wt.", "śr.", "czw.", "pt.", "sob."],
+    },
 ];
 
 /// The date language for `code` (any case), or `None` when there's none.
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 335528745..1c059a22a 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -35,7 +35,7 @@ pub use pdfcraft_organize::LabelStyle;
 pub use pdfcraft_organize::view::{InitialView, Layout as InitialLayout, Magnification, Navigation};
 
 pub use pdfcraft_cos::Algorithm;
-pub use pdfcraft_create::{CONVERTIBLE, ImageResolution, SourceKind, source_kind};
+pub use pdfcraft_create::{CONVERTIBLE, ImageResolution, SourceKind, decode_text, source_kind};
 pub use pdfcraft_edit::{
     Added, AddedImage, AddedText, Align as TextAlign, Background, Content as AddedContent, Family as FontFamily, HeaderFooter, MarkKind, Watermark,
 };
@@ -50,6 +50,8 @@ pub use pdfcraft_edit::{BlockStyle, PageImage, TextBlock, TextLine, first_undraw
 pub use pdfcraft_measure as measure;
 pub use pdfcraft_xfa::Report as XfaLayout;
 
+pub use pdfcraft_edit::{EditableObject, MAX_MOVE_OBJECTS, ObjectKind, ObjectTarget};
+
 /// A change to an existing page image.
 #[derive(Clone, Debug, PartialEq)]
 pub enum ImageEdit {
@@ -184,6 +186,7 @@ fn scope_of(edit: &Edit) -> Scope {
         | Edit::MoveAnnotation { .. }
         | Edit::ResizeAnnotation { .. }
         | Edit::StyleAnnotation { .. }
+        | Edit::FillAnnotation { .. }
         | Edit::SetAnnotationInfo { .. } => Scope::Comments,
         Edit::SetFieldValue { .. } | Edit::ResetForm { .. } | Edit::SetFieldImage { .. } | Edit::ApplyScriptChanges { .. } => Scope::Form,
         Edit::Batch { edits, .. } => {
@@ -272,6 +275,32 @@ impl Document {
         self.editor.as_ref().and_then(|e| pdfcraft_edit::page_images(&e.cos, page).ok()).unwrap_or_default()
     }
 
+    /// Mixed editable objects on one page. Source inventories are zero-based and added items
+    /// appear once. Rectangles are user-space points, independent of the viewer's zoom.
+    pub fn editable_objects(&self, page: usize) -> Result<Vec<EditableObject>, String> {
+        let editor = self.editor.as_ref().ok_or("the document can't be read")?;
+        pdfcraft_edit::editable_objects(&editor.cos, page).map_err(|e| e.to_string())
+    }
+
+    /// Displayed top-left-origin motion to a user-space vector. Use the linear map only,
+    /// so even a large crop-box origin cannot erase a small drag by cancellation.
+    pub fn object_move_offset(&self, page: usize, delta: [f64; 2]) -> Result<[f64; 2], String> {
+        let p = self.info.pages.get(page).ok_or("the page no longer exists")?;
+        let [x0, y0, x1, y1] = p.crop.map(f64::from);
+        let (a, b) = (delta[0] / f64::from(p.width.max(1e-3)), delta[1] / f64::from(p.height.max(1e-3)));
+        let (u, v) = match p.rotation {
+            90 => (b, -a),
+            180 => (-a, -b),
+            270 => (-b, a),
+            _ => (a, b),
+        };
+        let offset = [u * (x1 - x0), -v * (y1 - y0)];
+        if !offset.iter().all(|v| v.is_finite()) {
+            return Err("the move must be finite and non-zero".into());
+        }
+        Ok(offset)
+    }
+
     /// Save image as: image `index` on `page` as a file (extension, bytes).
     pub fn page_image_file(&self, page: usize, index: usize) -> Result<(&'static str, Vec<u8>), String> {
         let editor = self.editor.as_ref().ok_or("the document can't be read")?;
@@ -555,6 +584,51 @@ fn apply_layer_state(layers: &mut [Layer], groups: &[Vec<(u32, u16)>], changes:
 /// A file to combine: its name (the bookmark title), bytes, and page range (`None`: all).
 pub type CombineSource = (String, Arc<Vec<u8>>, Option<String>);
 
+/// A bookmark as the bookmark list shows it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct BookmarkRow {
+    /// Child indices from the top level, 0-based, as the edit functions take them.
+    pub path: Vec<usize>,
+    pub title: String,
+    /// Shown expanded (a positive `/Count`).
+    pub open: bool,
+    /// The 0-based page it goes to.
+    pub page: Option<usize>,
+}
+
+/// One page of the bookmark list, in outline order.
+#[derive(Clone, Debug, PartialEq)]
+pub struct BookmarkPage {
+    pub rows: Vec<BookmarkRow>,
+    /// Where the next page starts, or `None` at the end.
+    pub next: Option<usize>,
+    /// Set only when the document's structure could not be read for editing: its listing then
+    /// comes from the viewer's copy of the outline, which is shorter than the file's.
+    pub truncated: bool,
+}
+
+/// The rows of a viewer outline, in outline order, with their paths.
+fn outline_rows(items: &[pdfcraft_render::OutlineItem]) -> Vec<BookmarkRow> {
+    let mut rows = Vec::new();
+    // One entry per open level: its items, and how many of them have been listed.
+    let mut levels: Vec<(&[pdfcraft_render::OutlineItem], usize)> = vec![(items, 0)];
+    while let Some(&(list, next)) = levels.last() {
+        let Some(item) = list.get(next) else {
+            levels.pop();
+            continue;
+        };
+        if let Some(top) = levels.last_mut() {
+            top.1 += 1;
+        }
+        let path: Vec<usize> = levels.iter().map(|(_, listed)| listed.saturating_sub(1)).collect();
+        rows.push(BookmarkRow { path, title: item.title.clone(), open: item.open, page: item.page });
+        if !item.children.is_empty() {
+            levels.push((&item.children, 0));
+        }
+    }
+    rows
+}
+
 /// A document's working file captured for crash recovery.
 #[derive(Clone, Debug)]
 pub struct RecoverySnapshot {
@@ -879,6 +953,12 @@ pub enum Edit {
         /// Line or polyline: two endings. Callout: one. `None` leaves `/LE` unchanged.
         endings: Option<Vec<pdfcraft_annot::LineEnding>>,
     },
+    /// Fill a rectangle, oval or polygon comment, or remove its fill (`None`).
+    FillAnnotation {
+        page: usize,
+        index: usize,
+        fill: Option<Rgb>,
+    },
     /// Comment properties ▸ General / note icon.
     SetAnnotationInfo {
         page: usize,
@@ -987,6 +1067,13 @@ pub enum Edit {
         index: usize,
         change: ImageEdit,
     },
+    /// Move mixed existing and added objects together. References resolve before any change;
+    /// offset is a user-space vector. No retyping, reflow or font substitution is involved.
+    MoveObjects {
+        page: usize,
+        objects: Vec<ObjectTarget>,
+        offset: [f64; 2],
+    },
     /// Edit text in a paragraph box: replace paragraph `block` (from `Document::text_blocks`),
     /// rewrapped to the box's width.
     EditTextBlock {
@@ -1156,7 +1243,7 @@ impl Edit {
             Edit::LockAnnotation { .. } => "Unlock comment".into(),
             Edit::MoveAnnotation { .. } => "Move comment".into(),
             Edit::ResizeAnnotation { .. } => "Resize comment".into(),
-            Edit::StyleAnnotation { .. } | Edit::SetAnnotationInfo { .. } => "Change comment properties".into(),
+            Edit::StyleAnnotation { .. } | Edit::FillAnnotation { .. } | Edit::SetAnnotationInfo { .. } => "Change comment properties".into(),
             Edit::SetFieldValue { name, .. } => format!("Fill in {name}"),
             Edit::SetFieldImage { name, .. } => format!("Set the image of {name}"),
             Edit::ResetForm { .. } => "Clear form".into(),
@@ -1176,6 +1263,7 @@ impl Edit {
             Edit::SetDocumentScript { script: None, .. } => "Delete document JavaScript".into(),
             Edit::SetDocumentScript { .. } => "Edit document JavaScript".into(),
             Edit::EditTextLine { .. } | Edit::EditTextBlock { .. } => "Edit text".into(),
+            Edit::MoveObjects { objects, .. } => plural("Move object", objects.len()),
             Edit::EditPageImage { change, .. } => match change {
                 ImageEdit::Move(_) => "Move image".into(),
                 ImageEdit::Rotate(_) => "Rotate image".into(),
@@ -1295,6 +1383,7 @@ fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Result<(), Ed
         | Edit::MoveAnnotation { .. }
         | Edit::ResizeAnnotation { .. }
         | Edit::StyleAnnotation { .. }
+        | Edit::FillAnnotation { .. }
         | Edit::SetAnnotationInfo { .. }
         | Edit::SetMeasurementScale { .. } => {
             if p.annotate() {
@@ -1327,6 +1416,7 @@ fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Result<(), Ed
         | Edit::AddText { .. }
         | Edit::AddImage { .. }
         | Edit::UpdateContent { .. }
+        | Edit::MoveObjects { .. }
         | Edit::DeleteContent { .. }
         | Edit::ReplaceImage { .. }
         | Edit::ClearRedactions
@@ -1537,6 +1627,7 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
         Edit::StyleAnnotation { page, index, color, opacity, width, endings } => {
             pdfcraft_annot::set_style(doc, *page, *index, *color, *opacity, *width, endings.as_deref(), &cx.meta())?;
         }
+        Edit::FillAnnotation { page, index, fill } => pdfcraft_annot::set_fill(doc, *page, *index, *fill, &cx.meta())?,
         Edit::SetAnnotationInfo { page, index, author, subject, icon } => {
             pdfcraft_annot::set_info(doc, *page, *index, author.as_deref(), subject.as_deref(), *icon, &cx.meta())?;
         }
@@ -1626,6 +1717,7 @@ fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) ->
             };
             pdfcraft_edit::change_image(doc, *page, *index, &c)?;
         }
+        Edit::MoveObjects { page, objects, offset } => pdfcraft_edit::move_objects(doc, *page, objects, *offset)?,
         Edit::EditTextBlock { page, block, text, style } => {
             pdfcraft_edit::rewrite_block(doc, *page, *block, Some(text), style)?;
         }
@@ -1772,6 +1864,7 @@ fn comment_list(doc: &pdfcraft_cos::Document) -> Vec<pdfcraft_render::Annotation
             quads: s.quads,
             locked: s.locked,
             intent: s.intent,
+            fill_sign: s.fill_sign,
         })
         .collect()
 }
@@ -1802,6 +1895,17 @@ fn keys_after(edit: &Edit) -> Option<Keys> {
     }
 }
 
+/// The recovered user password of an R2–R4 file as text for the renderer, which tries a password
+/// as its UTF-8 bytes and then in PDFDocEncoding: UTF-8 bytes (as some writers store passwords
+/// PDFDocEncoding can't hold, such as "şifre") stay UTF-8, and other bytes are read as
+/// PDFDocEncoding, so either way the renderer gets back exactly these bytes.
+fn renderer_password(bytes: &[u8]) -> String {
+    match std::str::from_utf8(bytes) {
+        Ok(text) => text.to_owned(),
+        Err(_) => bytes.iter().map(|b| pdfcraft_cos::pdfdoc_char(*b)).collect(),
+    }
+}
+
 /// The last-resort guard (AGENTS.md §4): run `f`, turning a panic that escapes it into an error
 /// message, so one bad file or edit can't take the app and its other documents down. It is a
 /// safety net for bugs, not a substitute for returning errors.
@@ -1974,9 +2078,14 @@ fn xfa_field_data(doc: &pdfcraft_cos::Document) -> Vec<pdfcraft_xfa::FieldDatum>
 /// be written.
 /// `datasets`: the stream this edit already wrote, replaced in place rather than added again
 /// (and set to the one written).
-fn xfa_sync_datasets(doc: &mut pdfcraft_cos::Document, datasets: &mut Option<pdfcraft_cos::ObjRef>) -> Result<Vec<String>, String> {
+/// `tpl`: the form's parsed template when the document has one cached (else it is parsed).
+fn xfa_sync_datasets(
+    doc: &mut pdfcraft_cos::Document,
+    tpl: Option<&pdfcraft_xfa::model::Template>,
+    datasets: &mut Option<pdfcraft_cos::ObjRef>,
+) -> Result<Vec<String>, String> {
     let data = xfa_field_data(doc);
-    let r = pdfcraft_xfa::write_datasets_reusing(doc, &data, *datasets).map_err(|e| e.to_string())?;
+    let r = pdfcraft_xfa::write_datasets_with(doc, tpl, &data, *datasets).map_err(|e| e.to_string())?;
     if r.stream.is_some() {
         *datasets = r.stream;
     }
@@ -2114,7 +2223,7 @@ impl Session {
                     Ok(Ok(d)) => d.security().and_then(|s| s.recovered_user_password()),
                     _ => None,
                 };
-                let user: String = user.ok_or(OpenError::WrongPassword)?.iter().map(|b| char::from(*b)).collect();
+                let user = renderer_password(&user.ok_or(OpenError::WrongPassword)?);
                 (inspect(bytes.clone(), Some(&user))?, Some(user))
             }
             Err(e) => return Err(e),
@@ -2366,7 +2475,7 @@ impl Session {
         if let Some(tpl) = cx.xfa.clone() {
             if is_xfa && matches!(scope_of(&edit), Scope::Form | Scope::Full) {
                 let datasets = &mut cx.xfa_datasets;
-                let notes = guard(|| xfa_sync_datasets(&mut next, datasets))
+                let notes = guard(|| xfa_sync_datasets(&mut next, Some(&tpl), datasets))
                     .unwrap_or_else(|m| Err(format!("writing the XFA data failed unexpectedly ({m})")))
                     .map_err(EditError::Write)?;
                 cx.xfa_out.errors.extend(notes);
@@ -2398,8 +2507,8 @@ impl Session {
         // XFA forms keep their values in the datasets packet too, for Adobe's viewers.
         let mut xfa_notes = Vec::new();
         if is_xfa && matches!(scope_of(&edit), Scope::Form | Scope::Full) {
-            let datasets = &mut cx.xfa_datasets;
-            xfa_notes = guard(|| xfa_sync_datasets(&mut next, datasets))
+            let (tpl, datasets) = (cx.xfa.as_deref(), &mut cx.xfa_datasets);
+            xfa_notes = guard(|| xfa_sync_datasets(&mut next, tpl, datasets))
                 .unwrap_or_else(|m| Err(format!("writing the XFA data failed unexpectedly ({m})")))
                 .map_err(EditError::Write)?;
         }
@@ -2688,7 +2797,7 @@ impl Session {
         let created = guard(|| match kind {
             SourceKind::Pdf => open_source(name, bytes).map(|_| bytes.clone()),
             SourceKind::Image => self.create_from_images(&[(name.to_string(), bytes.to_vec())]),
-            SourceKind::Text => self.create_from_text(title, &String::from_utf8_lossy(bytes)),
+            SourceKind::Text => self.create_from_text(title, &decode_text(bytes)),
         })
         .map_err(|_| EditError::Source(format!("{name}: the file could not be read")))?;
         Ok((kind, created?))
@@ -2784,6 +2893,50 @@ impl Session {
         self.write_new(&out)
     }
 
+    /// [`Self::combine_unlocked`] where sources with the same `groups` key (by position) are one
+    /// file split into several runs placed apart: each file is opened and copied once, so it keeps
+    /// one bookmark, its links between its own pages, its fields and its attachments whole (see
+    /// `pdfcraft_organize::combine_grouped`). A group's later sources use its first source's bytes
+    /// and password; a source without a key is a file of its own.
+    pub fn combine_grouped(&self, sources: &[CombineSource], groups: &[u64], passwords: &[Option<&str>]) -> Result<Arc<Vec<u8>>, EditError> {
+        // Each file opened once: `file[i]` is source i's place in `docs`.
+        let (mut keys, mut docs, mut file): (Vec<Option<u64>>, Vec<pdfcraft_cos::Document>, Vec<usize>) = (Vec::new(), Vec::new(), Vec::new());
+        for (i, (name, bytes, _)) in sources.iter().enumerate() {
+            let key = groups.get(i).copied();
+            let known = key.and_then(|k| keys.iter().position(|g| *g == Some(k)));
+            let at = match known {
+                Some(at) => at,
+                None => {
+                    docs.push(open_source_with(name, bytes, passwords.get(i).copied().flatten())?);
+                    keys.push(key);
+                    docs.len() - 1
+                }
+            };
+            file.push(at);
+        }
+        let mut pages = Vec::with_capacity(sources.len());
+        for ((name, _, range), at) in sources.iter().zip(&file) {
+            let range = range.as_deref().map(str::trim).filter(|r| !r.is_empty());
+            let Some(d) = docs.get(*at) else { return Err(EditError::Write(format!("{name}: not opened"))) };
+            pages.push(match range {
+                Some(r) => {
+                    let n = pdfcraft_organize::page_count(d)?;
+                    let p = pdfcraft_print::select_pages(n, Some(r), &[], pdfcraft_print::Subset::All, false)
+                        .map_err(|e| EditError::Print(format!("{name}: {e}")))?;
+                    Some(p)
+                }
+                None => None,
+            });
+        }
+        let mut runs: Vec<pdfcraft_organize::Run<'_>> = Vec::with_capacity(sources.len());
+        for (((name, _, _), at), p) in sources.iter().zip(&file).zip(&pages) {
+            let Some(d) = docs.get(*at) else { return Err(EditError::Write(format!("{name}: not opened"))) };
+            runs.push((*at, name.as_str(), d, p.as_deref()));
+        }
+        let out = pdfcraft_organize::combine_grouped(&runs)?;
+        self.write_new(&out)
+    }
+
     /// New PDF bytes containing copies of `pages` of the document (Extract Pages).
     pub fn extract(&self, id: DocId, pages: &[usize]) -> Result<Arc<Vec<u8>>, EditError> {
         let src = self.cos(id)?;
@@ -2876,10 +3029,29 @@ impl Session {
         out
     }
 
+    /// A page of the bookmark list in outline order: up to `limit` bookmarks from position `offset`.
+    /// The document's own structure is read for it, so every bookmark can be reached by paging.
+    pub fn bookmark_page(&self, id: DocId, offset: usize, limit: usize) -> Option<BookmarkPage> {
+        let doc = self.get(id)?;
+        if let Some(editor) = doc.editor.as_ref() {
+            let page = pdfcraft_organize::bookmark_page(&editor.cos, offset, limit);
+            let rows = page.bookmarks.into_iter().map(|b| BookmarkRow { path: b.path, title: b.title, open: b.open, page: b.page }).collect();
+            return Some(BookmarkPage { rows, next: page.next, truncated: false });
+        }
+        let all = outline_rows(&doc.info.outline);
+        let end = offset.saturating_add(limit);
+        let rows = all.iter().skip(offset).take(limit).cloned().collect();
+        Some(BookmarkPage { rows, next: (end < all.len()).then_some(end), truncated: doc.info.outline_more })
+    }
+
     /// Top-level bookmarks as split points: (first page of each part, its bookmark's title).
     pub fn bookmark_splits(&self, id: DocId) -> Vec<(usize, String)> {
         let Some(doc) = self.get(id) else { return Vec::new() };
-        let mut out: Vec<(usize, String)> = doc.info.outline.iter().filter_map(|o| Some((o.page?, o.title.clone()))).collect();
+        let top: Vec<(Option<usize>, String)> = match doc.editor.as_ref() {
+            Some(editor) => pdfcraft_organize::top_level_bookmarks(&editor.cos).into_iter().map(|b| (b.page, b.title)).collect(),
+            None => doc.info.outline.iter().map(|o| (o.page, o.title.clone())).collect(),
+        };
+        let mut out: Vec<(usize, String)> = top.into_iter().filter_map(|(page, title)| Some((page?, title))).collect();
         out.sort_by_key(|x| x.0);
         out.dedup_by_key(|x| x.0);
         out
@@ -2890,6 +3062,8 @@ impl Session {
         let id = self.open(name, None, bytes, None)?;
         if let Some(d) = self.docs.iter_mut().find(|d| d.id == id) {
             d.dirty = true;
+            // Unsaved work with no edit yet still needs its first recovery snapshot.
+            d.generation += 1;
         }
         Ok(id)
     }
@@ -3188,9 +3362,25 @@ pub fn comment_kind(a: &pdfcraft_render::Annotation) -> &str {
 pub fn comment_summary(name: &str, all: &[pdfcraft_render::Annotation], sort: SummarySort) -> String {
     use std::fmt::Write;
     let top: Vec<&pdfcraft_render::Annotation> = all.iter().filter(|a| a.in_reply_to.is_none() && a.state.is_none()).collect();
-    let replies_of = |a: &pdfcraft_render::Annotation| -> Vec<&pdfcraft_render::Annotation> {
-        all.iter().filter(|r| r.state.is_none() && r.in_reply_to.is_some() && r.in_reply_to == a.name && a.name.is_some()).collect()
-    };
+    // Write a comment's replies, indenting each level. A reply to a reply keeps its `/IRT` on the
+    // direct parent, so following one level would leave the deeper replies out of the summary.
+    fn write_replies(out: &mut String, all: &[pdfcraft_render::Annotation], parent: &str, depth: usize) {
+        use std::fmt::Write;
+        if depth > 64 {
+            return;
+        }
+        for r in all.iter().filter(|r| r.state.is_none() && r.in_reply_to.as_deref() == Some(parent)) {
+            let indent = "    ".repeat(depth + 1);
+            let _ =
+                writeln!(out, "{indent}Author: {}  Subject: Reply  Date: {}", r.author.as_deref().unwrap_or(""), r.modified.as_deref().unwrap_or(""));
+            for line in r.contents.as_deref().unwrap_or("").lines() {
+                let _ = writeln!(out, "{indent}{line}");
+            }
+            if let Some(nm) = r.name.as_deref() {
+                write_replies(out, all, nm, depth + 1);
+            }
+        }
+    }
     let mut numbered: Vec<(usize, &pdfcraft_render::Annotation)> = Vec::new();
     let mut last = usize::MAX;
     let mut n = 0;
@@ -3227,11 +3417,8 @@ pub fn comment_summary(name: &str, all: &[pdfcraft_render::Annotation], sort: Su
         if let Some(c) = a.contents.as_deref().filter(|c| !c.is_empty()) {
             let _ = writeln!(out, "{c}");
         }
-        for r in replies_of(a) {
-            let _ = writeln!(out, "    Author: {}  Subject: Reply  Date: {}", r.author.as_deref().unwrap_or(""), r.modified.as_deref().unwrap_or(""));
-            for line in r.contents.as_deref().unwrap_or("").lines() {
-                let _ = writeln!(out, "    {line}");
-            }
+        if let Some(nm) = a.name.as_deref() {
+            write_replies(&mut out, all, nm, 0);
         }
         out.push('\n');
     }
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index e1c57481b..eee3f7ca5 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -465,6 +465,105 @@ fn mixed_files_convert_and_combine_in_order() {
     assert_eq!(outline_titles(&s.get(id).unwrap().info.outline), ["notes→1", "a→2", "scan→3"]);
 }
 
+#[test]
+fn utf16_and_code_page_text_files_convert_to_their_text() {
+    let mut s = Session::new();
+    // Notepad's "Unicode": UTF-16 little endian with a byte order mark.
+    let mut utf16 = vec![0xFF, 0xFE];
+    utf16.extend("Grüße aus Köln".encode_utf16().flat_map(u16::to_le_bytes));
+    let (_, pdf) = s.convert_to_pdf("notes.txt", &Arc::new(utf16)).unwrap();
+    let id = s.open_new("notes.pdf", pdf).unwrap();
+    assert_eq!(page_texts(&s, id), ["Grüße aus Köln"]);
+    // A UTF-8 byte order mark is not text; Windows-1252 bytes are not replacement characters.
+    let (_, pdf) = s.convert_to_pdf("menu.txt", &Arc::new(b"\xEF\xBB\xBFCaf\xC3\xA9".to_vec())).unwrap();
+    let id = s.open_new("menu.pdf", pdf).unwrap();
+    assert_eq!(page_texts(&s, id), ["Café"]);
+    let (_, pdf) = s.convert_to_pdf("old.txt", &Arc::new(b"Cr\xE8me br\xFBl\xE9e".to_vec())).unwrap();
+    let id = s.open_new("old.pdf", pdf).unwrap();
+    assert_eq!(page_texts(&s, id), ["Crème brûlée"]);
+}
+
+#[test]
+fn a_file_split_around_another_combines_in_order_with_one_bookmark() {
+    let mut s = Session::new();
+    let (a, b) = (Arc::new(fixture(3)), Arc::new(fixture(2)));
+    // a's pages 1–2, then b, then a's page 3: one file (group 7) split around another.
+    let sources: Vec<CombineSource> = vec![("a".into(), a.clone(), Some("1-2".into())), ("b".into(), b, None), ("a".into(), a, Some("3".into()))];
+    let combined = s.combine_grouped(&sources, &[7, 9, 7], &[]).unwrap();
+    let id = s.open_new("Combined.pdf", combined).unwrap();
+    assert_eq!(page_texts(&s, id), ["Page 1", "Page 2", "Page 1", "Page 2", "Page 3"]);
+    assert_eq!(outline_titles(&s.get(id).unwrap().info.outline), ["a→1", "b→3"], "one bookmark for a, at its first page");
+    // Without groups each source is a file of its own, as combine_ranges.
+    let (a, b) = (Arc::new(fixture(3)), Arc::new(fixture(2)));
+    let sources: Vec<CombineSource> = vec![("a".into(), a.clone(), Some("1".into())), ("b".into(), b, None), ("a".into(), a, Some("3".into()))];
+    let combined = s.combine_grouped(&sources, &[], &[]).unwrap();
+    let id = s.open_new("Combined 2.pdf", combined).unwrap();
+    assert_eq!(outline_titles(&s.get(id).unwrap().info.outline), ["a→1", "b→2", "a→4"]);
+    // A bad range is refused with the file's name.
+    let bad: Vec<CombineSource> = vec![("a".into(), Arc::new(fixture(1)), Some("9".into()))];
+    assert!(matches!(s.combine_grouped(&bad, &[1], &[]), Err(EditError::Print(e)) if e.starts_with("a:")));
+}
+
+#[test]
+fn a_page_with_a_form_field_shown_twice_keeps_one_field() {
+    // Regression (found by review): the repeated page copied the whole field again, so the
+    // result had two fields named "shared", filled in separately.
+    use pdfcraft_cos::{Dict, Document, Object, PdfString};
+    let mut doc = Document::open(Arc::new(fixture(2))).unwrap();
+    let pages: Vec<_> = pdfcraft_organize::pages(&doc).unwrap().into_iter().map(|p| p.obj).collect();
+    let field = doc.add(Object::Null);
+    let widgets: Vec<_> = pages
+        .iter()
+        .map(|p| {
+            let mut w = Dict::new();
+            w.set(b"Type".to_vec(), Object::name("Annot"));
+            w.set(b"Subtype".to_vec(), Object::name("Widget"));
+            w.set(b"Rect".to_vec(), Object::Array(vec![Object::Int(0), Object::Int(0), Object::Int(100), Object::Int(20)]));
+            w.set(b"Parent".to_vec(), Object::Ref(field));
+            w.set(b"P".to_vec(), Object::Ref(*p));
+            doc.add(w)
+        })
+        .collect();
+    let mut f = Dict::new();
+    f.set(b"FT".to_vec(), Object::name("Tx"));
+    f.set(b"T".to_vec(), Object::String(PdfString::text("shared")));
+    f.set(b"V".to_vec(), Object::String(PdfString::text("Ada")));
+    f.set(b"Kids".to_vec(), Object::Array(widgets.iter().copied().map(Object::Ref).collect()));
+    doc.set(field, Object::Dict(f));
+    for (p, w) in pages.iter().zip(&widgets) {
+        doc.update_dict(*p, |d| d.set(b"Annots".to_vec(), Object::Array(vec![Object::Ref(*w)]))).unwrap();
+    }
+    let mut form = Dict::new();
+    form.set(b"Fields".to_vec(), Object::Array(vec![Object::Ref(field)]));
+    doc.update_dict(doc.root().unwrap(), |d| d.set(b"AcroForm".to_vec(), Object::Dict(form))).unwrap();
+    let bytes = Arc::new(pdfcraft_cos::write_full(&doc, &Default::default()).unwrap());
+    // Pages 1, 2, then page 1 again: one file split around nothing but itself.
+    let s = Session::new();
+    let sources: Vec<CombineSource> = vec![("form".into(), bytes.clone(), Some("1-2".into())), ("form".into(), bytes, Some("1".into()))];
+    let out = s.combine_grouped(&sources, &[1, 1], &[]).unwrap();
+    let mut out = Document::open(out).unwrap();
+    pdfcraft_forms::set_value(&mut out, "shared", &pdfcraft_forms::FieldValue::Text("Grace".into())).unwrap();
+    let fields = pdfcraft_forms::fields(&out);
+    assert!(
+        !fields.is_empty() && fields.iter().all(|f| f.name == "shared" && f.value == ["Grace"]),
+        "one field, one value: {:?}",
+        fields.iter().map(|f| (&f.name, &f.value)).collect::<Vec<_>>()
+    );
+    let catalog = out.get(out.root().unwrap()).as_dict().cloned().unwrap();
+    let form = out.resolve(catalog.get(b"AcroForm").unwrap()).as_dict().cloned().unwrap();
+    let listed = form.get(b"Fields").and_then(|f| f.as_array()).cloned().unwrap();
+    assert_eq!(listed.len(), 1, "the field isn't copied again for the repeated page");
+    // Its widgets: one on each of the three pages, each belonging to its own page.
+    let out_pages: Vec<_> = pdfcraft_organize::pages(&out).unwrap().into_iter().map(|p| p.obj).collect();
+    let kids = out.resolve(&listed[0]).as_dict().and_then(|f| f.get(b"Kids").and_then(|k| k.as_array()).cloned()).unwrap();
+    assert_eq!(kids.len(), 3);
+    let mut on: Vec<_> = kids.iter().map(|k| out.resolve(k).as_dict().and_then(|w| w.reference(b"P")).unwrap()).collect();
+    on.sort();
+    let mut expected = out_pages.clone();
+    expected.sort();
+    assert_eq!(on, expected, "a widget per page, on its own page");
+}
+
 #[test]
 fn files_that_cannot_be_converted_are_refused_clearly() {
     let s = Session::new();
@@ -577,6 +676,19 @@ fn autosave_snapshots_only_changed_documents() {
     assert!(s.autosave_snapshots().is_empty(), "saved documents need no recovery");
 }
 
+#[test]
+fn autosave_snapshots_a_new_unsaved_document_once() {
+    let (mut s, clean) = session_with(1);
+    let id = s.open_new("Untitled.pdf", Arc::new(fixture(1))).unwrap();
+    let snaps = s.autosave_snapshots();
+    assert_eq!(snaps.len(), 1, "the new document is unsaved work");
+    assert_eq!(snaps[0].doc, id);
+    assert!(snaps.iter().all(|x| x.doc != clean), "the clean document stays out");
+    assert!(s.autosave_snapshots().is_empty(), "nothing new since the last snapshot");
+    s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    assert_eq!(s.autosave_snapshots().len(), 1, "a later edit is snapshotted again");
+}
+
 #[test]
 fn recovered_documents_reopen_unsaved_at_their_original_path() {
     let (mut s, id) = session_with(2);
@@ -1540,6 +1652,19 @@ fn comments_lock_take_checkmarks_hide_and_summarize() {
     assert_eq!(comment_summary("x", &[], SummarySort::Page), "Summary of Comments on x\n\nThis document has no comments.\n");
 }
 
+/// #820: the generated summary includes replies to replies, indented one level deeper.
+#[test]
+fn comment_summary_includes_replies_to_replies() {
+    let (mut s, id) = session_with(1);
+    s.apply(id, rect_comment(0, [40.0, 40.0, 90.0, 90.0])).unwrap();
+    s.apply(id, Edit::ReplyToAnnotation { page: 0, index: 0, text: "FIRST_REPLY".into(), author: "A".into() }).unwrap();
+    s.apply(id, Edit::ReplyToAnnotation { page: 0, index: 1, text: "NESTED_REPLY".into(), author: "B".into() }).unwrap();
+    let text = comment_summary("doc.pdf", &s.get(id).unwrap().info.annotations, SummarySort::Page);
+    assert!(text.contains("FIRST_REPLY"), "{text}");
+    assert!(text.contains("NESTED_REPLY"), "replies to replies are summarized: {text}");
+    assert!(text.contains("        NESTED_REPLY"), "the nested reply is indented under its parent: {text}");
+}
+
 #[test]
 fn signing_saving_trusting_and_commenting_afterwards() {
     let p12 = std::fs::read(concat!(env!("CARGO_MANIFEST_DIR"), "/../sign/tests/data/ec-p256.p12")).unwrap();
@@ -1684,6 +1809,24 @@ fn backgrounds_and_watermarks_from_files() {
 
 /// Scan & OCR ▸ Recognize text on a page that is only a picture of text (needs the models:
 /// `cargo xtask models`; skipped without them).
+#[test]
+fn recognize_text_reads_the_euro_sign() {
+    if !ocr::available() {
+        eprintln!("skipped: OCR models not installed");
+        return;
+    }
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let text = s.create_from_text("t", "Total amount due: €250 by Friday").unwrap();
+    let id = s.open("text.pdf", None, text, None).unwrap();
+    let png = export::Exporter::new(s.get(id).unwrap()).png(0, 150.0).unwrap();
+    let scan = s.create_from_images(&[("scan.png".into(), png)]).unwrap();
+    let id = s.open("scan.pdf", None, scan, None).unwrap();
+    s.recognize_text(id, &[], ocr::OcrSettings::default()).unwrap();
+    let text = page_texts(&s, id)[0].clone();
+    // The model was trained with € where the ocrs crate's alphabet has a second E.
+    assert!(text.contains("€250"), "{text}");
+}
+
 #[test]
 fn recognize_text_makes_a_scanned_page_searchable() {
     if !ocr::available() {
@@ -2281,6 +2424,46 @@ fn xfa_scripts_initialize_calculate_validate_toggle_and_add_rows() {
     assert!(!d2.dirty);
 }
 
+/// A repeating table inside an area of a positioned page (as in real Designer forms): every
+/// row is laid out, the values Adobe wrote (under the area's parent: areas are
+/// not data scopes) are read, a FormCalc total over all rows computes, and what is filled here
+/// is written back where Adobe's viewers read it, with no element for the area.
+#[test]
+fn xfa_rows_in_areas_are_laid_out_read_calculated_and_written_where_adobe_binds_them() {
+    let data = "<form><page><table><row><reason>Regular</reason><days>4</days></row><row><reason/><days/></row><row><reason/><days/></row></table><carried>5</carried></page></form>";
+    let bytes = Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::leave_template(data)));
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("leave.pdf", None, bytes, None).expect("opens");
+    let value = |s: &Session, n: &str| {
+        s.get(id).unwrap().form.iter().find(|f| f.name == n).unwrap_or_else(|| panic!("no field {n}")).value.first().cloned().unwrap_or_default()
+    };
+    let names = |s: &Session| s.get(id).unwrap().form.iter().map(|f| f.name.clone()).collect::<Vec<_>>();
+    // Three rows (occur min="3"), not one.
+    assert_eq!(names(&s).iter().filter(|n| n.starts_with("reason")).count(), 3, "{:?}", names(&s));
+    // Adobe's data, bound past the area.
+    assert_eq!((value(&s, "reason"), value(&s, "days"), value(&s, "carried")), ("Regular".into(), "4".into(), "5".into()));
+    // The total walks rows 0 to 2: 5 + 30 - 4.
+    assert_eq!(value(&s, "rest"), "31", "{:?}", s.take_js_output(id));
+    // A second regular row recalculates it.
+    s.apply(id, Edit::SetFieldValue { name: "reason_2".into(), value: FieldValue::Text("Regular".into()) }).unwrap();
+    s.apply(id, Edit::SetFieldValue { name: "days_2".into(), value: FieldValue::Text("2".into()) }).unwrap();
+    assert_eq!(value(&s, "rest"), "29", "{:?}", s.take_js_output(id));
+    assert!(s.take_js_output(id).errors.is_empty());
+    // Written where Adobe reads it: no element for the area, the rows under the table.
+    let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    let d = pdfcraft_xfa::data_of(&cos).unwrap();
+    let path = |som: &str| pdfcraft_xfa::som_to_path(som);
+    assert_eq!(d.count(&path("form[0].page[0]"), "box"), 0, "an element for the area was written");
+    assert_eq!(d.count(&path("form[0].page[0].table[0]"), "row"), 3);
+    assert_eq!(d.text_at(&path("form[0].page[0].table[0].row[1].days[0]")), Some("2"));
+    assert_eq!(d.text_at(&path("form[0].page[0].rest[0]")), Some("29"));
+    // Reopened, the values come back from that data.
+    let mut s2 = Session::new().with_clock(|| 1_700_000_000);
+    let id2 = s2.open("again.pdf", None, s.get(id).unwrap().bytes.clone(), None).expect("reopens");
+    let v2 = |n: &str| s2.get(id2).unwrap().form.iter().find(|f| f.name == n).unwrap().value.first().cloned().unwrap_or_default();
+    assert_eq!((v2("days_2"), v2("rest")), ("2".into(), "29".into()));
+}
+
 #[test]
 fn dynamic_xfa_forms_run_formcalc_scripts() {
     let bytes = Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::formcalc_template()));
@@ -2634,3 +2817,176 @@ fn oversized_exports_clamp_and_report_their_dpi_unless_strict() {
     let err = export::Exporter::from_source(strict).png(0, 600.0).unwrap_err();
     assert!(err.contains("exceeds renderer limits"), "{err}");
 }
+
+#[test]
+fn mixed_object_moves_are_one_undo_step_and_survive_save_reopen() {
+    let (mut s, id) = session_with(1);
+    let text = AddedText { text: "Added label".into(), rect: [20.0, 240.0, 140.0, 265.0], ..Default::default() };
+    s.apply(id, Edit::AddText { page: 0, text }).unwrap();
+    let image = image::RgbImage::from_pixel(12, 8, image::Rgb([240, 20, 20]));
+    let mut png = std::io::Cursor::new(Vec::new());
+    image.write_to(&mut png, image::ImageFormat::Png).unwrap();
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([40.0, 40.0, 80.0, 70.0]), name: "red.png".into(), bytes: Arc::new(png.into_inner()) }).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    s.mark_saved(id, saved.clone(), None).unwrap();
+    let before = s.get(id).unwrap().editable_objects(0).unwrap();
+    assert_eq!(before.len(), 3, "one native paragraph, one added label and one added image");
+    let generation = s.get(id).unwrap().edit_generation();
+    let targets = before.iter().map(|o| o.target).collect();
+    s.apply(id, Edit::MoveObjects { page: 0, objects: targets, offset: [24.0, -24.0] }).unwrap();
+    let doc = s.get(id).unwrap();
+    assert!(doc.dirty && doc.edit_generation() > generation);
+    assert_eq!(doc.can_undo(), Some("Move objects"));
+    let after = doc.editable_objects(0).unwrap();
+    for (a, b) in before.iter().zip(&after) {
+        assert_eq!(a.text, b.text);
+        for (i, (x, y)) in a.rect.iter().zip(b.rect).enumerate() {
+            assert!((y - x - if i % 2 == 0 { 24.0 } else { -24.0 }).abs() < 0.001);
+        }
+    }
+    let moved = s.save_bytes(id).unwrap();
+    assert!(moved.starts_with(saved.as_ref()), "an incremental update preserves the original revision");
+    let mut again = Session::new();
+    let other = again.open("moved.pdf", None, moved.clone(), None).unwrap();
+    assert_eq!(again.get(other).unwrap().editable_objects(0).unwrap(), after);
+    assert_eq!(s.undo(id).unwrap(), "Move objects");
+    assert_eq!(s.get(id).unwrap().editable_objects(0).unwrap(), before);
+    assert_eq!(s.get(id).unwrap().can_undo(), Some("Add image"), "one undo restores all three objects");
+    s.redo(id).unwrap();
+    assert_eq!(s.get(id).unwrap().editable_objects(0).unwrap(), after);
+    let mut renderer = pdfcraft_render::PageRenderer::new(moved, Default::default());
+    let rendered = renderer.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+    let pixel = |x: usize, y: usize| &rendered.rgba[(y * rendered.width as usize + x) * 4..][..3];
+    assert!(pixel(84, 269)[0] > 200 && pixel(84, 269)[1] < 50, "the added image renders at its new position");
+    assert!(pixel(45, 240).iter().all(|v| *v > 240), "the old image position is clear");
+}
+
+#[test]
+fn failed_group_moves_preserve_generation_dirty_state_and_redo_history() {
+    let (mut s, id) = session_with(1);
+    let objects: Vec<_> = s.get(id).unwrap().editable_objects(0).unwrap().iter().map(|o| o.target).collect();
+    s.apply(id, Edit::MoveObjects { page: 0, objects: objects.clone(), offset: [10.0, 0.0] }).unwrap();
+    s.undo(id).unwrap();
+    let before = s.save_bytes(id).unwrap();
+    let generation = s.get(id).unwrap().edit_generation();
+    let dirty = s.get(id).unwrap().dirty;
+    let mut bad = objects;
+    bad.push(ObjectTarget { kind: ObjectKind::Image, index: 999 });
+    assert!(s.apply(id, Edit::MoveObjects { page: 0, objects: bad, offset: [10.0, 0.0] }).is_err());
+    let doc = s.get(id).unwrap();
+    assert_eq!(doc.edit_generation(), generation);
+    assert_eq!(doc.dirty, dirty);
+    assert!(doc.can_undo().is_none());
+    assert_eq!(doc.can_redo(), Some("Move object"));
+    assert_eq!(s.save_bytes(id).unwrap(), before);
+    s.redo(id).unwrap();
+    assert!(s.get(id).unwrap().dirty);
+}
+
+#[test]
+fn group_move_respects_modify_permission_and_display_coordinate_rotation() {
+    for rotation in [0, 90, 180, 270] {
+        let (mut s, id) = session_with(1);
+        s.apply(id, Edit::RotatePages { pages: vec![0], degrees: rotation }).unwrap();
+        let doc = s.get(id).unwrap();
+        let delta = doc.object_move_offset(0, [17.0, 23.0]).unwrap();
+        let info = &doc.info.pages[0];
+        let a = info.user_to_view(30.0, 70.0);
+        let b = info.user_to_view(30.0 + delta[0] as f32, 70.0 + delta[1] as f32);
+        assert!((b[0] - a[0] - 17.0).abs() < 0.001 && (b[1] - a[1] - 23.0).abs() < 0.001);
+    }
+    let (mut s, id) = session_with(1);
+    let mut p = protection(None, Some("owner"));
+    p.changes = Changes::None;
+    s.apply(id, Edit::Protect(p)).unwrap();
+    let bytes = s.save_bytes(id).unwrap();
+    let mut reader = Session::new();
+    let id = reader.open("restricted.pdf", None, bytes, None).unwrap();
+    let objects = reader.get(id).unwrap().editable_objects(0).unwrap().iter().map(|o| o.target).collect();
+    let generation = reader.get(id).unwrap().edit_generation();
+    assert!(reader.apply(id, Edit::MoveObjects { page: 0, objects, offset: [10.0, 0.0] }).is_err());
+    let doc = reader.get(id).unwrap();
+    assert!(!doc.dirty && doc.can_undo().is_none() && doc.edit_generation() == generation);
+}
+
+#[test]
+fn group_moves_preserve_rotated_added_content_raster_geometry() {
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddText { page: 0, text: AddedText { text: "Added label".into(), rect: [20.0, 240.0, 140.0, 265.0], ..Default::default() } })
+        .unwrap();
+    let image = image::RgbImage::from_fn(20, 10, |x, _| image::Rgb(if x < 10 { [240, 20, 20] } else { [20, 20, 240] }));
+    let mut png = std::io::Cursor::new(Vec::new());
+    image.write_to(&mut png, image::ImageFormat::Png).unwrap();
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([40.0, 40.0, 80.0, 70.0]), name: "quadrants.png".into(), bytes: Arc::new(png.into_inner()) })
+        .unwrap();
+    let AddedContent::Image(mut image) = s.get(id).unwrap().added[1].content.clone() else { panic!() };
+    image.flip_h = true;
+    image.crop = [0.1, 0.0, 0.2, 0.0];
+    s.apply(id, Edit::UpdateContent { page: 0, index: 1, content: AddedContent::Image(image) }).unwrap();
+    s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    let render = |bytes| {
+        let mut r = pdfcraft_render::PageRenderer::new(bytes, Default::default());
+        r.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() })
+    };
+    let before = render(s.get(id).unwrap().bytes.clone());
+    let doc = s.get(id).unwrap();
+    let offset = doc.object_move_offset(0, [24.0, 36.0]).unwrap();
+    let objects = doc.editable_objects(0).unwrap().iter().map(|o| o.target).collect();
+    s.apply(id, Edit::MoveObjects { page: 0, objects, offset }).unwrap();
+    let after = render(s.get(id).unwrap().bytes.clone());
+    assert_eq!((before.width, before.height), (after.width, after.height));
+    let mut painted = 0;
+    for y in 0..before.height as usize {
+        for x in 0..before.width as usize {
+            let pos = (y * before.width as usize + x) * 4;
+            let expected = if x >= 24 && y >= 36 {
+                let old = ((y - 36) * before.width as usize + x - 24) * 4;
+                &before.rgba[old..old + 4]
+            } else {
+                &[255, 255, 255, 255]
+            };
+            // Raster coverage can round by one intensity level when equivalent placements
+            // reach the renderer through different text operators. Geometry and image colours
+            // must still agree across every pixel of the translated page.
+            assert!(after.rgba[pos..pos + 4].iter().zip(expected).all(|(a, b)| a.abs_diff(*b) <= 2), "pixel {x},{y}");
+            painted += usize::from(expected[..3].iter().any(|c| *c < 240));
+        }
+    }
+    assert!(painted > 500, "the comparison contains real rendered text and image pixels");
+}
+
+#[test]
+fn legacy_passwords_with_turkish_characters_open() {
+    // RC4-128 (R3): user "ılık€" in PDFDocEncoding (ı = 0x9A, € = 0xA0), owner "Çağlar"
+    // (PDFDocEncoding has no ğ: written without it, as pdfcraft-crypt writes R2–R4 passwords).
+    let mut cos = pdfcraft_cos::Document::open(Arc::new(fixture(1))).unwrap();
+    let params = pdfcraft_cos::NewEncryption {
+        algorithm: pdfcraft_cos::Algorithm::Rc4_128,
+        user_password: "ılık€",
+        owner_password: "Çağlar",
+        permissions: -1,
+        encrypt_metadata: true,
+        seed: [7; 32],
+    };
+    cos.set_encryption(&params).unwrap();
+    let bytes = Arc::new(pdfcraft_cos::write_full(&cos, &pdfcraft_cos::SaveOptions::default()).unwrap());
+    let mut s = Session::new();
+    // The renderer used to try only the UTF-8 bytes, and the owner fallback handed it the
+    // recovered user password as Latin-1: both came back as a wrong password.
+    for pw in ["ılık€", "Çağlar"] {
+        let id = s.open("x.pdf", None, bytes.clone(), Some(pw)).unwrap_or_else(|e| panic!("{pw}: {e:?}"));
+        assert_eq!(page_texts(&s, id), ["Page 1"], "{pw}");
+        assert!(s.get(id).unwrap().info.encrypted, "{pw}");
+    }
+    assert!(matches!(s.open("x.pdf", None, bytes, Some("ilik€")), Err(OpenError::WrongPassword)));
+}
+
+#[test]
+fn recovered_user_passwords_reach_the_renderer_byte_for_byte() {
+    assert_eq!(crate::renderer_password(b"pw"), "pw");
+    // UTF-8 bytes (qpdf writes "şifre" so; its \xC5\x9F has no PDFDocEncoding reading).
+    assert_eq!(crate::renderer_password("şifre".as_bytes()), "şifre");
+    // PDFDocEncoding bytes: ı = 0x9A, € = 0xA0, Ç = 0xC7.
+    assert_eq!(crate::renderer_password(&[0x9A, b'l', 0x9A, b'k', 0xA0]), "ılık€");
+    assert_eq!(crate::renderer_password(&[0xC7, b'o', b'k']), "Çok");
+}
diff --git a/crates/engine/src/xfa.rs b/crates/engine/src/xfa.rs
index f8ef3fd2f..029fcb700 100644
--- a/crates/engine/src/xfa.rs
+++ b/crates/engine/src/xfa.rs
@@ -167,10 +167,10 @@ fn count_instances(root: &FormNode, parent_som: &str, name: &str) -> usize {
     parent.map_or(0, |p| p.children.iter().filter(|c| c.name == name).count())
 }
 
-/// An instance SOM (`…table[0].row[2]`) split into its parent's data path and SOM, its name
-/// and its index.
-fn split_instance(som: &str) -> Option<(pdfcraft_xfa::DataPath, String, String, usize)> {
-    let mut path = pdfcraft_xfa::som_to_path(som);
+/// An instance SOM (`…table[0].row[2]`) split into its parent's data path (areas left out,
+/// see [`pdfcraft_xfa::data_path`]) and SOM, its name and its index.
+fn split_instance(tpl: &Template, som: &str) -> Option<(pdfcraft_xfa::DataPath, String, String, usize)> {
+    let mut path = pdfcraft_xfa::data_path(tpl, som);
     let (name, index) = path.pop()?;
     let parent_som = som.rsplit_once('.').map(|(p, _)| p).unwrap_or("").to_string();
     Some((path, parent_som, name, index))
@@ -356,7 +356,7 @@ impl<'a, 'b> Runner<'a, 'b> {
     /// Give the object at `som` the value `value` (field `name` when it has a widget). Returns
     /// whether it changed.
     fn set_value(&mut self, som: &str, value: &str) -> bool {
-        let path = pdfcraft_xfa::som_to_path(som);
+        let path = pdfcraft_xfa::data_path(self.tpl, som);
         let name = self.by_som().get(som).cloned();
         let Some(name) = name else {
             // No widget (a hidden field, a draw, a row not laid out yet): the data alone.
@@ -484,7 +484,7 @@ impl<'a, 'b> Runner<'a, 'b> {
             if matches!(info.kind, pdfcraft_forms::FieldKind::PushButton | pdfcraft_forms::FieldKind::Signature) {
                 continue;
             }
-            let path = pdfcraft_xfa::som_to_path(som);
+            let path = pdfcraft_xfa::data_path(self.tpl, som);
             let text = data_text(info);
             if self.data.as_ref().and_then(|d| d.text_at(&path)).unwrap_or("") != text {
                 self.data_op(pdfcraft_xfa::DataOp::Value { path, text });
@@ -501,10 +501,12 @@ impl<'a, 'b> Runner<'a, 'b> {
         // Instances of each repeating subform before the script ran, as the effects leave them.
         let mut counts: HashMap<(String, String), usize> = HashMap::new();
         {
+            // A copy of the shared reference: `live()` borrows `self` mutably.
+            let tpl = self.tpl;
             let live = self.live();
             for e in effects {
                 if let XfaEffect::AddInstance { som } | XfaEffect::RemoveInstance { som } = e
-                    && let Some((_, parent_som, name, _)) = split_instance(som)
+                    && let Some((_, parent_som, name, _)) = split_instance(tpl, som)
                 {
                     let have = count_instances(&live.root, &parent_som, &name);
                     counts.entry((parent_som, name)).or_insert(have);
@@ -542,7 +544,7 @@ impl<'a, 'b> Runner<'a, 'b> {
                     }
                 }
                 XfaEffect::AddInstance { som } | XfaEffect::RemoveInstance { som } => {
-                    let Some((parent, parent_som, name, index)) = split_instance(som) else { continue };
+                    let Some((parent, parent_som, name, index)) = split_instance(self.tpl, som) else { continue };
                     let key = (parent_som, name.clone());
                     let have = counts.get(&key).copied().unwrap_or(0);
                     if matches!(e, XfaEffect::AddInstance { .. }) {
@@ -750,7 +752,7 @@ mod tests {
         assert!(!som_matches("form[0].page1[0].qty[0]", "qt"));
         assert!(!som_matches("form[0].page1[0].price[0]", "qty"));
         assert_eq!(
-            split_instance("form[0].table[0].row[2]").map(|(p, ps, n, i)| (p.len(), ps, n, i)),
+            split_instance(&Template::default(), "form[0].table[0].row[2]").map(|(p, ps, n, i)| (p.len(), ps, n, i)),
             Some((2, "form[0].table[0]".into(), "row".into(), 2))
         );
     }
diff --git a/crates/fonts/src/pdf.rs b/crates/fonts/src/pdf.rs
index 488052439..412201a73 100644
--- a/crates/fonts/src/pdf.rs
+++ b/crates/fonts/src/pdf.rs
@@ -5,7 +5,8 @@
 //! approximations. Meanings come from `/ToUnicode`, else the encoding (`/Encoding` base and
 //! `/Differences` glyph names, ISO 32000-2 Annex D).
 
-use std::collections::HashMap;
+use std::borrow::Cow;
+use std::collections::{BinaryHeap, HashMap, HashSet};
 
 use pdfcraft_cos::{Dict, Document, Object};
 
@@ -46,7 +47,7 @@ pub struct Metrics {
     pub descent: f64,
     pub composite: bool,
     /// Code → Unicode text.
-    unicode: HashMap<u32, String>,
+    unicode: Unicode,
     /// `/BaseFont` (or Type 3 descriptor's `/FontName`), and whether it is a subset (`ABCDEF+Name`: other glyphs are missing).
     pub base_font: String,
     pub subset: bool,
@@ -73,13 +74,138 @@ fn descriptor_flags(doc: &Document, descriptor: &Dict) -> u32 {
     u32::try_from(value).unwrap_or(0)
 }
 
-/// Most entries a CMap may add, so a small stream of overlapping `bfrange`s can't take minutes
-/// or gigabytes; a full 2-byte code space is 65 536. Entries past it are ignored.
+/// Most mappings a CMap may add, where each `bfchar` or array-form entry counts one and each sequential
+/// range counts two (it covers at least two codes). So a CMap with at most this many codes is kept whole;
+/// mappings past the budget are ignored, so a stream of them can't take minutes or gigabytes.
 const MAX_CMAP_ENTRIES: usize = 1 << 20;
 /// Most codespace or CID ranges kept from a CMap; Adobe's largest published CMaps have a few
 /// thousand.
 const MAX_CMAP_RANGES: usize = 1 << 16;
 
+/// Code → Unicode of a font. Explicit mappings and sequential ranges are kept as declared, so a range
+/// costs one record however many codes it covers; where two overlap, the one declared later wins.
+#[derive(Clone, Debug, Default, PartialEq)]
+struct Unicode {
+    /// Simple fonts: the encoding table and `/Differences`, which ToUnicode overrides.
+    encoding: HashMap<u32, String>,
+    /// `bfchar` and array-form entries: the text of each code, with the declaration order of its last one.
+    explicit: HashMap<u32, (u32, String)>,
+    /// Sequential `bfrange` records, in declaration order.
+    ranges: Vec<BfRange>,
+    /// Which record covers each stretch of codes; see [`cover_index`].
+    cover: Vec<(u64, Option<usize>)>,
+    /// The latest-declared range covering each code below 65 536, as an index into `ranges` (`u32::MAX` for
+    /// none); empty without ranges. See [`owners_below_64k`].
+    low: Vec<u32>,
+    /// One bit per code below 65 536 that has an explicit entry; empty without any. A miss then skips the
+    /// hash lookup. See [`bit_set_below_64k`].
+    explicit_low: Vec<u64>,
+}
+
+/// A sequential `bfrange`: code `lo + k` (up to `hi`) maps to `units` with its last unit moved on by `k`.
+#[derive(Clone, Debug, PartialEq)]
+struct BfRange {
+    lo: u32,
+    hi: u32,
+    /// Declaration order, shared with the explicit entries.
+    seq: u32,
+    units: Box<[u16]>,
+}
+
+impl Unicode {
+    /// Whether `code` may have an explicit entry; false is certain for codes below 65 536 without one.
+    #[inline]
+    fn may_be_explicit(&self, code: u32) -> bool {
+        code >= 0x1_0000 || self.explicit_low.get(code as usize / 64).is_some_and(|w| (*w >> (code % 64)) & 1 == 1)
+    }
+
+    /// The latest-declared range that covers `code`.
+    #[inline]
+    fn covering(&self, code: u32) -> Option<&BfRange> {
+        if code < 0x1_0000 {
+            return self.ranges.get(*self.low.get(code as usize)? as usize);
+        }
+        let step = self.cover.partition_point(|&(start, _)| start <= u64::from(code));
+        let &(_, record) = self.cover.get(step.checked_sub(1)?)?;
+        self.ranges.get(record?)
+    }
+
+    /// The text of `code`: its explicit entry, unless a range declared after it covers the code;
+    /// otherwise the covering range, otherwise the encoding.
+    #[inline]
+    fn text(&self, code: u32) -> Option<Cow<'_, str>> {
+        let range = self.covering(code);
+        let explicit = if self.may_be_explicit(code) { self.explicit.get(&code) } else { None };
+        if let Some((seq, text)) = explicit
+            && range.is_none_or(|r| r.seq < *seq)
+        {
+            return Some(Cow::Borrowed(text.as_str()));
+        }
+        match range {
+            Some(r) => Some(Cow::Owned(r.text_at(code))),
+            None => self.encoding.get(&code).map(|t| Cow::Borrowed(t.as_str())),
+        }
+    }
+}
+
+impl BfRange {
+    /// The text of `code`, which lies in this range.
+    fn text_at(&self, code: u32) -> String {
+        // The offset is below 65 536 (the width limit in `parse_to_unicode`), so truncating it is exact.
+        let offset = code.saturating_sub(self.lo) as u16;
+        let last = self.units.len().saturating_sub(1);
+        let units = self.units.iter().enumerate().map(|(i, &u)| if i == last { u.wrapping_add(offset) } else { u });
+        char::decode_utf16(units).map(|r| r.unwrap_or(char::REPLACEMENT_CHARACTER)).collect()
+    }
+
+    /// The lowest code of this range whose own text is `c` and that `valid` accepts. Only a single
+    /// unit (a BMP character, or U+FFFD through a surrogate unit) or a surrogate pair can decode to
+    /// one character `c`; longer destinations always decode to several.
+    fn first_code(&self, c: char, valid: impl Fn(u32) -> bool) -> Option<u32> {
+        let width = self.hi.checked_sub(self.lo)?;
+        match &*self.units {
+            [base] if c == '\u{FFFD}' => {
+                // The offsets whose unit is a surrogate or U+FFFD, in order; each decodes to U+FFFD.
+                let mut cursor = 0u32;
+                loop {
+                    let unit = (u32::from(*base) + cursor) & 0xFFFF;
+                    let offset = cursor.checked_add(match unit {
+                        0..=0xD7FF => 0xD800 - unit,
+                        0xD800..=0xDFFF | 0xFFFD => 0,
+                        0xE000..=0xFFFC => 0xFFFD - unit,
+                        _ => 0x1_0000 - unit + 0xD800,
+                    })?;
+                    if offset > width {
+                        return None;
+                    }
+                    if let Some(code) = self.lo.checked_add(offset)
+                        && valid(code)
+                    {
+                        return Some(code);
+                    }
+                    cursor = offset.checked_add(1)?;
+                }
+            }
+            [base] => {
+                let offset = u32::from(u16::try_from(u32::from(c)).ok()?.wrapping_sub(*base));
+                let code = self.lo.checked_add(offset).filter(|_| offset <= width)?;
+                valid(code).then_some(code)
+            }
+            [lead, last] => {
+                let v = u32::from(c).checked_sub(0x1_0000)?;
+                if u32::from(*lead) != 0xD800 + (v >> 10) {
+                    return None;
+                }
+                let low = u16::try_from(0xDC00 + (v & 0x3FF)).ok()?;
+                let offset = u32::from(low.wrapping_sub(*last));
+                let code = self.lo.checked_add(offset).filter(|_| offset <= width)?;
+                valid(code).then_some(code)
+            }
+            _ => None,
+        }
+    }
+}
+
 /// A token of a CMap stream (PostScript syntax, ISO 32000-2 §9.10.3).
 #[derive(Debug, PartialEq)]
 enum Tok<'a> {
@@ -286,7 +412,7 @@ impl Metrics {
             ascent: 0.9,
             descent: -0.25,
             composite: false,
-            unicode: (32..127u8).map(|c| (u32::from(c), char::from(c).to_string())).collect(),
+            unicode: Unicode { encoding: (32..127u8).map(|c| (u32::from(c), char::from(c).to_string())).collect(), ..Unicode::default() },
             base_font: "Helvetica".into(),
             subset: false,
             bold: false,
@@ -481,12 +607,13 @@ impl Metrics {
 impl Metrics {
     /// The text a string shows (codes without a known meaning are left out).
     pub fn decode(&self, s: &[u8]) -> String {
-        self.codes(s).into_iter().filter_map(|(c, _)| self.unicode.get(&c).cloned()).collect()
+        self.codes(s).into_iter().filter_map(|(c, _)| self.text_of(c)).collect()
     }
 
     /// The Unicode text of one code, if known.
-    pub fn text_of(&self, code: u32) -> Option<&str> {
-        self.unicode.get(&code).map(String::as_str)
+    #[inline]
+    pub fn text_of(&self, code: u32) -> Option<Cow<'_, str>> {
+        self.unicode.text(code)
     }
 
     /// Whether the font has a glyph for `code` (subset fonts lack the glyphs they don't use).
@@ -501,19 +628,44 @@ impl Metrics {
         }
     }
 
+    /// Whether `code` shows exactly `c` and has a glyph for it.
+    fn shows(&self, code: u32, c: char) -> bool {
+        self.unicode.text(code).is_some_and(|t| t.chars().eq(std::iter::once(c))) && self.has_glyph(code)
+    }
+
     /// The bytes that show `text` in this font, or `None` if some character has no code or
     /// no glyph in it (the caller then substitutes another font).
     pub fn encode(&self, text: &str) -> Option<Vec<u8>> {
-        let mut reverse: HashMap<&str, u32> = HashMap::new();
-        for (code, t) in &self.unicode {
-            if self.has_glyph(*code) {
-                reverse.entry(t.as_str()).and_modify(|c| *c = (*c).min(*code)).or_insert(*code);
+        // The lowest code showing each wanted character. Explicit entries and the encoding are
+        // checked one by one; each range is asked for the wanted characters it can show.
+        let wanted: HashSet<char> = text.chars().collect();
+        let mut reverse: HashMap<char, u32> = HashMap::new();
+        for (&code, (_, t)) in &self.unicode.explicit {
+            if let Some(c) = only_char(t)
+                && wanted.contains(&c)
+                && self.shows(code, c)
+            {
+                keep(&mut reverse, c, code);
+            }
+        }
+        for (&code, t) in &self.unicode.encoding {
+            if let Some(c) = only_char(t)
+                && wanted.contains(&c)
+                && self.shows(code, c)
+            {
+                keep(&mut reverse, c, code);
+            }
+        }
+        for range in &self.unicode.ranges {
+            for &c in &wanted {
+                if let Some(code) = range.first_code(c, |m| self.shows(m, c)) {
+                    keep(&mut reverse, c, code);
+                }
             }
         }
         let mut out = Vec::with_capacity(text.len() * self.code_len);
-        let mut buf = [0u8; 4];
         for ch in text.chars() {
-            let code = *reverse.get(ch.encode_utf8(&mut buf) as &str)?;
+            let code = *reverse.get(&ch)?;
             let bytes = code.to_be_bytes();
             out.extend_from_slice(&bytes[4 - self.code_len.clamp(1, 4)..]);
         }
@@ -521,24 +673,156 @@ impl Metrics {
     }
 }
 
-/// UTF-16BE (with surrogates) from CMap hex bytes.
-fn utf16(b: &[u8]) -> String {
-    let units: Vec<u16> = b.chunks(2).map(|c| u16::from_be_bytes([c[0], *c.get(1).unwrap_or(&0)])).collect();
-    String::from_utf16_lossy(&units)
+/// The UTF-16 code units of CMap hex bytes.
+fn code_units(b: &[u8]) -> Vec<u16> {
+    b.chunks(2).map(|c| u16::from_be_bytes([c[0], *c.get(1).unwrap_or(&0)])).collect()
 }
 
-/// `bfchar`/`bfrange` entries of a ToUnicode CMap, at most [`MAX_CMAP_ENTRIES`] of them.
-fn parse_to_unicode(data: &[u8], out: &mut HashMap<u32, String>) {
-    let mut budget = MAX_CMAP_ENTRIES;
+/// UTF-16BE (with surrogates) from CMap hex bytes.
+fn utf16(b: &[u8]) -> String {
+    String::from_utf16_lossy(&code_units(b))
+}
+
+/// The character `s` is made of, if it is exactly one.
+fn only_char(s: &str) -> Option<char> {
+    let mut chars = s.chars();
+    let c = chars.next()?;
+    chars.next().is_none().then_some(c)
+}
+
+/// Keeps the lowest code found for `c`.
+fn keep(reverse: &mut HashMap<char, u32>, c: char, code: u32) {
+    reverse.entry(c).and_modify(|r| *r = (*r).min(code)).or_insert(code);
+}
+
+/// Spends `cost` of the budget; `false` when less is left.
+fn spend(budget: &mut usize, cost: usize) -> bool {
+    let Some(left) = budget.checked_sub(cost) else { return false };
+    *budget = left;
+    true
+}
+
+/// Adds an explicit mapping; `false` once the budget is spent.
+fn add_explicit(out: &mut Unicode, budget: &mut usize, seq: &mut u32, code: u32, text: String) -> bool {
+    if !spend(budget, 1) {
+        return false;
+    }
+    *seq = seq.saturating_add(1);
+    out.explicit.insert(code, (*seq, text));
+    true
+}
+
+/// Adds a sequential range, which covers at least two codes and so costs two; `false` once the budget is spent.
+fn add_range(out: &mut Unicode, budget: &mut usize, seq: &mut u32, lo: u32, hi: u32, units: Box<[u16]>) -> bool {
+    if !spend(budget, 2) {
+        return false;
+    }
+    *seq = seq.saturating_add(1);
+    out.ranges.push(BfRange { lo, hi, seq: *seq, units });
+    true
+}
+
+/// For each stretch of codes, from its first code on, the latest-declared range covering it (`None`
+/// where no range does), sorted by code; a lookup is one binary search over it.
+fn cover_index(ranges: &[BfRange]) -> Vec<(u64, Option<usize>)> {
+    // Openings (first code, record) and closings (one past the last code), each in code order. The cover
+    // can only change at one of their codes, so the sweep visits those codes in order.
+    let mut opens: Vec<(u32, u32)> = ranges.iter().enumerate().map(|(i, r)| (r.lo, i as u32)).collect();
+    opens.sort_unstable();
+    let mut closes: Vec<u64> = ranges.iter().map(|r| u64::from(r.hi) + 1).collect();
+    closes.sort_unstable();
+    // Records that have opened and not yet closed; the top is the latest declared one.
+    let mut open: BinaryHeap<u32> = BinaryHeap::new();
+    let mut cover: Vec<(u64, Option<usize>)> = Vec::new();
+    let (mut next_open, mut next_close) = (0, 0);
+    loop {
+        let p = match (opens.get(next_open), closes.get(next_close)) {
+            (Some(&(lo, _)), Some(&end)) => u64::from(lo).min(end),
+            (Some(&(lo, _)), None) => u64::from(lo),
+            (None, Some(&end)) => end,
+            (None, None) => break,
+        };
+        while let Some(&(lo, record)) = opens.get(next_open)
+            && u64::from(lo) <= p
+        {
+            open.push(record);
+            next_open += 1;
+        }
+        while closes.get(next_close).is_some_and(|&end| end <= p) {
+            next_close += 1;
+        }
+        while open.peek().is_some_and(|&top| ranges.get(top as usize).is_none_or(|r| u64::from(r.hi) < p)) {
+            open.pop();
+        }
+        let winner = open.peek().map(|&top| top as usize);
+        if cover.last().map(|&(_, w)| w) != Some(winner) {
+            cover.push((p, winner));
+        }
+    }
+    cover
+}
+
+/// One bit for each code below 65 536 in `codes`; empty when there is none.
+/// Sized to the highest such code, so a font with a few low codes costs a few words, not 8 KB.
+fn bit_set_below_64k(codes: impl Iterator<Item = u32>) -> Vec<u64> {
+    let low: Vec<u32> = codes.filter(|&code| code < 0x1_0000).collect();
+    let Some(&max) = low.iter().max() else { return Vec::new() };
+    let mut bits = vec![0u64; max as usize / 64 + 1];
+    for code in low {
+        if let Some(word) = bits.get_mut(code as usize / 64) {
+            *word |= 1u64 << (code % 64);
+        }
+    }
+    bits
+}
+
+/// The latest-declared range covering each code below 65 536, read off the stretches of `cover`; empty
+/// when no range covers such a code. The stretches are disjoint, so this takes at most 65 536 steps
+/// however many ranges there are.
+///
+/// The table ends with the last covered code: a code past it has no covering range, and a font whose
+/// ranges cover a few low codes costs that many entries, not a fixed 256 KB.
+fn owners_below_64k(cover: &[(u64, Option<usize>)]) -> Vec<u32> {
+    let stretch_end = |i: usize| cover.get(i + 1).map_or(0x1_0000, |&(next, _)| next.min(0x1_0000));
+    let len = cover
+        .iter()
+        .enumerate()
+        .filter(|&(_, &(start, winner))| winner.is_some() && start < 0x1_0000)
+        .map(|(i, _)| stretch_end(i))
+        .max()
+        .unwrap_or(0);
+    let mut owner = vec![u32::MAX; usize::try_from(len).unwrap_or(0)];
+    for (i, &(start, winner)) in cover.iter().enumerate() {
+        let Some(record) = winner else { continue };
+        // Record indices are below MAX_CMAP_ENTRIES, which fits in a u32.
+        let record = record as u32;
+        for code in start..stretch_end(i) {
+            if let Some(slot) = owner.get_mut(code as usize) {
+                *slot = record;
+            }
+        }
+    }
+    owner
+}
+
+/// `bfchar`/`bfrange` entries of a ToUnicode CMap, at most [`MAX_CMAP_ENTRIES`] mappings of them.
+fn parse_to_unicode(data: &[u8], out: &mut Unicode) {
+    parse_to_unicode_within(data, out, MAX_CMAP_ENTRIES);
+}
+
+/// [`parse_to_unicode`] with `budget` explicit entries, so tests can use a small one.
+fn parse_to_unicode_within(data: &[u8], out: &mut Unicode, mut budget: usize) {
+    let mut seq = 0u32;
     let mut toks = Lexer::new(data);
-    while let Some(t) = toks.next() {
+    'scan: while let Some(t) = toks.next() {
         match t {
             Tok::Word(b"beginbfchar") => {
                 while let Some([c, u]) = entry(&mut toks, b"endbfchar") {
                     if let (Tok::Hex(Some(c)), Tok::Hex(Some(u))) = (c, u) {
-                        let Some(left) = budget.checked_sub(1) else { return };
-                        budget = left;
-                        out.insert(be(&c), utf16(&u));
+                        let added = add_explicit(out, &mut budget, &mut seq, be(&c), utf16(&u));
+                        if !added {
+                            break 'scan;
+                        }
                     }
                 }
             }
@@ -560,9 +844,10 @@ fn parse_to_unicode(data: &[u8], out: &mut HashMap<u32, String>) {
                                 match t {
                                     Tok::Close => break,
                                     Tok::Hex(Some(u)) => {
-                                        let Some(left) = budget.checked_sub(1) else { return };
-                                        budget = left;
-                                        out.insert(c, utf16(&u));
+                                        let added = add_explicit(out, &mut budget, &mut seq, c, utf16(&u));
+                                        if !added {
+                                            break 'scan;
+                                        }
                                     }
                                     // A bad entry still stands for its code.
                                     _ => {}
@@ -571,14 +856,13 @@ fn parse_to_unicode(data: &[u8], out: &mut HashMap<u32, String>) {
                             }
                         }
                         Tok::Hex(Some(u)) if hi >= lo && hi - lo < 65536 => {
-                            let mut units: Vec<u16> = u.chunks(2).map(|c| u16::from_be_bytes([c[0], *c.get(1).unwrap_or(&0)])).collect();
-                            for code in lo..=hi {
-                                let Some(left) = budget.checked_sub(1) else { return };
-                                budget = left;
-                                out.insert(code, String::from_utf16_lossy(&units));
-                                if let Some(last) = units.last_mut() {
-                                    *last = last.wrapping_add(1);
-                                }
+                            let added = if lo == hi {
+                                add_explicit(out, &mut budget, &mut seq, lo, utf16(&u))
+                            } else {
+                                add_range(out, &mut budget, &mut seq, lo, hi, code_units(&u).into_boxed_slice())
+                            };
+                            if !added {
+                                break 'scan;
                             }
                         }
                         _ => {}
@@ -588,6 +872,9 @@ fn parse_to_unicode(data: &[u8], out: &mut HashMap<u32, String>) {
             _ => {}
         }
     }
+    out.cover = cover_index(&out.ranges);
+    out.low = owners_below_64k(&out.cover);
+    out.explicit_low = bit_set_below_64k(out.explicit.keys().copied());
 }
 
 /// A glyph name's Unicode (Annex D names, `uniXXXX`, `uXXXX[XX]`, single letters).
@@ -600,8 +887,8 @@ pub fn glyph_unicode(name: &str) -> Option<char> {
 }
 
 /// Code → Unicode for a font: its ToUnicode CMap, else (simple fonts) its encoding.
-fn unicode_map(doc: &Document, font: &Dict, composite: bool) -> HashMap<u32, String> {
-    let mut out = HashMap::new();
+fn unicode_map(doc: &Document, font: &Dict, composite: bool) -> Unicode {
+    let mut out = Unicode::default();
     if !composite {
         let enc = font.get(b"Encoding").map(|e| doc.resolve(e));
         let base_name = match enc.as_deref() {
@@ -616,7 +903,7 @@ fn unicode_map(doc: &Document, font: &Dict, composite: bool) -> HashMap<u32, Str
         };
         for (code, u) in table.iter().enumerate() {
             if let Some(c) = char::from_u32(*u).filter(|_| *u != 0) {
-                out.insert(code as u32, c.to_string());
+                out.encoding.insert(code as u32, c.to_string());
             }
         }
         if let Some(Object::Dict(d)) = enc.as_deref()
@@ -629,8 +916,8 @@ fn unicode_map(doc: &Document, font: &Dict, composite: bool) -> HashMap<u32, Str
                     Object::Int(n) => code = u32::try_from((*n).max(0)).unwrap_or(u32::MAX),
                     Object::Name(n) => {
                         match glyph_unicode(&String::from_utf8_lossy(n)) {
-                            Some(c) => out.insert(code, c.to_string()),
-                            None => out.remove(&code),
+                            Some(c) => out.encoding.insert(code, c.to_string()),
+                            None => out.encoding.remove(&code),
                         };
                         code = code.saturating_add(1);
                     }
@@ -653,6 +940,21 @@ mod tests {
 
     use super::*;
 
+    /// A font whose ranges cover a few low codes keeps tables that size, not a fixed 64k-entry one.
+    #[test]
+    fn low_code_tables_end_with_the_last_covered_code() {
+        // One range over codes 0x20..=0x21, then nothing.
+        let cover = [(0x20u64, Some(0usize)), (0x22, None)];
+        let owner = super::owners_below_64k(&cover);
+        assert_eq!(owner.len(), 0x22);
+        assert_eq!((owner[0x1F], owner[0x20], owner[0x21]), (u32::MAX, 0, 0));
+        assert!(super::owners_below_64k(&[(0x2_0000, Some(0))]).is_empty(), "no code below 65 536");
+        let bits = super::bit_set_below_64k([3u32, 130, 0x2_0000].into_iter());
+        assert_eq!(bits.len(), 3);
+        assert_eq!((bits[0], bits[2]), (1 << 3, 1 << 2));
+        assert!(super::bit_set_below_64k([0x1_0000u32].into_iter()).is_empty());
+    }
+
     fn font(doc: &mut Document, entries: Vec<(&str, Object)>) -> Dict {
         let mut d = Dict::new();
         d.set(b"Type".to_vec(), Object::name("Font"));
@@ -802,9 +1104,10 @@ mod tests {
     }
 
     fn to_unicode(cmap: &[u8]) -> HashMap<u32, String> {
-        let mut out = HashMap::new();
-        parse_to_unicode(cmap, &mut out);
-        out
+        let mut u = Unicode::default();
+        parse_to_unicode(cmap, &mut u);
+        let codes: Vec<u32> = u.explicit.keys().copied().chain(u.ranges.iter().flat_map(|r| r.lo..=r.hi)).collect();
+        codes.into_iter().filter_map(|c| u.text(c).map(|t| (c, t.into_owned()))).collect()
     }
 
     #[test]
@@ -852,22 +1155,233 @@ mod tests {
         let mut enc = Dict::new();
         enc.set(b"Differences".to_vec(), Object::Array(vec![Object::Int(i64::MAX), Object::name("A"), Object::name("B")]));
         let f = font(&mut doc, vec![("Subtype", Object::name("Type1")), ("Encoding", Object::Dict(enc))]);
-        assert_eq!(unicode_map(&doc, &f, false).get(&u32::MAX).map(String::as_str), Some("B"));
+        assert_eq!(unicode_map(&doc, &f, false).text(u32::MAX).as_deref(), Some("B"));
+    }
+
+    #[test]
+    fn sequential_ranges_past_the_entry_cap_still_map() {
+        // 17 ranges of 65 536 codes: 1 114 112 codes from 0.4 KB of CMap, more than MAX_CMAP_ENTRIES
+        // (the first 16 ranges use up the whole cap). Each range maps its codes upward from 'A', so
+        // the last code of the last range, 0x100019, is 'A' + 0x19 = 'Z'.
+        let mut cmap = b"17 beginbfrange ".to_vec();
+        for k in 0..17u32 {
+            cmap.extend(format!("<{:08X}> <{:08X}> <0041> ", k << 16, (k << 16) | 0xffff).bytes());
+        }
+        cmap.extend(b"endbfrange");
+        let mut doc = Document::new_empty();
+        let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap)));
+        let f = font(
+            &mut doc,
+            vec![
+                ("Subtype", Object::name("Type0")),
+                ("BaseFont", Object::name("Wide")),
+                ("Encoding", Object::name("Identity-H")),
+                ("ToUnicode", Object::Ref(tu)),
+            ],
+        );
+        let m = Metrics::from_dict(&doc, &f);
+        assert_eq!(m.text_of(0x0010_0019).as_deref(), Some("Z"));
     }
 
     #[test]
     fn a_cmap_adds_at_most_max_entries() {
-        // 200 ranges of 65 536 codes would be 13 million strings from 4 KB of stream.
+        // 200 ranges of 65 536 codes would be 13 million codes from 4 KB of stream: 200 records.
         let mut cmap = b"200 beginbfrange ".to_vec();
         for k in 0..200u32 {
             cmap.extend(format!("<{:08X}> <{:08X}> <0041> ", k << 16, (k << 16) | 0xffff).bytes());
         }
         cmap.extend(b"endbfrange");
-        assert_eq!(to_unicode(&cmap).len(), MAX_CMAP_ENTRIES);
+        let mut u = Unicode::default();
+        parse_to_unicode(&cmap, &mut u);
+        assert_eq!((u.ranges.len(), u.explicit.len()), (200, 0));
+        // Explicit entries are what the budget counts: 250 of the 300 here are kept.
+        let mut many = b"300 beginbfchar ".to_vec();
+        for k in 0..300u32 {
+            many.extend(format!("<{k:04X}> <{:04X}> ", 0x4E00 + k).bytes());
+        }
+        many.extend(b"endbfchar");
+        let mut u = Unicode::default();
+        parse_to_unicode_within(&many, &mut u, 250);
+        assert_eq!((u.explicit.len(), u.text(249).is_some(), u.text(250).is_some()), (250, true, false));
         let mut many = b"begincidrange ".to_vec();
         for k in 0..MAX_CMAP_RANGES + 10 {
             many.extend(format!("<{k:08X}> <{k:08X}> 1 ").bytes());
         }
         assert_eq!(parse_cmap(&many).1.len(), MAX_CMAP_RANGES);
     }
+
+    #[test]
+    fn a_range_is_one_record_however_many_codes() {
+        let mut u = Unicode::default();
+        parse_to_unicode(b"1 beginbfrange <0000> <FFFF> <0041> endbfrange", &mut u);
+        assert_eq!((u.ranges.len(), u.explicit.len()), (1, 0));
+        assert_eq!(u.text(0xFFFF).as_deref(), Some("@"), "0x41 + 0xFFFF wraps to U+0040");
+    }
+
+    #[test]
+    fn sequential_ranges_count_against_the_budget() {
+        // Range k maps codes k and k + 1 and costs two, so a budget of 250 keeps ranges 0 to 124.
+        let mut cmap = Vec::new();
+        for k in 0..300u32 {
+            cmap.extend(format!("1 beginbfrange <{k:08X}> <{:08X}> <0041> endbfrange ", k + 1).bytes());
+        }
+        let mut u = Unicode::default();
+        parse_to_unicode_within(&cmap, &mut u, 250);
+        assert_eq!((u.ranges.len(), u.text(125).is_some(), u.text(126).is_none()), (125, true, true));
+    }
+
+    #[test]
+    fn explicit_and_range_mappings_override_the_encoding() {
+        let mut doc = Document::new_empty();
+        let cmap = b"1 beginbfchar <41> <0058> endbfchar 1 beginbfrange <42> <43> <0059> endbfrange";
+        let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.to_vec())));
+        let f = font(
+            &mut doc,
+            vec![
+                ("Subtype", Object::name("Type1")),
+                ("BaseFont", Object::name("Custom")),
+                ("Encoding", Object::name("WinAnsiEncoding")),
+                ("ToUnicode", Object::Ref(tu)),
+            ],
+        );
+        let m = Metrics::from_dict(&doc, &f);
+        let shown: Vec<Option<String>> = (0x41..=0x44).map(|c| m.text_of(c).map(|t| t.into_owned())).collect();
+        assert_eq!(shown, [Some("X".to_string()), Some("Y".to_string()), Some("Z".to_string()), Some("D".to_string())]);
+    }
+
+    /// Deterministic input for the differential test below.
+    struct Gen(u64);
+
+    impl Gen {
+        fn below(&mut self, n: u32) -> u32 {
+            self.0 = self.0.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1_442_695_040_888_963_407);
+            ((self.0 >> 33) % u64::from(n)) as u32
+        }
+
+        /// A destination: a unit from a pool of edge cases, a surrogate pair, or a lone high surrogate.
+        fn units(&mut self) -> Vec<u16> {
+            const POOL: [u16; 12] = [0x41, 0x42, 0xE9, 0x0, 0xFFFD, 0xFFFE, 0xFFFF, 0x100, 0x3042, 0xD800, 0xDC00, 0xDFFF];
+            match self.below(6) {
+                0 => vec![0xD835, 0xDC00 + self.below(0x400) as u16],
+                1 => vec![0xD800, 0x41],
+                _ => vec![POOL[self.below(POOL.len() as u32) as usize]],
+            }
+        }
+    }
+
+    fn hex(units: &[u16]) -> String {
+        units.iter().map(|u| format!("{u:04X}")).collect()
+    }
+
+    #[test]
+    fn lookups_match_the_expanded_mappings() {
+        // Random ToUnicode CMaps; `expected` is what expanding their entries in order gives.
+        let mut g = Gen(0x2545_f491_4f6c_dd1d);
+        for _ in 0..300 {
+            let mut cmap = String::from("1 begincodespacerange <0000> <FFFF> endcodespacerange ");
+            let mut expected: HashMap<u32, String> = HashMap::new();
+            for _ in 0..1 + g.below(12) {
+                match g.below(3) {
+                    0 => {
+                        let (code, u) = (g.below(300), g.units());
+                        cmap += &format!("1 beginbfchar <{code:04X}> <{}> endbfchar ", hex(&u));
+                        expected.insert(code, String::from_utf16_lossy(&u));
+                    }
+                    1 => {
+                        let (lo, width, u) = (g.below(300), g.below(13), g.units());
+                        cmap += &format!("1 beginbfrange <{lo:04X}> <{:04X}> <{}> endbfrange ", lo + width, hex(&u));
+                        for k in 0..=width {
+                            let mut v = u.clone();
+                            if let Some(last) = v.last_mut() {
+                                *last = last.wrapping_add(k as u16);
+                            }
+                            expected.insert(lo + k, String::from_utf16_lossy(&v));
+                        }
+                    }
+                    _ => {
+                        let (lo, width) = (g.below(300), g.below(5));
+                        let dests: Vec<Vec<u16>> = (0..=width).map(|_| g.units()).collect();
+                        let list: Vec<String> = dests.iter().map(|d| format!("<{}>", hex(d))).collect();
+                        cmap += &format!("1 beginbfrange <{lo:04X}> <{:04X}> [{}] endbfrange ", lo + width, list.join(" "));
+                        for (k, d) in dests.iter().enumerate() {
+                            expected.insert(lo + k as u32, String::from_utf16_lossy(d));
+                        }
+                    }
+                }
+            }
+            let mut doc = Document::new_empty();
+            let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.clone().into_bytes())));
+            let f = font(
+                &mut doc,
+                vec![
+                    ("Subtype", Object::name("Type0")),
+                    ("BaseFont", Object::name("Gen")),
+                    ("Encoding", Object::name("Identity-H")),
+                    ("ToUnicode", Object::Ref(tu)),
+                ],
+            );
+            let m = Metrics::from_dict(&doc, &f);
+            for code in 0..=320u32 {
+                let got = m.text_of(code).map(|t| t.into_owned());
+                assert_eq!(got, expected.get(&code).cloned(), "code {code:#06x} in {cmap}");
+            }
+            let mut reverse: HashMap<char, u32> = HashMap::new();
+            for (&code, text) in &expected {
+                if let Some(c) = only_char(text) {
+                    keep(&mut reverse, c, code);
+                }
+            }
+            let mut chars: Vec<char> = expected.values().flat_map(|t| t.chars()).chain(['A', '\u{FFFD}', '\u{0}', '\u{1D400}']).collect();
+            chars.sort_unstable();
+            chars.dedup();
+            for c in chars {
+                let want = reverse.get(&c).map(|code| code.to_be_bytes()[2..].to_vec());
+                assert_eq!(m.encode(&c.to_string()), want, "char {c:?} in {cmap}");
+            }
+        }
+    }
+
+    #[test]
+    fn fffd_lookups_skip_overridden_surrogates() {
+        // Each record maps every code to itself, so its surrogate offsets decode to U+FFFD. The last
+        // record overrides the surrogates with letters, so each lookup walks past them to U+FFFD itself.
+        let mut cmap = "1 beginbfrange <0000> <FFFF> <0000> endbfrange ".repeat(300);
+        cmap.push_str("1 beginbfrange <D800> <DFFF> <0041> endbfrange");
+        let mut doc = Document::new_empty();
+        let tu = doc.add(Object::Stream(Stream::from_raw(Dict::new(), cmap.into_bytes())));
+        let f = font(
+            &mut doc,
+            vec![
+                ("Subtype", Object::name("Type0")),
+                ("BaseFont", Object::name("Gen")),
+                ("Encoding", Object::name("Identity-H")),
+                ("ToUnicode", Object::Ref(tu)),
+            ],
+        );
+        let m = Metrics::from_dict(&doc, &f);
+        assert_eq!(m.encode("\u{FFFD}"), Some(vec![0xFF, 0xFD]));
+    }
+
+    #[test]
+    fn hostile_ranges_stay_bounded() {
+        // A range wider than 65 536 codes is ignored, a reversed one maps nothing, and a maximal
+        // one-code range maps just its own code.
+        let mut u = Unicode::default();
+        let cmap = b"1 beginbfrange <00000000> <FFFFFFFF> <0041> endbfrange \
+            1 beginbfrange <0005> <0001> <0041> endbfrange \
+            1 beginbfrange <FFFFFFFF> <FFFFFFFF> <FFFF> endbfrange";
+        parse_to_unicode(cmap, &mut u);
+        assert_eq!((u.ranges.len(), u.text(u32::MAX).as_deref()), (0, Some("\u{FFFF}")));
+    }
+
+    #[test]
+    fn low_codes_resolve_to_the_covering_range() {
+        let mut u = Unicode::default();
+        let cmap = b"1 beginbfrange <0005> <0007> <0041> endbfrange 1 beginbfrange <0064> <0065> <0042> endbfrange \
+            1 beginbfrange <0000FFFE> <00010001> <0043> endbfrange";
+        parse_to_unicode(cmap, &mut u);
+        let covered: Vec<u32> = (0..0x70).filter(|&c| u.covering(c).is_some()).collect();
+        assert_eq!(covered, [5, 6, 7, 100, 101]);
+        assert_eq!((u.covering(0xFFFF).is_some(), u.covering(0x1_0001).is_some(), u.covering(0x1_0002).is_none()), (true, true, true));
+    }
 }
diff --git a/crates/js/src/lib.rs b/crates/js/src/lib.rs
index d265a8b82..fd6ff82d5 100644
--- a/crates/js/src/lib.rs
+++ b/crates/js/src/lib.rs
@@ -247,6 +247,9 @@ fn strings(v: &JsValue, ctx: &mut Context) -> JsResult<Vec<String>> {
     {
         let a = JsArray::from_object(o.clone())?;
         let n = a.length(ctx)?;
+        if n > MAX_ARRAY_LENGTH {
+            return Err(error(format!("array length exceeds {MAX_ARRAY_LENGTH}")));
+        }
         let mut out = Vec::new();
         for i in 0..n {
             let x = a.get(i, ctx)?;
@@ -589,15 +592,23 @@ fn timer(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
 fn printf(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
     let fmt = text(&arg(args, 0), ctx)?;
     let mut out = String::new();
+    let check_output = |len: usize| -> JsResult<()> {
+        if len > MAX_PRINTF_OUTPUT_BYTES {
+            return Err(error(format!("util.printf output exceeds {MAX_PRINTF_OUTPUT_BYTES} bytes")));
+        }
+        Ok(())
+    };
     let mut next = 1;
     let mut chars = fmt.chars().peekable();
     while let Some(c) = chars.next() {
         if c != '%' {
+            check_output(out.len().saturating_add(c.len_utf8()))?;
             out.push(c);
             continue;
         }
         if chars.peek() == Some(&'%') {
             chars.next();
+            check_output(out.len().saturating_add(1))?;
             out.push('%');
             continue;
         }
@@ -619,7 +630,7 @@ fn printf(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue>
         }
         let mut width = 0usize;
         while let Some(d) = chars.peek().and_then(|d| d.to_digit(10)) {
-            width = width * 10 + d as usize;
+            width = width.saturating_mul(10).saturating_add(d as usize);
             chars.next();
         }
         let mut prec = None;
@@ -627,11 +638,14 @@ fn printf(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue>
             chars.next();
             let mut p = 0usize;
             while let Some(d) = chars.peek().and_then(|d| d.to_digit(10)) {
-                p = p * 10 + d as usize;
+                p = p.saturating_mul(10).saturating_add(d as usize);
                 chars.next();
             }
             prec = Some(p);
         }
+        if width > MAX_PRINTF_WIDTH_PRECISION || prec.is_some_and(|p| p > MAX_PRINTF_WIDTH_PRECISION) {
+            return Err(error(format!("util.printf width or precision exceeds {MAX_PRINTF_WIDTH_PRECISION}")));
+        }
         let conv = chars.next().unwrap_or('s');
         let v = arg(args, next);
         next += 1;
@@ -660,6 +674,7 @@ fn printf(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue>
             }
         };
         let pad = width.saturating_sub(body.chars().count());
+        check_output(out.len().saturating_add(pad).saturating_add(body.len()))?;
         if zero && matches!(conv, 'd' | 'f') {
             let (sign, digits) = if body.starts_with(['-', '+', ' ']) { body.split_at(1) } else { ("", body.as_str()) };
             out.push_str(sign);
@@ -992,6 +1007,13 @@ fn event_object(ctx: &mut Context, e: &Event) -> JsObject {
 
 /// Longest script, in bytes.
 pub(crate) const MAX_SCRIPT_BYTES: usize = 256 * 1024;
+/// Largest width or precision accepted by `util.printf`.
+const MAX_PRINTF_WIDTH_PRECISION: usize = 4096;
+/// Longest `util.printf` output, in bytes.
+const MAX_PRINTF_OUTPUT_BYTES: usize = 1 << 20;
+/// Longest array read item by item (`resetForm`, a field's `value` or colours). A sparse array's
+/// length costs the script nothing but the host one string per item; real lists are tiny.
+const MAX_ARRAY_LENGTH: u64 = 1 << 20;
 /// Deepest nesting of `(`, `[` and `{`.
 const MAX_BRACKET_DEPTH: usize = 64;
 /// Longest run of prefix operators (`!`, `~`, `+`, `-`).
diff --git a/crates/js/src/tests.rs b/crates/js/src/tests.rs
index e23915eac..cb8b99749 100644
--- a/crates/js/src/tests.rs
+++ b/crates/js/src/tests.rs
@@ -94,6 +94,124 @@ fn util_printf_printd_and_printx() {
     assert_eq!(o.value, "1,234,567.89|00042|hi|FF|1.234,50|Jan 5, 2024 09:07|Friday|(555) 123-4567|ABC");
 }
 
+fn assert_printf_error(script: &str, message: &str) {
+    let o = go(script, &Event::doc("Open"));
+    assert!(o.error.as_deref().is_some_and(|e| e.starts_with(message)), "{script}: {:?}", o.error);
+    let o = xfa::run_xfa(
+        script,
+        &xfa::XfaEvent { activity: "initialize".into(), target: "form1[0]".into(), ..Default::default() },
+        &xfa::XfaDoc::default(),
+        &xfa_model::form(),
+        Limits::default(),
+    );
+    assert!(o.error.as_deref().is_some_and(|e| e.starts_with(message)), "XFA: {script}: {:?}", o.error);
+}
+
+#[test]
+fn util_printf_rejects_large_width() {
+    assert_printf_error("util.printf('%99999999999d', 1)", "TypeError: util.printf width or precision exceeds 4096");
+}
+
+#[test]
+fn util_printf_rejects_large_precision() {
+    assert_printf_error("util.printf('%.99999999999f', 1)", "TypeError: util.printf width or precision exceeds 4096");
+}
+
+#[test]
+fn util_printf_rejects_overflowing_width() {
+    assert_printf_error("util.printf('%9999999999999999999999999999999999999999d', 1)", "TypeError: util.printf width or precision exceeds 4096");
+}
+
+#[test]
+fn util_printf_rejects_overflowing_precision() {
+    assert_printf_error("util.printf('%.9999999999999999999999999999999999999999f', 1)", "TypeError: util.printf width or precision exceeds 4096");
+}
+
+#[test]
+fn util_printf_rejects_limits_for_all_conversions() {
+    for conv in ['d', 'f', 's', 'x'] {
+        for spec in ["4097", ".4097", "99999999999", ".99999999999"] {
+            assert_printf_error(&format!("util.printf('%{spec}{conv}', 1)"), "TypeError: util.printf width or precision exceeds 4096");
+        }
+    }
+}
+
+#[test]
+fn util_printf_bounds_total_output() {
+    for script in [
+        "util.printf('%4096d'.repeat(300), 1)",
+        "util.printf('%04096d'.repeat(300), -1)",
+        "util.printf('aa'.repeat(524288) + 'a')",
+        "util.printf('é'.repeat(524289))",
+        "util.printf('%%%%'.repeat(524288) + '%%')",
+        "util.printf('%s', 'aa'.repeat(524288) + 'a')",
+        "util.printf('%s%s', 'aa'.repeat(524288), 'b')",
+    ] {
+        assert_printf_error(script, "TypeError: util.printf output exceeds 1048576 bytes");
+    }
+}
+
+#[test]
+fn util_printf_accepts_limits_and_preserves_formats() {
+    let o = go(
+        "event.value = [util.printf('%4096d', 1).length, util.printf('%04096d', -1).length, \
+         util.printf('%.4096f', 1).length, util.printf('%.4096s', 'a'.repeat(4097)).length, \
+         util.printf('%4096x', 255).length, util.printf('%.4096x', 255), \
+         util.printf('%4096d'.repeat(255) + '%4095d', 1).length, util.printf('%4096d'.repeat(256), 1).length, \
+         util.printf('é'.repeat(524288)).length, util.printf('a%%b:%+06d|%4s|%.2s|%x', 42, 'é', 'é界a', 255)].join('|');",
+        &Event::field("Calculate", "total", ""),
+    );
+    assert_eq!(o.error, None);
+    assert_eq!(o.value, "4096|4096|4098|4096|4096|FF|1048575|1048576|524288|a%b:+00042|   é|é界|FF");
+}
+
+fn assert_array_error(script: &str) {
+    let o = go(script, &Event::field("Calculate", "total", ""));
+    assert!(o.error.as_deref().is_some_and(|e| e.starts_with("TypeError: array length exceeds 1048576")), "{script}: {:?}", o.error);
+    assert!(o.requests.is_empty() && o.changed.is_empty(), "{script}");
+}
+
+#[test]
+fn reset_form_and_field_setters_refuse_huge_arrays() {
+    for script in [
+        "this.resetForm(new Array(4294967295))",
+        "getField('total').value = new Array(4294967295)",
+        "event.target.value = new Array(4294967295)",
+        "getField('total').textColor = new Array(4294967295)",
+        "getField('total').fillColor = new Array(4294967295)",
+    ] {
+        assert_array_error(script);
+    }
+}
+
+#[test]
+fn reset_form_and_field_setters_take_arrays_up_to_the_limit() {
+    let o = go("this.resetForm(new Array(1 << 20)); getField('total').value = new Array(1 << 20);", &Event::field("Calculate", "total", ""));
+    assert_eq!(o.error, None);
+    assert!(matches!(&o.requests[..], [Request::Reset(names)] if names.len() == 1 << 20 && names.iter().all(String::is_empty)));
+    assert_eq!(o.changed.iter().find(|f| f.name == "total").unwrap().value, [""]);
+    assert_array_error("this.resetForm(new Array((1 << 20) + 1))");
+    assert_array_error("getField('total').value = new Array((1 << 20) + 1)");
+}
+
+#[test]
+fn reset_form_and_field_setters_still_read_short_arrays() {
+    let mut f = fields();
+    f.push(FieldState::new("pick", FieldType::ListBox, vec![]));
+    let o = run(
+        "this.resetForm(['a', 'b']); getField('pick').value = ['x', 'y', 'z']; getField('total').value = ['x', 'y', 'z'];",
+        &Event::field("Calculate", "total", ""),
+        &doc(),
+        &f,
+        &[],
+        Limits::default(),
+    );
+    assert_eq!(o.error, None);
+    assert_eq!(o.requests, [Request::Reset(vec!["a".into(), "b".into()])]);
+    assert_eq!(o.changed.iter().find(|f| f.name == "pick").unwrap().value, ["x", "y", "z"]);
+    assert_eq!(o.changed.iter().find(|f| f.name == "total").unwrap().value, ["x"]);
+}
+
 #[test]
 fn document_requests_and_console() {
     let o = go(
diff --git a/crates/measure/src/snap.rs b/crates/measure/src/snap.rs
index f9eeb92d4..46455dcf4 100644
--- a/crates/measure/src/snap.rs
+++ b/crates/measure/src/snap.rs
@@ -321,7 +321,8 @@ impl Walker<'_> {
                     }
                 }
                 "S" | "s" | "f" | "F" | "f*" | "B" | "B*" | "b" | "b*" => {
-                    if matches!(String::from_utf8_lossy(&op.op).as_ref(), "s" | "b" | "b*")
+                    // Fills close open subpaths implicitly (ISO 32000-2 8.5.3.3); only a bare stroke leaves the path open.
+                    if String::from_utf8_lossy(&op.op).as_ref() != "S"
                         && let (Some(a), Some(b)) = (current, start)
                     {
                         path.edge(a, b);
diff --git a/crates/measure/src/tests.rs b/crates/measure/src/tests.rs
index 8cd701d05..1348a3ec3 100644
--- a/crates/measure/src/tests.rs
+++ b/crates/measure/src/tests.rs
@@ -120,6 +120,16 @@ fn rejects_invalid_geometry_and_unsupported_scales() {
     assert!(set_scale(&mut d, 0, [0.0; 4], "bad", &Scale::default()).is_err());
 }
 #[test]
+fn filled_open_triangle_snaps_to_closing_edge() {
+    for (op, closed) in [("f", true), ("F", true), ("f*", true), ("B", true), ("B*", true), ("h f", true), ("S", false)] {
+        let d = fixture(&format!("40 50 m 160 50 l 100 170 l {op}"), "", &[]);
+        let paths = snap::geometry(&d, 0).unwrap();
+        assert_eq!(paths.segments.len(), if closed { 3 } else { 2 }, "{op}");
+        let hit = paths.snap([70.0, 110.0], 5.0, snap::SnapOptions::default()).unwrap();
+        assert_eq!(hit.is_some(), closed, "{op}");
+    }
+}
+#[test]
 fn snap_paths_endpoints_midpoints_and_intersections() {
     let d = fixture("10 20 m 110 20 l S 60 0 m 60 80 l S 10 100 100 40 re S", "", &[]);
     let paths = snap::geometry(&d, 0).unwrap();
diff --git a/crates/ocr/src/lib.rs b/crates/ocr/src/lib.rs
index ae829d965..a34386c15 100644
--- a/crates/ocr/src/lib.rs
+++ b/crates/ocr/src/lib.rs
@@ -18,6 +18,11 @@ pub use pdfcraft_fonts::helvetica_width;
 pub const DETECTION_MODEL: &str = "text-detection.rten";
 pub const RECOGNITION_MODEL: &str = "text-recognition.rten";
 
+/// The recognition model's alphabet, as it was trained (ocrs-models' `DEFAULT_ALPHABET`): its
+/// output classes follow this order. The ocrs crate's own copy has an `E` where the training had
+/// `€`, which made a scanned "€250" read as "E250".
+pub const ALPHABET: &str = " 0123456789!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~€ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+
 /// The languages the models read (ISO 639-1); all use the Latin alphabet without accents.
 pub const LANGUAGES: &[(&str, &str)] = &[("en", "English")];
 
@@ -109,6 +114,7 @@ impl Ocr {
         let params = ocrs::OcrEngineParams {
             detection_model: Some(load(&models.detection)?),
             recognition_model: Some(load(&models.recognition)?),
+            alphabet: Some(ALPHABET.into()),
             ..Default::default()
         };
         let engine = ocrs::OcrEngine::new(params).map_err(|e| OcrError::Load("ocr engine".into(), e.to_string()))?;
@@ -278,6 +284,15 @@ mod tests {
     }
 
     /// The message tells end users what to do; release builds have no cargo.
+    #[test]
+    fn the_alphabet_is_the_trained_one() {
+        let chars: Vec<char> = ALPHABET.chars().collect();
+        assert_eq!(chars.len(), 96);
+        // The euro sign follows the ASCII punctuation (class 44; 0 is the CTC blank), not a second E.
+        assert_eq!(chars.iter().position(|&c| c == '€'), Some(43));
+        assert_eq!(chars.iter().filter(|&&c| c == 'E').count(), 1);
+    }
+
     #[test]
     fn missing_models_message_is_for_end_users() {
         let message = OcrError::NoModels.to_string();
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index 4f079e14b..8645c82bf 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -208,10 +208,19 @@ fn jpeg(px: &[u8], n: usize, w: u32, h: u32, quality: u8) -> Option<Vec<u8>> {
     Some(out)
 }
 
+/// Whether `decode` is the default decode array for `n` components ([0 1] each), which changes
+/// nothing. Scanners write it on page images (#490).
+fn is_identity_decode(doc: &Document, decode: &Object, n: usize) -> bool {
+    let decode = doc.resolve(decode);
+    let Some(a) = decode.as_array() else { return false };
+    a.len() == 2 * n && a.chunks(2).all(|p| matches!(p, [lo, hi] if doc.resolve(lo).as_f64() == Some(0.0) && doc.resolve(hi).as_f64() == Some(1.0)))
+}
+
 /// A new image stream from 8-bit samples: the original dictionary with the new size and filter.
+/// A decode array is dropped: only images without one, or with the default one, get here.
 fn image_stream(old: &Dict, px: &[u8], n: usize, w: u32, h: u32, compression: Compression, was_dct: bool) -> Option<Stream> {
     let mut d = old.clone();
-    for k in [&b"Filter"[..], b"DecodeParms", b"Length", b"DL"] {
+    for k in [&b"Filter"[..], b"DecodeParms", b"Decode", b"Length", b"DL"] {
         d.remove(k);
     }
     d.set(b"Width".to_vec(), Object::Int(w as i64));
@@ -239,7 +248,11 @@ fn image_stream(old: &Dict, px: &[u8], n: usize, w: u32, h: u32, compression: Co
 /// Returns the new image and its new soft mask, if the result is smaller.
 fn process(doc: &Document, s: &Stream, ppi: f64, settings: &ImageSettings, n: usize) -> Option<(Stream, Option<(ObjRef, Stream)>)> {
     let d = &s.dict;
-    if d.contains(b"Decode") || d.contains(b"Mask") || d.name(b"ImageMask").is_some() || matches!(d.get(b"ImageMask"), Some(Object::Bool(true))) {
+    if d.get(b"Decode").is_some_and(|a| !is_identity_decode(doc, a, n))
+        || d.contains(b"Mask")
+        || d.name(b"ImageMask").is_some()
+        || matches!(d.get(b"ImageMask"), Some(Object::Bool(true)))
+    {
         return None;
     }
     if d.int(b"BitsPerComponent") != Some(8) {
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index 7f241b680..5ebd006cb 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -5,11 +5,12 @@
 //!   smallest over its uses, through form XObjects); colour and grayscale images above a
 //!   threshold are resampled (bicubic) to a target resolution and recompressed as JPEG or Flate.
 //!   A new image replaces the old one only if it is smaller. Images PdfCraft can't decode
-//!   faithfully (CMYK and other colour spaces, masks, decode arrays, JPEG 2000, JBIG2, CCITT,
-//!   more than 8 bits) are left alone.
+//!   faithfully (CMYK and other colour spaces, masks, decode arrays other than the default,
+//!   JPEG 2000, JBIG2, CCITT, other than 8 bits) are left alone.
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings.
-//! - **Clean up:** Flate-compress streams that have no filter.
+//! - **Clean up:** drop images and forms that pages list but never draw (such as a deleted
+//!   image); Flate-compress streams that have no filter.
 //!
 //! Metadata, attachments, comments, scripts, private data, hidden layers, bookmarks and form
 //! fields are discarded by `pdfcraft-redact`'s Remove Hidden Information, which the engine
@@ -20,6 +21,7 @@
 mod audit;
 mod images;
 mod links;
+mod unused;
 
 pub use audit::{SpaceCategory, SpaceUse, audit_space};
 
@@ -125,6 +127,8 @@ pub struct Report {
     pub invalid_links: usize,
     pub invalid_bookmarks: usize,
     pub unreferenced_dests: usize,
+    /// Images and forms the pages listed but never drew, dropped (Clean Up).
+    pub unused_xobjects: usize,
 }
 
 /// Optimize `doc` in place.
@@ -132,8 +136,9 @@ pub fn optimize(doc: &mut Document, settings: &Settings) -> Result<Report, Optim
     optimize_with_progress(doc, settings, &mut |_| true)
 }
 
-/// [`optimize`], calling `progress` before each image and before the clean-up. Returning `false`
-/// stops with [`OptimizeError::Cancelled`]; `doc` is then partly optimized and should be dropped.
+/// [`optimize`], calling `progress` before each image and before the clean-up (and now and then
+/// during a long one). Returning `false` stops with [`OptimizeError::Cancelled`]; `doc` is then
+/// partly optimized and should be dropped.
 pub fn optimize_with_progress(doc: &mut Document, settings: &Settings, progress: &mut dyn FnMut(Stage) -> bool) -> Result<Report, OptimizeError> {
     let mut report = Report::default();
     let pages = pdfcraft_annot::page_refs(doc).map_err(|_| OptimizeError::NoPages)?;
@@ -141,6 +146,7 @@ pub fn optimize_with_progress(doc: &mut Document, settings: &Settings, progress:
     if !progress(Stage::CleanUp) {
         return Err(OptimizeError::Cancelled);
     }
+    report.unused_xobjects = unused::remove_unused(doc, &pages, progress)?;
     if settings.discard_thumbnails {
         for p in &pages {
             if doc.get(*p).as_dict().is_some_and(|d| d.contains(b"Thumb")) {
diff --git a/crates/optimize/src/unused.rs b/crates/optimize/src/unused.rs
new file mode 100644
index 000000000..b8c8a62b2
--- /dev/null
+++ b/crates/optimize/src/unused.rs
@@ -0,0 +1,304 @@
+//! Clean Up: drop image and form XObjects that a page lists in its resources but nothing draws,
+//! such as an image deleted with Edit a PDF (its `Do` goes, its resource entry stays). A full
+//! rewrite keeps every object that is still referenced, so without this the image would stay in
+//! the file.
+//!
+//! Removing a name something still draws would make content disappear, so the rule is simple
+//! and errs on the side of keeping:
+//! - only a page's own resources are cleaned: dictionaries nothing else refers to (resources
+//!   shared with other pages, forms or appearances, and inherited ones, are left alone);
+//! - a name goes only if it is written nowhere in any stream the document still uses, found by
+//!   scanning the bytes wherever the name appears. Nothing can draw a resource by name without
+//!   writing the name in a stream, whichever resources a viewer then looks it up in;
+//! - if any such stream can't be read exactly the way a viewer would read it, nothing is
+//!   removed. Only pictures (images in an image codec, used only as images) are skipped.
+//!
+//! So a name another page writes for its own image keeps this page's image of that name too.
+
+use std::collections::{HashMap, HashSet};
+
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
+
+use crate::{OptimizeError, Stage};
+
+/// Image codecs: a stream encoded with one holds picture data.
+const IMAGE_CODECS: [&[u8]; 6] = [b"DCTDecode", b"DCT", b"JPXDecode", b"JBIG2Decode", b"CCITTFaxDecode", b"CCF"];
+
+/// Most data decoded while looking for names, in all; past it nothing is removed.
+const DECODE_BUDGET: usize = 1 << 31;
+
+/// How much data is decoded between two checks for a cancel.
+const CANCEL_CHECK: usize = 64 << 20;
+
+/// Where a page's own `/XObject` dictionary is.
+#[derive(Clone, Copy, PartialEq, Eq, Hash)]
+enum Place {
+    /// An object of its own (`/XObject n 0 R`).
+    Own(ObjRef),
+    /// Directly in the page's resources object (`/Resources n 0 R`).
+    InResources(ObjRef),
+    /// Directly in resources written directly in the page.
+    InPage(ObjRef),
+}
+
+/// How an object is used where a reference to it appears.
+#[derive(Clone, Copy, PartialEq)]
+enum Use {
+    /// As a picture: an `/XObject` entry, `/SMask`, `/Mask`, `/Thumb` or an alternate `/Image`.
+    Picture,
+    /// As an `/XObject` dictionary (its entries are pictures or forms).
+    Entries,
+    Other,
+}
+
+/// The objects the document uses (everything a full rewrite keeps): how many references point
+/// at each, and which are referenced other than as a picture.
+struct Graph {
+    refs: HashMap<u32, usize>,
+    not_picture: HashSet<u32>,
+}
+
+fn graph(doc: &Document) -> Graph {
+    let child = |key: &[u8], parent: Use| match (parent, key) {
+        (Use::Entries, _) => Use::Picture,
+        (_, b"XObject") => Use::Entries,
+        (_, b"SMask" | b"Mask" | b"Thumb" | b"Image") => Use::Picture,
+        _ => Use::Other,
+    };
+    let mut g = Graph { refs: HashMap::new(), not_picture: HashSet::new() };
+    let mut stack: Vec<(Object, Use)> = doc.trailer().iter().map(|(_, v)| (v.clone(), Use::Other)).collect();
+    while let Some((obj, how)) = stack.pop() {
+        let expand = |d: &Dict, stack: &mut Vec<(Object, Use)>| stack.extend(d.iter().map(|(k, v)| (v.clone(), child(k, how))));
+        match obj {
+            Object::Ref(r) => {
+                if how != Use::Picture {
+                    g.not_picture.insert(r.num);
+                }
+                let n = g.refs.entry(r.num).or_default();
+                *n += 1;
+                if *n > 1 {
+                    continue;
+                }
+                match &*doc.get(r) {
+                    Object::Dict(d) => expand(d, &mut stack),
+                    Object::Stream(s) => expand(&s.dict, &mut stack),
+                    Object::Array(a) => stack.extend(a.iter().map(|v| (v.clone(), how))),
+                    _ => {}
+                }
+            }
+            Object::Dict(d) => expand(&d, &mut stack),
+            Object::Array(a) => stack.extend(a.into_iter().map(|v| (v, how))),
+            _ => {}
+        }
+    }
+    g
+}
+
+/// `page`'s own `/XObject` dictionary, if nothing else refers to it.
+fn own_xobjects(doc: &Document, page: ObjRef, refs: &HashMap<u32, usize>) -> Option<(Place, Dict)> {
+    let only_once = |r: &ObjRef| refs.get(&r.num) == Some(&1);
+    let p = doc.get(page);
+    let p = p.as_dict()?;
+    // A node with kids passes its resources on.
+    if p.name(b"Type") != Some(b"Page") || p.contains(b"Kids") {
+        return None;
+    }
+    let (res, place) = match p.get(b"Resources")? {
+        Object::Ref(r) if only_once(r) => (doc.get(*r).as_dict()?.clone(), Place::InResources(*r)),
+        Object::Dict(d) => (d.clone(), Place::InPage(page)),
+        _ => return None,
+    };
+    match res.get(b"XObject")? {
+        Object::Ref(x) if only_once(x) => Some((Place::Own(*x), doc.get(*x).as_dict()?.clone())),
+        Object::Dict(x) => Some((place, x.clone())),
+        _ => None,
+    }
+}
+
+fn hex(b: &u8) -> Option<u8> {
+    (*b as char).to_digit(16).map(|d| d as u8)
+}
+
+/// Record which of `wanted` (none longer than `longest`) are written in `data` (`/Name`, `#xx`
+/// escapes decoded), wherever they appear: operands, strings, comments or inline image data.
+fn find_names(data: &[u8], wanted: &HashSet<Vec<u8>>, longest: usize, found: &mut HashSet<Vec<u8>>) {
+    let regular =
+        |b: u8| !matches!(b, b'\0' | b'\t' | b'\n' | b'\x0C' | b'\r' | b' ' | b'(' | b')' | b'<' | b'>' | b'[' | b']' | b'{' | b'}' | b'/' | b'%');
+    let mut i = 0;
+    while let Some(slash) = data.get(i..).and_then(|rest| rest.iter().position(|&b| b == b'/')) {
+        let mut j = i + slash + 1;
+        let mut name = Vec::new();
+        let mut too_long = false;
+        while let Some(&b) = data.get(j) {
+            if !regular(b) {
+                break;
+            }
+            let (byte, step) = match (b, data.get(j + 1).and_then(hex), data.get(j + 2).and_then(hex)) {
+                (b'#', Some(h), Some(l)) => (h << 4 | l, 3),
+                _ => (b, 1),
+            };
+            if name.len() < longest {
+                name.push(byte);
+            } else {
+                too_long = true;
+            }
+            j += step;
+        }
+        if !too_long && wanted.contains(&name) {
+            found.insert(name);
+        }
+        i = j;
+    }
+}
+
+/// What a stream's data is, for finding names in it.
+enum Data {
+    /// A picture: image data in an image codec, used only as an image.
+    Picture,
+    Decoded(Vec<u8>),
+    /// Not readable exactly the way a viewer would read it.
+    Unknown,
+}
+
+/// Whether the document's security handler leaves metadata streams unencrypted.
+fn plain_metadata(doc: &Document) -> bool {
+    doc.trailer()
+        .get(b"Encrypt")
+        .map(|e| doc.resolve(e))
+        .is_some_and(|e| matches!(e.as_dict().and_then(|e| e.get(b"EncryptMetadata")), Some(Object::Bool(false))))
+}
+
+fn data(s: &Stream, num: u32, g: &Graph, encrypted: bool, plain_metadata: bool) -> Data {
+    let d = &s.dict;
+    // Streams the security handler leaves as stored, which a viewer may still decrypt.
+    let ty = d.name(b"Type");
+    if encrypted && (ty == Some(b"XRef") || (ty == Some(b"Metadata") && plain_metadata)) {
+        return Data::Unknown;
+    }
+    // External data, or a filter description that is abbreviated, indirect or doesn't line up:
+    // a viewer might decode it differently from this check.
+    if d.contains(b"F")
+        || d.contains(b"DP")
+        || matches!(d.get(b"Filter"), Some(Object::Ref(_)))
+        || matches!(d.get(b"DecodeParms"), Some(Object::Ref(_)))
+    {
+        return Data::Unknown;
+    }
+    let filters: Vec<&[u8]> = match d.get(b"Filter") {
+        None => Vec::new(),
+        Some(Object::Name(n)) => vec![n.as_slice()],
+        Some(Object::Array(a)) => {
+            let names: Vec<&[u8]> = a.iter().filter_map(Object::as_name).collect();
+            if names.len() != a.len() {
+                return Data::Unknown;
+            }
+            names
+        }
+        Some(_) => return Data::Unknown,
+    };
+    if filters.contains(&&b"Crypt"[..]) {
+        return Data::Unknown;
+    }
+    if filters.iter().any(|f| IMAGE_CODECS.contains(f)) {
+        // Viewers decode any stream's codec, so picture data skipped here must be a picture.
+        let picture = d.name(b"Subtype") == Some(b"Image") && !g.not_picture.contains(&num);
+        return if picture { Data::Picture } else { Data::Unknown };
+    }
+    // Parameters only as direct integers, which this check and viewers read alike.
+    let direct = |p: &Object| match p {
+        Object::Dict(p) => p.iter().all(|(_, v)| matches!(v, Object::Int(_))),
+        Object::Null => true,
+        _ => false,
+    };
+    let parms_line_up = match d.get(b"DecodeParms") {
+        None => true,
+        Some(p @ (Object::Dict(_) | Object::Null)) => filters.len() == 1 && direct(p),
+        Some(Object::Array(a)) => a.len() == filters.len() && a.iter().all(direct),
+        Some(_) => false,
+    };
+    if !parms_line_up {
+        return Data::Unknown;
+    }
+    s.decoded_strict().map_or(Data::Unknown, Data::Decoded)
+}
+
+/// Drop the image and form XObjects that `pages` list in their own resources but no stream
+/// names. Returns how many went. `progress` is asked again every [`CANCEL_CHECK`] bytes
+/// decoded; `false` cancels.
+pub(crate) fn remove_unused(doc: &mut Document, pages: &[ObjRef], progress: &mut dyn FnMut(Stage) -> bool) -> Result<usize, OptimizeError> {
+    let g = graph(doc);
+    let mut seen = HashSet::new();
+    let mut candidates = Vec::new();
+    for page in pages {
+        let Some((place, xobjects)) = own_xobjects(doc, *page, &g.refs) else { continue };
+        if !seen.insert(place) {
+            continue;
+        }
+        let names: Vec<Vec<u8>> = xobjects
+            .iter()
+            .filter(|(_, v)| matches!(&*doc.resolve(v), Object::Stream(s) if matches!(s.dict.name(b"Subtype"), Some(b"Image" | b"Form"))))
+            .map(|(name, _)| name.clone())
+            .collect();
+        if !names.is_empty() {
+            candidates.push((place, names));
+        }
+    }
+    let wanted: HashSet<Vec<u8>> = candidates.iter().flat_map(|(_, names)| names.iter().cloned()).collect();
+    let longest = wanted.iter().map(Vec::len).max().unwrap_or(0);
+    let (encrypted, plain_metadata) = (doc.trailer().contains(b"Encrypt"), plain_metadata(doc));
+    let mut written = HashSet::new();
+    let (mut decoded, mut next_check) = (0usize, CANCEL_CHECK);
+    for num in g.refs.keys() {
+        if written.len() == wanted.len() {
+            return Ok(0);
+        }
+        let obj = doc.get(ObjRef::new(*num, doc.generation(*num)));
+        let Object::Stream(s) = &*obj else { continue };
+        match data(s, *num, &g, encrypted, plain_metadata) {
+            Data::Picture => {}
+            Data::Decoded(bytes) => {
+                decoded = decoded.saturating_add(bytes.len());
+                if decoded > DECODE_BUDGET {
+                    return Ok(0);
+                }
+                if decoded >= next_check {
+                    next_check = decoded.saturating_add(CANCEL_CHECK);
+                    if !progress(Stage::CleanUp) {
+                        return Err(OptimizeError::Cancelled);
+                    }
+                }
+                find_names(&bytes, &wanted, longest, &mut written);
+            }
+            Data::Unknown => return Ok(0),
+        }
+    }
+    let mut removed = 0;
+    for (place, names) in candidates {
+        let gone: Vec<Vec<u8>> = names.into_iter().filter(|n| !written.contains(n)).collect();
+        if gone.is_empty() {
+            continue;
+        }
+        let strip = |x: &mut Dict| {
+            for n in &gone {
+                x.remove(n);
+            }
+        };
+        match place {
+            Place::Own(x) => doc.update_dict(x, strip)?,
+            Place::InResources(r) => doc.update_dict(r, |res| {
+                if let Some(Object::Dict(x)) = res.get_mut(b"XObject") {
+                    strip(x);
+                }
+            })?,
+            Place::InPage(p) => doc.update_dict(p, |d| {
+                if let Some(Object::Dict(res)) = d.get_mut(b"Resources")
+                    && let Some(Object::Dict(x)) = res.get_mut(b"XObject")
+                {
+                    strip(x);
+                }
+            })?,
+        }
+        removed += gone.len();
+    }
+    Ok(removed)
+}
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 9e698756a..ff4dc801a 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -131,6 +131,39 @@ fn images_are_measured_where_drawn_and_downsampled() {
     assert_ne!(&out.rgba[i..i + 3], &[255, 255, 255]);
 }
 
+#[test]
+fn an_identity_decode_array_does_not_stop_reduce() {
+    // Office scanners write /Decode [0 1 0 1 0 1] (no change) on their page images (#490).
+    let with_decode = |doc: &mut Document, r: ObjRef, decode: Vec<Object>| {
+        let mut s = stream(doc, r);
+        s.dict.set(b"Decode".to_vec(), Object::Array(decode));
+        doc.set(r, Object::Stream(s));
+    };
+    let mut doc = Document::new_empty();
+    // 900 px drawn 216 pt (3 in) wide → 300 ppi, like a scanned page.
+    let scan = image(&mut doc, 900, 900, 3, true, None);
+    with_decode(&mut doc, scan, [0, 1, 0, 1, 0, 1].map(Object::Int).to_vec());
+    let gray = image(&mut doc, 900, 900, 1, false, None);
+    with_decode(&mut doc, gray, vec![Object::Real(0.0), Object::Real(1.0)]);
+    // A decode array that inverts the colours, and one of the wrong length: left alone.
+    let inverted = image(&mut doc, 900, 900, 3, true, None);
+    with_decode(&mut doc, inverted, [1, 0, 1, 0, 1, 0].map(Object::Int).to_vec());
+    let odd = image(&mut doc, 900, 900, 3, true, None);
+    with_decode(&mut doc, odd, [0, 1].map(Object::Int).to_vec());
+    page(
+        &mut doc,
+        &[("S", scan), ("G", gray), ("I", inverted), ("O", odd)],
+        "q 216 0 0 216 0 0 cm /S Do Q q 216 0 0 216 216 0 cm /G Do Q q 216 0 0 216 0 300 cm /I Do Q q 216 0 0 216 216 300 cm /O Do Q",
+    );
+    let report = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(report.images_resampled, 2, "{report:?}");
+    assert_eq!(stream(&doc, scan).dict.int(b"Width"), Some(450));
+    assert_eq!(stream(&doc, gray).dict.int(b"Width"), Some(450));
+    assert!(!stream(&doc, scan).dict.contains(b"Decode"), "the default decode array isn't carried over");
+    assert_eq!(stream(&doc, inverted).dict.int(b"Width"), Some(900));
+    assert_eq!(stream(&doc, odd).dict.int(b"Width"), Some(900));
+}
+
 #[test]
 fn settings_choose_what_happens() {
     let mut doc = Document::new_empty();
@@ -304,3 +337,249 @@ fn progress_is_reported_per_image_and_a_refusal_cancels() {
     assert!(matches!(r, Err(OptimizeError::Cancelled)), "{r:?}");
     assert_eq!(calls, 2, "nothing runs after the refusal");
 }
+
+/// A page with `resources` and, if given, `contents`.
+fn raw_page(doc: &mut Document, resources: Object, contents: Option<ObjRef>) -> ObjRef {
+    let pages = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages"))).unwrap();
+    let mut p = Dict::new();
+    p.set(b"Type".to_vec(), Object::name("Page"));
+    p.set(b"Parent".to_vec(), Object::Ref(pages));
+    p.set(b"MediaBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 612.into(), 792.into()]));
+    p.set(b"Resources".to_vec(), resources);
+    if let Some(c) = contents {
+        p.set(b"Contents".to_vec(), Object::Ref(c));
+    }
+    let r = doc.add(Object::Dict(p));
+    doc.update_dict(pages, |d| {
+        let mut kids = d.get(b"Kids").and_then(|k| k.as_array().cloned()).unwrap_or_default();
+        kids.push(Object::Ref(r));
+        d.set(b"Count".to_vec(), Object::Int(kids.len() as i64));
+        d.set(b"Kids".to_vec(), Object::Array(kids));
+    })
+    .unwrap();
+    r
+}
+
+/// Builders for the tests below.
+fn xobjects(pairs: &[(&str, ObjRef)]) -> Dict {
+    let mut x = Dict::new();
+    for (n, r) in pairs {
+        x.set(n.as_bytes().to_vec(), Object::Ref(*r));
+    }
+    x
+}
+
+fn resources(x: Dict) -> Dict {
+    let mut res = Dict::new();
+    res.set(b"XObject".to_vec(), Object::Dict(x));
+    res
+}
+
+fn content(doc: &mut Document, c: &str) -> ObjRef {
+    doc.add(Object::Stream(Stream::flate(Dict::new(), c.as_bytes())))
+}
+
+fn form(doc: &mut Document, resources: Option<Object>, c: &str) -> ObjRef {
+    let mut d = Dict::new();
+    d.set(b"Subtype".to_vec(), Object::name("Form"));
+    d.set(b"BBox".to_vec(), Object::Array(vec![0.into(), 0.into(), 1.into(), 1.into()]));
+    if let Some(r) = resources {
+        d.set(b"Resources".to_vec(), r);
+    }
+    doc.add(Object::Stream(Stream::flate(d, c.as_bytes())))
+}
+
+fn xobject_names(doc: &Document, resources: &Object) -> Vec<String> {
+    let res = doc.resolve(resources);
+    let mut n: Vec<String> =
+        res.as_dict().unwrap().get(b"XObject").unwrap().as_dict().unwrap().iter().map(|(k, _)| String::from_utf8_lossy(k).into_owned()).collect();
+    n.sort();
+    n
+}
+
+fn page_xobjects(doc: &Document, page: ObjRef) -> Vec<String> {
+    let res = doc.get(page).as_dict().unwrap().get(b"Resources").unwrap().clone();
+    xobject_names(doc, &res)
+}
+
+fn count_images(bytes: &[u8]) -> usize {
+    let doc = Document::open(Arc::new(bytes.to_vec())).unwrap();
+    doc.object_numbers()
+        .into_iter()
+        .filter(|n| matches!(&*doc.get(ObjRef::new(*n, doc.generation(*n))), Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image")))
+        .count()
+}
+
+#[test]
+fn images_and_forms_nothing_draws_are_dropped() {
+    let mut doc = Document::new_empty();
+    let img = |doc: &mut Document| image(doc, 64, 64, 3, false, None);
+
+    // Edit a PDF deleting an image: the page gets a new content stream without the `Do`; the
+    // old one, which still names the image, is no longer used.
+    let t1 = img(&mut doc);
+    let old = content(&mut doc, "q 72 0 0 72 0 0 cm /ImT Do Q");
+    let t = raw_page(&mut doc, Object::Dict(resources(xobjects(&[("ImT", t1)]))), Some(old));
+    let new = content(&mut doc, "");
+    doc.update_dict(t, |p| p.set(b"Contents".to_vec(), Object::Ref(new))).unwrap();
+    // Dropped: a JPEG a page no longer draws, beside one it does.
+    let a1 = img(&mut doc);
+    let a2 = image(&mut doc, 64, 64, 3, true, None);
+    let c = content(&mut doc, "q 72 0 0 72 0 0 cm /Im1 Do Q");
+    let a = raw_page(&mut doc, Object::Dict(resources(xobjects(&[("Im1", a1), ("Im2", a2)]))), Some(c));
+    // Dropped from resources the page alone refers to, written as an object of their own.
+    let s1 = img(&mut doc);
+    let own = doc.add(Object::Dict(resources(xobjects(&[("Unused", s1)]))));
+    let c = content(&mut doc, "");
+    let s = raw_page(&mut doc, Object::Ref(own), Some(c));
+    // An image drawn only inside a form stays; one beside it goes.
+    let (d3, d4) = (img(&mut doc), img(&mut doc));
+    let f = form(&mut doc, None, "/Im3 Do");
+    let c = content(&mut doc, "/F Do");
+    let d = raw_page(&mut doc, Object::Dict(resources(xobjects(&[("F", f), ("Im3", d3), ("Im4", d4)]))), Some(c));
+
+    // Kept, though the page's own content doesn't name them:
+    // - drawn by a form with resources of its own that lack the name (renderers fall back to
+    //   the page's);
+    let k1 = img(&mut doc);
+    let mut procset = Dict::new();
+    procset.set(b"ProcSet".to_vec(), Object::Array(vec![Object::name("PDF")]));
+    let fk = form(&mut doc, Some(Object::Dict(procset)), "/ImK Do");
+    let c = content(&mut doc, "/Fk Do");
+    let k = raw_page(&mut doc, Object::Dict(resources(xobjects(&[("Fk", fk), ("ImK", k1)]))), Some(c));
+    // - drawn by a Type 3 glyph named like an inert key;
+    let g6 = img(&mut doc);
+    let glyph = content(&mut doc, "/Im6 Do");
+    let mut procs = Dict::new();
+    procs.set(b"P".to_vec(), Object::Ref(glyph));
+    let mut t3 = Dict::new();
+    t3.set(b"Type".to_vec(), Object::name("Font"));
+    t3.set(b"Subtype".to_vec(), Object::name("Type3"));
+    t3.set(b"CharProcs".to_vec(), Object::Dict(procs));
+    let mut fonts = Dict::new();
+    fonts.set(b"T3".to_vec(), Object::Dict(t3));
+    let mut res = resources(xobjects(&[("Im6", g6)]));
+    res.set(b"Font".to_vec(), Object::Dict(fonts));
+    let c = content(&mut doc, "BT /T3 1 Tf (P) Tj ET");
+    let g = raw_page(&mut doc, Object::Dict(res), Some(c));
+    // - after an inline image whose data runs into the operators (no space before `EI`), or
+    //   given as the second of two operands;
+    let (l1, l2) = (img(&mut doc), img(&mut doc));
+    let c = content(&mut doc, "BI /W 1 /H 1 /BPC 8 /CS /G /F /AHx ID 00>EI Q q /ImL Do Q /Other /ImL2 Do");
+    let l = raw_page(&mut doc, Object::Dict(resources(xobjects(&[("ImL", l1), ("ImL2", l2)]))), Some(c));
+    // - drawn by a form field that is on no page;
+    let z1 = img(&mut doc);
+    let c = content(&mut doc, "");
+    let z = raw_page(&mut doc, Object::Dict(resources(xobjects(&[("Z1", z1)]))), Some(c));
+    let wap = form(&mut doc, None, "/Z1 Do");
+    let mut appearance = Dict::new();
+    appearance.set(b"N".to_vec(), Object::Ref(wap));
+    let mut widget = Dict::new();
+    widget.set(b"Subtype".to_vec(), Object::name("Widget"));
+    widget.set(b"AP".to_vec(), Object::Dict(appearance));
+    let widget = doc.add(Object::Dict(widget));
+    let mut acroform = Dict::new();
+    acroform.set(b"Fields".to_vec(), Object::Array(vec![Object::Ref(widget)]));
+    let root = doc.root().unwrap();
+    doc.update_dict(root, |c| c.set(b"AcroForm".to_vec(), Object::Dict(acroform))).unwrap();
+    // - in resources shared by pages (or with an annotation's appearance), or inherited from the
+    //   page tree: left alone;
+    let (b1, b2) = (img(&mut doc), img(&mut doc));
+    let shared = doc.add(Object::Dict(resources(xobjects(&[("X1", b1), ("X2", b2)]))));
+    let c = content(&mut doc, "0 0 m");
+    raw_page(&mut doc, Object::Ref(shared), Some(c));
+    let c = content(&mut doc, "/X1 Do");
+    raw_page(&mut doc, Object::Ref(shared), Some(c));
+    let (inh, unused_inh) = (img(&mut doc), img(&mut doc));
+    let tree = doc.root().and_then(|r| doc.get(r).as_dict().and_then(|d| d.reference(b"Pages"))).unwrap();
+    doc.update_dict(tree, |d| d.set(b"Resources".to_vec(), Object::Dict(resources(xobjects(&[("Inh", inh), ("Old", unused_inh)]))))).unwrap();
+    // - named by another page for its own image.
+    let (r1, r2) = (img(&mut doc), img(&mut doc));
+    let c = content(&mut doc, "");
+    let r = raw_page(&mut doc, Object::Dict(resources(xobjects(&[("Im9", r1)]))), Some(c));
+    let c = content(&mut doc, "/Im9 Do");
+    raw_page(&mut doc, Object::Dict(resources(xobjects(&[("Im9", r2)]))), Some(c));
+
+    let before = write_full(&doc, &SaveOptions::default()).unwrap();
+    let report = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(report.unused_xobjects, 4, "{report:?}");
+    assert!(page_xobjects(&doc, t).is_empty(), "the deleted image goes");
+    assert_eq!(page_xobjects(&doc, a), ["Im1"]);
+    assert!(xobject_names(&doc, &Object::Ref(own)).is_empty());
+    assert!(page_xobjects(&doc, s).is_empty());
+    assert_eq!(page_xobjects(&doc, d), ["F", "Im3"]);
+    assert_eq!(page_xobjects(&doc, k), ["Fk", "ImK"]);
+    assert_eq!(page_xobjects(&doc, g), ["Im6"]);
+    assert_eq!(page_xobjects(&doc, l), ["ImL", "ImL2"]);
+    assert_eq!(page_xobjects(&doc, z), ["Z1"]);
+    assert_eq!(xobject_names(&doc, &Object::Ref(shared)), ["X1", "X2"]);
+    assert_eq!(page_xobjects(&doc, tree), ["Inh", "Old"]);
+    assert_eq!(page_xobjects(&doc, r), ["Im9"]);
+    let after = write_full(&doc, &SaveOptions::default()).unwrap();
+    assert_eq!((count_images(&before), count_images(&after)), (17, 13), "the dropped images are gone from the file");
+}
+
+#[test]
+fn nothing_is_dropped_when_a_stream_cannot_be_checked() {
+    // A page with an image nothing draws, and an appearance stream on it.
+    let build = |stream: Stream| {
+        let mut doc = Document::new_empty();
+        let unused = image(&mut doc, 64, 64, 3, false, None);
+        let c = content(&mut doc, "");
+        let page = raw_page(&mut doc, Object::Dict(resources(xobjects(&[("Im1", unused)]))), Some(c));
+        let other = doc.add(Object::Stream(stream));
+        let mut appearance = Dict::new();
+        appearance.set(b"N".to_vec(), Object::Ref(other));
+        let mut annot = Dict::new();
+        annot.set(b"AP".to_vec(), Object::Dict(appearance));
+        doc.update_dict(page, |p| p.set(b"Annots".to_vec(), Object::Array(vec![Object::Dict(annot)]))).unwrap();
+        let report = optimize(&mut doc, &Settings::default()).unwrap();
+        (report.unused_xobjects, page_xobjects(&doc, page))
+    };
+    let (gone, kept) = ((1, Vec::<String>::new()), (0, vec!["Im1".to_string()]));
+    // Valid compressed data with extra keys.
+    let flate = |extra: &[(&str, Object)]| {
+        let mut s = Stream::flate(Dict::new(), b"0 0 m");
+        s.dict.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        for (k, v) in extra {
+            s.dict.set(k.as_bytes().to_vec(), v.clone());
+        }
+        s
+    };
+    let parms = |k: &str, v: Object| {
+        let mut p = Dict::new();
+        p.set(k.as_bytes().to_vec(), v);
+        Object::Dict(p)
+    };
+    // Readable: the image goes.
+    assert_eq!(build(flate(&[])), gone);
+    assert_eq!(build(flate(&[("DecodeParms", parms("Predictor", Object::Int(1)))])), gone);
+    // The name written with an escape still counts.
+    assert_eq!(build(Stream::flate(Dict::new(), b"/Im#31 Do")), kept);
+    // Read differently by viewers, or not at all: nothing goes.
+    let dangling = Object::Ref(ObjRef::new(999, 0));
+    let cases = [
+        Stream::from_raw(flate(&[]).dict, b"not zlib data".to_vec()),
+        flate(&[("Filter", dangling.clone())]),
+        flate(&[("Filter", Object::Array(vec![Object::name("FlateDecode"), dangling.clone()]))]),
+        flate(&[("Filter", Object::Array(vec![Object::name("Crypt"), Object::name("FlateDecode")]))]),
+        flate(&[("DP", parms("Predictor", Object::Int(1)))]),
+        flate(&[("DecodeParms", Object::Array(vec![Object::Dict(Dict::new()), Object::Dict(Dict::new())]))]),
+        flate(&[("DecodeParms", parms("Predictor", dangling))]),
+        flate(&[("DecodeParms", parms("Predictor", Object::Real(12.5)))]),
+        flate(&[("F", Object::name("external.dat"))]),
+        // An image codec on a stream drawn as an appearance: viewers decode it as content.
+        Stream::from_raw(
+            {
+                let mut d = Dict::new();
+                d.set(b"Filter".to_vec(), Object::name("CCITTFaxDecode"));
+                d
+            },
+            vec![0; 8],
+        ),
+    ];
+    for s in cases {
+        let dict = s.dict.clone();
+        assert_eq!(build(s), kept, "{dict:?}");
+    }
+}
diff --git a/crates/organize/src/dedupe.rs b/crates/organize/src/dedupe.rs
index 020c0df22..fe5cb0749 100644
--- a/crates/organize/src/dedupe.rs
+++ b/crates/organize/src/dedupe.rs
@@ -10,7 +10,10 @@
 //!   encoding dictionaries, and colour-space arrays. Objects whose *identity* matters (pages,
 //!   annotations, form fields, layers, outline items, structure elements) are never merged.
 //! - Two objects are equal when they are structurally identical with references compared after
-//!   merging, so a font dictionary merges once its font file has. This runs to a fixpoint.
+//!   merging, so a font dictionary merges once its font file has. This runs to a fixpoint. A
+//!   reference to a plain value (a name, number, boolean or string, such as ImageMagick's
+//!   `/ColorSpace 10 0 R` → `/DeviceRGB`) compares as that value; the value objects themselves
+//!   are never merged.
 //! - Only `candidates` (objects created by the operation) are ever replaced or rewritten. Existing
 //!   objects can serve as the merge target but are not changed, so an incremental save stays
 //!   small.
@@ -84,7 +87,14 @@ fn canon(map: &HashMap<ObjRef, ObjRef>, mut r: ObjRef) -> ObjRef {
     r
 }
 
-fn hash_obj(o: &Object, map: &HashMap<ObjRef, ObjRef>, h: &mut impl Hasher) {
+/// The value behind `r` when it is a plain value (name, number, boolean or string): it then
+/// means that value wherever it is used, whichever object holds it (#878).
+fn plain_value(doc: &Document, r: ObjRef) -> Option<std::sync::Arc<Object>> {
+    let o = doc.get(r);
+    matches!(*o, Object::Bool(_) | Object::Int(_) | Object::Real(_) | Object::Name(_) | Object::String(_)).then_some(o)
+}
+
+fn hash_obj(o: &Object, doc: &Document, map: &HashMap<ObjRef, ObjRef>, h: &mut impl Hasher) {
     match o {
         Object::Null => 0u8.hash(h),
         Object::Bool(b) => (1u8, b).hash(h),
@@ -95,7 +105,7 @@ fn hash_obj(o: &Object, map: &HashMap<ObjRef, ObjRef>, h: &mut impl Hasher) {
         Object::Array(a) => {
             (6u8, a.len()).hash(h);
             for x in a {
-                hash_obj(x, map, h);
+                hash_obj(x, doc, map, h);
             }
         }
         Object::Dict(d) => {
@@ -104,28 +114,39 @@ fn hash_obj(o: &Object, map: &HashMap<ObjRef, ObjRef>, h: &mut impl Hasher) {
             for (k, v) in d.iter() {
                 let mut eh = std::collections::hash_map::DefaultHasher::new();
                 k.hash(&mut eh);
-                hash_obj(v, map, &mut eh);
+                hash_obj(v, doc, map, &mut eh);
                 acc = acc.wrapping_add(eh.finish());
             }
             (7u8, d.len(), acc).hash(h);
         }
         Object::Stream(s) => {
             8u8.hash(h);
-            hash_obj(&Object::Dict(s.dict.clone()), map, h);
+            hash_obj(&Object::Dict(s.dict.clone()), doc, map, h);
             s.raw[..].hash(h);
         }
         Object::Ref(r) => {
             let c = canon(map, *r);
-            (9u8, c.num, c.generation).hash(h);
+            match plain_value(doc, c) {
+                Some(v) => hash_obj(&v, doc, map, h),
+                None => (9u8, c.num, c.generation).hash(h),
+            }
         }
     }
 }
 
-fn eq_obj(a: &Object, b: &Object, map: &HashMap<ObjRef, ObjRef>) -> bool {
+fn eq_obj(a: &Object, b: &Object, doc: &Document, map: &HashMap<ObjRef, ObjRef>) -> bool {
+    // Plain values behind references compare as the values (as `hash_obj` hashes them).
+    let plain = |o: &Object| if let Object::Ref(r) = o { plain_value(doc, canon(map, *r)) } else { None };
+    match (plain(a), plain(b)) {
+        (Some(x), Some(y)) => return eq_obj(&x, &y, doc, map),
+        (Some(x), None) => return eq_obj(&x, b, doc, map),
+        (None, Some(y)) => return eq_obj(a, &y, doc, map),
+        (None, None) => {}
+    }
     match (a, b) {
-        (Object::Array(x), Object::Array(y)) => x.len() == y.len() && x.iter().zip(y).all(|(p, q)| eq_obj(p, q, map)),
-        (Object::Dict(x), Object::Dict(y)) => x.len() == y.len() && x.iter().all(|(k, v)| y.get(k).is_some_and(|w| eq_obj(v, w, map))),
-        (Object::Stream(x), Object::Stream(y)) => x.raw == y.raw && eq_obj(&Object::Dict(x.dict.clone()), &Object::Dict(y.dict.clone()), map),
+        (Object::Array(x), Object::Array(y)) => x.len() == y.len() && x.iter().zip(y).all(|(p, q)| eq_obj(p, q, doc, map)),
+        (Object::Dict(x), Object::Dict(y)) => x.len() == y.len() && x.iter().all(|(k, v)| y.get(k).is_some_and(|w| eq_obj(v, w, doc, map))),
+        (Object::Stream(x), Object::Stream(y)) => x.raw == y.raw && eq_obj(&Object::Dict(x.dict.clone()), &Object::Dict(y.dict.clone()), doc, map),
         (Object::Ref(x), Object::Ref(y)) => canon(map, *x) == canon(map, *y),
         (Object::Real(x), Object::Real(y)) => x.to_bits() == y.to_bits(),
         (Object::String(x), Object::String(y)) => x.bytes == y.bytes,
@@ -201,9 +222,9 @@ pub fn dedupe_resources(doc: &mut Document, candidates: &[ObjRef], index_existin
                 continue;
             }
             let mut h = std::collections::hash_map::DefaultHasher::new();
-            hash_obj(o, &map, &mut h);
+            hash_obj(o, doc, &map, &mut h);
             let bucket = buckets.entry(h.finish()).or_default();
-            let target = bucket.iter().map(|j| &universe[*j]).find(|(_, other)| eq_obj(o, other, &map)).map(|(t, _)| *t);
+            let target = bucket.iter().map(|j| &universe[*j]).find(|(_, other)| eq_obj(o, other, doc, &map)).map(|(t, _)| *t);
             match target {
                 Some(t) if cand.contains(r) => {
                     map.insert(*r, t);
@@ -304,6 +325,35 @@ mod tests {
         assert_eq!(doc.get(p1), doc.get(p2), "both pages now use the one graphics state");
     }
 
+    fn image(doc: &mut Document, colour_space: Object) -> ObjRef {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"ColorSpace".to_vec(), colour_space);
+        doc.add(Object::Stream(Stream { dict: d, raw: b"pixels".to_vec().into() }))
+    }
+
+    #[test]
+    fn references_to_plain_values_compare_as_the_values() {
+        // ImageMagick writes `/ColorSpace 10 0 R` with `10 0 obj /DeviceRGB`, one per file (#878).
+        let mut doc = Document::new_empty();
+        let rgb1 = doc.add(Object::name("DeviceRGB"));
+        let rgb2 = doc.add(Object::name("DeviceRGB"));
+        let grey = doc.add(Object::name("DeviceGray"));
+        let a = image(&mut doc, Object::Ref(rgb1));
+        let b = image(&mut doc, Object::Ref(rgb2));
+        let c = image(&mut doc, Object::name("DeviceRGB")); // written directly: the same image
+        let d = image(&mut doc, Object::Ref(grey)); // same pixels, another colour space
+        let mut page = Dict::new();
+        page.set(b"Images".to_vec(), Object::Array([a, b, c, d].map(Object::Ref).to_vec()));
+        let p = doc.add(Object::Dict(page));
+        assert_eq!(dedupe_resources(&mut doc, &[rgb1, rgb2, grey, a, b, c, d, p], false), 2);
+        let page = doc.get(p);
+        let images = page.as_dict().unwrap().get(b"Images").unwrap().as_array().unwrap().clone();
+        assert_eq!(images, [a, a, a, d].map(Object::Ref).to_vec());
+        let nums = doc.object_numbers();
+        assert!(nums.contains(&rgb1.num) && nums.contains(&rgb2.num), "the values themselves are never merged");
+    }
+
     #[test]
     fn existing_objects_are_targets_but_never_changed() {
         let mut doc = Document::new_empty();
diff --git a/crates/organize/src/import.rs b/crates/organize/src/import.rs
index 9b68dc2ed..b3342c9b4 100644
--- a/crates/organize/src/import.rs
+++ b/crates/organize/src/import.rs
@@ -237,8 +237,19 @@ fn import_pages_mapped(dst: &mut Document, src: &Document, src_pages: &[usize],
     let mut new_pages = Vec::new();
     let mut done: HashMap<ObjRef, ObjRef> = HashMap::new();
     for (page, new, inherited) in targets {
-        // A page listed twice: make a second, independent page object sharing resources.
-        let new = if done.contains_key(&page) { dst.add(Object::Null) } else { new };
+        // A page listed twice: make a second, independent page object sharing resources, and
+        // with copies of its own annotations (an annotation belongs to one page: its `/P`, its
+        // popup, a widget's place). Destinations still map to the pages copied.
+        let repeat = done.contains_key(&page);
+        let new = if repeat { dst.add(Object::Null) } else { new };
+        let mut own = repeat.then(|| Copier {
+            src,
+            map: HashMap::new(),
+            pages: copier.pages.clone(),
+            annots: Vec::new(),
+            fields: Vec::new(),
+            ocgs: Vec::new(),
+        });
         let src_dict = src.get(page).as_dict().cloned().unwrap_or_default();
         let mut d = Dict::new();
         for (k, v) in src_dict.iter() {
@@ -249,13 +260,48 @@ fn import_pages_mapped(dst: &mut Document, src: &Document, src_pages: &[usize],
                 let list = src.resolve(v).as_array().cloned().unwrap_or_default();
                 let mut out = Vec::new();
                 for a in list {
+                    // On a repeated page a form field's widget becomes one more widget of the
+                    // same field (copied already with the page's first copy): one field, one
+                    // value, shown on both pages. Copying the field again would make two fields
+                    // of one name, filled in separately.
+                    let resolved = src.resolve(&a);
+                    let field = resolved.as_dict().filter(|d| d.name(b"Subtype") == Some(b"Widget")).and_then(|d| d.reference(b"Parent"));
+                    if repeat
+                        && let Some(parent) = field
+                        && let Some(copied) = copier.map.get(&parent).copied()
+                    {
+                        let r = dst.add(Object::Null);
+                        let c = copier.copy_value(dst, &resolved, Some(r));
+                        dst.set(r, c);
+                        // `/Kids` may be an array object of its own: add to it there, so the
+                        // field keeps its other widgets.
+                        match dst.get(copied).as_dict().and_then(|f| f.get(b"Kids").cloned()) {
+                            Some(Object::Ref(list)) => {
+                                let mut kids = dst.get(list).as_array().cloned().unwrap_or_default();
+                                kids.push(Object::Ref(r));
+                                dst.set(list, Object::Array(kids));
+                            }
+                            _ => dst.update_dict(copied, |f| {
+                                let mut kids = f.get(b"Kids").and_then(|k| k.as_array()).cloned().unwrap_or_default();
+                                kids.push(Object::Ref(r));
+                                f.set(b"Kids".to_vec(), Object::Array(kids));
+                            })?,
+                        }
+                        annot_pages.insert(r, new);
+                        out.push(Object::Ref(r));
+                        continue;
+                    }
+                    // A widget that is its own field (no parent to hang a second widget on) stays
+                    // the one object, shown on both pages, so the field stays one.
+                    let own_field = resolved.as_dict().is_some_and(|d| d.name(b"Subtype") == Some(b"Widget") && !d.contains(b"Parent"));
+                    let annots = if own_field { &mut copier } else { own.as_mut().unwrap_or(&mut copier) };
                     // Direct (inline) annotation dictionaries become indirect objects, so every
                     // copied annotation can be fixed up the same way.
                     let r = match a {
-                        Object::Ref(r) => copier.copy_ref(dst, r),
+                        Object::Ref(r) => annots.copy_ref(dst, r),
                         Object::Dict(_) => {
                             let r = dst.add(Object::Null);
-                            let c = copier.copy_value(dst, &a, Some(r));
+                            let c = annots.copy_value(dst, &a, Some(r));
                             dst.set(r, c);
                             r
                         }
@@ -280,6 +326,12 @@ fn import_pages_mapped(dst: &mut Document, src: &Document, src_pages: &[usize],
         d.set(b"Type".to_vec(), Object::name("Page"));
         d.set(b"Parent".to_vec(), Object::Ref(root));
         dst.set(new, Object::Dict(d));
+        // The repeat's own annotations are fixed up, its fields and layers registered, with the rest.
+        if let Some(own) = own {
+            copier.annots.extend(own.annots);
+            copier.fields.extend(own.fields);
+            copier.ocgs.extend(own.ocgs);
+        }
         done.insert(page, new);
         new_pages.push(new);
     }
@@ -529,6 +581,85 @@ pub fn combine_selected(sources: &[(&str, &Document, Option<&[usize]>)]) -> Resu
     Ok(out)
 }
 
+/// One run of pages for [`combine_grouped`]: the file it comes from (`group`: runs with the same
+/// group are one file split around, and give the same document), its title, the document, and
+/// its pages (0-based, in that order; `None` for all of them).
+pub type Run<'a> = (usize, &'a str, &'a Document, Option<&'a [usize]>);
+
+/// Combine Files where a file's pages may be split into several runs with other files' pages
+/// between them. Each file (group) is copied once, all its pages together, then the pages are put
+/// in the runs' order: its links between its own pages, its form fields and its attachments stay
+/// whole, and it gets one top-level bookmark (the title of its first run) at its first page, its
+/// own bookmarks nested. Otherwise as [`combine_selected`] (print standard, shared resources).
+pub fn combine_grouped(runs: &[Run<'_>]) -> Result<Document, OrganizeError> {
+    // Each file's pages, in the order its runs list them, and each run's place in that list.
+    struct File<'a> {
+        title: &'a str,
+        src: &'a Document,
+        pages: Vec<usize>,
+    }
+    let mut files: Vec<(usize, File<'_>)> = Vec::new();
+    let mut slices: Vec<(usize, usize, usize)> = Vec::with_capacity(runs.len());
+    for (group, title, src, chosen) in runs {
+        let at = match files.iter().position(|(g, _)| g == group) {
+            Some(at) => at,
+            None => {
+                files.push((*group, File { title, src, pages: Vec::new() }));
+                files.len() - 1
+            }
+        };
+        let Some((_, file)) = files.get_mut(at) else { continue };
+        let n = crate::page_count(file.src)?;
+        let pages: Vec<usize> = match chosen {
+            Some(p) => {
+                if let Some(bad) = p.iter().find(|i| **i >= n) {
+                    return Err(OrganizeError::NoSuchPage(*bad));
+                }
+                p.to_vec()
+            }
+            None => (0..n).collect(),
+        };
+        slices.push((at, file.pages.len(), pages.len()));
+        file.pages.extend(pages);
+    }
+    let mut out = Document::new_empty();
+    let mut marks = Vec::new();
+    let mut attachments = Vec::new();
+    let mut copies: Vec<Vec<ObjRef>> = Vec::with_capacity(files.len());
+    let mut standard: Option<(crate::pdfx::PrintStandard, &Document, HashMap<ObjRef, ObjRef>)> = None;
+    let mut agreed = true;
+    for (_, file) in &files {
+        let at = crate::page_count(&out)?;
+        let imported = import_pages_mapped(&mut out, file.src, &file.pages, at)?;
+        copies.push(imported.pages.clone());
+        if let Some(first) = imported.pages.first() {
+            marks.push((file.title.to_string(), *first, file.src, imported.page_map));
+        }
+        collect_attachments(&mut out, file.src, &mut attachments);
+        let declared = crate::pdfx::PrintStandard::of(file.src);
+        match &standard {
+            None => standard = Some((declared, file.src, imported.objects)),
+            Some((first, _, _)) => agreed &= first.same_as(&declared),
+        }
+    }
+    // The pages in the runs' order. A file's first run comes before its others, and its pages
+    // were copied in run order, so its bookmark (its first copied page) is its first page shown.
+    let mut order: Vec<(ObjRef, Dict)> = Vec::new();
+    for (file, start, len) in slices {
+        let run = copies.get(file).and_then(|c| c.get(start..start.saturating_add(len))).unwrap_or_default();
+        order.extend(run.iter().map(|r| (*r, Dict::new())));
+    }
+    rebuild(&mut out, &order)?;
+    if let Some((declared, src, objects)) = standard.filter(|_| agreed) {
+        crate::pdfx::carry(&mut out, src, &declared, objects)?;
+    }
+    let all: Vec<ObjRef> = out.object_numbers().into_iter().map(|n| ObjRef::new(n, out.generation(n))).collect();
+    crate::dedupe::dedupe_resources(&mut out, &all, false);
+    add_outline(&mut out, &marks)?;
+    set_attachments(&mut out, attachments)?;
+    Ok(out)
+}
+
 /// Copy a source's document-level attachments (`/Names /EmbeddedFiles`) into `dst`.
 fn collect_attachments(dst: &mut Document, src: &Document, out: &mut Vec<(Vec<u8>, Object)>) {
     let Some(tree) = src
diff --git a/crates/organize/src/labels.rs b/crates/organize/src/labels.rs
index 46211a984..c351adc04 100644
--- a/crates/organize/src/labels.rs
+++ b/crates/organize/src/labels.rs
@@ -7,7 +7,7 @@
 
 use std::collections::HashSet;
 
-use pdfcraft_cos::page_labels::{MAX_LABEL_BYTES, MAX_LABEL_TOTAL_BYTES, MAX_LABEL_TREE_DEPTH, MAX_LABEL_TREE_WORK, MAX_PREFIX_BYTES, alpha, roman};
+use pdfcraft_cos::page_labels::{MAX_LABEL_BYTES, MAX_LABEL_TREE_DEPTH, MAX_LABEL_TREE_WORK, MAX_PREFIX_BYTES, alpha, roman};
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString};
 
 use crate::{OrganizeError, page_count, pages_root};
@@ -232,40 +232,114 @@ fn checked_ranges(doc: &Document) -> Result<Vec<LabelRange>, OrganizeError> {
     Ok(unique)
 }
 
-/// Every page's label. `lenient` (reading a file): a range whose label can't be formatted
-/// shows physical page numbers for its pages instead of failing every label.
-fn labels_from_ranges(n: usize, ranges: &[LabelRange], lenient: bool) -> Result<Vec<String>, OrganizeError> {
-    let mut labels = Vec::new();
-    let mut total = 0usize;
-    let mut ranges = ranges.iter().peekable();
-    let mut active = None;
-    for p in 0..n {
-        while ranges.peek().is_some_and(|r| r.start <= p) {
-            active = ranges.next();
-        }
-        let label = match active {
-            Some(r) => {
-                let label = match r.label(p) {
-                    Ok(label) => label,
-                    Err(_) if lenient => String::new(),
-                    Err(e) => return Err(e),
-                };
-                total = total.checked_add(label.len()).ok_or_else(|| invalid_label("the total label size overflows"))?;
-                if total > MAX_LABEL_TOTAL_BYTES {
-                    return Err(invalid_label("custom labels exceed 4 MiB in total"));
-                }
-                if label.is_empty() { (p + 1).to_string() } else { label }
-            }
-            None => (p + 1).to_string(),
-        };
-        labels.push(label);
-    }
-    Ok(labels)
+/// A view of every page's label: the sorted ranges and the page count, with no string kept per
+/// page. [`PageLabels::label`] builds one label; [`PageLabels::iter`] builds them one at a time, so
+/// memory follows the ranges, not the pages.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PageLabels {
+    ranges: Vec<LabelRange>,
+    pages: usize,
 }
 
-/// Every page's label, as a viewer shows it. Resource limits return an actionable error.
+impl PageLabels {
+    /// Reads the document's `/PageLabels` and page count. A tree that is cyclic, too deep or too
+    /// large is an error.
+    pub fn new(doc: &Document) -> Result<Self, OrganizeError> {
+        Ok(Self { ranges: checked_ranges(doc)?, pages: page_count(doc)? })
+    }
+
+    /// The number of pages the labels cover.
+    pub fn pages(&self) -> usize {
+        self.pages
+    }
+
+    /// The label of page `page` (0-based), as a viewer shows it: a page with no range, or with an
+    /// empty range label, shows its physical number. Errors when the range's label cannot be
+    /// formatted (over 1,024 UTF-8 bytes, or a number past 32 bits).
+    pub fn label(&self, page: usize) -> Result<String, OrganizeError> {
+        if page >= self.pages {
+            return Err(OrganizeError::NoSuchPage(page));
+        }
+        let covering = self.ranges.partition_point(|r| r.start <= page);
+        let label = match covering.checked_sub(1).and_then(|i| self.ranges.get(i)) {
+            Some(range) => range.label(page)?,
+            None => String::new(),
+        };
+        Ok(if label.is_empty() { (page + 1).to_string() } else { label })
+    }
+
+    /// Every page's label, in page order, one at a time. Reading is lenient: a label that cannot
+    /// be formatted shows its physical page number, and the other ranges keep their labels.
+    pub fn iter(&self) -> impl Iterator<Item = String> + '_ {
+        (0..self.pages).map(|page| self.label(page).unwrap_or_else(|_| (page + 1).to_string()))
+    }
+}
+
+/// Every page's label, as a viewer shows it. This builds one string per page; for large
+/// documents, read single labels or stream them through [`PageLabels`].
 pub fn page_labels(doc: &Document) -> Result<Vec<String>, OrganizeError> {
-    labels_from_ranges(page_count(doc)?, &checked_ranges(doc)?, true)
+    Ok(PageLabels::new(doc)?.iter().collect())
+}
+
+/// Strict check for an edit: every label that the sorted, unique `ranges` produce over `pages`
+/// pages must fit. A range is checked from its largest number, so the work follows the ranges
+/// (and at most a thousand numbers at each end of a Roman range), not the pages.
+fn check_spans(ranges: &[LabelRange], pages: usize) -> Result<(), OrganizeError> {
+    let Some(last_page) = pages.checked_sub(1) else { return Ok(()) };
+    for (i, r) in ranges.iter().enumerate() {
+        // Prefix-only labels have no number to check; a range past the last page is never shown.
+        if r.start > last_page || r.style == LabelStyle::None {
+            continue;
+        }
+        let end = ranges.get(i + 1).map_or(last_page, |next| next.start.saturating_sub(1).min(last_page));
+        let lo = u64::from(r.first);
+        let hi = lo.saturating_add(u64::try_from(end.saturating_sub(r.start)).unwrap_or(u64::MAX));
+        let prefix = u64::try_from(r.prefix.len()).unwrap_or(u64::MAX);
+        let remaining = (MAX_LABEL_BYTES as u64).checked_sub(prefix).ok_or_else(|| invalid_label("a prefix exceeds 1024 UTF-8 bytes"))?;
+        // Numbers past u32::MAX are never formatted, so a label that is too long comes first.
+        if longest_numeral(r.style, lo, hi.min(u64::from(u32::MAX))) > remaining {
+            return Err(invalid_label("a label exceeds 1024 UTF-8 bytes"));
+        }
+        if hi > u64::from(u32::MAX) {
+            return Err(invalid_label("a page number overflows"));
+        }
+    }
+    Ok(())
+}
+
+/// The longest numeral `style` writes for the numbers `lo..=hi` (`1 <= lo <= hi`), in bytes.
+fn longest_numeral(style: LabelStyle, lo: u64, hi: u64) -> u64 {
+    match style {
+        // Decimal and alphabetic numerals only grow with the number, so the last one is longest.
+        LabelStyle::Decimal => u64::from(hi.checked_ilog10().unwrap_or(0)) + 1,
+        LabelStyle::UpperAlpha | LabelStyle::LowerAlpha => hi.saturating_sub(1) / 26 + 1,
+        LabelStyle::UpperRoman | LabelStyle::LowerRoman => longest_roman(lo, hi),
+        LabelStyle::None => 0,
+    }
+}
+
+/// The byte length of [`roman`]'s numeral for `n`: `n / 1000` copies of `m`, then the hundreds,
+/// tens and units, each a table lookup.
+fn roman_len(n: u64) -> u64 {
+    // Lengths of i, ii, iii, iv, v, vi, vii, viii, ix (and the same pattern for tens and hundreds).
+    const UNITS: [u64; 10] = [0, 1, 2, 3, 2, 1, 2, 3, 4, 2];
+    let digit = |place: u64| UNITS.get(usize::try_from(place % 10).unwrap_or_default()).copied().unwrap_or_default();
+    n / 1000 + digit(n / 100) + digit(n / 10) + digit(n)
+}
+
+/// The longest Roman numeral among `lo..=hi`, in bytes. Within one thousand the longest numeral is
+/// the one ending in 888, and every whole thousand between the ends contains it, so only the
+/// partial thousands at either end are read.
+fn longest_roman(lo: u64, hi: u64) -> u64 {
+    let (first, last) = (lo / 1000, hi / 1000);
+    if first == last {
+        return (lo..=hi).map(roman_len).max().unwrap_or_default();
+    }
+    let head = (lo..=first.saturating_mul(1000).saturating_add(999)).map(roman_len).max().unwrap_or_default();
+    let tail = (last.saturating_mul(1000)..=hi).map(roman_len).max().unwrap_or_default();
+    // Each whole thousand between the ends peaks at its thousand plus 12 (for 888); the last is largest.
+    let middle = if last.saturating_sub(first) >= 2 { last.saturating_sub(1).saturating_add(12) } else { 0 };
+    head.max(tail).max(middle)
 }
 
 /// Replace all label ranges (an empty list removes `/PageLabels`).
@@ -293,7 +367,7 @@ pub fn set_page_label_ranges(doc: &mut Document, ranges: &[LabelRange]) -> Resul
     if sorted.windows(2).any(|pair| pair.first().zip(pair.get(1)).is_some_and(|(a, b)| a.start == b.start)) {
         return Err(invalid_label("range start pages must be unique"));
     }
-    labels_from_ranges(page_count(doc)?, &sorted, false)?;
+    check_spans(&sorted, page_count(doc)?)?;
     let mut nums = Vec::new();
     for r in &sorted {
         let mut spec = Dict::new();
@@ -366,12 +440,77 @@ pub fn number_pages(doc: &mut Document, from: usize, to: usize, style: LabelStyl
 mod tests {
     use super::*;
 
+    /// No limit on the whole sequence: 4,097 labels of 1,024 bytes (over 4 MiB in total) are all
+    /// readable, one at a time or by page.
     #[test]
-    fn page_label_limits_bound_organizer_total_output() {
+    fn label_view_has_no_aggregate_limit() {
         let range = LabelRange { start: 0, style: LabelStyle::None, prefix: "x".repeat(MAX_LABEL_BYTES), first: u32::MAX };
-        let count = MAX_LABEL_TOTAL_BYTES / MAX_LABEL_BYTES;
-        assert_eq!(labels_from_ranges(count, std::slice::from_ref(&range), false).unwrap().len(), count);
-        assert!(labels_from_ranges(count + 1, &[range], false).unwrap_err().to_string().contains("4 MiB"));
+        let view = PageLabels { ranges: vec![range], pages: 4_097 };
+        assert_eq!(view.iter().map(|label| label.len()).sum::<usize>(), 4_097 * MAX_LABEL_BYTES);
+        assert_eq!(view.label(4_096).unwrap(), "x".repeat(MAX_LABEL_BYTES));
+    }
+
+    /// The view keeps the ranges, not one label per page: a billion-page document costs no more to
+    /// view than a short one, and a late label is built without the labels before it.
+    #[test]
+    fn label_view_does_not_grow_with_the_page_count() {
+        let prefix = "x".repeat(1000);
+        let range = LabelRange { start: 0, style: LabelStyle::Decimal, prefix: prefix.clone(), first: 1 };
+        let view = PageLabels { ranges: vec![range], pages: 1_000_000_000 };
+        assert_eq!(view.label(999_999_999).unwrap(), format!("{prefix}1000000000"));
+        assert_eq!(view.iter().take(2).collect::<Vec<_>>(), [format!("{prefix}1"), format!("{prefix}2")]);
+        assert_eq!(view.label(1_000_000_000), Err(OrganizeError::NoSuchPage(1_000_000_000)));
+    }
+
+    /// The numeral length formula and the bounded Roman search agree with the formatter.
+    #[test]
+    fn numeral_bounds_match_the_formatters() {
+        for n in (1..=3_000u64).chain([9_999, 10_000, 999_999, 1_000_000, 1_012_888, 1_013_888, u64::from(u32::MAX)]) {
+            match roman(n, MAX_LABEL_BYTES) {
+                Some(numeral) => assert_eq!(roman_len(n), numeral.len() as u64, "{n}"),
+                None => assert!(roman_len(n) > MAX_LABEL_BYTES as u64, "{n}"),
+            }
+        }
+        assert_eq!(longest_numeral(LabelStyle::UpperRoman, 888, 888), 12);
+        assert_eq!(longest_numeral(LabelStyle::Decimal, 1, 1_000), 4);
+        assert_eq!(longest_numeral(LabelStyle::LowerAlpha, 1, 27), 2);
+        let mut seed = 0x2545_f491_4f6c_dd1du64;
+        for _ in 0..400 {
+            seed = seed.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1_442_695_040_888_963_407);
+            let lo = 1 + (seed >> 33) % 3_000_000;
+            let hi = lo + (seed >> 40) % 2_500;
+            assert_eq!(longest_roman(lo, hi), (lo..=hi).map(roman_len).max().unwrap_or_default(), "{lo}..={hi}");
+        }
+    }
+
+    /// The edit check accepts exactly the ranges whose every label the per-page check accepts,
+    /// including spans that cross a thousand, numbers past 32 bits and long prefixes.
+    #[test]
+    fn span_check_agrees_with_per_label_checks() {
+        let styles = [LabelStyle::None, LabelStyle::Decimal, LabelStyle::UpperRoman, LabelStyle::LowerAlpha];
+        let firsts = [1, 3, 990, 999, 1_012_880, 1_013_990, 1_014_000, u32::MAX - 30, u32::MAX];
+        let prefixes = [0, 500, 1000, 1010, 1020, 1024];
+        let mut seed = 0x9e37_79b9_7f4a_7c15u64;
+        let mut next = |bound: usize| {
+            seed = seed.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1_442_695_040_888_963_407);
+            usize::try_from((seed >> 33) % bound as u64).unwrap_or_default()
+        };
+        for _ in 0..3_000 {
+            let pages = next(60);
+            let count = 1 + next(3);
+            let mut starts: Vec<usize> = (0..count).map(|_| next(pages + 3)).collect();
+            starts.sort_unstable();
+            starts.dedup();
+            let mut ranges = Vec::new();
+            for start in starts {
+                let style = styles[next(styles.len())];
+                let prefix = "p".repeat(prefixes[next(prefixes.len())]);
+                let first = firsts[next(firsts.len())];
+                ranges.push(LabelRange { start, style, prefix, first });
+            }
+            let per_label = (0..pages).all(|p| ranges.iter().rev().find(|r| r.start <= p).is_none_or(|r| r.label(p).is_ok()));
+            assert_eq!(check_spans(&ranges, pages).is_ok(), per_label, "{ranges:?} over {pages} pages");
+        }
     }
 
     #[test]
diff --git a/crates/organize/src/lib.rs b/crates/organize/src/lib.rs
index 5419eb773..3c6bf759f 100644
--- a/crates/organize/src/lib.rs
+++ b/crates/organize/src/lib.rs
@@ -24,11 +24,11 @@ pub mod view;
 
 pub use boxes::{BoxSpec, PageBox, page_boxes, set_page_box};
 pub use dedupe::dedupe_resources;
-pub use import::{SplitBy, combine, combine_selected, extract_pages, import_pages, page_as_form, split, split_ranges};
-pub use labels::{LabelRange, LabelStyle, number_pages, page_label_ranges, page_labels, set_page_label_ranges};
+pub use import::{Run, SplitBy, combine, combine_grouped, combine_selected, extract_pages, import_pages, page_as_form, split, split_ranges};
+pub use labels::{LabelRange, LabelStyle, PageLabels, number_pages, page_label_ranges, page_labels, set_page_label_ranges};
 pub use outline::{
-    Bookmark, OutlineEntry, OutlineError, add_bookmark, add_bookmark_tree, bookmarks, delete_bookmark, move_bookmark, rename_bookmark,
-    set_bookmark_open, set_bookmark_page,
+    Bookmark, BookmarkPage, OutlineEntry, OutlineError, add_bookmark, add_bookmark_tree, bookmark_page, bookmarks, delete_bookmark, move_bookmark,
+    rename_bookmark, set_bookmark_open, set_bookmark_page, top_level_bookmarks,
 };
 pub use view::{InitialView, displays_doc_title, initial_view, set_initial_view};
 
@@ -149,6 +149,9 @@ fn check(indices: &[usize], n: usize) -> Result<(), OrganizeError> {
 
 /// Rotate pages by a multiple of 90° (positive = clockwise), adjusting `/Rotate` (§7.7.3.3).
 pub fn rotate_pages(doc: &mut Document, indices: &[usize], degrees: i64) -> Result<(), OrganizeError> {
+    if degrees % 90 != 0 {
+        return Err(OrganizeError::Invalid("rotation must be a multiple of 90 degrees".into()));
+    }
     let all = walk(doc)?;
     check(indices, all.len())?;
     let delta = (degrees / 90) * 90;
@@ -192,8 +195,9 @@ pub fn delete_pages(doc: &mut Document, indices: &[usize]) -> Result<(), Organiz
 }
 
 /// Bookmarks, and links on the `keep` pages, that go to one of the `gone` pages lose that
-/// destination (/Dest, or a GoTo /A), rather than pointing at nothing.
+/// destination (/Dest, or a GoTo /A), rather than pointing at nothing; so does the catalog's /OpenAction.
 fn drop_destinations_to(doc: &mut Document, gone: &[ObjRef], keep: &[(ObjRef, Dict)]) -> Result<(), OrganizeError> {
+    let dead_names = drop_named_destinations(doc, gone)?;
     let mut holders = outline::items(doc);
     for (p, _) in keep {
         let annots = doc.get(*p).as_dict().and_then(|d| d.get(b"Annots").cloned()).map(|a| doc.resolve(&a).as_array().cloned().unwrap_or_default());
@@ -206,7 +210,12 @@ fn drop_destinations_to(doc: &mut Document, gone: &[ObjRef], keep: &[(ObjRef, Di
         );
     }
     let to_gone = |o: Option<&Object>| {
-        o.map(|o| doc.resolve(o)).and_then(|o| o.as_array().and_then(|a| a.first()).and_then(Object::as_ref)).is_some_and(|r| gone.contains(&r))
+        let Some(o) = o.map(|o| doc.resolve(o)) else { return false };
+        match &*o {
+            Object::Name(n) => dead_names.contains(n),
+            Object::String(s) => dead_names.contains(&s.bytes),
+            _ => goes_to(doc, &o, gone),
+        }
     };
     let mut dead: Vec<(ObjRef, &[u8])> = Vec::new();
     for h in holders {
@@ -219,6 +228,18 @@ fn drop_destinations_to(doc: &mut Document, gone: &[ObjRef], keep: &[(ObjRef, Di
             dead.push((h, b"A"));
         }
     }
+    // The catalog's /OpenAction is either a destination array or a GoTo action; one that opens a
+    // deleted page is dropped, as a bookmark's would be.
+    if let Some(root) = doc.root() {
+        let open = doc.get(root).as_dict().and_then(|c| c.get(b"OpenAction").map(|o| doc.resolve(o)));
+        let opens_gone = match open.as_deref() {
+            Some(Object::Dict(a)) => a.name(b"S") == Some(b"GoTo") && to_gone(a.get(b"D")),
+            other => to_gone(other),
+        };
+        if opens_gone {
+            dead.push((root, b"OpenAction"));
+        }
+    }
     for (h, key) in dead {
         doc.update_dict(h, |d| {
             d.remove(key);
@@ -227,6 +248,132 @@ fn drop_destinations_to(doc: &mut Document, gone: &[ObjRef], keep: &[(ObjRef, Di
     Ok(())
 }
 
+/// True when a destination (an array, or a dictionary whose /D is one) opens one of the `gone` pages.
+fn goes_to(doc: &Document, dest: &Object, gone: &[ObjRef]) -> bool {
+    let dest = doc.resolve(dest);
+    let array = match dest.as_dict() {
+        Some(d) => d.get(b"D").map(|d| doc.resolve(d)),
+        None => Some(dest.clone()),
+    };
+    array.and_then(|a| a.as_array().and_then(|a| a.first()).and_then(Object::as_ref)).is_some_and(|r| gone.contains(&r))
+}
+
+/// Remove the named destinations (the catalog's /Names /Dests tree and the legacy /Dests
+/// dictionary) that open one of the `gone` pages. Returns the removed names, so that the links
+/// using them can lose their destination too. Names of surviving pages are left alone.
+fn drop_named_destinations(doc: &mut Document, gone: &[ObjRef]) -> Result<Vec<Vec<u8>>, OrganizeError> {
+    let mut dead: Vec<Vec<u8>> = Vec::new();
+    let Some(root) = doc.root() else { return Ok(dead) };
+    let Some(catalog) = doc.get(root).as_dict().cloned() else { return Ok(dead) };
+    match catalog.get(b"Dests").cloned() {
+        Some(Object::Ref(r)) => {
+            if let Some(mut d) = doc.get(r).as_dict().cloned()
+                && prune_legacy(doc, &mut d, gone, &mut dead)
+            {
+                doc.update_dict(r, |x| *x = d)?;
+            }
+        }
+        Some(Object::Dict(mut d)) => {
+            if prune_legacy(doc, &mut d, gone, &mut dead) {
+                doc.update_dict(root, |c| c.set(b"Dests".to_vec(), Object::Dict(d)))?;
+            }
+        }
+        _ => {}
+    }
+    match catalog.get(b"Names").cloned() {
+        Some(Object::Ref(n)) => {
+            let tree = doc.get(n).as_dict().and_then(|d| d.get(b"Dests").cloned());
+            if let Some(new) = tree.and_then(|t| prune_tree_slot(doc, &t, gone, &mut dead).transpose()).transpose()? {
+                doc.update_dict(n, |d| d.set(b"Dests".to_vec(), Object::Dict(new)))?;
+            }
+        }
+        Some(Object::Dict(mut names)) => {
+            let tree = names.get(b"Dests").cloned();
+            if let Some(new) = tree.and_then(|t| prune_tree_slot(doc, &t, gone, &mut dead).transpose()).transpose()? {
+                names.set(b"Dests".to_vec(), Object::Dict(new));
+                doc.update_dict(root, |c| c.set(b"Names".to_vec(), Object::Dict(names)))?;
+            }
+        }
+        _ => {}
+    }
+    Ok(dead)
+}
+
+/// Drop the entries of a legacy /Dests dictionary that go to a `gone` page. True when any went.
+fn prune_legacy(doc: &Document, dests: &mut Dict, gone: &[ObjRef], dead: &mut Vec<Vec<u8>>) -> bool {
+    let keys: Vec<Vec<u8>> = dests.iter().filter(|(_, v)| goes_to(doc, v, gone)).map(|(k, _)| k.clone()).collect();
+    for k in &keys {
+        dests.remove(k);
+    }
+    dead.extend(keys.iter().cloned());
+    !keys.is_empty()
+}
+
+/// Prune a name tree held in `slot` (a reference, or a dictionary written inline). A reference is
+/// updated in place and yields `None`; an inline dictionary that changed is handed back.
+fn prune_tree_slot(doc: &mut Document, slot: &Object, gone: &[ObjRef], dead: &mut Vec<Vec<u8>>) -> Result<Option<Dict>, OrganizeError> {
+    let mut seen = Vec::new();
+    match slot {
+        Object::Ref(r) => {
+            prune_tree_ref(doc, *r, gone, dead, &mut seen)?;
+            Ok(None)
+        }
+        Object::Dict(d) => {
+            let mut node = d.clone();
+            Ok(prune_tree_node(doc, &mut node, gone, dead, &mut seen)?.then_some(node))
+        }
+        _ => Ok(None),
+    }
+}
+
+fn prune_tree_ref(doc: &mut Document, r: ObjRef, gone: &[ObjRef], dead: &mut Vec<Vec<u8>>, seen: &mut Vec<ObjRef>) -> Result<(), OrganizeError> {
+    if seen.contains(&r) {
+        return Ok(());
+    }
+    seen.push(r);
+    let Some(mut node) = doc.get(r).as_dict().cloned() else { return Ok(()) };
+    if prune_tree_node(doc, &mut node, gone, dead, seen)? {
+        doc.update_dict(r, |d| *d = node)?;
+    }
+    Ok(())
+}
+
+/// Drop the /Names pairs of one name-tree node that go to a `gone` page, then do the same for its
+/// /Kids. True when `node` itself changed (kids held by reference are written back here).
+fn prune_tree_node(
+    doc: &mut Document,
+    node: &mut Dict,
+    gone: &[ObjRef],
+    dead: &mut Vec<Vec<u8>>,
+    seen: &mut Vec<ObjRef>,
+) -> Result<bool, OrganizeError> {
+    let mut changed = false;
+    if let Some(pairs) = node.get(b"Names").map(|n| doc.resolve(n)).and_then(|n| n.as_array().cloned()) {
+        let mut kept = Vec::with_capacity(pairs.len());
+        for pair in pairs.chunks(2) {
+            match pair {
+                [key, value] if goes_to(doc, value, gone) => {
+                    if let Some(s) = doc.resolve(key).as_string() {
+                        dead.push(s.bytes.clone());
+                    }
+                }
+                _ => kept.extend_from_slice(pair),
+            }
+        }
+        if kept.len() != pairs.len() {
+            node.set(b"Names".to_vec(), Object::Array(kept));
+            changed = true;
+        }
+    }
+    let kids = node.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
+    for kid in kids {
+        if let Some(r) = kid.as_ref() {
+            prune_tree_ref(doc, r, gone, dead, seen)?;
+        }
+    }
+    Ok(changed)
+}
+
 /// Take widgets out of the form: out of their field's /Kids, or out of /AcroForm /Fields when
 /// they are fields themselves. A field left without kids goes too.
 fn drop_widgets(doc: &mut Document, mut widgets: Vec<ObjRef>) -> Result<(), OrganizeError> {
diff --git a/crates/organize/src/outline.rs b/crates/organize/src/outline.rs
index 0cc81a0a0..d3ac207fc 100644
--- a/crates/organize/src/outline.rs
+++ b/crates/organize/src/outline.rs
@@ -7,25 +7,45 @@
 //! Edits are surgical: they relink only the affected siblings (`/Parent`, `/Prev`, `/Next`,
 //! `/First`, `/Last`) and recompute `/Count` values, and an object is rewritten only when one of
 //! its values changes. Everything else on an item (colour, style, actions, unknown keys) is kept.
-//! Walks are cycle- and size-safe; a broken outline is never followed forever.
+//! Walks are cycle-safe and iterative, so a broken or deep outline is never followed forever and
+//! never overflows the stack. Listing is lazy: [`bookmark_page`] visits only the bookmarks up to
+//! the end of the page it returns.
 
-use std::collections::HashSet;
+use std::collections::{HashMap, HashSet};
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString};
 
 use crate::{OrganizeError, walk};
 
-/// Hard cap on items visited (broken or hostile outlines).
-const MAX_ITEMS: usize = 100_000;
+/// Deepest level a listing enters (the top level is 0). Bookmarks deeper than this are not
+/// listed; edits still reach them by path.
+const LIST_DEPTH: usize = 32;
 
-/// A bookmark as stored in the file.
+/// Deepest name-tree node read when looking up named destinations.
+const NAME_TREE_DEPTH: usize = 32;
+
+/// Deepest chain of indirect or named destinations followed for one bookmark.
+const DEST_DEPTH: u8 = 8;
+
+/// A bookmark in listing order, with where it sits and where it goes.
 #[derive(Clone, Debug, PartialEq)]
 pub struct Bookmark {
     pub obj: ObjRef,
+    /// Child indices from the top level (the paths the edit functions take).
+    pub path: Vec<usize>,
     pub title: String,
     /// Shown expanded (a positive `/Count`) when it has children.
     pub open: bool,
-    pub children: Vec<Bookmark>,
+    /// The 0-based page it goes to, when that page is in this document.
+    pub page: Option<usize>,
+}
+
+/// One page of the outline listing (see [`bookmark_page`]).
+#[derive(Clone, Debug, PartialEq)]
+pub struct BookmarkPage {
+    pub bookmarks: Vec<Bookmark>,
+    /// The offset where the next page starts, or `None` when this page is the last.
+    pub next: Option<usize>,
 }
 
 #[derive(Debug, thiserror::Error, PartialEq)]
@@ -56,7 +76,7 @@ fn children_of(doc: &Document, parent: ObjRef, seen: &mut HashSet<ObjRef>) -> Ve
     let mut out = Vec::new();
     let mut next = doc.get(parent).as_dict().and_then(|d| d.reference(b"First"));
     while let Some(r) = next {
-        if seen.len() >= MAX_ITEMS || !seen.insert(r) {
+        if !seen.insert(r) {
             break;
         }
         let item = doc.get(r);
@@ -79,23 +99,229 @@ pub(crate) fn items(doc: &Document) -> Vec<ObjRef> {
     out
 }
 
-/// The bookmark tree.
-pub fn bookmarks(doc: &Document) -> Vec<Bookmark> {
-    let Some(root) = outline_root(doc) else { return Vec::new() };
-    let mut seen = HashSet::from([root]);
-    fn build(doc: &Document, parent: ObjRef, seen: &mut HashSet<ObjRef>) -> Vec<Bookmark> {
-        children_of(doc, parent, seen)
-            .into_iter()
-            .map(|r| {
-                let item = doc.get(r);
-                let d = item.as_dict().cloned().unwrap_or_default();
-                let title = d.get(b"Title").map(|t| doc.resolve(t)).and_then(|t| t.as_string().map(|s| s.to_text())).unwrap_or_default();
-                let open = d.int(b"Count").is_some_and(|c| c > 0);
-                Bookmark { obj: r, title, open, children: build(doc, r, seen) }
-            })
-            .collect()
+/// The outline in listing order: each bookmark once, siblings by `/Next`, children right after
+/// their parent. An explicit stack keeps the walk iterative. A repeated or malformed item ends its
+/// run of siblings there, so a cycle or a broken link stops the walk instead of looping.
+struct Visit<'a> {
+    doc: &'a Document,
+    seen: HashSet<ObjRef>,
+    /// One entry per open level: the next sibling to visit, and how many siblings it has visited.
+    levels: Vec<(Option<ObjRef>, usize)>,
+    /// The deepest level the walk enters.
+    max_depth: usize,
+    /// The bookmark just visited: its children are entered by the next step.
+    enter: Option<ObjRef>,
+}
+
+impl<'a> Visit<'a> {
+    fn new(doc: &'a Document, max_depth: usize) -> Option<Self> {
+        let root = outline_root(doc)?;
+        let first = doc.get(root).as_dict().and_then(|d| d.reference(b"First"));
+        Some(Self { doc, seen: HashSet::from([root]), levels: vec![(first, 0)], max_depth, enter: None })
     }
-    build(doc, root, &mut seen)
+
+    /// Visit the next bookmark, or `None` when the listing is done.
+    fn step(&mut self) -> Option<ObjRef> {
+        if let Some(first) = self.enter.take() {
+            self.levels.push((Some(first), 0));
+        }
+        loop {
+            let depth = self.levels.len().checked_sub(1)?;
+            let level = self.levels.get_mut(depth)?;
+            let Some(r) = level.0.take() else {
+                self.levels.pop();
+                continue;
+            };
+            if !self.seen.insert(r) {
+                continue;
+            }
+            let item = self.doc.get(r);
+            let Some(d) = item.as_dict() else { continue };
+            level.0 = d.reference(b"Next");
+            level.1 = level.1.saturating_add(1);
+            self.enter = if depth < self.max_depth { d.reference(b"First") } else { None };
+            return Some(r);
+        }
+    }
+
+    /// Child indices from the top level to the bookmark last visited.
+    fn path(&self) -> Vec<usize> {
+        self.levels.iter().map(|(_, visited)| visited.saturating_sub(1)).collect()
+    }
+}
+
+/// Page targets for a listing: the page index of each page object, and the named destinations
+/// (read once, the first time one is needed).
+struct Targets {
+    pages: HashMap<ObjRef, usize>,
+    names: Option<HashMap<Vec<u8>, Object>>,
+}
+
+impl Targets {
+    fn new(doc: &Document) -> Self {
+        let pages = walk(doc).unwrap_or_default().into_iter().enumerate().map(|(i, (r, _))| (r, i)).collect();
+        Self { pages, names: None }
+    }
+
+    /// The named destination `key`: its name-tree entry, else its entry in the `/Dests` dictionary.
+    fn named(&mut self, doc: &Document, key: &[u8]) -> Option<Object> {
+        let names = self.names.get_or_insert_with(|| name_tree(doc));
+        names.get(key).cloned().or_else(|| dests_dict(doc, key))
+    }
+}
+
+/// Every entry of the catalog's `/Names /Dests` name tree, by name. The first entry of a name wins.
+/// Iterative, and nodes deeper than `NAME_TREE_DEPTH` are skipped.
+fn name_tree(doc: &Document) -> HashMap<Vec<u8>, Object> {
+    let mut out = HashMap::new();
+    let Some(root) = doc.root() else { return out };
+    let Some(names) = doc.get(root).as_dict().and_then(|c| c.get(b"Names").cloned()) else { return out };
+    let names = doc.resolve(&names);
+    let Some(tree) = names.as_dict().and_then(|n| n.get(b"Dests").cloned()) else { return out };
+    // Nodes still to read, with their depth. Kids go on the stack in reverse, so they are read in order.
+    let mut stack = vec![(tree, 0usize)];
+    let mut seen: HashSet<ObjRef> = HashSet::new();
+    while let Some((raw, depth)) = stack.pop() {
+        if depth > NAME_TREE_DEPTH {
+            continue;
+        }
+        if let Object::Ref(r) = raw
+            && !seen.insert(r)
+        {
+            continue;
+        }
+        let node = doc.resolve(&raw);
+        let Some(d) = node.as_dict() else { continue };
+        let pairs = d.get(b"Names").map(|n| doc.resolve(n));
+        if let Some(pairs) = pairs.as_deref().and_then(Object::as_array) {
+            for pair in pairs.chunks(2) {
+                if let [k, v] = pair
+                    && let Some(key) = name_key(doc, k)
+                {
+                    out.entry(key).or_insert_with(|| v.clone());
+                }
+            }
+        }
+        let kids = d.get(b"Kids").map(|k| doc.resolve(k));
+        if let Some(kids) = kids.as_deref().and_then(Object::as_array) {
+            for kid in kids.iter().rev() {
+                stack.push((kid.clone(), depth + 1));
+            }
+        }
+    }
+    out
+}
+
+/// The bytes of a name-tree key, which is a string or a name.
+fn name_key(doc: &Document, key: &Object) -> Option<Vec<u8>> {
+    match &*doc.resolve(key) {
+        Object::String(s) => Some(s.bytes.clone()),
+        Object::Name(n) => Some(n.clone()),
+        _ => None,
+    }
+}
+
+/// A named destination in the catalog's PDF 1.1 `/Dests` dictionary.
+fn dests_dict(doc: &Document, key: &[u8]) -> Option<Object> {
+    let root = doc.root()?;
+    let dests = doc.get(root).as_dict().and_then(|c| c.get(b"Dests").cloned())?;
+    let dests = doc.resolve(&dests);
+    dests.as_dict()?.get(key).cloned()
+}
+
+/// The page index a destination names: an explicit `[page /XYZ …]` array, a dictionary whose `/D`
+/// is one, or a named destination that resolves to one.
+fn page_of_dest(doc: &Document, targets: &mut Targets, dest: &Object, depth: u8) -> Option<usize> {
+    if depth > DEST_DEPTH {
+        return None;
+    }
+    let dest = doc.resolve(dest);
+    match &*dest {
+        Object::Array(a) => match a.first()? {
+            Object::Ref(page) => targets.pages.get(page).copied(),
+            // Some producers write a page number in a remote-style destination.
+            Object::Int(n) => usize::try_from(*n).ok().filter(|&p| p < targets.pages.len()),
+            _ => None,
+        },
+        Object::Dict(d) => page_of_dest(doc, targets, d.get(b"D")?, depth + 1),
+        Object::String(s) => {
+            let inner = targets.named(doc, &s.bytes)?;
+            page_of_dest(doc, targets, &inner, depth + 1)
+        }
+        Object::Name(n) => {
+            let inner = targets.named(doc, n)?;
+            page_of_dest(doc, targets, &inner, depth + 1)
+        }
+        _ => None,
+    }
+}
+
+/// The page an item goes to: its `/Dest`, else the destination of its GoTo action `/A`.
+fn item_page(doc: &Document, targets: &mut Targets, d: &Dict) -> Option<usize> {
+    if let Some(dest) = d.get(b"Dest")
+        && let Some(page) = page_of_dest(doc, targets, dest, 0)
+    {
+        return Some(page);
+    }
+    let action = doc.resolve(d.get(b"A")?);
+    let dest = action.as_dict()?.get(b"D")?;
+    page_of_dest(doc, targets, dest, 0)
+}
+
+/// A bookmark's title as viewers show it: the decoded text, without NULs or surrounding space.
+fn title_of(doc: &Document, d: &Dict) -> String {
+    let title = d.get(b"Title").map(|t| doc.resolve(t));
+    let text = match title.as_deref() {
+        Some(Object::String(s)) => s.to_text(),
+        Some(Object::Name(n)) => String::from_utf8_lossy(n).into_owned(),
+        _ => return String::new(),
+    };
+    text.trim_matches('\0').trim().to_string()
+}
+
+fn describe(doc: &Document, targets: &mut Targets, obj: ObjRef, path: Vec<usize>) -> Bookmark {
+    let item = doc.get(obj);
+    let (title, open, page) = match item.as_dict() {
+        Some(d) => (title_of(doc, d), d.int(b"Count").is_some_and(|c| c > 0), item_page(doc, targets, d)),
+        None => (String::new(), false, None),
+    };
+    Bookmark { obj, path, title, open, page }
+}
+
+/// Lists up to `limit` bookmarks from position `offset`, entering no level deeper than `max_depth`.
+fn list(doc: &Document, max_depth: usize, offset: usize, limit: usize) -> BookmarkPage {
+    let mut bookmarks = Vec::new();
+    let Some(mut visit) = Visit::new(doc, max_depth) else { return BookmarkPage { bookmarks, next: None } };
+    for _ in 0..offset {
+        if visit.step().is_none() {
+            return BookmarkPage { bookmarks, next: None };
+        }
+    }
+    let mut targets = Targets::new(doc);
+    while bookmarks.len() < limit {
+        let Some(obj) = visit.step() else { break };
+        bookmarks.push(describe(doc, &mut targets, obj, visit.path()));
+    }
+    let next = if bookmarks.len() == limit && visit.step().is_some() { Some(offset.saturating_add(bookmarks.len())) } else { None };
+    BookmarkPage { bookmarks, next }
+}
+
+/// Every bookmark, in listing order (bookmarks deeper than the listing depth are left out).
+pub fn bookmarks(doc: &Document) -> Vec<Bookmark> {
+    list(doc, LIST_DEPTH, 0, usize::MAX).bookmarks
+}
+
+/// The top-level bookmarks, in order.
+pub fn top_level_bookmarks(doc: &Document) -> Vec<Bookmark> {
+    list(doc, 0, 0, usize::MAX).bookmarks
+}
+
+/// One page of the bookmarks in listing order: up to `limit` from position `offset`, and the offset
+/// where the next page starts. Pages are contiguous, so following `next` lists every bookmark once.
+/// Only the bookmarks up to the end of the page are visited, so the first page does not depend on
+/// how many bookmarks come after it.
+pub fn bookmark_page(doc: &Document, offset: usize, limit: usize) -> BookmarkPage {
+    list(doc, LIST_DEPTH, offset, limit)
 }
 
 /// The object of the bookmark at `path`, and its parent object (the outline root for top-level).
@@ -162,31 +388,46 @@ fn relink(doc: &mut Document, parent: ObjRef, kids: &[ObjRef]) -> Result<()> {
     Ok(())
 }
 
+/// A node whose `/Count` [`recount`] is working out.
+struct Counting {
+    node: ObjRef,
+    kids: Vec<ObjRef>,
+    /// The next child to count.
+    next: usize,
+    /// Items visible below the node, so far.
+    visible: i64,
+    is_root: bool,
+}
+
 /// Recompute every `/Count` (§12.3.3: open items count their visible descendants, closed items
 /// the negative of what opening them would show; the root counts all visible items).
 fn recount(doc: &mut Document) -> Result<()> {
     let Some(root) = outline_root(doc) else { return Ok(()) };
     let mut seen = HashSet::from([root]);
-    // Returns the number of items visible below `node` when `node` is open.
-    fn visit(doc: &mut Document, node: ObjRef, is_root: bool, seen: &mut HashSet<ObjRef>) -> Result<i64> {
-        let kids = children_of(doc, node, seen);
-        let mut visible = 0i64;
-        for k in &kids {
-            let below = visit(doc, *k, false, seen)?;
-            let open = doc.get(*k).as_dict().and_then(|d| d.int(b"Count")).is_some_and(|c| c > 0);
-            visible += 1 + if open { below } else { 0 };
+    let kids = children_of(doc, root, &mut seen);
+    let mut stack = vec![Counting { node: root, kids, next: 0, visible: 0, is_root: true }];
+    // A node is counted once its children are, so the walk keeps its own stack instead of recursing.
+    while let Some(top) = stack.last_mut() {
+        if let Some(&kid) = top.kids.get(top.next) {
+            top.next += 1;
+            let kids = children_of(doc, kid, &mut seen);
+            stack.push(Counting { node: kid, kids, next: 0, visible: 0, is_root: false });
+            continue;
         }
-        let count = if kids.is_empty() {
+        let Some(done) = stack.pop() else { break };
+        let count = if done.kids.is_empty() {
             None
-        } else if is_root || doc.get(node).as_dict().and_then(|d| d.int(b"Count")).is_some_and(|c| c > 0) {
-            Some(visible)
+        } else if done.is_root || doc.get(done.node).as_dict().and_then(|d| d.int(b"Count")).is_some_and(|c| c > 0) {
+            Some(done.visible)
         } else {
-            Some(-visible)
+            Some(-done.visible)
         };
-        put(doc, node, b"Count", count.map(Object::Int))?;
-        Ok(visible)
+        put(doc, done.node, b"Count", count.map(Object::Int))?;
+        if let Some(parent) = stack.last_mut() {
+            let open = doc.get(done.node).as_dict().and_then(|d| d.int(b"Count")).is_some_and(|c| c > 0);
+            parent.visible = parent.visible.saturating_add(1 + if open { done.visible } else { 0 });
+        }
     }
-    visit(doc, root, true, &mut seen)?;
     Ok(())
 }
 
diff --git a/crates/organize/src/tests.rs b/crates/organize/src/tests.rs
index 152b961ac..c6d5b8394 100644
--- a/crates/organize/src/tests.rs
+++ b/crates/organize/src/tests.rs
@@ -16,6 +16,18 @@ fn page_rotation_resolves_inheritance_overrides_and_missing_pages() {
     assert_eq!(page_rotation(&doc, 3), Err(OrganizeError::NoSuchPage(3)));
 }
 
+#[test]
+fn rotate_rejects_angles_that_are_not_multiples_of_90() {
+    // The page tree only turns in quarter steps, so anything else used to be silently truncated
+    // by the integer division. It has to be an error, and the document must stay as it was.
+    let mut doc = Document::open(Arc::new(fixture())).unwrap();
+    assert_eq!(rotate_pages(&mut doc, &[0], 45), Err(OrganizeError::Invalid("rotation must be a multiple of 90 degrees".into())));
+    assert_eq!(rotate_pages(&mut doc, &[0], 91), Err(OrganizeError::Invalid("rotation must be a multiple of 90 degrees".into())));
+    assert_eq!(page_rotation(&doc, 0).unwrap(), 90);
+    rotate_pages(&mut doc, &[0], -90).unwrap();
+    assert_eq!(page_rotation(&doc, 0).unwrap(), 0);
+}
+
 /// A 3-page document with a nested page tree. MediaBox and Rotate are inherited from the root,
 /// Resources from an intermediate node; each page's content says which page it is.
 fn fixture() -> Vec<u8> {
@@ -158,6 +170,45 @@ fn deleted_pages_are_not_kept_by_what_points_at_them() {
     assert_eq!(form.as_dict().and_then(|f| f.get(b"Fields")).and_then(Object::as_array).map(Vec::len), Some(0), "the field went with its page");
 }
 
+#[test]
+fn deleting_the_opening_page_drops_the_open_action() {
+    let open_action = |doc: &Document| doc.get(doc.root().unwrap()).as_dict().unwrap().get(b"OpenAction").cloned();
+    let set_open = |doc: &mut Document, value: Object| {
+        let root = doc.root().unwrap();
+        doc.update_dict(root, |c| c.set(b"OpenAction".to_vec(), value)).unwrap();
+    };
+    let page = |doc: &Document, i: usize| pages(doc).unwrap()[i].obj;
+    for as_action in [false, true] {
+        let target = |doc: &Document, i: usize| {
+            let dest = Object::Array(vec![Object::Ref(page(doc, i)), Object::Name(b"Fit".to_vec())]);
+            if as_action {
+                let mut a = Dict::new();
+                a.set(b"S".to_vec(), Object::Name(b"GoTo".to_vec()));
+                a.set(b"D".to_vec(), dest);
+                Object::Dict(a)
+            } else {
+                dest
+            }
+        };
+        // The opening page goes: no OpenAction is left to point at nothing.
+        let mut doc = doc_a();
+        let open = target(&doc, 0);
+        set_open(&mut doc, open);
+        delete_pages(&mut doc, &[0]).unwrap();
+        let out = full_roundtrip(&doc);
+        assert_eq!(labels(&out), ["A2", "A3"]);
+        assert_eq!(open_action(&out), None);
+        // Another page goes: the opening page keeps its OpenAction.
+        let mut doc = doc_a();
+        let open = target(&doc, 0);
+        set_open(&mut doc, open);
+        delete_pages(&mut doc, &[2]).unwrap();
+        let out = full_roundtrip(&doc);
+        assert_eq!(labels(&out), ["A1", "A2"]);
+        assert!(open_action(&out).is_some());
+    }
+}
+
 #[test]
 fn cannot_delete_every_page_or_missing_pages() {
     let mut doc = open(fixture());
@@ -227,6 +278,42 @@ fn full_save_drops_unreachable_objects() {
     assert_eq!(hayro_syntax::Pdf::new(bytes).unwrap().pages().len(), 1);
 }
 
+#[test]
+fn deleting_a_page_drops_the_named_destinations_to_it() {
+    // Four names (two in the /Names tree, two in the legacy /Dests dictionary) go to P1 or P3;
+    // P2 has a link for each. Deleting P1 must drop its names and their links, keep P3's.
+    let b: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /Names << /Dests 6 0 R >> /Dests 7 0 R >>".into(), // 1
+        "<< /Type /Pages /Kids [3 0 R 4 0 R 5 0 R] /Count 3 /MediaBox [0 0 300 400] >>".into(), // 2
+        "<< /Type /Page /Parent 2 0 R >>".into(),                                          // 3
+        "<< /Type /Page /Parent 2 0 R /Annots [8 0 R 9 0 R 10 0 R 11 0 R] >>".into(),      // 4
+        "<< /Type /Page /Parent 2 0 R >>".into(),                                          // 5
+        "<< /Names [(treeFirst) [3 0 R /Fit] (treeLast) [5 0 R /Fit]] >>".into(),          // 6
+        "<< /legacyFirst [3 0 R /Fit] /legacyLast << /D [5 0 R /Fit] >> >>".into(),        // 7
+        "<< /Type /Annot /Subtype /Link /Rect [0 0 9 9] /Dest (treeFirst) >>".into(),      // 8
+        "<< /Type /Annot /Subtype /Link /Rect [0 0 9 9] /Dest (treeLast) >>".into(),       // 9
+        "<< /Type /Annot /Subtype /Link /Rect [0 0 9 9] /Dest /legacyFirst >>".into(),     // 10
+        "<< /Type /Annot /Subtype /Link /Rect [0 0 9 9] /A << /S /GoTo /D /legacyLast >> >>".into(), // 11
+    ];
+    let mut doc = open(build(&b, "/Root 1 0 R"));
+    delete_pages(&mut doc, &[0]).unwrap();
+    let out = full_roundtrip(&doc);
+    let cat = out.get(out.root().unwrap()).as_dict().cloned().unwrap();
+    let tree = out.resolve(out.resolve(cat.get(b"Names").unwrap()).as_dict().unwrap().get(b"Dests").unwrap());
+    let pairs = tree.as_dict().unwrap().get(b"Names").and_then(Object::as_array).cloned().unwrap();
+    assert_eq!(pairs.len(), 2, "{pairs:?}");
+    assert_eq!(pairs[0].as_string().map(|s| s.bytes.clone()), Some(b"treeLast".to_vec()));
+    let page3 = pages(&out).unwrap()[1].obj;
+    assert_eq!(out.resolve(&pairs[1]).as_array().and_then(|a| a.first()).and_then(Object::as_ref), Some(page3));
+    let legacy = out.resolve(cat.get(b"Dests").unwrap()).as_dict().cloned().unwrap();
+    assert!(!legacy.contains(b"legacyFirst") && legacy.contains(b"legacyLast"), "{legacy:?}");
+    let links = annots(&out, 0);
+    assert!(!links[0].contains(b"Dest"), "{:?}", links[0]);
+    assert!(links[1].contains(b"Dest"), "{:?}", links[1]);
+    assert!(!links[2].contains(b"Dest"), "{:?}", links[2]);
+    assert!(links[3].contains(b"A"), "{:?}", links[3]);
+}
+
 // ── Combine / extract / split ──────────────────────────────────────────────────────────────────
 
 /// Build a classic-xref PDF from object bodies (object i+1 = bodies[i]).
@@ -356,6 +443,44 @@ fn links_are_rewired_to_copied_pages_or_dropped() {
     assert!(!link.contains(b"Dest") && !link.contains(b"A"));
 }
 
+/// A widget annotation that is its own form field (no `/Parent`).
+fn own_field(doc: &Document, r: ObjRef) -> bool {
+    doc.get(r).as_dict().is_some_and(|d| d.name(b"Subtype") == Some(b"Widget") && !d.contains(b"Parent"))
+}
+
+#[test]
+fn repeated_page_gets_independent_annotations() {
+    // A1 has a link, A2 a link and a form field, A3 a note with a popup; each is listed twice.
+    let out = full_roundtrip(&extract_pages(&doc_a(), &[0, 0, 1, 1, 2, 2]).unwrap());
+    let ps = pages(&out).unwrap();
+    let refs: Vec<Vec<ObjRef>> = (0..6)
+        .map(|i| page_dict(&out, i).get(b"Annots").map(|a| out.resolve(a).as_array().cloned().unwrap_or_default()).unwrap_or_default())
+        .map(|list| list.iter().filter_map(|a| a.as_ref()).collect())
+        .collect();
+    for i in (0..6).step_by(2) {
+        assert!(!refs[i].is_empty());
+        assert_eq!(refs[i].len(), refs[i + 1].len());
+        for (a, b) in refs[i].iter().zip(&refs[i + 1]) {
+            // A widget that is its own field stays one object on both pages, so the field stays
+            // one (#790); every other annotation is copied.
+            if !own_field(&out, *a) {
+                assert_ne!(a, b, "each copy of the page has its own annotation objects");
+            }
+        }
+    }
+    for (i, list) in refs.iter().enumerate() {
+        for a in list.iter().filter(|a| !own_field(&out, **a)) {
+            assert_eq!(out.get(*a).as_dict().unwrap().reference(b"P"), Some(ps[i].obj), "/P names the page holding the copy");
+        }
+    }
+    // Each note keeps its own popup, pointing back at that note.
+    let popups: Vec<ObjRef> = [4, 5].iter().map(|&i| out.get(refs[i][0]).as_dict().unwrap().reference(b"Popup").unwrap()).collect();
+    assert_ne!(popups[0], popups[1]);
+    for (k, p) in popups.iter().enumerate() {
+        assert_eq!(out.get(*p).as_dict().unwrap().reference(b"Parent"), Some(refs[4 + k][0]));
+    }
+}
+
 #[test]
 fn form_fields_come_along_and_are_registered() {
     let out = full_roundtrip(&extract_pages(&doc_a(), &[1]).unwrap());
@@ -635,6 +760,96 @@ fn layers_are_registered_with_their_default_state() {
     assert!(!catalog(&out).contains(b"OCProperties"));
 }
 
+/// The top-level bookmarks' titles, in order.
+fn top_titles(doc: &Document) -> Vec<String> {
+    let Some(outlines) = catalog(doc).reference(b"Outlines") else { return Vec::new() };
+    let mut item = doc.get(outlines).as_dict().and_then(|o| o.reference(b"First"));
+    let mut titles = Vec::new();
+    while let Some(r) = item {
+        let d = doc.get(r).as_dict().cloned().unwrap();
+        titles.push(d.get(b"Title").and_then(|t| t.as_string()).map(|s| s.to_text()).unwrap());
+        item = d.reference(b"Next");
+    }
+    titles
+}
+
+#[test]
+fn a_file_split_around_another_is_copied_once_with_one_bookmark() {
+    // C's first page, then all of A, then C's second page.
+    let (a, c) = (doc_a(), doc_c());
+    let out = full_roundtrip(&crate::combine_grouped(&[(0, "C", &c, Some(&[0])), (1, "A", &a, None), (0, "C", &c, Some(&[1]))]).unwrap());
+    assert_eq!(labels(&out), ["C1", "A1", "A2", "A3", "C2"]);
+    assert_eq!(top_titles(&out), ["C", "A"], "one bookmark per file, not per run");
+    let ps = pages(&out).unwrap();
+    let outlines = out.get(catalog(&out).reference(b"Outlines").unwrap()).as_dict().cloned().unwrap();
+    let file = out.get(outlines.reference(b"First").unwrap()).as_dict().cloned().unwrap();
+    assert_eq!(file.get(b"Dest").and_then(|d| d.as_array()).unwrap()[0].as_ref(), Some(ps[0].obj), "C's bookmark: its first page shown");
+    // Its own bookmarks follow its pages wherever they went: the section is on C2, now last.
+    let chapter = out.get(file.reference(b"First").unwrap()).as_dict().cloned().unwrap();
+    let section = out.get(chapter.reference(b"First").unwrap()).as_dict().cloned().unwrap();
+    assert_eq!(section.get(b"Dest").and_then(|d| d.as_array()).unwrap()[0].as_ref(), Some(ps[4].obj));
+    // The link from C1 to C2 still works across A's pages between them.
+    let link = &annots(&out, 0)[0];
+    assert_eq!(link.get(b"Dest").and_then(|d| d.as_array()).expect("kept").first().and_then(|o| o.as_ref()), Some(ps[4].obj));
+    // Its attachment once, not once per run.
+    let names = out.resolve(catalog(&out).get(b"Names").unwrap()).as_dict().cloned().unwrap();
+    let tree = out.resolve(names.get(b"EmbeddedFiles").unwrap()).as_dict().cloned().unwrap();
+    let keys: Vec<String> = tree.get(b"Names").and_then(|n| n.as_array()).unwrap().chunks(2).map(|p| p[0].as_string().unwrap().to_text()).collect();
+    assert_eq!(keys, ["notes.txt"]);
+}
+
+#[test]
+fn a_page_shown_twice_gets_its_own_annotations() {
+    // One page with an indirect comment (and its popup), and a second page.
+    let b: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),                                                          // 1
+        "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 200 200] >>".into(),                    // 2
+        "<< /Type /Page /Parent 2 0 R /Contents 5 0 R /Annots [6 0 R] >>".into(),                            // 3
+        "<< /Type /Page /Parent 2 0 R /Contents 7 0 R >>".into(),                                            // 4
+        body("D1"),                                                                                          // 5
+        "<< /Type /Annot /Subtype /Text /Rect [0 0 10 10] /Contents (note) /P 3 0 R /Popup 8 0 R >>".into(), // 6
+        body("D2"),                                                                                          // 7
+        "<< /Type /Annot /Subtype /Popup /Rect [10 10 50 50] /Parent 6 0 R >>".into(),                       // 8
+    ];
+    let d = open(build(&b, "/Root 1 0 R"));
+    // Page 1 twice, from one file split around its page 2 (and the same through combine_selected).
+    for out in [
+        crate::combine_grouped(&[(0, "D", &d, Some(&[0, 1])), (0, "D", &d, Some(&[0]))]).unwrap(),
+        combine_selected(&[("D", &d, Some(&[0, 1, 0]))]).unwrap(),
+    ] {
+        let out = full_roundtrip(&out);
+        assert_eq!(labels(&out), ["D1", "D2", "D1"]);
+        let ps = pages(&out).unwrap();
+        let annot_of = |i: usize| page_dict(&out, i).get(b"Annots").and_then(|a| a.as_array()).and_then(|a| a[0].as_ref()).unwrap();
+        let (first, again) = (annot_of(0), annot_of(2));
+        assert_ne!(first, again, "two pages, two comments");
+        for (annot, page) in [(first, ps[0].obj), (again, ps[2].obj)] {
+            let a = out.get(annot).as_dict().cloned().unwrap();
+            assert_eq!(a.reference(b"P"), Some(page), "each comment belongs to its own page");
+            let popup = out.get(a.reference(b"Popup").unwrap()).as_dict().cloned().unwrap();
+            assert_eq!(popup.reference(b"Parent"), Some(annot), "and its popup to it");
+        }
+    }
+}
+
+#[test]
+fn grouped_runs_keep_their_order_repeats_and_separate_files() {
+    let (a, b) = (doc_a(), doc_b());
+    // B's page 2, A's page 1, B's page 1, A's page 1 again (a repeat is a page of its own).
+    let out = full_roundtrip(
+        &crate::combine_grouped(&[(0, "B", &b, Some(&[1])), (1, "A", &a, Some(&[0])), (0, "B", &b, Some(&[0])), (1, "A", &a, Some(&[0]))]).unwrap(),
+    );
+    assert_eq!(labels(&out), ["B2", "A1", "B1", "A1"]);
+    assert_eq!(top_titles(&out), ["B", "A"]);
+    let ps = pages(&out).unwrap();
+    assert_ne!(ps[1].obj, ps[3].obj, "a page shown twice is two pages");
+    // The same file added twice on purpose (two groups) keeps two bookmarks, as combine does.
+    let twice = full_roundtrip(&crate::combine_grouped(&[(0, "A", &a, None), (1, "A again", &a, None)]).unwrap());
+    assert_eq!(top_titles(&twice), ["A", "A again"]);
+    // A page that isn't there is refused, as combine_selected does.
+    assert!(matches!(crate::combine_grouped(&[(0, "A", &a, Some(&[9]))]), Err(crate::OrganizeError::NoSuchPage(9))));
+}
+
 #[test]
 fn combine_nests_source_bookmarks_and_keeps_attachments() {
     let out = full_roundtrip(&combine(&[("C", &doc_c()), ("C again", &doc_c())]).unwrap());
@@ -683,10 +898,72 @@ fn combine_and_insert_share_identical_resources() {
     assert_eq!(labels(&d), ["A1", "A2", "A3", "A1", "A2"]);
 }
 
+/// A one-page document drawing one image, written the way ImageMagick writes it: the colour
+/// space is an indirect `/DeviceRGB` object of its own (#878).
+fn indirect_colour_space_doc() -> Document {
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Resources << /XObject << /Im0 5 0 R >> >> /Contents 4 0 R >>".to_vec(),
+        stream(b"q 100 0 0 100 0 0 cm /Im0 Do Q"),
+        [
+            b"<< /Type /XObject /Subtype /Image /Width 2 /Height 1 /ColorSpace 6 0 R /BitsPerComponent 8 /Length 6 >>\nstream\n".as_slice(),
+            &[255, 0, 0, 0, 0, 255],
+            b"\nendstream",
+        ]
+        .concat(),
+        b"/DeviceRGB".to_vec(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    open(out)
+}
+
+#[test]
+fn combine_stores_an_image_once_when_its_colour_space_is_an_indirect_name() {
+    let images = |d: &Document| {
+        d.object_numbers()
+            .into_iter()
+            .filter(|n| matches!(&*d.get(ObjRef::new(*n, d.generation(*n))), Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image")))
+            .count()
+    };
+    let src = indirect_colour_space_doc();
+    let out = full_roundtrip(&crate::combine(&[("one", &src), ("two", &src), ("three", &src)]).unwrap());
+    assert_eq!(images(&out), 1);
+    assert_eq!(pages(&out).unwrap().len(), 3);
+    // Inserting the same pages again reuses the image already there.
+    let mut d = indirect_colour_space_doc();
+    crate::import_pages(&mut d, &indirect_colour_space_doc(), &[0], 1).unwrap();
+    assert_eq!(images(&full_roundtrip(&d)), 1);
+}
+
 // ---- bookmarks (M4.6) --------------------------------------------------------------------------
 
+/// The titles with children in brackets (`Parent[Child,Child]`), one per top-level bookmark.
 fn titles(b: &[crate::Bookmark]) -> Vec<String> {
-    b.iter().map(|x| if x.children.is_empty() { x.title.clone() } else { format!("{}[{}]", x.title, titles(&x.children).join(",")) }).collect()
+    fn level(b: &[crate::Bookmark], at: &mut usize, depth: usize) -> Vec<String> {
+        let mut out = Vec::new();
+        while let Some(x) = b.get(*at).filter(|x| x.path.len() == depth + 1) {
+            *at += 1;
+            let kids = level(b, at, depth + 1);
+            out.push(if kids.is_empty() { x.title.clone() } else { format!("{}[{}]", x.title, kids.join(",")) });
+        }
+        out
+    }
+    let mut at = 0;
+    level(b, &mut at, 0)
 }
 
 fn count_of(doc: &Document, r: ObjRef) -> Option<i64> {
@@ -747,11 +1024,12 @@ fn a_bookmark_tree_nests_entries_by_level_under_a_new_first_bookmark() {
 
     let b = crate::bookmarks(&d);
     let root = d.get(d.root().unwrap()).as_dict().unwrap().reference(b"Outlines").unwrap();
-    assert_eq!((count_of(&d, root), count_of(&d, b[0].obj), count_of(&d, b[0].children[0].obj)), (Some(6), Some(4), Some(2)));
-    let one = d.get(b[0].children[0].obj).as_dict().cloned().unwrap();
+    // Listing order: Untitled, One, Deep, Two, Next, Existing.
+    assert_eq!((count_of(&d, root), count_of(&d, b[0].obj), count_of(&d, b[1].obj)), (Some(6), Some(4), Some(2)));
+    let one = d.get(b[1].obj).as_dict().cloned().unwrap();
     assert_eq!(one.get(b"SE"), Some(&Object::Ref(se)));
     let pages = crate::walk(&d).unwrap();
-    let next = d.get(b[0].children[1].obj).as_dict().cloned().unwrap();
+    let next = d.get(b[4].obj).as_dict().cloned().unwrap();
     assert_eq!(next.get(b"Dest").and_then(|x| x.as_array()).map(|a| a[0].clone()), Some(Object::Ref(pages[2].0)));
 
     assert_eq!(crate::add_bookmark_tree(&mut d, "Untitled", &[]), Err(crate::OutlineError::NoEntries));
@@ -775,6 +1053,136 @@ fn bookmark_edits_keep_unknown_keys_and_touch_few_objects() {
     assert_eq!(d.modified_objects(), vec![b[0].obj.num], "a rename rewrites only that item");
 }
 
+/// A flat outline of `n` top-level bookmarks, `Item 0` to `Item n-1`, all going to one page.
+fn flat_outline(n: usize) -> Vec<u8> {
+    let mut b: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /Outlines 3 0 R >>".into(),
+        "<< /Type /Pages /Kids [4 0 R] /Count 1 /MediaBox [0 0 300 400] >>".into(),
+        format!("<< /Type /Outlines /First 5 0 R /Last {} 0 R /Count {n} >>", 4 + n),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+    ];
+    for k in 0..n {
+        let prev = if k == 0 { String::new() } else { format!(" /Prev {} 0 R", 4 + k) };
+        let next = if k + 1 == n { String::new() } else { format!(" /Next {} 0 R", 6 + k) };
+        b.push(format!("<< /Title (Item {k}) /Parent 3 0 R{prev}{next} /Dest [4 0 R /Fit] >>"));
+    }
+    build(&b, "/Root 1 0 R")
+}
+
+#[test]
+fn a_bookmark_past_the_hundred_thousandth_is_listed() {
+    let d = open(flat_outline(100_005));
+    let all = crate::bookmarks(&d);
+    assert_eq!(all.len(), 100_005);
+    assert_eq!(all.last().map(|b| b.title.as_str()), Some("Item 100004"));
+}
+
+/// A chain of `n` nested bookmarks: each is the first child of the one before it.
+fn deep_outline(n: usize) -> Vec<u8> {
+    let mut b: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /Outlines 3 0 R >>".into(),
+        "<< /Type /Pages /Kids [4 0 R] /Count 1 /MediaBox [0 0 300 400] >>".into(),
+        "<< /Type /Outlines /First 5 0 R /Last 5 0 R /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+    ];
+    for k in 0..n {
+        let parent = if k == 0 { 3 } else { 4 + k };
+        let first = if k + 1 == n { String::new() } else { format!(" /First {} 0 R /Count -1", 6 + k) };
+        b.push(format!("<< /Title (Deep {k}) /Parent {parent} 0 R{first} /Dest [4 0 R /Fit] >>"));
+    }
+    build(&b, "/Root 1 0 R")
+}
+
+#[test]
+fn deep_bookmark_chains_edit_without_recursion() {
+    let mut d = open(deep_outline(100_000));
+    // Adding at the top level recounts the whole outline, which walks the entire chain.
+    crate::add_bookmark(&mut d, &[], 1, "Extra", 0).unwrap();
+    // Listing enters levels 0 to 32 of the chain; the rest is reached by path only.
+    let listed = crate::bookmarks(&d);
+    assert_eq!(listed.len(), 34);
+    assert_eq!(listed.last().map(|b| (b.title.as_str(), b.path.clone())), Some(("Extra", vec![1])));
+    assert_eq!(listed[32].path.len(), 33);
+    assert_eq!(crate::bookmark_page(&d, 33, 10).bookmarks.len(), 1);
+}
+
+/// A one-page document whose outline is the given bookmark bodies, as objects 5, 6, … in order.
+fn outline_with(items: &[&str]) -> Document {
+    let mut b: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /Outlines 3 0 R >>".into(),
+        "<< /Type /Pages /Kids [4 0 R] /Count 1 /MediaBox [0 0 300 400] >>".into(),
+        format!("<< /Type /Outlines /First 5 0 R /Count {} >>", items.len()),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+    ];
+    b.extend(items.iter().map(|s| s.to_string()));
+    open(build(&b, "/Root 1 0 R"))
+}
+
+#[test]
+fn hostile_outlines_end_their_runs_and_never_loop() {
+    let listed = |items: &[&str]| titles(&crate::bookmarks(&outline_with(items)));
+    // A bookmark that is its own next sibling, or its own first child.
+    assert_eq!(listed(&["<< /Title (Self) /Parent 3 0 R /Next 5 0 R >>"]), ["Self"]);
+    assert_eq!(listed(&["<< /Title (Self) /Parent 3 0 R /First 5 0 R >>"]), ["Self"]);
+    // Two siblings that point at each other: the run ends where it would repeat.
+    assert_eq!(listed(&["<< /Title (A) /Parent 3 0 R /Next 6 0 R >>", "<< /Title (B) /Parent 3 0 R /Next 5 0 R >>"]), ["A", "B"]);
+    // A child that leads back to its ancestor.
+    assert_eq!(listed(&["<< /Title (A) /Parent 3 0 R /First 6 0 R >>", "<< /Title (B) /Parent 5 0 R /First 5 0 R >>"]), ["A[B]"]);
+    // A broken `/Next` (a missing object, then a number) and a missing first bookmark.
+    assert_eq!(listed(&["<< /Title (A) /Parent 3 0 R /Next 99 0 R >>"]), ["A"]);
+    assert_eq!(listed(&["<< /Title (A) /Parent 3 0 R /Next 6 0 R >>", "42"]), ["A"]);
+    assert!(listed(&[]).is_empty());
+}
+
+#[test]
+fn bookmark_pages_list_every_bookmark_once() {
+    let d = open(flat_outline(250));
+    let mut seen = Vec::new();
+    let mut offset = 0;
+    while let Some(next) = {
+        let page = crate::bookmark_page(&d, offset, 100);
+        assert!(page.bookmarks.len() <= 100);
+        seen.extend(page.bookmarks.iter().map(|b| b.title.clone()));
+        page.next
+    } {
+        assert_eq!(next, seen.len(), "a page ends where the next one starts");
+        offset = next;
+    }
+    assert_eq!(seen.len(), 250);
+    assert_eq!(seen.last().map(String::as_str), Some("Item 249"));
+
+    let big = open(flat_outline(100_005));
+    let first = crate::bookmark_page(&big, 0, 100);
+    assert_eq!((first.bookmarks.len(), first.next), (100, Some(100)));
+    let late = crate::bookmark_page(&big, 100_000, 100);
+    assert_eq!(
+        late.bookmarks.iter().map(|b| b.title.as_str()).collect::<Vec<_>>(),
+        ["Item 100000", "Item 100001", "Item 100002", "Item 100003", "Item 100004"]
+    );
+    assert_eq!((late.bookmarks[4].path.clone(), late.next), (vec![100_004], None));
+}
+
+#[test]
+fn bookmarks_name_their_pages_through_every_kind_of_destination() {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /Outlines 3 0 R /Names << /Dests 9 0 R >> >>".into(),
+        "<< /Type /Pages /Kids [4 0 R 5 0 R] /Count 2 /MediaBox [0 0 300 400] >>".into(),
+        "<< /Type /Outlines /First 6 0 R /Last 11 0 R /Count 6 >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+        "<< /Type /Page /Parent 2 0 R >>".into(),
+        "<< /Title (Named) /Parent 3 0 R /Next 7 0 R /Dest (intro) >>".into(),
+        "<< /Title (GoTo) /Parent 3 0 R /Prev 6 0 R /Next 8 0 R /A << /S /GoTo /D [5 0 R /Fit] >> >>".into(),
+        "<< /Title (Appendix) /Parent 3 0 R /Prev 7 0 R /Next 10 0 R /Dest /appendix >>".into(),
+        "<< /Names [(appendix) 12 0 R (intro) [4 0 R /Fit]] >>".into(),
+        "<< /Title <FEFF00480069> /Parent 3 0 R /Prev 8 0 R /Next 11 0 R /Dest [1 /Fit] >>".into(),
+        "<< /Title (  Padded  ) /Parent 3 0 R /Prev 10 0 R /Dest [2 0 R /Fit] >>".into(),
+        "<< /D [5 0 R /Fit] >>".into(),
+    ];
+    let d = open(build(&objs, "/Root 1 0 R"));
+    let listed: Vec<String> = crate::bookmarks(&d).iter().map(|b| format!("{}@{:?}", b.title, b.page)).collect();
+    assert_eq!(listed, ["Named@Some(0)", "GoTo@Some(1)", "Appendix@Some(1)", "Hi@Some(1)", "Padded@None"]);
+}
+
 // ---- page labels (M4.4) ------------------------------------------------------------------------
 
 #[test]
@@ -987,6 +1395,53 @@ fn page_label_too_long_range_falls_back_alone() {
     assert_eq!(labels[1], "2");
 }
 
+/// A document whose page tree is one flat node over `pages` leaves. The label tests below need
+/// more pages than `doc_a` has.
+fn flat_doc(pages: usize) -> Document {
+    let kids = (0..pages).map(|i| format!("{} 0 R", i + 3)).collect::<Vec<_>>().join(" ");
+    let mut objs = vec!["<< /Type /Catalog /Pages 2 0 R >>".to_string(), format!("<< /Type /Pages /Kids [{kids}] /Count {pages} >>")];
+    objs.extend((0..pages).map(|_| "<< /Type /Page /Parent 2 0 R >>".to_string()));
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, body) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for offset in offsets {
+        out.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    open(out)
+}
+
+/// Each label is valid (1,004 bytes), but the 5,000 of them total about 5 MB, past the old 4 MiB
+/// limit on the whole sequence. Every label is readable.
+#[test]
+fn page_labels_past_four_mib_in_total_stay_readable() {
+    let mut d = flat_doc(5_000);
+    let mut spec = Dict::new();
+    spec.set(b"P".to_vec(), Object::String(PdfString::text(&"x".repeat(1000))));
+    spec.set(b"S".to_vec(), Object::name("D"));
+    let mut tree = Dict::new();
+    tree.set(b"Nums".to_vec(), Object::Array(vec![Object::Int(0), Object::Dict(spec)]));
+    let tree = d.add(Object::Dict(tree));
+    d.update_dict(d.root().unwrap(), |c| c.set(b"PageLabels".to_vec(), Object::Ref(tree))).unwrap();
+    let labels = crate::page_labels(&d).unwrap();
+    assert_eq!(labels.len(), 5_000);
+    assert_eq!(labels[0], format!("{}1", "x".repeat(1000)));
+    assert_eq!(labels[4_999], format!("{}5000", "x".repeat(1000)));
+}
+
+/// The same 5,000 labels written by an edit: the edit is accepted and reads back.
+#[test]
+fn number_pages_past_four_mib_in_total_is_accepted() {
+    let mut d = flat_doc(5_000);
+    crate::number_pages(&mut d, 0, 4_999, crate::LabelStyle::Decimal, &"x".repeat(1000), 1).unwrap();
+    assert_eq!(crate::page_labels(&d).unwrap()[4_999], format!("{}5000", "x".repeat(1000)));
+}
+
 #[test]
 fn page_boxes_default_inherit_and_set() {
     let mut doc = open(fixture());
@@ -1183,3 +1638,27 @@ fn extract_keeps_images_type3_glyphs_may_draw() {
     let names = xobject_names(&part, 0);
     assert!(names.iter().any(|n| n.as_slice() == b"ImB"), "pruning must not run through Type 3 resources");
 }
+
+/// A page listed twice whose widget's field keeps `/Kids` as an array object of its own: the
+/// second widget joins that array, and the field keeps every widget it had.
+#[test]
+fn a_repeated_widget_joins_an_indirect_kids_array() {
+    let b: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [6 0 R] >> >>".into(), // 1
+        "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 300 400] >>".into(), // 2
+        "<< /Type /Page /Parent 2 0 R /Annots [5 0 R] >>".into(),                   // 3
+        "<< /Type /Page /Parent 2 0 R /Annots [8 0 R] >>".into(),                   // 4
+        "<< /Type /Annot /Subtype /Widget /Parent 6 0 R /Rect [10 10 90 30] /P 3 0 R >>".into(), // 5
+        "<< /FT /Tx /T (name) /V (Ada) /Kids 7 0 R >>".into(),                      // 6
+        "[5 0 R 8 0 R]".into(),                                                     // 7
+        "<< /Type /Annot /Subtype /Widget /Parent 6 0 R /Rect [10 40 90 60] /P 4 0 R >>".into(), // 8
+    ];
+    let src = open(build(&b, "/Root 1 0 R"));
+    let out = full_roundtrip(&extract_pages(&src, &[0, 0, 1]).unwrap());
+    let form = out.resolve(catalog(&out).get(b"AcroForm").unwrap());
+    let fields = form.as_dict().unwrap().get(b"Fields").and_then(Object::as_array).cloned().unwrap();
+    assert_eq!(fields.len(), 1, "one field");
+    let field = out.resolve(&fields[0]).as_dict().cloned().unwrap();
+    let kids = out.resolve(field.get(b"Kids").unwrap()).as_array().cloned().unwrap();
+    assert_eq!(kids.len(), 3, "both original widgets and the repeat's own: {kids:?}");
+}
diff --git a/crates/platform/Cargo.toml b/crates/platform/Cargo.toml
index 54e7030a3..d3644b913 100644
--- a/crates/platform/Cargo.toml
+++ b/crates/platform/Cargo.toml
@@ -9,3 +9,9 @@ license.workspace = true
 workspace = true
 
 [dependencies]
+
+[target.'cfg(target_os = "linux")'.dependencies]
+# The desktop's light/dark choice (see `desktop_theme.rs`). Already in the tree, with the features
+# this needs, through accesskit's accessibility bus; pinned to the same version so nothing is
+# built twice.
+zbus = "=5.19.0"
diff --git a/crates/platform/src/desktop_theme.rs b/crates/platform/src/desktop_theme.rs
new file mode 100644
index 000000000..9b88f9efe
--- /dev/null
+++ b/crates/platform/src/desktop_theme.rs
@@ -0,0 +1,136 @@
+//! The desktop's own light/dark choice, for an interface setting that follows it.
+//!
+//! winit reports no system theme on Linux — `ActiveEventLoop::system_theme` is `None` on every
+//! desktop there — so "Use system setting" has to ask the desktop itself. The XDG Desktop Portal's
+//! Settings interface answers on GNOME, KDE and XFCE alike, over X11 and Wayland alike.
+
+use std::sync::mpsc::{Receiver, TryRecvError, channel};
+use std::time::Duration;
+
+/// How often [`DesktopTheme::start`] re-reads the desktop's answer. The portal also publishes a
+/// change signal, but subscribing needs a connection kept alive for the life of every window; one
+/// round trip every few seconds is cheap and reacts soon enough after a theme switch.
+const POLL: Duration = Duration::from_secs(4);
+
+/// Whether the desktop asks applications to draw dark. `None` when it says nothing, and when
+/// there is no session bus or no portal to ask (a bare X server, a container), so the caller
+/// keeps whatever it chose itself.
+pub fn prefers_dark() -> Option<bool> {
+    read()
+}
+
+/// Watches the desktop and reports its choice when it changes. [`prefers_dark`] covers the
+/// answer at start-up; this covers the user switching theme while the app runs.
+#[derive(Default)]
+pub struct DesktopTheme {
+    /// `None` when no watcher thread could be started; the one-shot read still works.
+    changes: Option<Receiver<Option<bool>>>,
+}
+
+impl DesktopTheme {
+    /// Start watching. Nothing runs before this is called, and calling it once is enough. The
+    /// first answer is sent straight away, so the caller does not have to ask for it separately.
+    pub fn start() -> Self {
+        let (tx, rx) = channel();
+        let started = std::thread::Builder::new().name("pdfcraft-desktop-theme".into()).spawn(move || {
+            let mut last = read();
+            if tx.send(last).is_err() {
+                return;
+            }
+            loop {
+                std::thread::sleep(POLL);
+                let now = read();
+                if now != last {
+                    last = now;
+                    if tx.send(now).is_err() {
+                        return;
+                    }
+                }
+            }
+        });
+        Self { changes: started.ok().map(|_| rx) }
+    }
+
+    /// The desktop's new answer if it changed since the last call, to be polled once a frame.
+    /// Several changes in one frame collapse to the newest, and a desktop that stops answering
+    /// leaves the last answer in place.
+    pub fn take_change(&mut self) -> Option<bool> {
+        let Some(changes) = &self.changes else { return None };
+        let mut newest = None;
+        loop {
+            match changes.try_recv() {
+                Ok(changed) => newest = changed,
+                Err(TryRecvError::Empty) | Err(TryRecvError::Disconnected) => return newest,
+            }
+        }
+    }
+}
+
+/// Ask the portal once. D-Bus calls block, so this belongs off the UI thread: the watcher's
+/// thread is its only caller.
+#[cfg(target_os = "linux")]
+fn read() -> Option<bool> {
+    const PORTAL: &str = "org.freedesktop.portal.Desktop";
+    const SETTINGS: &str = "org.freedesktop.portal.Settings";
+    // The colour scheme under its GNOME schema name first: GNOME's portal answers it, and so
+    // does XFCE's, which proxies the GSettings schemas but not the older freedesktop one. KDE
+    // answers only the second.
+    const SCHEMAS: [(&str, &str); 2] = [("org.gnome.desktop.interface", "color-scheme"), ("org.freedesktop.interface.color-scheme", "color-scheme")];
+    let connection = zbus::blocking::Connection::session().ok()?;
+    for (schema, key) in SCHEMAS {
+        let Ok(reply) = connection.call_method(Some(PORTAL), "/org/freedesktop/portal/desktop", Some(SETTINGS), "ReadOne", &(schema, key)) else {
+            continue;
+        };
+        let Ok((answer,)) = reply.body().deserialize::<(zbus::zvariant::OwnedValue,)>() else { continue };
+        // The reply is one variant wrapping a string.
+        if let Ok(scheme) = String::try_from(&*answer) {
+            return parse(&scheme);
+        }
+    }
+    None
+}
+
+/// The portal's `color-scheme` answer. `default` means the desktop states no preference, so
+/// neither does the application.
+#[cfg(target_os = "linux")]
+fn parse(scheme: &str) -> Option<bool> {
+    match scheme {
+        "prefer-dark" => Some(true),
+        "prefer-light" => Some(false),
+        _ => None,
+    }
+}
+
+/// macOS and Windows answer through winit, which the caller already has.
+#[cfg(not(target_os = "linux"))]
+fn read() -> Option<bool> {
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The portal answers with one of three strings; only the two preferences are a choice.
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn the_portal_answer_reads_as_a_choice_or_as_none() {
+        assert_eq!(parse("prefer-dark"), Some(true));
+        assert_eq!(parse("prefer-light"), Some(false));
+        assert_eq!(parse("default"), None);
+        assert_eq!(parse(""), None);
+    }
+
+    /// Off Linux the caller already has winit's answer, so this adds nothing.
+    #[test]
+    #[cfg(not(target_os = "linux"))]
+    fn other_platforms_answer_through_winit() {
+        assert_eq!(prefers_dark(), None);
+    }
+
+    /// A watcher that was never started is inert rather than a panic.
+    #[test]
+    fn a_watcher_without_a_thread_is_inert() {
+        assert_eq!(DesktopTheme::default().take_change(), None);
+    }
+}
diff --git a/crates/platform/src/lib.rs b/crates/platform/src/lib.rs
index 799eb5669..684f100d3 100644
--- a/crates/platform/src/lib.rs
+++ b/crates/platform/src/lib.rs
@@ -3,4 +3,5 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+pub mod desktop_theme;
 pub mod staging;
diff --git a/crates/print/src/lib.rs b/crates/print/src/lib.rs
index 35e4661c3..7566f8caf 100644
--- a/crates/print/src/lib.rs
+++ b/crates/print/src/lib.rs
@@ -478,7 +478,8 @@ fn appearance_matrix(doc: &Document, form: &Dict, rect: [f64; 4]) -> Option<Matr
         rect[0] - b[0] * (rect[2] - rect[0]) / bw,
         rect[1] - b[1] * (rect[3] - rect[1]) / bh,
     ]);
-    Some(m.then(&a))
+    // The Do that draws the form applies its /Matrix itself, so only the placement goes here.
+    Some(a)
 }
 
 /// A Form XObject holding page `index` as it prints (user space; BBox = crop box).
diff --git a/crates/print/src/tests.rs b/crates/print/src/tests.rs
index 677762bea..b57e93b0f 100644
--- a/crates/print/src/tests.rs
+++ b/crates/print/src/tests.rs
@@ -469,3 +469,16 @@ fn printer_option_defaults_and_job_arguments() {
     assert!(args.ends_with("-o fit-to-page=false -o InputSlot=Tray2 -o EFMediaType=Heavy1"), "{args}");
     assert!(spool::printer_options("../../etc/passwd").is_empty(), "not a queue name");
 }
+
+#[test]
+fn a_scaled_appearance_is_not_scaled_twice() {
+    let doc = fixture(1);
+    let nums = |v: [f64; 6]| Object::Array(v.iter().map(|x| Object::Real(*x)).collect());
+    let mut form = Dict::new();
+    form.set(b"BBox".to_vec(), Object::Array([0.0, 0.0, 10.0, 10.0].iter().map(|x| Object::Real(*x)).collect()));
+    form.set(b"Matrix".to_vec(), nums([2.0, 0.0, 0.0, 2.0, 0.0, 0.0]));
+    // The form's own /Matrix doubles it to 20x20 when drawn; the placement only has to map 20x20 onto the 40x40 rect.
+    let m = appearance_matrix(&doc, &form, [10.0, 10.0, 50.0, 50.0]).unwrap();
+    assert!(close(m.0[0], 2.0) && close(m.0[3], 2.0), "{:?}", m.0);
+    assert!(close(m.0[4], 10.0) && close(m.0[5], 10.0), "{:?}", m.0);
+}
diff --git a/crates/redact/src/patterns.rs b/crates/redact/src/patterns.rs
index 7d9a54f71..0af3b02a9 100644
--- a/crates/redact/src/patterns.rs
+++ b/crates/redact/src/patterns.rs
@@ -100,9 +100,24 @@ fn phone(s: &[char], i: usize) -> Option<usize> {
     ok.then_some(end - i)
 }
 
+/// Scripts written without spaces between words (Chinese, Japanese, Korean, Thai, …): text in
+/// them often runs straight into an address, so their letters never count as part of one.
+fn spaceless(c: char) -> bool {
+    matches!(
+        u32::from(c),
+        0x0E00..=0x0EFF | 0x1000..=0x109F | 0x1100..=0x11FF | 0x1780..=0x17FF | 0x2E80..=0x9FFF | 0xA960..=0xA97F | 0xAC00..=0xD7FF | 0xF900..=0xFAFF | 0xFF00..=0xFFEF | 0x20000..=0x3FFFF
+    )
+}
+
+/// A letter or digit of an address: ASCII, or of any script written with spaces, so
+/// internationalized addresses (RFC 6531, IDN) such as "ayşe@örnek.com.tr" match.
+fn address_char(c: char) -> bool {
+    c.is_ascii_alphanumeric() || c.is_alphanumeric() && !spaceless(c)
+}
+
 fn email(s: &[char], i: usize) -> Option<usize> {
-    let local = |c: &char| c.is_ascii_alphanumeric() || "._%+-".contains(*c);
-    if !s[i].is_ascii_alphanumeric() || i.checked_sub(1).and_then(|p| s.get(p)).is_some_and(local) {
+    let local = |c: &char| address_char(*c) || "._%+-".contains(*c);
+    if !address_char(s[i]) || i.checked_sub(1).and_then(|p| s.get(p)).is_some_and(local) {
         return None;
     }
     let mut j = i;
@@ -114,12 +129,12 @@ fn email(s: &[char], i: usize) -> Option<usize> {
     }
     let d0 = j + 1;
     let mut k = d0;
-    while k < s.len() && (s[k].is_ascii_alphanumeric() || s[k] == '-' || s[k] == '.' && s.get(k + 1).is_some_and(char::is_ascii_alphanumeric)) {
+    while k < s.len() && (address_char(s[k]) || s[k] == '-' || s[k] == '.' && s.get(k + 1).is_some_and(|c| address_char(*c))) {
         k += 1;
     }
     let domain: String = s[d0..k].iter().collect();
     let tld = domain.rsplit('.').next().unwrap_or("");
-    (domain.contains('.') && tld.len() >= 2 && tld.chars().all(|c| c.is_ascii_alphabetic())).then_some(k - i)
+    (domain.contains('.') && tld.chars().count() >= 2 && tld.chars().all(char::is_alphabetic)).then_some(k - i)
 }
 
 fn luhn(digits: &[u32]) -> bool {
@@ -164,26 +179,53 @@ fn ssn(s: &[char], i: usize) -> Option<usize> {
     (area != "000" && area != "666" && !area.starts_with('9')).then_some(11)
 }
 
-const MONTHS: [&str; 12] = ["january", "february", "march", "april", "may", "june", "july", "august", "september", "october", "november", "december"];
+/// Month names the date pattern knows: English, then the languages whose dates are written
+/// "5 Ekim 2024" / "5. Oktober 2024" (day, month name, year).
+const MONTHS: [[&str; 12]; 5] = [
+    ["january", "february", "march", "april", "may", "june", "july", "august", "september", "october", "november", "december"],
+    ["ocak", "şubat", "mart", "nisan", "mayıs", "haziran", "temmuz", "ağustos", "eylül", "ekim", "kasım", "aralık"],
+    ["januar", "februar", "märz", "april", "mai", "juni", "juli", "august", "september", "oktober", "november", "dezember"],
+    ["janvier", "février", "mars", "avril", "mai", "juin", "juillet", "août", "septembre", "octobre", "novembre", "décembre"],
+    ["gennaio", "febbraio", "marzo", "aprile", "maggio", "giugno", "luglio", "agosto", "settembre", "ottobre", "novembre", "dicembre"],
+];
 
-/// A month name or its three-letter abbreviation (optionally with a full stop) at `i`.
+/// Abbreviations that may end in a full stop: English and Turkish ("Oca.", "Şub", "Ağu").
+const MONTH_ABBREVIATIONS: [[&str; 12]; 2] = [
+    ["jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec"],
+    ["oca", "şub", "mar", "nis", "may", "haz", "tem", "ağu", "eyl", "eki", "kas", "ara"],
+];
+
+/// One lowercase character for `c`, with Turkish dotted and dotless i the same as i, so
+/// "MAYIS", "Mayıs" and "EKİM" match and every character stays one character.
+fn fold(c: char) -> char {
+    match c {
+        'I' | '\u{130}' | '\u{131}' => 'i',
+        _ => c.to_lowercase().next().unwrap_or(c),
+    }
+}
+
+/// Characters `name` covers at `i`, when it stands there as a whole word (any case).
+fn word_at(s: &[char], i: usize, name: &str) -> Option<usize> {
+    let mut n = 0;
+    for c in name.chars() {
+        if s.get(i + n).copied().map(fold) != Some(fold(c)) {
+            return None;
+        }
+        n += 1;
+    }
+    (!s.get(i + n).is_some_and(|c| c.is_alphabetic())).then_some(n)
+}
+
+/// A month name or its abbreviation (optionally with a full stop) at `i`.
 fn month(s: &[char], i: usize) -> Option<usize> {
     if word(i.checked_sub(1).and_then(|p| s.get(p))) {
         return None;
     }
-    let rest: String = s[i..s.len().min(i + 10)].iter().collect::<String>().to_lowercase();
-    for m in MONTHS {
-        for cand in [m, &m[..3]] {
-            if rest.starts_with(cand) && !rest[cand.len()..].starts_with(|c: char| c.is_alphabetic()) {
-                let mut n = cand.chars().count();
-                if cand.len() == 3 && s.get(i + n) == Some(&'.') {
-                    n += 1;
-                }
-                return Some(n);
-            }
-        }
+    if let Some(n) = MONTHS.iter().flatten().filter_map(|m| word_at(s, i, m)).max() {
+        return Some(n);
     }
-    None
+    let n = MONTH_ABBREVIATIONS.iter().flatten().find_map(|m| word_at(s, i, m))?;
+    Some(if s.get(i + n) == Some(&'.') { n + 1 } else { n })
 }
 
 fn number(s: &[char], i: usize, min: usize, max: usize) -> Option<usize> {
@@ -208,10 +250,11 @@ fn date(s: &[char], i: usize) -> Option<usize> {
         {
             return Some(a + b + c + 2);
         }
-        // "5 January 2024".
+        // "5 January 2024", "5 Ekim 2024", "5. Oktober 2024".
+        let day = i + a + usize::from(s.get(i + a) == Some(&'.'));
         if a <= 2
-            && let k = i + a + spaces(i + a)
-            && k > i + a
+            && let k = day + spaces(day)
+            && k > day
             && let Some(m) = month(s, k)
         {
             let k2 = k + m + spaces(k + m);
@@ -323,6 +366,18 @@ mod tests {
         );
     }
 
+    #[test]
+    fn internationalized_emails() {
+        assert_eq!(
+            found(Pattern::Email, "Yazın: ayşe.yılmaz@örnek.com.tr, ÇAĞLAR@ŞİRKET.COM.TR; müller@bücher.de, иван@пример.рф, josé@correo.es."),
+            ["ayşe.yılmaz@örnek.com.tr", "ÇAĞLAR@ŞİRKET.COM.TR", "müller@bücher.de", "иван@пример.рф", "josé@correo.es"]
+        );
+        // Text in scripts without spaces stays out of the address around it.
+        assert_eq!(found(Pattern::Email, "メールはtaro@example.jpまで、联系support@example.cn谢谢"), ["taro@example.jp", "support@example.cn"]);
+        // Still no address without a dot in the domain or with a one-letter or numeric TLD.
+        assert_eq!(found(Pattern::Email, "ayşe@örnek, ş@ğ.ü, kişi@alan.123, a@b.c"), Vec::<String>::new());
+    }
+
     #[test]
     fn credit_cards_need_a_valid_checksum() {
         assert_eq!(
@@ -346,4 +401,37 @@ mod tests {
             ["10/01/2026", "2026-10-01", "1.10.26", "March 5, 2024", "Jan. 7 2025", "5 June 2023"]
         );
     }
+
+    #[test]
+    fn dates_with_turkish_month_names_in_any_case() {
+        assert_eq!(
+            found(Pattern::Date, "Tarih: 10 Ekim 2026, 3 Mayıs 2025, 5 Şubat 2024, 5 ŞUBAT 2024, 3 MAYIS 2025, 1 EKİM 2026 ve 9 kasım 2023."),
+            ["10 Ekim 2026", "3 Mayıs 2025", "5 Şubat 2024", "5 ŞUBAT 2024", "3 MAYIS 2025", "1 EKİM 2026", "9 kasım 2023"]
+        );
+        assert_eq!(
+            found(Pattern::Date, "12 Oca 2024, 7 Şub. 2025, 30 Ağu 2023, 1 ARA. 2022, 2 Haz 2021"),
+            ["12 Oca 2024", "7 Şub. 2025", "30 Ağu 2023", "1 ARA. 2022", "2 Haz 2021"]
+        );
+        // Words that only start like a month, or a month without a day and year, stay.
+        assert_eq!(
+            found(Pattern::Date, "5 Martı 2024, Ekimde 2026, 3 Mayısta 2025, ara 2024, Kasım ayında, 12 Aralık, Aralık 2024"),
+            Vec::<String>::new()
+        );
+    }
+
+    #[test]
+    fn dates_with_german_french_and_italian_month_names() {
+        assert_eq!(
+            found(Pattern::Date, "am 10. Oktober 2026, 3 März 2025, le 14 juillet 2024, 1 août 2023, il 25 dicembre 2022"),
+            ["10. Oktober 2026", "3 März 2025", "14 juillet 2024", "1 août 2023", "25 dicembre 2022"]
+        );
+        // "Mai" alone, a dotted day without a month and an unknown word are not dates.
+        assert_eq!(found(Pattern::Date, "Mai 2024, Kapitel 5. Absatz 2024, 5 Oktoberfest 2024"), Vec::<String>::new());
+    }
+
+    #[test]
+    fn case_folding_keeps_one_character_per_character() {
+        let s: Vec<char> = "\u{130}\u{131}I\u{15E}".chars().collect();
+        assert_eq!(s.iter().copied().map(fold).collect::<String>(), "iii\u{15F}");
+    }
 }
diff --git a/crates/render/src/inspect.rs b/crates/render/src/inspect.rs
index 995ec50cc..ab20f5608 100644
--- a/crates/render/src/inspect.rs
+++ b/crates/render/src/inspect.rs
@@ -30,6 +30,13 @@ const MAX_LAYER_STATE: usize = 1024;
 /// At most this many layers are read from all of `/RBGroups` together.
 const MAX_LAYER_GROUP_ENTRIES: usize = 4096;
 
+/// `DocInfo::outline` holds the first this many bookmarks in outline order. Opening a document
+/// reads only this window; the rest are listed by page through `pdfcraft_organize`.
+const OUTLINE_WINDOW: usize = 10_000;
+
+/// Deepest level `DocInfo::outline` nests (the top level is 0); deeper bookmarks are left out.
+const OUTLINE_DEPTH: usize = 32;
+
 fn load_options(password: Option<&str>) -> LoadOptions {
     LoadOptions { password: password.map(str::to_owned), max_decompressed_size: Some(LOAD_STREAM_LIMIT), ..LoadOptions::default() }
 }
@@ -51,6 +58,8 @@ pub struct DocInfo {
     pub xfa: Option<Xfa>,
     pub pages: Vec<PageInfo>,
     pub outline: Vec<OutlineItem>,
+    /// The outline has bookmarks that `outline` leaves out (see `OUTLINE_WINDOW`, `OUTLINE_DEPTH`).
+    pub outline_more: bool,
     pub annotations: Vec<Annotation>,
     pub fields: Vec<Field>,
     pub links: Vec<Link>,
@@ -264,6 +273,9 @@ pub struct Annotation {
     pub locked: bool,
     /// `/IT`, the intent: `FreeTextCallout`, `PolygonCloud`, `FreeTextTypeWriter`…
     pub intent: Option<String>,
+    /// A Fill & Sign mark: typed text, a check, cross, dot or line, or a typed, drawn or picture
+    /// signature or initials (the rules of `pdfcraft_annot::is_fill_sign`).
+    pub fill_sign: bool,
 }
 
 impl Annotation {
@@ -472,8 +484,7 @@ impl<'a> Inspector<'a> {
             Err(reason) => info.warnings.push(format!("Page labels were skipped: {reason}; using physical page numbers.")),
         }
         if let Some(first) = catalog.get(b"Outlines").ok().and_then(|o| self.dict(o)).and_then(|d| d.get(b"First").ok()) {
-            let mut seen = HashSet::new();
-            info.outline = self.outline_siblings(first, &mut seen, 0);
+            (info.outline, info.outline_more) = self.outline_window(first);
         }
         self.annotations(info);
         let mut field_seen = HashSet::new();
@@ -553,6 +564,25 @@ impl<'a> Inspector<'a> {
         self.resolve(d.get(key).ok()?).as_name().ok().map(|n| String::from_utf8_lossy(n).into_owned())
     }
 
+    /// Whether an annotation is a Fill & Sign mark. Keep in step with
+    /// `pdfcraft_annot::is_fill_sign`, which the engine's comment list uses.
+    fn is_fill_sign(&self, d: &Dictionary, subtype: &str) -> bool {
+        let yes = |key: &[u8]| matches!(d.get(key).map(|o| self.resolve(o)), Ok(Object::Boolean(true)));
+        if yes(b"PCFillSign") {
+            return true;
+        }
+        match subtype {
+            "FreeText" => self.name(d, b"IT").as_deref() == Some("FreeTextTypeWriter"),
+            "Stamp" => match self.name(d, b"Name").as_deref() {
+                Some("PCCheck" | "PCCross" | "PCDot" | "PCLine" | "PCTypedSignature") => true,
+                Some("PCCustomSignature" | "PCCustomInitials") => yes(b"PCPictureImage"),
+                _ => false,
+            },
+            "Ink" => self.text(d, b"Subj").as_deref() == Some("Signature"),
+            _ => false,
+        }
+    }
+
     fn page_of(&self, o: &Object) -> Option<usize> {
         match o {
             Object::Reference(id) => self.page_index.get(id).copied(),
@@ -646,34 +676,49 @@ impl<'a> Inspector<'a> {
 
     // ── outline ─────────────────────────────────────────────────────────────────────────────
 
-    fn outline_siblings(&self, first: &'a Object, seen: &mut HashSet<ObjectId>, depth: u32) -> Vec<OutlineItem> {
-        let mut items = Vec::new();
-        let mut cur = Some(first);
-        while let Some(o) = cur {
+    /// The window `DocInfo::outline` keeps: the first `OUTLINE_WINDOW` bookmarks in outline order,
+    /// nested no deeper than `OUTLINE_DEPTH`, and whether any bookmark was left out. Iterative, and
+    /// each bookmark is read once, so the work and memory stay within the window.
+    fn outline_window(&self, first: &'a Object) -> (Vec<OutlineItem>, bool) {
+        let mut seen = HashSet::new();
+        // The listed bookmarks in outline order, with their depth.
+        let mut listed: Vec<(usize, OutlineItem)> = Vec::new();
+        // One entry per open level: its next sibling, or `None` once that run of siblings has ended.
+        let mut levels: Vec<Option<&'a Object>> = vec![Some(first)];
+        let mut more = false;
+        while let Some(depth) = levels.len().checked_sub(1) {
+            let Some(slot) = levels.get_mut(depth) else { break };
+            let Some(o) = slot.take() else {
+                levels.pop();
+                continue;
+            };
             if let Object::Reference(id) = o
                 && !seen.insert(*id)
             {
-                break; // cycle
+                continue; // cycle: this run of siblings ends here
             }
-            let Some(d) = self.dict(o) else { break };
+            let Some(d) = self.dict(o) else { continue };
+            if listed.len() >= OUTLINE_WINDOW {
+                more = true;
+                break;
+            }
+            *slot = d.get(b"Next").ok();
             let dest = d
                 .get(b"Dest")
                 .ok()
                 .and_then(|dest| self.dest(dest, 0))
                 .or_else(|| d.get(b"A").ok().and_then(|a| self.dict(a)).and_then(|a| a.get(b"D").ok()).and_then(|dest| self.dest(dest, 0)));
             let (page, view) = dest.map_or((None, DestView::Top), |(p, v)| (Some(p), v));
-            let children = match (d.get(b"First").ok(), depth < 32) {
-                (Some(f), true) => self.outline_siblings(f, seen, depth + 1),
-                _ => Vec::new(),
-            };
-            let open = d.get(b"Count").ok().and_then(|c| c.as_i64().ok()).is_some_and(|c| c > 0);
-            items.push(OutlineItem { title: self.text(d, b"Title").unwrap_or_default(), page, view, children, open });
-            cur = d.get(b"Next").ok();
-            if items.len() > 100_000 {
-                break;
+            match d.get(b"First").ok() {
+                Some(child) if depth < OUTLINE_DEPTH => levels.push(Some(child)),
+                Some(_) => more = true,
+                None => {}
             }
+            let open = d.get(b"Count").ok().and_then(|c| c.as_i64().ok()).is_some_and(|c| c > 0);
+            let title = self.text(d, b"Title").unwrap_or_default();
+            listed.push((depth, OutlineItem { title, page, view, children: Vec::new(), open }));
         }
-        items
+        (nest_outline(listed), more)
     }
 
     // ── page labels (ISO 32000-2 §12.4.2) ───────────────────────────────────────────────────
@@ -871,6 +916,7 @@ impl<'a> Inspector<'a> {
                     _ => Vec::new(),
                 };
                 let in_reply_to = d.get(b"IRT").ok().and_then(|o| self.dict(o)).and_then(|p| self.text(p, b"NM"));
+                let fill_sign = self.is_fill_sign(d, &subtype);
                 info.annotations.push(Annotation {
                     page,
                     subtype,
@@ -886,6 +932,7 @@ impl<'a> Inspector<'a> {
                     quads,
                     locked: d.get(b"F").ok().and_then(|f| self.resolve(f).as_i64().ok()).unwrap_or(0) & 128 != 0,
                     intent: self.name(d, b"IT"),
+                    fill_sign,
                 });
             }
         }
@@ -1179,6 +1226,33 @@ fn text_string(bytes: &[u8]) -> String {
     pdfcraft_cos::PdfString::literal(bytes).to_text()
 }
 
+/// Nests a pre-order list of `(depth, item)` into the outline tree.
+fn nest_outline(listed: Vec<(usize, OutlineItem)>) -> Vec<OutlineItem> {
+    let mut roots = Vec::new();
+    // The open ancestors, outermost first; each collects its children until it closes.
+    let mut open: Vec<(usize, OutlineItem)> = Vec::new();
+    for (depth, item) in listed {
+        while open.last().is_some_and(|(d, _)| *d >= depth) {
+            close_outline(&mut open, &mut roots);
+        }
+        open.push((depth, item));
+    }
+    while !open.is_empty() {
+        close_outline(&mut open, &mut roots);
+    }
+    roots
+}
+
+/// Closes the innermost open bookmark: it joins its parent's children, or the top level.
+fn close_outline(open: &mut Vec<(usize, OutlineItem)>, roots: &mut Vec<OutlineItem>) {
+    if let Some((_, item)) = open.pop() {
+        match open.last_mut() {
+            Some((_, parent)) => parent.children.push(item),
+            None => roots.push(item),
+        }
+    }
+}
+
 fn rect4(o: &Object) -> [f32; 4] {
     match o {
         Object::Array(a) if a.len() == 4 => {
@@ -1310,6 +1384,204 @@ mod tests {
         }
     }
 
+    // Xref-stream fixtures exercise indirect /Length lookup during document loading: stream 2's /Length is `3 0 R`,
+    // `containers` lists compressed (id, container, index) entries and `objects` the other objects in the file.
+    fn compressed_length_pdf(containers: &[(u32, u32, u16)], objects: &[(u32, &[u8])]) -> Vec<u8> {
+        let mut pdf = b"%PDF-1.7\n".to_vec();
+        let ids = containers.iter().flat_map(|&(id, container, _)| [id, container]).chain(objects.iter().map(|&(id, _)| id));
+        let xref_id = ids.max().unwrap_or(3) + 1;
+        let mut records = vec![[0u8; 7]; (xref_id + 1) as usize];
+        records[0] = [0, 0, 0, 0, 0, 255, 255];
+        let mut append = |id: u32, body: &[u8]| {
+            records[id as usize][0] = 1;
+            records[id as usize][1..5].copy_from_slice(&(pdf.len() as u32).to_be_bytes());
+            pdf.extend_from_slice(format!("{id} 0 obj\n").as_bytes());
+            pdf.extend_from_slice(body);
+            pdf.extend_from_slice(b"\nendobj\n");
+        };
+        append(1, b"<< /Type /Catalog >>");
+        append(2, b"<< /Length 3 0 R >>\nstream\nhello\nendstream");
+        for &(id, body) in objects {
+            append(id, body);
+        }
+        for &(id, container, index) in containers {
+            records[id as usize][0] = 2;
+            records[id as usize][1..5].copy_from_slice(&container.to_be_bytes());
+            records[id as usize][5..7].copy_from_slice(&index.to_be_bytes());
+        }
+        let xref_offset = pdf.len();
+        records[xref_id as usize][0] = 1;
+        records[xref_id as usize][1..5].copy_from_slice(&(xref_offset as u32).to_be_bytes());
+        pdf.extend_from_slice(
+            format!("{xref_id} 0 obj\n<< /Type /XRef /Size {} /Root 1 0 R /W [1 4 2] /Length {} >>\nstream\n", records.len(), records.len() * 7)
+                .as_bytes(),
+        );
+        for record in records {
+            pdf.extend_from_slice(&record);
+        }
+        pdf.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{xref_offset}\n%%EOF\n").as_bytes());
+        pdf
+    }
+
+    // Stream 2's /Length starts a chain of `hops` indirect /Length lookups, each naming a new object; only the last
+    // link's /Length is direct. Compressed: link k is the integer 3 + 2k (the length it measures) alone in the object
+    // stream 4 + 2k, whose own /Length is link k + 1. Plain: link k is the stream 3 + k, whose /Length is link k + 1.
+    fn length_chain_pdf(hops: u32, compressed: bool) -> Vec<u8> {
+        let length = |hop: u32, next: u32, data: &str| if hop + 1 < hops { format!("{next} 0 R") } else { data.len().to_string() };
+        let (mut containers, mut objects) = (Vec::new(), Vec::new());
+        let mut value = 5; // the length of stream 2's data, "hello"
+        for hop in 0..hops {
+            if compressed {
+                let (id, container) = (3 + 2 * hop, 4 + 2 * hop);
+                let index = format!("{id} 0 ");
+                let data = format!("{index}{value}");
+                let dict = format!("/Type /ObjStm /N 1 /First {} /Length {}", index.len(), length(hop, id + 2, &data));
+                objects.push((container, format!("<< {dict} >>\nstream\n{data}\nendstream")));
+                containers.push((id, container, 0));
+                value = data.len();
+            } else {
+                objects.push((3 + hop, format!("<< /Length {} >>\nstream\n\nendstream", length(hop, 4 + hop, ""))));
+            }
+        }
+        let objects: Vec<_> = objects.iter().map(|(id, body)| (*id, body.as_bytes())).collect();
+        compressed_length_pdf(&containers, &objects)
+    }
+
+    // Lenient loading keeps a document whose stream 2 has an unresolvable /Length: the catalog, and stream 2's
+    // dictionary without its data.
+    fn load_without_stream_2_data(pdf: &[u8]) -> Document {
+        let doc = Document::load_mem(pdf).unwrap();
+        assert!(doc.catalog().unwrap().has_type(b"Catalog"));
+        assert!(doc.get_object((2, 0)).unwrap().as_stream().unwrap().content.is_empty());
+        doc
+    }
+
+    #[test]
+    fn compressed_object_self_container_does_not_recurse() {
+        let doc = load_without_stream_2_data(&compressed_length_pdf(&[(3, 3, 0)], &[]));
+        assert!(doc.get_object((3, 0)).is_err());
+    }
+
+    #[test]
+    fn compressed_object_mutual_containers_do_not_recurse() {
+        let doc = load_without_stream_2_data(&compressed_length_pdf(&[(3, 4, 0), (4, 3, 0)], &[]));
+        assert!(doc.get_object((3, 0)).is_err());
+        assert!(doc.get_object((4, 0)).is_err());
+    }
+
+    #[test]
+    fn object_stream_length_cycle_does_not_recurse() {
+        let pdf = compressed_length_pdf(&[(3, 4, 0)], &[(4, b"<< /Type /ObjStm /N 1 /First 4 /Length 3 0 R >>\nstream\n3 0 5\nendstream")]);
+        let doc = load_without_stream_2_data(&pdf);
+        // The container's /Length is the object it holds: the container is kept without data, so 3 never loads.
+        assert!(doc.get_object((4, 0)).unwrap().as_stream().unwrap().content.is_empty());
+        assert!(doc.get_object((3, 0)).is_err());
+    }
+
+    #[test]
+    fn compressed_object_container_chain_does_not_recurse() {
+        let containers: Vec<_> = (3..100_003).map(|id| (id, id + 1, 0)).collect();
+        let pdf = compressed_length_pdf(&containers, &[(100_003, b"<< /Type /ObjStm /N 1 /First 4 /Length 5 >>\nstream\n3 0 5\nendstream")]);
+        let doc = load_without_stream_2_data(&pdf);
+        // The object stream in the file loads, but the xref puts 3 in the compressed container 4, which is refused.
+        assert_eq!(doc.get_object((100_003, 0)).unwrap().as_stream().unwrap().content, b"3 0 5");
+        assert!(doc.get_object((3, 0)).is_err());
+    }
+
+    #[test]
+    fn compressed_objects_and_indirect_stream_length_still_load() {
+        let pdf = compressed_length_pdf(
+            &[(3, 4, 0), (5, 4, 1)],
+            &[(4, b"<< /Type /ObjStm /N 2 /First 8 /Length 17 >>\nstream\n3 0 5 2 5 (value)\nendstream")],
+        );
+        let doc = Document::load_mem_with_options(&pdf, LoadOptions { strict: true, ..Default::default() }).unwrap();
+        assert_eq!(doc.get_object((3, 0)).unwrap().as_i64().unwrap(), 5);
+        assert_eq!(doc.get_object((5, 0)).unwrap().as_str().unwrap(), b"value");
+        assert_eq!(doc.get_object((2, 0)).unwrap().as_stream().unwrap().content, b"hello");
+    }
+
+    #[test]
+    fn compressed_length_in_a_container_with_an_indirect_length_still_loads() {
+        // Two hops, as in a valid file: stream 2's /Length (3) is compressed in container 4, whose own /Length (5) is
+        // a plain indirect integer.
+        let pdf =
+            compressed_length_pdf(&[(3, 4, 0)], &[(4, b"<< /Type /ObjStm /N 1 /First 4 /Length 5 0 R >>\nstream\n3 0 5\nendstream"), (5, b"5")]);
+        let doc = Document::load_mem_with_options(&pdf, LoadOptions { strict: true, ..Default::default() }).unwrap();
+        assert_eq!(doc.get_object((3, 0)).unwrap().as_i64().unwrap(), 5);
+        assert_eq!(doc.get_object((5, 0)).unwrap().as_i64().unwrap(), 5);
+        assert_eq!(doc.get_object((2, 0)).unwrap().as_stream().unwrap().content, b"hello");
+    }
+
+    #[test]
+    fn compressed_length_chain_does_not_recurse() {
+        // Every container is an ordinary object in the file and every hop names a new object, so neither the
+        // container check nor the cycle history stops the chain; each hop recursed once more (a 512 KiB stack
+        // overflowed within 150 hops). Lookups past the cap fail: the first link never loads, while the last one,
+        // next to the direct /Length, does.
+        let hops = 5_000;
+        let doc = load_without_stream_2_data(&length_chain_pdf(hops, true));
+        assert!(doc.get_object((3, 0)).is_err());
+        assert!(doc.get_object((3 + 2 * (hops - 1), 0)).unwrap().as_i64().is_ok());
+        // The cap itself: loading link j reads its container's /Length, a chain of 2 * (hops - 1 - j) lookups, and
+        // 16 are allowed, so the 9th link from the end loads and the 10th does not.
+        assert!(doc.get_object((3 + 2 * (hops - 9), 0)).is_ok());
+        assert!(doc.get_object((3 + 2 * (hops - 10), 0)).is_err());
+    }
+
+    #[test]
+    fn plain_stream_length_chain_does_not_recurse() {
+        // The same recursion without object streams: each stream's /Length names the next stream (a 512 KiB stack
+        // overflowed within 200 hops). A stream is no length, so every link is kept as a stream without data.
+        let hops = 5_000;
+        let doc = load_without_stream_2_data(&length_chain_pdf(hops, false));
+        assert!((3..3 + hops).all(|id| doc.get_object((id, 0)).is_ok_and(|link| link.as_stream().is_ok_and(|s| s.content.is_empty()))));
+    }
+
+    fn indexed_object_stream(pairs: &[(u32, usize)], members: &[u8]) -> lopdf::Stream {
+        let mut content = Vec::new();
+        for &(id, offset) in pairs {
+            content.extend_from_slice(format!("{id} {offset} ").as_bytes());
+        }
+        let mut dict = Dictionary::new();
+        dict.set("Type", "ObjStm");
+        dict.set("N", pairs.len() as i64);
+        dict.set("First", content.len() as i64);
+        content.extend_from_slice(members);
+        lopdf::Stream::new(dict, content)
+    }
+
+    #[test]
+    fn object_stream_member_extents_bound_owned_strings() {
+        let mut members = vec![b'('; 32];
+        members.extend(vec![b'x'; 1 << 20]);
+        members.extend([b')'; 32]);
+        // Put the innermost (complete) string first in index order, then overlapping starts
+        // and duplicates. Only this first member at offset 31 may own the large string.
+        let mut pairs = vec![(100, 31)];
+        pairs.extend((0..31).map(|offset| (offset as u32 + 1, offset)));
+        pairs.extend([(200, 31), (201, 31)]);
+        let stream = indexed_object_stream(&pairs, &members);
+        let parsed = lopdf::ObjectStream::new_with_limit(&stream, Some(2 << 20)).unwrap();
+        assert_eq!(parsed.objects.get(&(100, 0)).unwrap().as_str().unwrap().len(), 1 << 20);
+        let total: usize = parsed.objects.values().filter_map(|object| object.as_str().ok()).map(<[u8]>::len).sum();
+        assert!(total <= stream.content.len(), "owned {total} string bytes from {} decoded bytes", stream.content.len());
+        assert!(!parsed.objects.contains_key(&(200, 0)));
+        assert!(!parsed.objects.contains_key(&(201, 0)));
+    }
+
+    #[test]
+    fn object_stream_member_extents_preserve_index_order_and_whitespace() {
+        let members = b" \n42\n /Name \n[true 7]\n << /Key (value) >>\n (last)";
+        // Unsorted offsets, and object 9 appears twice: its last index entry still wins.
+        let pairs = [(9, 0), (12, 21), (10, 5), (11, 12), (9, 41)];
+        let parsed = lopdf::ObjectStream::new(&indexed_object_stream(&pairs, members)).unwrap();
+        assert_eq!(parsed.objects.len(), 4);
+        assert_eq!(parsed.objects.get(&(9, 0)).unwrap().as_str().unwrap(), b"last");
+        assert_eq!(parsed.objects.get(&(10, 0)).unwrap().as_name().unwrap(), b"Name");
+        assert_eq!(parsed.objects.get(&(11, 0)).unwrap().as_array().unwrap(), &[Object::Boolean(true), Object::Integer(7)]);
+        assert_eq!(parsed.objects.get(&(12, 0)).unwrap().as_dict().unwrap().get(b"Key").unwrap().as_str().unwrap(), b"value");
+    }
+
     #[test]
     fn view_and_user_space_round_trip_for_every_rotation() {
         for rotation in [0u16, 90, 180, 270] {
@@ -1758,6 +2030,95 @@ trailer << /Root 1 0 R >>
         assert_eq!(titles, ["第一章", "目录", "A\u{FFFD}B", "概述", "Café", "A"]);
     }
 
+    /// A file whose objects are `bodies` in order (object 1 first), with a cross-reference table.
+    fn pdf_of(bodies: &[String]) -> Vec<u8> {
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, body) in bodies.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = out.len();
+        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", bodies.len() + 1).as_bytes());
+        for o in offsets {
+            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", bodies.len() + 1).as_bytes());
+        out
+    }
+
+    /// A one-page file whose outline is `items` (objects 5, 6, … in order).
+    fn outline_file(items: &[String]) -> Vec<u8> {
+        let mut bodies = vec![
+            "<< /Type /Catalog /Pages 2 0 R /Outlines 4 0 R >>".to_string(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>".to_string(),
+            "<< /Type /Page /Parent 2 0 R >>".to_string(),
+            format!("<< /Type /Outlines /First 5 0 R /Count {} >>", items.len()),
+        ];
+        bodies.extend(items.iter().cloned());
+        pdf_of(&bodies)
+    }
+
+    /// The titles of `items`, with children in brackets (`Parent[Child]`).
+    fn shape(items: &[OutlineItem]) -> Vec<String> {
+        items.iter().map(|o| if o.children.is_empty() { o.title.clone() } else { format!("{}[{}]", o.title, shape(&o.children).join(",")) }).collect()
+    }
+
+    #[test]
+    fn outline_window_keeps_the_first_bookmarks_and_says_when_more_follow() {
+        const COUNT: usize = OUTLINE_WINDOW + 5;
+        let items: Vec<String> = (0..COUNT)
+            .map(|k| {
+                let prev = if k == 0 { String::new() } else { format!(" /Prev {} 0 R", 4 + k) };
+                let next = if k + 1 == COUNT { String::new() } else { format!(" /Next {} 0 R", 6 + k) };
+                format!("<< /Title (Item {k}) /Parent 4 0 R{prev}{next} /Dest [3 0 R /Fit] >>")
+            })
+            .collect();
+        let info = inspect(Arc::new(outline_file(&items)), None).expect("opens");
+        assert_eq!(info.outline.len(), OUTLINE_WINDOW);
+        assert_eq!(info.outline.last().map(|o| o.title.as_str()), Some("Item 9999"));
+        assert!(info.outline_more);
+
+        let one = inspect(Arc::new(outline_file(&["<< /Title (Only) /Parent 4 0 R /Dest [3 0 R /Fit] >>".into()])), None).expect("opens");
+        assert_eq!(shape(&one.outline), ["Only"]);
+        assert!(!one.outline_more);
+    }
+
+    #[test]
+    fn outline_window_nests_no_deeper_than_its_depth_limit() {
+        // A chain of 40 bookmarks, each the first child of the one before.
+        let items: Vec<String> = (0..40)
+            .map(|k| {
+                let parent = if k == 0 { 4 } else { 4 + k };
+                let first = if k + 1 == 40 { String::new() } else { format!(" /First {} 0 R", 6 + k) };
+                format!("<< /Title (Deep {k}) /Parent {parent} 0 R{first} /Dest [3 0 R /Fit] >>")
+            })
+            .collect();
+        let info = inspect(Arc::new(outline_file(&items)), None).expect("opens");
+        let mut levels = 0;
+        let mut level = info.outline.first();
+        while let Some(item) = level {
+            levels += 1;
+            level = item.children.first();
+        }
+        assert_eq!(levels, OUTLINE_DEPTH + 1);
+        assert!(info.outline_more);
+    }
+
+    #[test]
+    fn outline_window_ends_cycles_and_broken_links_without_looping() {
+        let listed = |items: &[&str]| {
+            let items: Vec<String> = items.iter().map(|s| s.to_string()).collect();
+            shape(&inspect(Arc::new(outline_file(&items)), None).expect("opens").outline)
+        };
+        assert_eq!(listed(&["<< /Title (Self) /Parent 4 0 R /Next 5 0 R >>"]), ["Self"]);
+        assert_eq!(listed(&["<< /Title (Self) /Parent 4 0 R /First 5 0 R >>"]), ["Self"]);
+        assert_eq!(listed(&["<< /Title (A) /Parent 4 0 R /Next 6 0 R >>", "<< /Title (B) /Parent 4 0 R /Next 5 0 R >>"]), ["A", "B"]);
+        assert_eq!(listed(&["<< /Title (A) /Parent 4 0 R /First 6 0 R >>", "<< /Title (B) /Parent 5 0 R /First 5 0 R >>"]), ["A[B]"]);
+        assert_eq!(listed(&["<< /Title (A) /Parent 4 0 R /Next 99 0 R >>"]), ["A"]);
+        assert_eq!(listed(&["<< /Title (A) /Parent 4 0 R /Next 6 0 R >>", "42"]), ["A"]);
+    }
+
     #[test]
     fn destination_points_map_to_the_displayed_page() {
         // A crop box away from the origin: x 100..400, y 50..450.
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index b8aed6570..23d403609 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -20,8 +20,8 @@ pub use inspect::{
 };
 pub use pixels::Pixels;
 pub use raster::{
-    MAX_PIXELS, MAX_SIDE, PageRenderer, RenderConfig, RenderPool, RenderRequest, RenderStats, RenderWarning, RenderedPage, RequestKind, Tile,
-    device_pixels, effective_scale,
+    MAX_PIXELS, MAX_SIDE, PageRenderer, RenderConfig, RenderPool, RenderRequest, RenderStats, RenderWarning, RenderedPage, RequestKind, Retiring,
+    Tile, device_pixels, effective_scale,
 };
 pub use text::{PageText, TextGlyph};
 
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index 012879b46..e6b635ef1 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -883,6 +883,48 @@ impl RenderPool {
     }
 }
 
+/// A pool's threads after [`RenderPool::retire`]. Idle ones exit at once; one still rendering is
+/// told to stop at its next drawing operator and exits when its render returns, which a single
+/// long operator (such as decoding a huge image) can delay.
+pub struct Retiring(Vec<JoinHandle<()>>);
+
+impl Retiring {
+    /// The threads that haven't exited yet.
+    pub fn running(&mut self) -> usize {
+        self.0.retain(|h| !h.is_finished());
+        self.0.len()
+    }
+
+    /// Whether every thread has exited.
+    pub fn exited(&self) -> bool {
+        self.0.iter().all(JoinHandle::is_finished)
+    }
+}
+
+impl RenderPool {
+    /// No replacement threads: when the watchdog gives up on a render, the request (and any
+    /// later one) is answered with an error instead of starting another thread. For a caller that
+    /// bounds how many render threads exist at once: the stuck thread keeps running until its
+    /// operator returns, and a replacement would run beside it.
+    pub fn without_replacements(self) -> Self {
+        *lock(&self.replacements_left) = 0;
+        self
+    }
+
+    /// This pool's threads that haven't exited (workers and replacements; 0 when rendering inline).
+    pub fn threads(&self) -> usize {
+        lock(&self._workers).iter().filter(|h| !h.is_finished()).count()
+    }
+
+    /// Drop the pool but keep its threads' handles, for a caller that bounds how many render
+    /// threads run at once: a render the watchdog gave up on can outlive its pool.
+    pub fn retire(self) -> Retiring {
+        let handles = std::mem::take(&mut *lock(&self._workers));
+        drop(self);
+        Retiring(handles)
+    }
+}
+
 impl Drop for RenderPool {
     fn drop(&mut self) {
         #[cfg(not(target_arch = "wasm32"))]
@@ -1294,6 +1336,58 @@ mod tests {
         assert!(initializer.join().unwrap().unwrap().is_some());
     }
 
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn a_retired_pool_counts_its_threads_until_they_exit() {
+        // Idle: its thread leaves as soon as the pool is gone.
+        let mut idle = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default()).retire();
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+        while idle.running() > 0 && std::time::Instant::now() < deadline {
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        assert_eq!(idle.running(), 0);
+        // Busy in a step that can't be interrupted: still counted after the pool is dropped.
+        let pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default());
+        *lock(&pool.shared.slow_page) = Some((0, std::time::Duration::from_secs(2)));
+        pool.set_queue(vec![RenderRequest { page: 0, scale: 1.0, ..Default::default() }]);
+        while pool.shared.render_started.load(Ordering::Relaxed) == 0 && std::time::Instant::now() < deadline {
+            std::thread::sleep(std::time::Duration::from_millis(2));
+        }
+        let mut busy = pool.retire();
+        assert_eq!(busy.running(), 1, "the render is still under way");
+        while busy.running() > 0 && std::time::Instant::now() < deadline {
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        assert_eq!(busy.running(), 0, "and the thread exits when it returns");
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn a_pool_without_replacements_never_runs_a_second_thread() {
+        // The watchdog gives up on a render stuck in one long step; with no replacement, the
+        // request is answered with an error and the stuck thread is the only one.
+        let mut pool = RenderPool::new(Arc::new(ONE_PAGE_TWICE.to_vec()), 1, RenderConfig::default()).without_replacements();
+        pool.set_stuck_after(std::time::Duration::from_millis(50));
+        *lock(&pool.shared.slow_page) = Some((0, std::time::Duration::from_secs(2)));
+        pool.set_queue(vec![RenderRequest { page: 0, scale: 1.0, ..Default::default() }]);
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+        let answer = loop {
+            assert!(pool.threads() <= 1, "{} render threads", pool.threads());
+            if let Some(page) = pool.try_recv() {
+                break page;
+            }
+            assert!(std::time::Instant::now() < deadline, "the stuck render is answered");
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        };
+        assert!(answer.error.is_some(), "answered with an error, not a second attempt");
+        assert!(pool.threads() <= 1);
+        let mut retired = pool.retire();
+        while retired.running() > 0 {
+            assert!(std::time::Instant::now() < deadline, "the stuck thread exits when its step ends");
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+    }
+
     #[cfg(not(target_arch = "wasm32"))]
     #[test]
     fn page_panic_retires_shared_generation_and_healthy_pages_use_private_parsers() {
@@ -1661,7 +1755,11 @@ mod tests {
         let object = Object::from_bytes(data.as_bytes()).unwrap();
         assert_eq!(Function::new(&object).unwrap().eval([0.5].into_iter().collect()).unwrap().as_slice(), &[0.5]);
         let over = format!("<< /FunctionType 3 /Domain [0 1] /Functions [{data}] /Bounds [] /Encode [0 1] >>");
-        assert!(Function::new(&Object::from_bytes(over.as_bytes()).unwrap()).is_none());
+        // The 64 functions above nest exactly 128 levels (each dictionary and its /Functions
+        // array, then the leaf's /Domain array), the parser's nesting cap. 65 nest 130, so the
+        // parser refuses them before the function-depth guard sees them (a refusal either way).
+        // `function_limits_depth_guard_refuses_a_chain_of_references` tests the guard itself.
+        assert!(Object::from_bytes(over.as_bytes()).is_none(), "the parser refuses direct nesting past its cap");
 
         // One root plus 10,000 leaves is one node past the common budget. This input remains
         // below a megabyte and does not attempt excessive recursion or an allocation failure.
@@ -1677,6 +1775,43 @@ mod tests {
             assert_eq!(Function::new(&object).is_some(), children == 9999);
         }
     }
+    /// Stitching functions that each name the next through `N 0 R` nest no direct objects, so
+    /// the parser's nesting cap doesn't stop them and the function-depth guard does.
+    #[test]
+    fn function_limits_depth_guard_refuses_a_chain_of_references() {
+        use hayro::hayro_interpret::Function;
+        use hayro_syntax::object::{Object, ObjectIdentifier};
+        for functions in [64, 65] {
+            // Objects 4 onwards: each stitching function names the next one; the last is a leaf.
+            let objects: String = (4..4 + functions)
+                .map(|number| {
+                    let body = if number < 3 + functions {
+                        format!("<< /FunctionType 3 /Domain [0 1] /Functions [{} 0 R] /Bounds [] /Encode [0 1] >>", number + 1)
+                    } else {
+                        "<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >>".to_owned()
+                    };
+                    format!("{number} 0 obj {body} endobj\n")
+                })
+                .collect();
+            let parsed = hayro_syntax::Pdf::new(
+                format!(
+                    "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                     2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                     3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 20 20] >> endobj\n\
+                     {objects}trailer << /Root 1 0 R >>\n%%EOF"
+                )
+                .into_bytes(),
+            )
+            .unwrap();
+            let object = parsed.xref().get::<Object<'_>>(ObjectIdentifier::new(4, 0)).unwrap();
+            let function = Function::new(&object);
+            if functions == 64 {
+                assert_eq!(function.unwrap().eval([0.5].into_iter().collect()).unwrap().as_slice(), &[0.5]);
+            } else {
+                assert!(function.is_none(), "65 functions are one past the function-depth guard");
+            }
+        }
+    }
     #[test]
     fn function_limits_stitching_cycles_are_refused_and_shared_children_work() {
         use hayro::hayro_interpret::Function;
@@ -3353,6 +3488,222 @@ trailer << /Root 1 0 R >>
         assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the rest of the page draws");
     }
 
+    /// `depth` direct arrays (`array`), dictionaries with a key (`dict`) or both in turn (`mixed`)
+    /// around `null`.
+    fn nested(depth: usize, kind: &str) -> String {
+        let is_dict = |level| kind == "dict" || (kind == "mixed" && level % 2 == 0);
+        let mut value = String::new();
+        for level in 0..depth {
+            value.push_str(if is_dict(level) { "<< /N " } else { "[" });
+        }
+        value.push_str("null");
+        for level in (0..depth).rev() {
+            value.push_str(if is_dict(level) { " >>" } else { "]" });
+        }
+        value
+    }
+
+    /// `depth` dictionaries nested without keys (`<< << >> >>`), closed or not.
+    fn keyless(depth: usize, closed: bool) -> String {
+        let mut value = "<< ".repeat(depth);
+        if closed {
+            value.push_str(&">> ".repeat(depth));
+        }
+        value
+    }
+
+    /// A 40 × 40 page that runs `content`, with a correct xref table and `trailer` at the end
+    /// of a trailer that also points at an `/Info` title.
+    fn nesting_pdf(trailer: &str, content: &str) -> Vec<u8> {
+        let mut bytes = b"%PDF-1.7\n".to_vec();
+        let mut offsets = vec![0];
+        for (index, body) in [
+            "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_string(),
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << >> >>".to_string(),
+            format!("<< /Length {} >> stream\n{content}\nendstream", content.len()),
+            "<< /Title (Nested) >>".to_string(),
+        ]
+        .iter()
+        .enumerate()
+        {
+            offsets.push(bytes.len());
+            bytes.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", index + 1).as_bytes());
+        }
+        let xref = bytes.len();
+        bytes.extend_from_slice(b"xref\n0 6\n0000000000 65535 f \n");
+        for offset in &offsets[1..] {
+            bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+        }
+        bytes.extend_from_slice(format!("trailer << /Size 6 /Root 1 0 R /Info 5 0 R {trailer} >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+        bytes
+    }
+
+    /// Opens `bytes` and renders its one page, which must render without an error.
+    fn nesting_render(bytes: Vec<u8>) -> RenderedPage {
+        let parsed = Pdf::new(bytes.clone()).expect("xref repair can recover the catalog when the trailer is malformed");
+        assert_eq!(parsed.pages().len(), 1);
+        let mut renderer = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!((page.width, page.height), (40, 40));
+        page
+    }
+
+    /// Direct arrays and dictionaries used to recurse without a bound while skipping even
+    /// unused trailer values and content operands. Exercise the vendored patch in workspace CI.
+    #[test]
+    fn deeply_nested_direct_objects_do_not_overflow_the_stack() {
+        use hayro_syntax::object::Object;
+        use hayro_syntax::reader::{Reader, ReaderExt};
+        let pdf = |unused: &str, content: &str| nesting_pdf(&format!("/Unused {unused}"), content);
+        let paint = "1 0 0 rg 0 0 4 4 re f";
+        for kind in ["array", "dict", "mixed"] {
+            // Run the crash reproducer first, so the unpatched red state is a stack overflow.
+            let page = nesting_render(pdf(&nested(100_000, kind), paint));
+            assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "{kind}: repaired trailer");
+            for depth in [20, 128, 129] {
+                let value = nested(depth, kind);
+                let siblings = format!("{value} [] []");
+                let mut reader = Reader::new(siblings.as_bytes());
+                assert_eq!(reader.skip::<Object<'_>>(false).is_some(), depth <= 128, "{kind}: depth {depth}");
+                if depth > 128 {
+                    assert_eq!(reader.offset(), 0, "failed skips restore the offset");
+                    reader.jump(value.len());
+                }
+                // A failed skip must unwind its depth; successful siblings must not accumulate it.
+                for _ in 0..2 {
+                    reader.skip_white_spaces();
+                    assert!(reader.skip::<Object<'_>>(false).is_some());
+                }
+                let page = nesting_render(pdf(&value, paint));
+                assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "{kind}: depth {depth}");
+            }
+            // Many siblings exercise the offset constructor and ensure depth is per nesting.
+            let siblings = "[] ".repeat(256);
+            let mut reader = Reader::new_with(siblings.as_bytes(), 0);
+            for _ in 0..256 {
+                assert!(reader.skip::<Object<'_>>(false).is_some());
+                reader.skip_white_spaces();
+            }
+        }
+        // Content-stream arrays take the Object path, rather than MaybeRef<Object>.
+        for depth in [100_000, 20, 128, 129] {
+            let value = nested(depth, "array");
+            let mut reader = Reader::new(value.as_bytes());
+            assert_eq!(reader.skip::<Object<'_>>(true).is_some(), depth <= 128, "content: depth {depth}");
+            let content = format!("{value} discard {paint}");
+            let page = nesting_render(pdf("null", &content));
+            if depth <= 128 {
+                assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "content: depth {depth}");
+            }
+        }
+    }
+
+    /// A dictionary with an object where a key belongs is repaired by reading that object, not
+    /// skipping it, and that read recursed without a bound when the object was another such
+    /// dictionary: `<<` 100,000 times aborted the process. Here as a content-stream operand.
+    #[test]
+    fn dictionaries_nested_without_keys_in_content_do_not_overflow_the_stack() {
+        for closed in [true, false] {
+            let content = format!("1 0 0 rg 0 0 4 4 re f {} discard", keyless(100_000, closed));
+            let page = nesting_render(nesting_pdf("", &content));
+            assert_eq!(px40(&page, 1, 38), &[255, 0, 0, 255], "closed: {closed}");
+        }
+    }
+
+    /// The same, where a key of the trailer belongs: the xref table can't be used, and repair
+    /// finds the catalog.
+    #[test]
+    fn dictionaries_nested_without_keys_in_the_trailer_do_not_overflow_the_stack() {
+        for closed in [true, false] {
+            let page = nesting_render(nesting_pdf(&keyless(100_000, closed), "1 0 0 rg 0 0 4 4 re f"));
+            assert_eq!(px40(&page, 1, 38), &[255, 0, 0, 255], "closed: {closed}");
+        }
+    }
+
+    /// The same as the properties of marked content (`/Tag <<<<<< … BDC`).
+    #[test]
+    fn dictionaries_nested_without_keys_as_marked_content_properties_do_not_overflow_the_stack() {
+        for closed in [true, false] {
+            let properties = if closed { "<<".repeat(100_000) + &">>".repeat(100_000) } else { "<<".repeat(100_000) };
+            let content = format!("1 0 0 rg 0 0 4 4 re f /Tag {properties} BDC 0 0 1 rg 36 36 4 4 re f EMC");
+            let page = nesting_render(nesting_pdf("", &content));
+            assert_eq!(px40(&page, 1, 38), &[255, 0, 0, 255], "closed: {closed}");
+        }
+    }
+
+    /// Through the same three paths, dictionaries without keys are read up to the nesting cap
+    /// (128 dictionaries in all) and refused one past it.
+    #[test]
+    fn dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap() {
+        use hayro_syntax::object::{FromBytes, Object};
+        use hayro_syntax::reader::{Reader, ReaderExt};
+        let (red, blue, white) = ([255, 0, 0, 255], [0, 0, 255, 255], [255, 255, 255, 255]);
+        for depth in [128, 129] {
+            let within = depth <= 128;
+            let value = keyless(depth, true);
+            assert_eq!(Object::from_bytes(value.as_bytes()).is_some(), within, "object: {depth}");
+            assert_eq!(Reader::new(value.as_bytes()).read_without_context::<Object<'_>>().is_some(), within, "operand: {depth}");
+            // Content reading stops at an operand it can't read, so the blue square is drawn
+            // only when the dictionaries were read.
+            let properties = "<<".repeat(depth) + &">>".repeat(depth);
+            for (path, operand) in [("operand", format!("{value} discard")), ("BDC", format!("/Tag {properties} BDC"))] {
+                let content = format!("1 0 0 rg 0 0 4 4 re f {operand} 0 0 1 rg 36 36 4 4 re f");
+                let page = nesting_render(nesting_pdf("", &content));
+                assert_eq!(px40(&page, 1, 38), &red, "{path}: {depth}");
+                assert_eq!(px40(&page, 38, 1), if within { &blue } else { &white }, "{path}: {depth}");
+            }
+            // The trailer is the outermost dictionary. Within the cap it is read (with its
+            // /Info); past it, repair recovers the catalog but not the trailer.
+            let bytes = nesting_pdf(&keyless(depth - 1, true), "1 0 0 rg 0 0 4 4 re f");
+            let parsed = Pdf::new(bytes.clone()).expect("the trailer or repair finds the catalog");
+            assert_eq!(parsed.metadata().title, within.then(|| b"Nested".to_vec()), "trailer: {depth}");
+            assert_eq!(px40(&nesting_render(bytes), 1, 38), &red, "trailer: {depth}");
+        }
+    }
+
+    /// The cap must also fit small stacks: skip, read, iterate down with the array iterators and
+    /// format (`{:?}`) the deepest nesting it admits, of arrays, dictionaries, both and
+    /// dictionaries without keys, on a 512 KiB thread in a debug build. Measured when this was
+    /// written (macOS arm64, dev profile): at most about 100 KiB, for `{:?}` of 128 dictionaries.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn nesting_at_the_cap_fits_a_512_kib_stack() {
+        use hayro_syntax::object::{FromBytes, Object};
+        use hayro_syntax::reader::{Reader, ReaderExt};
+        let worker = std::thread::Builder::new().stack_size(512 * 1024).spawn(|| {
+            // (kind, arrays and dictionaries `{:?}` shows, levels walked down to the end)
+            for (kind, arrays, dicts, levels) in [("array", 128, 0, 129), ("dict", 0, 128, 129), ("mixed", 64, 64, 129), ("keyless", 0, 1, 1)] {
+                let value = if kind == "keyless" { keyless(128, true) } else { nested(128, kind) };
+                assert!(Reader::new(value.as_bytes()).skip::<Object<'_>>(false).is_some(), "{kind}: skip");
+                assert!(Reader::new(value.as_bytes()).skip::<Object<'_>>(true).is_some(), "{kind}: skip in content");
+                assert!(Reader::new(value.as_bytes()).read_without_context::<Object<'_>>().is_some(), "{kind}: operand");
+                let object = Object::from_bytes(value.as_bytes()).expect("the cap admits 128 levels");
+                let shown = format!("{object:?}");
+                assert_eq!((shown.matches("Array(").count(), shown.matches("Dict(").count()), (arrays, dicts), "{kind}: {{:?}}");
+                let (mut walked, mut next) = (0, Some(object));
+                while let Some(object) = next.take() {
+                    walked += 1;
+                    next = match object {
+                        Object::Array(array) => {
+                            assert_eq!(array.raw_iter().count(), 1, "{kind}: raw_iter");
+                            assert!(array.flex_iter().next::<Object<'_>>().is_some(), "{kind}: flex_iter");
+                            array.iter::<Object<'_>>().next()
+                        }
+                        Object::Dict(dict) => dict.get::<Object<'_>>("N"),
+                        _ => None,
+                    };
+                }
+                assert_eq!(walked, levels, "{kind}: iterate");
+            }
+        });
+        // A stack overflow aborts the process; a failed check is a panic, shown as it is.
+        if let Err(panic) = worker.expect("spawn a 512 KiB thread").join() {
+            std::panic::resume_unwind(panic);
+        }
+    }
+
     /// From the nightly `cargo xtask fuzz`: many small inline images, each with "EI" (followed
     /// by a space) inside its data, and no text anywhere. To decide whether such an "EI" ends the
     /// data, the parser re-read the rest of the stream as content, and that re-read did the same
diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index 5db3fa47c..8c47af214 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -30,6 +30,24 @@ pub struct TextGlyph {
     pub direction: [f32; 2],
 }
 
+/// `s` folded for case-insensitive search, one character for one character.
+///
+/// The dotted and dotless i of Turkish and Azerbaijani (`İ` U+0130, `ı` U+0131) and the Latin
+/// `I`/`i` all fold to `i`. `str::to_lowercase` follows no locale: it turns `İ` into `i` plus a
+/// combining dot (two characters) and leaves `ı` alone, so neither `İSTANBUL` nor `IRMAK` could
+/// be found by typing `istanbul` or `ırmak`. Search can't know the document's language, so the
+/// four are treated as one letter; this only adds matches where an `ı` or `İ` is involved.
+fn fold_case(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            'I' | 'i' | '\u{130}' | '\u{131}' => out.push('i'),
+            _ => out.extend(c.to_lowercase()),
+        }
+    }
+    out
+}
+
 /// The text of one page, in content order, with line structure.
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct PageText {
@@ -76,7 +94,7 @@ impl PageText {
 
     /// Search with Acrobat's find options: case-sensitive, whole words only.
     pub fn find_opts(&self, needle: &str, case_sensitive: bool, whole_words: bool) -> Vec<std::ops::Range<usize>> {
-        let fold = |s: &str| if case_sensitive { s.to_string() } else { s.to_lowercase() };
+        let fold = |s: &str| if case_sensitive { s.to_string() } else { fold_case(s) };
         let needle: Vec<char> = fold(needle).split_whitespace().collect::<Vec<_>>().join(" ").chars().collect();
         if needle.is_empty() {
             return Vec::new();
@@ -88,7 +106,12 @@ impl PageText {
                 chars.push((' ', i));
             }
             for c in fold(&g.text).chars() {
-                chars.push((if c.is_whitespace() { ' ' } else { c }, i));
+                let c = if c.is_whitespace() { ' ' } else { c };
+                // The query collapses a run of whitespace to one space, so collapse the page too.
+                if c == ' ' && chars.last().is_some_and(|k| k.0 == ' ') {
+                    continue;
+                }
+                chars.push((c, i));
             }
         }
         let word = |k: Option<&(char, usize)>| k.is_some_and(|c| c.0.is_alphanumeric());
@@ -190,21 +213,115 @@ impl PageText {
 
     /// Merge the boxes of `range` into one rectangle per line (for highlighting).
     pub fn line_rects(&self, range: std::ops::Range<usize>) -> Vec<[f32; 4]> {
-        let mut out: Vec<(u32, [f32; 4])> = Vec::new();
-        for i in range {
-            let Some(g) = self.glyphs.get(i) else { break };
-            let line = self.line_of[i];
+        self.merged_rects(range)
+    }
+
+    /// One rectangle per run of consecutive glyphs on one line, for glyph indices in ascending
+    /// order (a reading-order range, or [`Self::glyphs_in`]). A run stops at a skipped glyph, so
+    /// the rectangle never covers text that is not selected.
+    pub fn glyph_rects(&self, glyphs: &[usize]) -> Vec<[f32; 4]> {
+        self.merged_rects(glyphs.iter().copied())
+    }
+
+    fn merged_rects(&self, glyphs: impl IntoIterator<Item = usize>) -> Vec<[f32; 4]> {
+        let mut out: Vec<(u32, usize, [f32; 4])> = Vec::new();
+        for i in glyphs {
+            let (Some(g), Some(&line)) = (self.glyphs.get(i), self.line_of.get(i)) else { break };
             match out.last_mut() {
-                Some((l, r)) if *l == line => {
-                    r[0] = r[0].min(g.rect[0]);
-                    r[1] = r[1].min(g.rect[1]);
-                    r[2] = r[2].max(g.rect[2]);
-                    r[3] = r[3].max(g.rect[3]);
+                Some((l, last, r)) if *l == line && last.checked_add(1) == Some(i) => {
+                    *last = i;
+                    union(r, &g.rect);
                 }
-                _ => out.push((line, g.rect)),
+                _ => out.push((line, i, g.rect)),
             }
         }
-        out.into_iter().map(|(_, r)| r).collect()
+        out.into_iter().map(|(_, _, r)| r).collect()
+    }
+
+    /// The glyphs whose centre lies inside `rect` (view space, corners in either order), in
+    /// reading order: what a column selection covers (Alt/Option-drag, Acrobat's column select).
+    /// A glyph only partly inside counts when its centre is, so a rectangle drawn a little into
+    /// the next column does not pick up the edge of its text.
+    pub fn glyphs_in(&self, rect: [f32; 4]) -> Vec<usize> {
+        let (x0, x1) = (rect[0].min(rect[2]), rect[0].max(rect[2]));
+        let (y0, y1) = (rect[1].min(rect[3]), rect[1].max(rect[3]));
+        let inside = |g: &TextGlyph| {
+            let (cx, cy) = ((g.rect[0] + g.rect[2]) / 2.0, (g.rect[1] + g.rect[3]) / 2.0);
+            (x0..=x1).contains(&cx) && (y0..=y1).contains(&cy)
+        };
+        self.glyphs.iter().enumerate().filter(|(_, g)| inside(g)).map(|(i, _)| i).collect()
+    }
+
+    /// The text of a column selection ([`Self::glyphs_in`]) as it looks on the page: one row per
+    /// visual line, top to bottom. Pieces of different lines that sit side by side (table cells,
+    /// newspaper columns) share a row and are separated by a tab, so a pasted table lands in
+    /// spreadsheet cells. Rows of right-to-left text put their pieces right to left. When any
+    /// selected glyph does not run horizontally (CJK vertical writing, turned text, a page shown
+    /// turned by `/Rotate`) rows mean nothing, and the lines come out one per row in reading order
+    /// instead.
+    pub fn column_text(&self, glyphs: &[usize]) -> String {
+        // The selected glyphs of each line, with their box: (glyphs, bbox).
+        let mut lines: Vec<(Vec<usize>, [f32; 4])> = Vec::new();
+        let mut line_ids: Vec<u32> = Vec::new();
+        for &i in glyphs {
+            let (Some(g), Some(&line)) = (self.glyphs.get(i), self.line_of.get(i)) else { continue };
+            match (lines.last_mut(), line_ids.last()) {
+                (Some((members, bb)), Some(&l)) if l == line => {
+                    members.push(i);
+                    union(bb, &g.rect);
+                }
+                _ => {
+                    lines.push((vec![i], g.rect));
+                    line_ids.push(line);
+                }
+            }
+        }
+        // Within the layout's own tolerance for reading a glyph as unturned.
+        let vertical = glyphs.iter().any(|&i| self.glyphs.get(i).is_some_and(|g| g.direction[1].abs() > WORD_GAP));
+        let piece = |members: &[usize]| {
+            let mut s = String::new();
+            let mut prev: Option<usize> = None;
+            for &i in members {
+                let Some(g) = self.glyphs.get(i) else { continue };
+                let gap = self.space_before.get(i).copied().unwrap_or(false) || prev.and_then(|p| p.checked_add(1)) != Some(i);
+                if prev.is_some() && gap {
+                    s.push(' ');
+                }
+                s.push_str(&g.text);
+                prev = Some(i);
+            }
+            s
+        };
+        if vertical {
+            return lines.iter().map(|(members, _)| piece(members)).collect::<Vec<_>>().join("\n");
+        }
+        // Rows: a line joins the row whose first line its vertical centre falls within.
+        let mut order: Vec<usize> = (0..lines.len()).collect();
+        order.sort_by(|a, b| {
+            let cy = |k: usize| lines.get(k).map_or(0.0, |(_, bb)| (bb[1] + bb[3]) / 2.0);
+            cy(*a).total_cmp(&cy(*b))
+        });
+        let mut rows: Vec<(f32, f32, Vec<usize>)> = Vec::new();
+        for k in order {
+            let Some((_, bb)) = lines.get(k) else { continue };
+            let cy = (bb[1] + bb[3]) / 2.0;
+            match rows.last_mut() {
+                Some((top, bottom, members)) if cy >= *top && cy <= *bottom => members.push(k),
+                _ => rows.push((bb[1], bb[3], vec![k])),
+            }
+        }
+        let rtl = |members: &[usize]| members.iter().any(|&i| self.glyphs.get(i).is_some_and(|g| g.text.chars().any(is_rtl)));
+        let mut out = Vec::with_capacity(rows.len());
+        for (_, _, mut members) in rows {
+            let right_to_left = members.iter().all(|&k| lines.get(k).is_some_and(|(m, _)| rtl(m)));
+            members.sort_by(|a, b| {
+                let x = |k: usize| lines.get(k).map_or(0.0, |(_, bb)| bb[0]);
+                if right_to_left { x(*b).total_cmp(&x(*a)) } else { x(*a).total_cmp(&x(*b)) }
+            });
+            let cells: Vec<String> = members.iter().filter_map(|&k| lines.get(k)).map(|(m, _)| piece(m)).collect();
+            out.push(cells.join("\t"));
+        }
+        out.join("\n")
     }
 }
 
@@ -906,6 +1023,45 @@ mod tests {
         assert_eq!(to_upright([290.0, 0.0, 300.0, 10.0], 1, 300.0, 200.0), [0.0, 0.0, 10.0, 10.0]);
     }
 
+    #[test]
+    fn turkish_dotted_and_dotless_i_match_in_any_case() {
+        // "İSTANBUL IRMAK KIŞ" on one line: each word typed in lower case must find it, and the
+        // reverse. `to_lowercase` alone made `İ` two characters and left `ı` unmatched.
+        let mut v = Vec::new();
+        word(&mut v, "İSTANBUL", 10.0, 10.0, 7.0);
+        word(&mut v, "IRMAK", 80.0, 10.0, 7.0);
+        word(&mut v, "KIŞ", 130.0, 10.0, 7.0);
+        let upper = layout(v);
+        assert_eq!(upper.plain_text(), "İSTANBUL IRMAK KIŞ");
+        assert_eq!(upper.find("istanbul"), vec![0..8]);
+        assert_eq!(upper.find("İstanbul"), vec![0..8]);
+        assert_eq!(upper.find("ırmak"), vec![8..13]);
+        assert_eq!(upper.find("kış"), vec![13..16]);
+        assert_eq!(upper.find("istanbul ırmak kış"), vec![0..16], "a phrase across the words");
+        assert_eq!(upper.find_opts("ırmak", false, true), vec![8..13], "whole words");
+        assert!(upper.find_opts("istanbul", true, false).is_empty(), "case-sensitive search stays exact");
+        assert_eq!(upper.find_opts("İSTANBUL", true, false), vec![0..8]);
+
+        let mut v = Vec::new();
+        word(&mut v, "istanbul", 10.0, 10.0, 7.0);
+        word(&mut v, "ırmak", 80.0, 10.0, 7.0);
+        word(&mut v, "kış", 130.0, 10.0, 7.0);
+        let lower = layout(v);
+        assert_eq!(lower.find("İSTANBUL"), vec![0..8]);
+        assert_eq!(lower.find("IRMAK"), vec![8..13]);
+        assert_eq!(lower.find("KIŞ"), vec![13..16]);
+    }
+
+    #[test]
+    fn case_folding_keeps_one_character_per_character() {
+        for s in ["İSTANBUL", "ırmak", "Hello WORLD", "ÇAĞLAR", "Straße", "ΣΟΦΙΑ", "日本語"] {
+            assert_eq!(fold_case(s).chars().count(), s.chars().count(), "{s}");
+        }
+        assert_eq!(fold_case("Hello WORLD"), "hello world");
+        assert_eq!(fold_case("ÇAĞLAR Şişli"), "çağlar şişli");
+        assert_eq!(fold_case("İIıi"), "iiii");
+    }
+
     fn g(t: &str, x0: f32, y0: f32, x1: f32) -> TextGlyph {
         let rect = [x0, y0, x1, y0 + 10.0];
         TextGlyph { text: t.into(), rect, quad: [[x0, y0], [x1, y0], [x1, rect[3]], [x0, rect[3]]], direction: [1.0, 0.0] }
@@ -932,6 +1088,27 @@ mod tests {
         assert_eq!(t.nearest(52.0, 14.0), Some(5));
     }
 
+    #[test]
+    fn phrase_search_ignores_repeated_spaces() {
+        // "quick  brown" drawn with two space glyphs in a row. Text extraction keeps both spaces,
+        // but the phrase search has always collapsed runs of whitespace in the query, so the page
+        // text has to be collapsed the same way or the phrase is never found (#814).
+        let mut v = Vec::new();
+        word(&mut v, "quick", 10.0, 10.0, 6.0);
+        v.push(g(" ", 46.0, 10.0, 52.0));
+        v.push(g(" ", 52.0, 10.0, 58.0));
+        word(&mut v, "brown", 58.0, 10.0, 6.0);
+        let n = v.len();
+        let t = PageText { glyphs: v, line_of: vec![0; n], space_before: vec![false; n] };
+        assert_eq!(t.plain_text(), "quick  brown");
+        assert_eq!(t.find("quick brown"), vec![0..12]);
+        assert_eq!(t.find("quick  brown"), vec![0..12], "the query's own run of spaces is collapsed too");
+        assert_eq!(t.find("quick\tbrown"), vec![0..12]);
+        assert_eq!(t.find("quick"), vec![0..5]);
+        assert_eq!(t.find("brown"), vec![7..12]);
+        assert!(t.find("quick absent").is_empty());
+    }
+
     fn word(v: &mut Vec<TextGlyph>, s: &str, x: f32, y: f32, advance: f32) {
         for (i, c) in s.chars().enumerate() {
             let x0 = x + i as f32 * advance;
@@ -1120,4 +1297,85 @@ mod tests {
         let slant = skewed.quad[3][0] - skewed.quad[0][0];
         assert!((slant - 10.0).abs() < 1e-3, "the skewed glyph's upright edge leans by half its 20 pt height: {skewed:?}");
     }
+
+    /// A three-row table, "Name Qty / Apple 12 / Pear 7": the columns sit far enough apart that
+    /// reading order takes one column, then the other.
+    fn table() -> PageText {
+        let mut v = Vec::new();
+        for (row, (name, qty)) in [("Name", "Qty"), ("Apple", "12"), ("Pear", "7")].into_iter().enumerate() {
+            let y = 10.0 + row as f32 * 14.0;
+            word(&mut v, name, 10.0, y, 6.0);
+            word(&mut v, qty, 100.0, y, 6.0);
+        }
+        layout(v)
+    }
+
+    /// Issue #740: a column selection takes only what is inside the rectangle.
+    #[test]
+    fn a_column_selection_takes_one_table_column() {
+        let t = table();
+        assert_eq!(t.plain_text(), "Name\nApple\nPear\nQty\n12\n7", "reading order is column by column");
+        let qty = t.glyphs_in([95.0, 0.0, 130.0, 60.0]);
+        assert_eq!(t.column_text(&qty), "Qty\n12\n7");
+        assert_eq!(t.glyph_rects(&qty).len(), 3, "one highlight per row");
+        // Corners in either order.
+        assert_eq!(t.glyphs_in([130.0, 60.0, 95.0, 0.0]), qty);
+    }
+
+    /// Across columns the text comes out row by row, cells separated by tabs.
+    #[test]
+    fn a_column_selection_across_columns_reads_row_by_row() {
+        let t = table();
+        let all = t.glyphs_in([0.0, 0.0, 200.0, 60.0]);
+        assert_eq!(t.column_text(&all), "Name\tQty\nApple\t12\nPear\t7");
+        // The middle row only, and only the start of "Apple": centres decide.
+        let part = t.glyphs_in([0.0, 25.0, 31.0, 33.0]);
+        assert_eq!(t.column_text(&part), "Appl");
+        assert_eq!(t.glyph_rects(&part), vec![[10.0, 24.0, 34.0, 34.0]]);
+    }
+
+    /// A rectangle that misses every glyph, or is not a number, selects nothing.
+    #[test]
+    fn an_empty_or_degenerate_column_selection_is_empty() {
+        let t = table();
+        for r in [[300.0, 300.0, 400.0, 400.0], [f32::NAN, 0.0, 200.0, 60.0], [50.0, 50.0, 50.0, 50.0]] {
+            let none = t.glyphs_in(r);
+            assert!(none.is_empty(), "{r:?}");
+            assert_eq!(t.column_text(&none), "");
+            assert!(t.glyph_rects(&none).is_empty());
+        }
+        assert_eq!(PageText::default().column_text(&[0, 7, usize::MAX]), "", "indices past the text are ignored");
+    }
+
+    /// Right-to-left rows put their cells right to left.
+    #[test]
+    fn right_to_left_rows_read_right_to_left() {
+        let mut v = Vec::new();
+        // "שלום" (right) and "עולם" (left), each drawn visually.
+        word(&mut v, "םולש", 100.0, 10.0, 6.0);
+        word(&mut v, "םלוע", 10.0, 10.0, 6.0);
+        let t = layout(v);
+        let all = t.glyphs_in([0.0, 0.0, 200.0, 30.0]);
+        assert_eq!(t.column_text(&all), "שלום\tעולם");
+    }
+
+    /// Vertical lines (CJK vertical writing) come out one per row, in reading order.
+    #[test]
+    fn vertical_lines_keep_reading_order() {
+        // Written downwards: the em box's edge towards the next line is its left one.
+        let cell = |t: &str, x: f32, y: f32| TextGlyph {
+            text: t.into(),
+            rect: [x, y, x + 10.0, y + 10.0],
+            quad: [[x, y], [x, y + 10.0], [x + 10.0, y + 10.0], [x + 10.0, y]],
+            direction: [0.0, 1.0],
+        };
+        let t = PageText {
+            // Right column 日本 first, then the left column 語文, each top to bottom.
+            glyphs: vec![cell("日", 40.0, 10.0), cell("本", 40.0, 20.0), cell("語", 20.0, 10.0), cell("文", 20.0, 20.0)],
+            line_of: vec![0, 0, 1, 1],
+            space_before: vec![false; 4],
+        };
+        let all = t.glyphs_in([0.0, 0.0, 60.0, 40.0]);
+        assert_eq!(t.column_text(&all), "日本\n語文");
+    }
 }
diff --git a/crates/sign/README.md b/crates/sign/README.md
index 2b0b94424..78fb8d721 100644
--- a/crates/sign/README.md
+++ b/crates/sign/README.md
@@ -54,7 +54,11 @@ ECDSA P-256/P-384; the store integration is tested with software-backed keys. A
 or token whose driver registers a CNG key storage provider is such an identity too: the key
 is opened for signing without the silent flag, so the provider shows its own PIN dialog
 (checked by hand with a SafeNet token; CI has no hardware). A store identity signs with the
-issuers Windows chains its certificate to, without the root.
+issuers Windows chains its certificate to, without the root. Store certificates that can't
+sign (no private key, another key type, a key CNG can't open) are returned by
+`windows::list` as `unusable` with the reason and the Windows error code, shown greyed in
+the Sign dialog and by `sign_windows_ids`, instead of being left out silently; a key that
+needs a prompt to open is listed and asks at signing (issue #179).
 - **Validation:** `/ByteRange` and the CMS are read from the file's own bytes; the digest,
   the signature value and the signer's chain (against a `TrustStore`) are checked. Later
   revisions are diffed against the signed one, and the changes are classified (signing, form
diff --git a/crates/sign/src/windows.rs b/crates/sign/src/windows.rs
index 23b56a478..3974aff8c 100644
--- a/crates/sign/src/windows.rs
+++ b/crates/sign/src/windows.rs
@@ -1,14 +1,19 @@
 //! Signing identities in the Windows Current User Personal ("My") certificate store.
 //! Private keys remain in CNG; Windows may ask permission to use a key.
+//!
+//! Certificates that can't sign through PdfCraft (no usable private key, a key type it doesn't
+//! sign with) are reported in [`Listing::unusable`] with the reason rather than left out
+//! silently, so a missing identity can be explained (issue #179).
 
 use std::sync::Arc;
 
 use rustls_cng::cert::CertContext;
-use rustls_cng::key::{AlgorithmGroup, SignaturePadding};
+use rustls_cng::error::CngError;
+use rustls_cng::key::{AlgorithmGroup, NCryptKey, SignaturePadding};
 use rustls_cng::store::{CertStore, CertStoreType};
 
 use crate::keys::{DigestAlg, ExternalKey, PrivateKey, PublicKey, StoreKey};
-use crate::{Certificate, DigitalId, SignError};
+use crate::{Certificate, DigitalId, SignError, x509};
 
 struct WindowsKey {
     context: CertContext,
@@ -25,16 +30,39 @@ impl ExternalKey for WindowsKey {
         // signing handle without the silent flag so the provider can show its own dialog.
         let key = self.context.acquire_key(false).map_err(|e| {
             SignError::Crypto(format!(
-                "the Windows certificate store key couldn't be opened for signing (is the smart card or token connected?): {e}"
+                "the Windows certificate store key couldn't be opened for signing (is the smart card or token connected?): {}",
+                describe(&e)
             ))
         })?;
-        let raw = key
-            .sign(&digest, padding)
-            .map_err(|e| SignError::Crypto(format!("the Windows certificate store didn't sign (key use may have been cancelled): {e}")))?;
+        let raw = key.sign(&digest, padding).map_err(|e| {
+            SignError::Crypto(format!("the Windows certificate store didn't sign (key use may have been cancelled): {}", describe(&e)))
+        })?;
         self.public.store_signature_der(&raw)
     }
 }
 
+/// A Personal store certificate PdfCraft can't sign with, and why.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Unusable {
+    /// The subject's common name (else organization, else the DN), or a placeholder when
+    /// the certificate couldn't be read at all.
+    pub subject: String,
+    /// SHA-256 of the certificate as upper-case hex pairs (`Certificate::fingerprint`).
+    pub fingerprint: String,
+    /// Why it can't sign, as a clause that follows the name ("its private key is …").
+    pub reason: String,
+    /// The store holds no private key for it: a certificate someone else issued, filed under
+    /// Personal. Not a problem with an identity, so the Sign dialog doesn't show these.
+    pub no_private_key: bool,
+}
+
+/// The Personal store's signing identities and the certificates that can't sign.
+#[derive(Default)]
+pub struct Listing {
+    pub ids: Vec<DigitalId>,
+    pub unusable: Vec<Unusable>,
+}
+
 /// The `windows:<SHA-256 of the certificate DER>` reference kept for an identity.
 pub fn reference(certificate: &Certificate) -> String {
     let digest = DigestAlg::Sha256.digest(&[&certificate.raw]);
@@ -45,6 +73,7 @@ pub fn reference(certificate: &Certificate) -> String {
 /// Windows finds for the certificate, so a signature embeds them as it does for a file's.
 pub fn find(reference_or_name: &str) -> Result<DigitalId, SignError> {
     let (context, mut id) = entries()?
+        .ids
         .into_iter()
         .find(|(_, id)| {
             reference(&id.certificate) == reference_or_name
@@ -62,39 +91,156 @@ fn issuers(context: &CertContext, certificate: &Certificate) -> Vec<Certificate>
     chain.iter().filter(|der| **der != certificate.raw).filter_map(|der| Certificate::parse(der).ok()).collect()
 }
 
-/// List usable RSA, P-256 and P-384 CNG identities in Current User > Personal.
-/// Certificates with unsupported keys or without an accessible private key are skipped.
+/// List usable RSA, P-256 and P-384 CNG identities in Current User > Personal
+/// (the `ids` of [`list`]).
 pub fn identities() -> Result<Vec<DigitalId>, SignError> {
-    Ok(entries()?.into_iter().map(|(_, id)| id).collect())
+    Ok(entries()?.ids.into_iter().map(|(_, id)| id).collect())
 }
 
-/// Each usable identity with the store's certificate context it came from.
-fn entries() -> Result<Vec<(CertContext, DigitalId)>, SignError> {
+/// List Current User > Personal: the RSA, P-256 and P-384 identities whose private key CNG can
+/// open, and every other certificate with the reason it can't sign. A key that needs a prompt
+/// to open counts as usable; the prompt appears at signing.
+pub fn list() -> Result<Listing, SignError> {
+    let Entries { ids, unusable } = entries()?;
+    Ok(Listing { ids: ids.into_iter().map(|(_, id)| id).collect(), unusable })
+}
+
+/// Each usable identity with the store's certificate context it came from, and the rest.
+struct Entries {
+    ids: Vec<(CertContext, DigitalId)>,
+    unusable: Vec<Unusable>,
+}
+
+fn entries() -> Result<Entries, SignError> {
     let store = CertStore::open(CertStoreType::CurrentUser, "My")
-        .map_err(|e| SignError::Crypto(format!("the Windows Current User Personal store couldn't be opened: {e}")))?;
-    let contexts = store.find_all().map_err(|e| SignError::Crypto(format!("the Windows certificate store couldn't be searched: {e}")))?;
-    let mut out = Vec::new();
+        .map_err(|e| SignError::Crypto(format!("the Windows Current User Personal store couldn't be opened: {}", describe(&e))))?;
+    let contexts =
+        store.find_all().map_err(|e| SignError::Crypto(format!("the Windows certificate store couldn't be searched: {}", describe(&e))))?;
+    let mut ids = Vec::new();
+    let mut unusable = Vec::new();
     for context in contexts {
-        let Ok(certificate) = Certificate::parse(context.as_der()) else { continue };
-        // Enumeration must not open permission or PIN dialogs. Signing may prompt later.
-        let Ok(key) = context.acquire_key(true) else { continue };
-        // P-521, brainpool and Ed25519 certificates parse (to verify with) but aren't signed with.
-        let supported = match certificate.public_key.store_signing_key() {
-            Some(StoreKey::Rsa) => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Rsa),
-            Some(StoreKey::Ecdsa(want)) => {
-                key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Ecdsa) && key.bits().is_ok_and(|bits| bits == want)
-            }
-            None => false,
+        let der = context.as_der();
+        let fingerprint = DigestAlg::Sha256.digest(&[der]).iter().map(|b| format!("{b:02X}")).collect::<Vec<_>>().join(" ");
+        let mut skip = |subject: String, reason: String, no_private_key: bool| {
+            unusable.push(Unusable { subject, fingerprint: fingerprint.clone(), reason, no_private_key });
         };
-        if !supported {
+        let certificate = match Certificate::parse(der) {
+            Ok(c) => c,
+            Err(e) => {
+                let subject = x509::subject_of(der).map(|n| n.display_name()).unwrap_or_else(|| "(unreadable certificate)".to_string());
+                skip(subject, format!("the certificate can't be read: {e}"), false);
+                continue;
+            }
+        };
+        // P-521, brainpool and Ed25519 certificates parse (to verify with) but aren't signed with.
+        let Some(want) = certificate.public_key.store_signing_key() else {
+            let what = certificate.public_key.describe();
+            skip(certificate.display_name(), format!("its {what} key can't sign through PdfCraft yet (RSA, P-256 and P-384 only)"), false);
             continue;
+        };
+        // Enumeration must not open permission or PIN dialogs. Signing may prompt later.
+        match context.acquire_key(true) {
+            Ok(key) => {
+                if let Err(reason) = matches_key(&key, want) {
+                    skip(certificate.display_name(), reason, false);
+                    continue;
+                }
+                // The silent handle was only for the checks above; `sign` acquires its own.
+                drop(key);
+            }
+            // The key opens only with a prompt (strong private key protection, a PIN): usable.
+            Err(CngError::WindowsError(NTE_SILENT_CONTEXT | NTE_UI_REQUIRED)) => {}
+            Err(e) => {
+                let no_private_key = e == CngError::WindowsError(CRYPT_E_NO_KEY_PROPERTY);
+                let reason = if no_private_key {
+                    "it has no private key in the store".to_string()
+                } else {
+                    format!("its private key can't be opened: {}", describe(&e))
+                };
+                skip(certificate.display_name(), reason, no_private_key);
+                continue;
+            }
         }
-        // The silent handle was only for the checks above; `sign` acquires its own.
-        drop(key);
         let public = certificate.public_key.clone();
         let key = PrivateKey::external(public.clone(), Arc::new(WindowsKey { context: context.clone(), public }));
         let friendly_name = Some(certificate.display_name());
-        out.push((context, DigitalId { key, certificate, chain: Vec::new(), friendly_name }));
+        ids.push((context, DigitalId { key, certificate, chain: Vec::new(), friendly_name }));
+    }
+    Ok(Entries { ids, unusable })
+}
+
+/// Whether the store's key is what the certificate needs (RSA; ECDSA on its curve).
+fn matches_key(key: &NCryptKey, want: StoreKey) -> Result<(), String> {
+    let group = key.algorithm_group().map_err(|e| format!("its private key's algorithm couldn't be read: {}", describe(&e)))?;
+    let name = |g: &AlgorithmGroup| match g {
+        AlgorithmGroup::Rsa => "an RSA".to_string(),
+        AlgorithmGroup::Ecdsa => "an ECDSA".to_string(),
+        other => format!("a {other:?}"),
+    };
+    let expected = match want {
+        StoreKey::Rsa => AlgorithmGroup::Rsa,
+        StoreKey::Ecdsa(_) => AlgorithmGroup::Ecdsa,
+    };
+    if group != expected {
+        return Err(format!("its certificate holds {} key but the store's private key is {} key", name(&expected), name(&group)));
+    }
+    if let StoreKey::Ecdsa(bits) = want {
+        let actual = key.bits().map_err(|e| format!("its private key's size couldn't be read: {}", describe(&e)))?;
+        if actual != bits {
+            return Err(format!("its certificate holds a P-{bits} key but the store's private key has {actual} bits"));
+        }
+    }
+    Ok(())
+}
+
+// Error codes (winerror.h) that explain why a key can't be opened.
+const NTE_NO_KEY: u32 = 0x8009_000D;
+const NTE_PERM: u32 = 0x8009_0010;
+const NTE_NOT_FOUND: u32 = 0x8009_0011;
+const NTE_BAD_PROVIDER: u32 = 0x8009_0013;
+const NTE_BAD_PROV_TYPE: u32 = 0x8009_0014;
+const NTE_BAD_KEYSET: u32 = 0x8009_0016;
+const NTE_PROV_DLL_NOT_FOUND: u32 = 0x8009_001E;
+const NTE_SILENT_CONTEXT: u32 = 0x8009_0022;
+const NTE_NOT_SUPPORTED: u32 = 0x8009_0029;
+const NTE_UI_REQUIRED: u32 = 0x8009_002E;
+const NTE_DEVICE_NOT_READY: u32 = 0x8009_0030;
+const NTE_DEVICE_NOT_FOUND: u32 = 0x8009_0035;
+const NTE_USER_CANCELLED: u32 = 0x8009_0036;
+const CRYPT_E_NO_KEY_PROPERTY: u32 = 0x8009_200B;
+
+/// A CNG error with the Windows code and, for the usual ones, what it means.
+fn describe(e: &CngError) -> String {
+    let CngError::WindowsError(code) = e else { return e.to_string() };
+    let meaning = match *code {
+        NTE_NO_KEY | NTE_BAD_KEYSET | NTE_NOT_FOUND => "the key is missing from its key store (deleted, or imported under another Windows account)",
+        NTE_PERM => "access to the key was denied",
+        NTE_BAD_PROVIDER | NTE_BAD_PROV_TYPE | NTE_PROV_DLL_NOT_FOUND => {
+            "its key provider isn't available to CNG (a legacy CryptoAPI-only provider, or its driver isn't installed)"
+        }
+        NTE_NOT_SUPPORTED => "its key provider doesn't support the operation",
+        NTE_DEVICE_NOT_READY | NTE_DEVICE_NOT_FOUND => "the smart card or token isn't available",
+        NTE_USER_CANCELLED => "the request was cancelled",
+        NTE_SILENT_CONTEXT | NTE_UI_REQUIRED => "the key needs a prompt to open",
+        CRYPT_E_NO_KEY_PROPERTY => "the certificate has no private key",
+        0x8010_0000..=0x8010_FFFF => "the smart card isn't available",
+        _ => return format!("Windows error 0x{code:08X}"),
+    };
+    format!("{meaning} (Windows error 0x{code:08X})")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn errors_are_explained_with_their_code() {
+        assert_eq!(
+            describe(&CngError::WindowsError(NTE_BAD_KEYSET)),
+            "the key is missing from its key store (deleted, or imported under another Windows account) (Windows error 0x80090016)"
+        );
+        assert_eq!(describe(&CngError::WindowsError(0x8010_000C)), "the smart card isn't available (Windows error 0x8010000C)");
+        assert_eq!(describe(&CngError::WindowsError(0x57)), "Windows error 0x00000057");
+        assert_eq!(describe(&CngError::InvalidHashLength), "Invalid hash length");
     }
-    Ok(out)
 }
diff --git a/crates/sign/src/x509.rs b/crates/sign/src/x509.rs
index 1873d012f..1c4537391 100644
--- a/crates/sign/src/x509.rs
+++ b/crates/sign/src/x509.rs
@@ -57,6 +57,11 @@ impl Name {
         self.get(C)
     }
 
+    /// The name Acrobat shows: the common name, else the organization, else the DN.
+    pub fn display_name(&self) -> String {
+        self.common_name().or(self.organization()).map(str::to_string).unwrap_or_else(|| self.display())
+    }
+
     /// "CN=Ada Lovelace, O=Example, E=ada@example.com"
     pub fn display(&self) -> String {
         self.attrs
@@ -400,7 +405,7 @@ impl Certificate {
 
     /// The display name Acrobat uses: the common name, else the organization, else the DN.
     pub fn display_name(&self) -> String {
-        self.subject.common_name().or(self.subject.organization()).map(str::to_string).unwrap_or_else(|| self.subject.display())
+        self.subject.display_name()
     }
 
     /// SHA-256 fingerprint as upper-case hex pairs.
@@ -452,6 +457,19 @@ impl Certificate {
     }
 }
 
+/// The subject alone, to name a certificate `Certificate::parse` rejects (one with a key type
+/// PdfCraft doesn't support, say). `None` when even that can't be read.
+pub fn subject_of(raw: &[u8]) -> Option<Name> {
+    let cert = Tlv::parse_all(raw).ok()?.expect(tag::SEQUENCE, "Certificate").ok()?;
+    let tbs = cert.children().ok()?.into_iter().next()?;
+    let mut f = tbs.children().ok()?.into_iter().peekable();
+    if f.peek().is_some_and(|t| t.tag == tag::ctx(0)) {
+        f.next();
+    }
+    // serial, signature algorithm, issuer, validity, then the subject.
+    Name::parse(&f.nth(4)?).ok()
+}
+
 /// The chain from `leaf` up through `pool`, as far as issuers can be found and may issue: each
 /// issuer's key verifies the certificate below it, it is a CA allowed to sign certificates, its
 /// `pathLenConstraint` allows the CA certificates below it, and (when `at` is given) it was valid
diff --git a/crates/sign/tests/pdf.rs b/crates/sign/tests/pdf.rs
index 0542190a2..20b7f0883 100644
--- a/crates/sign/tests/pdf.rs
+++ b/crates/sign/tests/pdf.rs
@@ -1086,7 +1086,12 @@ fn a_timestamp_token_may_sign_with_a_different_digest_than_its_imprint() {
 #[cfg(windows)]
 #[test]
 fn windows_store_enumeration_and_missing_identity() {
-    assert!(pdfcraft_sign::windows::identities().is_ok());
+    let listing = pdfcraft_sign::windows::list().unwrap();
+    assert_eq!(listing.ids.len(), pdfcraft_sign::windows::identities().unwrap().len());
+    // Whatever this machine's store holds, every certificate left out is named and explained.
+    for u in &listing.unusable {
+        assert!(!u.subject.is_empty() && !u.reason.is_empty() && u.fingerprint.len() == 95, "{u:?}");
+    }
     assert!(pdfcraft_sign::windows::find("windows:no such signer").is_err());
 }
 
@@ -1108,9 +1113,10 @@ impl Drop for Certificates {
     fn drop(&mut self) {
         for thumbprint in &self.0 {
             // New-SelfSignedCertificate also leaves a public copy of a self-signed or CA
-            // certificate in Intermediate Certification Authorities (CA).
+            // certificate in Intermediate Certification Authorities (CA). -DeleteKey fails on
+            // a certificate without a key; the plain removal then runs.
             let out = powershell(&format!(
-                "Remove-Item -LiteralPath 'Cert:\\CurrentUser\\My\\{thumbprint}' -DeleteKey; $copy='Cert:\\CurrentUser\\CA\\{thumbprint}'; if (Test-Path -LiteralPath $copy) {{ Remove-Item -LiteralPath $copy }}"
+                "$p='Cert:\\CurrentUser\\My\\{thumbprint}'; try {{ Remove-Item -LiteralPath $p -DeleteKey }} catch {{ Remove-Item -LiteralPath $p }}; $copy='Cert:\\CurrentUser\\CA\\{thumbprint}'; if (Test-Path -LiteralPath $copy) {{ Remove-Item -LiteralPath $copy }}"
             ));
             if !out.status.success() {
                 eprintln!("test certificate cleanup failed: {}", String::from_utf8_lossy(&out.stderr));
@@ -1156,6 +1162,20 @@ fn signing_with_windows_store_identities() {
         assert_eq!(signature.modification, Modification::None);
         assert_eq!(signature.signer.as_deref(), Some(name.as_str()));
     }
+    // A certificate without a private key (issued to someone else, filed under Personal) is
+    // reported as such rather than listed or dropped silently (issue #179).
+    let ada = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap().certificate;
+    let cer = std::env::temp_dir().join(format!("pdfcraft-windows-store-{unique}.cer"));
+    std::fs::write(&cer, &ada.raw).unwrap();
+    let out = powershell(&format!("(Import-Certificate -FilePath '{}' -CertStoreLocation 'Cert:\\CurrentUser\\My').Thumbprint", cer.display()));
+    let _ = std::fs::remove_file(&cer);
+    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+    created.0.push(String::from_utf8(out.stdout).unwrap().trim().to_string());
+    let listing = pdfcraft_sign::windows::list().unwrap();
+    let reported = listing.unusable.iter().find(|u| u.fingerprint == ada.fingerprint()).expect("key-less certificate reported");
+    assert!(reported.no_private_key, "{reported:?}");
+    assert_eq!(reported.subject, ada.display_name());
+    assert!(listing.ids.iter().all(|id| id.certificate.raw != ada.raw));
     let thumbprints = created.0.clone();
     drop(created);
     for thumbprint in thumbprints {
diff --git a/crates/ui-egui/src/actions_ui.rs b/crates/ui-egui/src/actions_ui.rs
index d3e0bfeac..b31426373 100644
--- a/crates/ui-egui/src/actions_ui.rs
+++ b/crates/ui-egui/src/actions_ui.rs
@@ -28,6 +28,36 @@ pub struct RunProgress {
     pub message: Option<String>,
 }
 
+/// Keep each desktop result, including when input basenames repeat or an earlier run already
+/// used the name. The search is bounded and never falls back to an occupied destination.
+#[cfg(not(target_arch = "wasm32"))]
+fn write_result(dir: &std::path::Path, name: &str, bytes: &[u8]) -> std::io::Result<std::path::PathBuf> {
+    use std::io::{Error, ErrorKind};
+    let source = std::path::Path::new(name);
+    let filename = source.file_name().ok_or_else(|| Error::from(ErrorKind::InvalidInput))?;
+    let stem = source.file_stem().unwrap_or(filename).to_string_lossy();
+    for number in 1..=10_000 {
+        let path = if number == 1 {
+            dir.join(filename)
+        } else {
+            let suffix = match source.extension() {
+                Some(ext) => format!("{stem} ({number}).{}", ext.to_string_lossy()),
+                None => format!("{stem} ({number})"),
+            };
+            dir.join(suffix)
+        };
+        match std::fs::symlink_metadata(&path) {
+            Ok(_) => continue,
+            Err(e) if e.kind() == ErrorKind::NotFound => {
+                crate::editing::write_atomically(&path.to_string_lossy(), bytes)?;
+                return Ok(path);
+            }
+            Err(e) => return Err(e),
+        }
+    }
+    Err(Error::from(ErrorKind::AlreadyExists))
+}
+
 impl PdfCraftApp {
     /// Built-in actions, then the user's.
     pub fn all_actions(&self) -> Vec<Action> {
@@ -75,7 +105,7 @@ impl PdfCraftApp {
                 }
                 let r = pdfcraft_engine::actions::run_on(&action, &name, Arc::new(bytes), |_, _| {}).and_then(|r| {
                     #[cfg(not(target_arch = "wasm32"))]
-                    crate::editing::write_atomically(&dir.join(&name).to_string_lossy(), &r.bytes).map_err(|e| e.to_string())?;
+                    write_result(&dir, &name, &r.bytes).map_err(|e| e.to_string())?;
                     #[cfg(target_arch = "wasm32")]
                     crate::editing::download(&name, &r.bytes)?;
                     Ok(())
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 2dc7c5765..bf66f873b 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -60,7 +60,7 @@ fn texture_bytes(tex: &TextureHandle) -> usize {
 
 /// Visible grid rows, plus one adjacent row in either direction. Work is independent of
 /// document length, including after a large scroll jump.
-fn thumbnail_rows(top: f32, bottom: f32, row_height: f32, rows: usize) -> Range<usize> {
+pub(crate) fn thumbnail_rows(top: f32, bottom: f32, row_height: f32, rows: usize) -> Range<usize> {
     let first = (top.max(0.0) / row_height).floor() as usize;
     let end = (bottom.max(0.0) / row_height).ceil() as usize;
     first.saturating_sub(1).min(rows)..end.saturating_add(1).min(rows)
@@ -196,17 +196,45 @@ pub struct Find {
     pub in_panel: bool,
 }
 
-/// A text selection on one page, in reading-order glyph indices.
+/// A text selection on one page.
 #[derive(Clone, Copy, Debug, PartialEq)]
 struct Selection {
     page: usize,
-    anchor: usize,
-    head: usize,
+    span: Span,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Span {
+    /// Reading order, between two glyph indices.
+    Run { anchor: usize, head: usize },
+    /// Column select (#740): the glyphs inside a rectangle in page view space, drawn from the
+    /// corner the drag started at (`rect[0..2]`) to the pointer (`rect[2..4]`).
+    Column { rect: [f32; 4] },
 }
 
 impl Selection {
-    fn range(&self) -> Range<usize> {
-        self.anchor.min(self.head)..self.anchor.max(self.head) + 1
+    fn run(page: usize, anchor: usize, head: usize) -> Self {
+        Self { page, span: Span::Run { anchor, head } }
+    }
+
+    fn range(anchor: usize, head: usize) -> Range<usize> {
+        anchor.min(head)..anchor.max(head).saturating_add(1)
+    }
+
+    /// One rectangle per selected piece of a line, in view space (highlighting, markup quads).
+    fn rects(&self, text: &PageText) -> Vec<[f32; 4]> {
+        match self.span {
+            Span::Run { anchor, head } => text.line_rects(Self::range(anchor, head)),
+            Span::Column { rect } => text.glyph_rects(&text.glyphs_in(rect)),
+        }
+    }
+
+    /// The selected text, as Copy puts it on the clipboard.
+    fn text(&self, text: &PageText) -> String {
+        match self.span {
+            Span::Run { anchor, head } => text.text_of(Self::range(anchor, head)),
+            Span::Column { rect } => text.column_text(&text.glyphs_in(rect)),
+        }
     }
 }
 
@@ -306,6 +334,12 @@ pub struct DocView {
     shown: bool,
     /// Turns wheel input into page turns in single-page view.
     wheel: crate::wheel_pager::WheelPager,
+    /// Until this time, apply precise (touchpad) wheel input 1:1 and suppress egui's eased copy.
+    /// A precision touchpad sends pixel-precise `MouseWheel` events; on Windows they arrive with
+    /// no `TouchPhase::Start`, so egui eases deltas of 8 px or more and the page lags the finger
+    /// (#759). The window outlasts a single frame so egui's internal easing tail is suppressed as
+    /// it decays, instead of adding on top of the 1:1 motion.
+    precise_scroll_until: f64,
     pub(crate) auto_scroll: crate::autoscroll::AutoScroll,
     /// Pages selected in the organize grid or the Pages panel (0-based). Empty means "the current page".
     pub selected: BTreeSet<usize>,
@@ -319,6 +353,7 @@ pub struct DocView {
     pub line_editor: Option<crate::edit_text_ui::LineEditor>,
     /// Edit text & images: the images per page (by document generation), and the selected one.
     pub(crate) edit_images: HashMap<usize, (u64, Vec<pdfcraft_engine::PageImage>)>,
+    pub(crate) objects: crate::object_ui::ObjectSelection,
     pub image_selection: Option<crate::edit_text_ui::ImageSelection>,
     /// A paragraph box being dragged (moved, or resized from its right edge) in Edit text.
     pub block_drag: Option<crate::edit_text_ui::BlockDrag>,
@@ -503,6 +538,7 @@ impl DocView {
             zoom_anchor: None,
             shown: false,
             wheel: Default::default(),
+            precise_scroll_until: 0.0,
             auto_scroll: Default::default(),
             selected: BTreeSet::new(),
             select_anchor: None,
@@ -510,6 +546,7 @@ impl DocView {
             edit_lines: HashMap::new(),
             line_editor: None,
             edit_images: HashMap::new(),
+            objects: Default::default(),
             image_selection: None,
             block_drag: None,
             pending_action: None,
@@ -679,7 +716,7 @@ impl DocView {
         let s = self.selection?;
         let text = self.texts.get(&s.page)?;
         let page = info.pages.get(s.page)?;
-        let quads: Vec<[f64; 8]> = text.line_rects(s.range()).into_iter().map(|r| page.view_rect_to_quad(r)).collect();
+        let quads: Vec<[f64; 8]> = s.rects(text).into_iter().map(|r| page.view_rect_to_quad(r)).collect();
         (!quads.is_empty()).then_some((s.page, quads))
     }
 
@@ -704,7 +741,7 @@ impl DocView {
 
     /// Select text on `page` from glyph `from` to glyph `to` (tests and automation).
     pub fn select_text(&mut self, page: usize, from: usize, to: usize) {
-        self.selection = Some(Selection { page, anchor: from, head: to });
+        self.selection = Some(Selection::run(page, from, to));
     }
 
     /// Open the find bar (or focus it if already open).
@@ -795,7 +832,7 @@ impl DocView {
     pub fn selected_text(&self) -> Option<String> {
         let s = self.selection?;
         let t = self.texts.get(&s.page)?;
-        Some(t.text_of(s.range())).filter(|x| !x.is_empty())
+        Some(s.text(t)).filter(|x| !x.is_empty())
     }
 
     pub fn thumb(&self, page: usize) -> Option<&TextureHandle> {
@@ -945,7 +982,7 @@ impl DocView {
         if t.glyphs.is_empty() {
             return false;
         }
-        self.selection = Some(Selection { page, anchor: 0, head: t.glyphs.len() - 1 });
+        self.selection = Some(Selection::run(page, 0, t.glyphs.len() - 1));
         true
     }
 
@@ -1357,7 +1394,7 @@ impl DocView {
         let avail_w = (self.viewport_w - 2.0 * SIDE).max(100.0);
         let per_row = if self.layout == PageLayout::TwoUp { 2.0 } else { 1.0 };
         match self.fit {
-            Fit::Width => self.zoom = (avail_w - GAP * (per_row - 1.0)) / (max_w * PT * per_row),
+            Fit::Width => self.zoom = (avail_w - GAP * (per_row - 1.0)) / (w * PT * per_row),
             Fit::Page => {
                 let zw = (avail_w - GAP * (per_row - 1.0)) / (w * PT * per_row);
                 let zh = (self.viewport_h - 2.0 * MARGIN) / (h * PT);
@@ -1369,6 +1406,16 @@ impl DocView {
         self.zoom = self.zoom.clamp(0.08, 64.0);
     }
 
+    /// Width of the scroll content. Single-page view sizes it to the page it shows, so a
+    /// wider page elsewhere in the document can't push the shown one off-centre.
+    fn content_width(&self, info: &DocInfo, avail_w: f32) -> f32 {
+        let single = (self.layout == PageLayout::Single).then(|| self.current.min(info.pages.len().saturating_sub(1)));
+        let shown = info.pages.iter().enumerate().filter(|&(i, _)| single.is_none_or(|c| c == i));
+        let max_w = shown.map(|(_, p)| self.display_size(p).0).fold(0.0, f32::max);
+        let per_row = if self.layout == PageLayout::TwoUp { 2.0 } else { 1.0 };
+        (max_w * self.zoom * PT * per_row + 2.0 * SIDE).max(avail_w)
+    }
+
     /// Page rects in content coordinates (origin at the scroll content's top-left).
     fn layout(&self, info: &DocInfo, content_w: f32) -> Vec<Rect> {
         let s = self.zoom * PT;
@@ -1612,7 +1659,9 @@ pub fn shortcuts(view: &mut DocView, ctx: &egui::Context) {
         view.fit = Fit::Width;
         view.goto = Some((view.current, 0.0));
     }
-    if pressed(cmd(Key::G)) {
+    if pressed(KeyboardShortcut::new(Modifiers::COMMAND | Modifiers::SHIFT, Key::G)) {
+        view.find_step(false);
+    } else if pressed(cmd(Key::G)) {
         view.find_step(true);
     }
     if pressed(cmd(Key::OpenBracket)) {
@@ -1621,9 +1670,6 @@ pub fn shortcuts(view: &mut DocView, ctx: &egui::Context) {
     if pressed(cmd(Key::CloseBracket)) {
         view.view_history(true);
     }
-    if pressed(KeyboardShortcut::new(Modifiers::COMMAND | Modifiers::SHIFT, Key::G)) {
-        view.find_step(false);
-    }
     // ⌘C arrives as a Copy event on most platforms.
     let copy = ctx.input(|i| i.events.iter().any(|e| matches!(e, egui::Event::Copy)));
     if copy && let Some(text) = view.selected_text() {
@@ -1728,7 +1774,8 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         None => {}
     }
     // No dialog, close prompt or palette over the page: only then does page input count.
-    let unobstructed = app.dialog.is_none() && app.close_request.is_none() && !app.palette_open;
+    let unobstructed = !app.modal_open() && !app.palette_open;
+    let view = &mut app.views[index];
     if view.organize {
         organize_grid(view, info, doc.allows_assembly(), doc.dirty, unobstructed, ui, &t);
         return;
@@ -1756,21 +1803,19 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         Vec2::ZERO
     };
 
-    let max_w = info.pages.iter().map(|p| view.display_size(p).0).fold(0.0, f32::max)
-        * view.zoom
-        * PT
-        * if view.layout == PageLayout::TwoUp { 2.0 } else { 1.0 };
-    let content_w = (max_w + 2.0 * SIDE).max(avail.width());
+    let content_w = view.content_width(info, avail.width());
     let rects = view.layout(info, content_w);
     let middle_gesture = view.auto_scroll.blocks_input();
     // Single page: when the whole page fits, the wheel would do nothing, so it turns pages
     // instead; zoomed in far enough to pan, it pans. Touch drags are untouched: with nothing
     // to pan, touch users turn pages with the rail buttons, the page box and the arrow keys.
     // Runs before `visible_pages` so the frame that turns the page draws it.
+    let mut single_paging = false;
     if view.layout == PageLayout::Single {
         // Within a point, so layout rounding can't stop a fitting page from turning.
         let fits = rects.get(view.current.min(rects.len().saturating_sub(1))).is_some_and(|r| r.height() + 2.0 * MARGIN <= avail.height() + 1.0);
         let can_turn = fits && !middle_gesture && unobstructed && ui.rect_contains_pointer(avail);
+        single_paging = can_turn;
         // Every wheel event goes to the pager, so it follows each trackpad touch to its end
         // even while the page can't turn.
         ui.input(|i| {
@@ -1788,6 +1833,46 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             ui.input_mut(|i| i.smooth_scroll_delta.y = 0.0);
         }
     }
+    // Touchpad scrolling 1:1 (#759). A precision touchpad sends pixel-precise `MouseWheel`
+    // events; on Windows they carry no `TouchPhase::Start`, so egui never takes its no-smoothing
+    // path and eases deltas of 8 px or more, leaving the page a frame behind the finger. Apply
+    // the precise delta ourselves this frame through the un-animated scroll path, and suppress
+    // egui's eased copy while it decays so it neither doubles nor trails the motion. A coarse
+    // mouse wheel keeps egui's easing (pleasant for chunky notches).
+    let now = ui.input(|i| i.time);
+    let mut precise_scroll = Vec2::ZERO;
+    if ui.rect_contains_pointer(avail) {
+        let mut coarse_wheel = false;
+        ui.input(|i| {
+            for e in &i.events {
+                if let egui::Event::MouseWheel { unit, delta, modifiers, .. } = e {
+                    if modifiers.command || modifiers.ctrl {
+                        continue; // Zooming, not scrolling.
+                    }
+                    match unit {
+                        // Shift scrolls sideways, matching egui's own wheel handling.
+                        egui::MouseWheelUnit::Point if modifiers.shift => precise_scroll.x += delta.x + delta.y,
+                        egui::MouseWheelUnit::Point => precise_scroll += *delta,
+                        egui::MouseWheelUnit::Line | egui::MouseWheelUnit::Page => coarse_wheel = true,
+                    }
+                }
+            }
+        });
+        if coarse_wheel {
+            view.precise_scroll_until = 0.0;
+        } else if precise_scroll != Vec2::ZERO {
+            view.precise_scroll_until = now + 0.25;
+        }
+    }
+    // Paging owns the vertical axis in single-page view; leave it to the pager.
+    if single_paging {
+        precise_scroll.y = 0.0;
+    }
+    if now < view.precise_scroll_until {
+        ui.input_mut(|i| i.smooth_scroll_delta = Vec2::ZERO);
+    } else {
+        precise_scroll = Vec2::ZERO;
+    }
     let visible_pages: Vec<usize> = match view.layout {
         PageLayout::Single => vec![view.current.min(rects.len() - 1)],
         _ => (0..rects.len()).collect(),
@@ -1836,7 +1921,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let selects_text = match tool {
         QuickTool::Comment(t) => t.markup().is_some() || t == comments::CommentTool::ReplaceText,
         QuickTool::Select => !preparing,
-        QuickTool::Redact => true,
+        QuickTool::Redact | QuickTool::ColumnSelect => true,
         QuickTool::Hand
         | QuickTool::Measure(_)
         | QuickTool::Crop
@@ -1887,6 +1972,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     } else {
         view.prepare.selected = None;
     }
+    view.objects.prepare(doc, tool == QuickTool::EditText && can_modify, ui.ctx());
     let added = doc.added.clone();
     let doc_links = if tool == QuickTool::Link { doc.links.clone() } else { Vec::new() };
     if editing_content {
@@ -1917,8 +2003,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             // Only interactions pause; the document must keep its original colours.
             ui.set_opacity(opacity);
         }
-        // Middle-button auto-scroll and the keyboard (positive y moves the content down).
-        let delta = auto_delta - vec2(0.0, key_scroll);
+        // Middle-button auto-scroll, the keyboard and precise touchpad input (#759); positive y
+        // moves the content down. All three scroll without easing, unlike egui's wheel default.
+        let delta = auto_delta - vec2(0.0, key_scroll) + precise_scroll;
         if delta != Vec2::ZERO {
             ui.scroll_with_delta_animation(delta, egui::style::ScrollAnimation::none());
         }
@@ -2124,8 +2211,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     stamp_placed = true;
                 }
             }
+            // Over a mark already placed, the Fill & Sign tool picks it up (comments, below).
             if let QuickTool::Fill(ft) = tool
                 && allowed
+                && !comments::fill_grabs(ui, &pcx, view)
             {
                 match crate::fill_sign::page_input(
                     ui,
@@ -2172,7 +2261,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 field_placed |= o.placed;
                 o.consumed || field_tool.is_some()
             } else {
-                tool == QuickTool::Select && crate::forms_ui::page_input(ui, &resp, &xf, i, info, &form, can_fill, view)
+                tool == QuickTool::Select
+                    && !comments::select_grabs(ui, &pcx, view)
+                    && crate::forms_ui::page_input(ui, &resp, &xf, i, info, &form, can_fill, view)
             };
             // Redact draws boxes off text; so does Highlight (an area highlight, as in Acrobat).
             let area_tool = tool == QuickTool::Redact && can_modify || tool == QuickTool::Comment(comments::CommentTool::Highlight) && allowed;
@@ -2184,11 +2275,12 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 };
                 crate::redact_ui::page_input(ui, &resp, &xf, i, info, over_text, view)
             };
-            let on_content = editing_content && can_modify && {
+            let on_objects = tool == QuickTool::EditText && can_modify && crate::object_ui::page_input(ui, &resp, &xf, i, doc, view);
+            let on_content = !on_objects && editing_content && can_modify && {
                 crate::content_ui::page_input(ui, &resp, &xf, i, info, &added, tool == QuickTool::AddText, &text_style, view)
                     || tool == QuickTool::AddText
             };
-            let on_edit_text = tool == QuickTool::EditText && can_modify && {
+            let on_edit_text = !on_objects && tool == QuickTool::EditText && can_modify && {
                 let generation = doc.edit_generation();
                 let lines = match view.edit_lines.get(&i) {
                     Some((g, l)) if *g == generation => l.clone(),
@@ -2211,9 +2303,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     || crate::edit_text_ui::page_input(ui, &resp, &xf, i, info, &lines, view)
             };
             let on_link = tool == QuickTool::Link && can_modify && crate::link_ui::page_input(ui, &resp, &xf, i, info, &doc_links, view);
-            let consumed = on_edit_text || on_link || on_content || boxing || on_field || comments::page_input(ui, &resp, &pcx, view);
+            let consumed = on_objects || on_edit_text || on_link || on_content || boxing || on_field || comments::page_input(ui, &resp, &pcx, view);
 
-            let preview_target = (tool == QuickTool::Select && !comments_hidden).then_some(view.comments.selected).flatten();
+            let preview_target =
+                (matches!(tool, QuickTool::Select | QuickTool::Fill(_)) && !comments_hidden).then_some(view.comments.selected).flatten();
             view.signature_drag.prepare(ui.ctx(), doc, preview_target, scale);
             view.signature_drag.paint(painter, &pcx, &view.comments, view.pending_edit.as_ref());
 
@@ -2237,9 +2330,16 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     }
                 }
                 if let Some(sel) = view.selection.filter(|s| s.page == i) {
-                    for lr in text.line_rects(sel.range()) {
+                    for lr in sel.rects(&text) {
                         painter.rect_filled(to_screen(lr), CornerRadius::same(1), Color32::from_rgba_unmultiplied(0x3A, 0x7B, 0xF0, 70));
                     }
+                    // The rectangle being drawn, as Acrobat shows it while column-selecting.
+                    if let Span::Column { rect } = sel.span
+                        && resp.dragged()
+                    {
+                        let outline = Stroke::new(1.0, Color32::from_rgb(0x3A, 0x7B, 0xF0));
+                        painter.rect_stroke(to_screen(rect), CornerRadius::ZERO, outline, egui::StrokeKind::Middle);
+                    }
                 }
                 if selects_text
                     && !consumed
@@ -2248,20 +2348,44 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                     let (vx, vy) = xf.screen_to_view(p);
                     let over_text = text.glyphs.iter().any(|g| vx >= g.rect[0] && vx <= g.rect[2] && vy >= g.rect[1] && vy <= g.rect[3]);
                     let over_link = info.links.iter().any(|l| l.page == i && xf.user_rect(info, i, l.rect).contains(p));
-                    if over_text && !over_link {
+                    // Column select (#740): the Column select tool, or Alt (Option on macOS) held
+                    // while a drag starts, as in Acrobat.
+                    let column = tool == QuickTool::ColumnSelect || ui.input(|inp| inp.modifiers.alt);
+                    if column && !over_link {
+                        ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
+                    } else if over_text && !over_link {
                         ui.ctx().set_cursor_icon(egui::CursorIcon::Text);
                     }
                     let press_here = ui.input(|inp| inp.pointer.press_origin()).is_some_and(|o| r.contains(o));
                     if resp.drag_started() && press_here && !over_link {
                         let origin = ui.input(|inp| inp.pointer.press_origin()).unwrap_or(p);
                         let (ox, oy) = xf.screen_to_view(origin);
-                        view.selection = text.nearest(ox, oy).map(|a| Selection { page: i, anchor: a, head: a });
+                        view.selection = if column {
+                            Some(Selection { page: i, span: Span::Column { rect: [ox, oy, vx, vy] } })
+                        } else {
+                            text.nearest(ox, oy).map(|a| Selection::run(i, a, a))
+                        };
                     }
                     if resp.dragged()
                         && let Some(sel) = view.selection.as_mut().filter(|s| s.page == i)
-                        && let Some(h) = text.nearest(vx, vy)
                     {
-                        sel.head = h;
+                        match &mut sel.span {
+                            Span::Run { head, .. } => {
+                                if let Some(h) = text.nearest(vx, vy) {
+                                    *head = h;
+                                }
+                            }
+                            Span::Column { rect } => {
+                                rect[2] = vx;
+                                rect[3] = vy;
+                            }
+                        }
+                    }
+                    // A rectangle around no text selects nothing.
+                    if resp.drag_stopped()
+                        && view.selection.is_some_and(|s| s.page == i && matches!(s.span, Span::Column { .. }) && s.text(&text).is_empty())
+                    {
+                        view.selection = None;
                     }
                     // Quick clicks widen the selection: two a word, three the line, four the page.
                     // egui counts up to three, so four come from the run kept here. The markup and
@@ -2284,15 +2408,16 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                             _ => text.glyphs.len().checked_sub(1).map(|last| (0, last)),
                         });
                         if let Some((first, last)) = span {
-                            view.selection = Some(Selection { page: i, anchor: first, head: last });
+                            view.selection = Some(Selection::run(i, first, last));
                         }
                     } else if resp.clicked() && !over_link {
                         // ⇧-click extends a selection on this page to the click, keeping its
-                        // anchor (#527). Otherwise (no shift, or no selection on this page; a
-                        // selection cannot yet span pages) a click clears the selection.
+                        // anchor (#527). Otherwise (no shift, no selection on this page, or a
+                        // column selection, which has no anchor glyph; a selection cannot yet
+                        // span pages) a click clears the selection.
                         let shift = ui.input(|inp| inp.modifiers.shift);
-                        match (view.selection.as_mut().filter(|s| shift && s.page == i), text.nearest(vx, vy)) {
-                            (Some(sel), Some(h)) => sel.head = h,
+                        match (view.selection.as_mut().filter(|s| shift && s.page == i).map(|s| &mut s.span), text.nearest(vx, vy)) {
+                            (Some(Span::Run { head, .. }), Some(h)) => *head = h,
                             _ => view.selection = None,
                         }
                     }
@@ -2310,6 +2435,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             if editing_content {
                 crate::content_ui::paint_page(ui, painter, &xf, i, info, &added, view);
             }
+            if tool == QuickTool::EditText {
+                crate::object_ui::paint(painter, &xf, i, info, &view.objects);
+            }
             if tool == QuickTool::Link {
                 crate::link_ui::paint(ui, painter, &xf, i, info, &doc_links, view);
             }
@@ -2537,6 +2665,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     if typed.is_some() {
         view.pending_edit = typed;
     }
+    if let Some(why) = view.objects.notice.take() {
+        refused = Some(why);
+    }
     let form_notice = view.forms.notice.take();
     // One crop, then back to selecting (as Acrobat does).
     let cropped = view.pending_edit.as_ref().is_some_and(|e| matches!(e, pdfcraft_engine::Edit::SetPageBox { .. }));
@@ -2895,16 +3026,10 @@ fn notices(
     let xfa = doc.xfa.as_ref();
     if let Some((icon, color, template, arg)) = signed {
         let mut open = false;
-        egui::Frame::NONE.fill(t.accent_soft).inner_margin(egui::Margin::symmetric(14, 7)).show(ui, |ui| {
-            ui.horizontal(|ui| {
-                ui.add(icons::image(icon, 16.0, color));
-                ui.label(egui::RichText::new(crate::i18n::fmt(tl!(template), &[("by", &arg)])).color(t.text));
-                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                    if crate::widgets::pill_button(ui, tl!("Signature panel"), false).clicked() {
-                        open = true;
-                    }
-                });
-            });
+        notice_bar(ui, t, icon, color, crate::i18n::fmt(tl!(template), &[("by", &arg)]), |ui| {
+            if crate::widgets::pill_button(ui, tl!("Signature panel"), false).clicked() {
+                open = true;
+            }
         });
         return open.then_some(Notice::Signatures);
     }
@@ -2955,29 +3080,23 @@ fn notices(
         None
     };
     let (icon, text, fields) = msg?;
-    egui::Frame::NONE.fill(t.accent_soft).inner_margin(egui::Margin::symmetric(14, 7)).show(ui, |ui| {
-        ui.horizontal(|ui| {
-            ui.add(icons::image(icon, 16.0, t.accent_text));
-            ui.label(egui::RichText::new(text).color(t.text));
-            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                if icons::button(ui, "x", 22.0, false, tl!("Dismiss")).clicked() {
-                    view.notice_dismissed = true;
-                }
-                if fields {
-                    let label = if view.highlight_fields { tl!("Hide field highlights") } else { tl!("Highlight fields") };
-                    if crate::widgets::pill_button(ui, label, view.highlight_fields).clicked() {
-                        view.highlight_fields = !view.highlight_fields;
-                        toggled = Some(Notice::FieldHighlights(view.highlight_fields));
-                    }
-                }
-                if secured && crate::widgets::pill_button(ui, tl!("Security settings"), false).clicked() {
-                    open_security = true;
-                }
-                if repaired && !secured && info.fields.is_empty() && crate::widgets::pill_button(ui, tl!("Details"), false).clicked() {
-                    open_repairs = true;
-                }
-            });
-        });
+    notice_bar(ui, t, icon, t.accent_text, text, |ui| {
+        if icons::button(ui, "x", 22.0, false, tl!("Dismiss")).clicked() {
+            view.notice_dismissed = true;
+        }
+        if fields {
+            let label = if view.highlight_fields { tl!("Hide field highlights") } else { tl!("Highlight fields") };
+            if crate::widgets::pill_button(ui, label, view.highlight_fields).clicked() {
+                view.highlight_fields = !view.highlight_fields;
+                toggled = Some(Notice::FieldHighlights(view.highlight_fields));
+            }
+        }
+        if secured && crate::widgets::pill_button(ui, tl!("Security settings"), false).clicked() {
+            open_security = true;
+        }
+        if repaired && !secured && info.fields.is_empty() && crate::widgets::pill_button(ui, tl!("Details"), false).clicked() {
+            open_repairs = true;
+        }
     });
     if open_repairs {
         return Some(Notice::Repairs);
@@ -2985,6 +3104,37 @@ fn notices(
     open_security.then_some(Notice::Security).or(toggled)
 }
 
+/// One notice bar: an icon and a message on the left, `buttons` (added right to left) on the
+/// right. The buttons are laid out first, so the message only gets the width they leave: it
+/// wraps there (or, when very little is left, is cut short with the full text on hover) instead
+/// of running under the buttons and past the document area into the side panel (#785). The
+/// buttons are centred on a row of button height, and the message's first line is centred on
+/// the same row; a wrapped message grows the bar downwards.
+fn notice_bar(ui: &mut egui::Ui, t: &Tokens, icon: &str, icon_color: Color32, text: String, buttons: impl FnOnce(&mut egui::Ui)) {
+    const ROW: f32 = 28.0;
+    const ICON: f32 = 16.0;
+    egui::Frame::NONE.fill(t.accent_soft).inner_margin(egui::Margin::symmetric(14, 7)).show(ui, |ui| {
+        let width = ui.available_width();
+        ui.allocate_ui_with_layout(vec2(width, ROW), egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            ui.set_min_height(ROW);
+            buttons(ui);
+            let rest = ui.available_width().max(0.0);
+            ui.allocate_ui_with_layout(vec2(rest, ROW), egui::Layout::top_down(egui::Align::Min), |ui| {
+                let font = egui::TextStyle::Body.resolve(ui.style());
+                let line = ui.fonts_mut(|f| f.row_height(&font)).max(ICON);
+                ui.add_space(((ROW - line) / 2.0).max(0.0));
+                ui.with_layout(egui::Layout::left_to_right(egui::Align::Min), |ui| {
+                    let (slot, _) = ui.allocate_exact_size(vec2(ICON, line), Sense::hover());
+                    icons::paint(ui, Rect::from_center_size(slot.center(), vec2(ICON, ICON)), icon, ICON, icon_color);
+                    let label = egui::Label::new(egui::RichText::new(text).color(t.text));
+                    // Wrapping into a sliver would stack the message a few letters per line.
+                    ui.add(if ui.available_width() >= 120.0 { label.wrap() } else { label.truncate() });
+                });
+            });
+        });
+    });
+}
+
 /// The floating quick-action bar at the left edge of the document area.
 fn quick_bar(app: &mut PdfCraftApp, area: Rect, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
@@ -3136,7 +3286,7 @@ fn quick_bar(app: &mut PdfCraftApp, area: Rect, ui: &mut egui::Ui) {
 }
 
 /// The organize toolbar: page operations on the selection (Acrobat's Organize Pages bar).
-fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, ui: &mut egui::Ui, t: &Tokens) {
+fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
     let targets = view.target_pages();
     let n = info.pages.len();
     let (first, last) = (targets.first().copied().unwrap_or(0), targets.last().copied().unwrap_or(0));
@@ -3242,8 +3392,9 @@ fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, dirty: b
             });
         });
     });
-    // Keys act on the selection unless a text field has focus.
-    if editable && !ui.ctx().egui_wants_keyboard_input() {
+    // Keys act on the selection unless a text field or a dialog has them (Delete under
+    // Preferences deleted the selected pages).
+    if editable && unobstructed && !ui.ctx().egui_wants_keyboard_input() {
         use egui::{Key, Modifiers};
         let (del, esc) = ui.input_mut(|i| {
             (
@@ -3274,7 +3425,7 @@ fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, dirty: b
 /// Organize pages: a thumbnail grid (Acrobat's Organize Pages view). Click selects, ⌘-click
 /// toggles, ⇧-click extends; double-click opens the page.
 /// The gap (0 = before the first page, n = after the last) the pointer points at in the grid.
-fn drop_gap(cells: &[(usize, Rect)], p: Pos2) -> Option<usize> {
+pub(crate) fn drop_gap(cells: &[(usize, Rect)], p: Pos2) -> Option<usize> {
     let (i, r) = cells.iter().min_by(|(_, a), (_, b)| a.distance_sq_to_pos(p).total_cmp(&b.distance_sq_to_pos(p)))?;
     Some(if p.x < r.center().x { *i } else { i + 1 })
 }
@@ -3294,16 +3445,16 @@ fn gap_button(ui: &mut egui::Ui, gap: usize, at: Pos2, height: f32, label: Strin
     resp.on_hover_text(label).clicked()
 }
 
-fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, auto_scroll_enabled: bool, ui: &mut egui::Ui, t: &Tokens) {
+fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
     let ppp = ui.ctx().pixels_per_point();
     // The page image scales with the zoom; the padding and the page number don't.
     let cell = vec2(146.0 * view.grid_zoom + 44.0, 194.0 * view.grid_zoom + 56.0);
     let anchor = view.grid_anchor.take();
     let mut open_page = None;
-    organize_toolbar(view, info, editable, dirty, ui, t);
+    organize_toolbar(view, info, editable, dirty, unobstructed, ui, t);
     let viewport = ui.available_rect_before_wrap();
     view.viewport_screen = viewport;
-    let auto_delta = if auto_scroll_enabled {
+    let auto_delta = if unobstructed {
         view.auto_scroll.update(ui, viewport, true)
     } else {
         view.auto_scroll.cancel();
@@ -3525,7 +3676,7 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
 
 /// A rendered raster as texture data. Its words are premultiplied RGBA bytes, exactly
 /// `Color32`s, so the renderer's buffer becomes the image without a copy on the UI thread.
-fn texture_image(size: [usize; 2], pixels: pdfcraft_render::Pixels) -> egui::ColorImage {
+pub(crate) fn texture_image(size: [usize; 2], pixels: pdfcraft_render::Pixels) -> egui::ColorImage {
     match bytemuck::allocation::try_cast_vec::<u32, Color32>(pixels.into_words()) {
         Ok(px) if px.len() == size[0].saturating_mul(size[1]) => egui::ColorImage::new(size, px),
         Ok(px) => egui::ColorImage::from_rgba_premultiplied(size, bytemuck::cast_slice(&px)),
@@ -4080,6 +4231,31 @@ trailer << /Root 1 0 R >>
         }
     }
 
+    #[test]
+    fn fit_width_fits_the_shown_page_in_single_page_view_only() {
+        let page =
+            |width: f32, height: f32| pdfcraft_render::PageInfo { width, height, label: String::new(), crop: [0.0, 0.0, width, height], rotation: 0 };
+        let info = DocInfo { pages: vec![page(300.0, 400.0), page(600.0, 400.0)], ..Default::default() };
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        (v.fit, v.viewport_w, v.viewport_h) = (Fit::Width, 1000.0, 800.0);
+        v.layout = PageLayout::Single;
+        v.fit_zoom(&info);
+        let narrow = v.zoom;
+        // The shown page fills the width between the side gutters, not centred for the wide page.
+        let shown = v.layout(&info, v.content_width(&info, 1000.0))[0];
+        assert!((shown.left() - SIDE).abs() < 1e-2 && (shown.width() - 860.0).abs() < 1e-2, "{shown:?}");
+        v.current = 1;
+        v.fit_zoom(&info);
+        assert!((narrow / v.zoom - 2.0).abs() < 1e-3, "the narrow page gets twice the zoom of the wide one");
+        // Scrolling views keep one zoom for the whole document.
+        v.layout = PageLayout::Continuous;
+        v.fit_zoom(&info);
+        let wide = v.zoom;
+        v.current = 0;
+        v.fit_zoom(&info);
+        assert_eq!(v.zoom, wide, "continuous fit width holds still across page sizes");
+    }
+
     #[test]
     fn layouts_match_their_commands_and_names() {
         for l in PageLayout::ORDER {
diff --git a/crates/ui-egui/src/combine_grid.rs b/crates/ui-egui/src/combine_grid.rs
new file mode 100644
index 000000000..80facbc84
--- /dev/null
+++ b/crates/ui-egui/src/combine_grid.rs
@@ -0,0 +1,1671 @@
+//! Combine files as a grid: a thumbnail of the first page each file contributes, drawn as a
+//! stack when it contributes more than one, with its name below. Cards are selected and moved
+//! with the same [`RowAction`]s as the table's rows, so both views share the selection, the
+//! order and the undo history.
+//!
+//! Thumbnails render off the UI thread through [`RenderPool`] (its panic guard, size caps and
+//! watchdog), one small pool per thumbnail. Only missing ones are asked for, those in view first.
+//! At most [`MAX_THREADS`] render threads exist at once, counted as threads, not pools: the pools
+//! start no watchdog replacements ([`RenderPool::without_replacements`]), and a pool's threads
+//! count until they have actually exited ([`RenderPool::retire`]), so a render the watchdog gave
+//! up on, or one whose file left the list, holds its place until its thread is gone. A thread
+//! stuck for good in one step that can't be interrupted keeps its place for good: threads can't
+//! be killed safely. On the web the pool renders on the UI thread inside `try_recv`, with no
+//! watchdog: there, at most one thumbnail per frame, only one waits at a time (its pool holds the
+//! parsed document), and a very slow page still stalls that frame (as in the document view).
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use egui::{Align2, Color32, CornerRadius, Rect, Sense, Stroke, TextureHandle, Vec2, pos2, vec2};
+use pdfcraft_render::{RenderConfig, RenderPool, RenderRequest, Retiring};
+
+use crate::PdfCraftApp;
+use crate::combine_ui::{CombineFile, ERROR, Lock, RowAction, WARNING};
+use crate::icons;
+use crate::theme::{self, Tokens};
+
+/// Render threads for thumbnails at once, counting those of retired pools until they exit.
+const MAX_THREADS: usize = 3;
+/// Results taken per frame, and the bytes they may upload.
+const UPLOADS_PER_FRAME: usize = 4;
+const UPLOAD_BYTES_PER_FRAME: usize = 8 << 20;
+/// Thumbnail textures kept, in bytes. Those out of view go first, longest unseen first; those in
+/// view are kept even over budget (at most a screenful of thumbnails of at most [`MAX_SIDE`]).
+const TEXTURE_BUDGET: usize = 32 << 20;
+/// The longest side of a thumbnail, in pixels.
+/// (Room for a Letter page at 200% on a screen of 1.5 pixels per point; sharper screens upscale a
+/// little at the largest sizes.)
+const MAX_SIDE: f32 = 768.0;
+/// Thumbnail sizes round up to this many pixels, so a slightly different layout reuses them.
+const SIZE_STEP: u32 = 16;
+/// The box a page is fitted in at 100%, and the room the card adds around it (for the hover bar
+/// and the stack above it, the name and a note below), which doesn't scale.
+const PAPER: Vec2 = vec2(132.0, 172.0);
+const AROUND: Vec2 = vec2(52.0, 90.0);
+/// From the top of a card to its page box: room for the hover bar, which sits mostly above the
+/// page.
+const ABOVE: f32 = 32.0;
+/// The hover bar's height; a quarter of it overlaps the page.
+const BAR_H: f32 = 34.0;
+/// The grid's zoom range, and the sizes its buttons and keys step through (the slider, the wheel
+/// and a pinch go anywhere between).
+pub(crate) const ZOOM_RANGE: std::ops::RangeInclusive<f32> = 0.6..=2.0;
+const ZOOM_STEPS: [f32; 7] = [0.6, 0.8, 1.0, 1.25, 1.5, 1.75, 2.0];
+
+/// The next size up (or down) from `zoom`; the end of the range stays put.
+pub(crate) fn zoom_step(zoom: f32, larger: bool) -> f32 {
+    let next =
+        if larger { ZOOM_STEPS.iter().copied().find(|s| *s > zoom + 0.001) } else { ZOOM_STEPS.iter().rev().copied().find(|s| *s < zoom - 0.001) };
+    next.unwrap_or(if larger { *ZOOM_RANGE.end() } else { *ZOOM_RANGE.start() })
+}
+/// Space above the first row of cards.
+const TOP: f32 = 12.0;
+/// A thumbnail's place: the file (by id) and the page (0-based, in the file). A file's card and
+/// the card of its first page when expanded show the same thumbnail.
+type Slot = (u64, usize);
+/// The page shown large (a card's magnifier) is kept beside the thumbnails under this slot, so it
+/// shares their threads, their limits and their checks.
+const PREVIEW: Slot = (u64::MAX, 0);
+/// The longest side of the page shown large, in pixels.
+const PREVIEW_SIDE: f32 = 2048.0;
+/// A file whose render is done keeps its document open this long (seconds), so the next page of
+/// the same file renders without reading the whole file again.
+const KEEP_OPEN: f64 = 2.0;
+/// The most pages one file can be spread out into (each is a card, laid out every frame).
+pub(crate) const MAX_EXPAND: usize = 2000;
+/// The shape drawn for a page whose size is unknown (US Letter); nothing is rendered for it.
+const FALLBACK_PAGE: (f32, f32) = (612.0, 792.0);
+/// Icons drawn on the (always white) paper, in either theme: the light theme's muted text, which
+/// keeps its contrast on white where the dark theme's doesn't.
+const ON_PAPER: Color32 = Color32::from_rgb(0x5E, 0x5E, 0x66);
+
+/// What the grid has for a file (tests and the control channel).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ThumbState {
+    /// Nothing yet: not in view, or nothing to draw (locked, unreadable, a bad page range, a page
+    /// whose size is unknown).
+    None,
+    /// Being rendered.
+    Pending,
+    /// A thumbnail of page `page` (0-based), `width` × `height` pixels.
+    Ready { page: usize, width: u32, height: u32 },
+    /// The page couldn't be drawn.
+    Failed(String),
+}
+
+/// A card being dragged: which file, and the list as it was (see [`RowAction::DropAt`]).
+#[derive(Clone, Copy)]
+struct GridDrag {
+    file: u64,
+    revision: u64,
+    /// A page card's page (entry id, place among its pages): that page moves, not its file.
+    page: Option<(u64, usize)>,
+}
+
+/// Everything a thumbnail depends on: the file's bytes, how it was read (its password), the page
+/// and the size. A cached thumbnail is used only while all of them still match.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct Key {
+    /// The address of the file's shared bytes: the same file, even after undo brings it back.
+    source: usize,
+    auth: u64,
+    page: usize,
+    px: [u32; 2],
+}
+
+impl Key {
+    fn same_page(&self, other: &Key) -> bool {
+        (self.source, self.auth, self.page) == (other.source, other.auth, other.page)
+    }
+}
+
+struct Entry {
+    key: Key,
+    tex: Option<TextureHandle>,
+    error: Option<String>,
+    /// The frame the card last showed it.
+    seen: u64,
+    bytes: usize,
+}
+
+struct Job {
+    slot: Slot,
+    key: Key,
+    pool: RenderPool,
+    tag: u64,
+}
+
+/// A pool whose render is done, with its document still open: kept a moment for the next page of
+/// the same file, read the same way.
+struct Open {
+    source: usize,
+    auth: u64,
+    pool: RenderPool,
+    /// When its render finished (seconds).
+    since: f64,
+}
+
+/// A thumbnail a card needs this frame.
+struct Want {
+    slot: Slot,
+    key: Key,
+    bytes: Arc<Vec<u8>>,
+    password: Option<Arc<str>>,
+    scale: f32,
+    visible: bool,
+}
+
+/// The grid's thumbnails and the renders under way.
+#[derive(Default)]
+pub(crate) struct Thumbs {
+    entries: HashMap<Slot, Entry>,
+    jobs: Vec<Job>,
+    /// Pools done rendering, their documents still open (their threads count).
+    open: Vec<Open>,
+    /// Threads of pools let go of, until they exit.
+    retiring: Vec<Retiring>,
+    frame: u64,
+    next_tag: u64,
+    wants: Vec<Want>,
+    /// Render on the UI thread, as the web build does (tests).
+    #[cfg(test)]
+    inline: bool,
+}
+
+/// What a card can draw now.
+enum Look {
+    Ready(egui::TextureId),
+    Failed(String),
+    /// Not ready; an older thumbnail of the same page may stand in.
+    Pending(Option<egui::TextureId>),
+}
+
+impl Thumbs {
+    /// Forget every thumbnail (the tab closed). Renders under way are let go of: told to stop at
+    /// their next drawing operator, and counted until their threads exit.
+    pub(crate) fn clear(&mut self) {
+        self.entries.clear();
+        self.wants.clear();
+        for job in self.jobs.drain(..) {
+            self.retiring.push(job.pool.retire());
+        }
+        for open in self.open.drain(..) {
+            self.retiring.push(open.pool.retire());
+        }
+    }
+
+    /// Render threads that exist now (real threads, not pools): those of pools at work, of pools
+    /// keeping a document open, and of pools let go of.
+    fn threads(&mut self) -> usize {
+        self.retiring.retain_mut(|r| r.running() > 0);
+        let retiring: usize = self.retiring.iter_mut().map(Retiring::running).sum();
+        let working: usize = self.jobs.iter().map(|j| j.pool.threads()).sum();
+        let open: usize = self.open.iter().map(|o| o.pool.threads()).sum();
+        working.saturating_add(open).saturating_add(retiring)
+    }
+
+    fn look(&mut self, slot: Slot, key: Key) -> Look {
+        let frame = self.frame;
+        match self.entries.get_mut(&slot) {
+            Some(e) if e.key == key => {
+                e.seen = frame;
+                match (&e.tex, &e.error) {
+                    (Some(tex), _) => Look::Ready(tex.id()),
+                    (None, Some(err)) => Look::Failed(err.clone()),
+                    (None, None) => Look::Pending(None),
+                }
+            }
+            // Another size of the same page stands in until this one arrives. A page that failed
+            // isn't tried again at another size: it would fail (or hang) the same way, each zoom.
+            Some(e) if e.key.same_page(&key) => {
+                e.seen = frame;
+                match &e.error {
+                    Some(err) if e.tex.is_none() => Look::Failed(err.clone()),
+                    _ => Look::Pending(e.tex.as_ref().map(TextureHandle::id)),
+                }
+            }
+            _ => Look::Pending(None),
+        }
+    }
+
+    fn state(&self, slot: Slot) -> ThumbState {
+        if let Some(e) = self.entries.get(&slot) {
+            if let Some(tex) = &e.tex {
+                let [w, h] = tex.size();
+                return ThumbState::Ready {
+                    page: e.key.page,
+                    width: u32::try_from(w).unwrap_or(u32::MAX),
+                    height: u32::try_from(h).unwrap_or(u32::MAX),
+                };
+            }
+            if let Some(err) = &e.error {
+                return ThumbState::Failed(err.clone());
+            }
+        }
+        if self.jobs.iter().any(|j| j.slot == slot) { ThumbState::Pending } else { ThumbState::None }
+    }
+
+    /// Once per frame, whatever shows: drop what no longer matches the list, take finished
+    /// renders, start those the grid asked for and keep the textures within budget. `current`
+    /// says what a thumbnail must match now (looked up, so the cost follows the files and the
+    /// thumbnails kept, not the pages of an expanded file).
+    fn finish(&mut self, ctx: &egui::Context, current: &dyn Fn(Slot) -> Option<Key>) {
+        let now = ctx.input(|i| i.time);
+        // Reconcile with the list as it is now (undo, redo, unlock, a new range, removal): a
+        // thumbnail of another page, password or file is never shown again.
+        self.entries.retain(|slot, e| current(*slot).is_some_and(|k| k.same_page(&e.key)));
+        // Renders nobody wants any more are let go of now (on the web, before they would render).
+        let (keep, gone): (Vec<Job>, Vec<Job>) = self.jobs.drain(..).partition(|job| current(job.slot).is_some_and(|k| k.same_page(&job.key)));
+        self.jobs = keep;
+        self.retiring.extend(gone.into_iter().map(|job| job.pool.retire()));
+        // Documents kept open past their time are closed.
+        let (keep, gone): (Vec<Open>, Vec<Open>) = self.open.drain(..).partition(|o| now - o.since < KEEP_OPEN);
+        self.open = keep;
+        self.retiring.extend(gone.into_iter().map(|o| o.pool.retire()));
+
+        // Finished renders, a few per frame. A pool without threads (the web) renders inside
+        // `try_recv`: at most one of those per frame.
+        let gpu_side = ctx.input(|i| i.max_texture_side);
+        let max_side = gpu_side.min(2 * MAX_SIDE as usize);
+        let (mut taken, mut uploaded, mut inline_used) = (0usize, 0usize, false);
+        let mut i = 0;
+        while i < self.jobs.len() {
+            if taken >= UPLOADS_PER_FRAME || uploaded >= UPLOAD_BYTES_PER_FRAME {
+                break;
+            }
+            let Some(job) = self.jobs.get(i) else { break };
+            if job.pool.is_inline() {
+                if inline_used {
+                    i += 1;
+                    continue;
+                }
+                inline_used = true;
+            }
+            // Not done yet, or not this job's answer (cannot happen with one request per pool):
+            // keep waiting. A pool without threads answers on the call that renders, so there no
+            // answer is one that never comes: the thumbnail fails rather than hold up the rest.
+            let answer = job.pool.try_recv().filter(|out| out.request.tag == job.tag);
+            if answer.is_none() && !job.pool.is_inline() {
+                i += 1;
+                continue;
+            }
+            let job = self.jobs.swap_remove(i);
+            taken += 1;
+            // A pool that rendered (rather than failed or hung) can keep its document open.
+            let healthy = answer.as_ref().is_some_and(|out| out.error.is_none());
+            let failed = |e: String| Entry { key: job.key, tex: None, error: Some(e), seen: self.frame, bytes: 0 };
+            let entry = match answer {
+                None => failed("the page wasn't drawn".to_owned()),
+                Some(out) => match out.error {
+                    Some(e) => failed(e),
+                    None => match texture(
+                        ctx,
+                        job.slot,
+                        [out.width, out.height],
+                        out.rgba,
+                        if job.slot == PREVIEW { gpu_side.min(PREVIEW_SIDE as usize) } else { max_side },
+                    ) {
+                        Ok((tex, bytes)) => {
+                            uploaded = uploaded.saturating_add(bytes);
+                            Entry { key: job.key, tex: Some(tex), error: None, seen: self.frame, bytes }
+                        }
+                        Err(e) => failed(e),
+                    },
+                },
+            };
+            self.entries.insert(job.slot, entry);
+            // Its document stays open a moment for the file's next page (its thread, idle, still
+            // counts); otherwise its thread (idle, or finishing a render the watchdog gave up on)
+            // counts until it exits.
+            if healthy && job.pool.threads() <= 1 && self.open.len() < MAX_THREADS {
+                self.open.push(Open { source: job.key.source, auth: job.key.auth, pool: job.pool, since: now });
+            } else {
+                self.retiring.push(job.pool.retire());
+            }
+        }
+
+        // New renders: the cards in view first, in grid order; one per thumbnail at a time.
+        let mut wants = std::mem::take(&mut self.wants);
+        wants.sort_by_key(|w| (w.slot != PREVIEW, !w.visible));
+        // A pool without threads (the web) parses its document when it is made and keeps it until
+        // it renders, one per frame: while one waits, nothing else starts.
+        // (Nor in the frame that rendered one: one heavy step per frame on the UI thread.)
+        let mut threads = if inline_used || self.jobs.iter().any(|j| j.pool.is_inline()) { MAX_THREADS } else { self.threads() };
+        let mut waiting = false;
+        for w in wants {
+            // Wanted for the list as it is now (not changed by this frame's action); one render
+            // per thumbnail at a time; and a want made earlier this frame may have just been
+            // answered.
+            if current(w.slot).is_none_or(|k| !k.same_page(&w.key))
+                || self.jobs.iter().any(|j| j.slot == w.slot)
+                || self.entries.get(&w.slot).is_some_and(|e| e.key == w.key)
+            {
+                continue;
+            }
+            // The same file, read the same way, still open from a render just done: no new read of
+            // the file (and its thread is already counted). On the web, not while another waits.
+            let inline_waiting = self.jobs.iter().any(|j| j.pool.is_inline());
+            if let Some(k) =
+                self.open.iter().position(|o| o.source == w.key.source && o.auth == w.key.auth && !(o.pool.is_inline() && inline_waiting))
+            {
+                let pool = self.open.swap_remove(k).pool;
+                self.next_tag = self.next_tag.wrapping_add(1);
+                let tag = self.next_tag;
+                pool.set_queue(vec![RenderRequest { page: w.key.page, scale: w.scale, tag, ..Default::default() }]);
+                if pool.is_inline() {
+                    threads = MAX_THREADS;
+                }
+                self.jobs.push(Job { slot: w.slot, key: w.key, pool, tag });
+                continue;
+            }
+            if threads >= MAX_THREADS {
+                // A document kept open for another file gives its thread up: it exits, and this
+                // starts then.
+                if let Some(k) = self.open.iter().enumerate().min_by(|(_, a), (_, b)| a.since.total_cmp(&b.since)).map(|(k, _)| k) {
+                    let open = self.open.swap_remove(k);
+                    self.retiring.push(open.pool.retire());
+                }
+                waiting = true;
+                break;
+            }
+            let config = RenderConfig { password: w.password, ..Default::default() };
+            #[cfg(test)]
+            let pool = if self.inline { RenderPool::new_inline(w.bytes, config) } else { RenderPool::new(w.bytes, 1, config).without_replacements() };
+            #[cfg(not(test))]
+            let pool = RenderPool::new(w.bytes, 1, config).without_replacements();
+            self.next_tag = self.next_tag.wrapping_add(1);
+            let tag = self.next_tag;
+            // The request stays in the pool's queue (it is never replaced) until its answer.
+            pool.set_queue(vec![RenderRequest { page: w.key.page, scale: w.scale, tag, ..Default::default() }]);
+            threads = if pool.is_inline() { MAX_THREADS } else { threads.saturating_add(1) };
+            self.jobs.push(Job { slot: w.slot, key: w.key, pool, tag });
+        }
+
+        // Within budget: drop the thumbnails out of view longest unseen first.
+        // (The page shown large has its own: one texture, gone when it closes.)
+        let mut total: usize = self.entries.iter().filter(|(f, _)| **f != PREVIEW).map(|(_, e)| e.bytes).sum();
+        if total > TEXTURE_BUDGET {
+            let mut old: Vec<(u64, Slot, usize)> = self
+                .entries
+                .iter()
+                .filter(|(f, e)| **f != PREVIEW && e.seen != self.frame && e.bytes > 0)
+                .map(|(f, e)| (e.seen, *f, e.bytes))
+                .collect();
+            old.sort_unstable();
+            for (_, slot, bytes) in old {
+                if total <= TEXTURE_BUDGET {
+                    break;
+                }
+                self.entries.remove(&slot);
+                total = total.saturating_sub(bytes);
+            }
+        }
+
+        // The cards were drawn before these results arrived: draw them again. Keep polling while
+        // renders are under way, and while a thumbnail waits for a thread to exit (not when
+        // nothing waits: a thread exiting changes nothing on screen).
+        if taken > 0 || self.jobs.iter().any(|j| j.pool.is_inline()) {
+            ctx.request_repaint();
+        } else if !self.jobs.is_empty() {
+            ctx.request_repaint_after(std::time::Duration::from_millis(16));
+        } else if waiting {
+            ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        } else if !self.open.is_empty() {
+            // To close the documents kept open when their time is up.
+            ctx.request_repaint_after(std::time::Duration::from_secs_f64(KEEP_OPEN));
+        }
+        self.frame = self.frame.wrapping_add(1);
+    }
+}
+
+/// A rendered thumbnail as a texture, and its size in bytes. A raster that doesn't add up, or is
+/// larger than a thumbnail can be (or than the GPU accepts), is refused, never uploaded.
+fn texture(
+    ctx: &egui::Context,
+    slot: Slot,
+    size: [u32; 2],
+    pixels: pdfcraft_render::Pixels,
+    max_side: usize,
+) -> Result<(TextureHandle, usize), String> {
+    let [w, h] = size.map(|v| v as usize);
+    if w == 0 || h == 0 || w > max_side || h > max_side {
+        return Err(format!("the thumbnail came back {w}×{h} pixels"));
+    }
+    let bytes = w.checked_mul(h).and_then(|p| p.checked_mul(4)).ok_or("the thumbnail is too large")?;
+    if pixels.len() != bytes {
+        return Err("the thumbnail came back incomplete".to_owned());
+    }
+    let image = crate::canvas::texture_image([w, h], pixels);
+    Ok((ctx.load_texture(format!("combine-thumb-{}-{}", slot.0, slot.1), image, egui::TextureOptions::LINEAR), bytes))
+}
+
+/// `name` shortened in the middle to what `fits`, keeping its extension ("Pilot Boat Ad….pdf").
+pub(crate) fn fit_name(name: &str, fits: impl Fn(&str) -> bool) -> String {
+    if fits(name) {
+        return name.to_owned();
+    }
+    // A short extension after the last dot (a dot is one byte, so these are char boundaries).
+    let split = name.rfind('.').filter(|p| *p > 0 && name.len() - p <= 6);
+    let (stem, ext) = match split {
+        Some(p) => (name.get(..p).unwrap_or(name), name.get(p..).unwrap_or("")),
+        None => (name, ""),
+    };
+    let chars: Vec<char> = stem.chars().collect();
+    let with = |n: usize| format!("{}…{ext}", chars.iter().take(n).collect::<String>());
+    // The longest start of the stem that fits, found by halving.
+    let (mut lo, mut hi) = (0usize, chars.len());
+    while lo < hi {
+        let mid = lo + (hi - lo).div_ceil(2);
+        if fits(&with(mid)) { lo = mid } else { hi = mid - 1 }
+    }
+    with(lo)
+}
+
+/// The box a page is fitted in at `zoom` (clamped to [`ZOOM_RANGE`]).
+fn paper_box(zoom: f32) -> Vec2 {
+    let zoom = if zoom.is_finite() { zoom.clamp(*ZOOM_RANGE.start(), *ZOOM_RANGE.end()) } else { 1.0 };
+    PAPER * zoom
+}
+
+/// The size to draw a page of `w` × `h` points in `fit`; `None` for a size that isn't one.
+fn paper_size(w: f32, h: f32, fit: Vec2) -> Option<Vec2> {
+    if !(w.is_finite() && h.is_finite() && w > 0.0 && h > 0.0) {
+        return None;
+    }
+    let s = (fit.x / w).min(fit.y / h);
+    s.is_finite().then(|| vec2(w * s, h * s))
+}
+
+/// How many cards of `cell` fit across `width` (at least one).
+fn columns_in(width: f32, cell: Vec2) -> usize {
+    ((width - 16.0) / cell.x).floor().max(1.0) as usize
+}
+
+/// What one place in the grid shows: a file's card, or (the file expanded) one of the pages it
+/// adds.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct Cell {
+    /// The file, by its place in the list.
+    pub(crate) file: usize,
+    /// For a page: its place among the pages the file adds, the page (0-based, in the file) and
+    /// how many it adds.
+    pub(crate) page: Option<(usize, usize, usize)>,
+}
+
+/// The pages an expanded file shows: in its range's order, and sorted (to look one up), for the
+/// range and page count they were worked out for.
+#[derive(Clone, Debug)]
+pub(crate) struct PageList {
+    of: (String, usize),
+    pub(crate) order: Arc<[usize]>,
+    sorted: Arc<[usize]>,
+}
+
+/// The pages an expanded file shows, worked out again only when its range or page count
+/// changes; `None` when it can't be shown as its pages (locked, unreadable, a bad range, no page,
+/// or more than [`MAX_EXPAND`]).
+pub(crate) fn pages_shown(cache: &mut HashMap<u64, PageList>, f: &CombineFile) -> Option<PageList> {
+    if f.lock.is_some() || f.problem.is_some() {
+        return None;
+    }
+    let list = match cache.get(&f.id) {
+        Some(list) if list.of.0 == f.range && list.of.1 == f.pages => list.clone(),
+        _ => {
+            let order = f.pages_taken().ok()?;
+            let mut sorted = order.clone();
+            sorted.sort_unstable();
+            let list = PageList { of: (f.range.clone(), f.pages), order: Arc::from(order), sorted: Arc::from(sorted) };
+            cache.insert(f.id, list.clone());
+            list
+        }
+    };
+    // (One page shows as a page card too: a file split into parts may leave one page in a part.)
+    (!list.order.is_empty() && list.order.len() <= MAX_EXPAND).then_some(list)
+}
+
+/// The grid's places, in order: each file's card, or its pages when it is expanded.
+fn layout(app: &mut PdfCraftApp) -> Vec<Cell> {
+    let tab = &mut app.combine_tab;
+    let mut cells = Vec::with_capacity(app.combine_draft.len());
+    for (file, f) in app.combine_draft.iter().enumerate() {
+        match tab.expanded.contains(&f.id).then(|| pages_shown(&mut tab.page_lists, f)).flatten() {
+            Some(list) => {
+                let of = list.order.len();
+                cells.extend(list.order.iter().enumerate().map(|(nth, &page)| Cell { file, page: Some((nth, page, of)) }));
+            }
+            None => cells.push(Cell { file, page: None }),
+        }
+    }
+    cells
+}
+
+/// The file gap (0 = before the first file, n = after the last) a drop before place `at` means: a
+/// drop inside an expanded file's pages goes to the nearer end of that file.
+fn file_gap(cells: &[Cell], at: usize, files: usize) -> usize {
+    match cells.get(at) {
+        None => files,
+        Some(Cell { file, page: Some((nth, _, of)) }) if *nth > 0 => {
+            if nth.saturating_mul(2) < *of {
+                *file
+            } else {
+                file.saturating_add(1)
+            }
+        }
+        Some(c) => c.file,
+    }
+}
+
+/// The grid of files, in the card that holds the list. Returns what the user did.
+pub(crate) fn grid(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, checks: &[Result<usize, String>], selected: &[bool]) -> Option<RowAction> {
+    let ctx = ui.ctx().clone();
+    let ppp = ctx.pixels_per_point();
+    let mut action = None;
+    let revision = app.combine_tab.revision;
+    let drag = egui::DragAndDrop::payload::<GridDrag>(&ctx).map(|d| *d);
+    // The card dragged may scroll out of the rows drawn, so its release is watched here.
+    let released = drag.is_some() && ctx.input(|i| i.pointer.any_released());
+    let n = app.combine_draft.len();
+    // The same file twice is allowed (e.g. a cover sheet), but probably a mistake.
+    // (A file's parts are the one file, not copies: counted by file.)
+    let mut copies: HashMap<(&str, usize), std::collections::BTreeSet<u64>> = HashMap::new();
+    for f in &app.combine_draft {
+        copies.entry((f.name.as_str(), f.bytes.len())).or_default().insert(f.group);
+    }
+    let twice: Vec<bool> = app.combine_draft.iter().map(|f| copies.get(&(f.name.as_str(), f.bytes.len())).is_some_and(|g| g.len() > 1)).collect();
+    let places = layout(app);
+    // Each file's first place (for the keys and to scroll to it).
+    let mut first_place = vec![0usize; n];
+    for (at, c) in places.iter().enumerate().rev() {
+        if let Some(slot) = first_place.get_mut(c.file) {
+            *slot = at;
+        }
+    }
+    app.combine_tab.grid_places = places.iter().map(|c| c.file).collect();
+    // Pages counted over the list (an entry that can't be split counting as one, see
+    // `moved_pages`): where each place's pages start, for a page dropped before it.
+    let counts: Vec<usize> = app
+        .combine_draft
+        .iter_mut()
+        .map(|f| if f.lock.is_none() && f.problem.is_none() { f.selection().ok().filter(|k| *k > 0).unwrap_or(1) } else { 1 })
+        .collect();
+    let mut page_at = Vec::with_capacity(places.len());
+    let mut total_pages = 0usize;
+    for c in &places {
+        page_at.push(total_pages);
+        total_pages = total_pages.saturating_add(if c.page.is_some() { 1 } else { counts.get(c.file).copied().unwrap_or(1) });
+    }
+    let picked_pages = app.combine_tab.selected_pages.clone();
+    let reveal = app.combine_tab.reveal.take();
+    let fit = paper_box(app.combine_zoom);
+    let cell = fit + AROUND;
+    let mut cells: Vec<(usize, Rect)> = Vec::new();
+    let viewport = ui.available_rect_before_wrap();
+    let pointer = ctx.pointer_latest_pos();
+    let files = &mut app.combine_draft;
+    let thumbs = &mut app.combine_thumbs;
+    let columns = &mut app.combine_tab.grid_columns;
+
+    // Over the grid itself, not over a menu or dialog above it.
+    let over_grid = ui.rect_contains_pointer(viewport);
+    let mut width = viewport.width();
+    let mut focused_card = None;
+    let output = egui::ScrollArea::vertical().id_salt("combine-grid").auto_shrink([false, false]).show_viewport(ui, |ui, clip| {
+        // Dragging near the top or bottom edge scrolls.
+        if drag.is_some()
+            && let Some(p) = pointer
+            && viewport.contains(p)
+        {
+            let edge = 40.0;
+            let delta = if p.y < viewport.top() + edge {
+                12.0
+            } else if p.y > viewport.bottom() - edge {
+                -12.0
+            } else {
+                0.0
+            };
+            if delta != 0.0 {
+                ui.scroll_with_delta(vec2(0.0, delta));
+                ctx.request_repaint();
+            }
+        }
+        ui.add_space(TOP);
+        width = ui.available_width();
+        let cols = columns_in(width, cell);
+        *columns = cols;
+        let rows = places.len().div_ceil(cols);
+        let left = ((width - cols as f32 * cell.x) / 2.0).max(0.0);
+        let (area, _) = ui.allocate_exact_size(vec2(width, rows as f32 * cell.y), Sense::hover());
+        let cell_rect = |i: usize| {
+            let (row, col) = (i / cols, i % cols);
+            Rect::from_min_size(pos2(area.left() + left + col as f32 * cell.x, area.top() + row as f32 * cell.y), cell)
+        };
+        if let Some(i) = reveal.and_then(|id| files.iter().position(|f| f.id == id)) {
+            ui.scroll_to_rect(cell_rect(first_place.get(i).copied().unwrap_or(0)), None);
+        }
+        for row in crate::canvas::thumbnail_rows(clip.top() - TOP, clip.bottom() - TOP, cell.y, rows) {
+            let first = row.saturating_mul(cols);
+            let in_row = places.get(first..first.saturating_add(cols).min(places.len())).unwrap_or_default();
+            // An expanded file's pages on this row share a tinted band, so they read as one file.
+            let mut run = 0;
+            while run < in_row.len() {
+                let Some(start) = in_row.get(run).copied() else { break };
+                let mut end = run;
+                while in_row.get(end.saturating_add(1)).is_some_and(|c| c.file == start.file && c.page.is_some()) {
+                    end = end.saturating_add(1);
+                }
+                if start.page.is_some() {
+                    let band = cell_rect(first.saturating_add(run)).union(cell_rect(first.saturating_add(end))).shrink2(vec2(2.0, 4.0));
+                    ui.painter().rect_filled(band, CornerRadius::same(10), t.accent_soft.gamma_multiply(0.45));
+                }
+                run = end.saturating_add(1);
+            }
+            for (col, place) in in_row.iter().enumerate() {
+                let i = first.saturating_add(col);
+                let Some(f) = files.get_mut(place.file) else { break };
+                let c = cell_rect(i);
+                cells.push((i, c));
+                let card = Card {
+                    i: place.file,
+                    page: place.page,
+                    rect: c,
+                    check: checks.get(place.file).cloned().unwrap_or(Ok(f.pages)),
+                    selected: selected.get(place.file).copied().unwrap_or(false)
+                        || place.page.is_some_and(|(nth, ..)| picked_pages.contains(&(f.id, nth))),
+                    twice: twice.get(place.file).copied().unwrap_or(false),
+                    revision,
+                    ppp,
+                    fit,
+                };
+                let card_id = card.id(ui, f);
+                if let Some(a) = card.show(ui, t, f, thumbs) {
+                    action = Some(a);
+                }
+                if ui.memory(|m| m.has_focus(card_id)) {
+                    focused_card = Some((card_id, f.id, place.page.map_or(0, |p| p.0)));
+                }
+            }
+        }
+        // While a page card is dragged: the page gap it would go to (any place, between any two
+        // pages), drawn at the nearest card's edge, and how many pages go.
+        if let Some(d) = drag
+            && let Some(page) = d.page
+            && let Some(p) = pointer
+        {
+            let at = crate::canvas::drop_gap(&cells, p);
+            let nearest = cells.iter().min_by(|(_, a), (_, b)| a.distance_sq_to_pos(p).total_cmp(&b.distance_sq_to_pos(p)));
+            if let Some((_, r)) = nearest {
+                let x = if p.x < r.center().x { r.left() + 2.0 } else { r.right() - 2.0 };
+                ui.painter().line_segment([pos2(x, r.top() + 10.0), pos2(x, r.bottom() - 30.0)], Stroke::new(3.0, t.accent));
+            }
+            let moving = if picked_pages.contains(&page) { picked_pages.len() } else { 1 };
+            let label = if moving == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &moving.to_string())]) };
+            ui.painter().text(p + vec2(14.0, 14.0), Align2::LEFT_TOP, label, theme::medium(12.0), t.accent_text);
+            if released
+                && viewport.contains(p)
+                && let Some(at) = at
+            {
+                let gap = page_at.get(at).copied().unwrap_or(total_pages);
+                action = Some(RowAction::MovePages { page, revision: d.revision, gap });
+            }
+        } else if let Some(d) = drag
+            && let Some(p) = pointer
+        {
+            // A file's card: the file gap it would go to, drawn as a bar, and how many files go.
+            let gap = crate::canvas::drop_gap(&cells, p).map(|at| file_gap(&places, at, n));
+            // Drawn at the end of the file before the gap or the start of the one after (an
+            // expanded file's pages are never split), whichever is nearer the pointer.
+            if let Some(gap) = gap {
+                let before = gap
+                    .checked_sub(1)
+                    .and_then(|f| first_place.get(f.saturating_add(1)).map(|next| next.saturating_sub(1)).or(places.len().checked_sub(1)));
+                let after = first_place.get(gap).copied();
+                let ends = [before.map(|at| cell_rect(at).right() - 2.0).zip(before), after.map(|at| cell_rect(at).left() + 2.0).zip(after)];
+                let nearest = ends.into_iter().flatten().min_by(|(xa, a), (xb, b)| {
+                    let da = pos2(*xa, cell_rect(*a).center().y).distance_sq(p);
+                    let db = pos2(*xb, cell_rect(*b).center().y).distance_sq(p);
+                    da.total_cmp(&db)
+                });
+                if let Some((x, at)) = nearest {
+                    let r = cell_rect(at);
+                    ui.painter().line_segment([pos2(x, r.top() + 10.0), pos2(x, r.bottom() - 30.0)], Stroke::new(3.0, t.accent));
+                }
+            }
+            let moving = files
+                .iter()
+                .position(|f| f.id == d.file)
+                .map_or(1, |i| if selected.get(i).copied().unwrap_or(false) { selected.iter().filter(|s| **s).count() } else { 1 });
+            let label = if moving == 1 { tl!("1 file").to_string() } else { crate::i18n::fmt(tl!("{n} files"), &[("n", &moving.to_string())]) };
+            ui.painter().text(p + vec2(14.0, 14.0), Align2::LEFT_TOP, label, theme::medium(12.0), t.accent_text);
+            // Dropped in the grid: there. Anywhere else: nothing moves.
+            if released
+                && viewport.contains(p)
+                && let Some(gap) = gap
+            {
+                action = Some(RowAction::DropAt { file: d.file, revision: d.revision, gap });
+            }
+        }
+    });
+
+    app.combine_tab.card_focus = focused_card.map(|(id, ..)| id);
+    app.combine_tab.card_focus_at = focused_card.map(|(_, file, nth)| (file, nth));
+
+    // Pinch, or Ctrl/⌘ with the wheel, over the grid zooms it.
+    let pinch = ctx.input(|i| i.zoom_delta());
+    if (pinch - 1.0).abs() > 0.001 && over_grid {
+        app.combine_tab.zoom_request = Some(app.combine_zoom * pinch);
+    }
+    // A zoom asked for this frame (toolbar, keys, pinch) applies now the grid has been laid out:
+    // the card under the pointer (or else the first in view) keeps its place on screen. Not while
+    // a card is dragged: the grid under it would change.
+    if let Some(zoom) = app.combine_tab.zoom_request.take()
+        && drag.is_none()
+    {
+        let before = app.combine_zoom;
+        app.set_combine_zoom(zoom);
+        if app.combine_zoom != before {
+            // The same card all through one gesture (a slider drag, a turn of the wheel): the
+            // first in view changes as the cards reflow, and following it would drift. A card is
+            // kept by its file and its place among the file's pages.
+            let now = ctx.input(|i| i.time);
+            let gesture = app.combine_tab.zoom_anchor.filter(|a| now - a.3 < 0.5).and_then(|(id, nth, above, _)| {
+                let file = app.combine_draft.iter().position(|f| f.id == id)?;
+                Some((first_place.get(file)?.saturating_add(nth).min(places.len().saturating_sub(1)), above))
+            });
+            // Cards just outside the view are drawn too (under the toolbar, say): the pointer
+            // counts only over the grid.
+            let under = pointer.filter(|_| over_grid).and_then(|p| cells.iter().find(|(_, r)| r.contains(p)));
+            let anchor = gesture
+                .or_else(|| under.or_else(|| cells.iter().find(|(_, r)| r.bottom() > viewport.top())).map(|(i, r)| (*i, r.top() - viewport.top())));
+            app.combine_tab.zoom_anchor = anchor.and_then(|(i, above)| {
+                let place = places.get(i)?;
+                Some((app.combine_draft.get(place.file)?.id, place.page.map_or(0, |p| p.0), above, now))
+            });
+            if let Some((i, above)) = anchor {
+                // Where it will be: its row at the new size, as far below the top as it is now;
+                // within what can be scrolled to, so zooming out at the bottom shows no gap.
+                let cell = paper_box(app.combine_zoom) + AROUND;
+                let cols = columns_in(width, cell);
+                let content = TOP + places.len().div_ceil(cols) as f32 * cell.y;
+                let y = (TOP + (i / cols) as f32 * cell.y - above).min(content - viewport.height()).max(0.0);
+                // Set as the scroll position itself, before the next frame draws anything: no
+                // jump, and no scroll still animating (to a card revealed by the keys, say) can
+                // carry it elsewhere.
+                let mut state = egui::scroll_area::State::default();
+                state.offset = vec2(0.0, y);
+                state.store(&ctx, output.id);
+            }
+            ctx.request_repaint();
+        }
+    }
+
+    action
+}
+
+/// One card's place and what it shows.
+struct Card {
+    /// The file, by its place in the list.
+    i: usize,
+    /// A page card (the file expanded): its place among the pages the file adds, the page and how
+    /// many it adds. `None` for the file's own card.
+    page: Option<(usize, usize, usize)>,
+    rect: Rect,
+    check: Result<usize, String>,
+    selected: bool,
+    twice: bool,
+    revision: u64,
+    ppp: f32,
+    /// The box the page is fitted in (the zoom).
+    fit: Vec2,
+}
+
+impl Card {
+    fn id(&self, ui: &egui::Ui, f: &CombineFile) -> egui::Id {
+        match self.page {
+            None => ui.id().with(("combine-card", f.id)),
+            Some((nth, ..)) => ui.id().with(("combine-page", f.id, nth)),
+        }
+    }
+
+    fn show(&self, ui: &mut egui::Ui, t: &Tokens, f: &mut CombineFile, thumbs: &mut Thumbs) -> Option<RowAction> {
+        let mut action = None;
+        let c = self.rect;
+        let id = self.id(ui, f);
+        let resp = ui.interact(c.shrink(4.0), id, Sense::click_and_drag());
+        let name = f.name.clone();
+        // A page card: "Page 3", and the file it belongs to.
+        let page_label = self.page.map(|(_, p, _)| crate::i18n::fmt(tl!("Page {label}"), &[("label", &p.saturating_add(1).to_string())]));
+        let label = match &page_label {
+            Some(page) => format!("{page} · {name}"),
+            None => name.clone(),
+        };
+        // As the organize grid's pages: a check box that is on when selected; and, for screen
+        // readers, selected as items in a list are.
+        resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, self.selected, &label));
+        let pages = match self.page {
+            // For screen readers: which page of how many.
+            Some((_, p, _)) => crate::i18n::fmt(tl!("Page {p} of {n}"), &[("p", &p.saturating_add(1).to_string()), ("n", &f.pages.to_string())]),
+            None if f.pages == 1 => tl!("1 page").to_string(),
+            None => crate::i18n::fmt(tl!("{n} pages"), &[("n", &f.pages.to_string())]),
+        };
+        let painter = ui.painter_at(c);
+
+        // Selected and hovered cards.
+        if self.selected || resp.hovered() {
+            painter.rect_filled(c.shrink(6.0), CornerRadius::same(8), if self.selected { t.accent_soft } else { t.hover });
+        }
+        if self.selected {
+            painter.rect_stroke(c.shrink(6.0), CornerRadius::same(8), Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
+        }
+
+        // The page, fitted in the paper box (top-aligned, room above for the stack).
+        let page = match self.page {
+            Some((_, p, _)) => Ok(p),
+            None => f.first_page(),
+        };
+        // The page's own size, when it is known and is one.
+        let known = page.as_ref().ok().and_then(|p| f.sizes.get(*p).copied()).filter(|(w, h)| paper_size(*w, *h, self.fit).is_some());
+        let size_pt = known.unwrap_or(FALLBACK_PAGE);
+        let size = paper_size(size_pt.0, size_pt.1, self.fit).unwrap_or(self.fit);
+        let top = c.top() + ABOVE;
+        let paper = Rect::from_min_size(pos2(c.center().x - size.x / 2.0 - 3.0, top + (self.fit.y - size.y)), size);
+        // A file's card that adds more than one page: sheets behind it.
+        let takes = self.check.as_ref().map_or(f.pages, |k| *k);
+        if self.page.is_none() && takes > 1 {
+            for d in [6.0, 3.0] {
+                let sheet = paper.translate(vec2(d, -d));
+                painter.rect_filled(sheet, CornerRadius::ZERO, Color32::WHITE);
+                painter.rect_stroke(sheet, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
+            }
+        }
+        painter.rect_filled(paper.translate(vec2(0.0, 1.5)), CornerRadius::same(1), t.page_shadow);
+        painter.rect_filled(paper, CornerRadius::ZERO, Color32::WHITE);
+
+        // What goes on the paper: the thumbnail, or why there isn't one.
+        let mut why: Option<(&str, Color32, String)> = None;
+        if let Some(lock) = f.lock {
+            let text = match lock {
+                Lock::Open => tl!("Password-protected"),
+                Lock::Permissions => tl!("Its security settings don't allow copying pages"),
+            };
+            why = Some(("lock", ON_PAPER, text.to_owned()));
+        } else if let Some(p) = &f.problem {
+            why = Some(("circle-x", ERROR, p.clone()));
+        } else {
+            match page {
+                Err(e) => why = Some(("circle-x", ERROR, e)),
+                // The pages couldn't be counted, or the page's size is unknown (some passwords
+                // open a file for combining but not for reading it here): nothing is drawn (the
+                // engine decides at Combine), and the card says so rather than look blank.
+                Ok(p) if p >= f.pages || known.is_none() => why = Some(("eye-off", ON_PAPER, tl!("No preview").to_owned())),
+                Ok(p) => {
+                    // Pixels per point: the size the paper is drawn at, on both sides, and never a
+                    // side longer than a thumbnail's (a long, thin page fits by its long side).
+                    let (w, h) = size_pt;
+                    let scale = (size.x * self.ppp / w).min(size.y * self.ppp / h).min(MAX_SIDE / w.max(h));
+                    let px = [w * scale, h * scale].map(|v| (v.max(1.0).ceil() as u32).div_ceil(SIZE_STEP).saturating_mul(SIZE_STEP));
+                    let key = Key { source: Arc::as_ptr(&f.bytes) as usize, auth: f.auth, page: p, px };
+                    let look = thumbs.look((f.group, p), key);
+                    let mut want = false;
+                    match look {
+                        Look::Ready(tex) => {
+                            painter.image(tex, paper, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+                        }
+                        Look::Failed(e) => why = Some(("triangle-alert", WARNING, crate::i18n::fmt(tl!("Preview unavailable: {e}"), &[("e", &e)]))),
+                        Look::Pending(stand_in) => {
+                            if let Some(tex) = stand_in {
+                                painter.image(tex, paper, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+                            }
+                            want = true;
+                        }
+                    }
+                    if want && scale.is_finite() && scale > 0.0 {
+                        thumbs.wants.push(Want {
+                            slot: (f.group, p),
+                            key,
+                            bytes: f.bytes.clone(),
+                            password: f.password().map(Arc::from),
+                            scale,
+                            visible: ui.is_rect_visible(c),
+                        });
+                    }
+                }
+            }
+        }
+        if let Some((icon, colour, _)) = &why {
+            icons::paint(ui, Rect::from_center_size(paper.center(), Vec2::splat(28.0)), icon, 28.0, *colour);
+        }
+        // For screen readers: the pages, and why no page is shown (otherwise only in the tooltip).
+        let description = match &why {
+            Some((_, _, reason)) => format!("{pages}. {reason}"),
+            None => pages.clone(),
+        };
+        ui.ctx().accesskit_node_builder(id, |node| {
+            node.set_selected(self.selected);
+            node.set_description(description);
+        });
+        painter.rect_stroke(paper, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
+
+        // A warning that doesn't stop it being combined: a badge on the file's card.
+        let warned = self.page.is_none() && (!f.notes.is_empty() || self.twice);
+        if warned && why.as_ref().is_none_or(|(icon, ..)| *icon == "eye-off") {
+            let r = Rect::from_center_size(paper.right_top() + vec2(-2.0, 2.0), Vec2::splat(18.0));
+            painter.circle_filled(r.center(), 10.0, t.card);
+            icons::paint(ui, r, "triangle-alert", 15.0, WARNING);
+        }
+
+        // The name, shortened in the middle to fit, and the pages taken when a range is set; on a
+        // page card, the page first and the file's name below it, smaller.
+        let name_y = top + self.fit.y + 16.0;
+        let max_w = c.width() - 20.0;
+        let (font, colour, y) = match &page_label {
+            Some(page) => {
+                painter.text(pos2(c.center().x, name_y), Align2::CENTER_CENTER, page, theme::semibold(12.5), t.text);
+                (theme::regular(11.5), t.text_muted, name_y + 17.0)
+            }
+            None => (theme::medium(12.5), t.text, name_y),
+        };
+        let fits = |s: &str| painter.layout_no_wrap(crate::bidi::visual(s).into_owned(), font.clone(), colour).size().x <= max_w;
+        let shown = crate::bidi::visual(&fit_name(&f.name, fits)).into_owned();
+        painter.text(pos2(c.center().x, y), Align2::CENTER_CENTER, shown, font, colour);
+        let note = if self.page.is_none() && !f.range.trim().is_empty() {
+            match &self.check {
+                Ok(k) => Some((crate::i18n::fmt(tl!("Pages: {k} of {n}"), &[("k", &k.to_string()), ("n", &f.pages.to_string())]), t.text_muted)),
+                Err(_) => Some((tl!("Check the pages").to_owned(), ERROR)),
+            }
+        } else {
+            None
+        };
+        if let Some((text, colour)) = note {
+            painter.text(pos2(c.center().x, name_y + 17.0), Align2::CENTER_CENTER, text, theme::regular(11.5), colour);
+        }
+
+        // On hover, the card's own actions along the top of the page (not while a card is
+        // dragged): remove this file only, and show it large when there is a page to show. Drawn
+        // over the card, so a click on one doesn't select or move it.
+        let previewable = why.is_none();
+        // A file that adds more pages than one can be spread out into them.
+        let expandable = self.page.is_none() && takes > 1 && takes <= MAX_EXPAND && f.lock.is_none() && f.problem.is_none() && self.check.is_ok();
+        // Shown large: the file from its first page, or a page card's page.
+        let preview = match self.page {
+            Some((nth, ..)) => RowAction::PreviewAt(f.id, nth),
+            None => RowAction::Preview(f.id),
+        };
+        // The card's own actions, in this order: expand (or, on a page, collapse), remove (the file,
+        // or the page), show large.
+        let mut buttons: Vec<(&str, String, RowAction)> = Vec::new();
+        if expandable {
+            buttons.push(("maximize-2", tl!("Expand").to_owned(), RowAction::Expand(f.id, true)));
+        }
+        if let Some((nth, ..)) = self.page {
+            buttons.push(("minimize-2", tl!("Collapse").to_owned(), RowAction::Expand(f.id, false)));
+            buttons.push(("trash-2", tl!("Remove page").to_owned(), RowAction::RemovePages(Some((f.id, nth)))));
+        } else {
+            buttons.push(("trash-2", crate::i18n::fmt(tl!("Remove {name}"), &[("name", &f.name)]), RowAction::RemoveFile(f.id)));
+        }
+        if previewable {
+            buttons.push(("search", tl!("Preview").to_owned(), preview));
+        }
+        // Nothing of the card shows over a dialog (the preview, the password box).
+        let covered = ui.ctx().memory(|m| m.top_modal_layer().is_some());
+        let mut over_bar = false;
+        if !covered && ui.rect_contains_pointer(c.shrink(4.0)) && !egui::DragAndDrop::has_any_payload(ui.ctx()) {
+            let count = buttons.len() as f32;
+            // Mostly above the page (a quarter over its top edge), so it hides little of it, and
+            // never the name below.
+            let y = paper.top() + BAR_H / 4.0 - BAR_H / 2.0;
+            let bar = Rect::from_center_size(pos2(paper.center().x, y), vec2(count * 26.0 + (count - 1.0).max(0.0) * 2.0 + 8.0, BAR_H));
+            over_bar = ui.rect_contains_pointer(bar);
+            painter.rect(bar, CornerRadius::same(8), t.card, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
+            let mut bar_ui = ui.new_child(egui::UiBuilder::new().max_rect(bar.shrink(4.0)).layout(egui::Layout::left_to_right(egui::Align::Center)));
+            bar_ui.spacing_mut().item_spacing.x = 2.0;
+            for (icon, label, act) in &buttons {
+                if icons::button(&mut bar_ui, icon, 26.0, false, label).clicked() {
+                    action = Some(act.clone());
+                }
+            }
+        }
+
+        // The full name and everything known about the file, on hover (on a page card, which page).
+        let mut tip = match &page_label {
+            Some(page) => format!("{}\n{page}", f.name),
+            None => format!("{}\n{pages} · {}", f.name, crate::panels::human_size(f.bytes.len())),
+        };
+        for line in why.iter().map(|(_, _, s)| s).chain(&f.notes) {
+            tip.push('\n');
+            tip.push_str(line);
+        }
+        if self.twice {
+            tip.push('\n');
+            tip.push_str(tl!("Added more than once"));
+        }
+        // Page ranges are typed in the list.
+        if self.page.is_none() && self.check.is_err() {
+            tip.push('\n');
+            tip.push_str(tl!("Switch to List view to change the pages it takes."));
+        }
+        // (Over the bar, its buttons say what they do instead.)
+        let resp = if covered || over_bar { resp } else { resp.on_hover_text(tip) };
+
+        // The same actions on a right click, show large first (and Unlock… for a locked file).
+        let at = resp.rect.left_bottom();
+        let locked = f.lock.is_some();
+        resp.context_menu(|ui| {
+            let item = |ui: &mut egui::Ui, icon: &str, label: &str| {
+                ui.add(egui::Button::image_and_text(icons::image(icon, 15.0, ui.visuals().text_color()), label)).clicked()
+            };
+            for (icon, label, act) in buttons.iter().rev() {
+                // (Remove names its file, as the trash button does.)
+                if item(ui, icon, label) {
+                    action = Some(act.clone());
+                    ui.close();
+                }
+            }
+            if locked && item(ui, "lock-open", tl!("Unlock…")) {
+                action = Some(RowAction::Unlock(Some(self.i), at));
+                ui.close();
+            }
+        });
+        if resp.drag_started() {
+            egui::DragAndDrop::set_payload(ui.ctx(), GridDrag { file: f.id, revision: self.revision, page: self.page.map(|(nth, ..)| (f.id, nth)) });
+        }
+        if resp.clicked() {
+            let mods = resp.ctx.input(|i| i.modifiers);
+            action = Some(match self.page {
+                Some((nth, ..)) => RowAction::ClickPage(f.id, nth, mods),
+                None => RowAction::Click(self.i, mods),
+            });
+        }
+        action
+    }
+}
+
+/// The file a card's magnifier opened, shown large over the page: one of the pages it adds at a
+/// time, flipped with the buttons or the Left and Right keys; Esc, the close button or a click
+/// outside closes it. It closes by itself when the file leaves the list or has nothing to show.
+pub(crate) fn preview(app: &mut PdfCraftApp, ctx: &egui::Context, t: &Tokens) {
+    // The command palette goes over everything: the preview waits under it (drawn again after).
+    if app.palette_open {
+        return;
+    }
+    let Some(p) = app.combine_tab.preview.as_mut() else { return };
+    let Some(f) = app.combine_draft.iter().find(|f| f.id == p.file).filter(|f| f.lock.is_none() && f.problem.is_none()) else {
+        app.combine_tab.preview = None;
+        return;
+    };
+    // The pages it adds, worked out again only when its range changes.
+    let pages = match &p.pages {
+        Some(((range, count), pages)) if *range == f.range && *count == f.pages => pages.clone(),
+        _ => match f.pages_taken() {
+            Ok(pages) => {
+                let pages: Arc<[usize]> = Arc::from(pages);
+                p.pages = Some(((f.range.clone(), f.pages), pages.clone()));
+                pages
+            }
+            Err(_) => {
+                app.combine_tab.preview = None;
+                return;
+            }
+        },
+    };
+    let n = pages.len();
+    p.at = p.at.min(n.saturating_sub(1));
+    let Some(&page) = pages.get(p.at) else {
+        app.combine_tab.preview = None;
+        return;
+    };
+    p.page = Some(page);
+    let at = p.at;
+    // Flipped with the keys (the grid's arrows wait while this shows), unless a text field has
+    // them.
+    let typing = ctx.text_edit_focused();
+    let (back, on) = ctx.input_mut(|i| {
+        for k in [egui::Key::Plus, egui::Key::Equals, egui::Key::Minus, egui::Key::Num0] {
+            i.consume_shortcut(&egui::KeyboardShortcut::new(egui::Modifiers::COMMAND, k));
+        }
+        if typing {
+            return (false, false);
+        }
+        (
+            i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowLeft) | i.consume_key(egui::Modifiers::NONE, egui::Key::PageUp),
+            i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowRight) | i.consume_key(egui::Modifiers::NONE, egui::Key::PageDown),
+        )
+    });
+    let (mut step, mut close) = (i64::from(on) - i64::from(back), false);
+    let screen = ctx.content_rect();
+    let width = (screen.width() * 0.86).max(320.0);
+    let body_h = (screen.height() * 0.86 - 110.0).max(200.0);
+    let ppp = ctx.pixels_per_point();
+    // No larger than the GPU takes, or the render would be refused.
+    let longest = ctx.input(|i| i.max_texture_side as f32).min(PREVIEW_SIDE);
+    let thumbs = &mut app.combine_thumbs;
+    let modal = egui::Modal::new(egui::Id::new("combine-preview")).show(ctx, |ui| {
+        ui.set_width(width);
+        ui.horizontal(|ui| {
+            ui.label(egui::RichText::new(crate::bidi::visual(&f.name)).font(theme::semibold(15.0)));
+            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                if icons::button(ui, "x", 30.0, false, tl!("Close")).clicked() {
+                    close = true;
+                }
+                let of = crate::i18n::fmt(tl!("Page {p} of {n}"), &[("p", &(at + 1).to_string()), ("n", &n.to_string())]);
+                ui.label(egui::RichText::new(of).color(t.text_muted));
+            });
+        });
+        ui.add_space(8.0);
+        // The page, as large as fits.
+        let (area, _) = ui.allocate_exact_size(vec2(width, body_h), Sense::hover());
+        let known = f.sizes.get(page).copied().filter(|(w, h)| paper_size(*w, *h, area.size()).is_some());
+        let (w, h) = known.unwrap_or(FALLBACK_PAGE);
+        let size = paper_size(w, h, area.size() - vec2(8.0, 8.0)).unwrap_or(area.size());
+        let paper = Rect::from_center_size(area.center(), size);
+        let painter = ui.painter_at(area);
+        painter.rect_filled(paper.translate(vec2(0.0, 2.0)), CornerRadius::same(1), t.page_shadow);
+        painter.rect_filled(paper, CornerRadius::ZERO, Color32::WHITE);
+        let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+        if known.is_some() {
+            let scale = (size.x * ppp / w).min(size.y * ppp / h).min(longest / w.max(h));
+            let px = [w * scale, h * scale].map(|v| (v.max(1.0).ceil() as u32).div_ceil(SIZE_STEP).saturating_mul(SIZE_STEP));
+            let key = Key { source: Arc::as_ptr(&f.bytes) as usize, auth: f.auth, page, px };
+            match thumbs.look(PREVIEW, key) {
+                Look::Ready(tex) => {
+                    painter.image(tex, paper, uv, Color32::WHITE);
+                }
+                Look::Failed(e) => {
+                    let text = crate::i18n::fmt(tl!("Preview unavailable: {e}"), &[("e", &e)]);
+                    painter.text(paper.center(), Align2::CENTER_CENTER, text, theme::regular(13.0), ON_PAPER);
+                }
+                Look::Pending(stand_in) => {
+                    // A smaller render of this page stands in: the last size shown, or its card's.
+                    let card = thumbs.entries.get(&(f.group, page)).filter(|e| e.key.auth == f.auth).and_then(|e| e.tex.as_ref());
+                    if let Some(tex) = stand_in.or(card.map(TextureHandle::id)) {
+                        painter.image(tex, paper, uv, Color32::WHITE);
+                    }
+                    if scale.is_finite() && scale > 0.0 {
+                        thumbs.wants.push(Want {
+                            slot: PREVIEW,
+                            key,
+                            bytes: f.bytes.clone(),
+                            password: f.password().map(Arc::from),
+                            scale,
+                            visible: true,
+                        });
+                    }
+                }
+            }
+        } else {
+            icons::paint(ui, Rect::from_center_size(paper.center(), Vec2::splat(36.0)), "eye-off", 36.0, ON_PAPER);
+        }
+        painter.rect_stroke(paper, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
+        ui.add_space(8.0);
+        // Previous and next, centred below.
+        ui.horizontal(|ui| {
+            ui.add_space((width - 2.0 * 30.0 - 6.0) / 2.0);
+            if ui.add_enabled_ui(at > 0, |ui| icons::button(ui, "chevron-left", 30.0, false, tl!("Previous page"))).inner.clicked() {
+                step = -1;
+            }
+            if ui.add_enabled_ui(at + 1 < n, |ui| icons::button(ui, "chevron-right", 30.0, false, tl!("Next page"))).inner.clicked() {
+                step = 1;
+            }
+        });
+    });
+    if close || modal.should_close() {
+        app.combine_tab.preview = None;
+    } else if let Some(p) = app.combine_tab.preview.as_mut() {
+        p.at = match step {
+            s if s < 0 => p.at.saturating_sub(1),
+            s if s > 0 => (p.at + 1).min(n.saturating_sub(1)),
+            _ => p.at,
+        };
+    }
+}
+
+impl PdfCraftApp {
+    /// The file shown large, the page on screen (0-based, in the file) and its render, while it
+    /// shows (tests and the control channel).
+    pub fn combine_preview(&self) -> Option<(String, usize, ThumbState)> {
+        let p = self.combine_tab.preview.as_ref()?;
+        let f = self.combine_draft.iter().find(|f| f.id == p.file)?;
+        Some((f.name.clone(), p.page?, self.combine_thumbs.state(PREVIEW)))
+    }
+
+    /// Size the Combine grid's cards (1.0 = the usual); out-of-range values are clamped and
+    /// nonsense is ignored.
+    pub fn set_combine_zoom(&mut self, zoom: f32) {
+        if zoom.is_finite() {
+            self.combine_zoom = zoom.clamp(*ZOOM_RANGE.start(), *ZOOM_RANGE.end());
+        }
+    }
+
+    /// Every frame, whatever shows: take finished thumbnails, start those the grid asked for (only
+    /// while it is drawn), and let go of what no longer matches the list, so renders under way
+    /// finish and release their threads in the list view, on Home or in a document tab too.
+    pub(crate) fn combine_thumbs_frame(&mut self, ctx: &egui::Context) {
+        // What each thumbnail must match now (cards out of view included): each file's first page,
+        // and an expanded file's pages (looked up in its sorted list, never listed one by one).
+        // (By file: the parts a file is split into share its thumbnails.)
+        struct Shown {
+            source: usize,
+            auth: u64,
+            pages: Vec<usize>,
+        }
+        let mut shown: HashMap<u64, Shown> = HashMap::with_capacity(self.combine_draft.len());
+        let tab = &mut self.combine_tab;
+        for f in self.combine_draft.iter_mut() {
+            let Ok(first) = f.first_page() else { continue };
+            let sorted = tab.expanded.contains(&f.id).then(|| pages_shown(&mut tab.page_lists, f)).flatten().map(|l| l.sorted);
+            let entry = shown.entry(f.group).or_insert_with(|| Shown { source: Arc::as_ptr(&f.bytes) as usize, auth: f.auth, pages: Vec::new() });
+            entry.pages.push(first);
+            entry.pages.extend(sorted.iter().flat_map(|s| s.iter().copied()));
+        }
+        for s in shown.values_mut() {
+            s.pages.sort_unstable();
+            s.pages.dedup();
+        }
+        // The page shown large, while it shows: leaving the tab closes it.
+        if !self.combine_showing() {
+            self.combine_tab.preview = None;
+        }
+        let preview = self.combine_tab.preview.as_ref().and_then(|p| {
+            let page = p.page?;
+            let f = self.combine_draft.iter().find(|f| f.id == p.file)?;
+            Some(Key { source: Arc::as_ptr(&f.bytes) as usize, auth: f.auth, page, px: [0, 0] })
+        });
+        let current = |slot: Slot| -> Option<Key> {
+            if slot == PREVIEW {
+                return preview;
+            }
+            let (id, page) = slot;
+            let s = shown.get(&id)?;
+            s.pages.binary_search(&page).is_ok().then_some(Key { source: s.source, auth: s.auth, page, px: [0, 0] })
+        };
+        self.combine_thumbs.finish(ctx, &current);
+    }
+
+    /// The single pages selected: each one's entry (by place in the list) and page (0-based, in
+    /// the file), in list order (tests and the control channel).
+    pub fn combine_selected_pages(&self) -> Vec<(usize, usize)> {
+        let mut out = Vec::new();
+        for (i, f) in self.combine_draft.iter().enumerate() {
+            let pages = f.pages_taken().unwrap_or_default();
+            for (nth, page) in pages.iter().enumerate() {
+                if self.combine_tab.selected_pages.contains(&(f.id, nth)) {
+                    out.push((i, *page));
+                }
+            }
+        }
+        out
+    }
+
+    /// Each entry's name and the pages it takes (0-based, in order): a file split into parts is
+    /// several entries (tests and the control channel).
+    pub fn combine_parts_shown(&self) -> Vec<(String, Vec<usize>)> {
+        self.combine_draft.iter().map(|f| (f.name.clone(), f.pages_taken().unwrap_or_default())).collect()
+    }
+
+    /// The files shown as their pages in the grid, by place in the list (tests and the control
+    /// channel).
+    pub fn combine_expanded(&self) -> Vec<usize> {
+        self.combine_draft.iter().enumerate().filter(|(_, f)| self.combine_tab.expanded.contains(&f.id)).map(|(i, _)| i).collect()
+    }
+
+    /// An expanded file's page cards: each page (0-based, in the file) and its thumbnail; empty
+    /// for a file shown as its card (tests and the control channel).
+    pub fn combine_page_thumbnails(&self, file: usize) -> Vec<(usize, ThumbState)> {
+        let Some(f) = self.combine_draft.get(file).filter(|f| self.combine_tab.expanded.contains(&f.id)) else { return Vec::new() };
+        let pages = f.pages_taken().unwrap_or_default();
+        pages.into_iter().map(|p| (p, self.combine_thumbs.state((f.group, p)))).collect()
+    }
+
+    /// Each listed file's grid thumbnail, in list order (tests and the control channel).
+    pub fn combine_thumbnails(&self) -> Vec<ThumbState> {
+        self.combine_draft.iter().map(|f| f.first_taken().map_or(ThumbState::None, |p| self.combine_thumbs.state((f.group, p)))).collect()
+    }
+
+    /// Thumbnail renders under way (tests: never more than a few).
+    pub fn combine_thumbnails_rendering(&self) -> usize {
+        self.combine_thumbs.jobs.len()
+    }
+
+    /// Render threads for thumbnails that exist now (counted from the threads themselves),
+    /// including those of finished or abandoned renders that haven't exited yet (tests: never
+    /// more than three).
+    pub fn combine_thumbnail_threads(&mut self) -> usize {
+        self.combine_thumbs.threads()
+    }
+
+    /// Whether no thumbnail render is under way and every render thread has exited (tests).
+    pub fn combine_thumbnail_threads_exited(&self) -> bool {
+        self.combine_thumbs.jobs.is_empty() && self.combine_thumbs.retiring.iter().all(Retiring::exited)
+    }
+
+    /// Thumbnail textures held (tests: none once the tab is closed).
+    pub fn combine_thumbnail_textures(&self) -> usize {
+        self.combine_thumbs.entries.values().filter(|e| e.tex.is_some()).count()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeSet;
+
+    use super::*;
+    use crate::combine_ui::{moved_order, step_to};
+
+    #[test]
+    fn long_names_keep_their_extension_and_whole_characters() {
+        let fits = |n: usize| move |s: &str| s.chars().count() <= n;
+        assert_eq!(fit_name("short.pdf", fits(20)), "short.pdf");
+        assert_eq!(fit_name("# 227 Pilot Boat Advance.pdf", fits(18)), "# 227 Pilot B….pdf");
+        // Multi-byte characters are never cut in half.
+        assert_eq!(fit_name("Überweisungsbestätigung.pdf", fits(12)), "Überwei….pdf");
+        assert_eq!(fit_name("日本語のファイル名です.pdf", fits(8)), "日本語….pdf");
+        // No extension, or a dot that isn't one.
+        assert_eq!(fit_name("README-without-extension", fits(10)), "README-wi…");
+        assert_eq!(fit_name(".hidden-file-name", fits(8)), ".hidden…");
+        // Nothing fits: the ellipsis and the extension.
+        assert_eq!(fit_name("abcdef.pdf", fits(0)), "….pdf");
+    }
+
+    #[test]
+    fn paper_sizes_fit_the_box_and_bad_sizes_are_refused() {
+        // The box follows the zoom, within its range; nonsense is 100%.
+        assert_eq!(paper_box(1.0), PAPER);
+        assert_eq!(paper_box(2.0), PAPER * 2.0);
+        assert_eq!(paper_box(99.0), PAPER * 2.0);
+        assert_eq!(paper_box(-1.0), PAPER * 0.6);
+        assert_eq!(paper_box(f32::NAN), PAPER);
+        for zoom in [0.6, 1.0, 2.0] {
+            let fit = paper_box(zoom);
+            // Letter is a little wider than the box: it fills the width. A tall page fills the height.
+            let letter = paper_size(612.0, 792.0, fit).unwrap();
+            assert!((letter.x - fit.x).abs() < 0.01 && letter.y <= fit.y + 0.01, "{letter:?}");
+            let tall = paper_size(612.0, 1008.0, fit).unwrap();
+            assert!((tall.y - fit.y).abs() < 0.01 && tall.x <= fit.x + 0.01, "{tall:?}");
+            let landscape = paper_size(792.0, 612.0, fit).unwrap();
+            assert!((landscape.x - fit.x).abs() < 0.01 && landscape.y < fit.y, "{landscape:?}");
+            for (w, h) in [(0.0, 792.0), (612.0, -1.0), (f32::NAN, 1.0), (f32::INFINITY, 1.0), (1e-30, 1e30)] {
+                let s = paper_size(w, h, fit);
+                assert!(s.is_none_or(|s| s.x.is_finite() && s.y.is_finite() && s.x <= fit.x + 0.01 && s.y <= fit.y + 0.01), "{w}×{h}: {s:?}");
+            }
+        }
+    }
+
+    #[test]
+    fn zoom_buttons_step_through_round_sizes() {
+        let mut z = 0.6;
+        let mut up = vec![z];
+        while z < 2.0 {
+            z = zoom_step(z, true);
+            up.push(z);
+        }
+        assert_eq!(up, ZOOM_STEPS);
+        assert_eq!(zoom_step(2.0, true), 2.0, "the largest stays put");
+        assert_eq!(zoom_step(0.6, false), 0.6, "the smallest stays put");
+        // From anywhere the slider left it, to the next round size.
+        assert_eq!(zoom_step(1.1, true), 1.25);
+        assert_eq!(zoom_step(1.1, false), 1.0);
+        assert_eq!(zoom_step(1.953, true), 2.0);
+        assert_eq!(zoom_step(1.0000001, true), 1.25, "a hair over a size counts as that size");
+    }
+
+    #[test]
+    fn arrow_keys_step_by_file_and_by_row() {
+        // The list: one at a time, staying put at both ends.
+        assert_eq!(step_to(0, 5, 1, false), 0);
+        assert_eq!(step_to(4, 5, 1, true), 4);
+        assert_eq!(step_to(2, 5, 1, true), 3);
+        // A grid of 3 per row and 8 files: rows [0 1 2] [3 4 5] [6 7].
+        assert_eq!(step_to(1, 8, 3, true), 4, "down one row, same column");
+        assert_eq!(step_to(5, 8, 3, true), 7, "a short last row is reached at its last file");
+        assert_eq!(step_to(6, 8, 3, true), 6, "the last row goes no further down");
+        assert_eq!(step_to(2, 8, 3, false), 2, "the first row goes no further up");
+        assert_eq!(step_to(7, 8, 3, false), 4);
+        // Out-of-range starts and empty lists don't panic.
+        assert_eq!(step_to(99, 8, 3, false), 4);
+        assert_eq!(step_to(0, 0, 3, true), 0);
+        assert_eq!(step_to(0, 1, 0, true), 0);
+    }
+
+    #[test]
+    fn moves_to_a_gap_keep_order_and_report_no_ops() {
+        let ids = [10, 11, 12, 13, 14];
+        let set = |v: &[u64]| v.iter().copied().collect::<BTreeSet<u64>>();
+        // One file to the start, to the end, and between others.
+        assert_eq!(moved_order(&ids, &set(&[13]), 0), Some(vec![13, 10, 11, 12, 14]));
+        assert_eq!(moved_order(&ids, &set(&[10]), 5), Some(vec![11, 12, 13, 14, 10]));
+        assert_eq!(moved_order(&ids, &set(&[10]), 3), Some(vec![11, 12, 10, 13, 14]));
+        // A discontiguous selection gathers at the gap, in list order.
+        assert_eq!(moved_order(&ids, &set(&[10, 12, 14]), 2), Some(vec![11, 10, 12, 14, 13]));
+        assert_eq!(moved_order(&ids, &set(&[11, 13]), 5), Some(vec![10, 12, 14, 11, 13]));
+        // Dropping a file next to itself, or a block inside itself, changes nothing.
+        assert_eq!(moved_order(&ids, &set(&[12]), 2), None);
+        assert_eq!(moved_order(&ids, &set(&[12]), 3), None);
+        assert_eq!(moved_order(&ids, &set(&[11, 12, 13]), 2), None);
+        // Nothing to move, unknown files and gaps past the end are harmless.
+        assert_eq!(moved_order(&ids, &set(&[]), 1), None);
+        assert_eq!(moved_order(&ids, &set(&[99]), 1), None);
+        assert_eq!(moved_order(&ids, &set(&[10]), 99), Some(vec![11, 12, 13, 14, 10]));
+    }
+
+    /// A PDF of `pages` pages of `w` × `h` points.
+    fn pdf(pages: usize, w: u32, h: u32) -> Arc<Vec<u8>> {
+        let mut objs: Vec<String> = vec!["<< /Type /Catalog /Pages 2 0 R >>".into()];
+        let kids: Vec<String> = (0..pages).map(|i| format!("{} 0 R", 3 + 2 * i)).collect();
+        objs.push(format!("<< /Type /Pages /Kids [{}] /Count {pages} /MediaBox [0 0 {w} {h}] >>", kids.join(" ")));
+        for i in 0..pages {
+            objs.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R >>", 4 + 2 * i));
+            let body = "0.2 0.4 0.8 rg 0 0 10 10 re f";
+            objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
+        }
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objs.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = out.len();
+        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+        for o in offsets {
+            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+        Arc::new(out)
+    }
+
+    fn key_of(bytes: &Arc<Vec<u8>>) -> Key {
+        Key { source: Arc::as_ptr(bytes) as usize, auth: 1, page: 0, px: [32, 48] }
+    }
+
+    fn want(file: u64, bytes: &Arc<Vec<u8>>) -> Want {
+        Want { slot: (file, 0), key: key_of(bytes), bytes: bytes.clone(), password: None, scale: 0.15, visible: true }
+    }
+
+    fn listing(files: &[(u64, &Arc<Vec<u8>>)]) -> HashMap<Slot, Key> {
+        files.iter().map(|(f, b)| ((*f, 0), key_of(b))).collect()
+    }
+
+    /// One frame of `finish`, as the app runs it; how soon it asks to be drawn again.
+    fn frame(ctx: &egui::Context, thumbs: &mut Thumbs, current: &HashMap<Slot, Key>) -> std::time::Duration {
+        let mut out = ctx.run_ui(egui::RawInput::default(), |ui| thumbs.finish(ui.ctx(), &|slot| current.get(&slot).copied()));
+        // No GPU here: the texture uploads are taken as done.
+        out.textures_delta.clear();
+        out.viewport_output.get(&egui::ViewportId::ROOT).map_or(std::time::Duration::MAX, |v| v.repaint_delay)
+    }
+
+    #[test]
+    fn a_thumbnail_that_arrives_is_drawn_without_waiting_for_input() {
+        // Regression: the cards are drawn before results are taken; the last result used to
+        // leave its card blank until the next mouse move.
+        let ctx = egui::Context::default();
+        let mut thumbs = Thumbs::default();
+        let bytes = pdf(1, 200, 300);
+        let current = listing(&[(1, &bytes)]);
+        thumbs.wants.push(want(1, &bytes));
+        frame(&ctx, &mut thumbs, &current);
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+        loop {
+            let delay = frame(&ctx, &mut thumbs, &current);
+            if thumbs.entries.get(&(1, 0)).is_some_and(|e| e.tex.is_some()) {
+                assert_eq!(delay, std::time::Duration::ZERO, "the frame that took the result asks for another");
+                break;
+            }
+            assert!(std::time::Instant::now() < deadline, "the thumbnail arrives");
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+    }
+
+    #[test]
+    fn a_result_for_a_file_that_changed_is_never_shown() {
+        let ctx = egui::Context::default();
+        let mut thumbs = Thumbs::default();
+        let bytes = pdf(1, 200, 300);
+        thumbs.wants.push(want(1, &bytes));
+        frame(&ctx, &mut thumbs, &listing(&[(1, &bytes)]));
+        assert_eq!(thumbs.jobs.len(), 1, "the render started");
+        // The file leaves the list (or is unlocked differently) while it renders.
+        let other = pdf(1, 200, 300);
+        let changed = listing(&[(1, &other)]);
+        frame(&ctx, &mut thumbs, &changed);
+        assert!(thumbs.jobs.is_empty(), "let go of at once");
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+        while thumbs.threads() > 0 {
+            assert!(std::time::Instant::now() < deadline, "its thread exits");
+            frame(&ctx, &mut thumbs, &changed);
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        assert!(thumbs.entries.is_empty(), "its result is never kept");
+    }
+
+    #[test]
+    fn textures_over_budget_go_longest_unseen_first_and_those_in_view_stay() {
+        let ctx = egui::Context::default();
+        let mut thumbs = Thumbs::default();
+        let tex = |n: &str| ctx.load_texture(n, egui::ColorImage::new([1, 1], vec![Color32::WHITE]), egui::TextureOptions::LINEAR);
+        let files: Vec<Arc<Vec<u8>>> = (0..4).map(|_| pdf(1, 200, 300)).collect();
+        thumbs.frame = 10;
+        // Seen at frames 1, 5 and 9 (out of view now), and 10 (in view), 20 MB each as counted.
+        for (i, seen) in [1u64, 5, 9, 10].into_iter().enumerate() {
+            let key = key_of(&files[i]);
+            thumbs.entries.insert((i as u64, 0), Entry { key, tex: Some(tex(&format!("t{i}"))), error: None, seen, bytes: 20 << 20 });
+        }
+        let current: HashMap<Slot, Key> = files.iter().enumerate().map(|(i, b)| ((i as u64, 0), key_of(b))).collect();
+        frame(&ctx, &mut thumbs, &current);
+        let mut kept: Vec<u64> = thumbs.entries.keys().map(|k| k.0).collect();
+        kept.sort_unstable();
+        assert_eq!(kept, [3], "80 MB: the three out of view go, oldest first; the one in view stays even over budget");
+    }
+
+    #[test]
+    fn render_threads_never_exceed_three_while_files_come_and_go() {
+        let ctx = egui::Context::default();
+        let mut thumbs = Thumbs::default();
+        let files: Vec<Arc<Vec<u8>>> = (0..12).map(|i| pdf(1 + i % 3, 200, 300)).collect();
+        let mut most = 0;
+        for round in 0..120u64 {
+            // A different handful of files every few frames: renders are abandoned all the time.
+            let start = (round / 3 % 4 * 3) as usize;
+            let shown: Vec<(u64, &Arc<Vec<u8>>)> = (start..start + 4).map(|i| (i as u64, &files[i % files.len()])).collect();
+            for (file, bytes) in &shown {
+                thumbs.wants.push(want(*file, bytes));
+            }
+            frame(&ctx, &mut thumbs, &listing(&shown));
+            let threads = thumbs.threads();
+            most = most.max(threads);
+            assert!(threads <= MAX_THREADS, "round {round}: {threads} render threads");
+            std::thread::sleep(std::time::Duration::from_millis(2));
+        }
+        assert!(most > 0, "renders did run");
+    }
+
+    #[test]
+    fn on_the_web_one_thumbnail_waits_at_a_time() {
+        // Regression: pools that render on the UI thread have no threads to count, so three
+        // started every frame while one finished, each holding its parsed document.
+        let ctx = egui::Context::default();
+        let mut thumbs = Thumbs { inline: true, ..Default::default() };
+        let files: Vec<Arc<Vec<u8>>> = (0..6).map(|_| pdf(1, 200, 300)).collect();
+        let shown: Vec<(u64, &Arc<Vec<u8>>)> = files.iter().enumerate().map(|(i, b)| (i as u64, b)).collect();
+        // One heavy step a frame on the UI thread: a parse, then the next frame its render.
+        for round in 0..14 {
+            for (file, bytes) in &shown {
+                thumbs.wants.push(want(*file, bytes));
+            }
+            frame(&ctx, &mut thumbs, &listing(&shown));
+            assert!(thumbs.jobs.len() <= 1, "round {round}: {} renders waiting", thumbs.jobs.len());
+            assert!(thumbs.jobs.iter().all(|j| j.pool.is_inline()));
+        }
+        assert!(thumbs.entries.values().filter(|e| e.tex.is_some()).count() == 6, "all six drawn, one heavy step per frame");
+    }
+
+    #[test]
+    fn the_next_page_of_a_file_reuses_its_open_document_until_it_closes() {
+        // Regression: each page of an expanded file read (parsed) the whole file again.
+        let ctx = egui::Context::default();
+        let mut thumbs = Thumbs::default();
+        let bytes = pdf(3, 200, 300);
+        let first = key_of(&bytes);
+        let second = Key { page: 1, ..first };
+        let current: HashMap<Slot, Key> = [((1, 0), first), ((1, 1), second)].into_iter().collect();
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+        let drawn = |thumbs: &Thumbs, slot: Slot| thumbs.entries.get(&slot).is_some_and(|e| e.tex.is_some());
+        while !drawn(&thumbs, (1, 0)) {
+            assert!(std::time::Instant::now() < deadline, "page 1 is drawn");
+            thumbs.wants.push(want(1, &bytes));
+            frame(&ctx, &mut thumbs, &current);
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        assert_eq!(thumbs.open.len(), 1, "its document stays open a moment");
+        // Page 2 of the same file, read the same way: that open document renders it.
+        thumbs.wants.push(Want { slot: (1, 1), key: second, ..want(1, &bytes) });
+        frame(&ctx, &mut thumbs, &current);
+        assert!(thumbs.open.is_empty() && thumbs.jobs.len() == 1, "reused, not a new pool: {} open, {} jobs", thumbs.open.len(), thumbs.jobs.len());
+        while !drawn(&thumbs, (1, 1)) {
+            assert!(std::time::Instant::now() < deadline, "page 2 is drawn");
+            frame(&ctx, &mut thumbs, &current);
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        assert!(thumbs.threads() <= MAX_THREADS);
+        // Unused, it closes after a while, and its thread goes.
+        while thumbs.threads() > 0 || !thumbs.open.is_empty() {
+            assert!(std::time::Instant::now() < deadline, "the open document closes and its thread exits");
+            frame(&ctx, &mut thumbs, &current);
+        }
+    }
+
+    #[test]
+    fn a_page_that_failed_is_not_tried_again_at_another_size() {
+        // Regression: each zoom step asked for a new render of a page that had failed (or hung
+        // for the watchdog's 20 s), filling the render threads.
+        // (A card asks for a render only when it looks Pending.)
+        let mut thumbs = Thumbs::default();
+        let bytes = pdf(1, 200, 300);
+        let key = key_of(&bytes);
+        thumbs.entries.insert((1, 0), Entry { key, tex: None, error: Some("broken".into()), seen: 0, bytes: 0 });
+        let larger = Key { px: [key.px[0] + 64, key.px[1] + 64], ..key };
+        assert!(matches!(thumbs.look((1, 0), larger), Look::Failed(e) if e == "broken"), "the failure stands at another size");
+        // Another read of the file (a new password) is a new page: tried again.
+        let reread = Key { auth: 2, ..key };
+        assert!(matches!(thumbs.look((1, 0), reread), Look::Pending(None)));
+    }
+
+    #[test]
+    fn on_the_web_a_render_that_never_answers_fails_and_lets_the_rest_through() {
+        // A pool without threads answers on the call that renders: no answer then never comes.
+        // It used to wait for good, so nothing else started and every frame asked for another.
+        let ctx = egui::Context::default();
+        let mut thumbs = Thumbs { inline: true, ..Default::default() };
+        let (silent, next) = (pdf(1, 200, 300), pdf(1, 200, 300));
+        let pool = RenderPool::new_inline(silent.clone(), RenderConfig::default());
+        // Nothing queued: this pool has nothing to answer with.
+        thumbs.jobs.push(Job { slot: (1, 0), key: key_of(&silent), pool, tag: 7 });
+        let current = listing(&[(1, &silent), (2, &next)]);
+        for _ in 0..4 {
+            thumbs.wants.push(want(2, &next));
+            frame(&ctx, &mut thumbs, &current);
+        }
+        assert!(thumbs.entries.get(&(1, 0)).is_some_and(|e| e.tex.is_none() && e.error.is_some()), "the silent one failed");
+        assert!(thumbs.entries.get(&(2, 0)).is_some_and(|e| e.tex.is_some()), "the next one was drawn");
+        assert!(thumbs.jobs.is_empty());
+        assert!(frame(&ctx, &mut thumbs, &current) > std::time::Duration::ZERO, "no more frames asked for at once");
+    }
+}
diff --git a/crates/ui-egui/src/combine_ui.rs b/crates/ui-egui/src/combine_ui.rs
index 0fd087cd8..faefb68f8 100644
--- a/crates/ui-egui/src/combine_ui.rs
+++ b/crates/ui-egui/src/combine_ui.rs
@@ -5,7 +5,7 @@
 //! column heading; PDFs dropped on the tab join the list. Every change to the list can be undone.
 
 use std::cmp::Ordering;
-use std::collections::BTreeSet;
+use std::collections::{BTreeSet, HashMap};
 use std::sync::Arc;
 use std::time::SystemTime;
 
@@ -17,8 +17,8 @@ use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, icons, widgets};
 
 /// Same reds and ambers as the signature status (`sign_ui`).
-const ERROR: Color32 = Color32::from_rgb(0xD7, 0x37, 0x3F);
-const WARNING: Color32 = Color32::from_rgb(0xE6, 0x86, 0x19);
+pub(crate) const ERROR: Color32 = Color32::from_rgb(0xD7, 0x37, 0x3F);
+pub(crate) const WARNING: Color32 = Color32::from_rgb(0xE6, 0x86, 0x19);
 /// Undo steps kept for the list (each holds the list itself; the files' bytes are shared).
 const HISTORY: usize = 100;
 
@@ -113,6 +113,32 @@ impl Columns {
     }
 }
 
+/// How the files are shown: a thumbnail of each (the default, to see what goes where) or the
+/// table (kept in the settings).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum CombineView {
+    #[default]
+    Grid,
+    List,
+}
+
+impl CombineView {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            CombineView::Grid => "grid",
+            CombineView::List => "list",
+        }
+    }
+
+    pub fn parse(s: &str) -> Option<Self> {
+        match s {
+            "grid" => Some(CombineView::Grid),
+            "list" => Some(CombineView::List),
+            _ => None,
+        }
+    }
+}
+
 /// A column heading being dragged to a new place.
 #[derive(Clone, Copy)]
 struct HeadingDrag(SortKey);
@@ -152,6 +178,55 @@ pub struct CombineTab {
     fitted: f32,
     /// The password box of Unlock…, while it shows.
     unlock: Option<UnlockPrompt>,
+    /// Bumped on every change to the list, so a grid drag that began before one is dropped.
+    pub(crate) revision: u64,
+    /// The file the keyboard moved to, for the grid to scroll into view.
+    pub(crate) reveal: Option<u64>,
+    /// Files per grid row as last drawn (Up/Down move a row in the grid).
+    pub(crate) grid_columns: usize,
+    /// A grid zoom asked for this frame (toolbar, keys, pinch); the grid applies it once it has
+    /// laid out, so it can keep the same cards in view.
+    pub(crate) zoom_request: Option<f32>,
+    /// The card size slider, which takes the arrow keys while it has the keyboard.
+    pub(crate) zoom_slider: Option<egui::Id>,
+    /// The card kept in place through a zoom gesture: its file, its place among the file's pages
+    /// (0 for the file's own card), how far below the top of the grid it was, and when the grid
+    /// last zoomed (seconds).
+    pub(crate) zoom_anchor: Option<(u64, usize, f32, f64)>,
+    /// Files shown as their pages in the grid (a view, not an edit: no undo step).
+    pub(crate) expanded: BTreeSet<u64>,
+    /// The pages each expanded file shows, worked out again only when its range changes.
+    pub(crate) page_lists: HashMap<u64, crate::combine_grid::PageList>,
+    /// The file (by place in the list) at each place of the grid as last drawn: Up and Down step
+    /// a row of cards, page cards included.
+    pub(crate) grid_places: Vec<usize>,
+    /// A file shown large (a card's magnifier), while it shows.
+    pub(crate) preview: Option<Preview>,
+    /// The card that had the keyboard last frame: Space shows its file large; on any other focused
+    /// widget Space is that widget's.
+    pub(crate) card_focus: Option<egui::Id>,
+    /// That card's file and its place among the file's pages (0 for the file's own card): Space
+    /// on a page card shows that page.
+    pub(crate) card_focus_at: Option<(u64, usize)>,
+    /// Single pages selected in the grid (an expanded file's page cards), by entry id and place
+    /// among the entry's pages; the files' selection is empty while any is.
+    pub(crate) selected_pages: BTreeSet<(u64, usize)>,
+    /// The page a Shift-click selects from.
+    pub(crate) page_anchor: Option<(u64, usize)>,
+}
+
+/// The pages a range takes, and the range and page count they were worked out for.
+pub(crate) type PagesTaken = ((String, usize), Arc<[usize]>);
+
+/// A file shown large: which, the place among the pages it adds, and those pages (worked out
+/// again only when its page range or page count changes).
+#[derive(Clone, Debug)]
+pub(crate) struct Preview {
+    pub(crate) file: u64,
+    pub(crate) at: usize,
+    /// The page (0-based, in the file) on screen, for the thumbnails to render.
+    pub(crate) page: Option<usize>,
+    pub(crate) pages: Option<PagesTaken>,
 }
 
 /// A password: kept in memory only, never printed (debug output ends up in logs).
@@ -186,8 +261,11 @@ struct UnlockPrompt {
 }
 
 /// What can be known about a file up front, opened with a password or not.
+#[derive(Clone)]
 struct Assessed {
     pages: usize,
+    /// Each page's displayed size in points (empty when the inspector couldn't read it).
+    sizes: Arc<[(f32, f32)]>,
     problem: Option<String>,
     lock: Option<Lock>,
     notes: Vec<String>,
@@ -216,6 +294,10 @@ fn assess(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<Assessed, Asse
         Some(i) => i.pages.len(),
         None => pdfcraft_engine::source_page_count(bytes, password).unwrap_or(0),
     };
+    let sizes: Arc<[(f32, f32)]> = match &info {
+        Some(i) => i.pages.iter().map(|p| (p.width, p.height)).collect(),
+        None => Arc::from(Vec::new()),
+    };
     let encrypted = password.is_some() || info.as_ref().is_some_and(|i| i.encrypted);
     let warnings = info.map(|i| i.warnings).unwrap_or_default();
     let (problem, lock) = match check {
@@ -239,7 +321,7 @@ fn assess(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Result<Assessed, Asse
         });
     }
     notes.extend(warnings.into_iter().take(5));
-    Ok(Assessed { pages, problem, lock, notes })
+    Ok(Assessed { pages, sizes, problem, lock, notes })
 }
 
 #[derive(Clone, Debug)]
@@ -258,13 +340,30 @@ pub(crate) struct Incoming {
     pub note: Option<String>,
 }
 
+/// A new value for [`CombineFile::auth`]: counted for the whole run, outside the undo history.
+fn next_auth() -> u64 {
+    static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
+    NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
+}
+
+/// A page range checked: the pages it takes and the first of them (0-based), or why it's wrong.
+type RangeCheck = Result<(usize, usize), String>;
+
 #[derive(Clone, Debug)]
 pub struct CombineFile {
     /// Stable while the file is in the list (selection, undo).
     pub id: u64,
+    /// The file it is (part of): the entries a file is split into (a page moved between another
+    /// file's pages) share it. Combined as one file, unlocked together, counted once.
+    pub(crate) group: u64,
     pub name: String,
     pub bytes: Arc<Vec<u8>>,
     pub pages: usize,
+    /// Each page's displayed size in points; shared, so undo snapshots don't copy it.
+    pub(crate) sizes: Arc<[(f32, f32)]>,
+    /// How the file was read (with which password): a new value every time it is read, never
+    /// reused, not even after undo, so a thumbnail made another way is never taken for this one.
+    pub(crate) auth: u64,
     /// The pages to take ("" = all).
     pub range: String,
     /// When the file was last modified (desktop picks and drops only).
@@ -279,34 +378,76 @@ pub struct CombineFile {
     pub notes: Vec<String>,
     /// Where it came from, shown among the warnings (e.g. an open document's unsaved changes).
     origin_note: Option<String>,
-    /// The range last checked and the result: the number of pages it takes, or why it is wrong.
-    checked: Option<(String, Result<usize, String>)>,
+    /// The range last checked and the result: the number of pages it takes and the first of
+    /// them (0-based), or why it is wrong.
+    checked: Option<(String, RangeCheck)>,
 }
 
 impl CombineFile {
     fn take(&mut self, a: Assessed, password: Option<Secret>) {
         self.pages = a.pages;
+        self.sizes = a.sizes;
         self.problem = a.problem;
         self.lock = a.lock;
         self.password = password;
+        self.auth = next_auth();
         self.notes = self.origin_note.iter().cloned().chain(a.notes).collect();
         self.checked = None;
     }
 
+    /// The password the file was unlocked with, if any.
+    pub(crate) fn password(&self) -> Option<&str> {
+        self.password.as_ref().map(|p| p.0.as_str())
+    }
+
     /// The number of pages `range` takes, or why it can't be used. Checked again only when the
     /// range changes.
     pub fn selection(&mut self) -> Result<usize, String> {
+        self.checked_range().map(|(count, _)| count)
+    }
+
+    /// The first page (0-based) the range takes, in its order ("3, 1" starts with page 3): the
+    /// page the grid shows for the file.
+    pub fn first_page(&mut self) -> Result<usize, String> {
+        self.checked_range().map(|(_, first)| first)
+    }
+
+    /// The first page the range takes, without updating the cache (read-only callers).
+    pub(crate) fn first_taken(&self) -> Option<usize> {
+        match &self.checked {
+            Some((range, result)) if *range == self.range => result.as_ref().ok().map(|(_, first)| *first),
+            _ => self.pages_taken().ok()?.first().copied(),
+        }
+    }
+
+    /// Every page (0-based) the range takes, in its order: what the preview flips through.
+    pub(crate) fn pages_taken(&self) -> Result<Vec<usize>, String> {
+        if self.range.trim().is_empty() {
+            return Ok((0..self.pages).collect());
+        }
+        match pdfcraft_engine::print::select_pages(self.pages, Some(&self.range), &[], pdfcraft_engine::print::Subset::All, false) {
+            Ok(p) if p.is_empty() => Err(tl!("No pages selected").to_string()),
+            Ok(p) => Ok(p),
+            Err(e) => Err(e.to_string()),
+        }
+    }
+
+    fn checked_range(&mut self) -> RangeCheck {
         if let Some((range, result)) = &self.checked
             && *range == self.range
         {
             return result.clone();
         }
         let result = if self.range.trim().is_empty() {
-            Ok(self.pages)
+            // (A file whose pages couldn't be counted is left to the engine, as before; the grid
+            // checks the first page against the page count.)
+            Ok((self.pages, 0))
         } else {
             match pdfcraft_engine::print::select_pages(self.pages, Some(&self.range), &[], pdfcraft_engine::print::Subset::All, false) {
-                Ok(p) if p.is_empty() => Err(tl!("No pages selected").to_string()),
-                Ok(p) => Ok(p.len()),
+                Ok(p) => match p.first() {
+                    Some(first) => Ok((p.len(), *first)),
+                    None => Err(tl!("No pages selected").to_string()),
+                },
                 Err(e) => Err(e.to_string()),
             }
         };
@@ -326,23 +467,59 @@ impl CombineFile {
     }
 }
 
-enum RowAction {
+#[derive(Clone)]
+pub(crate) enum RowAction {
     /// A click on row `i` (Ctrl/⌘ toggles it, Shift selects up to it).
     Click(usize, Modifiers),
     SelectAll,
-    /// Up/Down arrow; with Shift the selection grows.
+    /// An arrow key: `by` files on (1 in the list, or along a grid row; a grid row's length for
+    /// Up/Down in the grid). With Shift the selection grows.
     Step {
         down: bool,
+        by: usize,
         extend: bool,
     },
     MoveUp,
     MoveDown,
     Remove,
+    /// One file's card trash: that file only, whatever else is selected.
+    RemoveFile(u64),
+    /// One file's magnifier: show it large.
+    Preview(u64),
+    /// Space: show the file the keyboard is on (or the first selected) large.
+    PreviewSelected,
+    /// A page card's magnifier: show its file large, from that page (its place among the pages
+    /// the file adds).
+    PreviewAt(u64, usize),
+    /// Show one file as its pages in the grid (`true`), or as its card again.
+    Expand(u64, bool),
+    /// Every file that adds more than one page, as its pages (`true`), or all as cards again.
+    ExpandAll(bool),
+    /// A click on a page card: that page (by entry id and place among its pages) selected,
+    /// Ctrl/⌘ toggling it, Shift selecting up to it.
+    ClickPage(u64, usize, Modifiers),
+    /// A page card (and the rest of the selected pages, if it is selected) dropped before page
+    /// `gap` of the list (see [`moved_pages`]), if the list hasn't changed since the drag began.
+    MovePages {
+        page: (u64, usize),
+        revision: u64,
+        gap: usize,
+    },
+    /// One page's trash (`Some`), or the selected pages: out of the list.
+    RemovePages(Option<(u64, usize)>),
     /// Row `from` (and the rest of the selection, if it is selected) dropped on row `to`.
     Drop {
         from: usize,
         to: usize,
     },
+    /// A grid card (and the rest of the selection, if it is selected) dropped at `gap`
+    /// (0 = before the first file, n = after the last), if the list hasn't changed since the
+    /// drag began.
+    DropAt {
+        file: u64,
+        revision: u64,
+        gap: usize,
+    },
     Sort(SortKey),
     /// Unlock… on row `i` (and the rest of the selection, if it is selected), or on the
     /// selection (`None`); the password box opens at the position.
@@ -366,10 +543,61 @@ pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     let n = app.combine_draft.len();
     let ids: Vec<u64> = app.combine_draft.iter().map(|f| f.id).collect();
     app.combine_tab.selected.retain(|id| ids.contains(id));
+    // Pages stay picked only while they show (a grid card of an expanded file), so the trash or
+    // Delete never takes a page the user can't see.
+    {
+        let tab = &mut app.combine_tab;
+        if app.combine_view == CombineView::Grid {
+            let shown: BTreeSet<(u64, usize)> = app
+                .combine_draft
+                .iter_mut()
+                .filter(|f| tab.expanded.contains(&f.id))
+                .flat_map(|f| {
+                    let id = f.id;
+                    (0..f.selection().unwrap_or(0)).map(move |nth| (id, nth))
+                })
+                .collect();
+            tab.selected_pages.retain(|p| shown.contains(p));
+        } else {
+            tab.selected_pages.clear();
+        }
+        if tab.selected_pages.is_empty() {
+            tab.page_anchor = None;
+        }
+    }
+    // A file stays expanded only while it can show as its pages (not locked again by undo, nor
+    // edited down to one page or a bad range): it doesn't come back expanded by itself.
+    {
+        let tab = &mut app.combine_tab;
+        let draft = &app.combine_draft;
+        let lists = &mut tab.page_lists;
+        tab.expanded.retain(|id| draft.iter().find(|f| f.id == *id).is_some_and(|f| crate::combine_grid::pages_shown(lists, f).is_some()));
+        let expanded = &tab.expanded;
+        tab.page_lists.retain(|id, _| expanded.contains(id));
+    }
     let selected: Vec<bool> = ids.iter().map(|id| app.combine_tab.selected.contains(id)).collect();
     let count = selected.iter().filter(|s| **s).count();
     let blocker = blocker(&app.combine_draft, &checks);
-    let mut events = TableEvents { action: keyboard(ui, n, count > 0), ..Default::default() };
+    let grid = app.combine_view == CombineView::Grid;
+    let columns = grid.then_some(app.combine_tab.grid_columns);
+    // The keyboard is the list's unless a text field, the password box or the size slider has it.
+    let slider_focused = grid && app.combine_tab.zoom_slider.is_some_and(|id| ui.memory(|m| m.has_focus(id)));
+    // (Nor while a file is shown large: its window may only open or close this frame.)
+    let covered = app.combine_tab.unlock.is_some() || app.combine_tab.preview.is_some();
+    let focus = ui.memory(|m| m.focused());
+    let space = focus.is_none() || focus == app.combine_tab.card_focus;
+    let any_picked = count > 0 || !app.combine_tab.selected_pages.is_empty();
+    let keys = if covered || slider_focused { None } else { keyboard(ui, n, any_picked, columns, space) };
+    let mut events = TableEvents { action: keys, ..Default::default() };
+    // ⌘+ / ⌘− / ⌘0 size the grid's cards (instead of the whole window's text).
+    if grid && n > 0 && !covered {
+        app.combine_tab.zoom_request = zoom_keys(ui, app.combine_zoom).or(app.combine_tab.zoom_request);
+    }
+    // An arrow pressed or a zoom asked for in the list has nothing for the grid to do later.
+    if !grid {
+        app.combine_tab.reveal = None;
+        app.combine_tab.zoom_request = None;
+    }
     let mut combine = false;
 
     egui::Frame::NONE.inner_margin(egui::Margin::symmetric(28, 20)).show(ui, |ui| {
@@ -386,12 +614,19 @@ pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 }
             });
         });
-        ui.label(egui::RichText::new(tl!("Files are combined from top to bottom. Leave Pages empty to take every page.")).color(t.text_faint));
+        let hint = if grid {
+            tl!("Files are combined in the order shown. Drag them to change it.")
+        } else {
+            tl!("Files are combined from top to bottom. Leave Pages empty to take every page.")
+        };
+        ui.label(egui::RichText::new(hint).color(t.text_faint));
         ui.add_space(12.0);
 
-        // Toolbar.
-        ui.horizontal(|ui| {
+        // Toolbar: on two lines when the window is narrow.
+        ui.horizontal_wrapped(|ui| {
             ui.spacing_mut().item_spacing.x = 6.0;
+            // Where the line ends (an overflowing line would move it).
+            let edge = ui.max_rect().right();
             add_menu(app, ui);
             let open_docs: Vec<(usize, String)> =
                 app.views.iter().enumerate().filter_map(|(i, v)| app.session.get(v.id).map(|d| (i, d.display_name()))).collect();
@@ -409,18 +644,21 @@ pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     }
                 }
             });
-            separator(ui, &t);
+            group(ui, &t, edge, 4.0 * 30.0 + 3.0 * 6.0);
             // Moves need a selected row with room to move; the buttons stay put either way.
             let can_up = selected.iter().skip_while(|s| **s).any(|s| *s);
             let can_down = selected.iter().rev().skip_while(|s| **s).any(|s| *s);
             let why = tl!("Select a file first");
-            let remove = match count {
-                1 => {
+            let pages_picked = app.combine_tab.selected_pages.len();
+            let remove = match (pages_picked, count) {
+                (1, _) => tl!("Remove page").to_string(),
+                (k, _) if k > 1 => crate::i18n::fmt(tl!("Remove {n} pages"), &[("n", &k.to_string())]),
+                (_, 1) => {
                     let name = app.combine_draft.iter().find(|f| app.combine_tab.selected.contains(&f.id)).map_or("", |f| f.name.as_str());
                     crate::i18n::fmt(tl!("Remove {name}"), &[("name", name)])
                 }
-                0 => tl!("Remove").to_string(),
-                k => crate::i18n::fmt(tl!("Remove {n} files"), &[("n", &k.to_string())]),
+                (_, 0) => tl!("Remove").to_string(),
+                (_, k) => crate::i18n::fmt(tl!("Remove {n} files"), &[("n", &k.to_string())]),
             };
             if tool(ui, can_up, "chevron-up", tl!("Move up"), why).clicked() {
                 events.action = Some(RowAction::MoveUp);
@@ -428,7 +666,7 @@ pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             if tool(ui, can_down, "chevron-down", tl!("Move down"), why).clicked() {
                 events.action = Some(RowAction::MoveDown);
             }
-            if tool(ui, count > 0, "trash-2", &remove, why).clicked() {
+            if tool(ui, count > 0 || pages_picked > 0, "trash-2", &remove, why).clicked() {
                 events.action = Some(RowAction::Remove);
             }
             let locked = app.combine_draft.iter().any(|f| f.lock.is_some() && app.combine_tab.selected.contains(&f.id));
@@ -436,7 +674,7 @@ pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             if unlock.clicked() {
                 events.action = Some(RowAction::Unlock(None, unlock.rect.left_bottom() + vec2(0.0, 6.0)));
             }
-            separator(ui, &t);
+            group(ui, &t, edge, 2.0 * 30.0 + 6.0);
             let (undo, redo) = (!app.combine_tab.undo.is_empty(), !app.combine_tab.redo.is_empty());
             if tool(ui, undo, "undo-2", tl!("Undo"), tl!("Nothing to undo")).clicked() {
                 app.execute("edit.undo");
@@ -444,10 +682,30 @@ pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             if tool(ui, redo, "redo-2", tl!("Redo"), tl!("Nothing to redo")).clicked() {
                 app.execute("edit.redo");
             }
+            group(ui, &t, edge, 2.0 * 30.0 + 6.0);
+            // Thumbnails or the table; the choice is kept in the settings.
+            for (view, icon, label) in [(CombineView::Grid, "layout-grid", tl!("Grid view")), (CombineView::List, "list", tl!("List view"))] {
+                if icons::button(ui, icon, 30.0, app.combine_view == view, label).clicked() {
+                    app.combine_view = view;
+                }
+            }
             if count > 1 {
                 ui.add_space(6.0);
                 ui.label(egui::RichText::new(crate::i18n::fmt(tl!("{n} selected"), &[("n", &count.to_string())])).color(t.text_muted));
             }
+            if grid && n > 0 {
+                // Every file as its pages, or all as cards again.
+                group(ui, &t, edge, 2.0 * 30.0 + 6.0);
+                let can_expand = app.combine_draft.iter_mut().any(|f| !app.combine_tab.expanded.contains(&f.id) && expandable(f));
+                if ui.add_enabled_ui(can_expand, |ui| icons::button(ui, "maximize-2", 30.0, false, tl!("Expand all"))).inner.clicked() {
+                    events.action = Some(RowAction::ExpandAll(true));
+                }
+                let can_collapse = !app.combine_tab.expanded.is_empty();
+                if ui.add_enabled_ui(can_collapse, |ui| icons::button(ui, "minimize-2", 30.0, false, tl!("Collapse all"))).inner.clicked() {
+                    events.action = Some(RowAction::ExpandAll(false));
+                }
+                zoom_controls(app, ui, &t, edge);
+            }
         });
         ui.add_space(10.0);
 
@@ -459,9 +717,19 @@ pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             ui,
             |ui| {
                 ui.set_min_height(card_h - 12.0);
+                // The grid scrolls inside the card, leaving room for the totals below it.
+                if grid {
+                    ui.set_max_height(card_h - 12.0);
+                }
                 ui.set_width(ui.available_width());
                 if n == 0 {
                     empty_state(app, ui, &t, files_hovering);
+                // The view as the toolbar left it: a click on List view this frame starts no
+                // thumbnail renders.
+                } else if app.combine_view == CombineView::Grid {
+                    if let Some(action) = crate::combine_grid::grid(app, ui, &t, &checks, &selected) {
+                        events.action = Some(action);
+                    }
                 } else {
                     let table_events = table(app, ui, &t, &checks, &selected);
                     events.range_focused |= table_events.range_focused;
@@ -473,16 +741,30 @@ pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             },
         );
 
+        // A file shown large, over everything.
+        crate::combine_grid::preview(app, ui.ctx(), &t);
+
         // Totals.
         ui.add_space(8.0);
         if n > 0 {
             ui.horizontal(|ui| {
                 let pages: usize = checks.iter().filter_map(|c| c.as_ref().ok()).sum();
-                let size: usize = app.combine_draft.iter().map(|f| f.bytes.len()).sum();
+                // Each file's size once, however many parts it is in.
+                let mut counted = BTreeSet::new();
+                let size: usize = app.combine_draft.iter().filter(|f| counted.insert(f.group)).map(|f| f.bytes.len()).sum();
+                // A file split into parts counts once.
+                let n = app.combine_draft.iter().map(|f| f.group).collect::<BTreeSet<u64>>().len();
                 let files = if n == 1 { tl!("1 file").to_string() } else { crate::i18n::fmt(tl!("{n} files"), &[("n", &n.to_string())]) };
                 let pages = if pages == 1 { tl!("1 page").to_string() } else { crate::i18n::fmt(tl!("{n} pages"), &[("n", &pages.to_string())]) };
                 ui.label(egui::RichText::new(format!("{files} · {pages} · {}", crate::panels::human_size(size))).color(t.text_muted));
-                let bad = app.combine_draft.iter().zip(&checks).filter(|(f, c)| f.problem.is_some() || c.is_err()).count();
+                let bad = app
+                    .combine_draft
+                    .iter()
+                    .zip(&checks)
+                    .filter(|(f, c)| f.problem.is_some() || c.is_err())
+                    .map(|(f, _)| f.group)
+                    .collect::<BTreeSet<u64>>()
+                    .len();
                 if bad > 0 {
                     ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
                         let text = if bad == 1 {
@@ -597,18 +879,36 @@ fn unlock_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
 
 fn separator(ui: &mut egui::Ui, t: &Tokens) {
     ui.add_space(4.0);
-    ui.painter().vline(ui.cursor().left(), ui.max_rect().y_range().shrink(4.0), Stroke::new(1.0, t.divider));
+    // As tall as the buttons on this line (the toolbar can take two).
+    let top = ui.cursor().top();
+    ui.painter().vline(ui.cursor().left(), (top + 4.0)..=(top + 26.0), Stroke::new(1.0, t.divider));
     ui.add_space(6.0);
 }
 
+/// Before a group of toolbar buttons `width` wide: a divider, or a new line when the group
+/// doesn't fit before `edge` (the toolbar wraps between groups, never inside one).
+fn group(ui: &mut egui::Ui, t: &Tokens, edge: f32, width: f32) {
+    if edge - ui.cursor().min.x < width + 10.0 {
+        ui.end_row();
+    } else {
+        separator(ui, t);
+    }
+}
+
 /// A toolbar icon button, disabled with a reason.
 fn tool(ui: &mut egui::Ui, enabled: bool, icon: &str, label: &str, disabled_why: &str) -> egui::Response {
     ui.add_enabled_ui(enabled, |ui| icons::button(ui, icon, 30.0, false, label)).inner.on_disabled_hover_text(disabled_why)
 }
 
+/// Whether a file can be shown as its pages: readable, unlocked, and adding more than one.
+fn expandable(f: &mut CombineFile) -> bool {
+    f.lock.is_none() && f.problem.is_none() && f.selection().is_ok_and(|k| k > 1 && k <= crate::combine_grid::MAX_EXPAND)
+}
+
 /// Why Combine can't run yet, if so.
 fn blocker(files: &[CombineFile], checks: &[Result<usize, String>]) -> Option<String> {
-    if files.len() < 2 {
+    // (A file split into parts is still one file.)
+    if files.iter().map(|f| f.group).collect::<BTreeSet<u64>>().len() < 2 {
         return Some(tl!("Add at least two files").to_string());
     }
     for (f, check) in files.iter().zip(checks) {
@@ -623,9 +923,13 @@ fn blocker(files: &[CombineFile], checks: &[Result<usize, String>]) -> Option<St
 }
 
 /// While no text field has the keyboard: Up/Down select (Shift extends), Alt+Up/Down move the
-/// selection, Delete removes it, Ctrl/⌘+A selects every file.
-fn keyboard(ui: &egui::Ui, n: usize, any_selected: bool) -> Option<RowAction> {
-    if n == 0 || ui.ctx().memory(|m| m.focused().is_some()) {
+/// selection, Delete removes it, Ctrl/⌘+A selects every file. In the grid (`columns` per row)
+/// Left/Right step one file and Up/Down one row.
+pub(crate) fn keyboard(ui: &egui::Ui, n: usize, any_selected: bool, grid_columns: Option<usize>, space: bool) -> Option<RowAction> {
+    // A focused card or button still leaves the arrows to the list; a text field, an open menu
+    // or a dialog doesn't.
+    let ctx = ui.ctx();
+    if n == 0 || ctx.text_edit_focused() || egui::Popup::is_any_open(ctx) || ctx.memory(|m| m.top_modal_layer().is_some()) {
         return None;
     }
     use egui::Key;
@@ -633,6 +937,11 @@ fn keyboard(ui: &egui::Ui, n: usize, any_selected: bool) -> Option<RowAction> {
         if i.consume_key(Modifiers::COMMAND, Key::A) {
             return Some(RowAction::SelectAll);
         }
+        // As Quick Look: the file the keyboard is on, large (the way there without a pointer). A
+        // focused button keeps its Space.
+        if any_selected && space && i.consume_key(Modifiers::NONE, Key::Space) {
+            return Some(RowAction::PreviewSelected);
+        }
         if any_selected {
             if i.consume_key(Modifiers::ALT, Key::ArrowUp) {
                 return Some(RowAction::MoveUp);
@@ -644,18 +953,89 @@ fn keyboard(ui: &egui::Ui, n: usize, any_selected: bool) -> Option<RowAction> {
                 return Some(RowAction::Remove);
             }
         }
-        for (down, key) in [(false, Key::ArrowUp), (true, Key::ArrowDown)] {
-            if i.consume_key(Modifiers::NONE, key) {
-                return Some(RowAction::Step { down, extend: false });
-            }
+        let row = grid_columns.unwrap_or(1).max(1);
+        let mut keys = vec![(false, row, Key::ArrowUp), (true, row, Key::ArrowDown)];
+        if grid_columns.is_some() {
+            keys.extend([(false, 1, Key::ArrowLeft), (true, 1, Key::ArrowRight)]);
+        }
+        for (down, by, key) in keys {
+            // Shift first: a plain arrow also matches with Shift held (egui ignores an extra
+            // Shift), which would step instead of extending.
             if i.consume_key(Modifiers::SHIFT, key) {
-                return Some(RowAction::Step { down, extend: true });
+                return Some(RowAction::Step { down, by, extend: true });
+            }
+            if i.consume_key(Modifiers::NONE, key) {
+                return Some(RowAction::Step { down, by, extend: false });
             }
         }
         None
     })
 }
 
+/// ⌘+ (or ⌘=), ⌘− and ⌘0, while no text field, menu or dialog has the keyboard: the grid zoom
+/// they ask for, from `zoom`.
+fn zoom_keys(ui: &egui::Ui, zoom: f32) -> Option<f32> {
+    use crate::combine_grid::zoom_step;
+    use egui::{Key, KeyboardShortcut};
+    let ctx = ui.ctx();
+    if ctx.text_edit_focused() || egui::Popup::is_any_open(ctx) || ctx.memory(|m| m.top_modal_layer().is_some()) {
+        return None;
+    }
+    // All of them are taken (several can arrive in one slow frame), so none is left for egui to
+    // zoom the whole window with.
+    let (larger, smaller, reset) = ctx.input_mut(|i| {
+        let mut pressed = |k| i.consume_shortcut(&KeyboardShortcut::new(Modifiers::COMMAND, k));
+        (pressed(Key::Plus) | pressed(Key::Equals), pressed(Key::Minus), pressed(Key::Num0))
+    });
+    match (larger, smaller, reset) {
+        (_, _, true) => Some(1.0),
+        (true, false, _) => Some(zoom_step(zoom, true)),
+        (false, true, _) => Some(zoom_step(zoom, false)),
+        _ => None,
+    }
+}
+
+/// The grid's card size, at the right of the toolbar (right to left: larger, the percentage, the
+/// slider, smaller), as the page grid's.
+fn zoom_controls(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, edge: f32) {
+    use crate::combine_grid::{ZOOM_RANGE, zoom_step};
+    let zoom = app.combine_zoom;
+    // Two buttons, the percentage, the slider and the spaces between: on a line of their own when
+    // they don't fit beside the rest.
+    let needed = 30.0 + 44.0 + 96.0 + 30.0 + 4.0 * ui.spacing().item_spacing.x + 8.0;
+    if edge - ui.cursor().min.x < needed {
+        ui.end_row();
+    }
+    // Right-aligned on the line, up to its end.
+    let line = Rect::from_min_max(ui.cursor().min, egui::pos2(edge, ui.cursor().min.y + 30.0));
+    ui.scope_builder(egui::UiBuilder::new().max_rect(line).layout(Layout::right_to_left(Align::Center)), |ui| {
+        let larger = ui.add_enabled_ui(zoom < *ZOOM_RANGE.end(), |ui| icons::button(ui, "zoom-in", 30.0, false, tl!("Larger pages"))).inner;
+        if larger.clicked() {
+            app.combine_tab.zoom_request = Some(zoom_step(zoom, true));
+        }
+        let percent =
+            egui::Button::new(egui::RichText::new(format!("{:.0}%", zoom * 100.0)).font(theme::medium(12.0)).color(t.text_muted)).frame(false);
+        let percent = ui.add_sized([44.0, 30.0], percent);
+        percent.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Reset page size")));
+        if percent.on_hover_text(tl!("Reset page size")).clicked() {
+            app.combine_tab.zoom_request = Some(1.0);
+        }
+        let mut value = zoom;
+        ui.spacing_mut().slider_width = 96.0;
+        let slider = ui.add(egui::Slider::new(&mut value, ZOOM_RANGE).show_value(false));
+        // Read out as a percentage, as shown beside it.
+        slider.widget_info(|| egui::WidgetInfo::slider(true, f64::from(value * 100.0).round(), tl!("Page size")));
+        app.combine_tab.zoom_slider = Some(slider.id);
+        if slider.on_hover_text(tl!("Page size")).changed() {
+            app.combine_tab.zoom_request = Some(value);
+        }
+        let smaller = ui.add_enabled_ui(zoom > *ZOOM_RANGE.start(), |ui| icons::button(ui, "zoom-out", 30.0, false, tl!("Smaller pages"))).inner;
+        if smaller.clicked() {
+            app.combine_tab.zoom_request = Some(zoom_step(zoom, false));
+        }
+    });
+}
+
 fn empty_state(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, files_hovering: bool) {
     ui.vertical_centered(|ui| {
         ui.add_space((ui.available_height() / 2.0 - 70.0).max(16.0));
@@ -722,10 +1102,11 @@ fn add_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
 fn table(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, checks: &[Result<usize, String>], selected: &[bool]) -> TableEvents {
     let mut events = TableEvents::default();
     // The same file twice is allowed (e.g. a cover sheet), but probably a mistake.
+    // (A file's parts are the one file, not copies.)
     let twice: Vec<bool> = app
         .combine_draft
         .iter()
-        .map(|f| app.combine_draft.iter().filter(|g| g.name == f.name && g.bytes.len() == f.bytes.len()).count() > 1)
+        .map(|f| app.combine_draft.iter().filter(|g| g.group != f.group && g.name == f.name && g.bytes.len() == f.bytes.len()).count() > 0)
         .collect();
     let dragging = egui::DragAndDrop::has_payload_of_type::<usize>(ui.ctx());
     // Until the user resizes a column, the widths follow the window.
@@ -1092,6 +1473,166 @@ fn natural(a: &str, b: &str) -> Ordering {
     }
 }
 
+/// Where an arrow key goes from `at` among `n` files, `by` at a time (1 in the list; a grid
+/// row's length for Up/Down in the grid). It stays put on the first row going up and on the last
+/// row going down; a short last row is reached from the row above at its last file.
+pub(crate) fn step_to(at: usize, n: usize, by: usize, down: bool) -> usize {
+    let by = by.max(1);
+    let last = n.saturating_sub(1);
+    let at = at.min(last);
+    if down {
+        if at >= last / by * by { at } else { at.saturating_add(by).min(last) }
+    } else if at < by {
+        at
+    } else {
+        at - by
+    }
+}
+
+/// The order after moving the files `moving` (keeping their order) to `gap` in `ids` as it is
+/// (0 = before the first, `ids.len()` = after the last); `None` when nothing would change.
+pub(crate) fn moved_order(ids: &[u64], moving: &BTreeSet<u64>, gap: usize) -> Option<Vec<u64>> {
+    let gap = gap.min(ids.len());
+    // The gap counted among the files that stay.
+    let before = ids.get(..gap).map_or(0, |s| s.iter().filter(|id| moving.contains(id)).count());
+    let (taken, mut rest): (Vec<u64>, Vec<u64>) = ids.iter().partition(|id| moving.contains(id));
+    if taken.is_empty() {
+        return None;
+    }
+    let at = gap.saturating_sub(before).min(rest.len());
+    rest.splice(at..at, taken);
+    (rest != ids).then_some(rest)
+}
+
+/// A page range (1-based: "1-3, 6, 9-7") that takes exactly `pages` (0-based, in that order)
+/// from a file of `count` pages; empty (every page) when that is all of them in order.
+pub(crate) fn range_of(pages: &[usize], count: usize) -> String {
+    if pages.len() == count && pages.iter().enumerate().all(|(i, p)| i == *p) {
+        return String::new();
+    }
+    let mut parts: Vec<String> = Vec::new();
+    let mut i = 0;
+    while let Some(&start) = pages.get(i) {
+        // The longest run going up (or down) one page at a time from here.
+        let step = |a: usize, b: usize| {
+            if b == a.wrapping_add(1) {
+                1
+            } else if a == b.wrapping_add(1) {
+                -1
+            } else {
+                0
+            }
+        };
+        let dir = pages.get(i + 1).map_or(0, |&next| step(start, next));
+        let mut end = i;
+        while dir != 0 && pages.get(end + 1).is_some_and(|&next| pages.get(end).is_some_and(|&cur| step(cur, next) == dir)) {
+            end += 1;
+        }
+        let last = pages.get(end).copied().unwrap_or(start);
+        parts.push(if end == i { format!("{}", start.saturating_add(1)) } else { format!("{}-{}", start.saturating_add(1), last.saturating_add(1)) });
+        i = end + 1;
+    }
+    parts.join(", ")
+}
+
+/// One list entry, for moving and removing single pages: its file (`group`: the parts of one
+/// file split around share it) and the pages it takes, in order; `None` when they can't be
+/// listed (a locked file, a bad range): such an entry only ever moves whole.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct Part {
+    pub(crate) id: u64,
+    pub(crate) group: u64,
+    pub(crate) pages: Option<Vec<usize>>,
+}
+
+/// One page in the list's order, or an entry that moves whole.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Item {
+    Page { group: u64, from: u64, nth: usize, page: usize },
+    Whole(u64),
+}
+
+/// Every page in the list's order (and the entries that can't be split, whole).
+fn items_of(parts: &[Part]) -> Vec<Item> {
+    let mut items = Vec::new();
+    for p in parts {
+        match &p.pages {
+            Some(pages) => items.extend(pages.iter().enumerate().map(|(nth, &page)| Item::Page { group: p.group, from: p.id, nth, page })),
+            None => items.push(Item::Whole(p.id)),
+        }
+    }
+    items
+}
+
+/// Entries again from `items`: a file's pages side by side are one entry (its first unused id
+/// among them, else a new one from `new_id`); entries that move whole keep theirs.
+fn parts_of(items: &[Item], parts: &[Part], new_id: &mut dyn FnMut() -> u64) -> Vec<Part> {
+    let mut out: Vec<Part> = Vec::new();
+    let mut used: BTreeSet<u64> = BTreeSet::new();
+    let mut run: Vec<Item> = Vec::new();
+    let mut close = |run: &mut Vec<Item>, out: &mut Vec<Part>, used: &mut BTreeSet<u64>| {
+        let Some(Item::Page { group, .. }) = run.first().copied() else { return };
+        let id = run.iter().find_map(|i| match i {
+            Item::Page { from, .. } if !used.contains(from) => Some(*from),
+            _ => None,
+        });
+        let id = id.unwrap_or_else(&mut *new_id);
+        used.insert(id);
+        let pages = run.iter().filter_map(|i| if let Item::Page { page, .. } = i { Some(*page) } else { None }).collect();
+        out.push(Part { id, group, pages: Some(pages) });
+        run.clear();
+    };
+    for item in items {
+        match item {
+            Item::Whole(id) => {
+                close(&mut run, &mut out, &mut used);
+                if let Some(p) = parts.iter().find(|p| p.id == *id) {
+                    used.insert(*id);
+                    out.push(p.clone());
+                }
+            }
+            Item::Page { group, .. } => {
+                if run.first().is_some_and(|f| !matches!(f, Item::Page { group: g, .. } if g == group)) {
+                    close(&mut run, &mut out, &mut used);
+                }
+                run.push(*item);
+            }
+        }
+    }
+    close(&mut run, &mut out, &mut used);
+    out
+}
+
+/// The entries after moving the pages `moving` (by entry id and place among its pages), in
+/// their order, to before page `gap` of the list (counted over every page, an entry that can't be
+/// split counting as one; 0 = before the first): a page moved between another file's pages
+/// splits its file into parts, and parts of one file brought side by side join. `None` when
+/// nothing would change.
+pub(crate) fn moved_pages(parts: &[Part], moving: &BTreeSet<(u64, usize)>, gap: usize, new_id: &mut dyn FnMut() -> u64) -> Option<Vec<Part>> {
+    let items = items_of(parts);
+    let gap = gap.min(items.len());
+    let picked = |i: &Item| matches!(i, Item::Page { from, nth, .. } if moving.contains(&(*from, *nth)));
+    let before = items.get(..gap).map_or(0, |s| s.iter().filter(|i| picked(i)).count());
+    let (taken, mut rest): (Vec<Item>, Vec<Item>) = items.iter().partition(|i| picked(i));
+    if taken.is_empty() {
+        return None;
+    }
+    let at = gap.saturating_sub(before).min(rest.len());
+    rest.splice(at..at, taken);
+    let out = parts_of(&rest, parts, new_id);
+    (out != parts).then_some(out)
+}
+
+/// The entries after taking out the pages `removing` (by entry id and place among its pages);
+/// an entry left with none goes, and parts of one file left side by side join. `None` when
+/// nothing would change.
+pub(crate) fn removed_pages(parts: &[Part], removing: &BTreeSet<(u64, usize)>, new_id: &mut dyn FnMut() -> u64) -> Option<Vec<Part>> {
+    let items: Vec<Item> =
+        items_of(parts).into_iter().filter(|i| !matches!(i, Item::Page { from, nth, .. } if removing.contains(&(*from, *nth)))).collect();
+    let out = parts_of(&items, parts, new_id);
+    (out != parts).then_some(out)
+}
+
 /// Six dots: the drag handle.
 fn grip(ui: &egui::Ui, rect: Rect, colour: Color32) {
     for dx in [-2.5, 2.5] {
@@ -1153,6 +1694,9 @@ impl PdfCraftApp {
 
     /// Select these rows (tests and automation).
     pub fn select_combine_rows(&mut self, rows: &[usize]) {
+        // Files picked: no page stays picked (the trash and Delete act on these files).
+        self.combine_tab.selected_pages.clear();
+        self.combine_tab.page_anchor = None;
         self.combine_tab.selected = rows.iter().filter_map(|i| self.combine_draft.get(*i)).map(|f| f.id).collect();
         let last = rows.last().and_then(|i| self.combine_draft.get(*i)).map(|f| f.id);
         (self.combine_tab.anchor, self.combine_tab.cursor) = (last, last);
@@ -1165,8 +1709,11 @@ impl PdfCraftApp {
     fn combine_restore(&mut self, s: Snapshot) {
         self.combine_draft = s.files;
         self.combine_tab.selected = s.selected;
+        self.combine_tab.selected_pages.clear();
+        self.combine_tab.page_anchor = None;
         self.combine_tab.sort = s.sort;
         self.combine_tab.range_edit = None;
+        self.combine_tab.revision = self.combine_tab.revision.wrapping_add(1);
         // A Pages field with the keyboard would otherwise keep typing into the restored list
         // without an undo step.
         if let Some(ctx) = &self.ctx {
@@ -1175,6 +1722,7 @@ impl PdfCraftApp {
     }
 
     fn combine_push_undo(&mut self, before: Snapshot) {
+        self.combine_tab.revision = self.combine_tab.revision.wrapping_add(1);
         let undo = &mut self.combine_tab.undo;
         undo.push(before);
         if undo.len() > HISTORY {
@@ -1230,7 +1778,199 @@ impl PdfCraftApp {
         self.combine_tab.sort = Some((key, ascending));
     }
 
-    fn combine_apply(&mut self, action: RowAction) {
+    /// The list as parts, for page edits: each entry's pages, or `None` for one that can't be
+    /// split (locked, unreadable, a bad range).
+    fn combine_parts(&self) -> Vec<Part> {
+        self.combine_draft
+            .iter()
+            .map(|f| Part {
+                id: f.id,
+                group: f.group,
+                // (No page listed, e.g. its pages couldn't be counted: it moves whole, never lost.)
+                pages: (f.lock.is_none() && f.problem.is_none()).then(|| f.pages_taken().ok()).flatten().filter(|p| !p.is_empty()),
+            })
+            .collect()
+    }
+
+    /// Make the list `parts`, as one undo step: entries kept by id, new parts made from their
+    /// file's other entries, each taking exactly its pages (its range rewritten). The parts of a
+    /// file shown as its pages stay shown so; the page selection is let go of.
+    fn combine_set_parts(&mut self, parts: Vec<Part>) {
+        self.combine_record();
+        self.combine_put_parts(parts);
+        let tab = &mut self.combine_tab;
+        tab.selected_pages.clear();
+        tab.page_anchor = None;
+        // An order made by hand isn't sorted any more.
+        tab.sort = None;
+    }
+
+    /// Join the parts of a file that have come to be side by side (no undo step of its own: it
+    /// belongs to the change that brought them together).
+    fn combine_join_parts(&mut self) {
+        let parts = self.combine_parts();
+        // Nothing to join unless some file is in more than one part.
+        let groups: BTreeSet<u64> = parts.iter().map(|p| p.group).collect();
+        if groups.len() == parts.len() {
+            return;
+        }
+        let next = &mut self.combine_tab.next_id;
+        let mut new_id = || {
+            let id = *next;
+            *next = next.wrapping_add(1);
+            id
+        };
+        let joined = parts_of(&items_of(&parts), &parts, &mut new_id);
+        if joined != parts {
+            self.combine_put_parts(joined);
+        }
+    }
+
+    /// Make the list `parts`: entries kept by id, new parts made from their file's other entries,
+    /// each taking exactly its pages (its range rewritten only when they differ).
+    fn combine_put_parts(&mut self, parts: Vec<Part>) {
+        let old = std::mem::take(&mut self.combine_draft);
+        let expanded: BTreeSet<u64> = old.iter().filter(|f| self.combine_tab.expanded.contains(&f.id)).map(|f| f.group).collect();
+        for p in parts {
+            let Some(base) = old.iter().find(|f| f.id == p.id).or_else(|| old.iter().find(|f| f.group == p.group)) else { continue };
+            let mut f = base.clone();
+            f.id = p.id;
+            // (A range that already takes these pages stays as the user typed it.)
+            if let Some(pages) = &p.pages
+                && f.pages_taken().ok().as_ref() != Some(pages)
+            {
+                f.range = range_of(pages, f.pages);
+                f.checked = None;
+            }
+            if expanded.contains(&f.group) {
+                self.combine_tab.expanded.insert(f.id);
+            }
+            self.combine_draft.push(f);
+        }
+        let ids: BTreeSet<u64> = self.combine_draft.iter().map(|f| f.id).collect();
+        self.combine_tab.selected.retain(|id| ids.contains(id));
+    }
+
+    /// A page card clicked: that page selected (Ctrl/⌘ toggles it, Shift selects every page from
+    /// the last one clicked, in the list's order); the files' selection is let go of.
+    fn combine_click_page(&mut self, id: u64, nth: usize, m: Modifiers) {
+        let page = (id, nth);
+        let tab = &mut self.combine_tab;
+        tab.selected.clear();
+        tab.cursor = Some(id);
+        if m.shift
+            && let Some(from) = tab.page_anchor
+        {
+            // Every page between the two, as the grid shows them.
+            let order: Vec<(u64, usize)> = self
+                .combine_draft
+                .iter()
+                .filter(|f| tab.expanded.contains(&f.id))
+                .flat_map(|f| (0..f.pages_taken().map_or(0, |p| p.len())).map(move |n| (f.id, n)))
+                .collect();
+            let (a, b) = (order.iter().position(|p| *p == from), order.iter().position(|p| *p == page));
+            if let (Some(a), Some(b)) = (a, b) {
+                if !m.command {
+                    tab.selected_pages.clear();
+                }
+                tab.selected_pages.extend(order.get(a.min(b)..=a.max(b)).unwrap_or_default().iter().copied());
+                return;
+            }
+        }
+        if m.command {
+            if !tab.selected_pages.remove(&page) {
+                tab.selected_pages.insert(page);
+            }
+        } else {
+            tab.selected_pages = BTreeSet::from([page]);
+        }
+        tab.page_anchor = Some(page);
+    }
+
+    /// Move `moving` to `gap`, as one undo step; a move that changes nothing leaves the list,
+    /// its sort and the history alone.
+    fn combine_move_to_gap(&mut self, moving: BTreeSet<u64>, gap: usize) {
+        let ids: Vec<u64> = self.combine_draft.iter().map(|f| f.id).collect();
+        let Some(order) = moved_order(&ids, &moving, gap) else { return };
+        self.combine_record();
+        let rank: std::collections::HashMap<u64, usize> = order.iter().enumerate().map(|(i, id)| (*id, i)).collect();
+        self.combine_draft.sort_by_key(|f| rank.get(&f.id).copied().unwrap_or(usize::MAX));
+        self.combine_tab.selected = moving.into_iter().filter(|id| rank.contains_key(id)).collect();
+        self.combine_tab.sort = None;
+    }
+
+    pub(crate) fn combine_apply(&mut self, action: RowAction) {
+        let page_edit = matches!(action, RowAction::ClickPage(..) | RowAction::MovePages { .. } | RowAction::RemovePages(_));
+        self.combine_apply_once(action);
+        // One kind of selection at a time: files picked (by a click, the keys, a drop, Unlock…)
+        // let go of the pages picked, so the trash never takes pages the user no longer means.
+        if !self.combine_tab.selected.is_empty() {
+            self.combine_tab.selected_pages.clear();
+            self.combine_tab.page_anchor = None;
+        }
+        // A file's parts brought side by side (the file between them removed or moved away) are
+        // one entry again, as in the same undo step.
+        if !page_edit {
+            self.combine_join_parts();
+        }
+    }
+
+    fn combine_apply_once(&mut self, action: RowAction) {
+        // The trash and Delete act on the selected pages while there are any.
+        let action = match action {
+            // (Files picked come first: the two are never both picked, but if they ever were, the
+            // files the user sees picked are what goes.)
+            RowAction::Remove if self.combine_tab.selected.is_empty() && !self.combine_tab.selected_pages.is_empty() => RowAction::RemovePages(None),
+            a => a,
+        };
+        // Page edits work on the list as parts.
+        match action {
+            RowAction::ClickPage(id, nth, m) => return self.combine_click_page(id, nth, m),
+            RowAction::MovePages { page, revision, gap } => {
+                if revision != self.combine_tab.revision {
+                    return;
+                }
+                let moving =
+                    if self.combine_tab.selected_pages.contains(&page) { self.combine_tab.selected_pages.clone() } else { BTreeSet::from([page]) };
+                let parts = self.combine_parts();
+                let next = &mut self.combine_tab.next_id;
+                let mut new_id = || {
+                    let id = *next;
+                    *next = next.wrapping_add(1);
+                    id
+                };
+                if let Some(moved) = moved_pages(&parts, &moving, gap, &mut new_id) {
+                    self.combine_set_parts(moved);
+                }
+                return;
+            }
+            RowAction::RemovePages(one) => {
+                let removing = match one {
+                    Some(page) => BTreeSet::from([page]),
+                    None => self.combine_tab.selected_pages.clone(),
+                };
+                if removing.is_empty() {
+                    return;
+                }
+                let parts = self.combine_parts();
+                let next = &mut self.combine_tab.next_id;
+                let mut new_id = || {
+                    let id = *next;
+                    *next = next.wrapping_add(1);
+                    id
+                };
+                // (Nothing to take out: no undo step, the redo history kept.)
+                if let Some(left) = removed_pages(&parts, &removing, &mut new_id) {
+                    self.combine_set_parts(left);
+                }
+                return;
+            }
+            _ => {}
+        }
+        // A file's card clicked (or the list's keys): the files are selected, no page.
+        if matches!(action, RowAction::Click(..) | RowAction::SelectAll | RowAction::Step { .. }) {
+            self.combine_tab.selected_pages.clear();
+        }
         let ids: Vec<u64> = self.combine_draft.iter().map(|f| f.id).collect();
         let n = ids.len();
         let index_of = |id: Option<u64>| id.and_then(|id| ids.iter().position(|x| *x == id));
@@ -1259,10 +1999,17 @@ impl PdfCraftApp {
             RowAction::SelectAll => {
                 tab.selected = ids.iter().copied().collect();
             }
-            RowAction::Step { down, extend } => {
+            RowAction::Step { down, by, extend } => {
+                // With files shown as their pages, Up and Down go a row of cards (from the last
+                // of a file's cards down, from its first up) to the file there.
+                let places = &tab.grid_places;
+                let rows_of_cards = by > 1 && places.len() > n;
                 let next = match index_of(tab.cursor) {
-                    Some(c) if down => (c + 1).min(n.saturating_sub(1)),
-                    Some(c) => c.saturating_sub(1),
+                    Some(c) if rows_of_cards => {
+                        let from = if down { places.iter().rposition(|f| *f == c) } else { places.iter().position(|f| *f == c) };
+                        from.and_then(|at| places.get(step_to(at, places.len(), by, down)).copied()).unwrap_or(c)
+                    }
+                    Some(c) => step_to(c, n, by, down),
                     None if down => 0,
                     None => n.saturating_sub(1),
                 };
@@ -1275,6 +2022,7 @@ impl PdfCraftApp {
                     tab.anchor = Some(id);
                 }
                 tab.cursor = Some(id);
+                tab.reveal = Some(id);
             }
             RowAction::MoveUp | RowAction::MoveDown => {
                 let up = matches!(action, RowAction::MoveUp);
@@ -1313,21 +2061,88 @@ impl PdfCraftApp {
                 self.combine_tab.selected = next.into_iter().collect();
                 (self.combine_tab.anchor, self.combine_tab.cursor) = (next, next);
             }
+            RowAction::RemoveFile(id) => {
+                if !ids.contains(&id) {
+                    return;
+                }
+                self.combine_record();
+                self.combine_draft.retain(|f| f.id != id);
+                // The rest of the selection stays as it was.
+                self.combine_tab.selected.remove(&id);
+                if self.combine_tab.anchor == Some(id) {
+                    self.combine_tab.anchor = None;
+                }
+                if self.combine_tab.cursor == Some(id) {
+                    self.combine_tab.cursor = None;
+                }
+            }
+            RowAction::Preview(id) => {
+                if ids.contains(&id) {
+                    self.combine_tab.preview = Some(Preview { file: id, at: 0, page: None, pages: None });
+                }
+            }
+            RowAction::PreviewAt(id, at) => {
+                if ids.contains(&id) {
+                    self.combine_tab.preview = Some(Preview { file: id, at, page: None, pages: None });
+                }
+            }
+            RowAction::Expand(id, on) => {
+                if on {
+                    if self.combine_draft.iter_mut().any(|f| f.id == id && expandable(f)) {
+                        self.combine_tab.expanded.insert(id);
+                    }
+                } else {
+                    self.combine_tab.expanded.remove(&id);
+                    // Its card may be far from where its pages were: brought into view.
+                    self.combine_tab.reveal = Some(id);
+                }
+            }
+            RowAction::ExpandAll(on) => {
+                self.combine_tab.expanded =
+                    if on { self.combine_draft.iter_mut().filter_map(|f| expandable(f).then_some(f.id)).collect() } else { BTreeSet::new() };
+                if !on {
+                    self.combine_tab.reveal = self.combine_tab.cursor;
+                }
+            }
+            RowAction::PreviewSelected => {
+                // The file the keyboard is on, or the first selected; with pages selected, the
+                // page card that has the keyboard, or the first selected page.
+                let first_page = tab.selected_pages.iter().min_by_key(|(id, nth)| (ids.iter().position(|x| x == id), *nth)).copied();
+                let page = tab.card_focus_at.filter(|p| tab.selected_pages.contains(p)).or(first_page);
+                let id = tab
+                    .cursor
+                    .filter(|c| tab.selected.contains(c))
+                    .or_else(|| ids.iter().copied().find(|id| tab.selected.contains(id)))
+                    .or(page.map(|(id, _)| id));
+                // Only what its card would offer a magnifier for (unlocked, readable, measured).
+                let shows = |id: u64| self.combine_draft.iter().any(|f| f.id == id && f.lock.is_none() && f.problem.is_none() && !f.sizes.is_empty());
+                if let Some(id) = id.filter(|id| shows(*id)) {
+                    // From the page card that has the keyboard (or the selected page), if it's one
+                    // of this file's.
+                    let at = self.combine_tab.card_focus_at.or(page).filter(|(file, _)| *file == id).map_or(0, |(_, nth)| nth);
+                    self.combine_tab.preview = Some(Preview { file: id, at, page: None, pages: None });
+                }
+            }
+            // (Page edits were done above.)
+            RowAction::ClickPage(..) | RowAction::MovePages { .. } | RowAction::RemovePages(_) => {}
             RowAction::Drop { from, to } => {
                 let (Some(&dragged), Some(&target)) = (ids.get(from), ids.get(to)) else { return };
                 // Dragging a selected file takes the whole selection along.
                 let moving: BTreeSet<u64> = if tab.selected.contains(&dragged) { tab.selected.clone() } else { BTreeSet::from([dragged]) };
+                // Dropped on the selection itself: nothing to do.
                 if moving.contains(&target) {
                     return;
                 }
-                self.combine_record();
-                let list = &mut self.combine_draft;
-                let (taken, mut rest): (Vec<_>, Vec<_>) = list.drain(..).partition(|f| moving.contains(&f.id));
-                let at = rest.iter().position(|f| f.id == target).map_or(rest.len(), |p| if from < to { p + 1 } else { p });
-                rest.splice(at..at, taken);
-                *list = rest;
-                self.combine_tab.selected = moving;
-                self.combine_tab.sort = None;
+                // Below the row when dragged down, above it when dragged up.
+                self.combine_move_to_gap(moving, if from < to { to + 1 } else { to });
+            }
+            RowAction::DropAt { file, revision, gap } => {
+                // The list changed under the drag (e.g. undo): the gap no longer means the same.
+                if revision != tab.revision || !ids.contains(&file) {
+                    return;
+                }
+                let moving: BTreeSet<u64> = if tab.selected.contains(&file) { tab.selected.clone() } else { BTreeSet::from([file]) };
+                self.combine_move_to_gap(moving, gap);
             }
             RowAction::Unlock(row, at) => {
                 let locked: BTreeSet<u64> = self.combine_draft.iter().filter(|f| f.lock.is_some()).map(|f| f.id).collect();
@@ -1356,8 +2171,11 @@ impl PdfCraftApp {
     /// Close the Combine files tab and forget its list; the last document shows, if any.
     pub fn close_combine_tab(&mut self) {
         let showing = self.combine_showing();
-        self.combine_tab = CombineTab::default();
+        // (Revisions keep counting: a drag begun before can never match a list made after.)
+        let revision = self.combine_tab.revision.wrapping_add(1);
+        self.combine_tab = CombineTab { revision, ..CombineTab::default() };
         self.combine_draft.clear();
+        self.combine_thumbs.clear();
         if showing {
             self.active = self.views.len().checked_sub(1);
         }
@@ -1386,6 +2204,7 @@ impl PdfCraftApp {
             };
             let mut f = CombineFile {
                 id: 0,
+                group: 0,
                 name,
                 bytes,
                 pages: 0,
@@ -1394,6 +2213,8 @@ impl PdfCraftApp {
                 problem: None,
                 lock: None,
                 password: None,
+                sizes: Arc::from(Vec::new()),
+                auth: 0,
                 notes: Vec::new(),
                 origin_note: note,
                 checked: None,
@@ -1405,6 +2226,7 @@ impl PdfCraftApp {
             self.combine_record();
             for mut f in added {
                 f.id = self.combine_tab.next_id;
+                f.group = f.id;
                 self.combine_tab.next_id = self.combine_tab.next_id.wrapping_add(1);
                 self.combine_draft.push(f);
             }
@@ -1427,24 +2249,30 @@ impl PdfCraftApp {
     /// Try `password` on the protected files `rows` (as one undo step). Returns false when it
     /// opened none of them.
     pub fn combine_unlock(&mut self, rows: &[u64], password: &str) -> bool {
+        // A file split into parts is unlocked as one: each file once, all its parts alike.
+        let groups: BTreeSet<u64> =
+            rows.iter().filter_map(|id| self.combine_draft.iter().find(|f| f.id == *id && f.lock.is_some())).map(|f| f.group).collect();
         let mut accepted = Vec::new();
-        for id in rows {
-            let Some(f) = self.combine_draft.iter().find(|f| f.id == *id && f.lock.is_some()) else { continue };
+        for group in &groups {
+            let Some(f) = self.combine_draft.iter().find(|f| f.group == *group) else { continue };
             if let Ok(a) = assess(&f.bytes, Some(password)) {
-                accepted.push((*id, a));
+                accepted.push((*group, a));
             }
         }
         if accepted.is_empty() {
             return false;
         }
         self.combine_record();
-        let tried = rows.len();
+        let tried = groups.len();
         let mut unlocked = 0;
-        for (id, a) in accepted {
-            if let Some(f) = self.combine_draft.iter_mut().find(|f| f.id == id) {
-                f.take(a, Some(Secret(password.to_owned())));
-                unlocked += usize::from(f.lock.is_none());
+        for (group, a) in accepted {
+            let mut auth = None;
+            for f in self.combine_draft.iter_mut().filter(|f| f.group == group) {
+                f.take(a.clone(), Some(Secret(password.to_owned())));
+                // Read once: one way of reading for all its parts (their thumbnails are shared).
+                f.auth = *auth.get_or_insert(f.auth);
             }
+            unlocked += usize::from(self.combine_draft.iter().any(|f| f.group == group && f.lock.is_none()));
         }
         if tried > 1 {
             self.notify_fmt("Unlocked {n} of {m} files", &[("n", &unlocked.to_string()), ("m", &tried.to_string())]);
@@ -1508,13 +2336,15 @@ impl PdfCraftApp {
         if files.is_empty() {
             return;
         }
-        let count = files.len();
+        // Each file once, however many parts it is in.
+        let count = files.iter().map(|f| f.group).collect::<BTreeSet<u64>>().len();
+        let groups: Vec<u64> = files.iter().map(|f| f.group).collect();
         let sources: Vec<(String, Arc<Vec<u8>>, Option<String>)> = files
             .iter()
             .map(|f| (crate::files::strip_pdf(&f.name).to_string(), f.bytes.clone(), Some(f.range.clone()).filter(|r| !r.trim().is_empty())))
             .collect();
         let passwords: Vec<Option<&str>> = files.iter().map(|f| f.password.as_ref().map(|p| p.0.as_str())).collect();
-        match self.session.combine_unlocked(&sources, &passwords) {
+        match self.session.combine_grouped(&sources, &groups, &passwords) {
             Ok(bytes) => {
                 self.close_combine_tab();
                 let message = crate::i18n::fmt(tl!("Combined {n} files"), &[("n", &count.to_string())]);
@@ -1525,3 +2355,144 @@ impl PdfCraftApp {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A one-page PDF that opens with "pw".
+    fn locked() -> Vec<u8> {
+        let objs = [
+            "<< /Type /Catalog /Pages 2 0 R >>",
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>",
+            "<< /Type /Page /Parent 2 0 R >>",
+        ];
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objs.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = out.len();
+        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+        for o in offsets {
+            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+        let mut doc = pdfcraft_cos::Document::open(Arc::new(out)).unwrap();
+        doc.set_encryption(&pdfcraft_cos::NewEncryption {
+            algorithm: pdfcraft_cos::Algorithm::Aes256,
+            user_password: "pw",
+            owner_password: "owner",
+            permissions: -1,
+            encrypt_metadata: true,
+            seed: [4; 32],
+        })
+        .unwrap();
+        pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
+    }
+
+    #[test]
+    fn every_read_of_a_file_is_new_even_after_undo() {
+        // Regression: the read counter lived in the undo history, so unlock → undo → unlock (with
+        // another password) could repeat a value and keep a thumbnail of the other read.
+        let mut app = PdfCraftApp::new();
+        app.stage_combine(vec![("secret.pdf".into(), locked())]);
+        let added = app.combine_draft[0].auth;
+        assert!(app.combine_unlock_rows(&[0], "pw"));
+        let first = app.combine_draft[0].auth;
+        app.combine_history_step(true);
+        assert_eq!(app.combine_draft[0].auth, added, "undo brings back the file as it was read");
+        assert!(app.combine_unlock_rows(&[0], "owner"));
+        let second = app.combine_draft[0].auth;
+        assert!(second != first && second != added, "added {added}, unlocked {first}, unlocked again {second}");
+    }
+
+    #[test]
+    fn moves_by_rank_never_lose_or_repeat_a_file() {
+        let mut app = PdfCraftApp::new();
+        app.stage_combine((0..6).map(|i| (format!("f{i}.pdf"), locked())).collect());
+        let mut ids: Vec<u64> = app.combine_draft.iter().map(|f| f.id).collect();
+        for (moving, gap) in [(vec![0usize, 2, 4], 6), (vec![5], 0), (vec![1, 3], 3)] {
+            let set: BTreeSet<u64> = moving.iter().filter_map(|i| ids.get(*i).copied()).collect();
+            app.combine_move_to_gap(set, gap);
+            let mut now: Vec<u64> = app.combine_draft.iter().map(|f| f.id).collect();
+            ids = now.clone();
+            now.sort_unstable();
+            assert_eq!(now, (0..6).collect::<Vec<u64>>(), "every file once");
+        }
+    }
+
+    #[test]
+    fn page_lists_become_the_shortest_range() {
+        assert_eq!(range_of(&[0, 1, 2], 3), "", "every page in order: no range");
+        assert_eq!(range_of(&[0, 1, 2], 5), "1-3");
+        assert_eq!(range_of(&[2, 0, 3], 5), "3, 1, 4");
+        assert_eq!(range_of(&[8, 7, 6, 0], 9), "9-7, 1");
+        assert_eq!(range_of(&[0, 0, 1], 2), "1, 1-2");
+        assert_eq!(range_of(&[4], 9), "5");
+        assert_eq!(range_of(&[], 3), "");
+        // Whatever comes out reads back as the same pages.
+        for pages in [vec![0, 1, 2, 5, 4, 3, 3, 7], vec![9, 0, 9, 1], vec![2, 1, 0, 1, 2]] {
+            let range = range_of(&pages, 10);
+            let back = pdfcraft_engine::print::select_pages(10, Some(&range), &[], pdfcraft_engine::print::Subset::All, false).unwrap();
+            assert_eq!(back, pages, "{range}");
+        }
+    }
+
+    fn part(id: u64, group: u64, pages: &[usize]) -> Part {
+        Part { id, group, pages: Some(pages.to_vec()) }
+    }
+
+    #[test]
+    fn a_page_moved_between_another_files_pages_splits_its_file_and_parts_rejoin() {
+        let mut next = 100;
+        let mut new_id = || {
+            next += 1;
+            next
+        };
+        // A: pages 1-3, B: pages 1-2.
+        let list = [part(1, 1, &[0, 1, 2]), part(2, 2, &[0, 1])];
+        // A's page 3 between B's pages: A splits around B's first page.
+        let moved = moved_pages(&list, &BTreeSet::from([(1, 2)]), 4, &mut new_id).unwrap();
+        assert_eq!(moved, [part(1, 1, &[0, 1]), part(2, 2, &[0]), part(101, 1, &[2]), part(102, 2, &[1])]);
+        // Back where it was: the parts join again, under their first ids.
+        let back = moved_pages(&moved, &BTreeSet::from([(101, 0)]), 2, &mut new_id).unwrap();
+        assert_eq!(back, [part(1, 1, &[0, 1, 2]), part(2, 2, &[0, 1])]);
+        // Within a file: only its order changes.
+        let within = moved_pages(&list, &BTreeSet::from([(1, 0)]), 3, &mut new_id).unwrap();
+        assert_eq!(within, [part(1, 1, &[1, 2, 0]), part(2, 2, &[0, 1])]);
+        // Several pages carried together keep their order.
+        let both = moved_pages(&list, &BTreeSet::from([(1, 0), (1, 2)]), 5, &mut new_id).unwrap();
+        assert_eq!(both, [part(1, 1, &[1]), part(2, 2, &[0, 1]), part(103, 1, &[0, 2])]);
+        // Dropped where it is, or nothing picked: no change.
+        assert_eq!(moved_pages(&list, &BTreeSet::from([(1, 1)]), 1, &mut new_id), None);
+        assert_eq!(moved_pages(&list, &BTreeSet::from([(9, 9)]), 0, &mut new_id), None);
+        // A file that can't be split moves whole, and pages move around it.
+        let locked = [part(1, 1, &[0, 1]), Part { id: 3, group: 3, pages: None }];
+        let around = moved_pages(&locked, &BTreeSet::from([(1, 0)]), 3, &mut new_id).unwrap();
+        assert_eq!(around, [part(1, 1, &[1]), Part { id: 3, group: 3, pages: None }, part(104, 1, &[0])]);
+    }
+
+    #[test]
+    fn removing_pages_drops_emptied_parts_and_joins_what_meets() {
+        let mut next = 200;
+        let mut new_id = || {
+            next += 1;
+            next
+        };
+        // A split around B: A[1], B[1], A[2].
+        let list = [part(1, 1, &[0]), part(2, 2, &[0]), part(3, 1, &[1])];
+        // B goes: A's two parts meet and join.
+        assert_eq!(removed_pages(&list, &BTreeSet::from([(2, 0)]), &mut new_id), Some(vec![part(1, 1, &[0, 1])]));
+        // One page of a part.
+        let two = [part(1, 1, &[0, 1, 2])];
+        assert_eq!(removed_pages(&two, &BTreeSet::from([(1, 1)]), &mut new_id), Some(vec![part(1, 1, &[0, 2])]));
+        // Every page: nothing left. Repeated pages are told apart by their place.
+        assert_eq!(removed_pages(&two, &BTreeSet::from([(1, 0), (1, 1), (1, 2)]), &mut new_id), Some(Vec::new()));
+        let repeats = [part(1, 1, &[0, 0])];
+        assert_eq!(removed_pages(&repeats, &BTreeSet::from([(1, 1)]), &mut new_id), Some(vec![part(1, 1, &[0])]));
+        // A page that isn't there: nothing changes, and it says so.
+        assert_eq!(removed_pages(&two, &BTreeSet::from([(1, 9)]), &mut new_id), None);
+    }
+}
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index ba77f0d50..8ccf14562 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -37,9 +37,27 @@ pub(crate) fn mac_shortcuts(ctx: &egui::Context) -> bool {
     ctx.os() == egui::os::OperatingSystem::Mac
 }
 
-/// How `s` is written on this platform.
+/// How `s` is written on this platform, using the resolved current interface language.
 pub(crate) fn shortcut_label(ctx: &egui::Context, s: Shortcut) -> String {
-    s.label(mac_shortcuts(ctx))
+    let key = crate::i18n::key_name(s.key);
+    if mac_shortcuts(ctx) {
+        Shortcut { key, ..s }.label(true)
+    } else {
+        let mut parts = Vec::new();
+        if s.command || s.mac_ctrl {
+            parts.push(crate::i18n::key_name("Ctrl"));
+        }
+        if s.shift {
+            parts.push(crate::i18n::key_name("Shift"));
+        }
+        parts.push(key);
+        parts.join("+")
+    }
+}
+
+/// The command modifier for help text such as “Strg-scroll”; bindings stay in the engine.
+pub(crate) fn command_modifier_label(ctx: &egui::Context) -> &'static str {
+    if mac_shortcuts(ctx) { Shortcut::command_name(true) } else { crate::i18n::key_name("Ctrl") }
 }
 
 /// How a registered command's shortcut is written on this platform ("" without one).
@@ -457,6 +475,7 @@ impl PdfCraftApp {
                 }
             }
             "view.marquee_zoom" => self.quick_tool = crate::QuickTool::MarqueeZoom,
+            "edit.column_select" => self.quick_tool = crate::QuickTool::ColumnSelect,
             "edit.snapshot" => {
                 self.quick_tool = crate::QuickTool::Snapshot;
                 self.notify_tr("Drag a rectangle around the area to copy");
@@ -623,7 +642,6 @@ impl PdfCraftApp {
 
 /// Render a top-level menu's registered commands (with live labels, shortcuts and enablement).
 pub(crate) fn registry_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui, menu: &str) {
-    let mac = mac_shortcuts(ui.ctx());
     for spec in commands::menu(menu) {
         let label = commands::current_label(spec, &app.session, app.active_ids().map(|(_, id)| id));
         let label = crate::i18n::menu_label(spec.id, &label);
@@ -660,7 +678,7 @@ pub(crate) fn registry_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui, menu: &str
             }
             continue;
         }
-        let shortcut = spec.shortcut.map(|s| s.label(mac)).unwrap_or_default();
+        let shortcut = spec.shortcut.map(|s| shortcut_label(ui.ctx(), s)).unwrap_or_default();
         let enabled = app.command_enabled(spec);
         let resp = ui.add_enabled(enabled, egui::Button::new(label).shortcut_text(shortcut));
         if resp.clicked() {
@@ -670,3 +688,32 @@ pub(crate) fn registry_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui, menu: &str
     }
     let _ = widgets::menu_item;
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use egui::os::OperatingSystem;
+
+    #[test]
+    fn localized_shortcut_labels_follow_language_and_platform() {
+        let previous = crate::i18n::current();
+        let ctx = egui::Context::default();
+        for os in [OperatingSystem::Windows, OperatingSystem::Nix] {
+            ctx.set_os(os);
+            crate::i18n::set_current(crate::i18n::Lang::from_code("de").unwrap());
+            assert_eq!(shortcut_label(&ctx, Shortcut::cmd("K")), "Strg+K");
+            assert_eq!(shortcut_label(&ctx, Shortcut::cmd_shift("S")), "Strg+Umschalt+S");
+            assert_eq!(command_shortcut_label(&ctx, "view.read_mode"), "Strg+H");
+            assert_eq!(command_modifier_label(&ctx), "Strg");
+            assert_eq!(Shortcut::cmd_shift("S").label(false), "Ctrl+Shift+S", "engine/control labels keep their stable spelling");
+            crate::i18n::set_current(crate::i18n::Lang::EN);
+            assert_eq!(shortcut_label(&ctx, Shortcut::cmd_shift("S")), "Ctrl+Shift+S");
+        }
+        ctx.set_os(OperatingSystem::Mac);
+        crate::i18n::set_current(crate::i18n::Lang::from_code("de").unwrap());
+        assert_eq!(shortcut_label(&ctx, Shortcut::cmd_shift("S")), "⇧⌘S");
+        assert_eq!(command_shortcut_label(&ctx, "view.read_mode"), "⌃⌘H");
+        assert_eq!(command_modifier_label(&ctx), "⌘");
+        crate::i18n::set_current(previous);
+    }
+}
diff --git a/crates/ui-egui/src/comment_props.rs b/crates/ui-egui/src/comment_props.rs
index 023f5b7e8..11776bcaf 100644
--- a/crates/ui-egui/src/comment_props.rs
+++ b/crates/ui-egui/src/comment_props.rs
@@ -1,5 +1,5 @@
 //! Comment Properties (Acrobat: right-click a comment ▸ Properties…; audit "Comment
-//! properties"): Appearance (colour, opacity, line thickness, note icon), General (author,
+//! properties"): Appearance (colour, fill, opacity, line thickness, note icon), General (author,
 //! subject, modified) and Review History (status changes), with Acrobat's Locked box.
 
 use egui::{Align, Layout};
@@ -100,6 +100,9 @@ impl PdfCraftApp {
         if let Some(w) = p.width {
             style.width = w;
         }
+        if p.fillable && tool.has_fill() {
+            style.fill = p.fill;
+        }
         self.comment_prefs.set_style(tool, style);
         self.notify_fmt("New {tool} comments will look like this one", &[("tool", &crate::i18n::in_sentence(tl!(tool.label())))]);
     }
@@ -128,6 +131,9 @@ pub fn edits(d: &PropsDraft) -> Vec<Edit> {
     if e.restylable && (color.is_some() || opacity.is_some() || width.is_some() || endings.is_some()) {
         out.push(Edit::StyleAnnotation { page: d.page, index: d.index, color, opacity, width, endings });
     }
+    if e.restylable && e.fillable && e.fill != o.fill {
+        out.push(Edit::FillAnnotation { page: d.page, index: d.index, fill: e.fill });
+    }
     let author = (e.author != o.author).then(|| e.author.clone());
     let subject = (e.subject != o.subject).then(|| e.subject.clone());
     let icon = (e.icon != o.icon).then_some(e.icon).flatten();
@@ -194,6 +200,13 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                         e.color = Some(c);
                     }
                     ui.end_row();
+                    if e.fillable {
+                        ui.label(tl!("Fill colour"));
+                        if let Some(f) = crate::comments::fill_picker(ui, e.fill) {
+                            e.fill = f;
+                        }
+                        ui.end_row();
+                    }
                     ui.label(tl!("Opacity"));
                     let mut pct = e.opacity * 100.0;
                     if ui.add(egui::Slider::new(&mut pct, 0.0..=100.0).suffix("%")).changed() {
diff --git a/crates/ui-egui/src/comments.rs b/crates/ui-egui/src/comments.rs
index 1f195784c..bce3d18de 100644
--- a/crates/ui-egui/src/comments.rs
+++ b/crates/ui-egui/src/comments.rs
@@ -191,6 +191,11 @@ impl CommentTool {
         self.draws() || self.clicks_points()
     }
 
+    /// Whether the fill-colour control applies: shapes with an interior (#686).
+    pub fn has_fill(self) -> bool {
+        matches!(self, Self::Rectangle | Self::Oval | Self::Polygon | Self::Cloud)
+    }
+
     /// A placeholder shape of this kind (for per-tool default styles).
     fn sample(self) -> Shape {
         match self {
@@ -287,6 +292,13 @@ impl CommentPrefs {
         }
     }
 
+    /// The tool's fill (`None`: no fill). Only shapes with an interior keep one.
+    pub fn set_fill(&mut self, tool: CommentTool, fill: Option<Rgb>) {
+        if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
+            s.fill = if tool.has_fill() { fill.filter(|c| c.iter().all(|x| x.is_finite())).map(|c| c.map(|x| x.clamp(0.0, 1.0))) } else { None };
+        }
+    }
+
     pub fn set_style(&mut self, tool: CommentTool, style: Style) {
         if let Some((_, s)) = self.styles.iter_mut().find(|(t, _)| *t == tool) {
             *s = style;
@@ -521,10 +533,10 @@ fn is_markup(subtype: &str) -> bool {
     matches!(subtype, "Highlight" | "Underline" | "StrikeOut" | "Squiggly")
 }
 
-/// Rectangles, ovals, text boxes and stamps. A callout's `/Rect` also holds its leader line, so it
-/// only moves.
+/// Rectangles, ovals, text boxes, stamps and drawings (drawn signatures among them). A callout's
+/// `/Rect` also holds its leader line, so it only moves.
 fn resizable(a: &Annotation) -> bool {
-    matches!(a.subtype.as_str(), "Square" | "Circle" | "FreeText" | "Stamp") && a.intent.as_deref() != Some("FreeTextCallout")
+    matches!(a.subtype.as_str(), "Square" | "Circle" | "FreeText" | "Stamp" | "Ink") && a.intent.as_deref() != Some("FreeTextCallout")
 }
 
 const HANDLES: [(i8, i8); 8] = [(-1, -1), (0, -1), (1, -1), (1, 0), (1, 1), (0, 1), (-1, 1), (-1, 0)];
@@ -576,6 +588,7 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>,
     let page_rect = cx.xf.rect;
     let pressed_here = origin.is_some_and(|o| page_rect.contains(o));
     let over_page = pointer.is_some_and(|p| page_rect.contains(p));
+    let fill_grab = fill_grabs(ui, cx, view);
     let cv = &mut view.comments;
     if cv.gesture.is_some() && ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
         cv.gesture = None;
@@ -768,10 +781,47 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, cx: &PageCx<'_>,
             true
         }
         QuickTool::Select => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
+        QuickTool::Fill(_) if fill_grab => select_input(ui, resp, cx, view, pointer, origin, pressed_here),
         _ => false,
     }
 }
 
+/// With a Fill & Sign tool, the Fill & Sign marks already on the page are picked up as with the
+/// Select tool, as in Acrobat: hovering one shows the move cursor, a click selects it, a drag
+/// moves it and the selected one's handles resize it. Elsewhere the tool places its mark. While
+/// the button is down the press decides; otherwise the pointer (egui clears the press origin on
+/// release, so a click is located by the pointer).
+pub(crate) fn fill_grabs(ui: &egui::Ui, cx: &PageCx<'_>, view: &DocView) -> bool {
+    matches!(cx.tool, QuickTool::Fill(_)) && grabs(ui, cx, view, |a| a.fill_sign)
+}
+
+/// With the Select tool, a comment that would move (not text markup) is picked up before a form
+/// field under it, so a signature placed over a field can still be dragged off it.
+pub(crate) fn select_grabs(ui: &egui::Ui, cx: &PageCx<'_>, view: &DocView) -> bool {
+    cx.tool == QuickTool::Select && grabs(ui, cx, view, |a| !is_markup(&a.subtype))
+}
+
+/// Whether the press (or, with no button down, the pointer) is on a `pick` comment or on the
+/// selected one's resize handles.
+fn grabs(ui: &egui::Ui, cx: &PageCx<'_>, view: &DocView, pick: impl Fn(&Annotation) -> bool) -> bool {
+    if cx.hidden {
+        return false;
+    }
+    let cv = &view.comments;
+    if matches!(cv.gesture, Some(Gesture::Move { page, .. } | Gesture::Resize { page, .. }) if page == cx.page) {
+        return true;
+    }
+    let (pointer, origin, down) = ui.input(|i| (i.pointer.hover_pos(), i.pointer.press_origin(), i.pointer.any_down()));
+    let Some(p) = (if down { origin } else { pointer }).filter(|p| cx.xf.rect.contains(*p)) else { return false };
+    let on_handle = cv
+        .selected
+        .filter(|(page, _)| *page == cx.page)
+        .and_then(|(_, i)| cx.get(i))
+        .filter(|a| pick(a) && cx.allowed && resizable(a))
+        .is_some_and(|a| HANDLES.into_iter().any(|h| handle_pos(cx.screen_rect(a), h).distance(p) <= 7.0));
+    on_handle || cx.hit(p).is_some_and(pick)
+}
+
 fn clamp_to(r: Rect, p: Pos2) -> Pos2 {
     pos2(p.x.clamp(r.left(), r.right()), p.y.clamp(r.top(), r.bottom()))
 }
@@ -816,6 +866,11 @@ fn select_input(
             // On screen, the image is also turned by the view's rotation.
             let turned = !cx.xf.rot.is_multiple_of(180);
             let aspect_ratio = view.signature_drag.aspect_ratio(cx.page, a.index).map(|ratio| if turned { ratio.recip() } else { ratio });
+            // A drawn signature keeps its shape from the corners, as image signatures do.
+            let aspect_ratio = aspect_ratio.or_else(|| {
+                let r = cx.screen_rect(a);
+                (a.fill_sign && a.subtype == "Ink" && r.height() > 0.0).then(|| r.width() / r.height())
+            });
             cv.gesture = Some(Gesture::Resize { page: cx.page, index: a.index, handle: h, from: o, aspect_ratio });
             consumed = true;
         } else if let Some(a) = cx.hit(o)
@@ -917,9 +972,9 @@ pub(crate) fn page_after_text(resp: &egui::Response, cx: &PageCx<'_>, view: &mut
 pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, cx: &PageCx<'_>, view: &DocView) {
     let cv = &view.comments;
     let pointer = ui.input(|i| i.pointer.hover_pos());
-    if cx.tool == QuickTool::Select
-        && cv.gesture.is_none()
+    if cv.gesture.is_none()
         && let Some(a) = pointer.and_then(|p| cx.hit(p))
+        && (cx.tool == QuickTool::Select || matches!(cx.tool, QuickTool::Fill(_)) && a.fill_sign)
         && cv.selected != Some((cx.page, a.index))
     {
         for r in cx.screen_rects(a) {
@@ -1333,7 +1388,23 @@ pub fn swatch_grid(ui: &mut egui::Ui, current: Option<Rgb>) -> Option<Rgb> {
     picked
 }
 
-/// The comment tools' extra quick-bar controls: pin, colour, opacity and thickness.
+/// "No fill" and the colour swatches; returns the choice clicked (`Some(None)`: no fill).
+pub fn fill_picker(ui: &mut egui::Ui, current: Option<Rgb>) -> Option<Option<Rgb>> {
+    let mut picked = None;
+    ui.push_id("fill-picker", |ui| {
+        ui.vertical(|ui| {
+            if ui.selectable_label(current.is_none(), tl!("No fill")).clicked() {
+                picked = Some(None);
+            }
+            if let Some(c) = swatch_grid(ui, current) {
+                picked = Some(Some(c));
+            }
+        });
+    });
+    picked
+}
+
+/// The comment tools' extra quick-bar controls: pin, colour, fill, opacity and thickness.
 pub(crate) fn quick_bar_controls(ui: &mut egui::Ui, tool: CommentTool, prefs: &mut CommentPrefs) {
     let style = prefs.style(tool);
     if icons::button(ui, "pin", 32.0, prefs.pinned, if prefs.pinned { tl!("Keep tool selected: on") } else { tl!("Keep tool selected") }).clicked() {
@@ -1349,6 +1420,16 @@ pub(crate) fn quick_bar_controls(ui: &mut egui::Ui, tool: CommentTool, prefs: &m
             ui.close();
         }
     });
+    if tool.has_fill() {
+        let resp = fill_button(ui, style.fill);
+        egui::Popup::menu(&resp).align(egui::RectAlign::RIGHT_START).show(|ui| {
+            ui.label(egui::RichText::new(tl!("Fill colour")).font(theme::semibold(12.0)));
+            if let Some(f) = fill_picker(ui, style.fill) {
+                prefs.set_fill(tool, f);
+                ui.close();
+            }
+        });
+    }
     let resp = icons::button(ui, "blend", 32.0, false, tl!("Opacity"));
     egui::Popup::menu(&resp).align(egui::RectAlign::RIGHT_START).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
         ui.set_min_width(180.0);
@@ -1371,6 +1452,32 @@ pub(crate) fn quick_bar_controls(ui: &mut egui::Ui, tool: CommentTool, prefs: &m
     }
 }
 
+/// The quick bar's fill button: a filled square in the fill colour, or a crossed-out outline
+/// for no fill.
+fn fill_button(ui: &mut egui::Ui, fill: Option<Rgb>) -> egui::Response {
+    let (r, resp) = ui.allocate_exact_size(vec2(32.0, 32.0), Sense::click());
+    let sq = Rect::from_center_size(r.center(), vec2(16.0, 16.0));
+    let edge = Stroke::new(1.0, Color32::from_black_alpha(90));
+    match fill {
+        Some(c) => {
+            ui.painter().rect_filled(sq, 2.0, color32(c));
+        }
+        None => {
+            ui.painter().line_segment([sq.left_bottom(), sq.right_top()], Stroke::new(1.5, Color32::from_rgb(0xD3, 0x2F, 0x2F)));
+        }
+    }
+    ui.painter().rect_stroke(sq, 2.0, edge, egui::StrokeKind::Inside);
+    if resp.hovered() {
+        ui.painter().rect_stroke(r.shrink(2.0), 6.0, Stroke::new(1.0, Color32::from_black_alpha(40)), egui::StrokeKind::Inside);
+    }
+    let label = match fill {
+        Some(_) => tl!("Fill colour"),
+        None => tl!("Fill colour: none"),
+    };
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, label));
+    resp.on_hover_text(label)
+}
+
 /// Status badge icon and label for a review state name.
 pub fn status_badge(state: &str) -> Option<(&'static str, &'static str, Color32)> {
     match state {
diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 7d0f10f03..1dab43e3e 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -371,7 +371,7 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
             // Pressing a button takes the focus from the text: that is not a click away.
             let on_buttons = ui.input(|i| i.pointer.interact_pos()).is_some_and(|p| buttons.contains(p));
             cancel |= ui.input(|i| i.key_pressed(egui::Key::Escape));
-            commit = done || resp.lost_focus() && !on_buttons;
+            commit = done || resp.lost_focus() && !on_buttons && !view.objects.hold_editor;
         });
         // Page text is drawn with the standard fonts; anything else would be saved as `?` (#125).
         undrawable = self::undrawable(t, memo);
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index b335db5dc..80bfec29b 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -662,6 +662,17 @@ impl Host for crate::PdfCraftApp {
                 "selected_comment": v.comments.selected.map(|(p, i)| json!({ "page": p + 1, "index": i + 1 })),
                 "comment_composer_open": v.comments.composer.is_some(),
             })),
+            // The Combine files tab: how its files show, and each grid thumbnail's state.
+            "combine": {
+                "showing": self.combine_showing(),
+                "view": self.combine_view.as_str(),
+                "zoom": self.combine_zoom,
+                "files": self.combine_draft.iter().map(|f| f.name.clone()).collect::<Vec<_>>(),
+                "selected": self.combine_selection(),
+                "thumbnails": self.combine_thumbnails().iter().map(|t| format!("{t:?}")).collect::<Vec<_>>(),
+                "expanded": self.combine_expanded().iter().filter_map(|i| self.combine_draft.get(*i).map(|f| f.name.clone())).collect::<Vec<_>>(),
+                "preview": self.combine_preview().map(|(file, page, render)| json!({ "file": file, "page": page + 1, "render": format!("{render:?}") })),
+            },
             "quick_tool": match self.quick_tool {
                 crate::QuickTool::Measure(t) => format!("measure-{}", t.name()),
                 crate::QuickTool::Select => "select".to_string(),
@@ -675,6 +686,7 @@ impl Host for crate::PdfCraftApp {
                 crate::QuickTool::SignArea { certify: true } => "certify".to_string(),
                 crate::QuickTool::MarqueeZoom => "marquee-zoom".to_string(),
                 crate::QuickTool::Snapshot => "snapshot".to_string(),
+                crate::QuickTool::ColumnSelect => "column-select".to_string(),
                 crate::QuickTool::Stamp(k) => format!("stamp-{}", k.name().trim_start_matches("PC").to_ascii_lowercase()),
                 crate::QuickTool::CustomStamp(i) => format!("custom-stamp-{i}"),
                 crate::QuickTool::Fill(f) => format!("fill-{}", f.command().trim_start_matches("sign.fill.")),
diff --git a/crates/ui-egui/src/create_ui.rs b/crates/ui-egui/src/create_ui.rs
index 56e82d885..fedd2d64c 100644
--- a/crates/ui-egui/src/create_ui.rs
+++ b/crates/ui-egui/src/create_ui.rs
@@ -227,15 +227,15 @@ impl PdfCraftApp {
     }
 
     /// Save an optimized copy (Reduce File Size, Optimize PDF) next to the original, reporting
-    /// the saving.
+    /// the saving. A Reduce File Size copy that isn't smaller is not saved (#490).
     pub(crate) fn save_optimized(
         &mut self,
         id: pdfcraft_engine::DocId,
-        suffix: &str,
+        kind: crate::optimize_ui::OptimizeKind,
         result: Result<(Arc<Vec<u8>>, String), pdfcraft_engine::EditError>,
     ) {
         let Some(doc) = self.session.get(id) else { return };
-        let (before, name) = (doc.bytes.len(), format!("{} ({suffix}).pdf", stem(&doc.name)));
+        let (before, name) = (doc.bytes.len(), format!("{} ({}).pdf", stem(&doc.name), kind.suffix()));
         let (bytes, detail) = match result {
             Ok(r) => r,
             Err(e) => {
@@ -244,18 +244,28 @@ impl PdfCraftApp {
             }
         };
         let after = bytes.len();
-        let saved = move |app: &mut PdfCraftApp, place: String| {
-            let pct = 100.0 * (1.0 - after as f64 / before.max(1) as f64);
-            app.notify_fmt(
-                "Saved {place}: {before} → {after} ({pct}% smaller){detail}",
-                &[
-                    ("place", &place),
-                    ("before", &crate::panels::human_size(before)),
-                    ("after", &crate::panels::human_size(after)),
-                    ("pct", &format!("{pct:.0}")),
-                    ("detail", &detail),
-                ],
+        if kind == crate::optimize_ui::OptimizeKind::Reduce && after >= before {
+            self.notify_fmt(
+                "This file is already as small as it can be made ({size}). No copy was saved.",
+                &[("size", &crate::panels::human_size(before))],
             );
+            return;
+        }
+        let saved = move |app: &mut PdfCraftApp, place: String| {
+            let (b, a) = (crate::panels::human_size(before), crate::panels::human_size(after));
+            if after < before {
+                let pct = 100.0 * (1.0 - after as f64 / before.max(1) as f64);
+                app.notify_fmt(
+                    "Saved {place}: {before} → {after} ({pct}% smaller){detail}",
+                    &[("place", &place), ("before", &b), ("after", &a), ("pct", &format!("{pct:.0}")), ("detail", &detail)],
+                );
+            } else {
+                // Optimize PDF still saves: what it discards may matter more than the size.
+                app.notify_fmt(
+                    "Saved {place}: {before} → {after} (not smaller){detail}",
+                    &[("place", &place), ("before", &b), ("after", &a), ("detail", &detail)],
+                );
+            }
         };
         #[cfg(not(target_arch = "wasm32"))]
         {
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 7766b5cbf..1da3a2157 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -1036,36 +1036,37 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                     ACTUAL_SIZE, COPY, FIND_NEXT, FIND_PREV, FIT_WIDTH, PAGE_LEVEL, PAGE_NEXT, PAGE_PREV, ROTATE_CCW, ROTATE_CW, SELECT_ALL, ZOOM_IN,
                     ZOOM_OUT,
                 };
-                let mac = crate::commands::mac_shortcuts(ui.ctx());
                 // Registered commands first (always in sync with the real bindings), then the
                 // keys the document view handles itself.
                 let mut rows: Vec<(String, String)> = pdfcraft_engine::commands::COMMANDS
                     .iter()
-                    .filter_map(|c| c.shortcut.map(|k| (k.label(mac), tl!(c.label).trim_end_matches('…').to_string())))
+                    .filter_map(|c| {
+                        c.shortcut.map(|k| (crate::commands::shortcut_label(ui.ctx(), k), tl!(c.label).trim_end_matches('…').to_string()))
+                    })
                     .collect();
-                let key = |s: pdfcraft_engine::commands::Shortcut| s.label(mac);
+                let key = |s: pdfcraft_engine::commands::Shortcut| crate::commands::shortcut_label(ui.ctx(), s);
                 let pair = |a, b| format!("{} / {}", key(a), key(b));
                 // Key names, translated where a catalog has them (not scanned as UI literals).
                 let named = |k: &str| tl!(k).to_string();
                 let scroll = crate::i18n::fmt(
                     tl!("Zoom in / out (also pinch or {key}-scroll)"),
-                    &[("key", pdfcraft_engine::commands::Shortcut::command_name(mac))],
+                    &[("key", crate::commands::command_modifier_label(ui.ctx()))],
                 );
                 for (k, v) in [
                     (pair(FIND_NEXT, FIND_PREV), tl!("Next / previous match").to_string()),
                     (key(COPY), tl!("Copy selected text").to_string()),
                     (named("Double-click"), tl!("Select a word").to_string()),
-                    (named("Esc"), tl!("Clear selection / close find").to_string()),
+                    (crate::i18n::key_name("Esc").to_string(), tl!("Clear selection / close find").to_string()),
                     (key(ACTUAL_SIZE), tl!("Actual size").to_string()),
                     (key(PAGE_LEVEL), tl!("Zoom to page level").to_string()),
                     (key(FIT_WIDTH), tl!("Fit to width").to_string()),
                     (pair(ZOOM_IN, ZOOM_OUT), scroll),
                     (pair(ROTATE_CW, ROTATE_CCW), tl!("Rotate view").to_string()),
-                    (named("Home / End"), tl!("First / last page").to_string()),
+                    (format!("{} / {}", crate::i18n::key_name("Home"), crate::i18n::key_name("End")), tl!("First / last page").to_string()),
                     (format!("← / →, {}", pair(PAGE_PREV, PAGE_NEXT)), tl!("Previous / next page").to_string()),
                     (named("V"), tl!("Select (V)").to_string()),
                     (named("H / Space (hold)"), tl!("Hand (H)").to_string()),
-                    (named("Delete"), tl!("Delete selected pages (Organize)").to_string()),
+                    (crate::i18n::key_name("Delete").to_string(), tl!("Delete selected pages (Organize)").to_string()),
                     (key(SELECT_ALL), tl!("Select all pages (Organize)").to_string()),
                 ] {
                     rows.push((k, v));
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index f5d530713..556d0b387 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -81,12 +81,21 @@ pub(crate) fn extras_panel(ui: &mut egui::Ui, e: &mut Extras) -> bool {
 }
 
 impl LineEditor {
+    pub(crate) fn has_changes(&self) -> bool {
+        self.text != self.original || self.look != self.look0 || self.extras != self.extras0
+    }
+
     /// How far the box may grow to the right, when the paragraph is a single line (a multi-line
     /// paragraph rewraps to its own width and the box doesn't grow).
     pub fn growth(&self) -> Option<f32> {
         (self.max_width > self.rect.width()).then_some(self.max_width)
     }
 
+    /// Whether the edited text differs from the original (unsaved changes).
+    pub fn has_unsaved_text(&self) -> bool {
+        self.text != self.original
+    }
+
     /// The formatting the panel changed.
     pub fn style(&self) -> pdfcraft_engine::BlockStyle {
         let (l, o) = (&self.look, &self.look0);
@@ -161,6 +170,30 @@ fn color32(color: [f64; 3]) -> Color32 {
     )
 }
 
+/// The dark box behind text too pale to read on white.
+const DARK_EDITOR_FILL: Color32 = Color32::from_gray(0x26);
+
+/// WCAG relative luminance of an sRGB colour.
+fn luminance(c: Color32) -> f32 {
+    let channel = |v: u8| {
+        let v = f32::from(v) / 255.0;
+        if v <= 0.040_45 { v / 12.92 } else { ((v + 0.055) / 1.055).powf(2.4) }
+    };
+    0.2126 * channel(c.r()) + 0.7152 * channel(c.g()) + 0.0722 * channel(c.b())
+}
+
+/// WCAG contrast ratio between two colours (1 to 21).
+fn contrast(a: Color32, b: Color32) -> f32 {
+    let (la, lb) = (luminance(a), luminance(b));
+    (la.max(lb) + 0.05) / (la.min(lb) + 0.05)
+}
+
+/// The inline editor's background for text drawn in `text`: white, or a dark box when the text
+/// reads better on that (white or pale text, which would vanish on white).
+pub(crate) fn editor_fill(text: Color32) -> Color32 {
+    if contrast(text, Color32::WHITE) >= contrast(text, DARK_EDITOR_FILL) { Color32::WHITE } else { DARK_EDITOR_FILL }
+}
+
 /// A selected page image, and what the pointer is doing to it.
 #[derive(Clone, Debug, PartialEq)]
 pub struct ImageSelection {
@@ -496,7 +529,11 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
     let page = view.line_editor.as_ref()?.page;
     let xf = view.page_xform(page)?;
     let viewport_right = view.viewport_rect().right();
+    let hold = view.objects.hold_editor;
     let ed = view.line_editor.as_mut()?;
+    if hold {
+        ed.focus = true;
+    }
     // Reproject the source box every frame. The page may have been zoomed, scrolled or rotated
     // while the format panel was open.
     ed.rect = xf.user_rect(info, ed.page, ed.source_rect).expand(2.0);
@@ -520,7 +557,11 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                 }) + 8.0;
                 width = width.max(needed).min(ed.max_width);
             }
-            egui::Frame::NONE.fill(Color32::WHITE).stroke(Stroke::new(1.5, ACCENT)).inner_margin(egui::Margin::symmetric(2, 0)).show(ui, |ui| {
+            // White, unless the text is too pale to read on white (white text from a coloured
+            // banner, #913): then a dark box, with a caret that shows on it.
+            let fill = editor_fill(text_color);
+            egui::Frame::NONE.fill(fill).stroke(Stroke::new(1.5, ACCENT)).inner_margin(egui::Margin::symmetric(2, 0)).show(ui, |ui| {
+                ui.visuals_mut().text_cursor.stroke.color = if fill == Color32::WHITE { Color32::BLACK } else { Color32::WHITE };
                 let rows = ed.text.lines().count().max(1);
                 let r = ui.add(
                     egui::TextEdit::multiline(&mut ed.text)
@@ -539,7 +580,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                 let apply = ui.input(|i| i.key_pressed(egui::Key::Enter) && i.modifiers.command);
                 if esc {
                     done = Some(false);
-                } else if apply || (r.lost_focus() && !outside) {
+                } else if apply || (r.lost_focus() && !outside && !hold) {
                     done = Some(true);
                 }
             });
@@ -559,3 +600,21 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
         None => None,
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn pale_text_is_edited_on_a_dark_box() {
+        // #913: white text from a coloured banner was typed onto a white box and vanished.
+        for pale in [Color32::WHITE, Color32::from_rgb(0xFF, 0xFF, 0x00), Color32::from_gray(0xE0), Color32::from_rgb(0xFF, 0xA5, 0x00)] {
+            assert_eq!(editor_fill(pale), DARK_EDITOR_FILL, "{pale:?}");
+            assert!(contrast(pale, editor_fill(pale)) >= 4.5, "{pale:?} is readable");
+        }
+        // Ordinary dark or saturated text keeps the white box.
+        for dark in [Color32::BLACK, Color32::from_rgb(0x1F, 0x2A, 0x6B), Color32::from_rgb(0xC0, 0x00, 0x00), Color32::from_gray(0x60)] {
+            assert_eq!(editor_fill(dark), Color32::WHITE, "{dark:?}");
+        }
+    }
+}
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index f57381800..2cf6041b3 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -85,7 +85,8 @@ impl PdfCraftApp {
                 true
             }
             Err(e) => {
-                self.notify_fmt("{label} failed: {e}", &[("label", &crate::i18n::action_label(&label)), ("e", &e.to_string())]);
+                let message = if matches!(edit, Edit::MoveObjects { .. }) { crate::object_ui::move_error(&e) } else { e.to_string() };
+                self.notify_fmt("{label} failed: {e}", &[("label", &crate::i18n::action_label(&label)), ("e", &message)]);
                 false
             }
         }
@@ -349,6 +350,7 @@ impl PdfCraftApp {
             || v.content.blocked().is_some()
             || v.forms.focus.as_ref().is_some_and(|f| crate::forms_ui::draft_edit(f, &doc.form).is_some())
             || v.fill_text.as_ref().is_some_and(|t| !t.text.trim().is_empty())
+            || v.line_editor.as_ref().map_or_else(|| false, |ed| ed.has_unsaved_text())
     }
 
     /// Save the active document. Returns `true` if it was written.
@@ -403,7 +405,7 @@ impl PdfCraftApp {
         }
         #[cfg(target_arch = "wasm32")]
         {
-            let _ = (target, path);
+            let _ = path;
             if !self.flatten_fill_sign_for_save(id) {
                 return false;
             }
@@ -414,16 +416,32 @@ impl PdfCraftApp {
                     return false;
                 }
             };
-            match download(&name, &bytes) {
+            // An embedding page that asked for saves (`?host=parent`) gets the bytes; otherwise
+            // the browser downloads them.
+            let to_host = self.host_save.is_some();
+            let delivered = match &self.host_save {
+                Some(save) => save(&name, &bytes, matches!(target, SaveTarget::As)),
+                None => download(&name, &bytes),
+            };
+            match delivered {
                 Ok(()) => {
                     let _ = self.session.mark_saved(id, bytes, None);
-                    if let Some(doc) = self.session.get(id) {
-                        self.views[index].document_changed(&doc.info);
+                    if let Some(doc) = self.session.get(id)
+                        && let Some(view) = self.views.get_mut(index)
+                    {
+                        view.document_changed(&doc.info);
+                    }
+                    // The host reports where the file went (and any failure) itself.
+                    if !to_host {
+                        self.notify_fmt("Downloaded {name}", &[("name", &name)]);
                     }
-                    self.notify_fmt("Downloaded {name}", &[("name", &name)]);
                     after(self);
                     true
                 }
+                Err(e) if to_host => {
+                    self.notify_fmt("Couldn't save {name}: {e}", &[("name", &name), ("e", &e)]);
+                    false
+                }
                 Err(e) => {
                     self.notify_fmt("Couldn't download {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
                     false
@@ -603,8 +621,14 @@ impl PdfCraftApp {
         ctx.send_viewport_cmd(egui::ViewportCommand::Close);
     }
 
+    /// Publish whether any document has unsaved work, for the browser's reload warning (#812).
+    pub(crate) fn sync_unsaved_flag(&self) {
+        self.unsaved_flag.store(self.first_dirty().is_some(), std::sync::atomic::Ordering::Relaxed);
+    }
+
     /// Intercept window close while documents have unsaved changes.
     pub(crate) fn guard_quit(&mut self, ctx: &egui::Context) {
+        self.sync_unsaved_flag();
         if !ctx.input(|i| i.viewport().close_requested()) {
             return;
         }
@@ -630,6 +654,7 @@ fn comment_page(edit: &Edit) -> Option<usize> {
         | Edit::MoveAnnotation { page, .. }
         | Edit::ResizeAnnotation { page, .. }
         | Edit::StyleAnnotation { page, .. }
+        | Edit::FillAnnotation { page, .. }
         | Edit::SetAnnotationInfo { page, .. } => Some(*page),
         _ => None,
     }
@@ -972,6 +997,19 @@ mod revert_draft_tests {
         }
     }
 
+    #[test]
+    fn unsaved_flag_follows_dirty_state() {
+        use std::sync::atomic::Ordering;
+        // `guard_quit` runs every frame, also on the web, where no close request ever arrives.
+        let ctx = egui::Context::default();
+        let mut app = app();
+        app.guard_quit(&ctx);
+        assert!(!app.unsaved_flag.load(Ordering::Relaxed));
+        assert!(app.apply_edit(Edit::SetFieldValue { name: "name".into(), value: FieldValue::Text("Changed".into()) }));
+        app.guard_quit(&ctx);
+        assert!(app.unsaved_flag.load(Ordering::Relaxed));
+    }
+
     #[test]
     fn successful_revert_clears_focused_or_queued_drafts_only_on_its_document() {
         for queued in [false, true] {
diff --git a/crates/ui-egui/src/files.rs b/crates/ui-egui/src/files.rs
index 5cdd66e6f..d74233fd3 100644
--- a/crates/ui-egui/src/files.rs
+++ b/crates/ui-egui/src/files.rs
@@ -366,7 +366,7 @@ impl PdfCraftApp {
                     self.notify_fmt("{name} is too large for a word list (at most 1 MB).", &[("name", &name)]);
                     return;
                 }
-                self.redact_search.words = pdfcraft_engine::redact_word_list(&String::from_utf8_lossy(&bytes)).join("\n");
+                self.redact_search.words = pdfcraft_engine::redact_word_list(&pdfcraft_engine::decode_text(&bytes)).join("\n");
                 self.redact_search.mode = crate::redact_ui::SearchMode::Words;
             }
         }
@@ -597,6 +597,7 @@ impl PdfCraftApp {
             }
         };
         let safe = |t: &str| t.chars().map(|c| if c.is_alphanumeric() || " -_.,()".contains(c) { c } else { '_' }).collect::<String>();
+        let mut used = std::collections::HashSet::new();
         let named: Vec<(String, Arc<Vec<u8>>)> = parts
             .into_iter()
             .map(|(a, b, bytes)| {
@@ -607,7 +608,14 @@ impl PdfCraftApp {
                     None if a == b => format!("{stem} (page {a}).pdf"),
                     None => format!("{stem} (pages {a}-{b}).pdf"),
                 };
-                (name, bytes)
+                // Equal titles (or titles that sanitize alike) get (2), (3), ... so no part overwrites another; compared case-insensitively.
+                let mut unique = name.clone();
+                let mut n = 1;
+                while !used.insert(unique.to_lowercase()) {
+                    n += 1;
+                    unique = format!("{} ({n}).pdf", name.trim_end_matches(".pdf"));
+                }
+                (unique, bytes)
             })
             .collect();
         self.write_files(&named, "Choose a folder for the split files");
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/fill_sign.rs
index 27c7ee261..f7e45a8ef 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/fill_sign.rs
@@ -406,8 +406,10 @@ pub(crate) fn page_input(
     }
     match tool {
         FillTool::Text => {
-            view.fill_text = Some(TypeBox { page, at: [at[0], at[1] + TEXT_SIZE * 0.6], text: String::new(), focus: true });
-            None
+            // Clicking away from an open box commits it: the page sees this click before the box
+            // sees its lost focus, so replacing the box first would drop what was typed.
+            let open = view.fill_text.replace(TypeBox { page, at: [at[0], at[1] + TEXT_SIZE * 0.6], text: String::new(), focus: true });
+            open.filter(|tb| !tb.text.trim().is_empty()).map(|tb| FillAction::Edit(Box::new(typed(tb.page, tb.at, tb.text.trim(), author))))
         }
         FillTool::Date => Some(match date_text {
             Ok(text) => FillAction::Edit(Box::new(typed(page, [at[0], at[1] + TEXT_SIZE * 0.6], text, author))),
@@ -455,7 +457,10 @@ pub(crate) fn type_box(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
     let mut cancel = false;
     egui::Area::new(egui::Id::new(("fill-text", view.id.0))).order(egui::Order::Foreground).fixed_pos(pos).show(ctx, |ui| {
         let Some(t) = view.fill_text.as_mut() else { return };
-        let width = ((t.text.len().max(8) as f32) * TEXT_SIZE as f32 * 0.6 * zoom).clamp(60.0, 600.0);
+        let width = ((t.text.chars().count().max(8) as f32) * TEXT_SIZE as f32 * 0.6 * zoom).clamp(60.0, 600.0);
+        // The area's max rect is last frame's size, which caps the edit's width; widen it so the
+        // box grows as text is typed.
+        ui.set_min_width(width);
         let r = ui.add(
             egui::TextEdit::singleline(&mut t.text)
                 .font(egui::FontId::proportional((TEXT_SIZE as f32 * zoom).max(8.0)))
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 01f86029e..48d5baf08 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -29,6 +29,9 @@
 	Preferences	التفضيلات
 	Preferences…	التفضيلات…
 	Interface language	لغة الواجهة
+	Interface size	حجم الواجهة
+	Auto ({percent}%)	تلقائي ({percent}%)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	يتبع الوضع التلقائي حجم النص في النظام. تُعرض الصفحات دائمًا بالدقة الكاملة للشاشة.
 	Identity	الهوية
 	Name on new comments	الاسم على التعليقات الجديدة
 	Open…	فتح…
@@ -74,6 +77,7 @@
 	Fit visible	ملاءمة المرئي
 	Marquee zoom	تكبير بالتحديد
 	Take a snapshot	التقاط لقطة
+	Column select	تحديد عمود
 	Full screen mode	وضع ملء الشاشة
 	Read mode	وضع القراءة
 	Switch light / dark theme	التبديل بين السمة الفاتحة والداكنة
@@ -1094,6 +1098,7 @@
 	Dates	التواريخ
 	Text in images isn't found; recognise text (OCR) first.	النص داخل الصور لا يُعثر عليه؛ استخدم التعرف على النص (OCR) أولًا.
 	No matches.	لا توجد تطابقات.
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	بعض الإشارات المرجعية غير معروضة هنا: تعرض اللوحة عددًا محدودًا منها، وبعمق تداخل محدود.
 	{n} match(es) marked for redaction.	عُلِّم {n} تطابق للحجب.
 	Multiple words or phrases	كلمات أو عبارات متعددة
 	One word or phrase per line	كلمة أو عبارة واحدة في كل سطر
@@ -1496,6 +1501,8 @@
 	Right Edge	الحافة اليمنى
 	Language	اللغة
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	تم الحفظ {place}: {before} → {after} (أصغر بنسبة {pct}%){detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	هذا الملف صغير بالفعل قدر الإمكان ({size}). لم تُحفظ أي نسخة.
+	Saved {place}: {before} → {after} (not smaller){detail}	تم الحفظ {place}: {before} → {after} (ليس أصغر){detail}
 	Couldn't save the image: {e}	تعذّر حفظ الصورة: {e}
 	Adding images arrives on the web with file pickers for images	إضافة الصور ستتوفر على الويب مع منتقيات ملفات الصور
 	Replacing images on page {p} arrives on the web with image pickers ({i})	استبدال الصور في الصفحة {p} سيتوفر على الويب مع منتقيات الصور ({i})
@@ -2163,6 +2170,44 @@ certificate	Subject	صاحب الشهادة
 	A selected field has no widget on any page, so the fields can't be edited together.	أحد الحقول المحددة ليس له عنصر واجهة في أي صفحة، لذا لا يمكن تحرير الحقول معًا.
 	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	التعرف على النص غير مثبت: نماذجه مفقودة (شغّل `cargo xtask models`، أو اضبط PDFCRAFT_MODELS).
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} بدقة {dpi} dpi، وهي أكبر دقة يمكن رسمها بها)
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	تم تحديد {n} عنصر|تم تحديد {n} عنصر|تم تحديد {n} عنصرين|تم تحديد {n} عناصر|تم تحديد {n} عنصرًا|تم تحديد {n} عنصر
+	Drag the selection to move it. Esc clears the selection.	اسحب التحديد لنقله. يمسح Esc التحديد.
+	Shift-click to select several objects. Drag empty space to select an area.	انقر مع الضغط على Shift لتحديد عدة عناصر. اسحب في مساحة فارغة لتحديد منطقة.
+	Select at most 1000 objects at a time.	حدد 1000 عنصر كحد أقصى في المرة الواحدة.
+	Finish or discard the text being edited before selecting several objects.	أكمل تحرير النص أو تجاهله قبل تحديد عدة عناصر.
+	Move object	نقل عنصر
+	Move objects	نقل عناصر
+	Vertical text cannot be moved with this selection.	لا يمكن نقل النص العمودي مع هذا التحديد.
+	Text used as a clipping path cannot be moved with this selection.	لا يمكن نقل النص المستخدم كمسار قص مع هذا التحديد.
+	These objects could not be moved. Select them again and try a smaller move.	تعذر نقل هذه العناصر. حددها مجددًا وحاول نقلها بمسافة أقل.
+	This page contains objects that cannot be selected together.	تحتوي هذه الصفحة على عناصر لا يمكن تحديدها معًا.
+	Fill colour	لون التعبئة
+	No fill	بلا تعبئة
+	Fill colour: none	لون التعبئة: بلا
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	مسافة
+	Grid view	عرض الشبكة
+	List view	عرض القائمة
+	Files are combined in the order shown. Drag them to change it.	تُدمج الملفات بالترتيب المعروض. اسحبها لتغيير الترتيب.
+	Preview unavailable: {e}	المعاينة غير متاحة: {e}
+	Pages: {k} of {n}	الصفحات: {k} من {n}
+	Check the pages	تحقق من الصفحات
+	Switch to List view to change the pages it takes.	انتقل إلى عرض القائمة لتغيير الصفحات التي يأخذها.
+	Expand all	توسيع الكل
+	Collapse all	طي الكل
+	Remove page	إزالة الصفحة
+	Remove {n} pages	إزالة {n} صفحات
+
+# Shared panel docking
 	Reset panel layout	إعادة تعيين تخطيط اللوحات
 	Float panel	تعويم اللوحة
 	Move to group	نقل إلى مجموعة
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 42088e074..5c514ac7c 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -55,6 +55,9 @@
 	Preferences	Настройки
 	Preferences…	Настройки…
 	Interface language	Език на интерфейса
+	Interface size	Размер на интерфейса
+	Auto ({percent}%)	Автоматично ({percent}%)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	Автоматично следва размера на текста в системата. Страниците винаги се изобразяват с пълната разделителна способност на екрана.
 	Identity	Самоличност
 	Name on new comments	Име в новите коментари
 	Open…	Отвори…
@@ -109,6 +112,7 @@
 	Rotate view clockwise	Завърти изгледа по часовниковата стрелка
 	Rotate view counterclockwise	Завърти изгледа обратно на часовниковата стрелка
 	Take a snapshot	Направи моментна снимка
+	Column select	Избор на колона
 	Full screen mode	Цял екран
 	Read mode	Режим на четене
 	Switch light / dark theme	Превключи светла / тъмна тема
@@ -786,6 +790,7 @@
 	Dates	Дати
 	Text in images isn't found; recognise text (OCR) first.	Текстът в изображения не се открива; първо разпознайте текста (OCR).
 	No matches.	Няма съвпадения.
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	Някои отметки не са показани тук: панелът показва ограничен брой, с ограничена дълбочина на влагане.
 	{n} match(es) marked for redaction.	{n} съвпадение(я) маркирани за заличаване.
 	Multiple words or phrases	Няколко думи или фрази
 	One word or phrase per line	По една дума или фраза на ред
@@ -1448,6 +1453,8 @@
 	Right Edge	Десен ръб
 	Language	Език
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Записано {place}: {before} → {after} (с {pct}% по-малко){detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	Файлът вече е възможно най-малък ({size}). Не е записано копие.
+	Saved {place}: {before} → {after} (not smaller){detail}	Записано {place}: {before} → {after} (не е по-малко){detail}
 	Couldn't save the image: {e}	Изображението не можа да бъде записано: {e}
 	Adding images arrives on the web with file pickers for images	Добавянето на изображения в уеб версията ще стане достъпно с инструментите за избор на файлове с изображения
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Замяната на изображения на страница {p} в уеб версията ще стане достъпна с инструментите за избор на изображения ({i})
@@ -2103,17 +2110,44 @@ action wizard	Start	Старт
 	The field {name} no longer exists.	Полето {name} вече не съществува.
 	A selected field has no widget on any page, so the fields can't be edited together.	Едно от избраните полета няма елемент на нито една страница, затова полетата не могат да се редактират заедно.
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} с {dpi} dpi, най-голямата резолюция, с която могат да бъдат изобразени)
-	Zoom out (⌘−)	Намали мащаба (⌘−)
-	Zoom in (⌘+)	Увеличи мащаба (⌘+)
-	Rotate view clockwise (⇧⌘+)	Завърти изгледа по часовниковата стрелка (⇧⌘+)
-	Open a PDF (⌘O)	Отвори PDF файл (⌘O)
-	Print (⌘P)	Печат (⌘P)
-	Document properties (⌘D)	Свойства на документа (⌘D)
-	New bookmark (⌘B)	Нова отметка (⌘B)
-	Previous (⇧⌘G)	Предишно (⇧⌘G)
-	Next (⌘G)	Следващо (⌘G)
-	Zoom in / out (also pinch or ⌘-scroll)	Увеличи / намали (също с щипване или ⌘ + превъртане)
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Разпознаването на текст не е инсталирано: моделите му липсват (изпълнете `cargo xtask models` или задайте PDFCRAFT_MODELS).
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	Избран е {n} обект|Избрани са {n} обекта
+	Drag the selection to move it. Esc clears the selection.	Плъзнете избраното, за да го преместите. Esc премахва избора.
+	Shift-click to select several objects. Drag empty space to select an area.	Щракнете с Shift, за да изберете няколко обекта. Плъзнете в празно място, за да изберете област.
+	Select at most 1000 objects at a time.	Изберете най-много 1000 обекта наведнъж.
+	Finish or discard the text being edited before selecting several objects.	Завършете или отменете редактирането на текста, преди да изберете няколко обекта.
+	Move object	Преместване на обект
+	Move objects	Преместване на обекти
+	Vertical text cannot be moved with this selection.	Вертикалният текст не може да се премести с този избор.
+	Text used as a clipping path cannot be moved with this selection.	Текстът, използван като изрязващ контур, не може да се премести с този избор.
+	These objects could not be moved. Select them again and try a smaller move.	Тези обекти не можаха да бъдат преместени. Изберете ги отново и опитайте по-малко отместване.
+	This page contains objects that cannot be selected together.	Тази страница съдържа обекти, които не могат да се изберат заедно.
+	Fill colour	Цвят на запълване
+	No fill	Без запълване
+	Fill colour: none	Цвят на запълване: няма
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	Интервал
+	Grid view	Изглед мрежа
+	List view	Изглед списък
+	Files are combined in the order shown. Drag them to change it.	Файловете се обединяват в показания ред. Плъзнете ги, за да го промените.
+	Preview unavailable: {e}	Няма преглед: {e}
+	Pages: {k} of {n}	Страници: {k} от {n}
+	Check the pages	Проверете страниците
+	Switch to List view to change the pages it takes.	Превключете към изглед списък, за да промените кои страници се вземат.
+	Expand all	Разгъни всички
+	Collapse all	Свий всички
+	Remove page	Премахни страницата
+	Remove {n} pages	Премахни {n} страници
+
+# Shared panel docking
 	Reset panel layout	Възстанови оформлението на панелите
 	Float panel	Откачи панела
 	Move to group	Премести в група
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 691861fcb..0d4741fab 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -24,6 +24,9 @@
 	Preferences	Předvolby
 	Preferences…	Předvolby…
 	Interface language	Jazyk rozhraní
+	Interface size	Velikost rozhraní
+	Auto ({percent}%)	Automaticky ({percent} %)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	Automaticky se řídí velikostí textu v systému. Stránky se vždy vykreslují v plném rozlišení displeje.
 	Identity	Identita
 	Name on new comments	Jméno autora nových komentářů
 	Enable Acrobat JavaScript	Povolit Acrobat JavaScript
@@ -51,6 +54,8 @@
 	Document properties…	Vlastnosti dokumentu…
 	Export to image…	Exportovat jako obrázek…
 	Reduce file size…	Zmenšit velikost souboru…
+	This file is already as small as it can be made ({size}). No copy was saved.	Soubor je už tak malý, jak to jde ({size}). Žádná kopie nebyla uložena.
+	Saved {place}: {before} → {after} (not smaller){detail}	Uloženo {place}: {before} → {after} (není menší){detail}
 	Optimize PDF…	Optimalizovat PDF…
 	Export to text…	Exportovat jako text…
 	Export to Word…	Exportovat do formátu Word…
@@ -65,6 +70,7 @@
 	Find…	Najít…
 	Advanced search…	Rozšířené hledání…
 	Take a snapshot	Pořídit snímek
+	Column select	Výběr sloupce
 	Clear form	Vymazat formulář
 	Copy pages	Kopírovat stránky
 	Cut pages	Vyjmout stránky
@@ -145,6 +151,29 @@
 	Import list…	Importovat seznam…
 	{n} word(s) or phrase(s)	Slova nebo fráze: {n}
 	{name} is too large for a word list (at most 1 MB).	{name} je pro seznam slov příliš velký (nejvýše 1 MB).
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	Vybrán {n} objekt|Vybrány {n} objekty|Vybráno {n} objektů
+	Drag the selection to move it. Esc clears the selection.	Přetažením výběr přesunete. Esc zruší výběr.
+	Shift-click to select several objects. Drag empty space to select an area.	Kliknutím se Shiftem vyberete více objektů. Tažením v prázdném místě vyberete oblast.
+	Select at most 1000 objects at a time.	Vyberte nejvýše 1000 objektů najednou.
+	Finish or discard the text being edited before selecting several objects.	Před výběrem více objektů dokončete nebo zahoďte úpravu textu.
+	Move object	Přesunout objekt
+	Move objects	Přesunout objekty
+	Vertical text cannot be moved with this selection.	Svislý text nelze přesunout s tímto výběrem.
+	Text used as a clipping path cannot be moved with this selection.	Text použitý jako ořezová cesta nelze přesunout s tímto výběrem.
+	These objects could not be moved. Select them again and try a smaller move.	Tyto objekty se nepodařilo přesunout. Vyberte je znovu a zkuste menší posun.
+	This page contains objects that cannot be selected together.	Tato stránka obsahuje objekty, které nelze vybrat společně.
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	Mezerník
+
+# Shared panel docking
 	Reset panel layout	Obnovit rozložení panelů
 	Float panel	Uvolnit panel
 	Move to group	Přesunout do skupiny
@@ -153,5 +182,3 @@
 	Resize panel window	Změnit velikost okna panelu
 	Tools	Nástroje
 	Inspector	Inspektor
-	Document	Dokument
-	Close panel	Zavřít panel
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 114a18c53..ee07c925d 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -18,6 +18,9 @@
 	Preferences	Einstellungen
 	Preferences…	Einstellungen…
 	Interface language	Sprache der Oberfläche
+	Interface size	Größe der Oberfläche
+	Auto ({percent}%)	Automatisch ({percent} %)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	Automatisch folgt der Textgröße des Systems. Seiten werden immer in der vollen Auflösung des Bildschirms dargestellt.
 	Identity	Identität
 	Name on new comments	Name für neue Kommentare
 	Open…	Öffnen…
@@ -44,6 +47,7 @@
 	Fit visible	Sichtbaren Inhalt einpassen
 	Marquee zoom	Auswahlrahmen-Zoom
 	Take a snapshot	Schnappschuss erstellen
+	Column select	Spaltenauswahl
 	Full screen mode	Vollbildmodus
 	Read mode	Lesemodus
 	Switch light / dark theme	Helles / dunkles Design umschalten
@@ -1075,6 +1079,7 @@
 	Dates	Datumsangaben
 	Text in images isn't found; recognise text (OCR) first.	Text in Bildern wird nicht gefunden; führe zuerst Text erkennen (OCR) aus.
 	No matches.	Keine Treffer.
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	Einige Lesezeichen werden hier nicht angezeigt: Das Fenster listet nur eine begrenzte Anzahl bis zu einer begrenzten Tiefe auf.
 	{n} match(es) marked for redaction.	{n} Treffer zum Schwärzen markiert.
 	Multiple words or phrases	Mehrere Wörter oder Ausdrücke
 	One word or phrase per line	Ein Wort oder Ausdruck pro Zeile
@@ -1476,6 +1481,8 @@
 	Right Edge	Rechter Rand
 	Language	Sprache
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	{place} gespeichert: {before} → {after} ({pct} % kleiner){detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	Diese Datei ist bereits so klein wie möglich ({size}). Es wurde keine Kopie gespeichert.
+	Saved {place}: {before} → {after} (not smaller){detail}	{place} gespeichert: {before} → {after} (nicht kleiner){detail}
 	Couldn't save the image: {e}	Das Bild konnte nicht gespeichert werden: {e}
 	Adding images arrives on the web with file pickers for images	Bilder hinzufügen kommt im Web zusammen mit der Bildauswahl
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Bilder auf Seite {p} ersetzen kommt im Web zusammen mit der Bildauswahl ({i})
@@ -2141,17 +2148,44 @@ action wizard	Start	Starten
 	The field {name} no longer exists.	Das Feld {name} existiert nicht mehr.
 	A selected field has no widget on any page, so the fields can't be edited together.	Ein ausgewähltes Feld hat auf keiner Seite ein Widget, daher können die Felder nicht gemeinsam bearbeitet werden.
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} mit {dpi} dpi, der größten Auflösung, in der sie gezeichnet werden können)
-	Zoom in / out (also pinch or ⌘-scroll)	Vergrößern / Verkleinern (auch per Pinch-Geste oder ⌘ + Scrollen)
-	Open a PDF (⌘O)	PDF öffnen (⌘O)
-	Print (⌘P)	Drucken (⌘P)
-	Document properties (⌘D)	Dokumenteigenschaften (⌘D)
-	Zoom out (⌘−)	Verkleinern (⌘−)
-	Zoom in (⌘+)	Vergrößern (⌘+)
-	Rotate view clockwise (⇧⌘+)	Ansicht im Uhrzeigersinn drehen (⇧⌘+)
-	New bookmark (⌘B)	Neues Lesezeichen (⌘B)
-	Previous (⇧⌘G)	Vorheriger (⇧⌘G)
-	Next (⌘G)	Nächster (⌘G)
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Die Texterkennung ist nicht installiert, ihre Modelle fehlen (führe `cargo xtask models` aus oder setze PDFCRAFT_MODELS).
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	{n} Objekt ausgewählt|{n} Objekte ausgewählt
+	Drag the selection to move it. Esc clears the selection.	Ziehen Sie die Auswahl, um sie zu verschieben. Esc hebt die Auswahl auf.
+	Shift-click to select several objects. Drag empty space to select an area.	Mit Umschalt-Klick mehrere Objekte auswählen. Ziehen Sie in einem leeren Bereich, um einen Auswahlrahmen aufzuziehen.
+	Select at most 1000 objects at a time.	Wählen Sie höchstens 1000 Objekte gleichzeitig aus.
+	Finish or discard the text being edited before selecting several objects.	Schließen Sie die Textbearbeitung ab oder verwerfen Sie sie, bevor Sie mehrere Objekte auswählen.
+	Move object	Objekt verschieben
+	Move objects	Objekte verschieben
+	Vertical text cannot be moved with this selection.	Vertikaler Text kann mit dieser Auswahl nicht verschoben werden.
+	Text used as a clipping path cannot be moved with this selection.	Text, der als Beschneidungspfad dient, kann mit dieser Auswahl nicht verschoben werden.
+	These objects could not be moved. Select them again and try a smaller move.	Diese Objekte konnten nicht verschoben werden. Wählen Sie sie erneut aus und versuchen Sie eine kleinere Verschiebung.
+	This page contains objects that cannot be selected together.	Diese Seite enthält Objekte, die nicht gemeinsam ausgewählt werden können.
+	Fill colour	Füllfarbe
+	No fill	Keine Füllung
+	Fill colour: none	Füllfarbe: keine
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Strg
+key	Shift	Umschalt
+key	Delete	Entf
+key	Esc	Esc
+key	Home	Pos1
+key	End	Ende
+key	Space	Leertaste
+	Grid view	Rasteransicht
+	List view	Listenansicht
+	Files are combined in the order shown. Drag them to change it.	Dateien werden in der gezeigten Reihenfolge kombiniert. Zieh sie, um sie zu ändern.
+	Preview unavailable: {e}	Keine Vorschau: {e}
+	Pages: {k} of {n}	Seiten: {k} von {n}
+	Check the pages	Prüfe die Seiten
+	Switch to List view to change the pages it takes.	Wechsle zur Listenansicht, um die übernommenen Seiten zu ändern.
+	Expand all	Alle ausklappen
+	Collapse all	Alle einklappen
+	Remove page	Seite entfernen
+	Remove {n} pages	{n} Seiten entfernen
+
+# Shared panel docking
 	Reset panel layout	Bereichsanordnung zurücksetzen
 	Float panel	Bereich frei platzieren
 	Move to group	In Gruppe verschieben
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 167e08aeb..c7cced68b 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -18,6 +18,9 @@
 	Preferences	Preferencias
 	Preferences…	Preferencias…
 	Interface language	Idioma de la interfaz
+	Interface size	Tamaño de la interfaz
+	Auto ({percent}%)	Automático ({percent} %)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	Automático sigue el tamaño del texto del sistema. Las páginas siempre se muestran con la resolución completa de la pantalla.
 	Identity	Identidad
 	Name on new comments	Nombre en los comentarios nuevos
 	Open…	Abrir…
@@ -67,6 +70,7 @@
 	Fit visible	Ajustar al contenido visible
 	Marquee zoom	Zoom por selección
 	Take a snapshot	Tomar una instantánea
+	Column select	Selección de columna
 	Full screen mode	Modo de pantalla completa
 	Read mode	Modo de lectura
 	Switch light / dark theme	Cambiar entre tema claro y oscuro
@@ -1088,6 +1092,7 @@
 	Dates	Fechas
 	Text in images isn't found; recognise text (OCR) first.	El texto de las imágenes no se encuentra; reconoce antes el texto (OCR).
 	No matches.	Sin coincidencias.
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	Algunos marcadores no se muestran aquí: el panel muestra un número limitado, con una profundidad de anidación limitada.
 	{n} match(es) marked for redaction.	{n} coincidencia(s) marcada(s) para censurar.
 	Multiple words or phrases	Varias palabras o frases
 	One word or phrase per line	Una palabra o frase por línea
@@ -1490,6 +1495,8 @@
 	Right Edge	Borde derecho
 	Language	Idioma
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Guardado {place}: {before} → {after} ({pct}% más pequeño){detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	Este archivo ya es lo más pequeño posible ({size}). No se guardó ninguna copia.
+	Saved {place}: {before} → {after} (not smaller){detail}	Guardado {place}: {before} → {after} (no es más pequeño){detail}
 	Couldn't save the image: {e}	No se pudo guardar la imagen: {e}
 	Adding images arrives on the web with file pickers for images	Añadir imágenes llegará a la versión web con los selectores de archivos de imagen
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Reemplazar imágenes en la página {p} llegará a la versión web con los selectores de imagen ({i})
@@ -2057,17 +2064,44 @@
 	The field {name} no longer exists.	El campo {name} ya no existe.
 	A selected field has no widget on any page, so the fields can't be edited together.	Un campo seleccionado no tiene ningún widget en ninguna página, así que los campos no se pueden editar juntos.
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} a {dpi} ppp, el mayor tamaño al que se pueden dibujar)
-	Zoom in / out (also pinch or ⌘-scroll)	Acercar / alejar (también con pellizco o ⌘ + desplazamiento)
-	Open a PDF (⌘O)	Abrir un PDF (⌘O)
-	Print (⌘P)	Imprimir (⌘P)
-	Document properties (⌘D)	Propiedades del documento (⌘D)
-	Zoom out (⌘−)	Alejar (⌘−)
-	Zoom in (⌘+)	Acercar (⌘+)
-	Rotate view clockwise (⇧⌘+)	Girar la vista a la derecha (⇧⌘+)
-	New bookmark (⌘B)	Nuevo marcador (⌘B)
-	Previous (⇧⌘G)	Anterior (⇧⌘G)
-	Next (⌘G)	Siguiente (⌘G)
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	El reconocimiento de texto no está instalado: faltan sus modelos (ejecuta `cargo xtask models` o define PDFCRAFT_MODELS).
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	{n} objeto seleccionado|{n} objetos seleccionados
+	Drag the selection to move it. Esc clears the selection.	Arrastra la selección para moverla. Esc borra la selección.
+	Shift-click to select several objects. Drag empty space to select an area.	Pulsa Mayús y haz clic para seleccionar varios objetos. Arrastra en un espacio vacío para seleccionar un área.
+	Select at most 1000 objects at a time.	Selecciona como máximo 1000 objetos a la vez.
+	Finish or discard the text being edited before selecting several objects.	Termina o descarta la edición del texto antes de seleccionar varios objetos.
+	Move object	Mover objeto
+	Move objects	Mover objetos
+	Vertical text cannot be moved with this selection.	El texto vertical no se puede mover con esta selección.
+	Text used as a clipping path cannot be moved with this selection.	El texto usado como trazado de recorte no se puede mover con esta selección.
+	These objects could not be moved. Select them again and try a smaller move.	No se pudieron mover estos objetos. Vuelve a seleccionarlos e intenta un desplazamiento menor.
+	This page contains objects that cannot be selected together.	Esta página contiene objetos que no se pueden seleccionar juntos.
+	Fill colour	Color de relleno
+	No fill	Sin relleno
+	Fill colour: none	Color de relleno: ninguno
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Mayús
+key	Delete	Supr
+key	Esc	Esc
+key	Home	Inicio
+key	End	Fin
+key	Space	Espacio
+	Grid view	Vista de cuadrícula
+	List view	Vista de lista
+	Files are combined in the order shown. Drag them to change it.	Los archivos se combinan en el orden mostrado. Arrástralos para cambiarlo.
+	Preview unavailable: {e}	Vista previa no disponible: {e}
+	Pages: {k} of {n}	Páginas: {k} de {n}
+	Check the pages	Revisa las páginas
+	Switch to List view to change the pages it takes.	Cambia a la vista de lista para cambiar las páginas que se incluyen.
+	Expand all	Expandir todo
+	Collapse all	Contraer todo
+	Remove page	Quitar página
+	Remove {n} pages	Quitar {n} páginas
+
+# Shared panel docking
 	Reset panel layout	Restablecer disposición de paneles
 	Float panel	Hacer flotante el panel
 	Move to group	Mover al grupo
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index e3c5c1c0c..79cda906e 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -18,6 +18,9 @@
 	Preferences	Préférences
 	Preferences…	Préférences…
 	Interface language	Langue de l'interface
+	Interface size	Taille de l'interface
+	Auto ({percent}%)	Automatique ({percent} %)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	Automatique suit la taille du texte du système. Les pages sont toujours rendues à la pleine résolution de l'écran.
 	Identity	Identité
 	Name on new comments	Nom sur les nouveaux commentaires
 	Open…	Ouvrir…
@@ -44,6 +47,7 @@
 	Fit visible	Ajuster au contenu visible
 	Marquee zoom	Zoom par sélection
 	Take a snapshot	Prendre un instantané
+	Column select	Sélection de colonne
 	Full screen mode	Mode plein écran
 	Read mode	Mode lecture
 	Switch light / dark theme	Basculer entre les thèmes clair et sombre
@@ -1074,6 +1078,7 @@
 	Dates	Dates
 	Text in images isn't found; recognise text (OCR) first.	Le texte dans les images n'est pas trouvé ; reconnaissez d'abord le texte (OCR).
 	No matches.	Aucune correspondance.
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	Certains signets ne sont pas affichés ici : le panneau en liste un nombre limité, sur une profondeur limitée.
 	{n} match(es) marked for redaction.	{n} correspondance(s) marquée(s) pour biffure.
 	Multiple words or phrases	Plusieurs mots ou expressions
 	One word or phrase per line	Un mot ou une expression par ligne
@@ -1475,6 +1480,8 @@
 	Right Edge	Bord droit
 	Language	Langue
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Enregistré {place} : {before} → {after} ({pct} % plus petit){detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	Ce fichier est déjà aussi petit que possible ({size}). Aucune copie n'a été enregistrée.
+	Saved {place}: {before} → {after} (not smaller){detail}	Enregistré {place} : {before} → {after} (pas plus petit){detail}
 	Couldn't save the image: {e}	Impossible d'enregistrer l'image : {e}
 	Adding images arrives on the web with file pickers for images	L'ajout d'images arrivera sur le web avec les sélecteurs de fichiers d'images
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Le remplacement d'images à la page {p} arrivera sur le web avec les sélecteurs d'images ({i})
@@ -2141,17 +2148,44 @@ signature pad	Type	Saisir
 	The field {name} no longer exists.	Le champ {name} n'existe plus.
 	A selected field has no widget on any page, so the fields can't be edited together.	Un champ sélectionné n'a de widget sur aucune page : les champs ne peuvent pas être modifiés ensemble.
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} à {dpi} ppp, la plus grande taille possible pour les dessiner)
-	Zoom in / out (also pinch or ⌘-scroll)	Zoom avant / arrière (aussi pincer ou ⌘-défilement)
-	Open a PDF (⌘O)	Ouvrir un PDF (⌘O)
-	Print (⌘P)	Imprimer (⌘P)
-	Document properties (⌘D)	Propriétés du document (⌘D)
-	Zoom out (⌘−)	Zoom arrière (⌘−)
-	Zoom in (⌘+)	Zoom avant (⌘+)
-	Rotate view clockwise (⇧⌘+)	Pivoter l'affichage vers la droite (⇧⌘+)
-	New bookmark (⌘B)	Nouveau signet (⌘B)
-	Previous (⇧⌘G)	Précédent (⇧⌘G)
-	Next (⌘G)	Suivant (⌘G)
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	La reconnaissance de texte n'est pas installée : ses modèles sont absents (exécutez `cargo xtask models`, ou définissez PDFCRAFT_MODELS).
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	{n} objet sélectionné|{n} objets sélectionnés
+	Drag the selection to move it. Esc clears the selection.	Faites glisser la sélection pour la déplacer. Échap annule la sélection.
+	Shift-click to select several objects. Drag empty space to select an area.	Maj-clic pour sélectionner plusieurs objets. Faites glisser dans un espace vide pour sélectionner une zone.
+	Select at most 1000 objects at a time.	Sélectionnez au maximum 1000 objets à la fois.
+	Finish or discard the text being edited before selecting several objects.	Terminez ou abandonnez la modification du texte avant de sélectionner plusieurs objets.
+	Move object	Déplacer un objet
+	Move objects	Déplacer des objets
+	Vertical text cannot be moved with this selection.	Le texte vertical ne peut pas être déplacé avec cette sélection.
+	Text used as a clipping path cannot be moved with this selection.	Le texte utilisé comme chemin de découpe ne peut pas être déplacé avec cette sélection.
+	These objects could not be moved. Select them again and try a smaller move.	Ces objets n’ont pas pu être déplacés. Sélectionnez-les à nouveau et essayez un déplacement plus petit.
+	This page contains objects that cannot be selected together.	Cette page contient des objets qui ne peuvent pas être sélectionnés ensemble.
+	Fill colour	Couleur de fond
+	No fill	Sans fond
+	Fill colour: none	Couleur de fond : aucune
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Maj
+key	Delete	Suppr
+key	Esc	Échap
+key	Home	Début
+key	End	Fin
+key	Space	Espace
+	Grid view	Vue en grille
+	List view	Vue en liste
+	Files are combined in the order shown. Drag them to change it.	Les fichiers sont combinés dans l'ordre affiché. Faites-les glisser pour le modifier.
+	Preview unavailable: {e}	Aperçu indisponible : {e}
+	Pages: {k} of {n}	Pages : {k} sur {n}
+	Check the pages	Vérifiez les pages
+	Switch to List view to change the pages it takes.	Passez à la vue en liste pour modifier les pages prises.
+	Expand all	Tout développer
+	Collapse all	Tout réduire
+	Remove page	Retirer la page
+	Remove {n} pages	Retirer {n} pages
+
+# Shared panel docking
 	Reset panel layout	Réinitialiser la disposition des panneaux
 	Float panel	Détacher le panneau
 	Move to group	Déplacer vers un groupe
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 9d5d23131..7fb60fb4b 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -18,6 +18,9 @@
 	Preferences	Beállítások
 	Preferences…	Beállítások…
 	Interface language	Felület nyelve
+	Interface size	Felület mérete
+	Auto ({percent}%)	Automatikus ({percent}%)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	Az Automatikus beállítás a rendszer szövegméretét követi. Az oldalak mindig a kijelző teljes felbontásában jelennek meg.
 	Identity	Személyazonosság
 	Name on new comments	Név az új megjegyzéseken
 	Open…	Megnyitás…
@@ -44,6 +47,7 @@
 	Fit visible	Látható tartalomhoz igazítás
 	Marquee zoom	Kijelölő nagyítás
 	Take a snapshot	Pillanatkép
+	Column select	Oszlopkijelölés
 	Full screen mode	Teljes képernyő
 	Read mode	Olvasási mód
 	Switch light / dark theme	Világos / sötét téma váltása
@@ -1064,6 +1068,7 @@
 	Dates	Dátumok
 	Text in images isn't found; recognise text (OCR) first.	A képekben lévő szöveg nem található meg; előbb futtass szövegfelismerést (OCR).
 	No matches.	Nincs találat.
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	Néhány könyvjelző itt nem látható: a panel korlátozott számút és korlátozott mélységig sorol fel.
 	{n} match(es) marked for redaction.	{n} találat megjelölve kitakarásra.
 	Multiple words or phrases	Több szó vagy kifejezés
 	One word or phrase per line	Soronként egy szó vagy kifejezés
@@ -1465,6 +1470,8 @@
 	Right Edge	Jobb szél
 	Language	Nyelv
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Mentve ide: {place}: {before} → {after} ({pct}%-kal kisebb){detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	Ez a fájl már a lehető legkisebb ({size}). Nem készült másolat.
+	Saved {place}: {before} → {after} (not smaller){detail}	Mentve ide: {place}: {before} → {after} (nem kisebb){detail}
 	Couldn't save the image: {e}	A képet nem sikerült menteni: {e}
 	Adding images arrives on the web with file pickers for images	A képek hozzáadása a webes változatban a képválasztóval együtt érkezik
 	Replacing images on page {p} arrives on the web with image pickers ({i})	A {p}. oldal képeinek cseréje a webes változatban a képválasztóval együtt érkezik ({i})
@@ -2139,17 +2146,44 @@ action wizard	Start	Indítás
 	The field {name} no longer exists.	A(z) {name} mező már nem létezik.
 	A selected field has no widget on any page, so the fields can't be edited together.	Az egyik kijelölt mezőnek egyik oldalon sincs widgetje, ezért a mezők nem szerkeszthetők együtt.
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} {dpi} dpi felbontással, a legnagyobb méretben, amelyben megjeleníthetők)
-	Zoom in / out (also pinch or ⌘-scroll)	Nagyítás / kicsinyítés (csípéssel vagy ⌘-görgetéssel is)
-	Open a PDF (⌘O)	PDF megnyitása (⌘O)
-	Print (⌘P)	Nyomtatás (⌘P)
-	Document properties (⌘D)	Dokumentum tulajdonságai (⌘D)
-	Zoom out (⌘−)	Kicsinyítés (⌘−)
-	Zoom in (⌘+)	Nagyítás (⌘+)
-	Rotate view clockwise (⇧⌘+)	Nézet forgatása az óramutató járásával megegyezően (⇧⌘+)
-	New bookmark (⌘B)	Új könyvjelző (⌘B)
-	Previous (⇧⌘G)	Előző (⇧⌘G)
-	Next (⌘G)	Következő (⌘G)
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	A szövegfelismerés nincs telepítve: hiányoznak a modelljei (futtasd a `cargo xtask models` parancsot, vagy állítsd be a PDFCRAFT_MODELS változót).
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	{n} objektum kijelölve|{n} objektum kijelölve
+	Drag the selection to move it. Esc clears the selection.	A kijelölés áthelyezéséhez húzza azt. Az Esc törli a kijelölést.
+	Shift-click to select several objects. Drag empty space to select an area.	Több objektum kijelöléséhez kattintson a Shift lenyomásával. Terület kijelöléséhez húzzon az üres részen.
+	Select at most 1000 objects at a time.	Egyszerre legfeljebb 1000 objektumot jelöljön ki.
+	Finish or discard the text being edited before selecting several objects.	Több objektum kijelölése előtt fejezze be vagy vesse el a szöveg szerkesztését.
+	Move object	Objektum áthelyezése
+	Move objects	Objektumok áthelyezése
+	Vertical text cannot be moved with this selection.	A függőleges szöveg nem helyezhető át ezzel a kijelöléssel.
+	Text used as a clipping path cannot be moved with this selection.	A vágógörbeként használt szöveg nem helyezhető át ezzel a kijelöléssel.
+	These objects could not be moved. Select them again and try a smaller move.	Ezeket az objektumokat nem sikerült áthelyezni. Jelölje ki őket újra, és próbáljon kisebb elmozdítást.
+	This page contains objects that cannot be selected together.	Ez az oldal olyan objektumokat tartalmaz, amelyek nem jelölhetők ki együtt.
+	Fill colour	Kitöltőszín
+	No fill	Nincs kitöltés
+	Fill colour: none	Kitöltőszín: nincs
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	Szóköz
+	Grid view	Rácsnézet
+	List view	Listanézet
+	Files are combined in the order shown. Drag them to change it.	A fájlok a látható sorrendben egyesülnek. Húzd őket a sorrend módosításához.
+	Preview unavailable: {e}	Nincs előnézet: {e}
+	Pages: {k} of {n}	Oldalak: {k} / {n}
+	Check the pages	Ellenőrizd az oldalakat
+	Switch to List view to change the pages it takes.	Válts listanézetre, ha módosítanád, mely oldalak kerüljenek bele.
+	Expand all	Összes kibontása
+	Collapse all	Összes összecsukása
+	Remove page	Oldal eltávolítása
+	Remove {n} pages	{n} oldal eltávolítása
+
+# Shared panel docking
 	Reset panel layout	Panelelrendezés visszaállítása
 	Float panel	Panel lebegtetése
 	Move to group	Áthelyezés csoportba
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 5a7566867..01ea9d636 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -24,6 +24,9 @@
 	Preferences	Preferenze
 	Preferences…	Preferenze…
 	Interface language	Lingua dell'interfaccia
+	Interface size	Dimensione dell'interfaccia
+	Auto ({percent}%)	Auto ({percent}%)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	Auto segue la dimensione del testo del sistema. Le pagine vengono sempre visualizzate alla piena risoluzione dello schermo.
 	Identity	Identità
 	Name on new comments	Nome sui nuovi commenti
 	Open…	Apri…
@@ -70,6 +73,7 @@
 	Fit visible	Adatta al visibile
 	Marquee zoom	Ingrandimento selettivo
 	Take a snapshot	Acquisisci istantanea
+	Column select	Selezione colonna
 	Full screen mode	Modalità schermo intero
 	Read mode	Modalità lettura
 	Switch light / dark theme	Alterna tema chiaro/scuro
@@ -1090,6 +1094,7 @@
 	Dates	Date
 	Text in images isn't found; recognise text (OCR) first.	Il testo nelle immagini non viene trovato; esegui prima il riconoscimento del testo (OCR).
 	No matches.	Nessuna corrispondenza.
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	Alcuni segnalibri non sono mostrati qui: il pannello ne elenca un numero limitato, fino a una profondità limitata.
 	{n} match(es) marked for redaction.	Corrispondenze contrassegnate per l'oscuramento: {n}.
 	Multiple words or phrases	Più parole o frasi
 	One word or phrase per line	Una parola o frase per riga
@@ -1491,6 +1496,8 @@
 	Right Edge	Bordo destro
 	Language	Lingua
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Salvato {place}: {before} → {after} ({pct}% in meno){detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	Questo file è già il più piccolo possibile ({size}). Nessuna copia salvata.
+	Saved {place}: {before} → {after} (not smaller){detail}	Salvato {place}: {before} → {after} (non più piccolo){detail}
 	Couldn't save the image: {e}	Impossibile salvare l'immagine: {e}
 	Adding images arrives on the web with file pickers for images	Sul web, l'aggiunta di immagini arriverà con i selettori di file per immagini
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Sul web, la sostituzione di immagini a pagina {p} arriverà con i selettori di immagini ({i})
@@ -2150,6 +2157,44 @@ signature pad	Type	Digita
 	The field {name} no longer exists.	Il campo {name} non esiste più.
 	A selected field has no widget on any page, so the fields can't be edited together.	Un campo selezionato non ha widget in nessuna pagina, quindi i campi non possono essere modificati insieme.
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} a {dpi} dpi, la dimensione massima a cui si possono disegnare)
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	{n} oggetto selezionato|{n} oggetti selezionati
+	Drag the selection to move it. Esc clears the selection.	Trascina la selezione per spostarla. Esc annulla la selezione.
+	Shift-click to select several objects. Drag empty space to select an area.	Maiusc-clic per selezionare più oggetti. Trascina in uno spazio vuoto per selezionare un’area.
+	Select at most 1000 objects at a time.	Seleziona al massimo 1000 oggetti alla volta.
+	Finish or discard the text being edited before selecting several objects.	Completa o annulla la modifica del testo prima di selezionare più oggetti.
+	Move object	Sposta oggetto
+	Move objects	Sposta oggetti
+	Vertical text cannot be moved with this selection.	Il testo verticale non può essere spostato con questa selezione.
+	Text used as a clipping path cannot be moved with this selection.	Il testo usato come tracciato di ritaglio non può essere spostato con questa selezione.
+	These objects could not be moved. Select them again and try a smaller move.	Non è stato possibile spostare questi oggetti. Selezionali di nuovo e prova uno spostamento più piccolo.
+	This page contains objects that cannot be selected together.	Questa pagina contiene oggetti che non possono essere selezionati insieme.
+	Fill colour	Colore riempimento
+	No fill	Nessun riempimento
+	Fill colour: none	Colore riempimento: nessuno
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Maiusc
+key	Delete	Canc
+key	Esc	Esc
+key	Home	Home
+key	End	Fine
+key	Space	Spazio
+	Grid view	Vista griglia
+	List view	Vista elenco
+	Files are combined in the order shown. Drag them to change it.	I file vengono combinati nell'ordine mostrato. Trascinali per cambiarlo.
+	Preview unavailable: {e}	Anteprima non disponibile: {e}
+	Pages: {k} of {n}	Pagine: {k} di {n}
+	Check the pages	Controlla le pagine
+	Switch to List view to change the pages it takes.	Passa alla vista elenco per cambiare le pagine incluse.
+	Expand all	Espandi tutto
+	Collapse all	Comprimi tutto
+	Remove page	Rimuovi pagina
+	Remove {n} pages	Rimuovi {n} pagine
+
+# Shared panel docking
 	Reset panel layout	Ripristina disposizione pannelli
 	Float panel	Rendi pannello flottante
 	Move to group	Sposta nel gruppo
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index c6763e757..f782fa442 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -24,6 +24,9 @@
 	Preferences	環境設定
 	Preferences…	環境設定…
 	Interface language	表示言語
+	Interface size	表示サイズ
+	Auto ({percent}%)	自動 ({percent}%)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	自動にすると、システムの文字サイズに合わせます。ページは常にディスプレイの最大解像度で描画されます。
 	Identity	個人情報
 	Name on new comments	新しい注釈の作成者名
 	Open…	開く…
@@ -73,6 +76,7 @@
 	Fit visible	表示範囲に合わせる
 	Marquee zoom	範囲指定ズーム
 	Take a snapshot	スナップショットを作成
+	Column select	列の選択
 	Full screen mode	全画面表示
 	Read mode	閲覧モード
 	Switch light / dark theme	明るい／暗いテーマを切り替え
@@ -1094,6 +1098,7 @@
 	Dates	日付
 	Text in images isn't found; recognise text (OCR) first.	画像内のテキストは検索できません。先に OCR でテキストを認識してください。
 	No matches.	一致する項目はありません。
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	一部のしおりはここに表示されません。パネルに表示できる数と階層の深さには上限があります。
 	{n} match(es) marked for redaction.	{n} 件の一致項目に墨消しマークを付けました。
 	Multiple words or phrases	複数の単語または語句
 	One word or phrase per line	1 行に 1 つの単語または語句
@@ -1496,6 +1501,8 @@
 	Right Edge	右端
 	Language	言語
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	{place} に保存: {before} → {after}（{pct}% 削減）{detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	このファイルはすでに最小のサイズです（{size}）。コピーは保存されませんでした。
+	Saved {place}: {before} → {after} (not smaller){detail}	{place} に保存: {before} → {after}（縮小なし）{detail}
 	Couldn't save the image: {e}	画像を保存できませんでした: {e}
 	Adding images arrives on the web with file pickers for images	Web 版の画像追加は画像ファイル選択に対応した際に利用可能になります
 	Replacing images on page {p} arrives on the web with image pickers ({i})	ページ {p} の画像置換は Web 版の画像選択に対応した際に利用可能になります（{i}）
@@ -2141,16 +2148,44 @@ signature pad	Type	入力
 	The field {name} no longer exists.	フィールド {name} はもう存在しません。
 	A selected field has no widget on any page, so the fields can't be edited together.	選択したフィールドの一つがどのページにもウィジェットを持たないため、まとめて編集できません。
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	（{n} 件は描画できる最大サイズの {dpi} dpi で書き出しました）
-	Zoom in / out (also pinch or ⌘-scroll)	拡大／縮小（ピンチ操作や ⌘＋スクロールも使用可能）
-	Open a PDF (⌘O)	PDF を開く（⌘O）
-	Print (⌘P)	印刷（⌘P）
-	Document properties (⌘D)	文書のプロパティ（⌘D）
-	Zoom out (⌘−)	縮小（⌘−）
-	Zoom in (⌘+)	拡大（⌘+）
-	Rotate view clockwise (⇧⌘+)	表示を時計回りに回転（⇧⌘+）
-	New bookmark (⌘B)	新しいしおり（⌘B）
-	Previous (⇧⌘G)	前へ（⇧⌘G）
-	Next (⌘G)	次へ（⌘G）
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	{n}個のオブジェクトを選択中
+	Drag the selection to move it. Esc clears the selection.	選択範囲をドラッグして移動します。Escで選択を解除します。
+	Shift-click to select several objects. Drag empty space to select an area.	Shiftを押しながらクリックすると複数のオブジェクトを選択できます。空白をドラッグすると範囲選択できます。
+	Select at most 1000 objects at a time.	一度に選択できるオブジェクトは1000個までです。
+	Finish or discard the text being edited before selecting several objects.	複数のオブジェクトを選択する前に、テキストの編集を完了するか破棄してください。
+	Move object	オブジェクトを移動
+	Move objects	複数のオブジェクトを移動
+	Vertical text cannot be moved with this selection.	この選択範囲では縦書きのテキストを移動できません。
+	Text used as a clipping path cannot be moved with this selection.	この選択範囲ではクリッピングパスとして使われているテキストを移動できません。
+	These objects could not be moved. Select them again and try a smaller move.	これらのオブジェクトを移動できませんでした。選択し直し、移動量を小さくして試してください。
+	This page contains objects that cannot be selected together.	このページには一緒に選択できないオブジェクトがあります。
+	Fill colour	塗りつぶし色
+	No fill	塗りつぶしなし
+	Fill colour: none	塗りつぶし色: なし
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	スペース
+	Grid view	グリッド表示
+	List view	リスト表示
+	Files are combined in the order shown. Drag them to change it.	ファイルは表示されている順に結合されます。ドラッグして順番を変更できます。
+	Preview unavailable: {e}	プレビューを表示できません: {e}
+	Pages: {k} of {n}	ページ: {k}/{n}
+	Check the pages	ページ指定を確認してください
+	Switch to List view to change the pages it takes.	使用するページを変更するには、リスト表示に切り替えてください。
+	Expand all	すべて展開
+	Collapse all	すべて折りたたむ
+	Remove page	ページを削除
+	Remove {n} pages	{n} ページを削除
+
+# Shared panel docking
 	Reset panel layout	パネル配置をリセット
 	Float panel	パネルをフロート化
 	Move to group	グループに移動
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index e91926185..f8d768392 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -115,8 +115,18 @@ fn plural_arabic(n: u64) -> usize {
     }
 }
 
+/// Polish integer counts: 1 is one; endings 2–4 except 12–14 are few; the rest are many.
+fn plural_polish(n: u64) -> usize {
+    match (n, n % 100, n % 10) {
+        (1, _, _) => 0,
+        (_, 12..=14, _) => 2,
+        (_, _, 2..=4) => 1,
+        _ => 2,
+    }
+}
+
 /// The registry. English first: it is the fallback and the source language.
-pub static LANGUAGES: [LangInfo; 16] = [
+pub static LANGUAGES: [LangInfo; 17] = [
     LangInfo { code: "en", name: "English", source: "", plural: plural_one_other, rtl: false, catalog: OnceLock::new() },
     LangInfo { code: "ja", name: "日本語", source: include_str!("ja.tsv"), plural: plural_none, rtl: false, catalog: OnceLock::new() },
     // Simplified Chinese; `zh`, `zh-CN`, `zh-SG` and `zh-Hans-*` locales resolve here (see `candidates`).
@@ -165,6 +175,8 @@ pub static LANGUAGES: [LangInfo; 16] = [
     // Arabic (Modern Standard, Western digits); every `ar-*` locale (`ar-MA`, `ar-EG`, `ar-SA` ...)
     // resolves here. Right to left: see `LangInfo::rtl`.
     LangInfo { code: "ar", name: "العربية", source: include_str!("ar.tsv"), plural: plural_arabic, rtl: true, catalog: OnceLock::new() },
+    // Polish; every `pl-*` locale (`pl-pl`, `pl_pl.UTF-8`) resolves here.
+    LangInfo { code: "pl", name: "Polski", source: include_str!("pl.tsv"), plural: plural_polish, rtl: false, catalog: OnceLock::new() },
 ];
 
 impl LangInfo {
@@ -383,6 +395,12 @@ pub fn t(s: &str) -> &str {
     tr(current(), s)
 }
 
+/// The name of a keyboard key, distinct from a command such as Delete. Missing key-name
+/// translations use the English key name, never a plain command translation.
+pub fn key_name(s: &str) -> &str {
+    current().catalog().contextual("key", s).unwrap_or(s)
+}
+
 /// Translate an English UI string; unknown strings come back unchanged.
 pub fn tr(lang: Lang, s: &str) -> &str {
     lang.catalog().plain(s).unwrap_or(s)
@@ -484,6 +502,26 @@ mod tests {
     use super::*;
 
     const JA: fn() -> Lang = || Lang::from_code("ja").expect("ja registered");
+    // These physical key-cap names remain English in several keyboard layouts. Only their
+    // dedicated key context may use them unchanged; ordinary command labels still translate.
+    const KEY_CAP_NAMES: &[&str] = &["Ctrl", "Shift", "Delete", "Esc", "Home", "End"];
+
+    #[test]
+    fn keyboard_key_names_have_a_separate_context_and_english_fallback() {
+        for lang in Lang::all().filter(|l| *l != Lang::EN) {
+            for key in ["Ctrl", "Shift", "Delete", "Esc", "Home", "End", "Space"] {
+                assert!(lang.catalog().contextual("key", key).is_some(), "{}: {key}", lang.code());
+            }
+        }
+        let previous = current();
+        set_current(Lang::from_code("de").unwrap());
+        assert_eq!(key_name("Delete"), "Entf");
+        assert_eq!(t("Delete"), "Löschen");
+        assert_eq!(key_name("Open"), "Open", "a missing key name must not borrow a command translation");
+        set_current(Lang::EN);
+        assert_eq!(key_name("Delete"), "Delete");
+        set_current(previous);
+    }
 
     #[test]
     fn tags_map_to_languages() {
@@ -1165,7 +1203,8 @@ mod tests {
         const KEEP_AS_IS: &[&str] = &["OK"];
         let (entries, _) = parse_entries(cs.0.source, cs.0.plural_forms());
         for e in &entries {
-            assert!(e.source != e.translation || KEEP_AS_IS.contains(&e.source.as_str()), "{:?} is untranslated", e.source);
+            let key_cap = e.context == "key" && KEY_CAP_NAMES.contains(&e.source.as_str());
+            assert!(e.source != e.translation || KEEP_AS_IS.contains(&e.source.as_str()) || key_cap, "{:?} is untranslated", e.source);
             assert!(!e.translation.contains("..."), "use … rather than three dots: {:?}", e.translation);
             assert_eq!(e.translation.trim(), e.translation, "stray whitespace: {:?}", e.translation);
         }
@@ -1990,7 +2029,13 @@ mod tests {
             "+Bin",
             "−Bin",
         ];
-        let unchanged: Vec<_> = entries.iter().filter(|e| e.source == e.translation && !keep.contains(&e.source.as_str())).collect();
+        let unchanged: Vec<_> = entries
+            .iter()
+            .filter(|e| {
+                let key_cap = e.context == "key" && KEY_CAP_NAMES.contains(&e.source.as_str());
+                e.source == e.translation && !keep.contains(&e.source.as_str()) && !key_cap
+            })
+            .collect();
         assert!(unchanged.is_empty(), "untranslated Ukrainian catalog entries: {unchanged:#?}");
     }
 
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
new file mode 100644
index 000000000..64485e69e
--- /dev/null
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -0,0 +1,2191 @@
+# Polish (pl) catalog. Columns, separated by a TAB:  context <TAB> source <TAB> translation
+#
+#   context  empty                a plain UI string; `source` is the English text in the code
+#            @id                  a command id (e.g. file.saveAs): wins over the English text for
+#                                 that menu item, so one id can read differently from its twin
+#            @plural              `source` is "one|other" (English forms); the translation lists the
+#                                 language's forms separated by "|" (see `plural` in i18n/mod.rs)
+#            anything else        a disambiguating context passed to `tr_ctx`
+#   escapes  \n  \t  \\  inside a column. `{name}` placeholders must appear in both columns.
+#   lines starting with # and blank lines are ignored.
+#
+# Clean-room: every entry was written from the plain meaning of the English label using ordinary
+# Polish computing vocabulary. No proprietary localisation resource, string table or product UI
+# (Acrobat's included) was consulted or copied; add entries the same way.
+# Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
+# the trailing "…" of dialog commands is kept.
+
+	Menu	Menu
+	File	Plik
+	Edit	Edycja
+	Pages	Strony
+	View	Widok
+	Help	Pomoc
+	Preferences	Preferencje
+	Preferences…	Preferencje…
+	Interface language	Język interfejsu
+	Identity	Tożsamość
+	Name on new comments	Autor nowych komentarzy
+	Open…	Otwórz…
+	Open Recent	Otwórz ostatnie
+	Clear Recent Files	Wyczyść listę ostatnich plików
+	Remove from Recent	Usuń z ostatnich
+	Remove {name} from Recent	Usuń {name} z ostatnich
+	Pin folder to Home…	Przypnij folder do strony głównej…
+	Folders	Foldery
+	Pin a folder…	Przypnij folder…
+	Pin a folder to Home	Przypnij folder do strony głównej
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	Przypnij folder, aby wyświetlać tutaj jego najnowsze pliki PDF, np. folder zapisu skanera lub synchronizowanego dysku w chmurze.
+	Unpin	Odepnij
+	Unpin {folder}	Odepnij {folder}
+	Looking for PDFs…	Szukanie plików PDF…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	Ten folder jest teraz niedostępny. Mógł zostać przeniesiony albo jego dysk lub synchronizacja z chmurą jest nieaktywna.
+	No PDFs in this folder yet	W tym folderze nie ma jeszcze plików PDF
+	Show less	Pokaż mniej
+	Show {n} more	Pokaż jeszcze {n}
+	The newest {n} of {total} PDFs	Najnowsze {n} z {total} plików PDF
+	Pinned folders need the desktop app	Przypinanie folderów wymaga aplikacji komputerowej
+	Choose a folder on this computer to pin	Wybierz folder na tym komputerze do przypięcia
+	{folder} is already pinned to Home	Folder {folder} jest już przypięty do strony głównej
+	You can pin up to {n} folders. Unpin one first.	Możesz przypiąć maksymalnie {n} folderów. Najpierw odepnij jeden.
+	Pinned {folder} to Home	Przypięto {folder} do strony głównej
+	No recent files	Brak ostatnich plików
+	New blank PDF	Nowy pusty PDF
+	Create PDF from file…	Utwórz PDF z pliku…
+	Create PDF from images…	Utwórz PDF z obrazów…
+	Create PDF from multiple files…	Utwórz PDF z wielu plików…
+	Create PDF from clipboard	Utwórz PDF ze schowka
+	Combine files…	Połącz pliki…
+	Save	Zapisz
+	Save as…	Zapisz jako…
+	Close file	Zamknij plik
+	Close all	Zamknij wszystkie
+	Revert	Przywróć
+	Print…	Drukuj…
+	Document properties…	Właściwości dokumentu…
+	Undo	Cofnij
+	Redo	Ponów
+	Find…	Znajdź…
+	Advanced search…	Wyszukiwanie zaawansowane…
+	Copy pages	Kopiuj strony
+	Cut pages	Wytnij strony
+	Paste pages	Wklej strony
+	Fit visible	Dopasuj widoczny obszar
+	Marquee zoom	Powiększ zaznaczony obszar
+	Take a snapshot	Zrób migawkę
+	Full screen mode	Tryb pełnoekranowy
+	Read mode	Tryb czytania
+	Switch light / dark theme	Przełącz jasny / ciemny motyw
+	Comments panel	Panel komentarzy
+	Form fields panel	Panel pól formularza
+	Clear form	Wyczyść formularz
+	Find tools and commands…	Znajdź narzędzia i polecenia…
+	Zoom	Powiększenie
+	Actual size	Rzeczywisty rozmiar
+	Zoom to page level	Dopasuj całą stronę
+	Fit to width	Dopasuj do szerokości
+	Display theme	Motyw interfejsu
+	Side panels	Panele boczne
+	Enable Acrobat JavaScript	Włącz Acrobat JavaScript
+	OK	OK
+	Join our Discord	Dołącz do naszego Discorda
+	Close	Zamknij
+	Next / previous match	Następne / poprzednie dopasowanie
+	Copy selected text	Kopiuj zaznaczony tekst
+	Double-click	Dwukrotne kliknięcie
+	Select a word	Zaznacz słowo
+	Clear selection / close find	Wyczyść zaznaczenie / zamknij wyszukiwanie
+	Zoom in / out (also pinch or ⌘-scroll)	Powiększ / pomniejsz (także gestem szczypania lub ⌘-przewijaniem)
+	Rotate view	Obróć widok
+	First / last page	Pierwsza / ostatnia strona
+	Previous / next page	Poprzednia / następna strona
+	Delete selected pages (Organize)	Usuń zaznaczone strony (Organizuj)
+	Select all pages (Organize)	Zaznacz wszystkie strony (Organizuj)
+	Home	Strona główna
+	Open	Otwórz
+	Open a PDF (⌘O)	Otwórz PDF (⌘O)
+	Dark gray theme	Ciemnoszary motyw
+	Light theme	Jasny motyw
+	All tools	Wszystkie narzędzia
+	Read	Czytaj
+	Convert	Konwertuj
+	E-Sign	Podpis elektroniczny
+	Print (⌘P)	Drukuj (⌘P)
+	Save (M4)	Zapisz (M4)
+	Document properties (⌘D)	Właściwości dokumentu (⌘D)
+	Find tools and commands	Znajdź narzędzia i polecenia
+	Fit to height	Dopasuj do wysokości
+	Zoom in	Powiększ
+	Zoom out	Pomniejsz
+	Rotate view clockwise	Obróć widok w prawo
+	Rotate view counterclockwise	Obróć widok w lewo
+	Page navigation	Nawigacja po stronach
+	Previous view	Poprzedni widok
+	Next view	Następny widok
+	Page display	Wyświetlanie stron
+	Continuous scrolling	Przewijanie ciągłe
+	Two-page view	Widok dwóch stron
+	Single page	Pojedyncza strona
+	Show cover page in two-page view	Pokaż okładkę w widoku dwóch stron
+	Use system setting	Użyj ustawienia systemowego
+	Light gray	Jasnoszary
+	Dark gray	Ciemnoszary
+	Comments	Komentarze
+	Bookmarks	Zakładki
+	Fields	Pola
+	Layers	Warstwy
+	Attachments	Załączniki
+	Signatures	Podpisy
+	Accessibility Checker	Sprawdzanie dostępności
+	Search	Szukaj
+	Compare	Porównaj
+	Page thumbnails	Miniatury stron
+	Form fields	Pola formularza
+	Zoom out (⌘−)	Pomniejsz (⌘−)
+	Zoom in (⌘+)	Powiększ (⌘+)
+	Rotate view clockwise (⇧⌘+)	Obróć widok w prawo (⇧⌘+)
+	Toggle fit page / fit width	Przełącz dopasowanie do strony / szerokości
+	Next page	Następna strona
+	Previous page	Poprzednia strona
+	Current page — type a page number or label (such as iv) and press Enter	Bieżąca strona — wpisz numer lub etykietę strony (np. iv) i naciśnij Enter
+	Welcome to PdfCraft	Witamy w PdfCraft
+	An open-source PDF workbench — local, private, and scriptable.	Otwarty zestaw narzędzi do PDF — lokalny, prywatny i obsługujący skrypty.
+	Join the ArtCraft community	Dołącz do społeczności ArtCraft
+	Get help, share feedback and follow development on Discord.	Uzyskaj pomoc, podziel się opinią i śledź rozwój na Discordzie.
+	Recommended tools	Polecane narzędzia
+	Use now	Użyj teraz
+	Open file	Otwórz plik
+	Recent	Ostatnie
+	Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.	Pliki otwierane w PdfCraft pojawiają się tutaj. Upuść PDF w dowolnym miejscu, aby go otworzyć.
+	Privacy	Prywatność
+	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft działa offline. Bez telemetrii, konta i przetwarzania w chmurze, chyba że dodasz dostawcę.
+	Scripts run in a sandbox without file or network access. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Skrypty działają w piaskownicy bez dostępu do plików i sieci. Przy wyłączonym JavaScript standardowe funkcje formatowania, walidacji i obliczeń Acrobata nadal działają.
+	Back to all tools	Wróć do wszystkich narzędzi
+	Close panel	Zamknij panel
+	View less	Wyświetl mniej
+	View more	Wyświetl więcej
+	Available	Dostępne
+	Ready	Gotowe
+	Search tools and commands…	Szukaj narzędzi i poleceń…
+	No matching tools	Brak pasujących narzędzi
+	Tool	Narzędzie
+	Command	Polecenie
+	Add a sticky note	Dodaj notatkę
+	Add a text box	Dodaj pole tekstowe
+	Highlight text	Podświetl tekst
+	Underline text	Podkreśl tekst
+	Strikethrough text	Przekreśl tekst
+	Squiggly underline text	Podkreśl tekst falistą linią
+	Draw freehand	Rysuj odręcznie
+	Draw a line	Narysuj linię
+	Draw an arrow	Narysuj strzałkę
+	Draw a rectangle	Narysuj prostokąt
+	Draw an oval	Narysuj owal
+	Draw a polygon	Narysuj wielokąt
+	Draw connected lines	Narysuj połączone linie
+	Draw a cloud	Narysuj chmurkę
+	Add a callout	Dodaj objaśnienie
+	Insert text	Wstaw tekst
+	Replace text	Zastąp tekst
+	Attach a file	Dołącz plik
+	Erase drawings	Wymaż rysunki
+	Flatten comments	Spłaszcz komentarze
+	Import comments…	Importuj komentarze…
+	Add a stamp	Dodaj stempel
+	Export all comments to data file…	Eksportuj wszystkie komentarze do pliku danych…
+	Hide all comments	Ukryj wszystkie komentarze
+	Summarize comments	Podsumuj komentarze
+	Import form data…	Importuj dane formularza…
+	Export form data…	Eksportuj dane formularza…
+	PDF/A…	PDF/A…
+	Action Wizard…	Kreator akcji…
+	Prepare for distribution…	Przygotuj do dystrybucji…
+	Optimize scanned documents…	Optymalizuj zeskanowane dokumenty…
+	Compare files…	Porównaj pliki…
+	Detect form fields	Wykryj pola formularza
+	Merge data files into spreadsheet…	Scal pliki danych w arkusz kalkulacyjny…
+	Flatten form fields	Spłaszcz pola formularza
+	Prepare a form	Przygotuj formularz
+	Tab order: by rows	Kolejność tabulacji: według wierszy
+	Tab order: by columns	Kolejność tabulacji: według kolumn
+	Tab order: by document structure	Kolejność tabulacji: według struktury dokumentu
+	Add text	Dodaj tekst
+	Edit text & images	Edytuj tekst i obrazy
+	Add or edit links	Dodaj lub edytuj łącza
+	Create links from URLs	Utwórz łącza z adresów URL
+	Remove all links	Usuń wszystkie łącza
+	Add Bates numbering…	Dodaj numerację Batesa…
+	Add image…	Dodaj obraz…
+	Redact text and images	Utajnij tekst i obrazy
+	Redact pages…	Utajnij strony…
+	Find text and redact…	Znajdź tekst i utajnij…
+	Redaction properties…	Właściwości utajniania…
+	Apply redactions…	Zastosuj utajnienia…
+	Clear redaction marks	Wyczyść oznaczenia do utajnienia
+	Remove hidden information…	Usuń ukryte informacje…
+	Sanitize document…	Oczyść dokument…
+	Field properties…	Właściwości pola…
+	Add a text field	Dodaj pole tekstowe formularza
+	Add a checkbox	Dodaj pole wyboru
+	Add a radio button	Dodaj przycisk opcji
+	Add a drop-down list	Dodaj listę rozwijaną
+	Add a list box	Dodaj pole listy
+	Add a button	Dodaj przycisk
+	Add an image field	Dodaj pole obrazu
+	Add a date field	Dodaj pole daty
+	Add a digital signature field	Dodaj pole podpisu cyfrowego
+	Digitally sign	Podpisz cyfrowo
+	Certify (visible signature)	Certyfikuj (widoczny podpis)
+	Certify (invisible signature)	Certyfikuj (niewidoczny podpis)
+	Validate all signatures	Zweryfikuj wszystkie podpisy
+	Signatures panel	Panel podpisów
+	Fill & Sign: add text	Wypełnij i podpisz: dodaj tekst
+	Fill & Sign: checkmark	Wypełnij i podpisz: znacznik wyboru
+	Fill & Sign: cross	Wypełnij i podpisz: krzyżyk
+	Fill & Sign: dot	Wypełnij i podpisz: kropka
+	Fill & Sign: line	Wypełnij i podpisz: linia
+	Fill & Sign: date	Wypełnij i podpisz: data
+	Fill & Sign: sign	Wypełnij i podpisz: podpis
+	Fill & Sign: initials	Wypełnij i podpisz: inicjały
+	Export to image…	Eksportuj do obrazu…
+	Reduce file size…	Zmniejsz rozmiar pliku…
+	Optimize PDF…	Optymalizuj PDF…
+	Export to text…	Eksportuj do tekstu…
+	Export to Word…	Eksportuj do Worda…
+	Export to HTML…	Eksportuj do HTML…
+	Export to RTF…	Eksportuj do RTF…
+	JavaScript console…	Konsola JavaScript…
+	Document JavaScripts…	Skrypty JavaScript dokumentu…
+	Recognize text…	Rozpoznaj tekst…
+	Recognize text in multiple files…	Rozpoznaj tekst w wielu plikach…
+	Check for accessibility…	Sprawdź dostępność…
+	Open accessibility report	Otwórz raport dostępności
+	Change reading options…	Zmień opcje czytania…
+	Add alternate text…	Dodaj tekst alternatywny…
+	Export all images…	Eksportuj wszystkie obrazy…
+	Add header & footer…	Dodaj nagłówek i stopkę…
+	Update header & footer…	Zaktualizuj nagłówek i stopkę…
+	Remove header & footer	Usuń nagłówek i stopkę
+	Add watermark…	Dodaj znak wodny…
+	Update watermark…	Zaktualizuj znak wodny…
+	Remove watermark	Usuń znak wodny
+	Add background…	Dodaj tło…
+	Update background…	Zaktualizuj tło…
+	Remove background	Usuń tło
+	Protect using password…	Chroń hasłem…
+	Remove security	Usuń zabezpieczenia
+	Security properties…	Właściwości zabezpieczeń…
+	Organize pages	Organizuj strony
+	New bookmark	Nowa zakładka
+	Rotate pages clockwise	Obróć strony w prawo
+	Rotate pages counterclockwise	Obróć strony w lewo
+	Delete pages	Usuń strony
+	Insert blank page	Wstaw pustą stronę
+	Rotate pages…	Obróć strony…
+	Duplicate pages	Powiel strony
+	Crop pages	Przytnij strony
+	Set page boxes…	Ustaw obszary strony…
+	Insert pages from file…	Wstaw strony z pliku…
+	Replace pages…	Zastąp strony…
+	Extract pages…	Wyodrębnij strony…
+	Split document…	Podziel dokument…
+	Number pages…	Ponumeruj strony…
+	Keyboard shortcuts	Skróty klawiaturowe
+	Join the ArtCraft Discord	Dołącz do Discorda ArtCraft
+	PdfCraft web page	Strona internetowa PdfCraft
+	PdfCraft on GitHub	PdfCraft na GitHubie
+	ArtCraft website	Strona internetowa ArtCraft
+	Check for updates…	Sprawdź aktualizacje…
+	About PdfCraft	O PdfCraft
+	Export a PDF	Eksportuj PDF
+	Export to	Eksportuj do
+	Microsoft Word (.docx)	Microsoft Word (.docx)
+	Spreadsheet (.xlsx)	Arkusz kalkulacyjny (.xlsx)
+	Presentation (.pptx)	Prezentacja (.pptx)
+	Image (PNG)	Obraz (PNG)
+	Export all images	Eksportuj wszystkie obrazy
+	HTML web page	Strona internetowa HTML
+	Rich Text Format (.rtf)	Tekst sformatowany (.rtf)
+	Text (plain)	Tekst (zwykły)
+	PostScript / EPS	PostScript / EPS
+	Fill & Sign	Wypełnij i podpisz
+	Fill	Wypełnij
+	Checkmark	Znacznik wyboru
+	Cross	Krzyżyk
+	Dot	Kropka
+	Line	Linia
+	Date	Data
+	Signature	Podpis
+	Initials	Inicjały
+	Edit a PDF	Edytuj PDF
+	Modify page	Modyfikuj stronę
+	Rotate pages	Obróć strony
+	Insert pages	Wstaw strony
+	Extract pages	Wyodrębnij strony
+	Add content	Dodaj zawartość
+	Text	Tekst
+	Image	Obraz
+	Header and footer	Nagłówek i stopka
+	Watermark	Znak wodny
+	Link	Łącze
+	Bates numbering	Numeracja Batesa
+	Background	Tło
+	Attach file	Dołącz plik
+	Create a PDF	Utwórz PDF
+	Create from	Utwórz z
+	Single file	Pojedynczy plik
+	Multiple files	Wiele plików
+	Images	Obrazy
+	Clipboard	Schowek
+	Blank page	Pusta strona
+	Combine files	Połącz pliki
+	Combine	Połącz
+	Add files to combine	Dodaj pliki do połączenia
+	Page options	Opcje stron
+	Page grid	Siatka stron
+	Rotate	Obróć
+	Delete	Usuń
+	Extract	Wyodrębnij
+	Insert	Wstaw
+	Replace	Zastąp
+	Split	Podziel
+	More	Więcej
+	Set page boxes	Ustaw obszary strony
+	Page labels	Etykiety stron
+	Page transitions	Przejścia stron
+	Add comments	Dodaj komentarze
+	Markup	Oznaczenia
+	Sticky note	Notatka
+	Underline	Podkreślenie
+	Strikethrough	Przekreślenie
+	Squiggly underline	Faliste podkreślenie
+	Text box	Pole tekstowe
+	Drawing	Rysunek
+	Rectangle	Prostokąt
+	Oval	Owal
+	Arrow	Strzałka
+	Cloud	Chmurka
+	Stamp	Stempel
+	Review	Recenzja
+	Comment list	Lista komentarzy
+	Scan & OCR	Skanowanie i OCR
+	Recognize text	Rozpoznaj tekst
+	In this file	W tym pliku
+	In multiple files	W wielu plikach
+	Enhance scanned file	Popraw zeskanowany plik
+	Correct recognized text	Popraw rozpoznany tekst
+	Protect a PDF	Chroń PDF
+	Protect	Chroń
+	Protect with password	Chroń hasłem
+	Remove hidden information	Usuń ukryte informacje
+	Advanced options	Opcje zaawansowane
+	Encrypt with certificate	Szyfruj certyfikatem
+	Security properties	Właściwości zabezpieczeń
+	Redact a PDF	Utajnij PDF
+	Redact	Utajnij
+	Redact pages	Utajnij strony
+	Find text and redact	Znajdź tekst i utajnij
+	Set properties	Ustaw właściwości
+	Sanitize document	Oczyść dokument
+	Compress a PDF	Kompresuj PDF
+	Optimize	Optymalizuj
+	Reduce file size	Zmniejsz rozmiar pliku
+	Advanced optimization	Zaawansowana optymalizacja
+	Audit space usage	Analiza wykorzystania miejsca
+	Field list	Lista pól
+	Field properties	Właściwości pola
+	Tab order by rows	Kolejność tabulacji według wierszy
+	Tab order by columns	Kolejność tabulacji według kolumn
+	Import data	Importuj dane
+	Export data	Eksportuj dane
+	Add form components	Dodaj elementy formularza
+	Text field	Pole tekstowe formularza
+	Checkbox	Pole wyboru
+	Radio button	Przycisk opcji
+	Drop-down list	Lista rozwijana
+	List box	Pole listy
+	Button	Przycisk
+	Image field	Pole obrazu
+	Date field	Pole daty
+	Digital signature	Podpis cyfrowy
+	Stamps	Stemple
+	Stamp palette	Paleta stempli
+	Use a certificate	Użyj certyfikatu
+	Certificates	Certyfikaty
+	Timestamp	Znacznik czasu
+	Use print production	Użyj przygotowania do druku
+	Print production	Przygotowanie do druku
+	Output preview	Podgląd wyjściowy
+	Preflight	Kontrola wstępna
+	Convert colors	Konwertuj kolory
+	Add printer marks	Dodaj znaczniki drukarskie
+	Fix hairlines	Popraw cienkie linie
+	Measure objects	Zmierz obiekty
+	Measure	Pomiar
+	Measuring tool	Narzędzie pomiarowe
+	Geospatial location	Położenie geoprzestrzenne
+	Compare files	Porównaj pliki
+	Select files to compare	Wybierz pliki do porównania
+	Use guided actions	Użyj akcji z przewodnikiem
+	Actions list	Lista akcji
+	Action Wizard	Kreator akcji
+	Make accessible	Zapewnij dostępność
+	Prepare for distribution	Przygotuj do dystrybucji
+	Optimize scanned documents	Optymalizuj zeskanowane dokumenty
+	Archive documents	Archiwizuj dokumenty
+	Prepare for accessibility	Przygotuj pod kątem dostępności
+	Accessibility	Dostępność
+	Automatically tag PDF	Automatycznie oznacz PDF tagami
+	Change reading options	Zmień opcje czytania
+	Check for accessibility	Sprawdź dostępność
+	Add alternate text	Dodaj tekst alternatywny
+	Fix reading order	Popraw kolejność czytania
+	Apply PDF standards	Zastosuj standardy PDF
+	Standards	Standardy
+	Save as PDF/A	Zapisz jako PDF/A
+	Save as PDF/X	Zapisz jako PDF/X
+	Save as PDF/UA	Zapisz jako PDF/UA
+	Add search index	Dodaj indeks wyszukiwania
+	Index	Indeks
+	Manage embedded index	Zarządzaj osadzonym indeksem
+	Use JavaScript	Użyj JavaScript
+	JavaScript	JavaScript
+	Console	Konsola
+	Document JavaScripts	Skrypty JavaScript dokumentu
+	Document actions	Akcje dokumentu
+	AI assistant	Asystent AI
+	Bring your own model (off by default)	Podłącz własny model (domyślnie wyłączone)
+	Summarize	Podsumuj
+	Ask about this document	Zapytaj o ten dokument
+	Translate	Przetłumacz
+	pages	strony
+	Planned	Planowane
+	Planned for milestone	Planowane na etap
+	open to see what it will include	otwórz, aby zobaczyć planowane funkcje
+	Optional: needs an AI provider you configure	Opcjonalne: wymaga skonfigurowanego dostawcy AI
+	Coming in milestone	Dostępne w etapie
+	Items marked Ready work today.	Elementy oznaczone jako Gotowe działają już teraz.
+	Preview	Podgląd
+	Edit fields	Edytuj pola
+	Try the form as people filling it in will see it	Wypróbuj formularz w widoku osoby, która będzie go wypełniać
+	Redact all	Utajnij wszystko
+	Clear all	Wyczyść wszystko
+	Rotate page	Obróć stronę
+	Delete page	Usuń stronę
+	Move page	Przenieś stronę
+	Move pages	Przenieś strony
+	Duplicate page	Powiel stronę
+	Replace page	Zastąp stronę
+	Replace pages	Zastąp strony
+	Crop page	Przytnij stronę
+	Cancel	Anuluj
+	Don't save	Nie zapisuj
+	Apply	Zastosuj
+	Run	Uruchom
+	Clear	Wyczyść
+	Sanitize	Oczyść
+	Mark all	Oznacz wszystko
+	Save changes to “{name}” before closing?	Zapisać zmiany w „{name}” przed zamknięciem?
+	Your changes will be lost if you don't save them.	Jeśli nie zapiszesz zmian, zostaną utracone.
+	Password required	Wymagane hasło
+	“{name}” is protected. Enter a password to open it.	Plik „{name}” jest chroniony. Wpisz hasło, aby go otworzyć.
+	Password	Hasło
+	Incorrect password. Try again.	Nieprawidłowe hasło. Spróbuj ponownie.
+	Recognize Text	Rozpoznaj tekst
+	Password protection will be applied when you save	Ochrona hasłem zostanie zastosowana podczas zapisu
+	Saved the print-ready PDF to {path}	Zapisano PDF gotowy do druku w {path}
+	Could not save: {e}	Nie można zapisać: {e}
+	Earlier in tab order	Wcześniej w kolejności tabulacji
+	Later in tab order	Później w kolejności tabulacji
+	From:	Od:
+	To:	Do:
+	High Resolution	Wysoka rozdzielczość
+	Print	Drukuj
+	Verify to see what the document needs.	Uruchom weryfikację, aby sprawdzić wymagania dokumentu.
+	Set Page Boxes	Ustaw obszary strony
+	Signature panel	Panel podpisu
+	{month} {day}, {y}	{day} {month} {y}
+	The document's security settings don't allow filling in form fields	Ustawienia zabezpieczeń dokumentu nie zezwalają na wypełnianie pól formularza
+	{name} is read-only	Pole {name} jest tylko do odczytu
+	{name} has no action	Pole {name} nie ma akcji
+	Previous month	Poprzedni miesiąc
+	Next month	Następny miesiąc
+	January	Styczeń
+	February	Luty
+	March	Marzec
+	April	Kwiecień
+	May	Maj
+	June	Czerwiec
+	July	Lipiec
+	August	Sierpień
+	September	Wrzesień
+	October	Październik
+	November	Listopad
+	December	Grudzień
+	Done	Gotowe
+	This certificate is in your list of trusted certificates.	Ten certyfikat znajduje się na liście zaufanych certyfikatów.
+	This certificate is trusted through a certificate above it in the chain.	Ten certyfikat jest zaufany dzięki certyfikatowi wyżej w łańcuchu.
+	This certificate is not trusted. Signatures made with it show an unknown identity.	Ten certyfikat nie jest zaufany. Podpisy złożone przy jego użyciu mają nieznaną tożsamość.
+	Add to Trusted Certificates	Dodaj do zaufanych certyfikatów
+	Export…	Eksportuj…
+	PDF Optimizer	Optymalizator PDF
+	Discard Objects	Usuń obiekty
+	Discard User Data	Usuń dane użytkownika
+	Clean Up	Porządkowanie
+	Color Images	Obrazy kolorowe
+	Grayscale Images	Obrazy w skali szarości
+	Bicubic downsampling to	Zmniejsz rozdzielczość metodą dwusześcienną do
+	for images above	dla obrazów powyżej
+	Compression	Kompresja
+	ZIP	ZIP
+	Retain existing	Zachowaj istniejącą
+	Minimum	Minimalna
+	Low	Niska
+	High	Wysoka
+	Maximum	Maksymalna
+	Each image is measured where pages draw it; an image is replaced only if the result is smaller.	Każdy obraz jest mierzony w miejscu użycia na stronach; zostaje zastąpiony tylko wtedy, gdy wynik zajmuje mniej miejsca.
+	Discard all links, actions and JavaScript	Usuń wszystkie łącza, akcje i JavaScript
+	Discard alternate images	Usuń alternatywne obrazy
+	Discard embedded page thumbnails	Usuń osadzone miniatury stron
+	Discard document tags	Usuń tagi dokumentu
+	Discard embedded print settings	Usuń osadzone ustawienia druku
+	Discard bookmarks	Usuń zakładki
+	Discard hidden layer content	Usuń zawartość ukrytych warstw
+	Discard all comments, forms and multimedia	Usuń wszystkie komentarze, formularze i multimedia
+	Discard document information and metadata	Usuń informacje o dokumencie i metadane
+	Discard all object data (file attachments)	Usuń wszystkie dane obiektów (załączniki)
+	Discard private data of other applications	Usuń prywatne dane innych aplikacji
+	Discard hidden text	Usuń ukryty tekst
+	Use Flate to encode streams that are not encoded	Zakoduj nieskompresowane strumienie metodą Flate
+	Remove invalid links and bookmarks	Usuń nieprawidłowe łącza i zakładki
+	Remove unreferenced named destinations	Usuń nieużywane nazwane miejsca docelowe
+	Compress document structure (object streams)	Kompresuj strukturę dokumentu (strumienie obiektów)
+	Remove unused objects and merge identical ones	Usuń nieużywane obiekty i scal identyczne
+	Audit space usage…	Analiza wykorzystania miejsca…
+	Space Audit	Analiza miejsca
+	Bytes	Bajty
+	Content Streams	Strumienie zawartości
+	X Object Forms	Obiekty Form XObject
+	Structure Info	Informacje o strukturze
+	Thumbnails	Miniatury
+	Named Destinations	Nazwane miejsca docelowe
+	Color Spaces	Przestrzenie kolorów
+	Shadings	Cieniowania
+	Patterns (graphics objects)	Wzorce (obiekty graficzne)
+	Extended Graphics States	Rozszerzone stany grafiki
+	Embedded Files	Osadzone pliki
+	Document Overhead	Narzut dokumentu
+	Total	Łącznie
+	Text Field Properties	Właściwości pola tekstowego
+	Check Box Properties	Właściwości pola wyboru
+	Radio Button Properties	Właściwości przycisku opcji
+	Dropdown Properties	Właściwości listy rozwijanej
+	List Box Properties	Właściwości pola listy
+	Button Properties	Właściwości przycisku
+	Digital Signature Properties	Właściwości podpisu cyfrowego
+	Position	Położenie
+	Options	Opcje
+	Validate	Walidacja
+	Calculate	Obliczenia
+	Actions	Akcje
+	This field is locked. Unlock it to change its properties.	To pole jest zablokowane. Odblokuj je, aby zmienić właściwości.
+	Tooltip:	Podpowiedź:
+	Common Properties	Wspólne właściwości
+	Read Only	Tylko do odczytu
+	Required	Wymagane
+	Font Size:	Rozmiar czcionki:
+	Auto	Automatycznie
+	Text Color:	Kolor tekstu:
+	Borders and Colors	Obramowania i kolory
+	Border Color:	Kolor obramowania:
+	Fill Color:	Kolor wypełnienia:
+	No color	Bez koloru
+	Beveled	Wypukłe
+	Left:	Od lewej:
+	Bottom:	Od dołu:
+	Width:	Szerokość:
+	Height:	Wysokość:
+	Rotation:	Obrót:
+	Points from the page's bottom-left corner.	Punkty od lewego dolnego rogu strony.
+	Alignment:	Wyrównanie:
+	Default Value:	Wartość domyślna:
+	Multi-line	Wiele wierszy
+	Scroll long text	Przewijaj długi tekst
+	Allow Rich Text Formatting	Zezwalaj na formatowanie tekstu
+	Limit of	Limit
+	characters	znaków
+	Field is used for file selection	Pole służy do wyboru pliku
+	Check spelling	Sprawdzaj pisownię
+	Comb of	Podziel na
+	Export Value: {on}	Wartość eksportowana: {on}
+	Check box is checked by default	Pole wyboru jest domyślnie zaznaczone
+	Button is checked by default	Przycisk jest domyślnie zaznaczony
+	Buttons with the same name and value are selected in unison	Przyciski o tej samej nazwie i wartości są zaznaczane razem
+	Item:	Element:
+	Item List	Lista elementów
+	Up	W górę
+	Delete {o}	Usuń {o}
+	Add the choices people pick from.	Dodaj opcje do wyboru.
+	Default:	Domyślnie:
+	(none)	(brak)
+	Sort items	Sortuj elementy
+	Allow user to enter custom text	Zezwalaj na wpisywanie własnego tekstu
+	Multiple selection	Wybór wielu elementów
+	Commit selected value immediately	Zatwierdzaj wybraną wartość natychmiast
+	Number	Liczba
+	Percentage	Procent
+	Time	Czas
+	Special	Specjalny
+	Select format category:	Wybierz kategorię formatu:
+	The value is shown as typed.	Wartość jest wyświetlana tak, jak ją wpisano.
+	Decimal places:	Miejsca dziesiętne:
+	Separator style:	Styl separatora:
+	Currency symbol:	Symbol waluty:
+	Before the number	Przed liczbą
+	Negative number style:	Styl liczb ujemnych:
+	Format:	Format:
+	Custom:	Własny:
+	Zip Code	Kod pocztowy USA
+	Zip Code + 4	Kod pocztowy USA + 4 cyfry
+	Phone Number	Numer telefonu
+	Social Security Number	Numer ubezpieczenia społecznego USA
+	Arbitrary Mask	Dowolna maska
+	Mask:	Maska:
+	9 digit, A letter, O letter or digit, X any character	9 — cyfra, A — litera, O — litera lub cyfra, X — dowolny znak
+	Example: {sample}	Przykład: {sample}
+	Field value is not validated	Wartość pola nie jest walidowana
+	Field value is in range:	Wartość pola mieści się w zakresie:
+	Add an Action	Dodaj akcję
+	Select Trigger:	Wybierz zdarzenie:
+	Mouse Up	Zwolnienie przycisku myszy
+	Mouse Down	Naciśnięcie przycisku myszy
+	Mouse Enter	Wejście wskaźnika myszy
+	Mouse Exit	Wyjście wskaźnika myszy
+	On Focus	Uzyskanie fokusu
+	On Blur	Utrata fokusu
+	Select Action:	Wybierz akcję:
+	Open a web link	Otwórz łącze internetowe
+	Reset a form	Zresetuj formularz
+	Execute a menu item	Wykonaj polecenie menu
+	Show a field	Pokaż pole
+	Hide a field	Ukryj pole
+	Submit a form	Wyślij formularz
+	Fields to reset (comma-separated; empty: all)	Pola do zresetowania (oddzielone przecinkami; puste: wszystkie)
+	Print, NextPage, PrevPage, FirstPage or LastPage	Print, NextPage, PrevPage, FirstPage lub LastPage
+	Field names (comma-separated)	Nazwy pól (oddzielone przecinkami)
+	URL to submit to	Adres URL do wysłania danych
+	Script:	Skrypt:
+	Value:	Wartość:
+	No actions	Brak akcji
+	Value is not calculated	Wartość nie jest obliczana
+	Value is the	Wartość jest
+	sum (+)	sumą (+)
+	product (x)	iloczynem (x)
+	average	średnią
+	minimum	minimum
+	maximum	maksimum
+	of the following fields:	następujących pól:
+	Simplified field notation:	Uproszczony zapis pól:
+	Field names with + - * / and parentheses; put \\ before spaces in names.	Nazwy pól z + - * / i nawiasami; przed spacjami w nazwach wpisz \\.
+	Format text	Formatuj tekst
+	Bold	Pogrubienie
+	Italic	Kursywa
+	Align left	Wyrównaj do lewej
+	Centre	Wyśrodkuj
+	Align right	Wyrównaj do prawej
+	Justify	Wyjustuj
+	Standard fonts; text outside Windows-1252 isn't supported yet.	Standardowe czcionki; tekst spoza Windows-1252 nie jest jeszcze obsługiwany.
+	Edit image	Edytuj obraz
+	Rotate counterclockwise	Obróć w lewo
+	Rotate clockwise	Obróć w prawo
+	Flip horizontal	Odbij w poziomie
+	Flip vertical	Odbij w pionie
+	Replace image	Zastąp obraz
+	Crop (% trimmed from each side)	Przytnij (% usuwany z każdej strony)
+	Click on the page to add text; each click starts a new box, and ✓ finishes. Drag items to move them, drag a corner to resize, double-click text to edit it.	Kliknij stronę, aby dodać tekst; każde kliknięcie tworzy nowe pole, a ✓ kończy edycję. Przeciągaj elementy, aby je przenosić, i narożnik, aby zmieniać rozmiar. Kliknij tekst dwukrotnie, aby go edytować.
+	Choose an image	Wybierz obraz
+	Export to Image	Eksportuj do obrazu
+	Export to Text	Eksportuj do tekstu
+	Export All Images	Eksportuj wszystkie obrazy
+	Resolution	Rozdzielczość
+	Format	Format
+	Quality	Jakość
+	One {f} file per page, named after the document.	Jeden plik {f} na stronę, z nazwą utworzoną od nazwy dokumentu.
+	Exclude images smaller than	Pomiń obrazy mniejsze niż
+	No limit	Bez limitu
+	Each image once, named after the document and page. JPEG images are saved unchanged; others as PNG.	Każdy obraz zapisywany raz, z nazwą utworzoną od dokumentu i strony. Obrazy JPEG są zapisywane bez zmian, pozostałe jako PNG.
+	Plain text in reading order; pages are separated by form feeds.	Zwykły tekst w kolejności czytania; strony oddzielone znakami wysuwu strony.
+	Create {what}	Utwórz {what}
+	initials	inicjały
+	signature	podpis
+	Create Custom Stamp	Utwórz własny stempel
+	From {file}	Z {file}
+	Category:	Kategoria:
+	e.g. My stamps	np. Moje stemple
+	Name:	Nazwa:
+	Custom	Własny
+	Delete stamp	Usuń stempel
+	Create custom stamp…	Utwórz własny stempel…
+	From a PDF page or an image	Ze strony PDF lub obrazu
+	Line spacing	Odstęp między wierszami
+	Character spacing	Odstęp między znakami
+	Horizontal scale	Skala pozioma
+	Rotate Clockwise	Obróć w prawo
+	Rotate Counterclockwise	Obróć w lewo
+	Flip Horizontal	Odbij w poziomie
+	Flip Vertical	Odbij w pionie
+	Replace Image…	Zastąp obraz…
+	Save Image As…	Zapisz obraz jako…
+	Check for updates	Sprawdź aktualizacje
+	No check has run yet.	Nie sprawdzono jeszcze aktualizacji.
+	Checking for a newer version…	Sprawdzanie dostępności nowszej wersji…
+	PdfCraft {v} is available.	PdfCraft {v} jest dostępny.
+	You have version {c}. Download the new version from its release page.	Masz wersję {c}. Pobierz nową wersję ze strony wydania.
+	PdfCraft {c} is up to date.	PdfCraft {c} jest aktualny.
+	Couldn't check for updates: {e}	Nie można sprawdzić aktualizacji: {e}
+	You have version {c}. All releases are listed at {page}.	Masz wersję {c}. Wszystkie wydania są dostępne na {page}.
+	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Sprawdza najnowsze wydanie na GitHubie. Nic nie jest pobierane ani instalowane automatycznie.
+	Download	Pobierz
+	Later	Później
+	none	brak
+	Declared conformance: {shown}	Deklarowana zgodność: {shown}
+	Output intent: {list}	Profil wyjściowy: {list}
+	Conformance level:	Poziom zgodności:
+	No problems found: the document conforms to {level}.	Nie znaleziono problemów: dokument jest zgodny z {level}.
+	 (page {p})	 (strona {p})
+	  · not fixable here	  · nie można naprawić tutaj
+	Verify	Weryfikuj
+	Box	Obszar
+	Units	Jednostki
+	Set to zero	Wyzeruj
+	Current page ({n})	Bieżąca strona ({n})
+	Subset	Podzbiór
+	Update	Aktualizuj
+	Add	Dodaj
+	{verb} Header and Footer	{verb} nagłówek i stopkę
+	{verb} Watermark	{verb} znak wodny
+	{verb} Background	{verb} tło
+	Margins (in)	Marginesy (cale)
+	Left Header Text	Lewy tekst nagłówka
+	Center Header Text	Środkowy tekst nagłówka
+	Right Header Text	Prawy tekst nagłówka
+	Left Footer Text	Lewy tekst stopki
+	Center Footer Text	Środkowy tekst stopki
+	Right Footer Text	Prawy tekst stopki
+	Insert Page Number	Wstaw numer strony
+	Insert Date	Wstaw datę
+	Start page number	Początkowy numer strony
+	Source	Źródło
+	Fit to page	Dopasuj do strony
+	Rotation	Obrót
+	Appear behind page	Umieść za zawartością strony
+	Appear on top of page	Umieść przed zawartością strony
+	From colour	Z koloru
+	Page Range Options	Opcje zakresu stron
+	Preview: page {p} of {n}	Podgląd: strona {p} z {n}
+	Applies to 1 page	Dotyczy 1 strony
+	Applies to {n} pages	Liczba objętych stron: {n}
+	Replaces the existing one on those pages.	Zastępuje istniejący element na tych stronach.
+	PDF or image	PDF lub obraz
+	No file chosen	Nie wybrano pliku
+	Page number	Numer strony
+	Scale relative to target page	Skala względem strony docelowej
+	Link Properties	Właściwości łącza
+	Create Link	Utwórz łącze
+	Link Appearance	Wygląd łącza
+	Link Type:	Typ łącza:
+	Visible Rectangle	Widoczny prostokąt
+	Invisible Rectangle	Niewidoczny prostokąt
+	Highlight Style:	Styl podświetlenia:
+	Invert	Odwrócenie
+	Outline	Obrys
+	Inset	Wklęsły
+	Line Thickness:	Grubość linii:
+	Thin	Cienka
+	Thick	Gruba
+	Line Style:	Styl linii:
+	Solid	Ciągła
+	Dashed	Przerywana
+	Color:	Kolor:
+	Link Action	Akcja łącza
+	Open a web page	Otwórz stronę internetową
+	Go to a page view	Przejdź do widoku strony
+	Type the web address.	Wpisz adres internetowy.
+	This document has no signatures.	Ten dokument nie zawiera podpisów.
+	The Keychain's digital IDs couldn't be listed: {e}	Nie można wyświetlić identyfikatorów cyfrowych z pęku kluczy: {e}
+	Signed and saved to {path}	Podpisano i zapisano w {path}
+	Couldn't open revision {n}: {e}	Nie można otworzyć rewizji {n}: {e}
+	Couldn't open the signed version: {e}	Nie można otworzyć podpisanej wersji: {e}
+	Sign with a Digital ID	Podpisz identyfikatorem cyfrowym
+	Choose the digital ID that you want to use for signing:	Wybierz identyfikator cyfrowy do podpisania:
+	Keychain  ·  	Pęk kluczy  ·  
+	Windows store  ·  	Magazyn Windows  ·  
+	Issued by: 	Wystawca: 
+	, Expires: 	, Wygasa: 
+	No digital IDs yet.	Brak identyfikatorów cyfrowych.
+	Configure New Digital ID	Skonfiguruj nowy identyfikator cyfrowy
+	Continue	Kontynuuj
+	Configure a Digital ID for Signing	Skonfiguruj identyfikator cyfrowy do podpisywania
+	Use a Digital ID from a file	Użyj identyfikatora cyfrowego z pliku
+	Create a new Digital ID (self-signed, saved to a password-protected file)	Utwórz nowy identyfikator cyfrowy (samopodpisany, zapisany w pliku chronionym hasłem)
+	Name	Nazwa
+	Organizational Unit	Jednostka organizacyjna
+	Organization Name	Nazwa organizacji
+	Email Address	Adres e-mail
+	Country/Region	Kraj/region
+	Key Algorithm	Algorytm klucza
+	Confirm Password	Potwierdź hasło
+	Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others.	Ważny przez 5 lat, do podpisów cyfrowych. Samopodpisane identyfikatory zwykle nie są zaufane dla innych osób.
+	File (.p12, .pfx)	Plik (.p12, .pfx)
+	Digital ID	Identyfikator cyfrowy
+	Browse…	Przeglądaj…
+	{verb} as "{name}"	{verb} jako „{name}”
+	Certify	Certyfikuj
+	The signature will be invisible.	Podpis będzie niewidoczny.
+	Distinguished name	Nazwa wyróżniająca
+	Labels	Etykiety
+	Permitted actions after certifying	Dozwolone działania po certyfikacji
+	No changes allowed	Zmiany niedozwolone
+	Annotations, form fill-in, and digital signatures	Adnotacje, wypełnianie formularzy i podpisy cyfrowe
+	Form fill-in and digital signatures	Wypełnianie formularzy i podpisy cyfrowe
+	The key is in the macOS Keychain, which may ask to allow PdfCraft to use it.	Klucz znajduje się w pęku kluczy macOS, który może poprosić o zgodę na jego użycie przez PdfCraft.
+	The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.	Klucz znajduje się w magazynie certyfikatów Windows, który może poprosić o zgodę na jego użycie przez PdfCraft.
+	Digital ID password	Hasło identyfikatora cyfrowego
+	Back	Wstecz
+	Validate all	Zweryfikuj wszystkie
+	Sign this field…	Podpisz to pole…
+	Signature is valid:	Podpis jest prawidłowy:
+	Signature validity is UNKNOWN:	Ważność podpisu jest NIEZNANA:
+	Signature is INVALID:	Podpis jest NIEPRAWIDŁOWY:
+	Signature Details	Szczegóły podpisu
+	Reason	Powód
+	Signing time	Czas podpisania
+	Algorithm	Algorytm
+	Signer	Podpisujący
+	Issued by	Wystawca
+	Valid	Ważny
+	Field	Pole
+	Field: {field} on page {p}	Pole: {field} na stronie {p}
+	Add to trusted certificates	Dodaj do zaufanych certyfikatów
+	View signed version	Wyświetl podpisaną wersję
+	Show certificate…	Pokaż certyfikat…
+	Export certificate…	Eksportuj certyfikat…
+	Certificate Viewer	Przeglądarka certyfikatów
+	This dialog shows the details of a certificate and its chain.	To okno wyświetla szczegóły certyfikatu i jego łańcucha.
+	Trust	Zaufanie
+	Issued to	Wystawiony dla
+	Valid from	Ważny od
+	Valid to	Ważny do
+	Intended usage	Przeznaczenie
+	Any	Dowolne
+	Version	Wersja
+	Serial number	Numer seryjny
+	Issuer	Wystawca certyfikatu
+	Validity starts	Początek ważności
+	Validity ends	Koniec ważności
+	Public key	Klucz publiczny
+	Key usage	Użycie klucza
+	Not present	Brak
+	Self-signed	Samopodpisany
+	Edit Action	Edytuj akcję
+	New Action	Nowa akcja
+	Action name:	Nazwa akcji:
+	Description:	Opis:
+	Steps	Kroki
+	Add the steps this action runs, in order.	Dodaj kolejno kroki wykonywane przez tę akcję.
+	Add Step	Dodaj krok
+	An action with this name already exists.	Akcja o tej nazwie już istnieje.
+	New Action…	Nowa akcja…
+	Edit…	Edytuj…
+	Add watermark	Dodaj znak wodny
+	Add header	Dodaj nagłówek
+	Add footer	Dodaj stopkę
+	Set document title	Ustaw tytuł dokumentu
+	Run a JavaScript	Uruchom JavaScript
+	Prepare for Distribution	Przygotuj do dystrybucji
+	Remove hidden information and flatten comments and form fields, so recipients see only the pages.	Usuń ukryte informacje i spłaszcz komentarze oraz pola formularza, aby odbiorcy widzieli tylko strony.
+	Optimize Scanned Documents	Optymalizuj zeskanowane dokumenty
+	Make scans searchable, then make them smaller.	Umożliw wyszukiwanie w skanach, a następnie zmniejsz ich rozmiar.
+	Add Page Numbers	Dodaj numery stron
+	Number every page in the footer.	Ponumeruj każdą stronę w stopce.
+	Mark as Confidential	Oznacz jako poufne
+	A diagonal CONFIDENTIAL watermark on every page.	Ukośny znak wodny POUFNE na każdej stronie.
+	Sanitize Documents	Oczyść dokumenty
+	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	Usuń ukryte informacje, metadane, skrypty i osadzoną zawartość oraz zapisz pliki na nowo.
+	Type text	Wpisz tekst
+	Text to insert	Tekst do wstawienia
+	Replacement text	Tekst zastępczy
+	Edit text…	Edytuj tekst…
+	Add a sticky note here	Dodaj notatkę tutaj
+	{kind} Properties	Właściwości: {kind}
+	Appearance	Wygląd
+	General	Ogólne
+	Review History	Historia recenzji
+	This comment's appearance can't be changed yet.	Nie można jeszcze zmienić wyglądu tego komentarza.
+	Icon	Ikona
+	Thickness	Grubość
+	Modified	Zmodyfikowano
+	No status has been set.	Nie ustawiono statusu.
+	Compare Files	Porównaj pliki
+	Old file:	Stary plik:
+	Open the older version first	Najpierw otwórz starszą wersję
+	New file:	Nowy plik:
+	Text is compared word by word; the differences are shown on the new file.	Tekst jest porównywany słowo po słowie; różnice są wyświetlane w nowym pliku.
+	Compare this file with an older version: Compare files… in All tools.	Porównaj ten plik ze starszą wersją: Porównaj pliki… we Wszystkich narzędziach.
+	No differences in the text.	Brak różnic w tekście.
+	{n} {kind}	{n} {kind}
+	Inserted	Wstawione
+	Deleted	Usunięte
+	Replaced	Zastąpione
+	Visual	Wizualne
+	Mark as comments	Oznacz jako komentarze
+	Report…	Raport…
+	{kind} · page {p}	{kind} · strona {p}
+	Set Alternate Text	Ustaw tekst alternatywny
+	This document has no tagged figures.	Ten dokument nie ma ilustracji oznaczonych tagami.
+	 on page {p}	 na stronie {p}
+	Figure {i} of {n}{page}	Ilustracja {i} z {n}{page}
+	No preview	Brak podglądu
+	Alternate text	Tekst alternatywny
+	Describe the figure	Opisz ilustrację
+	Decorative figure	Ilustracja dekoracyjna
+	Previous figure	Poprzednia ilustracja
+	Next figure	Następna ilustracja
+	Save & Close	Zapisz i zamknij
+	Accessibility Checker Options	Opcje sprawdzania dostępności
+	Report Options	Opcje raportu
+	Create accessibility report	Utwórz raport dostępności
+	Page Range	Zakres stron
+	All pages in document	Wszystkie strony dokumentu
+	Checking Options ({on} of 32 in all categories)	Opcje sprawdzania ({on} z 32 we wszystkich kategoriach)
+	Show this dialog when the Checker starts	Pokaż to okno przy uruchamianiu sprawdzania
+	Select All	Zaznacz wszystko
+	Clear All	Wyczyść wszystko
+	Start Checking	Rozpocznij sprawdzanie
+	This document hasn't been checked yet.	Ten dokument nie został jeszcze sprawdzony.
+	No issues found	Nie znaleziono problemów
+	1 issue	1 problem
+	{n} issues	Liczba problemów: {n}
+	{label} (1 issue)	{label} (1 problem)
+	{label} ({n} issues)	{label} (liczba problemów: {n})
+	Check again	Sprawdź ponownie
+	Report	Raport
+	Show the accessibility report	Pokaż raport dostępności
+	Collapse	Zwiń
+	Expand	Rozwiń
+	{rule} - {status}	{rule} - {status}
+	Passed	Zaliczone
+	Failed	Niezaliczone
+	Needs manual check	Wymaga sprawdzenia ręcznego
+	Skipped	Pominięte
+	Fix	Napraw
+	Skip Rule	Pomiń regułę
+	Explain	Wyjaśnij
+	Check Again	Sprawdź ponownie
+	Show Report	Pokaż raport
+	Options…	Opcje…
+	Go to the page	Przejdź do strony
+	Page Content	Zawartość strony
+	Forms	Formularze
+	Alternate Text	Tekst alternatywny
+	Tables	Tabele
+	Lists	Listy
+	Headings	Nagłówki
+	Accessibility permission flag	Flaga uprawnień dostępności
+	Accessibility permission flag is set	Flaga uprawnień dostępności jest ustawiona
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	Ustawienia zabezpieczeń muszą umożliwiać technologiom asystującym odczyt zawartości („Włącz dostęp do tekstu dla czytników ekranu”). Zmień zabezpieczenia dokumentu, aby na to zezwolić.
+	Image-only PDF	PDF zawierający wyłącznie obrazy
+	Document is not image-only PDF	Dokument nie jest plikiem PDF zawierającym wyłącznie obrazy
+	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	Stron będących jedynie obrazami tekstu nie można odczytać na głos ani przeszukiwać. Rozpoznaj tekst (OCR), aby dodać warstwę tekstową.
+	Document is tagged PDF	Dokument jest plikiem PDF z tagami
+	Tags give the document a logical structure that assistive technology follows. Tag the document (Automatically tag PDF).	Tagi nadają dokumentowi strukturę logiczną używaną przez technologie asystujące. Oznacz dokument tagami (Automatycznie oznacz PDF tagami).
+	Logical Reading Order	Logiczna kolejność czytania
+	Document structure provides a logical reading order	Struktura dokumentu zapewnia logiczną kolejność czytania
+	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	Sprawdź, czy kolejność tagów odpowiada kolejności czytania przez osobę widzącą. Popraw ją narzędziem Kolejność czytania lub w panelu Tagi.
+	Primary language	Język podstawowy
+	Text language is specified	Określono język tekstu
+	Screen readers choose their voice from the document's language. Set it in Document Properties > Advanced > Language.	Czytniki ekranu dobierają głos na podstawie języka dokumentu. Ustaw go w Właściwości dokumentu > Zaawansowane > Język.
+	Document title is showing in title bar	Tytuł dokumentu jest wyświetlany na pasku tytułu
+	The window should show a meaningful title rather than the file name. Set a title and Initial View > Show: Document Title.	Okno powinno wyświetlać zrozumiały tytuł zamiast nazwy pliku. Ustaw tytuł i Widok początkowy > Pokaż: Tytuł dokumentu.
+	Bookmarks are present in large documents	Duże dokumenty zawierają zakładki
+	Documents of more than 20 pages need bookmarks for navigation. Add bookmarks for the main sections.	Dokumenty dłuższe niż 20 stron potrzebują zakładek do nawigacji. Dodaj zakładki głównych sekcji.
+	Color contrast	Kontrast kolorów
+	Document has appropriate color contrast	Dokument ma odpowiedni kontrast kolorów
+	Text must contrast enough with its background for people with low vision. Check the colours by eye or with a contrast tool.	Tekst musi wystarczająco kontrastować z tłem dla osób słabowidzących. Sprawdź kolory wzrokowo lub narzędziem pomiaru kontrastu.
+	Tagged content	Zawartość z tagami
+	All page content is tagged	Cała zawartość strony jest oznaczona tagami
+	Everything on a page must be tagged or marked as an artifact (decoration, headers, footers). Tag the untagged content.	Każdy element strony musi mieć tag lub być oznaczony jako artefakt (dekoracja, nagłówek, stopka). Oznacz nieotagowaną zawartość.
+	Tagged annotations	Adnotacje z tagami
+	All annotations are tagged	Wszystkie adnotacje są oznaczone tagami
+	Comments, links and fields must be in the tag tree to be announced. Tag the annotations.	Komentarze, łącza i pola muszą znajdować się w drzewie tagów, aby mogły zostać odczytane. Oznacz adnotacje tagami.
+	Tab order	Kolejność tabulacji
+	Tab order is consistent with structure order	Kolejność tabulacji jest zgodna z kolejnością struktury
+	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	Na stronach z łączami, komentarzami lub polami tabulacja powinna odpowiadać strukturze. Naprawa ustawia kolejność tabulacji każdej strony na Użyj struktury dokumentu.
+	Character encoding	Kodowanie znaków
+	Reliable character encoding is provided	Zapewniono poprawne kodowanie znaków
+	Fonts must map their characters to Unicode so text can be read and copied. Fix the fonts or recreate the PDF.	Czcionki muszą mapować znaki na Unicode, aby tekst można było odczytywać i kopiować. Popraw czcionki lub utwórz PDF ponownie.
+	Tagged multimedia	Multimedia z tagami
+	All multimedia objects are tagged	Wszystkie obiekty multimedialne są oznaczone tagami
+	Video, sound and rich media must be tagged to be announced. Tag the multimedia annotations.	Wideo, dźwięk i inne multimedia muszą mieć tagi, aby mogły zostać odczytane. Oznacz adnotacje multimedialne tagami.
+	Screen flicker	Migotanie ekranu
+	Page will not cause screen flicker	Strona nie powoduje migotania ekranu
+	Animation that flashes can cause seizures. Check scripts and media for flicker.	Migające animacje mogą wywoływać napady padaczkowe. Sprawdź skrypty i multimedia pod kątem migotania.
+	Scripts	Skrypty
+	No inaccessible scripts	Brak niedostępnych skryptów
+	Timed responses	Odpowiedzi z limitem czasu
+	Page does not require timed responses	Strona nie wymaga odpowiedzi w określonym czasie
+	People may need more time to respond. Check that nothing has a time limit.	Niektóre osoby mogą potrzebować więcej czasu na odpowiedź. Sprawdź, czy nie ma limitów czasu.
+	Navigation links	Łącza nawigacyjne
+	Navigation links are not repetitive	Łącza nawigacyjne nie powtarzają się
+	Repeated navigation links should be skippable. Check links that appear on every page.	Powtarzające się łącza nawigacyjne powinno dać się pominąć. Sprawdź łącza występujące na każdej stronie.
+	Tagged form fields	Pola formularza z tagami
+	All form fields are tagged	Wszystkie pola formularza są oznaczone tagami
+	Form fields must be in the tag tree (Form tags) to be announced. Tag the form fields.	Pola formularza muszą być w drzewie tagów (tagi Form), aby mogły zostać odczytane. Oznacz pola formularza tagami.
+	Field descriptions	Opisy pól
+	All form fields have description	Wszystkie pola formularza mają opisy
+	Each field needs a tooltip that says what to enter. Add one in Field Properties > General > Tooltip.	Każde pole potrzebuje podpowiedzi opisującej, co należy wpisać. Dodaj ją w Właściwości pola > Ogólne > Podpowiedź.
+	Figures alternate text	Tekst alternatywny ilustracji
+	Figures require alternate text	Ilustracje wymagają tekstu alternatywnego
+	Pictures need alternate text that describes them, or must be marked decorative. Add alternate text to each figure.	Obrazy potrzebują opisowego tekstu alternatywnego lub oznaczenia jako dekoracyjne. Dodaj tekst alternatywny do każdej ilustracji.
+	Nested alternate text	Zagnieżdżony tekst alternatywny
+	Alternate text that will never be read	Tekst alternatywny, który nigdy nie zostanie odczytany
+	Alternate text inside an element that already has alternate text is never read. Remove the inner alternate text.	Tekst alternatywny wewnątrz elementu, który już go ma, nie jest odczytywany. Usuń wewnętrzny tekst alternatywny.
+	Associated with content	Powiązanie z zawartością
+	Alternate text must be associated with some content	Tekst alternatywny musi być powiązany z zawartością
+	Alternate text on an element without page content is never reached. Remove it or attach the element to content.	Tekst alternatywny elementu bez zawartości strony jest niedostępny. Usuń go lub powiąż element z zawartością.
+	Hides annotation	Ukrywanie adnotacji
+	Alternate text should not hide annotation	Tekst alternatywny nie powinien ukrywać adnotacji
+	Alternate text on an element that contains a link or field hides that annotation from assistive technology. Move the alternate text.	Tekst alternatywny elementu zawierającego łącze lub pole ukrywa tę adnotację przed technologiami asystującymi. Przenieś tekst alternatywny.
+	Other elements alternate text	Tekst alternatywny innych elementów
+	Other elements that require alternate text	Inne elementy wymagające tekstu alternatywnego
+	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Formuły i podobne elementy nietekstowe potrzebują tekstu alternatywnego. Dodaj go do nich.
+	Rows	Wiersze
+	TR must be a child of Table, THead, TBody, or TFoot	TR musi być elementem podrzędnym Table, THead, TBody lub TFoot
+	Table cells belong in a row. Fix the table's tags.	Komórki tabeli należą do wiersza. Popraw tagi tabeli.
+	Headers	Nagłówki tabel
+	Tables should have headers	Tabele powinny mieć nagłówki
+	Header cells (TH) tell listeners what each column or row holds. Mark the header cells.	Komórki nagłówkowe (TH) informują, co zawiera kolumna lub wiersz. Oznacz komórki nagłówkowe.
+	Regularity	Regularność
+	Tables must contain the same number of columns in each row and rows in each column	Tabele muszą mieć tyle samo kolumn w każdym wierszu i wierszy w każdej kolumnie
+	Irregular tables confuse cell navigation. Give every row the same number of cells (counting spans).	Nieregularne tabele utrudniają nawigację między komórkami. Zapewnij każdemu wierszowi tyle samo komórek (uwzględniając scalanie).
+	Summary	Podsumowanie
+	Tables must have a summary	Tabele muszą mieć podsumowanie
+	A summary describes the table's purpose and layout. Add a Summary attribute to each table.	Podsumowanie opisuje cel i układ tabeli. Dodaj atrybut Summary do każdej tabeli.
+	List items	Elementy listy
+	LI must be a child of L	LI musi być elementem podrzędnym L
+	List items belong in a list. Fix the list's tags.	Elementy listy należą do listy. Popraw tagi listy.
+	Lbl and LBody	Lbl i LBody
+	Lbl and LBody must be children of LI	Lbl i LBody muszą być elementami podrzędnymi LI
+	List labels and bodies belong in a list item. Fix the list's tags.	Etykiety i treść listy należą do jej elementu. Popraw tagi listy.
+	Appropriate nesting	Właściwe zagnieżdżenie
+	Heading levels shouldn't skip (an H1 followed by an H3). Retag the headings.	Poziomy nagłówków nie powinny być pomijane (H1, a następnie H3). Popraw tagi nagłówków.
+	TH and TD	TH i TD
+	TH and TD must be children of TR	TH i TD muszą być elementami podrzędnymi TR
+	Mark Page Range	Oznacz zakres stron
+	Pages from	Strony od
+	Single word or phrase	Pojedyncze słowo lub fraza
+	Text to find	Tekst do znalezienia
+	Patterns	Wzorce
+	Phone Numbers	Numery telefonów
+	Email Addresses	Adresy e-mail
+	Credit Cards	Karty kredytowe
+	Social Security Numbers	Numery ubezpieczenia społecznego USA
+	Dates	Daty
+	Text in images isn't found; recognise text (OCR) first.	Tekst w obrazach nie zostanie znaleziony; najpierw rozpoznaj tekst (OCR).
+	No matches.	Brak dopasowań.
+	{n} match(es) marked for redaction.	Liczba dopasowań oznaczonych do utajnienia: {n}.
+	Redaction Tool Properties	Właściwości narzędzia utajniania
+	Redacted area fill colour:	Kolor wypełnienia utajnionego obszaru:
+	Use overlay text	Użyj tekstu nakładanego
+	Custom text:	Własny tekst:
+	Font:	Czcionka:
+	Font size:	Rozmiar czcionki:
+	Auto-size text to fit redaction region	Dopasuj rozmiar tekstu do utajnianego obszaru
+	Font colour:	Kolor czcionki:
+	Repeat overlay text	Powtarzaj tekst nakładany
+	Text alignment:	Wyrównanie tekstu:
+	Center	Środek
+	Apply redactions	Zastosuj utajnienia
+	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Zamierzasz zastosować 1 oznaczenie do utajnienia. Tekst, obrazy i rysunki pod oznaczeniami oraz nakładające się na nie komentarze i pola formularza zostaną trwale usunięte.
+	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Zamierzasz zastosować oznaczenia do utajnienia w liczbie {n}. Tekst, obrazy i rysunki pod oznaczeniami oraz nakładające się na nie komentarze i pola formularza zostaną trwale usunięte.
+	Save the document afterwards: saving rewrites the whole file so no trace of the removed content stays in it.	Następnie zapisz dokument: zapis tworzy cały plik na nowo, aby nie pozostał w nim żaden ślad usuniętej zawartości.
+	Select the items to remove from this document.	Wybierz elementy do usunięcia z tego dokumentu.
+	Metadata	Metadane
+	File attachments	Załączniki plikowe
+	Comments and markups	Komentarze i oznaczenia
+	Hidden text	Ukryty tekst
+	Hidden layers	Ukryte warstwy
+	Links, actions and JavaScripts	Łącza, akcje i skrypty JavaScript
+	Private data of other applications	Prywatne dane innych aplikacji
+	None found	Nic nie znaleziono
+	Form fields are flattened: their values stay visible. Saving rewrites the whole file.	Pola formularza są spłaszczane: ich wartości pozostają widoczne. Zapis tworzy cały plik na nowo.
+	Remove	Usuń
+	Sanitizing removes hidden information from the document: metadata, file attachments, comments, form fields (flattened), hidden text and layers, bookmarks, links, actions and scripts, and private application data.	Oczyszczanie usuwa ukryte informacje z dokumentu: metadane, załączniki, komentarze, pola formularza (spłaszczane), ukryty tekst i warstwy, zakładki, łącza, akcje i skrypty oraz prywatne dane aplikacji.
+	Save the document afterwards; saving rewrites the whole file so nothing removed stays in it.	Następnie zapisz dokument; zapis tworzy cały plik na nowo, aby nie pozostały w nim usunięte dane.
+	Printer:	Drukarka:
+	Save as PDF	Zapisz jako PDF
+	{name} (default)	{name} (domyślna)
+	Copies:	Kopie:
+	Collate	Sortuj kopie
+	Print in grayscale	Drukuj w skali szarości
+	Two-sided:	Druk dwustronny:
+	Off	Wyłączony
+	Flip on long edge	Odwracaj wzdłuż długiej krawędzi
+	Flip on short edge	Odwracaj wzdłuż krótkiej krawędzi
+	Paper:	Papier:
+	Pages to Print	Strony do wydrukowania
+	More options:	Więcej opcji:
+	All pages in range	Wszystkie strony w zakresie
+	Odd pages only	Tylko strony nieparzyste
+	Even pages only	Tylko strony parzyste
+	Reverse pages	Odwróć kolejność stron
+	Page Sizing & Handling	Rozmiar i układ stron
+	Size	Rozmiar
+	Poster	Plakat
+	Multiple	Wiele stron
+	Booklet	Broszura
+	Fit	Dopasuj
+	Shrink oversized pages	Zmniejsz zbyt duże strony
+	Custom scale:	Własna skala:
+	Tile scale:	Skala kafelków:
+	Overlap:	Zakładka kafelków:
+	Cut marks	Znaczniki cięcia
+	Pages per sheet:	Strony na arkusz:
+	Page order:	Kolejność stron:
+	Horizontal	Pozioma
+	Horizontal reversed	Pozioma odwrócona
+	Vertical	Pionowa
+	Vertical reversed	Pionowa odwrócona
+	Print page border	Drukuj obramowanie strony
+	Auto-rotate pages	Automatycznie obracaj strony
+	Booklet subset:	Część broszury:
+	Both sides	Obie strony
+	Front side only	Tylko przednia strona
+	Back side only	Tylko tylna strona
+	Binding:	Oprawa:
+	Left	Lewa
+	Right	Prawa
+	Orientation:	Orientacja:
+	Auto portrait/landscape	Automatycznie pionowa/pozioma
+	Portrait	Pionowa
+	Landscape	Pozioma
+	Comments & Forms	Komentarze i formularze
+	Document	Dokument
+	Document and markups	Dokument i oznaczenia
+	Document and stamps	Dokument i stemple
+	Form fields only	Tylko pola formularza
+	Previous sheet	Poprzedni arkusz
+	Next sheet	Następny arkusz
+	No sheets	Brak arkuszy
+	Sheet {s} of {n}	Arkusz {s} z {n}
+	Removed 1 hidden item. Save to remove them from the file.	Usunięto 1 ukryty element. Zapisz, aby usunąć go z pliku.
+	Removed {n} hidden items. Save to remove them from the file.	Usunięto ukryte elementy w liczbie {n}. Zapisz, aby usunąć je z pliku.
+	Document sanitized. Save to finish: saving rewrites the whole file.	Dokument oczyszczony. Zapisz, aby zakończyć: zapis tworzy cały plik na nowo.
+	Applied 1 redaction mark. Save to remove the content from the file.	Zastosowano 1 oznaczenie do utajnienia. Zapisz, aby usunąć zawartość z pliku.
+	Applied {n} redaction marks. Save to remove the content from the file.	Zastosowano oznaczenia do utajnienia w liczbie {n}. Zapisz, aby usunąć zawartość z pliku.
+	JavaScript Console	Konsola JavaScript
+	JavaScript is turned off (Preferences ▸ JavaScript).	JavaScript jest wyłączony (Preferencje ▸ JavaScript).
+	Output appears here.	Tutaj pojawią się wyniki.
+	Script Name:	Nazwa skryptu:
+	This document has no document-level scripts.	Ten dokument nie zawiera skryptów na poziomie dokumentu.
+	No form fields were detected	Nie wykryto pól formularza
+	Detected 1 form field	Wykryto 1 pole formularza
+	Detected {n} form fields	Liczba wykrytych pól formularza: {n}
+	{field}: {e}	{field}: {e}
+	Current page	Bieżąca strona
+	Selected pages	Zaznaczone strony
+	Document language	Język dokumentu
+	Output	Wynik
+	Searchable Image (Exact)	Obraz z możliwością wyszukiwania (dokładny)
+	Adds invisible text over each word; the page image is not changed	Dodaje niewidoczny tekst nad każdym słowem; obraz strony pozostaje bez zmian
+	Downsample to	Zmniejsz rozdzielczość do
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	Rozpoznawanie tekstu nie jest zainstalowane: brakuje plików modeli. Zainstaluj PdfCraft ponownie lub ustaw PDFCRAFT_MODELS na folder zawierający te pliki.
+	Settings	Ustawienia
+	Optional	Opcjonalne
+	Planned · {m}	Planowane · {m}
+	Planned for milestone {m} — open to see what it will include	Planowane na etap {m} — otwórz, aby zobaczyć planowane funkcje
+	Coming in milestone {m}. Items marked Ready work today.	Dostępne w etapie {m}. Elementy oznaczone jako Gotowe działają już teraz.
+	1 mark	1 oznaczenie
+	{n} marks	Liczba oznaczeń: {n}
+	Dynamic	Dynamiczne
+	Sign Here	Podpisz tutaj
+	Standard Business	Standardowe biznesowe
+	Choose a stamp, then click on the page to place it.	Wybierz stempel, a następnie kliknij stronę, aby go umieścić.
+	Note	Notatka
+	Polyline	Łamana
+	Attachment	Załącznik
+	Callout	Objaśnienie
+	Typewriter	Tekst maszynowy
+	Checked	Zaznaczone
+	Unchecked	Niezaznaczone
+	Marked	Oznaczone
+	Locked	Zablokowane
+	Search comments	Szukaj komentarzy
+	Add a comment	Dodaj komentarz
+	No comments yet.	Brak komentarzy.
+	Pick a tool in the quick bar, or type above.	Wybierz narzędzie na pasku szybkiego dostępu lub wpisz tekst powyżej.
+	No comments match.	Brak pasujących komentarzy.
+	Unknown author	Nieznany autor
+	No colour	Bez koloru
+	Remove checkmark	Usuń znacznik wyboru
+	Mark with checkmark	Oznacz znacznikiem wyboru
+	Reply	Odpowiedz
+	Add a reply	Dodaj odpowiedź
+	Post	Opublikuj
+	Page {label}	Strona {label}
+	{kind} — click to show it on the page	{kind} — kliknij, aby pokazać na stronie
+	Set status	Ustaw status
+	Copy text	Kopiuj tekst
+	Properties…	Właściwości…
+	Make Current Properties Default	Ustaw bieżące właściwości jako domyślne
+	More options	Więcej opcji
+	Sort by	Sortuj według
+	Author	Autor
+	Type	Typ
+	Colour	Kolor
+	Show all comments	Pokaż wszystkie komentarze
+	Create PDF comment summary…	Utwórz podsumowanie komentarzy w PDF…
+	Export all to data file…	Eksportuj wszystkie do pliku danych…
+	Filter comments	Filtruj komentarze
+	Status	Status
+	Accepted	Zaakceptowane
+	Rejected	Odrzucone
+	Cancelled	Anulowane
+	Completed	Ukończone
+	Show all	Pokaż wszystko
+	Yellow	Żółty
+	Orange	Pomarańczowy
+	Red	Czerwony
+	Pink	Różowy
+	Purple	Fioletowy
+	Blue	Niebieski
+	Light blue	Jasnoniebieski
+	Green	Zielony
+	Gray	Szary
+	Black	Czarny
+	Bookmark options	Opcje zakładek
+	Expand all bookmarks	Rozwiń wszystkie zakładki
+	Expand top-level bookmarks	Rozwiń zakładki najwyższego poziomu
+	Collapse all bookmarks	Zwiń wszystkie zakładki
+	New bookmark (⌘B)	Nowa zakładka (⌘B)
+	This document has no bookmarks.	Ten dokument nie zawiera zakładek.
+	This document has no layers.	Ten dokument nie zawiera warstw.
+	This document has no attachments.	Ten dokument nie zawiera załączników.
+	Hide layer	Ukryj warstwę
+	Show layer	Pokaż warstwę
+	Set layer visibility	Ustaw widoczność warstwy
+	on page {label}	na stronie {label}
+	Save attachment…	Zapisz załącznik…
+	Open in a new tab	Otwórz w nowej karcie
+	This document has no pages.	Ten dokument nie zawiera stron.
+	Find text	Znajdź tekst
+	No matches	Brak dopasowań
+	Searching… {s}/{p}	Wyszukiwanie… {s}/{p}
+	{c} of {n}{more}	{c} z {n}{more}
+	Previous (⇧⌘G)	Poprzednie (⇧⌘G)
+	Next (⌘G)	Następne (⌘G)
+	Find options	Opcje wyszukiwania
+	Whole words only	Tylko całe słowa
+	Case-sensitive	Rozróżniaj wielkość liter
+	Close (Esc)	Zamknij (Esc)
+	Align	Wyrównaj
+	Top	Góra
+	Bottom	Dół
+	Center horizontally	Wyśrodkuj w poziomie
+	Center vertically	Wyśrodkuj w pionie
+	Distribute	Rozmieść równomiernie
+	Horizontally	Poziomo
+	Vertically	Pionowo
+	Set Fields to Same Size	Ustaw jednakowy rozmiar pól
+	Height	Wysokość
+	Width	Szerokość
+	Both	Oba wymiary
+	Duplicate…	Powiel…
+	All pages	Wszystkie strony
+	Odd pages	Strony nieparzyste
+	Even pages	Strony parzyste
+	Landscape pages	Strony poziome
+	Portrait pages	Strony pionowe
+	Move earlier	Przenieś wcześniej
+	Move later	Przenieś później
+	Back to the document	Wróć do dokumentu
+	Protect Using Password	Chroń hasłem
+	Requires user to enter a password for:	Wymagaj hasła do:
+	Viewing	Wyświetlania
+	Editing	Edycji
+	Type Password	Wpisz hasło
+	Re-type Password	Wpisz hasło ponownie
+	Strength: {s}	Siła hasła: {s}
+	Strong	Silne
+	Medium	Średnie
+	Weak	Słabe
+	Advanced Options {chevron}	Opcje zaawansowane {chevron}
+	Compatibility	Zgodność
+	Acrobat X and later (256-bit AES)	Acrobat X i nowsze (256-bitowy AES)
+	Acrobat 7.0 and later (128-bit AES)	Acrobat 7.0 i nowsze (128-bitowy AES)
+	Acrobat 5.0 and later (128-bit RC4)	Acrobat 5.0 i nowsze (128-bitowy RC4)
+	Acrobat 3.0 and later (40-bit RC4)	Acrobat 3.0 i nowsze (40-bitowy RC4)
+	Encrypt	Szyfruj
+	All document contents	Cała zawartość dokumentu
+	All document contents except metadata	Cała zawartość dokumentu poza metadanymi
+	Printing allowed	Dozwolone drukowanie
+	Low Resolution (150 dpi)	Niska rozdzielczość (150 dpi)
+	Changes allowed	Dozwolone zmiany
+	Inserting, deleting, and rotating pages	Wstawianie, usuwanie i obracanie stron
+	Filling in form fields and signing existing signature fields	Wypełnianie pól formularza i podpisywanie istniejących pól podpisu
+	Commenting, filling in form fields, and signing existing signature fields	Komentowanie, wypełnianie pól formularza i podpisywanie istniejących pól podpisu
+	Any except extracting pages	Wszystkie poza wyodrębnianiem stron
+	Enable copying of text, images, and other content	Zezwalaj na kopiowanie tekstu, obrazów i innej zawartości
+	Enable text access for screen reader devices for the visually impaired	Zezwalaj czytnikom ekranu dla osób niewidomych na dostęp do tekstu
+	Type a password.	Wpisz hasło.
+	The passwords don't match.	Hasła nie są zgodne.
+	This compatibility level supports only plain ASCII passwords.	Ten poziom zgodności obsługuje tylko hasła złożone ze znaków ASCII.
+	Anyone opening the document will need this password. It's applied when you save.	Każda osoba otwierająca dokument będzie potrzebować tego hasła. Zostanie zastosowane przy zapisie.
+	The document opens without a password; this password is needed to change the restrictions. It's applied when you save.	Dokument otwiera się bez hasła; to hasło jest potrzebne do zmiany ograniczeń. Zostanie zastosowane przy zapisie.
+	Recover unsaved documents?	Odzyskać niezapisane dokumenty?
+	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft nie został zamknięty prawidłowo. Automatycznie zapisano zmiany w tych dokumentach:
+	just now	przed chwilą
+	{n} min ago	{n} min temu
+	{n} h ago	{n} godz. temu
+	 · password-protected	 · chroniony hasłem
+	Recover	Odzyskaj
+	Discard	Odrzuć
+	Version {v}	Wersja {v}
+	A clean-room, open-source PDF application written in Rust. MIT OR Apache-2.0.	Otwarta aplikacja PDF napisana w Rust na podstawie niezależnej implementacji. MIT OR Apache-2.0.
+	Part of	Część
+	Summarize Options	Opcje podsumowania
+	Choose a layout:	Wybierz układ:
+	Comments only	Tylko komentarze
+	Sort comments by:	Sortuj komentarze według:
+	Create PDF Comment Summary	Utwórz podsumowanie komentarzy w PDF
+	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Przywrócić ostatnio zapisaną wersję „{name}”? Późniejszych zmian nie będzie można odzyskać.
+	Number pages	Ponumeruj strony
+	Style	Styl
+	None (prefix only)	Brak (tylko prefiks)
+	Prefix	Prefiks
+	Start	Początek
+	Labels: {preview}. Later pages keep their labels.	Etykiety: {preview}. Dalsze strony zachowają swoje etykiety.
+	Even and Odd Pages	Strony parzyste i nieparzyste
+	Even Pages Only	Tylko strony parzyste
+	Odd Pages Only	Tylko strony nieparzyste
+	Landscape and Portrait Pages	Strony poziome i pionowe
+	Landscape Pages	Strony poziome
+	Portrait Pages	Strony pionowe
+	Duplicate Field	Powiel pole
+	Duplicate "{name}" onto:	Powiel „{name}” na:
+	1 page selected.	Zaznaczono 1 stronę.
+	{n} pages selected.	Liczba zaznaczonych stron: {n}.
+	Delete pages after extracting	Usuń strony po wyodrębnieniu
+	Extract pages as separate files	Wyodrębnij strony jako oddzielne pliki
+	Rotate Pages	Obróć strony
+	Direction:	Kierunek:
+	Clockwise 90 degrees	90 stopni w prawo
+	Counterclockwise 90 degrees	90 stopni w lewo
+	180 degrees	180 stopni
+	Pages:	Strony:
+	All	Wszystkie
+	Selection	Zaznaczenie
+	From	Od
+	Rotate:	Obróć:
+	Repairs	Naprawy
+	Repair log	Dziennik napraw
+	Split document	Podziel dokument
+	Number of pages	Liczba stron
+	Pages per file	Strony na plik
+	File size	Rozmiar pliku
+	At most	Maksymalnie
+	Top-level bookmarks ({n})	Zakładki najwyższego poziomu ({n})
+	Before each selected page (select pages in Organize)	Przed każdą zaznaczoną stroną (zaznacz strony w Organizuj)
+	Creates 1 file from {n} pages.	Tworzy 1 plik z {n} stron.
+	Creates {f} files from {n} pages.	Tworzy pliki w liczbie {f} z {n} stron.
+	Each file holds as many of the {n} pages as fit.	Każdy plik zawiera tyle z {n} stron, ile się zmieści.
+	Replace Pages	Zastąp strony
+	Original: replace pages	Oryginał: zastąp strony
+	to	do
+	to {n}	do {n}
+	Replacement: pages of {name}	Zamiennik: strony z {name}
+	of {name}	z {name}
+	Only the page content changes: links, comments, form fields and bookmarks on the original pages stay.	Zmienia się tylko zawartość stron: łącza, komentarze, pola formularza i zakładki na oryginalnych stronach pozostają.
+	The replacement file doesn't have that many pages.	Plik zastępczy nie ma tylu stron.
+	Tagged PDF	PDF z tagami
+	Document Properties	Właściwości dokumentu
+	Description	Opis
+	Initial View	Widok początkowy
+	Security	Zabezpieczenia
+	Fonts	Czcionki
+	Advanced	Zaawansowane
+	Title	Tytuł
+	Subject	Temat
+	Keywords	Słowa kluczowe
+	Application	Aplikacja
+	PDF producer	Producent PDF
+	Layout and Magnification	Układ i powiększenie
+	Navigation tab	Karta nawigacyjna
+	Page Only	Tylko strona
+	Bookmarks Panel and Page	Panel zakładek i strona
+	Pages Panel and Page	Panel stron i strona
+	Attachments Panel and Page	Panel załączników i strona
+	Layers Panel and Page	Panel warstw i strona
+	Page layout	Układ stron
+	Default	Domyślny
+	Single Page	Pojedyncza strona
+	Single Page Continuous	Pojedyncze strony, przewijanie ciągłe
+	Two-Up (Facing)	Dwie strony (sąsiadujące)
+	Two-Up Continuous (Facing)	Dwie strony, przewijanie ciągłe (sąsiadujące)
+	Two-Up (Cover Page)	Dwie strony (z okładką)
+	Two-Up Continuous (Cover Page)	Dwie strony, przewijanie ciągłe (z okładką)
+	Magnification	Powiększenie
+	Actual Size	Rzeczywisty rozmiar
+	Fit Page	Dopasuj do strony
+	Fit Width	Dopasuj do szerokości
+	Fit Height	Dopasuj do wysokości
+	Fit Visible	Dopasuj widoczny obszar
+	Open to page	Otwórz na stronie
+	of {pages}	z {pages}
+	Window Options	Opcje okna
+	Resize window to initial page	Dopasuj rozmiar okna do pierwszej strony
+	Center window on screen	Wyśrodkuj okno na ekranie
+	Open in Full Screen mode	Otwórz w trybie pełnoekranowym
+	Show:	Pokaż:
+	File Name	Nazwa pliku
+	Document Title	Tytuł dokumentu
+	User Interface Options	Opcje interfejsu użytkownika
+	Hide menu bar	Ukryj pasek menu
+	Hide toolbars	Ukryj paski narzędzi
+	Hide window controls	Ukryj kontrolki okna
+	Security method	Metoda zabezpieczeń
+	No security	Brak zabezpieczeń
+	Restrictions	Ograniczenia
+	None — everything is allowed	Brak — wszystko jest dozwolone
+	Password security	Zabezpieczenie hasłem
+	Encryption	Szyfrowanie
+	Opened with	Otwarto przy użyciu
+	— (protection is applied when you save)	— (ochrona zostanie zastosowana przy zapisie)
+	Owner password (no restrictions apply)	Hasło właściciela (bez ograniczeń)
+	User password	Hasło użytkownika
+	Change settings…	Zmień ustawienia…
+	Printing	Drukowanie
+	Not allowed	Niedozwolone
+	Allowed	Dozwolone
+	High resolution	Wysoka rozdzielczość
+	Low resolution	Niska rozdzielczość
+	Changing the document	Zmienianie dokumentu
+	Document assembly	Składanie dokumentu
+	Content copying	Kopiowanie zawartości
+	Content copying for accessibility	Kopiowanie zawartości na potrzeby dostępności
+	Commenting	Komentowanie
+	Filling of form fields	Wypełnianie pól formularza
+	No fonts are referenced by the pages.	Strony nie odwołują się do żadnych czcionek.
+	PDF version	Wersja PDF
+	Location	Położenie
+	Page size	Rozmiar strony
+	Yes	Tak
+	No	Nie
+	Revisions	Rewizje
+	View revision {n}	Wyświetl rewizję {n}
+	Open the file as it was saved then	Otwórz plik w stanie z tamtego zapisu
+	Binding	Oprawa
+	Left Edge	Lewa krawędź
+	Right Edge	Prawa krawędź
+	Language	Język
+	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Zapisano {place}: {before} → {after} (o {pct}% mniej){detail}
+	Couldn't save the image: {e}	Nie można zapisać obrazu: {e}
+	Adding images arrives on the web with file pickers for images	Dodawanie obrazów w wersji internetowej będzie dostępne wraz z wyborem plików obrazów
+	Replacing images on page {p} arrives on the web with image pickers ({i})	Zastępowanie obrazów na stronie {p} w wersji internetowej będzie dostępne wraz z wyborem obrazów ({i})
+	{name}: choosing images arrives on the web with file pickers for images	{name}: wybór obrazów w wersji internetowej będzie dostępny wraz z wyborem plików obrazów
+	Replacing images arrives on the web with image file pickers	Zastępowanie obrazów w wersji internetowej będzie dostępne wraz z wyborem plików obrazów
+	Couldn't create a PDF: {e}	Nie można utworzyć PDF: {e}
+	The clipboard has no image or text	Schowek nie zawiera obrazu ani tekstu
+	On the web, open or drop an image to convert it	W wersji internetowej otwórz lub upuść obraz, aby go przekonwertować
+	Couldn't optimize the file: {e}	Nie można zoptymalizować pliku: {e}
+	Couldn't write {path}: {e}	Nie można zapisać {path}: {e}
+	The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.	Formularz wymaga wysłania do {u}; PdfCraft nie wysyła danych formularza. Zapisz dokument, aby zachować wpisane dane.
+	{s} actions run in the JavaScript engine (M6)	Liczba akcji wykonywanych w silniku JavaScript (M6): {s}
+	{name}: the {other} action isn't supported yet	{name}: akcja {other} nie jest jeszcze obsługiwana
+	{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.	{name} wysyła formularz do {url}; PdfCraft nie wysyła danych formularza. Zapisz dokument, aby zachować wpisane dane.
+	Export stopped: {e}	Eksport zatrzymany: {e}
+	Exported 1 image	Wyeksportowano 1 obraz
+	Exported {n} images	Liczba wyeksportowanych obrazów: {n}
+	 ({s} not exported: {first})	 (nie wyeksportowano {s}: {first})
+	Exported the text of 1 page	Wyeksportowano tekst 1 strony
+	Exported the text of {n} pages	Liczba stron z wyeksportowanym tekstem: {n}
+	{msg} to {dir}	{msg} do {dir}
+	Exporting… {d} of {t}	Eksportowanie… {d} z {t}
+	Choose a folder for the exported files	Wybierz folder dla eksportowanych plików
+	New {tool} comments will look like this one	Nowe komentarze typu {tool} będą wyglądać tak jak ten
+	This document can't be checked: it couldn't be read for editing	Nie można sprawdzić dokumentu: nie udało się go odczytać do edycji
+	The checker found no problems in this document.	Nie znaleziono problemów w tym dokumencie.
+	The checker found 1 problem which may prevent the document from being fully accessible.	Znaleziono 1 problem, który może uniemożliwiać pełną dostępność dokumentu.
+	The checker found {n} problems which may prevent the document from being fully accessible.	Znaleziono problemy w liczbie {n}, które mogą uniemożliwiać pełną dostępność dokumentu.
+	The text is the same	Tekst jest identyczny
+	1 difference found	Znaleziono 1 różnicę
+	{n} differences found	Liczba znalezionych różnic: {n}
+	Added 1 comment	Dodano 1 komentarz
+	Added {n} comments	Liczba dodanych komentarzy: {n}
+	Choose a folder for the results	Wybierz folder dla wyników
+	Files for {name}	Pliki dla {name}
+	An action is already running	Akcja jest już uruchomiona
+	Running action… file {d} of {t}	Wykonywanie akcji… plik {d} z {t}
+	No unlinked web addresses were found in the text	W tekście nie znaleziono adresów internetowych bez łączy
+	Created 1 link	Utworzono 1 łącze
+	Created {n} links	Liczba utworzonych łączy: {n}
+	Text recognition is already running	Rozpoznawanie tekstu już trwa
+	Optimizing… removing user data	Optymalizowanie… usuwanie danych użytkownika
+	Optimizing… image {d} of {t}	Optymalizowanie… obraz {d} z {t}
+	Optimizing… cleaning up	Optymalizowanie… porządkowanie
+	Optimizing… merging identical objects	Optymalizowanie… scalanie identycznych obiektów
+	Optimizing… writing the copy	Optymalizowanie… zapisywanie kopii
+	Cancelling…	Anulowanie…
+	Optimization is already running	Optymalizacja już trwa
+	Optimization cancelled	Optymalizacja anulowana
+	Couldn't optimize the file	Nie można zoptymalizować pliku
+	Recognizing text… file {d} of {t}	Rozpoznawanie tekstu… plik {d} z {t}
+	Recognizing text… page {d} of {t}	Rozpoznawanie tekstu… strona {d} z {t}
+	Recognized 1 word	Rozpoznano 1 słowo
+	Recognized {n} words	Liczba rozpoznanych słów: {n}
+	{words} on {pages}	{words} na {pages}
+	; 1 page already had text	; 1 strona zawierała już tekst
+	; {n} pages already had text	; liczba stron zawierających już tekst: {n}
+	Recognized {w} words in 1 file	Rozpoznano słowa w liczbie {w} w 1 pliku
+	Recognized {w} words in {n} files	Liczba rozpoznanych słów: {w}; liczba plików: {n}
+	; failed: {list}	; niepowodzenia: {list}
+	1 file done	Ukończono 1 plik
+	{n} files done	Liczba ukończonych plików: {n}
+	The selected area has been copied ({w} × {h} pixels)	Zaznaczony obszar został skopiowany ({w} × {h} pikseli)
+	Couldn't take the snapshot: {e}	Nie można zrobić migawki: {e}
+	Couldn't recover {name}: {e}	Nie można odzyskać {name}: {e}
+	The document now conforms to {level}; save it to keep the changes	Dokument jest teraz zgodny z {level}; zapisz go, aby zachować zmiany
+	Fixed what could be fixed; 1 problem remains	Naprawiono wszystko, co możliwe; pozostał 1 problem
+	Fixed what could be fixed; {n} problems remain	Naprawiono wszystko, co możliwe; liczba pozostałych problemów: {n}
+	Custom stamps arrive on the web with file pickers for images	Własne stemple w wersji internetowej będą dostępne wraz z wyborem plików obrazów
+	{file} is too large for a stamp (at most {n} MB)	Plik {file} jest zbyt duży na stempel (maksymalnie {n} MB)
+	Sent to {printer}	Wysłano do {printer}
+	Sent to {printer}: {msg}	Wysłano do {printer}: {msg}
+	Choose a folder for the searchable files	Wybierz folder dla plików z możliwością wyszukiwania
+	Files are combined from top to bottom. Leave Pages empty to take every page.	Pliki są łączone od góry do dołu. Pozostaw pole Strony puste, aby uwzględnić wszystkie strony.
+	Unlock…	Odblokuj…
+	Select a password-protected file first	Najpierw wybierz plik chroniony hasłem
+	Enter the permissions password to allow combining	Wpisz hasło uprawnień, aby umożliwić łączenie
+	Enter the password that opens it	Wpisz hasło otwarcia pliku
+	Unlock {name}	Odblokuj {name}
+	Unlock {n} files	Odblokuj pliki w liczbie {n}
+	The same password is tried on each file.	To samo hasło jest sprawdzane dla każdego pliku.
+	Hide password	Ukryj hasło
+	Show password	Pokaż hasło
+	Wrong password	Nieprawidłowe hasło
+	The password is only used to read the file; it isn't saved.	Hasło służy wyłącznie do odczytu pliku; nie jest zapisywane.
+	Unlock	Odblokuj
+	Opened, but its security settings don't allow combining. Enter the permissions password.	Otwarto, ale ustawienia zabezpieczeń nie zezwalają na łączenie. Wpisz hasło uprawnień.
+	Unlocked: the combined file won't be password-protected	Odblokowano: połączony plik nie będzie chroniony hasłem
+	Unlocked {n} of {m} files	Odblokowano {n} z {m} plików
+	Drop PDFs or folders here, or choose them.	Upuść tutaj pliki PDF lub foldery albo wybierz je.
+	Add folder…	Dodaj folder…
+	Add folder and subfolders…	Dodaj folder i podfoldery…
+	More ways to add files	Więcej sposobów dodawania plików
+	Every PDF in the folder	Każdy PDF w folderze
+	Every PDF in the folder and the folders inside it	Każdy PDF w folderze i jego podfolderach
+	Add folder	Dodaj folder
+	Add folder and subfolders	Dodaj folder i podfoldery
+	No PDFs found in {folder}	Nie znaleziono plików PDF w {folder}
+	Added the first {n} PDFs in {folder}	Dodano pierwsze {n} plików PDF z {folder}
+	Click to sort, drag to move the column. Drag its edge to resize it.	Kliknij, aby sortować; przeciągnij, aby przenieść kolumnę. Przeciągnij jej krawędź, aby zmienić szerokość.
+	Reset columns	Zresetuj kolumny
+	Remove {n} files	Usuń pliki w liczbie {n}
+	{n} selected	Zaznaczono: {n}
+	sorted ascending	posortowane rosnąco
+	sorted descending	posortowane malejąco
+	Protected: the combined file won't keep its security settings	Chroniony: połączony plik nie zachowa jego ustawień zabezpieczeń
+	Add open documents	Dodaj otwarte dokumenty
+	All open documents	Wszystkie otwarte dokumenty
+	No documents are open	Brak otwartych dokumentów
+	Select a file first	Najpierw wybierz plik
+	1 file	1 plik
+	{n} files	Liczba plików: {n}
+	1 file needs attention	1 plik wymaga uwagi
+	{n} files need attention	Liczba plików wymagających uwagi: {n}
+	{name} can't be combined: {why}	Nie można połączyć {name}: {why}
+	Check the pages of {name}: {why}	Sprawdź strony {name}: {why}
+	Add the PDFs to combine	Dodaj pliki PDF do połączenia
+	File name	Nazwa pliku
+	Warnings	Ostrzeżenia
+	Drag to reorder	Przeciągnij, aby zmienić kolejność
+	{k} of {n}	{k} z {n}
+	? of {n}	? z {n}
+	Added more than once	Dodano więcej niż raz
+	yesterday	wczoraj
+	{n} days ago	{n} dni temu
+	No pages selected	Nie zaznaczono stron
+	Password-protected	Chroniony hasłem
+	Its security settings don't allow copying pages	Ustawienia zabezpieczeń nie zezwalają na kopiowanie stron
+	Can't be read: {e}	Nie można odczytać: {e}
+	Includes unsaved changes	Zawiera niezapisane zmiany
+	Pages of {name} to combine, e.g. 1-3, 6	Strony z {name} do połączenia, np. 1-3, 6
+	Remove {name}	Usuń {name}
+	Add files…	Dodaj pliki…
+	Add at least two files	Dodaj co najmniej dwa pliki
+	Couldn't add {name}: {e}	Nie można dodać {name}: {e}
+	Couldn't combine files: {e}	Nie można połączyć plików: {e}
+	Export comments	Eksportuj komentarze
+	Export form data	Eksportuj dane formularza
+	Comment and form data	Dane komentarzy i formularza
+	Export	Eksportuj
+	Select data files to merge	Wybierz pliki danych do scalenia
+	Form data and PDF forms	Dane formularza i formularze PDF
+	Save the spreadsheet	Zapisz arkusz kalkulacyjny
+	Save the accessibility report	Zapisz raport dostępności
+	Save image	Zapisz obraz
+	Export certificate	Eksportuj certyfikat
+	Choose a folder for the extracted pages	Wybierz folder dla wyodrębnionych stron
+	Choose a folder for the split files	Wybierz folder dla podzielonych plików
+	Couldn't use {name}: {e}	Nie można użyć {name}: {e}
+	Couldn't extract pages: {e}	Nie można wyodrębnić stron: {e}
+	Couldn't write {name}: {e}	Nie można zapisać {name}: {e}
+	Wrote 1 file to {dir}	Zapisano 1 plik w {dir}
+	Wrote {n} files to {dir}	Liczba plików zapisanych w {dir}: {n}
+	No pages match those choices	Żadna strona nie pasuje do wybranych opcji
+	Couldn't split: {e}	Nie można podzielić: {e}
+	Couldn't summarize comments: {e}	Nie można podsumować komentarzy: {e}
+	Couldn't open the result: {e}	Nie można otworzyć wyniku: {e}
+	Importing data arrives on the web with file pickers for data files	Import danych w wersji internetowej będzie dostępny wraz z wyborem plików danych
+	Exported to {path}	Wyeksportowano do {path}
+	Merging data files needs the desktop app	Scalanie plików danych wymaga aplikacji komputerowej
+	Merged 1 file into {path}	Scalono 1 plik do {path}
+	Merged {n} files into {path}	Liczba plików scalonych do {path}: {n}
+	Combined {n} files	Liczba połączonych plików: {n}
+	Extracted 1 page	Wyodrębniono 1 stronę
+	Extracted {n} pages	Liczba wyodrębnionych stron: {n}
+	Created a comment summary	Utworzono podsumowanie komentarzy
+	Couldn't open {name}: {e}	Nie można otworzyć {name}: {e}
+	Couldn't read {name}: {e}	Nie można odczytać {name}: {e}
+	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Tryb przenośny jest wyłączony: nie można zapisywać w {folder} ({error}). Ustawienia są przechowywane w folderze użytkownika.
+	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft renderuje bez procesora graficznego, więc może działać wolno. Aktualizacja sterownika graficznego może pomóc.
+	Couldn't save: {e}	Nie można zapisać: {e}
+	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Pobieranie załączników w wersji internetowej będzie dostępne w M3.10 (gotowe bajty: {n})
+	`{command}` {when}	`{command}` {when}
+	ships in milestone {m}	będzie dostępne w etapie {m}
+	needs an AI provider (off by default)	wymaga dostawcy AI (domyślnie wyłączone)
+	is available	jest dostępne
+	is not available yet	nie jest jeszcze dostępne
+	{label} failed: {e}	Niepowodzenie: {label}: {e}
+	Undid {label}	Cofnięto: {label}
+	Redid {label}	Ponowiono: {label}
+	A document needs at least one page: copy instead	Dokument musi mieć co najmniej jedną stronę: zamiast wycinać, skopiuj
+	Cut {what}	Wycięto: {what}
+	Copied {what}	Skopiowano: {what}
+	1 page	1 strona
+	{n} pages	Liczba stron: {n}
+	Copy or cut pages first	Najpierw skopiuj lub wytnij strony
+	Couldn't save {name}: {e}	Nie można zapisać {name}: {e}
+	Saved {name}	Zapisano {name}
+	Saved, but reopening failed: {e}	Zapisano, ale ponowne otwarcie nie powiodło się: {e}
+	Downloaded {name}	Pobrano {name}
+	Couldn't download {name}: {e}	Nie można pobrać {name}: {e}
+	Reverted to the last saved version	Przywrócono ostatnio zapisaną wersję
+	That didn't work: an internal error stopped it ({m}). Your documents are unchanged.	Operacja nie powiodła się z powodu błędu wewnętrznego ({m}). Dokumenty pozostały bez zmian.
+	Nothing to undo	Brak operacji do cofnięcia
+	Nothing to redo	Brak operacji do ponowienia
+	This document has no form fields you can fill in	Ten dokument nie ma pól formularza do wypełnienia
+	This document has no comments to flatten	Ten dokument nie ma komentarzy do spłaszczenia
+	This document has no form fields to flatten	Ten dokument nie ma pól formularza do spłaszczenia
+	There are no redaction marks (mark text, areas or pages first)	Brak oznaczeń do utajnienia (najpierw oznacz tekst, obszary lub strony)
+	This document has no {kind} to change	W tym dokumencie nie ma elementu „{kind}” do zmiany
+	header or footer	nagłówek lub stopka
+	watermark	znak wodny
+	background	tło
+	This document isn't password-protected	Ten dokument nie jest chroniony hasłem
+	Only the document's owner can change its security (open it with the permissions password)	Tylko właściciel dokumentu może zmienić zabezpieczenia (otwórz go przy użyciu hasła uprawnień)
+	The document's security settings don't allow this change	Ustawienia zabezpieczeń dokumentu nie zezwalają na tę zmianę
+	Open a document first	Najpierw otwórz dokument
+	Security will be removed when you save	Zabezpieczenia zostaną usunięte przy zapisie
+	Click text or an image to edit it	Kliknij tekst lub obraz, aby go edytować
+	Drag a rectangle to create a link; double-click a link to edit it	Narysuj prostokąt, aby utworzyć łącze; kliknij łącze dwukrotnie, aby je edytować
+	There are no redaction marks to apply	Brak oznaczeń do utajnienia do zastosowania
+	Drag to draw the area where the signature should appear.	Narysuj prostokąt w miejscu, w którym ma się pojawić podpis.
+	Couldn't fit the visible content: {e}	Nie można dopasować widocznej zawartości: {e}
+	Drag a rectangle around the area to copy	Narysuj prostokąt wokół obszaru do skopiowania
+	Click on the page to add a {tool}, or drag to set its size	Kliknij stronę, aby dodać element „{tool}”, lub przeciągnij, aby ustawić jego rozmiar
+	Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes	Narysuj prostokąt na stronie, aby ją przyciąć; kliknij stronę dwukrotnie, aby ustawić obszary strony
+	Keep tool selected: on	Pozostaw narzędzie aktywne: włączone
+	Keep tool selected	Pozostaw narzędzie aktywne
+	Opacity	Krycie
+	Line thickness	Grubość linii
+	What word or phrase would you like to search for?	Jakie słowo lub frazę chcesz wyszukać?
+	Searching… {s} of {p} pages	Wyszukiwanie… strona {s} z {p}
+	 (searching… {s} of {p} pages)	 (wyszukiwanie… strona {s} z {p})
+	1 instance	1 wystąpienie
+	{n} instances	Liczba wystąpień: {n}
+	Go to this result	Przejdź do tego wyniku
+	Highlight	Podświetlenie
+	Draw	Rysuj
+	Polygon	Wielokąt
+	Connected lines	Połączone linie
+	Eraser	Gumka
+	Sign	Podpisz
+	Certified by {by}	Certyfikowany przez {by}
+	At least one signature is invalid.	Co najmniej jeden podpis jest nieprawidłowy.
+	Signed and all signatures are valid.	Dokument jest podpisany i wszystkie podpisy są prawidłowe.
+	At least one signature has problems.	Co najmniej jeden podpis ma problemy.
+	This document is secured. Some changes are restricted by its security settings.	Ten dokument jest zabezpieczony. Niektóre zmiany są ograniczone ustawieniami zabezpieczeń.
+	This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.	To dynamiczny formularz XFA, którego PdfCraft nie potrafi jeszcze wyświetlić. Widzisz stronę zastępczą pliku.
+	This form also contains XFA data, which PdfCraft doesn't read yet. You can fill its fields, but Acrobat may show the XFA values instead.	Ten formularz zawiera również dane XFA, których PdfCraft jeszcze nie odczytuje. Możesz wypełniać jego pola, ale Acrobat może zamiast nich wyświetlać wartości XFA.
+	This document contains {n} interactive form fields.	Ten dokument zawiera interaktywne pola formularza w liczbie {n}.
+	This file was damaged and has been repaired. Saving keeps the repaired version.	Ten plik był uszkodzony i został naprawiony. Zapis zachowa naprawioną wersję.
+	Dismiss	Zamknij komunikat
+	Hide field highlights	Ukryj podświetlenia pól
+	Highlight fields	Podświetl pola
+	Security settings	Ustawienia zabezpieczeń
+	Details	Szczegóły
+	Select (V)	Zaznaczanie (V)
+	Hand (H)	Rączka (H)
+	Delete pages (Delete)	Usuń strony (Delete)
+	Insert a blank page after the selection	Wstaw pustą stronę za zaznaczeniem
+	Insert pages from a file…	Wstaw strony z pliku…
+	Extract pages to a new document	Wyodrębnij strony do nowego dokumentu
+	Split into files…	Podziel na pliki…
+	Select pages	Zaznacz strony
+	Cut	Wytnij
+	Copy	Kopiuj
+	Paste after	Wklej po
+	Rename	Zmień nazwę
+	Set to current page ({n})	Ustaw bieżącą stronę ({n})
+	Move up	Przenieś w górę
+	Move down	Przenieś w dół
+	Indent	Zwiększ wcięcie
+	Outdent	Zmniejsz wcięcie
+	This document has no form fields.	Ten dokument nie zawiera pól formularza.
+	Tab order: move a field with its arrows.	Kolejność tabulacji: przenieś pole strzałkami.
+	Unplaced	Nieumieszczone
+	Has JavaScript actions (run in M6)	Zawiera akcje JavaScript (wykonywane w M6)
+	Page	Strona
+	None	Brak
+	Delete selected fields	Usuń zaznaczone pola
+	Diagnostic details	Szczegóły diagnostyczne
+	The operation failed.	Operacja nie powiodła się.
+	no such document	brak takiego dokumentu
+	nothing to undo	brak operacji do cofnięcia
+	nothing to redo	brak operacji do ponowienia
+	this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)	ten dokument jest podpisany: zapisanie go na nowo unieważniłoby podpisy (zamiast tego zapisz przyrostowo)
+	the document is protected by a password	dokument jest chroniony hasłem
+	the password is incorrect	hasło jest nieprawidłowe
+	the document has no page tree	dokument nie ma drzewa stron
+	a document must keep at least one page	dokument musi zachować co najmniej jedną stronę
+	a bookmark cannot be moved inside itself	nie można przenieść zakładki do jej wnętrza
+	the title must not be empty	tytuł nie może być pusty
+	the document has no form fields	dokument nie zawiera pól formularza
+	there are no redaction marks to apply	brak oznaczeń do utajnienia do zastosowania
+	there are no pages to print	brak stron do wydrukowania
+	the document has no tags	dokument nie ma tagów
+	{0}: {1}	{0}: {1}
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	modele rozpoznawania tekstu nie są zainstalowane (zainstaluj PdfCraft ponownie lub ustaw PDFCRAFT_MODELS na folder zawierający modele)
+	the image is empty	obraz jest pusty
+	this file isn't XFDF, FDF, XML or text form data	ten plik nie zawiera danych formularza XFDF, FDF, XML ani tekstowych
+	nothing in the file matches this document	żadne dane w pliku nie pasują do tego dokumentu
+	This page couldn't be displayed.\n{e}	Nie można wyświetlić tej strony.\n{e}
+	Go to page {p}	Przejdź do strony {p}
+	{s} action	Akcja {s}
+	Page {p} of {n}	Strona {p} z {n}
+	1 page selected	Zaznaczono 1 stronę
+	{n} pages selected	Liczba zaznaczonych stron: {n}
+	{name} — unsaved changes	{name} — niezapisane zmiany
+	{kind} field	Pole typu {kind}
+	Select a file for the stamp	Wybierz plik dla stempla
+	JavaScript, e.g. getField("total").value	JavaScript, np. getField("total").value
+	Font: Helvetica	Czcionka: Helvetica
+	e.g. en-US	np. pl-PL
+	Rendering: hayro (bootstrap) · UI: egui · Icons: Lucide (ISC) · Fonts: Inter, JetBrains Mono, Dancing Script (OFL)	Renderowanie: hayro (wersja początkowa) · Interfejs: egui · Ikony: Lucide (ISC) · Czcionki: Inter, JetBrains Mono, Dancing Script (OFL)
+	CheckBox	Pole wyboru
+	Radio	Przycisk opcji
+	PushButton	Przycisk
+	Combo	Lista rozwijana
+	List	Lista
+	Unknown	Nieznany
+	The document has no XMP metadata	Dokument nie zawiera metadanych XMP
+	The title in the metadata and the document information differ	Tytuł w metadanych różni się od tytułu w informacjach o dokumencie
+	The document is encrypted	Dokument jest zaszyfrowany
+	Device colour is used, but there is no PDF/A output intent	Użyto kolorów urządzenia, ale brak profilu wyjściowego PDF/A
+	DeviceCMYK is used: it needs a CMYK output intent (not added automatically)	Użyto DeviceCMYK: wymagany jest profil wyjściowy CMYK (nie jest dodawany automatycznie)
+	The document has additional actions (/AA)	Dokument zawiera dodatkowe akcje (/AA)
+	The document has document-level JavaScript	Dokument zawiera JavaScript na poziomie dokumentu
+	The form asks viewers to make appearances (NeedAppearances)	Formularz wymaga tworzenia wyglądu pól przez przeglądarki (NeedAppearances)
+	A form field has additional actions	Pole formularza zawiera dodatkowe akcje
+	A stream uses LZW compression	Strumień używa kompresji LZW
+	A stream refers to an external file	Strumień odwołuje się do pliku zewnętrznego
+	An image asks to be interpolated	Obraz wymaga interpolacji
+	An image has alternates or OPI information	Obraz zawiera alternatywne wersje lub informacje OPI
+	PostScript XObjects aren't allowed	Obiekty PostScript XObject nie są dozwolone
+	Embedded files must be PDF/A files themselves (use PDF/A-3 for others)	Osadzone pliki muszą być zgodne z PDF/A (dla innych użyj PDF/A-3)
+	An embedded file has no AFRelationship	Osadzony plik nie ma AFRelationship
+	Select Icon	Wybierz ikonę
+	Choose images	Wybierz obrazy
+	{dpi} pixels/inch	{dpi} pikseli/cal
+	Type your {what}.	Wpisz {what}.
+	Draw your {what} below.	Narysuj {what} poniżej.
+	Your name	Twoje imię i nazwisko
+	Images and text (converted to PDF)	Obrazy i tekst (konwertowane do PDF)
+	Images and text	Obrazy i tekst
+	Check Box Style:	Styl pola wyboru:
+	Button Style:	Styl przycisku:
+	Check	Znacznik wyboru
+	Circle	Okrąg
+	Diamond	Romb
+	Square	Kwadrat
+	Star	Gwiazda
+	{month} {y}	{month} {y}
+	Change {key}	Zmień {key}
+	Insert pages from {name}	Wstaw strony z {name}
+	Fill in {name}	Wypełnij {name}
+	Set the image of {name}	Ustaw obraz pola {name}
+	Edit script of {name}	Edytuj skrypt pola {name}
+	Import {name}	Importuj {name}
+	Add bookmark	Dodaj zakładkę
+	Rename bookmark	Zmień nazwę zakładki
+	Delete bookmark	Usuń zakładkę
+	Move bookmark	Przenieś zakładkę
+	Set bookmark destination	Ustaw miejsce docelowe zakładki
+	Add stamp	Dodaj stempel
+	Delete comment	Usuń komentarz
+	Edit comment	Edytuj komentarz
+	Erase	Wymaż
+	Lock comment	Zablokuj komentarz
+	Unlock comment	Odblokuj komentarz
+	Move comment	Przenieś komentarz
+	Resize comment	Zmień rozmiar komentarza
+	Change comment properties	Zmień właściwości komentarza
+	Add field	Dodaj pole
+	Change field properties	Zmień właściwości pola
+	Delete field	Usuń pole
+	Duplicate field	Powiel pole
+	Set tab order	Ustaw kolejność tabulacji
+	Change initial view	Zmień widok początkowy
+	Set alternate text	Ustaw tekst alternatywny
+	Mark figure as decorative	Oznacz ilustrację jako dekoracyjną
+	Run JavaScript	Uruchom JavaScript
+	Delete document JavaScript	Usuń JavaScript dokumentu
+	Edit document JavaScript	Edytuj JavaScript dokumentu
+	Edit text	Edytuj tekst
+	Move image	Przenieś obraz
+	Rotate image	Obróć obraz
+	Flip image	Odbij obraz
+	Delete image	Usuń obraz
+	Add header & footer	Dodaj nagłówek i stopkę
+	Update header & footer	Zaktualizuj nagłówek i stopkę
+	Update watermark	Zaktualizuj znak wodny
+	Add background	Dodaj tło
+	Update background	Zaktualizuj tło
+	Add image	Dodaj obraz
+	Edit content	Edytuj zawartość
+	Delete content	Usuń zawartość
+	Remove redaction marks	Usuń oznaczenia do utajnienia
+	Add link	Dodaj łącze
+	Change link properties	Zmień właściwości łącza
+	Delete link	Usuń łącze
+	Create link	Utwórz łącze
+	Flatten	Spłaszcz
+	Add sticky note	Dodaj notatkę
+	Add highlight	Dodaj podświetlenie
+	Add underline	Dodaj podkreślenie
+	Add strikethrough	Dodaj przekreślenie
+	Add squiggly underline	Dodaj faliste podkreślenie
+	Add rectangle	Dodaj prostokąt
+	Add oval	Dodaj owal
+	Add arrow	Dodaj strzałkę
+	Add line	Dodaj linię
+	Add drawing	Dodaj rysunek
+	Add text box	Dodaj pole tekstowe
+	Add checkmark	Dodaj znacznik wyboru
+	Add cross	Dodaj krzyżyk
+	Add dot	Dodaj kropkę
+	Add signature	Dodaj podpis
+	Add redaction mark	Dodaj oznaczenie do utajnienia
+	Add cloud	Dodaj chmurkę
+	Add polygon	Dodaj wielokąt
+	Add connected lines	Dodaj połączone linie
+	Add callout	Dodaj objaśnienie
+	Add inserted text	Dodaj wstawiony tekst
+	Add file attachment	Dodaj załącznik plikowy
+	Set status Accepted	Ustaw status Zaakceptowane
+	Set status Rejected	Ustaw status Odrzucone
+	Set status Cancelled	Ustaw status Anulowane
+	Set status Completed	Ustaw status Ukończone
+	Set status None	Ustaw status Brak
+	Set status Unmarked	Ustaw status Nieoznaczone
+	Save as PDF/A-1b	Zapisz jako PDF/A-1b
+	Save as PDF/A-2b	Zapisz jako PDF/A-2b
+	Save as PDF/A-3b	Zapisz jako PDF/A-3b
+	Fill & Sign: change signature	Wypełnij i podpisz: zmień podpis
+	Fill & Sign: change initials	Wypełnij i podpisz: zmień inicjały
+	Fill & Sign: remove saved signature	Wypełnij i podpisz: usuń zapisany podpis
+	Fill & Sign: remove saved initials	Wypełnij i podpisz: usuń zapisane inicjały
+	Change signature	Zmień podpis
+	Change initials	Zmień inicjały
+	Measure distance	Zmierz odległość
+	Measure perimeter	Zmierz obwód
+	Measure area	Zmierz pole powierzchni
+	Set measurement scale	Ustaw skalę pomiaru
+	Measurement information	Informacje o pomiarze
+	Measurement snapping	Przyciąganie pomiarów
+	Export measurements as CSV	Eksportuj pomiary do CSV
+	Distance	Odległość
+	Perimeter	Obwód
+	Area	Pole powierzchni
+	Drawing scale	Skala rysunku
+	Snapping	Przyciąganie
+	Export measurements	Eksportuj pomiary
+	Open a PDF to measure it.	Otwórz PDF, aby wykonać pomiar.
+	Click vertices. Enter or double-click finishes a perimeter or area. Click the first point to close an area.	Klikaj wierzchołki. Enter lub dwukrotne kliknięcie kończy pomiar obwodu lub pola. Kliknij pierwszy punkt, aby zamknąć obszar.
+	Shift constrains to 45 degrees. Backspace removes a vertex. Escape cancels.	Shift ogranicza do 45 stopni. Backspace usuwa wierzchołek. Escape anuluje.
+	Angle	Kąt
+	Click the first point to begin.	Kliknij pierwszy punkt, aby rozpocząć.
+	Snap to drawing	Przyciągaj do rysunku
+	Endpoints	Punkty końcowe
+	Midpoints	Punkty środkowe
+	Intersections	Przecięcia
+	Paths	Ścieżki
+	Sensitivity	Czułość
+	Unit	Jednostka
+	Decimals	Miejsca dziesiętne
+	Calibrate from two points	Kalibruj na podstawie dwóch punktów
+	Entire page	Cała strona
+	Viewport rectangle in page points (x, y, width, height)	Prostokąt obszaru widoku w punktach strony (x, y, szerokość, wysokość)
+	Viewport	Obszar widoku
+	Apply scale	Zastosuj skalę
+	Saved measurements	Zapisane pomiary
+	Saved measurements.	Pomiary zapisane.
+	Endpoint	Punkt końcowy
+	Midpoint	Punkt środkowy
+	Intersection	Przecięcie
+	Path	Ścieżka
+	This drawing exceeds the snapping limit; only the first paths are used.	Ten rysunek przekracza limit przyciągania; używane są tylko pierwsze ścieżki.
+	Some page content couldn't be read; snapping uses the rest.	Nie można odczytać części zawartości strony; przyciąganie używa pozostałej zawartości.
+	Unsupported measurements	Nieobsługiwane pomiary
+	Label	Etykieta
+	{n} measurements use an unsupported format and are left out.	Pominięto pomiary w liczbie {n}, które używają nieobsługiwanego formatu.
+	This area has too many overlapping paths; intersection snapping is limited.	Ten obszar ma zbyt wiele nakładających się ścieżek; przyciąganie do przecięć jest ograniczone.
+	This measurement needs at least {n} points.	Ten pomiar wymaga co najmniej {n} punktów.
+	Switch to two-page view first to show the cover page	Najpierw przełącz na widok dwóch stron, aby pokazać okładkę
+	Page display: {layout}	Wyświetlanie stron: {layout}
+	Fit to width scrolling	Przewijanie z dopasowaniem do szerokości
+	Fit one full page	Dopasuj jedną całą stronę
+	Created a PDF from {n} files	Utworzono PDF z {n} plików
+	PDF, images and text	PDF, obrazy i tekst
+	Insert a file before page {label}	Wstaw plik przed stroną {label}
+	Insert a file at the end	Wstaw plik na końcu
+	Save pages	Zapisz strony
+	Save these pages as one PDF	Zapisz te strony jako jeden PDF
+	No changes to save	Brak zmian do zapisania
+	Created a PDF from {n} files; left out: {names}	Utworzono PDF z {n} plików; pominięto: {names}
+	Created a PDF from the first {n} files	Utworzono PDF z pierwszych {n} plików
+	None of those files can be made into a PDF; use PDFs, images or .txt files	Żadnego z tych plików nie można przekonwertować do PDF; użyj plików PDF, obrazów lub plików .txt
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Wybierz obraz PNG lub JPEG (do 4 MiB). Przezroczystość zostanie zachowana.
+	Couldn't import the signature image: {e}	Nie można zaimportować obrazu podpisu: {e}
+	Go to page…	Przejdź do strony…
+	Reopen the files that were open when PdfCraft last closed	Otwórz ponownie pliki otwarte przy ostatnim zamknięciu PdfCraft
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Standardowe czcionki nie obsługują znaku „{c}” ({code}). Na razie można dodawać tylko tekst ze znakami zachodnioeuropejskimi.
+	Open arrow	Otwarta strzałka
+	Closed arrow	Zamknięta strzałka
+	Butt	Poprzeczna kreska
+	Reverse open arrow	Odwrócona otwarta strzałka
+	Reverse closed arrow	Odwrócona zamknięta strzałka
+	Slash	Ukośna kreska
+	Larger pages	Większe strony
+	Smaller pages	Mniejsze strony
+	Reset page size	Zresetuj rozmiar strony
+	Date format	Format daty
+	Fill & Sign dates	Daty w Wypełnij i podpisz
+	Pattern	Wzorzec
+	Today: {date}	Dzisiaj: {date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy lub yy — rok · m lub mm — miesiąc · mmm lub mmmm — nazwa miesiąca · d lub dd — dzień · ddd lub dddd — dzień tygodnia. H, h, M, s i t oznaczają czas i nie można używać ich samodzielnie: umieść {escape} przed literą, aby wyświetlić ją dosłownie.
+	Same as interface ({language})	Jak w interfejsie ({language})
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	Nie można jeszcze zapisać znaków {chars} w PDF: tekst w Wypełnij i podpisz obsługuje tylko znaki zachodnioeuropejskie. Wybierz format liczbowy, np. dd.mm.yyyy.
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	Otwiera preferencje sterownika drukarki. Są zapisywane dla każdego wydruku z tego komputera; wybrane tutaj kopie, druk dwustronny, skala szarości i papier nadal obowiązują.
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	Ustawienia sterownika drukarki dla tego wydruku: podajnik, rodzaj papieru, wykańczanie i inne.
+	Couldn't open the printer's preferences: {e}	Nie można otworzyć preferencji drukarki: {e}
+	Printer properties	Właściwości drukarki
+	Reset to printer defaults	Przywróć domyślne ustawienia drukarki
+	This printer offers no settings of its own.	Ta drukarka nie udostępnia własnych ustawień.
+	% of all commits	% wszystkich commitów
+	+Bin	+Bin
+	+LOC	+LOC
+	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login}: PR: {prs}, commitów: {commits}, +{added} / −{deleted} wierszy (Δ {delta}), +{bin_added} / −{bin_deleted} zasobów binarnych, {first} – {last}
+	A button	Przycisk
+	A link	Łącze
+	A script	Skrypt
+	About	Informacje
+	Add {what}	Dodaj {what}
+	Align fields	Wyrównaj pola
+	Another file dialog is still open. Finish with it first.	Inne okno wyboru pliku jest nadal otwarte. Najpierw je zamknij.
+	Basic constraints	Podstawowe ograniczenia
+	Binary assets added	Dodane zasoby binarne
+	Binary assets removed	Usunięte zasoby binarne
+	Change document properties	Zmień właściwości dokumentu
+	Change {what}	Zmień {what}
+	Commits	Commity
+	Company	Firma
+	Contributors	Współtwórcy
+	Couldn't show the file picker. Please try again.	Nie można wyświetlić okna wyboru pliku. Spróbuj ponownie.
+	Create	Utwórz
+	Create PDF from images	Utwórz PDF z obrazów
+	Cut and stack	Przetnij i ułóż w stos
+	DPI sets the printed page size without resampling the image.	DPI określa rozmiar drukowanej strony bez zmiany rozdzielczości obrazu.
+	Default page display	Domyślne wyświetlanie stron
+	Default workspace mode	Domyślny tryb obszaru roboczego
+	Default zoom	Domyślne powiększenie
+	Display name	Nazwa wyświetlana
+	Distribute fields	Rozmieść pola równomiernie
+	Documents and view	Dokumenty i widok
+	Dynamic XFA form laid out from its template: {pages}, {fields}.	Dynamiczny formularz XFA z układem według szablonu: {pages}, {fields}.
+	Files are combined in this order. Leave Pages empty to take every page.	Pliki są łączone w tej kolejności. Pozostaw pole Strony puste, aby uwzględnić wszystkie strony.
+	First	Pierwszy
+	First commit	Pierwszy commit
+	Grab bag	Różne
+	H / Space (hold)	H / Spacja (przytrzymaj)
+	Home / End	Home / End
+	Last	Ostatni
+	Last commit	Ostatni commit
+	Line delta	Zmiana liczby wierszy
+	Line ending	Zakończenie linii
+	Lines +/−	Wiersze +/−
+	Lines added	Dodane wiersze
+	Lines deleted	Usunięte wiersze
+	Mark differences	Oznacz różnice
+	Mark for redaction	Oznacz do utajnienia
+	Mark pages for redaction	Oznacz strony do utajnienia
+	Match field sizes	Dopasuj rozmiary pól
+	Merged PRs	Scalone PR
+	Model	Model
+	Models	Modele
+	Name (A–Z)	Nazwa (A–Z)
+	No contributor data was built into this copy.	Ta kopia nie zawiera danych o współtwórcach.
+	No model credits were built into this copy.	Ta kopia nie zawiera informacji o modelach.
+	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	Kontynuuj tylko wtedy, gdy ufasz temu dokumentowi. Adres może zawierać informacje z dokumentu, np. dane wpisane w formularzu.
+	Open email app	Otwórz aplikację pocztową
+	Open link	Otwórz łącze
+	Open this web page?	Otworzyć tę stronę internetową?
+	PRs	PR
+	Place saved {what}	Umieść zapisane: {what}
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Drukuj jednostronnie. Zachowaj kolejność arkuszy, przetnij w miejscach oznaczeń, a następnie ułóż stosy od lewej do prawej i od góry do dołu.
+	Real name	Imię i nazwisko
+	Remove saved {what}	Usuń zapisane: {what}
+	Reverse the order	Odwróć kolejność
+	Run form script	Uruchom skrypt formularza
+	SHA-1 digest	Skrót SHA-1
+	SHA-256 digest	Skrót SHA-256
+	Scripted content must be usable with a keyboard and assistive technology. Check the document's scripts.	Zawartość obsługiwana skryptami musi być dostępna z klawiatury i dla technologii asystujących. Sprawdź skrypty dokumentu.
+	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Skrypty działają w piaskownicy bez dostępu do plików i sieci. Skrypt próbujący otworzyć stronę internetową najpierw wymaga Twojej zgody. Przy wyłączonym JavaScript standardowe funkcje formatowania, walidacji i obliczeń Acrobata nadal działają.
+	Selected image files: {count}	Wybrane pliki obrazów: {count}
+	Show	Pokaż
+	Sign yourself	Podpisz samodzielnie
+	Sort	Sortuj
+	Squiggly	Faliste podkreślenie
+	Table	Tabela
+	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	Wiersze tabeli należą bezpośrednio do tabeli lub jej nagłówka, treści albo stopki. Popraw tagi tabeli.
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Rozpoznawanie tekstu nie jest zainstalowane: brakuje modeli (uruchom `cargo xtask models` lub ustaw PDFCRAFT_MODELS).
+	That didn't work: an internal error stopped it ({m}).	Operacja nie powiodła się z powodu błędu wewnętrznego ({m}).
+	The Windows store's digital IDs couldn't be listed: {e}	Nie można wyświetlić identyfikatorów cyfrowych z magazynu Windows: {e}
+	The document changed while you were choosing a file, so nothing was changed.	Dokument zmienił się podczas wybierania pliku, więc nic nie zmieniono.
+	The document was closed before it could be saved.	Dokument został zamknięty, zanim można go było zapisać.
+	The pages were extracted but not deleted, because the document changed while you were choosing a folder.	Strony zostały wyodrębnione, ale nie usunięte, ponieważ dokument zmienił się podczas wybierania folderu.
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	Ten adres internetowy łączy litery z różnych alfabetów, co jest częstym sposobem podszywania się pod nazwę innej witryny.
+	This web address uses letters from another alphabet, which can look like familiar ones.	Ten adres internetowy używa liter z innego alfabetu, które mogą wyglądać jak znane litery.
+	Use 72 DPI (one point per pixel)	Użyj 72 DPI (jeden punkt na piksel)
+	Use custom DPI	Użyj własnego DPI
+	Use each image's embedded DPI; use 72 DPI when it is absent.	Użyj DPI osadzonego w każdym obrazie; jeśli go brak, użyj 72 DPI.
+	Use image resolution	Użyj rozdzielczości obrazu
+	Use {what}	Użyj {what}
+	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Używane, gdy PDF nie określa układu ani powiększenia. Przewijanie ciągłe nie przeskakuje między stronami.
+	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Używane przy otwieraniu PDF. Jawnie wybrany tryb uruchomienia lub sterowania ma pierwszeństwo w bieżącej sesji.
+	Username	Nazwa użytkownika
+	Write this email?	Napisać tę wiadomość e-mail?
+	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	Formularz XFA: pola i dane XFA są synchronizowane, aby inne przeglądarki wyświetlały wpisane wartości.
+	{n} contributors · {c} commits	Współtwórców: {n} · Commitów: {c}
+	{who} in this document tried to open an address PdfCraft won't open: {e}.	Element „{who}” w tym dokumencie próbował otworzyć adres, którego PdfCraft nie otworzy: {e}.
+	{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents.	Element „{who}” w tym dokumencie próbował otworzyć adres, którego PdfCraft nie otworzy: {e}. Z dokumentów otwierane są tylko łącza internetowe (http, https) i pocztowe (mailto).
+	{who} in this document wants to open this address in your browser:	Element „{who}” w tym dokumencie chce otworzyć ten adres w przeglądarce:
+	{who} in this document wants to open your email app with this address:	Element „{who}” w tym dokumencie chce otworzyć aplikację pocztową z tym adresem:
+	ΔLOC	ΔLOC
+	−Bin	−Bin
+	−LOC	−LOC
+@plural	{n} field|{n} fields	{n} pole|{n} pola|{n} pól
+@plural	{n} page|{n} pages	{n} strona|{n} strony|{n} stron
+signature pad	Type	Wpisz
+	Flatten Fill & Sign when saving	Spłaszczaj elementy Wypełnij i podpisz przy zapisie
+	Text, marks and signatures become part of the page. Other comments stay editable.	Tekst, oznaczenia i podpisy stają się częścią strony. Pozostałe komentarze pozostają edytowalne.
+	Scroll tabs left	Przewiń karty w lewo
+	Scroll tabs right	Przewiń karty w prawo
+	Shared Field Properties	Wspólne właściwości pól
+	{n} fields selected	Liczba zaznaczonych pól: {n}
+	Mixed	Różne wartości
+	Custom font	Własna czcionka
+	Only checked properties will change. Mixed means the selected fields have different values.	Zmieni się tylko zaznaczone właściwości. Różne wartości oznaczają, że wybrane pola mają odmienne wartości.
+	Shift- or Ctrl/Command-click to select several fields.	Klikaj z Shift lub Ctrl/Command, aby zaznaczyć kilka pól.
+	Font size 0 uses automatic sizing.	Rozmiar czcionki 0 włącza automatyczny dobór rozmiaru.
+	Character limit:	Limit znaków:
+	Character limit 0 means no limit. A comb of characters needs a limit.	Limit znaków 0 oznacza brak limitu. Podział na kratki wymaga limitu znaków.
+	To change locked fields, also set Locked to No.	Aby zmienić zablokowane pola, ustaw również Zablokowane na Nie.
+	Comb of characters	Podział znaków na kratki
+	The document changed while you were editing field properties.	Dokument zmienił się podczas edycji właściwości pól.
+	The document is no longer open.	Dokument nie jest już otwarty.
+	The field properties dialog is no longer open.	Okno właściwości pól nie jest już otwarte.
+	The field properties could not be changed.	Nie można zmienić właściwości pól.
+	The selected fields could not be found. Select them again.	Nie można znaleźć wybranych pól. Zaznacz je ponownie.
+	The field {name} no longer exists.	Pole {name} już nie istnieje.
+	A selected field has no widget on any page, so the fields can't be edited together.	Wybrane pole nie ma widżetu na żadnej stronie, więc nie można edytować tych pól razem.
+	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} przy {dpi} dpi, czyli największym możliwym rozmiarze wyświetlania)
+# Contexts distinguish commands, certificate fields, and month cases in dates.
+comment menu	Edit	Edytuj
+action wizard	Start	Uruchom
+certificate	Subject	Podmiot certyfikatu
+calendar date	January	stycznia
+calendar date	February	lutego
+calendar date	March	marca
+calendar date	April	kwietnia
+calendar date	May	maja
+calendar date	June	czerwca
+calendar date	July	lipca
+calendar date	August	sierpnia
+calendar date	September	września
+calendar date	October	października
+calendar date	November	listopada
+calendar date	December	grudnia
+	Undo {action}	Cofnij: {action}
+	Redo {action}	Ponów: {action}
+	Inserted text	Wstawiony tekst
+	Certificate authority	Urząd certyfikacji
+	End entity	Podmiot końcowy
+	Creator	Twórca
+	Producer	Producent
+
+# Additional labels and portable shortcuts in the current main branch.
+	Zoom in / out (also pinch or {key}-scroll)	Powiększ / pomniejsz (także gestem szczypania lub {key} i przewijaniem)
+	Open a PDF ({key})	Otwórz PDF ({key})
+	Print ({key})	Drukuj ({key})
+	Document properties ({key})	Właściwości dokumentu ({key})
+	Zoom out ({key})	Pomniejsz ({key})
+	Zoom in ({key})	Powiększ ({key})
+	Rotate view clockwise ({key})	Obróć widok w prawo ({key})
+	New bookmark ({key})	Nowa zakładka ({key})
+	Previous ({key})	Poprzednie ({key})
+	Next ({key})	Następne ({key})
+	Redaction code:	Kod utajniania:
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	Spacja
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	{n} obiekt zaznaczony|{n} obiekty zaznaczone|{n} obiektów zaznaczonych
+	Drag the selection to move it. Esc clears the selection.	Przeciągnij zaznaczenie, aby je przenieść. Esc anuluje zaznaczenie.
+	Shift-click to select several objects. Drag empty space to select an area.	Klikaj z wciśniętym Shift, aby zaznaczyć kilka obiektów. Przeciągnij w pustym miejscu, aby zaznaczyć obszar.
+	Select at most 1000 objects at a time.	Zaznacz najwyżej 1000 obiektów naraz.
+	Finish or discard the text being edited before selecting several objects.	Zakończ lub odrzuć edycję tekstu przed zaznaczeniem kilku obiektów.
+	Move object	Przenieś obiekt
+	Move objects	Przenieś obiekty
+	Vertical text cannot be moved with this selection.	Tekstu pionowego nie można przenieść razem z tym zaznaczeniem.
+	Text used as a clipping path cannot be moved with this selection.	Tekstu używanego jako ścieżka przycinania nie można przenieść razem z tym zaznaczeniem.
+	These objects could not be moved. Select them again and try a smaller move.	Nie udało się przenieść tych obiektów. Zaznacz je ponownie i spróbuj mniejszego przesunięcia.
+	This page contains objects that cannot be selected together.	Ta strona zawiera obiekty, których nie można zaznaczyć razem.
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 5499d1d96..697f7585f 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -18,6 +18,9 @@
 	Preferences	Preferências
 	Preferences…	Preferências…
 	Interface language	Idioma da interface
+	Interface size	Tamanho da interface
+	Auto ({percent}%)	Automático ({percent}%)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	Automático segue o tamanho do texto do sistema. As páginas sempre são exibidas na resolução total da tela.
 	Identity	Identidade
 	Name on new comments	Nome nos novos comentários
 	Open…	Abrir…
@@ -51,6 +54,7 @@
 	Fit visible	Ajustar ao visível
 	Marquee zoom	Zoom por seleção
 	Take a snapshot	Capturar instantâneo
+	Column select	Seleção de coluna
 	Full screen mode	Modo de tela cheia
 	Read mode	Modo de leitura
 	Switch light / dark theme	Alternar tema claro / escuro
@@ -730,6 +734,7 @@
 	Dates	Datas
 	Text in images isn't found; recognise text (OCR) first.	Texto em imagens não é encontrado; reconheça o texto (OCR) primeiro.
 	No matches.	Nenhuma correspondência.
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	Alguns marcadores não são mostrados aqui: o painel lista um número limitado, com profundidade limitada.
 	{n} match(es) marked for redaction.	{n} correspondência(s) marcada(s) para ocultação.
 	Multiple words or phrases	Várias palavras ou frases
 	One word or phrase per line	Uma palavra ou frase por linha
@@ -1389,6 +1394,8 @@
 	Right Edge	Borda direita
 	Language	Idioma
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Salvo {place}: {before} → {after} ({pct}% menor){detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	Este arquivo já está o menor possível ({size}). Nenhuma cópia foi salva.
+	Saved {place}: {before} → {after} (not smaller){detail}	Salvo {place}: {before} → {after} (não ficou menor){detail}
 	Couldn't save the image: {e}	Não foi possível salvar a imagem: {e}
 	Adding images arrives on the web with file pickers for images	A adição de imagens chegará à Web com seletores de arquivo para imagens
 	Replacing images on page {p} arrives on the web with image pickers ({i})	A substituição de imagens na página {p} chegará à Web com seletores de imagem ({i})
@@ -2142,6 +2149,44 @@ comment menu	Edit	Editar
 	The field {name} no longer exists.	O campo {name} não existe mais.
 	A selected field has no widget on any page, so the fields can't be edited together.	Um campo selecionado não tem widget em nenhuma página, então os campos não podem ser editados juntos.
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} a {dpi} dpi, o maior tamanho em que podem ser desenhadas)
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	{n} objeto selecionado|{n} objetos selecionados
+	Drag the selection to move it. Esc clears the selection.	Arraste a seleção para movê-la. Esc limpa a seleção.
+	Shift-click to select several objects. Drag empty space to select an area.	Use Shift e clique para selecionar vários objetos. Arraste em um espaço vazio para selecionar uma área.
+	Select at most 1000 objects at a time.	Selecione no máximo 1000 objetos por vez.
+	Finish or discard the text being edited before selecting several objects.	Conclua ou descarte a edição do texto antes de selecionar vários objetos.
+	Move object	Mover objeto
+	Move objects	Mover objetos
+	Vertical text cannot be moved with this selection.	O texto vertical não pode ser movido com esta seleção.
+	Text used as a clipping path cannot be moved with this selection.	O texto usado como caminho de recorte não pode ser movido com esta seleção.
+	These objects could not be moved. Select them again and try a smaller move.	Não foi possível mover estes objetos. Selecione-os novamente e tente um deslocamento menor.
+	This page contains objects that cannot be selected together.	Esta página contém objetos que não podem ser selecionados juntos.
+	Fill colour	Cor de preenchimento
+	No fill	Sem preenchimento
+	Fill colour: none	Cor de preenchimento: nenhuma
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	Espaço
+	Grid view	Exibição em grade
+	List view	Exibição em lista
+	Files are combined in the order shown. Drag them to change it.	Os arquivos são combinados na ordem mostrada. Arraste-os para mudá-la.
+	Preview unavailable: {e}	Pré-visualização indisponível: {e}
+	Pages: {k} of {n}	Páginas: {k} de {n}
+	Check the pages	Verifique as páginas
+	Switch to List view to change the pages it takes.	Mude para a exibição em lista para alterar as páginas incluídas.
+	Expand all	Expandir tudo
+	Collapse all	Recolher tudo
+	Remove page	Remover página
+	Remove {n} pages	Remover {n} páginas
+
+# Shared panel docking
 	Reset panel layout	Redefinir disposição dos painéis
 	Float panel	Tornar painel flutuante
 	Move to group	Mover para grupo
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index c8245361b..711cd0956 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -17,6 +17,9 @@
 	Preferences	Настройки
 	Preferences…	Настройки…
 	Interface language	Язык интерфейса
+	Interface size	Размер интерфейса
+	Auto ({percent}%)	Авто ({percent}%)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	В режиме «Авто» используется размер текста из настроек системы. Страницы всегда отображаются в полном разрешении экрана.
 	Identity	Идентификация
 	Name on new comments	Имя в новых комментариях
 	Open…	Открыть…
@@ -65,6 +68,7 @@
 	Fit visible	По видимой области
 	Marquee zoom	Масштаб выделением
 	Take a snapshot	Сделать снимок
+	Column select	Выделение столбца
 	Full screen mode	Полноэкранный режим
 	Read mode	Режим чтения
 	Switch light / dark theme	Переключить светлую / тёмную тему
@@ -1095,6 +1099,7 @@
 	Dates	Даты
 	Text in images isn't found; recognise text (OCR) first.	Текст в изображениях не находится; сначала распознайте текст (OCR).
 	No matches.	Совпадений нет.
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	Некоторые закладки здесь не показаны: панель показывает ограниченное число закладок с ограниченной глубиной вложенности.
 	{n} match(es) marked for redaction.	Отмечено для сокрытия: {n} совпад.
 	Multiple words or phrases	Несколько слов или фраз
 	One word or phrase per line	По одному слову или фразе в строке
@@ -1497,6 +1502,8 @@
 	Right Edge	Правый край
 	Language	Язык
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Сохранено {place}: {before} → {after} (на {pct}% меньше){detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	Этот файл уже минимального размера ({size}). Копия не сохранена.
+	Saved {place}: {before} → {after} (not smaller){detail}	Сохранено {place}: {before} → {after} (не меньше){detail}
 	Couldn't save the image: {e}	Не удалось сохранить изображение: {e}
 	Adding images arrives on the web with file pickers for images	Добавление изображений появится в веб-версии с выбором файлов изображений
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Замена изображений на стр. {p} появится в веб-версии с выбором изображений ({i})
@@ -2054,17 +2061,44 @@
 	The field {name} no longer exists.	Поле {name} больше не существует.
 	A selected field has no widget on any page, so the fields can't be edited together.	У одного из выбранных полей нет виджета ни на одной странице, поэтому поля нельзя изменить вместе.
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} — с разрешением {dpi} dpi, максимальным, с каким их можно отрисовать)
-	Zoom in / out (also pinch or ⌘-scroll)	Масштаб (также щипок или ⌘-прокрутка)
-	Open a PDF (⌘O)	Открыть PDF (⌘O)
-	Print (⌘P)	Печать (⌘P)
-	Document properties (⌘D)	Свойства документа (⌘D)
-	Zoom out (⌘−)	Уменьшить (⌘−)
-	Zoom in (⌘+)	Увеличить (⌘+)
-	Rotate view clockwise (⇧⌘+)	Повернуть вид по часовой стрелке (⇧⌘+)
-	New bookmark (⌘B)	Новая закладка (⌘B)
-	Previous (⇧⌘G)	Предыдущее (⇧⌘G)
-	Next (⌘G)	Следующее (⌘G)
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Распознавание текста не установлено: отсутствуют модели (запустите `cargo xtask models` или задайте PDFCRAFT_MODELS).
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	Выделен {n} объект|Выделено {n} объекта|Выделено {n} объектов
+	Drag the selection to move it. Esc clears the selection.	Перетащите выделение, чтобы переместить его. Esc снимает выделение.
+	Shift-click to select several objects. Drag empty space to select an area.	Щёлкните с Shift, чтобы выбрать несколько объектов. Протяните рамку на пустом месте, чтобы выделить область.
+	Select at most 1000 objects at a time.	Выбирайте не более 1000 объектов одновременно.
+	Finish or discard the text being edited before selecting several objects.	Завершите или отмените редактирование текста, прежде чем выбирать несколько объектов.
+	Move object	Переместить объект
+	Move objects	Переместить объекты
+	Vertical text cannot be moved with this selection.	Вертикальный текст нельзя переместить вместе с этим выделением.
+	Text used as a clipping path cannot be moved with this selection.	Текст, используемый как обтравочный контур, нельзя переместить вместе с этим выделением.
+	These objects could not be moved. Select them again and try a smaller move.	Не удалось переместить эти объекты. Выберите их снова и попробуйте меньшее смещение.
+	This page contains objects that cannot be selected together.	На этой странице есть объекты, которые нельзя выделить вместе.
+	Fill colour	Цвет заливки
+	No fill	Без заливки
+	Fill colour: none	Цвет заливки: нет
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	Пробел
+	Grid view	Вид сеткой
+	List view	Вид списком
+	Files are combined in the order shown. Drag them to change it.	Файлы объединяются в показанном порядке. Перетащите их, чтобы изменить его.
+	Preview unavailable: {e}	Предпросмотр недоступен: {e}
+	Pages: {k} of {n}	Страницы: {k} из {n}
+	Check the pages	Проверьте страницы
+	Switch to List view to change the pages it takes.	Переключитесь на вид списком, чтобы изменить, какие страницы взять.
+	Expand all	Развернуть все
+	Collapse all	Свернуть все
+	Remove page	Удалить страницу
+	Remove {n} pages	Удалить страницы: {n}
+
+# Shared panel docking
 	Reset panel layout	Сбросить расположение панелей
 	Float panel	Сделать панель плавающей
 	Move to group	Переместить в группу
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 169dce7d0..f3a4afd33 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -22,6 +22,9 @@ comment menu	Edit	సవరించు
 	Preferences	ప్రాధాన్యతలు
 	Preferences…	ప్రాధాన్యతలు…
 	Interface language	ఇంటర్‌ఫేస్ భాష
+	Interface size	ఇంటర్‌ఫేస్ పరిమాణం
+	Auto ({percent}%)	ఆటో ({percent}%)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	ఆటో సిస్టమ్ టెక్స్ట్ పరిమాణాన్ని అనుసరిస్తుంది. పేజీలు ఎల్లప్పుడూ డిస్‌ప్లే పూర్తి రిజల్యూషన్‌లో చూపబడతాయి.
 	Identity	గుర్తింపు
 	Name on new comments	కొత్త వ్యాఖ్యలపై చూపే పేరు
 	Open…	తెరువు…
@@ -50,6 +53,7 @@ comment menu	Edit	సవరించు
 	Fit visible	కనిపించే భాగానికి సరిపోయేలా
 	Marquee zoom	ఎంచుకున్న ప్రాంతానికి జూమ్
 	Take a snapshot	స్నాప్‌షాట్ తీయి
+	Column select	నిలువు వరుస ఎంపిక
 	Full screen mode	పూర్తి స్క్రీన్ మోడ్
 	Read mode	చదివే మోడ్
 	Switch light / dark theme	లేత / ముదురు థీమ్‌ల మధ్య మారు
@@ -1069,6 +1073,7 @@ comment menu	Edit	సవరించు
 	Dates	తేదీలు
 	Text in images isn't found; recognise text (OCR) first.	చిత్రాలలోని టెక్స్ట్ కనుగొనబడదు; ముందుగా టెక్స్ట్‌ను గుర్తించండి (OCR).
 	No matches.	సరిపోలికలు ఏవీ లేవు.
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	కొన్ని బుక్‌మార్క్‌లు ఇక్కడ చూపబడవు: ప్యానెల్ పరిమిత సంఖ్యలో, పరిమిత లోతు వరకు మాత్రమే జాబితా చేస్తుంది.
 	{n} match(es) marked for redaction.	రెడాక్షన్ కోసం గుర్తించిన సరిపోలికలు: {n}.
 	Multiple words or phrases	బహుళ పదాలు లేదా పదబంధాలు
 	One word or phrase per line	ఒక్కో పంక్తికి ఒక పదం లేదా పదబంధం
@@ -1471,6 +1476,8 @@ action wizard	Start	ప్రారంభించు
 	Right Edge	కుడి అంచు
 	Language	భాష
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	{place} సేవ్ చేయబడింది: {before} → {after} ({pct}% తగ్గింది){detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	ఈ ఫైల్ ఇప్పటికే సాధ్యమైనంత చిన్నదిగా ఉంది ({size}). కాపీ ఏదీ సేవ్ చేయబడలేదు.
+	Saved {place}: {before} → {after} (not smaller){detail}	{place} సేవ్ చేయబడింది: {before} → {after} (తగ్గలేదు){detail}
 	Couldn't save the image: {e}	చిత్రాన్ని సేవ్ చేయడం సాధ్యం కాలేదు: {e}
 	Adding images arrives on the web with file pickers for images	చిత్రాలను జోడించడం, చిత్రాల కోసం ఫైల్ పికర్‌లతో పాటు వెబ్‌లో వస్తుంది
 	Replacing images on page {p} arrives on the web with image pickers ({i})	{p}వ పేజీలోని చిత్రాలను భర్తీ చేయడం, చిత్రాల పికర్‌లతో పాటు వెబ్‌లో వస్తుంది ({i})
@@ -2072,17 +2079,43 @@ action wizard	Start	ప్రారంభించు
 	The field {name} no longer exists.	{name} ఫీల్డ్ ఇకపై లేదు.
 	A selected field has no widget on any page, so the fields can't be edited together.	ఎంచుకున్న ఒక ఫీల్డ్‌కు ఏ పేజీలోనూ విడ్జెట్ లేదు, కాబట్టి ఫీల్డ్‌లను కలిపి సవరించలేము.
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} {dpi} dpi వద్ద, అవి గీయగల అతిపెద్ద పరిమాణం)
-	Zoom in / out (also pinch or ⌘-scroll)	జూమ్ పెంచు / తగ్గించు (పించ్ లేదా ⌘-స్క్రోల్‌తో కూడా)
-	Open a PDF (⌘O)	PDFను తెరువు (⌘O)
-	Print (⌘P)	ముద్రించు (⌘P)
-	Document properties (⌘D)	పత్ర లక్షణాలు (⌘D)
-	Zoom out (⌘−)	జూమ్ తగ్గించు (⌘−)
-	Zoom in (⌘+)	జూమ్ పెంచు (⌘+)
-	Rotate view clockwise (⇧⌘+)	వీక్షణను సవ్యదిశలో తిప్పు (⇧⌘+)
-	New bookmark (⌘B)	కొత్త బుక్‌మార్క్ (⌘B)
-	Previous (⇧⌘G)	మునుపటి (⇧⌘G)
-	Next (⌘G)	తదుపరి (⌘G)
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	టెక్స్ట్ గుర్తింపు ఇన్‌స్టాల్ కాలేదు: దాని మోడల్‌లు లేవు (`cargo xtask models` అమలు చేయండి, లేదా PDFCRAFT_MODELS సెట్ చేయండి).
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	{n} వస్తువు ఎంచుకోబడింది|{n} వస్తువులు ఎంచుకోబడ్డాయి
+	Drag the selection to move it. Esc clears the selection.	ఎంపికను కదిలించడానికి లాగండి. Esc ఎంపికను తొలగిస్తుంది.
+	Shift-click to select several objects. Drag empty space to select an area.	అనేక వస్తువులను ఎంచుకోవడానికి Shift నొక్కి క్లిక్ చేయండి. ప్రాంతాన్ని ఎంచుకోవడానికి ఖాళీ ప్రదేశంలో లాగండి.
+	Select at most 1000 objects at a time.	ఒకేసారి గరిష్ఠంగా 1000 వస్తువులను ఎంచుకోండి.
+	Finish or discard the text being edited before selecting several objects.	అనేక వస్తువులను ఎంచుకునే ముందు వచన సవరణను పూర్తి చేయండి లేదా విస్మరించండి.
+	Move object	వస్తువును కదిలించు
+	Move objects	వస్తువులను కదిలించు
+	Vertical text cannot be moved with this selection.	ఈ ఎంపికతో నిలువు వచనాన్ని కదిలించలేరు.
+	Text used as a clipping path cannot be moved with this selection.	క్లిప్పింగ్ పాత్‌గా ఉపయోగించిన వచనాన్ని ఈ ఎంపికతో కదిలించలేరు.
+	These objects could not be moved. Select them again and try a smaller move.	ఈ వస్తువులను కదిలించలేకపోయాము. మళ్లీ ఎంచుకుని తక్కువ దూరం కదిలించడానికి ప్రయత్నించండి.
+	This page contains objects that cannot be selected together.	ఈ పేజీలో కలిసి ఎంచుకోలేని వస్తువులు ఉన్నాయి.
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	స్పేస్
+	Grid view	గ్రిడ్ వీక్షణ
+	List view	జాబితా వీక్షణ
+	Files are combined in the order shown. Drag them to change it.	ఫైల్‌లు చూపిన క్రమంలో కలపబడతాయి. క్రమాన్ని మార్చడానికి వాటిని లాగండి.
+	Preview unavailable: {e}	ప్రివ్యూ అందుబాటులో లేదు: {e}
+	Pages: {k} of {n}	పేజీలు: {n}లో {k}
+	Check the pages	పేజీలను తనిఖీ చేయండి
+	Switch to List view to change the pages it takes.	ఇది తీసుకునే పేజీలను మార్చడానికి జాబితా వీక్షణకు మారండి.
+	Larger pages	పెద్ద పేజీలు
+	Smaller pages	చిన్న పేజీలు
+	Reset page size	పేజీ పరిమాణాన్ని రీసెట్ చేయి
+	Expand all	అన్నీ విస్తరించు
+	Collapse all	అన్నీ ముడుచు
+	Remove page	పేజీని తీసివేయి
+	Remove {n} pages	{n} పేజీలను తీసివేయి
+
+# Shared panel docking
 	Reset panel layout	ప్యానెల్ అమరికను రీసెట్ చేయి
 	Float panel	ప్యానెల్‌ను తేలియాడేలా చేయి
 	Move to group	సమూహానికి తరలించు
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index f78d0d99f..b1f565c8c 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -27,6 +27,9 @@
 	Preferences	Налаштування
 	Preferences…	Налаштування…
 	Interface language	Мова інтерфейсу
+	Interface size	Розмір інтерфейсу
+	Auto ({percent}%)	Автоматично ({percent}%)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	Автоматичний режим використовує розмір тексту із системних налаштувань. Сторінки завжди відображаються в повній роздільній здатності екрана.
 	Identity	Особисті дані
 	Name on new comments	Ім’я в нових коментарях
 	Open…	Відкрити…
@@ -72,6 +75,7 @@
 	Fit visible	За видимою областю
 	Marquee zoom	Масштабувати виділену область
 	Take a snapshot	Зробити знімок
+	Column select	Виділення стовпця
 	Full screen mode	Повноекранний режим
 	Read mode	Режим читання
 	Switch light / dark theme	Перемкнути світлу / темну тему
@@ -1092,6 +1096,7 @@
 	Dates	Дати
 	Text in images isn't found; recognise text (OCR) first.	Текст у зображеннях не знаходиться; спочатку розпізнайте текст (OCR).
 	No matches.	Збігів немає.
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	Деякі закладки тут не показано: панель показує обмежену кількість закладок з обмеженою глибиною вкладення.
 	{n} match(es) marked for redaction.	Збігів, позначених для вилучення: {n}.
 	Multiple words or phrases	Кілька слів або фраз
 	One word or phrase per line	По одному слову або фразі в рядку
@@ -1494,6 +1499,8 @@
 	Right Edge	Правий край
 	Language	Мова
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Збережено {place}: {before} → {after} (менше на {pct}%){detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	Цей файл уже мінімального розміру ({size}). Копію не збережено.
+	Saved {place}: {before} → {after} (not smaller){detail}	Збережено {place}: {before} → {after} (не менше){detail}
 	Couldn't save the image: {e}	Не вдалося зберегти зображення: {e}
 	Adding images arrives on the web with file pickers for images	Додавання зображень з’явиться у вебверсії разом із вибором файлів зображень
 	Replacing images on page {p} arrives on the web with image pickers ({i})	Заміна зображень на сторінці {p} з’явиться у вебверсії разом із вибором зображень ({i})
@@ -2164,6 +2171,44 @@ certificate	Subject	Власник сертифіката
 	The field {name} no longer exists.	Поле {name} більше не існує.
 	A selected field has no widget on any page, so the fields can't be edited together.	Одне з вибраних полів не має віджета на жодній сторінці, тому поля не можна редагувати разом.
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} — з роздільністю {dpi} dpi, найбільшою, з якою їх можна відобразити)
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	Виділено {n} об’єкт|Виділено {n} об’єкти|Виділено {n} об’єктів
+	Drag the selection to move it. Esc clears the selection.	Перетягніть виділення, щоб перемістити його. Esc скасовує виділення.
+	Shift-click to select several objects. Drag empty space to select an area.	Клацніть із Shift, щоб вибрати кілька об’єктів. Протягніть рамку на порожньому місці, щоб виділити область.
+	Select at most 1000 objects at a time.	Вибирайте не більше 1000 об’єктів одночасно.
+	Finish or discard the text being edited before selecting several objects.	Завершіть або скасуйте редагування тексту, перш ніж вибирати кілька об’єктів.
+	Move object	Перемістити об’єкт
+	Move objects	Перемістити об’єкти
+	Vertical text cannot be moved with this selection.	Вертикальний текст не можна перемістити разом із цим виділенням.
+	Text used as a clipping path cannot be moved with this selection.	Текст, що використовується як контур відсікання, не можна перемістити разом із цим виділенням.
+	These objects could not be moved. Select them again and try a smaller move.	Не вдалося перемістити ці об’єкти. Виберіть їх знову та спробуйте менше зміщення.
+	This page contains objects that cannot be selected together.	На цій сторінці є об’єкти, які не можна виділити разом.
+	Fill colour	Колір заливки
+	No fill	Без заливки
+	Fill colour: none	Колір заливки: немає
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	Пробіл
+	Grid view	Вигляд сіткою
+	List view	Вигляд списком
+	Files are combined in the order shown. Drag them to change it.	Файли об’єднуються в показаному порядку. Перетягніть їх, щоб змінити його.
+	Preview unavailable: {e}	Попередній перегляд недоступний: {e}
+	Pages: {k} of {n}	Сторінки: {k} із {n}
+	Check the pages	Перевірте сторінки
+	Switch to List view to change the pages it takes.	Перейдіть до вигляду списком, щоб змінити, які сторінки взяти.
+	Expand all	Розгорнути всі
+	Collapse all	Згорнути всі
+	Remove page	Видалити сторінку
+	Remove {n} pages	Видалити сторінки: {n}
+
+# Shared panel docking
 	Reset panel layout	Скинути розташування панелей
 	Float panel	Відкріпити панель
 	Move to group	Перемістити до групи
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index b2e0dbb5f..898a66bcc 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -58,6 +58,9 @@
 	Preferences	首选项
 	Preferences…	首选项…
 	Interface language	界面语言
+	Interface size	界面大小
+	Auto ({percent}%)	自动 ({percent}%)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	“自动”会跟随系统的文字大小。页面始终以显示器的完整分辨率渲染。
 	Identity	身份
 	Name on new comments	新注释的作者姓名
 	Open…	打开…
@@ -115,6 +118,7 @@
 	Rotate view clockwise	顺时针旋转视图
 	Rotate view counterclockwise	逆时针旋转视图
 	Take a snapshot	拍摄快照
+	Column select	列选择
 	Full screen mode	全屏模式
 	Read mode	阅读模式
 	Switch light / dark theme	切换浅色/深色主题
@@ -793,6 +797,7 @@
 	Dates	日期
 	Text in images isn't found; recognise text (OCR) first.	图像中的文本无法找到；请先识别文本（OCR）。
 	No matches.	无匹配。
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	此处未显示部分书签：面板列出的书签数量和嵌套深度有限。
 	{n} match(es) marked for redaction.	已标记 {n} 个匹配以待密文。
 	Multiple words or phrases	多个单词或短语
 	One word or phrase per line	每行一个单词或短语
@@ -1455,6 +1460,8 @@
 	Right Edge	右边缘
 	Language	语言
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	已保存{place}：{before} → {after}（缩小了{pct}%）{detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	此文件已经是最小的了（{size}）。未保存副本。
+	Saved {place}: {before} → {after} (not smaller){detail}	已保存{place}：{before} → {after}（未缩小）{detail}
 	Couldn't save the image: {e}	无法保存图像：{e}
 	Adding images arrives on the web with file pickers for images	Web 端添加图像将使用图像文件选择器
 	Replacing images on page {p} arrives on the web with image pickers ({i})	在 Web 端替换第{p}页的图像将使用图像选择器（{i}）
@@ -2105,17 +2112,44 @@
 	The field {name} no longer exists.	字段 {name} 已不存在。
 	A selected field has no widget on any page, so the fields can't be edited together.	某个所选字段在任何页面上都没有控件，因此无法一起编辑这些字段。
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	（{n} 张以可绘制的最大尺寸 {dpi} dpi 导出）
-	Zoom out (⌘−)	缩小 (⌘−)
-	Zoom in (⌘+)	放大 (⌘+)
-	Rotate view clockwise (⇧⌘+)	顺时针旋转视图 (⇧⌘+)
-	Open a PDF (⌘O)	打开 PDF (⌘O)
-	Print (⌘P)	打印 (⌘P)
-	Document properties (⌘D)	文档属性 (⌘D)
-	New bookmark (⌘B)	新建书签 (⌘B)
-	Previous (⇧⌘G)	上一个 (⇧⌘G)
-	Next (⌘G)	下一个 (⌘G)
-	Zoom in / out (also pinch or ⌘-scroll)	放大/缩小（也可用捏合或 ⌘+滚轮）
-	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	尚未安装文本识别功能：缺少模型（请运行 `cargo xtask models` 或设置 PDFCRAFT_MODELS）。
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	已选择 {n} 个对象
+	Drag the selection to move it. Esc clears the selection.	拖动选区即可移动。按 Esc 清除选择。
+	Shift-click to select several objects. Drag empty space to select an area.	按住 Shift 单击可选择多个对象。拖动空白区域可框选。
+	Select at most 1000 objects at a time.	一次最多选择 1000 个对象。
+	Finish or discard the text being edited before selecting several objects.	请先完成或放弃正在编辑的文本，再选择多个对象。
+	Move object	移动对象
+	Move objects	移动多个对象
+	Vertical text cannot be moved with this selection.	无法随此选区移动竖排文本。
+	Text used as a clipping path cannot be moved with this selection.	无法随此选区移动用作剪切路径的文本。
+	These objects could not be moved. Select them again and try a smaller move.	无法移动这些对象。请重新选择并尝试较小的移动距离。
+	This page contains objects that cannot be selected together.	此页面包含无法一起选择的对象。
+	Fill colour	填充颜色
+	No fill	无填充
+	Fill colour: none	填充颜色：无
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	空格
+	Grid view	网格视图
+	List view	列表视图
+	Files are combined in the order shown. Drag them to change it.	文件按显示的顺序合并。拖动可更改顺序。
+	Preview unavailable: {e}	无法预览：{e}
+	Pages: {k} of {n}	页面：{k}/{n}
+	Check the pages	请检查页码
+	Switch to List view to change the pages it takes.	切换到列表视图以更改要使用的页面。
+	Expand all	全部展开
+	Collapse all	全部折叠
+	Remove page	删除页面
+	Remove {n} pages	删除 {n} 页
+
+# Shared panel docking
 	Reset panel layout	重置面板布局
 	Float panel	浮动面板
 	Move to group	移到组中
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 01dc9c430..2f1936d33 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -17,6 +17,9 @@
 	Preferences	偏好設定
 	Preferences…	偏好設定…
 	Interface language	介面語言
+	Interface size	介面大小
+	Auto ({percent}%)	自動 ({percent}%)
+	Auto follows the system's text size. Pages always render at the display's full resolution.	「自動」會跟隨系統的文字大小。頁面一律以螢幕的完整解析度呈現。
 	Identity	個人資訊
 	Name on new comments	新註解的作者名稱
 	Open…	開啟…
@@ -74,6 +77,7 @@
 	Rotate view clockwise	順時針旋轉檢視
 	Rotate view counterclockwise	逆時針旋轉檢視
 	Take a snapshot	擷取快照
+	Column select	欄選取
 	Full screen mode	全螢幕模式
 	Read mode	閱讀模式
 	Switch light / dark theme	切換淺色／深色主題
@@ -742,6 +746,7 @@
 	Dates	日期
 	Text in images isn't found; recognise text (OCR) first.	圖片中的文字無法找到；請先識別文字（OCR）。
 	No matches.	無匹配。
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	此處未顯示部分書籤：面板列出的書籤數量和巢狀深度有限。
 	{n} match(es) marked for redaction.	已標記 {n} 個匹配以待遮蔽內容。
 	Multiple words or phrases	多個單字或片語
 	One word or phrase per line	每行一個單字或片語
@@ -1404,6 +1409,8 @@
 	Right Edge	右邊緣
 	Language	語言
 	Saved {place}: {before} → {after} ({pct}% smaller){detail}	已儲存{place}：{before} → {after}（縮小了{pct}%）{detail}
+	This file is already as small as it can be made ({size}). No copy was saved.	此檔案已經是最小的了（{size}）。未儲存副本。
+	Saved {place}: {before} → {after} (not smaller){detail}	已儲存{place}：{before} → {after}（未縮小）{detail}
 	Couldn't save the image: {e}	無法儲存圖片：{e}
 	Adding images arrives on the web with file pickers for images	Web 端新增圖片將使用圖片檔案選擇器
 	Replacing images on page {p} arrives on the web with image pickers ({i})	在 Web 端替換第{p}頁的圖片將使用圖片選擇器（{i}）
@@ -2027,16 +2034,44 @@
 	The field {name} no longer exists.	欄位 {name} 已不存在。
 	A selected field has no widget on any page, so the fields can't be edited together.	某個所選欄位在任何頁面上都沒有控制項，因此無法一起編輯這些欄位。
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	（{n} 張以可繪製的最大尺寸 {dpi} dpi 匯出）
-	Zoom out (⌘−)	縮小（⌘−）
-	Zoom in (⌘+)	放大（⌘+）
-	Rotate view clockwise (⇧⌘+)	順時針旋轉檢視（⇧⌘+）
-	Open a PDF (⌘O)	開啟 PDF（⌘O）
-	Print (⌘P)	列印（⌘P）
-	Document properties (⌘D)	文件內容（⌘D）
-	New bookmark (⌘B)	新建書籤 (⌘B)
-	Previous (⇧⌘G)	上一個 (⇧⌘G)
-	Next (⌘G)	下一個 (⌘G)
-	Zoom in / out (also pinch or ⌘-scroll)	放大／縮小（也可用雙指縮放或 ⌘ 加捲動）
+
+# Multi-object selection and movement (#844)
+@plural	{n} object selected|{n} objects selected	已選取 {n} 個物件
+	Drag the selection to move it. Esc clears the selection.	拖曳選取範圍即可移動。按 Esc 清除選取。
+	Shift-click to select several objects. Drag empty space to select an area.	按住 Shift 點選可選取多個物件。拖曳空白區域可框選。
+	Select at most 1000 objects at a time.	一次最多選取 1000 個物件。
+	Finish or discard the text being edited before selecting several objects.	請先完成或放棄正在編輯的文字，再選取多個物件。
+	Move object	移動物件
+	Move objects	移動多個物件
+	Vertical text cannot be moved with this selection.	無法隨此選取範圍移動直排文字。
+	Text used as a clipping path cannot be moved with this selection.	無法隨此選取範圍移動用作裁切路徑的文字。
+	These objects could not be moved. Select them again and try a smaller move.	無法移動這些物件。請重新選取並嘗試較小的移動距離。
+	This page contains objects that cannot be selected together.	此頁面包含無法一起選取的物件。
+	Fill colour	填充顏色
+	No fill	無填充
+	Fill colour: none	填充顏色：無
+
+# Keyboard key names, distinct from command labels.
+key	Ctrl	Ctrl
+key	Shift	Shift
+key	Delete	Delete
+key	Esc	Esc
+key	Home	Home
+key	End	End
+key	Space	空格
+	Grid view	格狀檢視
+	List view	清單檢視
+	Files are combined in the order shown. Drag them to change it.	檔案將按顯示的順序合併。拖曳可變更順序。
+	Preview unavailable: {e}	無法預覽：{e}
+	Pages: {k} of {n}	頁面：{k}/{n}
+	Check the pages	請檢查頁碼
+	Switch to List view to change the pages it takes.	切換到清單檢視以變更要使用的頁面。
+	Expand all	全部展開
+	Collapse all	全部摺疊
+	Remove page	刪除頁面
+	Remove {n} pages	刪除 {n} 頁
+
+# Shared panel docking
 	Reset panel layout	重設面板配置
 	Float panel	浮動面板
 	Move to group	移至群組
diff --git a/crates/ui-egui/src/icon_data.rs b/crates/ui-egui/src/icon_data.rs
index fbb39d3c3..7341b5775 100644
--- a/crates/ui-egui/src/icon_data.rs
+++ b/crates/ui-egui/src/icon_data.rs
@@ -116,6 +116,7 @@ pub static ICONS: &[(&str, &[u8])] = &[
     ("messages-square", include_bytes!("../../../assets/icons/messages-square.svg")),
     ("mic", include_bytes!("../../../assets/icons/mic.svg")),
     ("minimize", include_bytes!("../../../assets/icons/minimize.svg")),
+    ("minimize-2", include_bytes!("../../../assets/icons/minimize-2.svg")),
     ("minus", include_bytes!("../../../assets/icons/minus.svg")),
     ("moon", include_bytes!("../../../assets/icons/moon.svg")),
     ("mouse-pointer-2", include_bytes!("../../../assets/icons/mouse-pointer-2.svg")),
diff --git a/crates/ui-egui/src/icons.rs b/crates/ui-egui/src/icons.rs
index 1c6c14a41..9fcafd1c7 100644
--- a/crates/ui-egui/src/icons.rs
+++ b/crates/ui-egui/src/icons.rs
@@ -75,7 +75,8 @@ mod tests {
 
     #[test]
     fn shared_catalog_preserves_existing_icons_and_fallback_uri() {
-        assert_eq!(ICONS.len(), 184);
+        assert_eq!(ICONS.len(), 185);
+        assert!(exists("minimize-2"));
         for (name, original) in ICONS {
             let expected =
                 String::from_utf8_lossy(original).replace("currentColor", "#ffffff").replace("stroke-width=\"2\"", "stroke-width=\"1.75\"");
diff --git a/crates/ui-egui/src/js_ui.rs b/crates/ui-egui/src/js_ui.rs
index d285372b6..9f5ffdfa1 100644
--- a/crates/ui-egui/src/js_ui.rs
+++ b/crates/ui-egui/src/js_ui.rs
@@ -252,6 +252,30 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
             crate::i18n::set_current(crate::i18n::Lang::from_pref(&app.language));
         }
     });
+    ui.horizontal(|ui| {
+        use crate::ui_scale;
+        ui.label(tl!("Interface size"));
+        let auto =
+            crate::i18n::fmt(tl!("Auto ({percent}%)"), &[("percent", &ui_scale::percent(ui_scale::factor(None, app.system_text_scale)).to_string())]);
+        let selected = app.ui_scale.map_or_else(|| auto.clone(), |f| format!("{}%", ui_scale::percent(f)));
+        egui::ComboBox::from_id_salt("interface-size").selected_text(selected).show_ui(ui, |ui| {
+            if ui.selectable_value(&mut app.ui_scale, None, auto).clicked() {
+                ui.close();
+            }
+            for p in ui_scale::PRESETS {
+                let factor = f32::from(p) / 100.0;
+                if ui.selectable_label(app.ui_scale.is_some_and(|f| ui_scale::percent(f) == u32::from(p)), format!("{p}%")).clicked() {
+                    app.ui_scale = Some(factor);
+                    ui.close();
+                }
+            }
+        });
+    });
+    ui.label(
+        egui::RichText::new(tl!("Auto follows the system's text size. Pages always render at the display's full resolution."))
+            .small()
+            .color(t.text_muted),
+    );
     ui.add_space(8.0);
     ui.label(egui::RichText::new(tl!("Documents and view")).font(theme::semibold(13.0)));
     ui.horizontal(|ui| {
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 446b019ad..48c26147e 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -26,9 +26,11 @@ mod a11y_ui;
 mod actions_ui;
 pub mod canvas;
 mod chrome;
+mod combine_grid;
+pub use combine_grid::ThumbState as CombineThumb;
 mod combine_ui;
 pub mod docking;
-pub use combine_ui::{Columns as CombineColumns, Lock as CombineLock, SortKey};
+pub use combine_ui::{Columns as CombineColumns, CombineView, Lock as CombineLock, SortKey};
 mod commands;
 mod comment_props;
 pub mod comments;
@@ -57,6 +59,7 @@ pub mod marks {
 }
 mod content_ui;
 mod link_ui;
+mod object_ui;
 pub use create_ui::Clip;
 pub use link_ui::LinkDraft;
 pub use optimize_ui::{OptimizeDraft, OptimizeTab};
@@ -110,6 +113,7 @@ mod recovery;
 #[cfg(not(target_arch = "wasm32"))]
 mod system_fonts;
 pub mod theme;
+pub mod ui_scale;
 pub mod updates;
 mod wheel_pager;
 mod widgets;
@@ -206,6 +210,9 @@ pub enum QuickTool {
     MarqueeZoom,
     /// Edit ▸ Take a Snapshot.
     Snapshot,
+    /// Edit ▸ Column Select: drag a rectangle to select only the text inside it (#740). The
+    /// Select tool does the same while Alt/Option is held at the start of a drag.
+    ColumnSelect,
 }
 
 /// Files dropped on a document's page grid.
@@ -342,6 +349,14 @@ pub enum OsEvent {
 /// Returns the [`OsEvent`]s that arrived since it was last called (set by the desktop app).
 pub type OsEventsFn = Box<dyn FnMut() -> Vec<OsEvent>>;
 
+/// Hands a saved PDF to the page embedding PdfCraft (web): `(name, bytes, save_as)`. `save_as`
+/// is `true` for Save As. Set by the web app when a host page (such as a Nextcloud app) asked
+/// for saves; without it the browser downloads the file.
+pub type HostSaveFn = Box<dyn Fn(&str, &[u8], bool) -> Result<(), String>>;
+
+/// Told every frame whether any tab has unsaved work, so a host page can warn before leaving.
+pub type HostDirtyFn = Box<dyn FnMut(bool)>;
+
 pub struct PasswordPrompt {
     pub name: String,
     pub path: Option<String>,
@@ -350,6 +365,9 @@ pub struct PasswordPrompt {
     pub error: Option<String>,
     /// A late startup file must stay in the background even after it is unlocked.
     activate: bool,
+    /// The bytes are a recovery snapshot: once the document is open it takes the snapshot's
+    /// path and recovery entry. Cancelling the prompt drops the association with it (#813).
+    recovered: Option<RecoveryMeta>,
 }
 
 #[derive(serde::Serialize, serde::Deserialize)]
@@ -393,8 +411,19 @@ pub struct PdfCraftApp {
     /// Resolved colours, including the current OS theme when following the system.
     pub theme: ThemeKind,
     pub theme_preference: ThemePreference,
+    /// The desktop's light/dark choice, watched while the app runs (Linux has no winit answer).
+    desktop_theme: pdfcraft_platform::desktop_theme::DesktopTheme,
+    /// The last answer [`desktop_theme`] gave, so a frame that asks costs nothing.
+    desktop_dark: Option<bool>,
     /// Interface language preference: `auto` (follow the system) or a code from [`i18n::LANGUAGES`].
     pub language: String,
+    /// Preferences ▸ Interface size as a factor, or `None` to follow [`Self::system_text_scale`].
+    pub ui_scale: Option<f32>,
+    /// The desktop's text scaling (GNOME's text scaling factor), which the desktop app reads at
+    /// launch. 1.0 elsewhere, so tests and screenshots don't depend on the machine.
+    pub system_text_scale: f32,
+    /// The interface size last given to egui ([`ui_scale::sync`]).
+    ui_scale_applied: Option<f32>,
     /// Preferences: bake Fill & Sign marks into the page when saving. Off, so a normal save stays editable.
     pub flatten_fill_sign_on_save: bool,
     pub dialog: Option<Dialog>,
@@ -427,8 +456,14 @@ pub struct PdfCraftApp {
     startup_superseded: bool,
     /// Asynchronous opens that failed (web `?file=` fetches), shown as a notice.
     pub failed_inbox: FailedInbox,
+    /// Mirrors "some document has unsaved work" each frame, so the web page's `beforeunload` handler can read it (#812).
+    pub unsaved_flag: std::sync::Arc<std::sync::atomic::AtomicBool>,
     /// Requests from the operating system, polled every frame (macOS Apple events).
     pub os_events: Option<OsEventsFn>,
+    /// Save delivers to the embedding page instead of downloading (web, see [`HostSaveFn`]).
+    pub host_save: Option<HostSaveFn>,
+    /// Reports unsaved work to the embedding page (web, see [`HostDirtyFn`]).
+    pub host_dirty: Option<HostDirtyFn>,
     /// A pending "save changes?" question (closing a dirty tab or quitting).
     pub close_request: Option<CloseRequest>,
     /// Save to this path instead of asking (tests and automation).
@@ -495,6 +530,13 @@ pub struct PdfCraftApp {
     pub combine_tab: combine_ui::CombineTab,
     /// The Combine files table's column order and widths (kept in the settings).
     pub combine_columns: combine_ui::Columns,
+    /// Combine files as thumbnails or as the table (kept in the settings).
+    pub combine_view: combine_ui::CombineView,
+    /// How large the Combine grid draws its cards (1.0 = the usual; kept in the settings). Set
+    /// with [`PdfCraftApp::set_combine_zoom`].
+    pub combine_zoom: f32,
+    /// The Combine grid's thumbnails: rendered off the UI thread, a few at a time.
+    pub(crate) combine_thumbs: combine_grid::Thumbs,
     /// Images waiting for the resolution choice (released on cancel).
     pub image_import: Option<create_ui::ImageImport>,
     /// The custom stamp library, and the stamp being created.
@@ -526,7 +568,6 @@ pub struct PdfCraftApp {
     pub recoverable: Vec<RecoveryMeta>,
     recovery_keys: std::collections::HashMap<DocId, String>,
     last_autosave: f64,
-    pending_recovered: Option<RecoveryMeta>,
     allow_quit: bool,
     /// Shortcuts pressed while a text field had the keyboard, run on the next frame (see
     /// `registry_shortcuts`).
@@ -632,6 +673,12 @@ impl Default for PdfCraftApp {
     }
 }
 
+/// What the operating system says about light and dark, as "draw dark". `None` means nobody
+/// answered, not a preference, so the caller keeps what it chose.
+fn system_theme(ctx: &egui::Context, desktop_dark: Option<bool>) -> Option<bool> {
+    ctx.system_theme().map(|theme| theme == egui::Theme::Dark).or(desktop_dark)
+}
+
 /// A restored colour: an `[r, g, b]` array of finite numbers, each clamped to 0–1 (restored
 /// settings are untrusted). Anything else (a string, a wrong length, a null or a non-finite
 /// number) is refused whole, so the caller keeps its default.
@@ -673,7 +720,12 @@ impl PdfCraftApp {
             comment_prefs: Default::default(),
             theme: ThemeKind::Light,
             theme_preference: ThemePreference::Light,
+            desktop_theme: pdfcraft_platform::desktop_theme::DesktopTheme::start(),
+            desktop_dark: None,
             language: i18n::AUTO.to_string(),
+            ui_scale: None,
+            system_text_scale: 1.0,
+            ui_scale_applied: None,
             flatten_fill_sign_on_save: false,
             dialog: None,
             update_source: None,
@@ -694,7 +746,10 @@ impl PdfCraftApp {
             startup_inbox: Default::default(),
             startup_superseded: false,
             failed_inbox: Default::default(),
+            unsaved_flag: Default::default(),
             os_events: None,
+            host_save: None,
+            host_dirty: None,
             close_request: None,
             save_override: None,
             props_draft: None,
@@ -735,6 +790,9 @@ impl PdfCraftApp {
             combine_draft: Vec::new(),
             combine_tab: Default::default(),
             combine_columns: Default::default(),
+            combine_view: Default::default(),
+            combine_zoom: 1.0,
+            combine_thumbs: Default::default(),
             image_import: None,
             custom_stamps: Vec::new(),
             stamp_draft: Default::default(),
@@ -753,7 +811,6 @@ impl PdfCraftApp {
             recoverable: Vec::new(),
             recovery_keys: Default::default(),
             last_autosave: 0.0,
-            pending_recovered: None,
             allow_quit: false,
             deferred_commands: Vec::new(),
             dialog_seen: None,
@@ -871,7 +928,8 @@ impl PdfCraftApp {
             Ok(id) => id,
             Err(e @ (OpenError::NeedsPassword | OpenError::WrongPassword)) => {
                 let error = matches!(e, OpenError::WrongPassword).then(|| "Incorrect password. Try again.".to_string());
-                self.password_prompt = Some(PasswordPrompt { name: name.to_string(), path, bytes, input: String::new(), error, activate });
+                self.password_prompt =
+                    Some(PasswordPrompt { name: name.to_string(), path, bytes, input: String::new(), error, activate, recovered: None });
                 return Ok(());
             }
             Err(e) => return Err(e.to_string()),
@@ -1052,17 +1110,28 @@ impl PdfCraftApp {
     /// Answer the password prompt (`None` cancels).
     pub fn submit_password(&mut self, password: Option<String>) {
         let Some(p) = self.password_prompt.take() else { return };
-        let Some(pw) = password else { return };
+        let Some(pw) = password else {
+            // A cancelled recovery goes back on offer; its snapshot stays in the store and must
+            // not attach itself to whatever document is unlocked next (#813).
+            if let Some(meta) = p.recovered {
+                self.recoverable.push(meta);
+            }
+            return;
+        };
         match self.try_open(&p.name, p.path, p.bytes, Some(&pw), p.activate) {
             Err(e) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &p.name), ("e", &e.to_string())]),
-            // A recovered encrypted document is open once its foreground prompt is gone.
-            // Unlocking a background startup file must not finish another file's recovery.
-            Ok(()) if p.activate && self.password_prompt.is_none() => {
-                if let Some(meta) = self.pending_recovered.clone() {
-                    self.finish_recovery(&meta);
+            // A recovered encrypted document is open once its prompt is gone.
+            Ok(()) if self.password_prompt.is_none() => {
+                if let Some(meta) = &p.recovered {
+                    self.finish_recovery(meta);
+                }
+            }
+            // Wrong password: the new prompt is for the same bytes, so it keeps the snapshot.
+            Ok(()) => {
+                if let Some(prompt) = self.password_prompt.as_mut() {
+                    prompt.recovered = p.recovered;
                 }
             }
-            Ok(()) => {}
         }
     }
 
@@ -1142,6 +1211,12 @@ impl PdfCraftApp {
         self.active.and_then(|i| self.views.get(i).map(|v| (i, v.id)))
     }
 
+    /// A dialog or prompt is open over the window: the keyboard is its own, and nothing may act
+    /// on the document underneath it.
+    pub(crate) fn modal_open(&self) -> bool {
+        self.dialog.is_some() || self.close_request.is_some() || self.password_prompt.is_some() || self.pending_link.is_some() || self.updates.open
+    }
+
     /// Enable the UI control channel on `ctx` (opt-in; see [`control`]). Returns a client that
     /// sends requests to this app; [`control::serve`] exposes it on loopback.
     pub fn attach_control(&mut self, ctx: &egui::Context) -> control::ControlClient {
@@ -1213,7 +1288,9 @@ impl PdfCraftApp {
 
     pub fn set_theme_preference(&mut self, preference: ThemePreference) {
         self.theme_preference = preference;
-        self.theme = preference.resolve(self.ctx.as_ref().and_then(egui::Context::system_theme), self.theme);
+        // Before the first frame there is no context to ask, so the last choice stands.
+        let system = self.ctx.as_ref().and_then(|ctx| system_theme(ctx, self.desktop_dark));
+        self.theme = preference.resolve(system, self.theme);
         if let Some(ctx) = &self.ctx {
             theme::apply(ctx, self.theme);
         }
@@ -1227,7 +1304,10 @@ impl PdfCraftApp {
     }
 
     fn sync_theme(&mut self, ctx: &egui::Context) {
-        let kind = self.theme_preference.resolve(ctx.system_theme(), self.theme);
+        if let Some(dark) = self.desktop_theme.take_change() {
+            self.desktop_dark = Some(dark);
+        }
+        let kind = self.theme_preference.resolve(system_theme(ctx, self.desktop_dark), self.theme);
         if kind != self.theme {
             self.theme = kind;
             theme::apply(ctx, kind);
@@ -1309,6 +1389,8 @@ impl PdfCraftApp {
             "default_zoom": self.view_defaults.zoom_name(),
             "highlight_fields": self.view_defaults.highlight_fields,
             "language": self.language,
+            // Null follows the system's text scaling.
+            "ui_scale": self.ui_scale,
             "flatten_fill_sign": self.flatten_fill_sign_on_save,
             "date_format": self.session.date_format(),
             // Null follows the interface language.
@@ -1339,6 +1421,8 @@ impl PdfCraftApp {
             "javascript": self.session.javascript(),
             "actions": actions_ui::encode(&self.custom_actions),
             "combine_columns": self.combine_columns.to_json(),
+            "combine_view": self.combine_view.as_str(),
+            "combine_zoom": self.combine_zoom,
             "comments_panel_closed": self.comments_panel_closed,
         })
         .to_string()
@@ -1357,6 +1441,12 @@ impl PdfCraftApp {
             self.right = v.get("docking_right").and_then(|value| serde_json::from_value(value.clone()).ok()).flatten();
         }
         self.combine_columns = combine_ui::Columns::from_json(&v["combine_columns"]);
+        if let Some(view) = v["combine_view"].as_str().and_then(combine_ui::CombineView::parse) {
+            self.combine_view = view;
+        }
+        if let Some(zoom) = v["combine_zoom"].as_f64() {
+            self.set_combine_zoom(zoom as f32);
+        }
         if let Ok(r) = serde_json::from_value::<Vec<RecentFile>>(v["recent"].clone()) {
             // Only keep entries whose files still exist.
             #[cfg(not(target_arch = "wasm32"))]
@@ -1392,6 +1482,8 @@ impl PdfCraftApp {
         if let Some(on) = v["flatten_fill_sign"].as_bool() {
             self.flatten_fill_sign_on_save = on;
         }
+        // Settings are untrusted: a size out of range follows the system instead.
+        self.ui_scale = v["ui_scale"].as_f64().and_then(ui_scale::valid);
         // Settings are untrusted: an unusable pattern keeps the default.
         if let Some(f) = v["date_format"].as_str() {
             let _ = self.session.set_date_format(f);
@@ -1646,6 +1738,7 @@ impl PdfCraftApp {
                     "sign" => QuickTool::SignArea { certify: false },
                     "marquee-zoom" => QuickTool::MarqueeZoom,
                     "snapshot" => QuickTool::Snapshot,
+                    "column-select" => QuickTool::ColumnSelect,
                     "certify" => QuickTool::SignArea { certify: true },
                     custom if custom.starts_with("custom-stamp-") => {
                         let i: usize = custom[13..].parse().map_err(|_| format!("bad stamp {custom}"))?;
@@ -1674,6 +1767,7 @@ impl PdfCraftApp {
                 };
             }
             ("author", _) => self.comment_prefs.author = value.to_string(),
+            ("ui-scale", _) => self.ui_scale = ui_scale::parse(value)?,
             ("flatten-fill-sign", _) => {
                 self.flatten_fill_sign_on_save = match value {
                     "true" => true,
@@ -1689,6 +1783,18 @@ impl PdfCraftApp {
                 v.comments.selected = Some((p.saturating_sub(1), i.saturating_sub(1)));
                 v.comments.reveal = true;
             }
+            // `--combine-view list`: Combine files as thumbnails (grid) or as the table (list).
+            ("combine-view", _) => {
+                self.combine_view = combine_ui::CombineView::parse(value).ok_or("combine-view must be grid or list")?;
+            }
+            // `--combine-zoom 150`: the size of the cards in the Combine grid, in percent.
+            ("combine-zoom", _) => {
+                let percent = value.trim_end_matches('%').parse::<f32>().map_err(|e| e.to_string())?;
+                if !percent.is_finite() || !combine_grid::ZOOM_RANGE.contains(&(percent / 100.0)) {
+                    return Err("combine-zoom must be between 60 and 200".into());
+                }
+                self.set_combine_zoom(percent / 100.0);
+            }
             (k, None)
                 if ["page", "zoom", "layout", "cover", "organize", "grid-zoom", "fields", "find", "rotate", "select", "notice", "comment"]
                     .contains(&k) =>
@@ -1717,13 +1823,19 @@ impl PdfCraftApp {
             }
             return;
         }
+        // The other dialogs and prompts are modal too (⌘W closed the file behind Preferences,
+        // #870).
+        if self.modal_open() {
+            return;
+        }
         if let Some(view) = self.active.and_then(|i| self.views.get_mut(i))
             && view.auto_scroll.escape(ctx)
         {
             return;
         }
         self.registry_shortcuts(ctx);
-        if self.full_screen && ctx.input(|i| i.key_pressed(Key::Escape)) {
+        // (Esc closes a Combine file shown large first.)
+        if self.full_screen && self.combine_tab.preview.is_none() && ctx.input(|i| i.key_pressed(Key::Escape)) {
             self.set_full_screen(ctx, false);
         }
         if let Some(i) = self.active {
@@ -1823,6 +1935,7 @@ impl eframe::App for PdfCraftApp {
             }
         }
         self.sync_theme(ctx);
+        ui_scale::sync(ctx, ui_scale::factor(self.ui_scale, self.system_text_scale), &mut self.ui_scale_applied);
         // Remember user work even if its tab is subsequently closed or Home is selected.
         self.startup_superseded |= !self.views.is_empty() || self.combine_showing() || self.dialog.is_some() || self.password_prompt.is_some();
         // Before taking this frame's drop: the grid must be drawn once with the pointer where
@@ -1893,14 +2006,21 @@ impl eframe::App for PdfCraftApp {
         self.guard_quit(ctx);
         let now = ctx.input(|i| i.time);
         self.autosave_tick(now);
+        if self.host_dirty.is_some() {
+            let dirty = self.first_dirty().is_some();
+            if let Some(report) = self.host_dirty.as_mut() {
+                report(dirty);
+            }
+        }
         self.poll_updates();
         // Shortcuts deferred last frame: the text field has taken that frame's typing since.
         let deferred = std::mem::take(&mut self.deferred_commands);
         self.shortcuts(ctx);
-        // Scrolling is transient: never resume after changing tabs, opening a modal/palette,
-        // or returning to a window that lost focus.
-        let blocked = self.dialog.is_some() || self.close_request.is_some() || self.palette_open || !ctx.input(|i| i.focused);
+        // Scrolling and group-drag previews are transient: never resume after changing tabs,
+        // opening a modal/palette, or returning to a window that lost focus.
+        let blocked = self.modal_open() || self.palette_open || !ctx.input(|i| i.focused);
         for (index, view) in self.views.iter_mut().enumerate() {
+            view.objects.set_input_blocked(blocked || self.active != Some(index));
             if blocked || self.active != Some(index) {
                 view.auto_scroll.cancel();
             }
@@ -1992,6 +2112,8 @@ impl eframe::App for PdfCraftApp {
 
 impl PdfCraftApp {
     fn finish_render_frame(&mut self, ctx: &egui::Context) {
+        // The Combine grid's thumbnails, whichever tab shows (renders under way still finish).
+        self.combine_thumbs_frame(ctx);
         // Retire hidden documents before admitting the visible document's textures, so the
         // three cache limits apply to the application, regardless of how many tabs are open.
         for (i, view) in self.views.iter_mut().enumerate() {
diff --git a/crates/ui-egui/src/object_ui.rs b/crates/ui-egui/src/object_ui.rs
new file mode 100644
index 000000000..feb81c8cf
--- /dev/null
+++ b/crates/ui-egui/src/object_ui.rs
@@ -0,0 +1,363 @@
+//! Same-page mixed selection in Edit a PDF. Source references belong to one document
+//! generation; a drag previews geometry and commits one engine edit on release.
+
+use std::collections::HashMap;
+
+use egui::{Color32, Pos2, Rect, Stroke};
+use pdfcraft_engine::{Document, Edit, EditableObject, MAX_MOVE_OBJECTS, ObjectKind, ObjectTarget};
+use pdfcraft_render::DocInfo;
+
+use crate::canvas::{DocView, PageXform};
+
+const BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
+
+#[derive(Default)]
+pub(crate) struct ObjectSelection {
+    generation: Option<u64>,
+    cache: HashMap<usize, Result<Vec<EditableObject>, String>>,
+    page: Option<usize>,
+    selected: Vec<EditableObject>,
+    gesture: Option<Gesture>,
+    /// Expected geometry after our own edit, for remapping indexes that grouping can change.
+    pending: Option<Vec<EditableObject>>,
+    pub notice: Option<String>,
+    pub hold_editor: bool,
+    blocked_page: Option<usize>,
+    input_blocked: bool,
+}
+
+#[derive(Clone, Copy)]
+struct Gesture {
+    start: Pos2,
+    now: Pos2,
+    marquee: bool,
+    additive: bool,
+}
+
+impl ObjectSelection {
+    pub fn count(&self) -> usize {
+        self.selected.len()
+    }
+
+    /// A preview belongs to the active, focused document. Returning from another tab or a
+    /// modal must not turn a release that happened elsewhere into a document edit.
+    pub fn set_input_blocked(&mut self, blocked: bool) {
+        self.input_blocked = blocked;
+        if blocked {
+            self.gesture = None;
+            self.blocked_page = None;
+        }
+    }
+
+    fn clear(&mut self) {
+        self.page = None;
+        self.selected.clear();
+        self.gesture = None;
+        self.pending = None;
+        self.blocked_page = None;
+    }
+
+    pub fn prepare(&mut self, doc: &Document, enabled: bool, ctx: &egui::Context) {
+        self.hold_editor = false;
+        if !enabled {
+            self.clear();
+            return;
+        }
+        let generation = doc.edit_generation();
+        if self.generation != Some(generation) {
+            self.cache.clear();
+            self.gesture = None;
+            let expected = self.pending.take();
+            let remapped = self.page.zip(expected).and_then(|(page, expected)| {
+                let inventory = doc.editable_objects(page).ok()?;
+                let mut out = Vec::new();
+                for old in expected {
+                    let mut matches = inventory.iter().filter(|o| {
+                        o.target.kind == old.target.kind
+                            && o.content_type == old.content_type
+                            && o.text == old.text
+                            && o.rect.iter().zip(old.rect).all(|(a, b)| (a - b).abs() < 0.01)
+                    });
+                    let object = matches.next()?;
+                    if matches.next().is_some() || out.iter().any(|o: &EditableObject| o.target == object.target) {
+                        return None;
+                    }
+                    out.push(object.clone());
+                }
+                Some(out)
+            });
+            if let Some(objects) = remapped {
+                self.selected = objects;
+            } else {
+                self.clear();
+            }
+            self.generation = Some(generation);
+        } else {
+            // A refused edit keeps the generation and the original selection.
+            self.pending = None;
+        }
+        if self.page.is_some() && ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
+            self.clear();
+        }
+    }
+
+    fn inventory(&mut self, doc: &Document, page: usize) -> Result<Vec<EditableObject>, String> {
+        if self.cache.len() >= 8 && !self.cache.contains_key(&page) {
+            self.cache.clear();
+        }
+        self.cache.entry(page).or_insert_with(|| doc.editable_objects(page)).clone()
+    }
+}
+
+fn screen(xf: &PageXform, info: &DocInfo, page: usize, object: &EditableObject) -> Rect {
+    xf.user_rect(info, page, object.rect.map(|v| v as f32))
+}
+
+fn modified(ui: &egui::Ui) -> bool {
+    ui.input(|i| {
+        let modifiers = i
+            .events
+            .iter()
+            .find_map(|e| match e {
+                egui::Event::PointerButton { button: egui::PointerButton::Primary, pressed: true, modifiers, .. } => Some(*modifiers),
+                _ => None,
+            })
+            .unwrap_or(i.modifiers);
+        modifiers.shift || modifiers.ctrl || modifiers.command
+    })
+}
+
+fn single(view: &DocView, page: usize) -> Option<ObjectTarget> {
+    if let Some((_, index)) = view.content.selected.filter(|(p, _)| *p == page) {
+        Some(ObjectTarget { kind: ObjectKind::Added, index })
+    } else if let Some(s) = view.image_selection.as_ref().filter(|s| s.page == page) {
+        Some(ObjectTarget { kind: ObjectKind::Image, index: s.index })
+    } else {
+        view.line_editor.as_ref().filter(|e| e.page == page).map(|e| ObjectTarget { kind: ObjectKind::Text, index: e.block })
+    }
+}
+
+fn leave_single(view: &mut DocView) {
+    view.content.selected = None;
+    view.image_selection = None;
+    view.line_editor = None;
+    view.block_drag = None;
+}
+
+/// Returns true while group selection owns the interaction. Ordinary clicks still reach the
+/// single-object text/resize tools. A text draft is finished or discarded through its editor.
+pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, page: usize, doc: &Document, view: &mut DocView) -> bool {
+    if view.objects.input_blocked {
+        return true;
+    }
+    if view.content.draft.is_some() || view.line_editor.as_ref().is_some_and(|e| e.has_changes()) {
+        let blocked = view.objects.blocked_page == Some(page);
+        let modifier_press = ui.input(|i| i.pointer.primary_pressed())
+            && modified(ui)
+            && ui.input(|i| i.pointer.interact_pos()).is_some_and(|p| xf.rect.contains(p) && ui.clip_rect().contains(p));
+        if blocked || modifier_press {
+            view.objects.hold_editor = true;
+            view.objects.blocked_page = ui.input(|i| i.pointer.primary_down()).then_some(page);
+            if modifier_press {
+                view.objects.notice = Some(tl!("Finish or discard the text being edited before selecting several objects.").into());
+            }
+            return true;
+        }
+        return false;
+    }
+    let mut selection = std::mem::take(&mut view.objects);
+    let result = input(&mut selection, ui, resp, xf, page, doc, view);
+    view.objects = selection;
+    result
+}
+
+#[allow(clippy::too_many_arguments)]
+fn input(s: &mut ObjectSelection, ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, page: usize, doc: &Document, view: &mut DocView) -> bool {
+    let (pointer, pressed, down) = ui.input(|i| (i.pointer.interact_pos(), i.pointer.primary_pressed(), i.pointer.primary_down()));
+    let info = &doc.info;
+    if s.page == Some(page)
+        && let Some(mut gesture) = s.gesture
+    {
+        if let Some(p) = pointer {
+            gesture.now = p;
+        }
+        if !down {
+            if !gesture.marquee && gesture.start.distance(gesture.now) <= 3.0 && resp.double_clicked() {
+                s.clear();
+                return false;
+            }
+            s.gesture = None;
+            if gesture.marquee {
+                let area = Rect::from_two_pos(gesture.start, gesture.now).intersect(xf.rect);
+                if !gesture.additive {
+                    s.selected.clear();
+                }
+                if area.width() > 3.0
+                    && area.height() > 3.0
+                    && let Ok(objects) = s.inventory(doc, page)
+                {
+                    let candidates: Vec<_> = objects.into_iter().filter(|o| area.intersects(screen(xf, info, page, o))).collect();
+                    let mut selected = s.selected.clone();
+                    for object in candidates {
+                        if !selected.iter().any(|o| o.target == object.target) {
+                            selected.push(object);
+                        }
+                    }
+                    if selected.len() <= MAX_MOVE_OBJECTS {
+                        s.selected = selected;
+                    } else {
+                        s.notice = Some(tl!("Select at most 1000 objects at a time.").into());
+                    }
+                }
+                if s.selected.is_empty() {
+                    s.clear();
+                }
+            } else if gesture.start.distance(gesture.now) > 3.0 && view.pending_edit.is_none() {
+                let (a, b) = (xf.screen_to_view(gesture.start), xf.screen_to_view(gesture.now));
+                match doc.object_move_offset(page, [f64::from(b.0 - a.0), f64::from(b.1 - a.1)]) {
+                    Ok(offset) => {
+                        let mut expected = s.selected.clone();
+                        for object in &mut expected {
+                            object.rect =
+                                [object.rect[0] + offset[0], object.rect[1] + offset[1], object.rect[2] + offset[0], object.rect[3] + offset[1]];
+                        }
+                        s.pending = Some(expected);
+                        view.pending_edit = Some(Edit::MoveObjects { page, objects: s.selected.iter().map(|o| o.target).collect(), offset });
+                    }
+                    Err(_) => s.notice = Some(tl!("These objects could not be moved. Select them again and try a smaller move.").into()),
+                }
+            }
+        } else {
+            s.gesture = Some(gesture);
+        }
+        ui.ctx().set_cursor_icon(if gesture.marquee { egui::CursorIcon::Crosshair } else { egui::CursorIcon::Grabbing });
+        return true;
+    }
+    let Some(p) = pointer.filter(|p| xf.rect.contains(*p) && ui.clip_rect().contains(*p) && resp.rect.contains(*p)) else {
+        return s.page == Some(page) && !s.selected.is_empty();
+    };
+    if !pressed {
+        if s.page == Some(page) && !s.selected.is_empty() {
+            let union = s.selected.iter().fold(Rect::NOTHING, |r, o| r.union(screen(xf, info, page, o)));
+            if union.contains(p) {
+                ui.ctx().set_cursor_icon(egui::CursorIcon::Grab);
+            }
+            return true;
+        }
+        return false;
+    }
+    let objects = match s.inventory(doc, page) {
+        Ok(objects) => objects,
+        Err(_) => {
+            if modified(ui) {
+                s.notice = Some(tl!("This page contains objects that cannot be selected together.").into());
+                return true;
+            }
+            return false;
+        }
+    };
+    let additive = modified(ui);
+    // A page-sized background image must not hide editable labels or added notes.
+    // Within each kind, prefer the last object as the ordinary single-item tools do.
+    let hit = [ObjectKind::Added, ObjectKind::Text, ObjectKind::Image]
+        .into_iter()
+        .find_map(|kind| objects.iter().rev().find(|o| o.target.kind == kind && screen(xf, info, page, o).expand(2.0).contains(p)));
+    if additive {
+        if s.page != Some(page) {
+            s.clear();
+            s.page = Some(page);
+            if let Some(target) = single(view, page)
+                && let Some(object) = objects.iter().find(|o| o.target == target)
+            {
+                s.selected.push(object.clone());
+            }
+        }
+        if let Some(object) = hit {
+            if let Some(index) = s.selected.iter().position(|o| o.target == object.target) {
+                s.selected.remove(index);
+            } else if s.selected.len() < MAX_MOVE_OBJECTS {
+                s.selected.push(object.clone());
+            } else {
+                s.notice = Some(tl!("Select at most 1000 objects at a time.").into());
+            }
+        } else {
+            s.gesture = Some(Gesture { start: p, now: p, marquee: true, additive: true });
+        }
+        leave_single(view);
+        view.current = page;
+        return true;
+    }
+    if s.page == Some(page) && !s.selected.is_empty() {
+        let union = s.selected.iter().fold(Rect::NOTHING, |r, o| r.union(screen(xf, info, page, o)));
+        if union.contains(p) && !resp.double_clicked() {
+            s.gesture = Some(Gesture { start: p, now: p, marquee: false, additive: false });
+            return true;
+        }
+    }
+    s.clear();
+    if hit.is_some() {
+        return false;
+    }
+    leave_single(view);
+    s.page = Some(page);
+    s.gesture = Some(Gesture { start: p, now: p, marquee: true, additive: false });
+    view.current = page;
+    true
+}
+
+pub(crate) fn paint(painter: &egui::Painter, xf: &PageXform, page: usize, info: &DocInfo, selection: &ObjectSelection) {
+    if selection.page != Some(page) {
+        return;
+    }
+    let delta = selection.gesture.filter(|g| !g.marquee).map_or(egui::Vec2::ZERO, |g| g.now - g.start);
+    let mut union = Rect::NOTHING;
+    for object in &selection.selected {
+        let rect = screen(xf, info, page, object).translate(delta);
+        painter.rect_filled(rect, 0.0, BLUE.gamma_multiply(0.05));
+        painter.rect_stroke(rect, 0.0, Stroke::new(1.5, BLUE), egui::StrokeKind::Outside);
+        union = union.union(rect);
+    }
+    if selection.selected.len() > 1 {
+        painter.rect_stroke(union.expand(4.0), 0.0, Stroke::new(1.0, BLUE.gamma_multiply(0.7)), egui::StrokeKind::Outside);
+    }
+    if let Some(g) = selection.gesture.filter(|g| g.marquee) {
+        let area = Rect::from_two_pos(g.start, g.now).intersect(xf.rect);
+        painter.rect_filled(area, 0.0, BLUE.gamma_multiply(0.08));
+        painter.rect_stroke(area, 0.0, Stroke::new(1.0, BLUE), egui::StrokeKind::Outside);
+    }
+}
+
+/// Keep the UI refusal actionable and translated; headless callers retain the detailed error.
+pub(crate) fn move_error(error: &pdfcraft_engine::EditError) -> String {
+    let detail = error.to_string();
+    match detail.as_str() {
+        "vertical text cannot be moved in a group" => tl!("Vertical text cannot be moved with this selection.").into(),
+        "text used as a clipping path cannot be moved in a group" => tl!("Text used as a clipping path cannot be moved with this selection.").into(),
+        _ => tl!("These objects could not be moved. Select them again and try a smaller move.").into(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn selection_labels_and_refusals_are_translated_in_every_catalog() {
+        for language in crate::i18n::LANGUAGES.iter().filter(|l| !l.source.is_empty()) {
+            let lang = crate::i18n::Lang::from_code(language.code).unwrap();
+            for label in [
+                "Drag the selection to move it. Esc clears the selection.",
+                "Shift-click to select several objects. Drag empty space to select an area.",
+                "Select at most 1000 objects at a time.",
+                "Finish or discard the text being edited before selecting several objects.",
+                "Move object",
+                "Move objects",
+                "Vertical text cannot be moved with this selection.",
+                "Text used as a clipping path cannot be moved with this selection.",
+                "These objects could not be moved. Select them again and try a smaller move.",
+                "This page contains objects that cannot be selected together.",
+            ] {
+                assert_ne!(crate::i18n::tr(lang, label), label, "{}: {label}", language.code);
+            }
+            assert_ne!(crate::i18n::trn(lang, 2, "{n} object selected", "{n} objects selected"), "2 objects selected", "{}", language.code);
+        }
+    }
+}
diff --git a/crates/ui-egui/src/optimize_ui.rs b/crates/ui-egui/src/optimize_ui.rs
index ba65f465f..3452eeb52 100644
--- a/crates/ui-egui/src/optimize_ui.rs
+++ b/crates/ui-egui/src/optimize_ui.rs
@@ -60,7 +60,7 @@ pub enum OptimizeKind {
 
 impl OptimizeKind {
     /// The suffix of the saved copy's name ("notes (reduced).pdf").
-    fn suffix(self) -> &'static str {
+    pub(crate) fn suffix(self) -> &'static str {
         match self {
             OptimizeKind::Reduce => "reduced",
             OptimizeKind::Advanced => "optimized",
@@ -282,7 +282,7 @@ impl PdfCraftApp {
         }
         let job = match self.session.optimize_job(id, settings, discard) {
             Ok(job) => job,
-            Err(e) => return self.save_optimized(id, kind.suffix(), Err(e)),
+            Err(e) => return self.save_optimized(id, kind, Err(e)),
         };
         let progress = Arc::new(Mutex::new(OptimizeProgress::default()));
         let p = progress.clone();
@@ -352,7 +352,7 @@ impl PdfCraftApp {
                     let detail = if kind == OptimizeKind::Advanced { summary(&r) } else { String::new() };
                     (b, detail)
                 });
-                self.save_optimized(doc, kind.suffix(), result);
+                self.save_optimized(doc, kind, result);
             }
         }
     }
diff --git a/crates/ui-egui/src/palette.rs b/crates/ui-egui/src/palette.rs
index 4ce90a9e7..f11e1c157 100644
--- a/crates/ui-egui/src/palette.rs
+++ b/crates/ui-egui/src/palette.rs
@@ -50,7 +50,6 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
     }
     let q = app.palette_query.trim().to_lowercase();
     let mut hits: Vec<(usize, Hit)> = Vec::new();
-    let mac = cfg!(target_os = "macos") || cfg!(target_arch = "wasm32");
     let active = app.active_ids().map(|(_, id)| id);
     for spec in pdfcraft_engine::commands::COMMANDS {
         let label = pdfcraft_engine::commands::current_label(spec, &app.session, active);
@@ -61,7 +60,10 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 Hit {
                     group: None,
                     label: translated,
-                    detail: spec.shortcut.map(|k| k.label(mac)).unwrap_or_else(|| tl!(spec.menu.unwrap_or("Command")).to_string()),
+                    detail: spec
+                        .shortcut
+                        .map(|k| crate::commands::shortcut_label(ctx, k))
+                        .unwrap_or_else(|| tl!(spec.menu.unwrap_or("Command")).to_string()),
                     icon: spec.icon,
                     command: Some(spec.id),
                     ready: app.command_enabled(spec),
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index 88b537ab0..abdd38ee0 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -147,6 +147,16 @@ fn tool_detail(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, g: &'static
     }
     // Edit a PDF shows Format text at the top while text is selected or being added.
     if g.id == "edit" {
+        if app.quick_tool == crate::QuickTool::EditText {
+            let count = app.active_ids().map_or(0, |(i, _)| app.views[i].objects.count());
+            if count > 0 {
+                ui.label(crate::i18n::trn(crate::i18n::current(), count as u64, "{n} object selected", "{n} objects selected"));
+                ui.label(tl!("Drag the selection to move it. Esc clears the selection."));
+            } else {
+                ui.label(tl!("Shift-click to select several objects. Drag empty space to select an area."));
+            }
+            ui.add_space(6.0);
+        }
         format_section(app, ui, t);
     }
     let mut run = None;
@@ -541,6 +551,9 @@ pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                         for (i, item) in info.outline.iter().enumerate() {
                             outline_item(ui, &t, info, item, &[i], info.outline.len(), &mut ctx);
                         }
+                        if info.outline_more {
+                            ui.label(tl!("Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth."));
+                        }
                     }
                     RightPanel::Pages => pages(ui, &t, info, view, modal, bm_editable, &mut nav),
                     RightPanel::Fields => field_properties = fields(ui, &t, info, &doc.form, preparing, &mut view.prepare, &mut nav, &mut panel_edit),
diff --git a/crates/ui-egui/src/recovery.rs b/crates/ui-egui/src/recovery.rs
index df6b8bddb..e6ae0193a 100644
--- a/crates/ui-egui/src/recovery.rs
+++ b/crates/ui-egui/src/recovery.rs
@@ -170,13 +170,16 @@ impl PdfCraftApp {
                     continue;
                 }
             };
-            if meta.encrypted {
-                // The password prompt opens it; mark it recovered once it is open.
-                self.pending_recovered = Some(meta.clone());
-            }
             match self.open_bytes(&meta.name, None, bytes) {
                 Ok(()) if self.password_prompt.is_none() => self.finish_recovery(&meta),
-                Ok(()) => {}
+                // Encrypted: the password prompt opens it, and finishes its recovery once it
+                // does. The association travels with the prompt, so cancelling it cannot hand
+                // this snapshot's path to the next document that is unlocked (#813).
+                Ok(()) => {
+                    if let Some(prompt) = self.password_prompt.as_mut() {
+                        prompt.recovered = Some(meta.clone());
+                    }
+                }
                 Err(e) => self.notify_fmt("Couldn't recover {name}: {e}", &[("name", &meta.name), ("e", &e.to_string())]),
             }
         }
@@ -185,10 +188,9 @@ impl PdfCraftApp {
 
     /// The most recently opened tab came from `meta`: keep its recovery entry and path.
     pub(crate) fn finish_recovery(&mut self, meta: &RecoveryMeta) {
-        let Some((_, id)) = self.active_ids() else { return };
+        let Some(id) = self.views.last().map(|v| v.id) else { return };
         self.session.mark_recovered(id, meta.path.clone());
         self.recovery_keys.insert(id, meta.key.clone());
-        self.pending_recovered = None;
     }
 
     /// Delete recovery entries the user chose not to recover.
diff --git a/crates/ui-egui/src/sign_ui.rs b/crates/ui-egui/src/sign_ui.rs
index 77f588f53..6dda63489 100644
--- a/crates/ui-egui/src/sign_ui.rs
+++ b/crates/ui-egui/src/sign_ui.rs
@@ -21,6 +21,10 @@ pub struct DigitalIdEntry {
     pub issuer: String,
     pub email: String,
     pub expires: String,
+    /// Why the ID can't sign (a Windows store certificate whose key PdfCraft can't use): shown
+    /// greyed with the reason, and never selectable.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub unusable: Option<String>,
 }
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -93,14 +97,16 @@ pub struct SignDraft {
 }
 
 impl SignDraft {
-    fn new(page: usize, rect: Option<[f64; 4]>, field: Option<String>, certify: Option<u8>, ids: usize) -> Self {
+    /// Starts at Choose when there are IDs to show (even only unusable ones, so their reasons
+    /// are seen), with the first usable one selected.
+    fn new(page: usize, rect: Option<[f64; 4]>, field: Option<String>, certify: Option<u8>, ids: &[DigitalIdEntry]) -> Self {
         Self {
             page,
             rect,
             field,
             certify,
-            step: if ids == 0 { SignStep::Configure } else { SignStep::Choose },
-            selected: (ids > 0).then_some(0),
+            step: if ids.is_empty() { SignStep::Configure } else { SignStep::Choose },
+            selected: ids.iter().position(|e| e.unusable.is_none()),
             password: String::new(),
             reason: String::new(),
             location: String::new(),
@@ -220,6 +226,20 @@ pub fn entry_for(path: &str, c: &Certificate) -> DigitalIdEntry {
         issuer: c.issuer.common_name().map(str::to_string).unwrap_or_else(|| c.issuer.display()),
         email: c.subject.email().unwrap_or("").to_string(),
         expires: format!("{:04}.{:02}.{:02}", c.not_after.year, c.not_after.month, c.not_after.day),
+        unusable: None,
+    }
+}
+
+/// A greyed entry for a Windows store certificate that can't sign, with the reason.
+#[cfg(target_os = "windows")]
+fn entry_unusable(u: &sign::windows::Unusable) -> DigitalIdEntry {
+    DigitalIdEntry {
+        path: format!("windows:{}", u.fingerprint.split(' ').collect::<String>().to_ascii_lowercase()),
+        name: u.subject.clone(),
+        issuer: String::new(),
+        email: String::new(),
+        expires: String::new(),
+        unusable: Some(u.reason.clone()),
     }
 }
 
@@ -227,7 +247,7 @@ impl PdfCraftApp {
     /// Start signing: the rectangle (or field) is known; show Sign with a Digital ID.
     pub fn start_signing(&mut self, page: usize, rect: Option<[f64; 4]>, field: Option<String>, certify: Option<u8>) {
         self.refresh_os_key_store_ids();
-        self.sign_draft = Some(SignDraft::new(page, rect, field, certify, self.digital_ids.len()));
+        self.sign_draft = Some(SignDraft::new(page, rect, field, certify, &self.digital_ids));
         self.dialog = Some(crate::Dialog::Sign);
     }
 
@@ -247,11 +267,16 @@ impl PdfCraftApp {
         }
         #[cfg(target_os = "windows")]
         if self.os_key_store_ids {
-            match sign::windows::identities() {
-                Ok(ids) => {
-                    for id in ids {
+            match sign::windows::list() {
+                Ok(listing) => {
+                    for id in &listing.ids {
                         self.digital_ids.push(entry_for(&sign::windows::reference(&id.certificate), &id.certificate));
                     }
+                    // Certificates without a private key aren't identities; the rest are shown
+                    // greyed with why they can't sign (issue #179).
+                    for u in listing.unusable.iter().filter(|u| !u.no_private_key) {
+                        self.digital_ids.push(entry_unusable(u));
+                    }
                 }
                 Err(e) => self.notify_fmt("The Windows store's digital IDs couldn't be listed: {e}", &[("e", &e.to_string())]),
             }
@@ -325,7 +350,7 @@ impl PdfCraftApp {
         }
         let Some((_, doc_id)) = self.active_ids() else { return Err("no document".into()) };
         let d = self.sign_draft.clone().ok_or("nothing to sign")?;
-        let entry = d.selected.and_then(|i| self.digital_ids.get(i)).cloned().ok_or("Choose a digital ID.")?;
+        let entry = d.selected.and_then(|i| self.digital_ids.get(i)).filter(|e| e.unusable.is_none()).cloned().ok_or("Choose a digital ID.")?;
         let id = if entry.path.starts_with("keychain:") {
             keychain_id(&entry.path)?
         } else if entry.path.starts_with("windows:") {
@@ -467,17 +492,20 @@ fn choose(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
     egui::ScrollArea::vertical().max_height(220.0).show(ui, |ui| {
         for (i, e) in ids.iter().enumerate() {
             let selected = d.selected == Some(i);
+            let usable = e.unusable.is_none();
             let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 52.0), egui::Sense::click());
-            resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::RadioButton, true, selected, &e.name));
+            resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::RadioButton, usable, selected, &e.name));
             let fill = if selected {
                 t.accent_soft
-            } else if resp.hovered() {
+            } else if resp.hovered() && usable {
                 t.hover
             } else {
                 Color32::TRANSPARENT
             };
             ui.painter().rect_filled(rect, CornerRadius::same(6), fill);
-            icons::paint(ui, Rect::from_min_size(rect.min + vec2(10.0, 15.0), vec2(20.0, 20.0)), "badge-check", 18.0, t.accent);
+            // An unusable ID is greyed, with the reason where the issuer would be.
+            let (icon, name_color) = if usable { (t.accent, t.text) } else { (t.text_muted, t.text_muted) };
+            icons::paint(ui, Rect::from_min_size(rect.min + vec2(10.0, 15.0), vec2(20.0, 20.0)), "badge-check", 18.0, icon);
             // Certificate names can be any length: cut both lines with "…" at the row's edge
             // and show them whole on hover.
             let line = |text: &str, font: egui::FontId, color: Color32| {
@@ -485,27 +513,33 @@ fn choose(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
                 job.wrap = egui::text::TextWrapping::truncate_at_width((rect.width() - 50.0).max(0.0));
                 ui.painter().layout_job(job)
             };
-            let name = line(&e.name, theme::semibold(13.0), t.text);
-            let sub = format!(
-                "{keychain}{email}{issued}{issuer}{expires}{date}",
-                keychain = if e.path.starts_with("keychain:") {
-                    tl!("Keychain  ·  ").to_string()
-                } else if e.path.starts_with("windows:") {
-                    tl!("Windows store  ·  ").to_string()
-                } else {
-                    String::new()
-                },
-                email = if e.email.is_empty() { String::new() } else { format!("{}  ·  ", e.email) },
-                issued = tl!("Issued by: "),
-                issuer = e.issuer,
-                expires = tl!(", Expires: "),
-                date = e.expires,
-            );
+            let name = line(&e.name, theme::semibold(13.0), name_color);
+            let store = if e.path.starts_with("keychain:") {
+                tl!("Keychain  ·  ").to_string()
+            } else if e.path.starts_with("windows:") {
+                tl!("Windows store  ·  ").to_string()
+            } else {
+                String::new()
+            };
+            let sub = match &e.unusable {
+                Some(reason) => format!("{store}{reason}"),
+                None => format!(
+                    "{store}{email}{issued}{issuer}{expires}{date}",
+                    email = if e.email.is_empty() { String::new() } else { format!("{}  ·  ", e.email) },
+                    issued = tl!("Issued by: "),
+                    issuer = e.issuer,
+                    expires = tl!(", Expires: "),
+                    date = e.expires,
+                ),
+            };
             let details = line(&sub, theme::regular(11.5), t.text_muted);
             let elided = name.elided || details.elided;
-            ui.painter().galley(rect.min + vec2(40.0, 9.0), name, t.text);
+            ui.painter().galley(rect.min + vec2(40.0, 9.0), name, name_color);
             ui.painter().galley(rect.min + vec2(40.0, 28.0), details, t.text_muted);
             let resp = if elided { resp.on_hover_text(format!("{}\n{sub}", e.name)) } else { resp };
+            if !usable {
+                continue;
+            }
             if resp.clicked() {
                 d.selected = Some(i);
             }
@@ -1141,7 +1175,7 @@ mod tests {
     fn create_in(dir: &std::path::Path) -> Result<PathBuf, String> {
         let mut app = PdfCraftApp::new();
         app.export_dir_override = Some(dir.to_string_lossy().into_owned());
-        let mut draft = SignDraft::new(0, None, None, None, 0);
+        let mut draft = SignDraft::new(0, None, None, None, &[]);
         // P-256 keeps the test fast.
         let key = KEY_ALGORITHMS.iter().position(|k| k.1 == "p256").unwrap();
         draft.new_id =
diff --git a/crates/ui-egui/src/signature_drag.rs b/crates/ui-egui/src/signature_drag.rs
index b65d6cc60..fb683f1fa 100644
--- a/crates/ui-egui/src/signature_drag.rs
+++ b/crates/ui-egui/src/signature_drag.rs
@@ -124,7 +124,7 @@ impl SignatureDrag {
 
     pub fn paint(&self, painter: &egui::Painter, cx: &PageCx<'_>, cv: &CommentView, pending: Option<&Edit>) {
         let (Some((_, page, index)), Some(layers)) = (self.key, &self.layers) else { return };
-        if page != cx.page || cx.tool != QuickTool::Select || cx.hidden {
+        if page != cx.page || !matches!(cx.tool, QuickTool::Select | QuickTool::Fill(_)) || cx.hidden {
             return;
         }
         let dragging = matches!(cv.gesture, Some(Gesture::Move { page: p, index: i, .. } | Gesture::Resize { page: p, index: i, .. }) if (p, i) == (page, index));
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index 5b74b6422..1691f8328 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -22,13 +22,16 @@ pub enum ThemePreference {
 }
 
 impl ThemePreference {
-    pub fn resolve(self, system: Option<egui::Theme>, fallback: ThemeKind) -> ThemeKind {
+    /// The colours to draw. `system` is what the operating system says, `None` when it says
+    /// nothing; `fallback` is then what the app last drew, so an unanswering desktop leaves the
+    /// user's choice alone.
+    pub fn resolve(self, system: Option<bool>, fallback: ThemeKind) -> ThemeKind {
         match self {
             Self::Light => ThemeKind::Light,
             Self::Dark => ThemeKind::Dark,
             Self::System => match system {
-                Some(egui::Theme::Light) => ThemeKind::Light,
-                Some(egui::Theme::Dark) => ThemeKind::Dark,
+                Some(true) => ThemeKind::Dark,
+                Some(false) => ThemeKind::Light,
                 None => fallback,
             },
         }
@@ -285,6 +288,23 @@ pub fn apply(ctx: &egui::Context, kind: ThemeKind) {
 mod tests {
     use super::*;
 
+    /// "Use system setting" draws what the operating system says, dark or light.
+    #[test]
+    fn following_the_system_draws_what_the_system_says() {
+        assert_eq!(ThemePreference::System.resolve(Some(true), ThemeKind::Light), ThemeKind::Dark);
+        assert_eq!(ThemePreference::System.resolve(Some(false), ThemeKind::Dark), ThemeKind::Light);
+    }
+
+    /// An operating system that says nothing leaves the last choice standing, and an explicit
+    /// Light or Dark is never overridden by what the system says.
+    #[test]
+    fn an_answerless_system_leaves_the_choice_and_an_explicit_one_stands() {
+        assert_eq!(ThemePreference::System.resolve(None, ThemeKind::Light), ThemeKind::Light);
+        assert_eq!(ThemePreference::System.resolve(None, ThemeKind::Dark), ThemeKind::Dark);
+        assert_eq!(ThemePreference::Light.resolve(Some(true), ThemeKind::Dark), ThemeKind::Light);
+        assert_eq!(ThemePreference::Dark.resolve(Some(false), ThemeKind::Light), ThemeKind::Dark);
+    }
+
     /// WCAG 2 contrast ratio between two opaque colours.
     fn contrast(a: Color32, b: Color32) -> f32 {
         let lum = |c: Color32| {
diff --git a/crates/ui-egui/src/ui_scale.rs b/crates/ui-egui/src/ui_scale.rs
new file mode 100644
index 000000000..2637a0e05
--- /dev/null
+++ b/crates/ui-egui/src/ui_scale.rs
@@ -0,0 +1,121 @@
+//! Preferences ▸ Interface size: how large the interface is drawn, on top of the display's own
+//! scale. `Auto` follows the desktop's text scaling (GNOME's "Large Text" or text scaling factor,
+//! which the desktop app reads at launch), so PdfCraft's labels match the other apps' instead of
+//! staying small and showing their pixels on a 1× display.
+//!
+//! The scale is egui's zoom factor: `pixels_per_point` grows with it, so page rasters, which are
+//! rendered at `pixels_per_point` (`canvas::render_scale`), stay one texel per screen pixel.
+
+/// The smallest and largest interface sizes, as factors.
+pub const MIN: f32 = 0.5;
+pub const MAX: f32 = 3.0;
+
+/// The sizes the Preferences menu offers, in percent.
+pub const PRESETS: [u16; 10] = [50, 75, 90, 100, 110, 125, 150, 175, 200, 250];
+
+/// A factor from settings, the control channel or the system: finite and within [`MIN`]..=[`MAX`],
+/// or `None`.
+pub fn valid(factor: f64) -> Option<f32> {
+    let factor = factor as f32;
+    (factor.is_finite() && (MIN..=MAX).contains(&factor)).then_some(factor)
+}
+
+/// The factor to draw at: the preference, or the system's text scale when it is `Auto` (`None`).
+pub fn factor(preference: Option<f32>, system: f32) -> f32 {
+    preference.or_else(|| valid(f64::from(system))).unwrap_or(1.0)
+}
+
+/// Parse a control-channel value: `auto`, or a percentage such as `125` or `125%`.
+pub fn parse(value: &str) -> Result<Option<f32>, String> {
+    let value = value.trim();
+    if value.eq_ignore_ascii_case("auto") {
+        return Ok(None);
+    }
+    let percent: f64 = value.trim_end_matches('%').trim().parse().map_err(|_| format!("ui-scale must be auto or a percentage, not {value}"))?;
+    valid(percent / 100.0).map(Some).ok_or_else(|| format!("ui-scale must be between {}% and {}%", (MIN * 100.0).round(), (MAX * 100.0).round()))
+}
+
+/// The percentage a factor shows as.
+pub fn percent(factor: f32) -> u32 {
+    // In MIN..=MAX (every factor here went through `valid`, or is 1.0), so the cast can't overflow.
+    (factor * 100.0).round().clamp(0.0, 1000.0) as u32
+}
+
+/// Draw at `factor` from the next frame on, when it differs from the factor last applied
+/// (`applied`), so a zoom set elsewhere (a test harness's `pixels_per_point`) isn't undone every
+/// frame. egui's own ⌘+/⌘−/⌘0 interface zoom stays off: those keys zoom the page, and the
+/// preference alone decides the interface size.
+pub fn sync(ctx: &egui::Context, factor: f32, applied: &mut Option<f32>) {
+    if applied.is_none() {
+        ctx.options_mut(|o| o.zoom_with_keyboard = false);
+    }
+    if *applied != Some(factor) {
+        ctx.set_zoom_factor(factor);
+        *applied = Some(factor);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn auto_follows_a_usable_system_scale_only() {
+        assert_eq!(factor(None, 1.25), 1.25);
+        assert_eq!(factor(Some(1.5), 1.25), 1.5);
+        for system in [f32::NAN, f32::INFINITY, -1.0, 0.0, 0.1, 40.0] {
+            assert_eq!(factor(None, system), 1.0, "{system}");
+        }
+    }
+
+    #[test]
+    fn control_values_parse_or_say_what_is_allowed() {
+        assert_eq!(parse("auto"), Ok(None));
+        assert_eq!(parse(" AUTO "), Ok(None));
+        assert_eq!(parse("125"), Ok(Some(1.25)));
+        assert_eq!(parse("150%"), Ok(Some(1.5)));
+        for bad in ["", "big", "10", "1000", "NaN", "inf", "-125"] {
+            assert!(parse(bad).is_err(), "{bad}");
+        }
+        for p in PRESETS {
+            assert_eq!(parse(&p.to_string()).map(|f| f.map(percent)), Ok(Some(u32::from(p))));
+        }
+    }
+
+    #[test]
+    fn sync_sets_the_zoom_and_turns_off_keyboard_zoom() {
+        let ctx = egui::Context::default();
+        let mut applied = None;
+        sync(&ctx, 1.25, &mut applied);
+        assert_eq!(applied, Some(1.25));
+        // A bare context's first frame uploads the font atlas; nothing paints it here.
+        ctx.run_ui(egui::RawInput::default(), |_| {}).textures_delta.clear();
+        assert_eq!(ctx.zoom_factor(), 1.25);
+        assert!(!ctx.options(|o| o.zoom_with_keyboard));
+    }
+
+    #[test]
+    fn the_app_draws_at_the_system_scale_until_a_size_is_chosen() {
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1000.0, 700.0)).with_pixels_per_point(1.0).build_eframe(|_cc| {
+            let mut app = crate::PdfCraftApp::new();
+            app.system_text_scale = 1.25;
+            app
+        });
+        h.run_steps(3);
+        assert_eq!(h.ctx.pixels_per_point(), 1.25, "Auto follows the system's text scale");
+        h.state_mut().set_option("ui-scale", "150%").expect("a valid size");
+        h.run_steps(3);
+        assert_eq!(h.ctx.pixels_per_point(), 1.5);
+        assert!(h.state_mut().set_option("ui-scale", "5000").is_err());
+        // The chosen size survives a restart; a hostile one in the settings follows the system.
+        let saved = h.state().persist();
+        let mut restored = crate::PdfCraftApp::new();
+        restored.restore(&saved);
+        assert_eq!(restored.ui_scale, Some(1.5));
+        restored.restore(&saved.replace("\"ui_scale\":1.5", "\"ui_scale\":1e30"));
+        assert_eq!(restored.ui_scale, None);
+        h.state_mut().set_option("ui-scale", "auto").expect("auto");
+        h.run_steps(3);
+        assert_eq!(h.ctx.pixels_per_point(), 1.25);
+    }
+}
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index 9e45c9275..21448bdc8 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -63,7 +63,7 @@ pub fn search_box(ui: &mut egui::Ui, placeholder: &str, width: f32) -> Response
     let fill = if resp.hovered() { t.hover } else { t.field };
     ui.painter().rect(rect, CornerRadius::same(16), fill, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
     icons::paint(ui, Rect::from_min_size(rect.min + vec2(10.0, 8.0), vec2(16.0, 16.0)), "search", 15.0, t.text_muted);
-    let shortcut = ui.ctx().format_shortcut(&egui::KeyboardShortcut::new(egui::Modifiers::COMMAND, egui::Key::K));
+    let shortcut = crate::commands::command_shortcut_label(ui.ctx(), "view.palette");
     let shortcut = ui.painter().layout_no_wrap(shortcut, theme::regular(11.5), t.text_faint);
     let shortcut_pos = rect.right_center() - vec2(12.0 + shortcut.size().x, shortcut.size().y * 0.5);
     // Reserve the measured shortcut width in every language; long translations are elided
@@ -312,25 +312,32 @@ mod tests {
 
     #[test]
     fn search_placeholder_never_overlaps_the_shortcut() {
-        for width in [260.0, 160.0, 90.0] {
-            let ctx = egui::Context::default();
-            ctx.set_fonts(theme::font_definitions());
-            let placeholder = "Werkzeuge und Befehle suchen";
-            let output = ctx.run_ui(egui::RawInput::default(), |ui| {
-                search_box(ui, placeholder, width);
-            });
-            let text_shapes: Vec<_> = output
-                .shapes
-                .iter()
-                .filter_map(|shape| if let egui::Shape::Text(text) = &shape.shape { Some((shape.clip_rect, text)) } else { None })
-                .collect();
-            let (clip, hint) = text_shapes.iter().find(|(_, text)| text.galley.job.text == placeholder).unwrap();
-            let (_, shortcut) = text_shapes.iter().find(|(_, text)| text.galley.job.text.contains('K')).unwrap();
-            assert!(clip.right() <= shortcut.pos.x - 9.0, "hint must leave a gap before the shortcut at width {width}");
-            assert!(hint.galley.elided, "the long original German hint must be elided at width {width}");
-            assert_eq!(hint.galley.rows.len(), 1);
-            output.drop_without_applying_deltas();
+        let previous = crate::i18n::current();
+        for (code, expected) in [("en", "Ctrl+K"), ("de", "Strg+K")] {
+            crate::i18n::set_current(crate::i18n::Lang::from_code(code).unwrap());
+            for width in [260.0, 160.0, 90.0] {
+                let ctx = egui::Context::default();
+                ctx.set_os(egui::os::OperatingSystem::Nix);
+                ctx.set_fonts(theme::font_definitions());
+                let placeholder = "Werkzeuge und Befehle suchen";
+                let output = ctx.run_ui(egui::RawInput::default(), |ui| {
+                    search_box(ui, placeholder, width);
+                });
+                let text_shapes: Vec<_> = output
+                    .shapes
+                    .iter()
+                    .filter_map(|shape| if let egui::Shape::Text(text) = &shape.shape { Some((shape.clip_rect, text)) } else { None })
+                    .collect();
+                let (clip, hint) = text_shapes.iter().find(|(_, text)| text.galley.job.text == placeholder).unwrap();
+                let (_, shortcut) = text_shapes.iter().find(|(_, text)| text.galley.job.text.contains('K')).unwrap();
+                assert_eq!(shortcut.galley.job.text, expected);
+                assert!(clip.right() <= shortcut.pos.x - 9.0, "hint must leave a gap before the shortcut at width {width}");
+                assert!(hint.galley.elided, "the long original German hint must be elided at width {width}");
+                assert_eq!(hint.galley.rows.len(), 1);
+                output.drop_without_applying_deltas();
+            }
         }
+        crate::i18n::set_current(previous);
     }
 
     fn toast_rect(app: &mut PdfCraftApp, ctx: &egui::Context, width: f32, now: &mut f64) -> Rect {
diff --git a/crates/ui-egui/tests/actions.rs b/crates/ui-egui/tests/actions.rs
index dd4da8d3d..8e5f37cf0 100644
--- a/crates/ui-egui/tests/actions.rs
+++ b/crates/ui-egui/tests/actions.rs
@@ -57,3 +57,48 @@ fn run_and_create_actions() {
     h.run_steps(3);
     assert_eq!(h.state().toast.clone().unwrap().0, "Stamp drafts: 1 file done");
 }
+
+#[test]
+fn desktop_actions_preserve_duplicate_names_and_results_from_earlier_runs() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-actions-collisions-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(dir.join("first")).unwrap();
+    std::fs::create_dir_all(dir.join("second")).unwrap();
+    std::fs::create_dir_all(dir.join("out")).unwrap();
+    let three_pages = Session::new().create_blank(200.0, 300.0, 3).unwrap();
+    let one_page = Session::new().create_blank(200.0, 300.0, 1).unwrap();
+    std::fs::write(dir.join("first/report.PDF"), &*three_pages).unwrap();
+    std::fs::write(dir.join("second/report.PDF"), &*one_page).unwrap();
+    // A previous output must survive too, not just the first file in this batch.
+    std::fs::write(dir.join("out/report.PDF"), &*one_page).unwrap();
+    let d = dir.clone();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.run_inline = true;
+        app.export_dir_override = Some(d.join("out").to_string_lossy().into_owned());
+        app.action_files_override =
+            Some(vec![d.join("first/report.PDF").to_string_lossy().into_owned(), d.join("second/report.PDF").to_string_lossy().into_owned()]);
+        app
+    });
+    h.run_steps(2);
+    for (first, second) in [(2, 3), (4, 5)] {
+        // Start closes the wizard: reopen it just as a user does for the next run.
+        h.state_mut().execute("actions.distribution");
+        h.run_steps(2);
+        h.get_by_label("Start").click();
+        h.run_steps(3);
+        assert_eq!(h.state().toast.clone().unwrap().0, "Prepare for Distribution: 2 files done");
+        for (number, pages) in [(first, 3), (second, 1)] {
+            let path = dir.join(format!("out/report ({number}).PDF"));
+            let mut reopened = Session::new();
+            let id = reopened.open(path.to_string_lossy().into_owned(), None, std::sync::Arc::new(std::fs::read(&path).unwrap()), None).unwrap();
+            assert_eq!(reopened.get(id).unwrap().info.pages.len(), pages);
+        }
+    }
+    assert_eq!(std::fs::read_dir(dir.join("out")).unwrap().count(), 5);
+    assert_eq!(std::fs::read(dir.join("out/report.PDF")).unwrap(), *one_page);
+    assert_eq!(std::fs::read(dir.join("first/report.PDF")).unwrap(), *three_pages);
+    assert_eq!(std::fs::read(dir.join("second/report.PDF")).unwrap(), *one_page);
+    std::fs::remove_dir_all(dir).unwrap();
+}
diff --git a/crates/ui-egui/tests/column_select.rs b/crates/ui-egui/tests/column_select.rs
new file mode 100644
index 000000000..30ef0a13c
--- /dev/null
+++ b/crates/ui-egui/tests/column_select.rs
@@ -0,0 +1,153 @@
+//! Issue #740: column select, as in Acrobat. Alt-drag (Option-drag on macOS) with the Select tool,
+//! or a plain drag with Edit ▸ Column select, selects only the text inside the rectangle drawn.
+
+use egui::{Event, Modifiers, PointerButton, Pos2, vec2};
+use egui_kittest::Harness;
+use pdfcraft_ui_egui::PdfCraftApp;
+
+/// One 300×200 page with a three-row table, "Name Qty / Apple 12 / Pear 7". Its columns sit far
+/// enough apart that reading order takes one column, then the other: glyphs 0–3 "Name", 4–8
+/// "Apple", 9–12 "Pear", 13–15 "Qty", 16–17 "12", 18 "7".
+fn table() -> Vec<u8> {
+    let content =
+        "BT /F1 14 Tf 20 150 Td (Name) Tj 130 0 Td (Qty) Tj -130 -24 Td (Apple) Tj 130 0 Td (12) Tj -130 -24 Td (Pear) Tj 130 0 Td (7) Tj ET";
+    format!(
+        "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+        content.len()
+    )
+    .into_bytes()
+}
+
+fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 60.0).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("table.pdf", None, table()).expect("opens");
+        app.set_option("left", "closed").unwrap();
+        app.set_option("author", "Tester").unwrap();
+        setup(&mut app);
+        app
+    });
+    for _ in 0..200 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(h.state().views[0].glyph_screen_pos(0, 0).is_some(), "text layer loaded");
+    h
+}
+
+fn glyph(h: &Harness<'static, PdfCraftApp>, g: usize) -> Pos2 {
+    h.state().views[0].glyph_screen_pos(0, g).expect("glyph on screen")
+}
+
+fn text(h: &Harness<'static, PdfCraftApp>) -> Option<String> {
+    h.state().views[0].selected_text()
+}
+
+/// Press at `from`, move to `to` and release there, with `modifiers` held throughout.
+fn drag(h: &mut Harness<'static, PdfCraftApp>, from: Pos2, to: Pos2, modifiers: Modifiers) {
+    h.event(Event::ModifiersChanged(modifiers));
+    h.hover_at(from);
+    h.run_steps(1);
+    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers });
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(from + (to - from) * (k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    h.event(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers });
+    h.run_steps(1);
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(1);
+}
+
+/// Below-right of the top two rows: past the "y" of "Qty" (the wider cell), level with "12".
+fn below_right_of_row_two(h: &Harness<'static, PdfCraftApp>) -> Pos2 {
+    egui::pos2(glyph(h, 15).x.max(glyph(h, 17).x) + 12.0, glyph(h, 17).y + 8.0)
+}
+
+/// From above-left of "Name" to below-right of "12": the top two rows of both columns.
+fn top_two_rows(h: &Harness<'static, PdfCraftApp>) -> (Pos2, Pos2) {
+    (glyph(h, 0) - vec2(12.0, 12.0), below_right_of_row_two(h))
+}
+
+#[test]
+fn alt_drag_selects_only_the_text_inside_the_rectangle() {
+    let mut h = harness(|_| {});
+    let (from, to) = top_two_rows(&h);
+    // A plain drag selects in reading order: everything from "Name" to "12".
+    drag(&mut h, from, to, Modifiers::NONE);
+    assert_eq!(text(&h).as_deref(), Some("Name\nApple\nPear\nQty\n12"));
+    h.run_steps(60);
+    // Alt (Option on macOS) at the start of the drag: only the rectangle, row by row.
+    drag(&mut h, from, to, Modifiers::ALT);
+    assert_eq!(text(&h).as_deref(), Some("Name\tQty\nApple\t12"));
+    // One column of numbers, which is what the issue asked for.
+    h.run_steps(60);
+    let (from, to) = (glyph(&h, 13) - vec2(8.0, 12.0), egui::pos2(glyph(&h, 15).x + 12.0, glyph(&h, 18).y + 12.0));
+    drag(&mut h, from, to, Modifiers::ALT);
+    assert_eq!(text(&h).as_deref(), Some("Qty\n12\n7"));
+}
+
+#[test]
+fn the_column_select_tool_needs_no_modifier() {
+    let mut h = harness(|app| assert!(app.execute("edit.column_select")));
+    assert_eq!(h.state().quick_tool, pdfcraft_ui_egui::QuickTool::ColumnSelect);
+    let (from, to) = top_two_rows(&h);
+    drag(&mut h, from, to, Modifiers::NONE);
+    assert_eq!(text(&h).as_deref(), Some("Name\tQty\nApple\t12"));
+    // A rectangle around no text selects nothing.
+    h.run_steps(60);
+    let below = glyph(&h, 12) + vec2(0.0, 60.0);
+    drag(&mut h, below, below + vec2(60.0, 30.0), Modifiers::NONE);
+    assert_eq!(text(&h), None);
+}
+
+/// ⇧-click extends a reading-order selection; a column selection has no anchor glyph, so a
+/// ⇧-click clears it like a plain click.
+#[test]
+fn shift_click_clears_a_column_selection() {
+    let mut h = harness(|_| {});
+    let (from, to) = top_two_rows(&h);
+    drag(&mut h, from, to, Modifiers::ALT);
+    assert!(text(&h).is_some());
+    h.run_steps(60);
+    let at = glyph(&h, 10);
+    h.event(Event::ModifiersChanged(Modifiers::SHIFT));
+    h.hover_at(at);
+    h.run_steps(1);
+    for pressed in [true, false] {
+        h.event(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Modifiers::SHIFT });
+    }
+    h.run_steps(1);
+    h.event(Event::ModifiersChanged(Modifiers::NONE));
+    h.run_steps(1);
+    assert_eq!(text(&h), None);
+}
+
+/// Alt-drag with the highlighter marks only the cells inside the rectangle: one quad per piece
+/// of a line. The drag starts on text, since off text the highlighter draws an area highlight.
+#[test]
+fn alt_drag_with_the_highlighter_marks_only_the_column() {
+    let mut h = harness(|app| assert!(app.execute("comment.highlight")));
+    // Just above-left of the centre of "N", still on the glyph.
+    let (from, to) = (glyph(&h, 0) - vec2(2.0, 2.0), below_right_of_row_two(&h));
+    drag(&mut h, from, to, Modifiers::ALT);
+    h.run_steps(3);
+    let app = h.state();
+    let doc = app.session.get(app.views[0].id).unwrap();
+    let marks: Vec<(&str, usize)> = doc.info.annotations.iter().map(|a| (a.subtype.as_str(), a.quads.len())).collect();
+    assert_eq!(marks, [("Highlight", 4)], "Name, Qty, Apple and 12, each its own quad");
+}
diff --git a/crates/ui-egui/tests/combine_grid.rs b/crates/ui-egui/tests/combine_grid.rs
new file mode 100644
index 000000000..8e7ab6bc4
--- /dev/null
+++ b/crates/ui-egui/tests/combine_grid.rs
@@ -0,0 +1,1765 @@
+//! Headless UI tests for the Combine files grid: a thumbnail card per file, selected, moved and
+//! undone like the list's rows; thumbnails rendered lazily, a few at a time, and never stale.
+
+use std::time::Duration;
+
+use egui::{Key, Modifiers, Pos2, vec2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use pdfcraft_render::{PageRenderer, RenderRequest, RequestKind};
+use pdfcraft_ui_egui::{CombineThumb, CombineView, FilePurpose, PdfCraftApp};
+
+/// An `n`-page document with a proper xref table; page `i` shows "Page i+1".
+fn fixture(n: usize) -> Vec<u8> {
+    fixture_sized(n, 200.0, 300.0)
+}
+
+/// The same, with pages of `w` × `h` points.
+fn fixture_sized(n: usize, w: f32, h: f32) -> Vec<u8> {
+    let mut objs: Vec<String> = vec!["<< /Type /Catalog /Pages 2 0 R >>".into()];
+    let kids: Vec<String> = (0..n).map(|i| format!("{} 0 R", 4 + 2 * i)).collect();
+    objs.push(format!("<< /Type /Pages /Kids [{}] /Count {n} /MediaBox [0 0 {w} {h}] >>", kids.join(" ")));
+    objs.push("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into());
+    for i in 0..n {
+        objs.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources << /Font << /F1 3 0 R >> >> >>", 5 + 2 * i));
+        let body = format!("BT /F1 24 Tf 20 150 Td (Page {}) Tj ET", i + 1);
+        objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// A one-page document whose page takes a while to draw (tens of thousands of shapes), so a
+/// thumbnail render is still under way when a test acts.
+fn heavy() -> Vec<u8> {
+    let mut body = String::from("0.2 0.4 0.8 rg\n");
+    for i in 0..60_000 {
+        body.push_str(&format!("{} {} 1 1 re f\n", i % 200, (i / 200) % 300));
+    }
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /Contents 4 0 R >>".to_string(),
+        format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+/// A two-page fixture that opens with `user` and allows everything with `owner`.
+fn protected(user: &str, owner: &str) -> Vec<u8> {
+    protected_with(pdfcraft_cos::Algorithm::Aes256, user, owner)
+}
+
+fn protected_with(algorithm: pdfcraft_cos::Algorithm, user: &str, owner: &str) -> Vec<u8> {
+    let mut doc = pdfcraft_cos::Document::open(std::sync::Arc::new(fixture(2))).unwrap();
+    doc.set_encryption(&pdfcraft_cos::NewEncryption {
+        algorithm,
+        user_password: user,
+        owner_password: owner,
+        permissions: -1,
+        encrypt_metadata: true,
+        seed: [4; 32],
+    })
+    .unwrap();
+    pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
+}
+
+/// The Combine tab with these files (name, bytes), in its default (grid) view.
+fn grid_of(files: Vec<(&str, Vec<u8>)>, size: egui::Vec2) -> Harness<'static, PdfCraftApp> {
+    grid_after(files, size, 4)
+}
+
+/// The same, after only `steps` frames (1: the first thumbnails have only just been asked for).
+fn grid_after(files: Vec<(&str, Vec<u8>)>, size: egui::Vec2, steps: usize) -> Harness<'static, PdfCraftApp> {
+    let files: Vec<(String, Vec<u8>)> = files.into_iter().map(|(n, b)| (n.to_string(), b)).collect();
+    let mut h = Harness::builder().with_size(size).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.use_files(FilePurpose::Combine, files);
+        app
+    });
+    h.run_steps(steps);
+    h
+}
+
+/// The grid on the frame its first thumbnails start rendering (a render started in one frame
+/// is collected in a later one, so there always is such a frame).
+fn grid_after_one(files: Vec<(&str, Vec<u8>)>, size: egui::Vec2) -> Harness<'static, PdfCraftApp> {
+    let mut h = grid_after(files, size, 0);
+    for _ in 0..20 {
+        h.run_steps(1);
+        if h.state().combine_thumbnails_rendering() > 0 {
+            break;
+        }
+    }
+    h
+}
+
+fn grid_of_pages(names: &[(&str, usize)]) -> Harness<'static, PdfCraftApp> {
+    grid_of(names.iter().map(|(n, p)| (*n, fixture(*p))).collect(), vec2(1400.0, 900.0))
+}
+
+fn names(h: &Harness<'static, PdfCraftApp>) -> Vec<String> {
+    h.state().combine_draft.iter().map(|f| f.name.clone()).collect()
+}
+
+/// Run frames until `done`, giving render threads time; whether it happened.
+fn settle(h: &mut Harness<'static, PdfCraftApp>, done: impl Fn(&PdfCraftApp) -> bool) -> bool {
+    for _ in 0..400 {
+        h.run_steps(1);
+        if done(h.state()) {
+            return true;
+        }
+        std::thread::sleep(Duration::from_millis(10));
+    }
+    false
+}
+
+fn ready(t: &CombineThumb) -> bool {
+    matches!(t, CombineThumb::Ready { .. })
+}
+
+/// Press, move in steps and release, as a user drags.
+fn drag(h: &mut Harness<'static, PdfCraftApp>, from: Pos2, to: Pos2) {
+    h.hover_at(from);
+    h.run_steps(1);
+    h.drag_at(from);
+    h.run_steps(1);
+    for k in 1..=6 {
+        h.hover_at(from + (to - from) * (k as f32 / 6.0));
+        h.run_steps(1);
+    }
+    h.drop_at(to);
+    h.run_steps(4);
+}
+
+/// Where a file's card is.
+fn card(h: &Harness<'static, PdfCraftApp>, name: &str) -> egui::Rect {
+    h.get_by_label(name).rect()
+}
+
+fn texts_of(app: &PdfCraftApp, tab: usize) -> Vec<String> {
+    let doc = app.session.get(app.views[tab].id).unwrap();
+    let mut r = PageRenderer::new(doc.bytes.clone(), Default::default());
+    (0..r.page_count())
+        .map(|p| {
+            let out = r.render(RenderRequest { page: p, kind: RequestKind::Text, scale: 1.0, ..Default::default() });
+            out.text.map(|t| t.plain_text().trim().to_string()).unwrap_or_default()
+        })
+        .collect()
+}
+
+#[test]
+fn combine_shows_a_grid_by_default_and_the_view_is_kept_in_the_settings() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 2)]);
+    assert_eq!(h.state().combine_view, CombineView::Grid);
+    h.get_by_label_contains("Files are combined in the order shown");
+    assert!(h.query_by_label("File name").is_none(), "no table headings in the grid");
+    // The totals stay on screen below the grid.
+    let totals = h.get_by_label_contains("2 files · 3 pages").rect();
+    assert!(totals.bottom() <= 900.0, "the totals line is visible: {totals:?}");
+    h.get_by_label("List view").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_view, CombineView::List);
+    h.get_by_label("File name");
+    // Kept in the settings, and read back.
+    let saved = h.state().persist();
+    let mut fresh = PdfCraftApp::new();
+    assert_eq!(fresh.combine_view, CombineView::Grid);
+    fresh.restore(&saved);
+    assert_eq!(fresh.combine_view, CombineView::List);
+    // A damaged setting keeps the default.
+    let mut damaged = PdfCraftApp::new();
+    damaged.restore(r#"{"combine_view": "tiles"}"#);
+    assert_eq!(damaged.combine_view, CombineView::Grid);
+    // Scriptable, with a clear refusal for anything else.
+    let app = h.state_mut();
+    app.set_option("combine-view", "grid").unwrap();
+    assert_eq!(app.combine_view, CombineView::Grid);
+    assert_eq!(app.set_option("combine-view", "tiles"), Err("combine-view must be grid or list".into()));
+}
+
+#[test]
+fn cards_select_like_the_list_and_the_selection_survives_switching_views() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1), ("d.pdf", 1), ("e.pdf", 1)]);
+    h.get_by_label("b.pdf").click();
+    h.run_steps(1);
+    h.get_by_label("d.pdf").click_modifiers(Modifiers::SHIFT);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [1, 2, 3]);
+    h.get_by_label("c.pdf").click_modifiers(Modifiers::COMMAND);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [1, 3], "Ctrl/⌘ toggles one card");
+    h.get_by_label("2 selected");
+    assert!(h.get_by_label("b.pdf").accesskit_node().is_selected() == Some(true), "cards say they are selected");
+    h.get_by_label("List view").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_selection(), [1, 3]);
+    h.get_by_label("Grid view").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_selection(), [1, 3]);
+    // The toolbar acts on it in the grid too.
+    h.get_by_label("Remove 2 files").click();
+    h.run_steps(2);
+    assert_eq!(names(&h), ["a.pdf", "c.pdf", "e.pdf"]);
+}
+
+#[test]
+fn dragging_a_card_moves_it_and_undo_puts_it_back() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1), ("d.pdf", 1)]);
+    // Sorted first: a move by hand ends the sort, as in the list.
+    h.state_mut().combine_tab.sort = Some((pdfcraft_ui_egui::SortKey::Name, true));
+    let (a, c) = (card(&h, "a.pdf"), card(&h, "c.pdf"));
+    drag(&mut h, a.center(), c.center() + vec2(c.width() * 0.3, 0.0));
+    assert_eq!(names(&h), ["b.pdf", "c.pdf", "a.pdf", "d.pdf"]);
+    assert_eq!(h.state().combine_selection(), [2], "the moved card is selected");
+    assert_eq!(h.state().combine_tab.sort, None);
+    // The list shows the same order.
+    h.get_by_label("List view").click();
+    h.run_steps(2);
+    let rows: Vec<f32> = ["b.pdf", "c.pdf", "a.pdf", "d.pdf"].iter().map(|n| h.get_by_label(n).rect().top()).collect();
+    assert!(rows.windows(2).all(|w| w[0] < w[1]), "the table lists them in the same order: {rows:?}");
+    h.get_by_label("Grid view").click();
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert_eq!(names(&h), ["a.pdf", "b.pdf", "c.pdf", "d.pdf"]);
+    h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
+    h.run_steps(2);
+    assert_eq!(names(&h), ["b.pdf", "c.pdf", "a.pdf", "d.pdf"]);
+}
+
+#[test]
+fn a_dragged_selection_moves_together_to_the_first_and_last_gaps() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1), ("d.pdf", 1), ("e.pdf", 1)]);
+    // A selection with a gap in it.
+    h.state_mut().select_combine_rows(&[1, 3]);
+    h.run_steps(1);
+    let (b, e) = (card(&h, "b.pdf"), card(&h, "e.pdf"));
+    drag(&mut h, b.center(), e.center() + vec2(e.width() * 0.3, 0.0));
+    assert_eq!(names(&h), ["a.pdf", "c.pdf", "e.pdf", "b.pdf", "d.pdf"], "to the end, in their order");
+    assert_eq!(h.state().combine_selection(), [3, 4]);
+    // And back to the very start.
+    let (d, a) = (card(&h, "d.pdf"), card(&h, "a.pdf"));
+    drag(&mut h, d.center(), a.center() - vec2(a.width() * 0.3, 0.0));
+    assert_eq!(names(&h), ["b.pdf", "d.pdf", "a.pdf", "c.pdf", "e.pdf"]);
+    // A file that isn't selected moves alone, and becomes the selection.
+    let (c, b) = (card(&h, "c.pdf"), card(&h, "b.pdf"));
+    drag(&mut h, c.center(), b.center() - vec2(b.width() * 0.3, 0.0));
+    assert_eq!(names(&h), ["c.pdf", "b.pdf", "d.pdf", "a.pdf", "e.pdf"]);
+    assert_eq!(h.state().combine_selection(), [0]);
+}
+
+#[test]
+fn a_drop_that_changes_nothing_or_lands_outside_the_grid_leaves_no_undo_step() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1)]);
+    // The same drag gesture, to a real gap, does move (and is undone).
+    let (b, c) = (card(&h, "b.pdf"), card(&h, "c.pdf"));
+    drag(&mut h, b.center(), c.center() + vec2(c.width() * 0.3, 0.0));
+    assert_eq!(names(&h), ["a.pdf", "c.pdf", "b.pdf"]);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert_eq!(names(&h), ["a.pdf", "b.pdf", "c.pdf"]);
+    h.state_mut().combine_tab.sort = Some((pdfcraft_ui_egui::SortKey::Name, true));
+    let b = card(&h, "b.pdf");
+    // Onto its own place.
+    drag(&mut h, b.center(), b.center() + vec2(b.width() * 0.3, 0.0));
+    assert_eq!(names(&h), ["a.pdf", "b.pdf", "c.pdf"]);
+    // Onto the toolbar, outside the grid.
+    let toolbar = h.get_by_label("Grid view").rect().center();
+    drag(&mut h, b.center(), toolbar);
+    assert_eq!(names(&h), ["a.pdf", "b.pdf", "c.pdf"]);
+    assert!(h.state().combine_tab.sort.is_some(), "a move that didn't happen keeps the sort");
+    // The only step is still the adding of the files: one undo empties the list.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert!(names(&h).is_empty());
+    assert!(h.get_by_label("Undo").accesskit_node().is_disabled());
+}
+
+#[test]
+fn arrow_keys_move_by_card_and_by_row_and_shift_extends() {
+    let files: Vec<(String, usize)> = (0..9).map(|i| (format!("f{i}.pdf"), 1)).collect();
+    let named: Vec<(&str, usize)> = files.iter().map(|(n, p)| (n.as_str(), *p)).collect();
+    // Narrow enough for several rows.
+    let mut h = grid_of(named.iter().map(|(n, p)| (*n, fixture(*p))).collect(), vec2(760.0, 1200.0));
+    let top = card(&h, "f0.pdf").top();
+    let cols = (0..9).filter(|i| (card(&h, &format!("f{i}.pdf")).top() - top).abs() < 1.0).count();
+    assert!((2..9).contains(&cols), "several cards per row and several rows ({cols} per row)");
+    h.get_by_label("f0.pdf").click();
+    h.run_steps(1);
+    h.key_press(Key::ArrowRight);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [1]);
+    h.key_press(Key::ArrowDown);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [1 + cols], "down one row, same column");
+    h.key_press(Key::ArrowUp);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [1]);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::ArrowDown);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), (1..=1 + cols).collect::<Vec<_>>(), "Shift extends from the anchor");
+    // On the first row, Up stays.
+    h.get_by_label("f0.pdf").click();
+    h.run_steps(1);
+    h.key_press(Key::ArrowUp);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [0]);
+    // Alt+arrows still move the selection.
+    h.key_press_modifiers(Modifiers::ALT, Key::ArrowDown);
+    h.run_steps(1);
+    assert_eq!(names(&h).first().map(String::as_str), Some("f1.pdf"));
+}
+
+#[test]
+fn shift_arrows_extend_the_selection_in_the_list_too() {
+    // Regression: a plain arrow matched with Shift held, so Shift+Up/Down only stepped.
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1), ("d.pdf", 1)]);
+    h.state_mut().set_option("combine-view", "list").unwrap();
+    h.run_steps(2);
+    h.get_by_label("b.pdf").click();
+    h.run_steps(1);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::ArrowDown);
+    h.run_steps(1);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::ArrowDown);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [1, 2, 3]);
+    h.key_press_modifiers(Modifiers::SHIFT, Key::ArrowUp);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [1, 2]);
+    h.key_press(Key::ArrowUp);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [1], "a plain arrow still steps");
+}
+
+#[test]
+fn thumbnails_show_the_first_page_each_file_takes() {
+    let mut h = grid_of_pages(&[("three.pdf", 3), ("one.pdf", 1)]);
+    h.state_mut().combine_draft[0].range = "3, 1".into();
+    assert!(settle(&mut h, |app| app.combine_thumbnails().iter().all(ready)), "{:?}", h.state().combine_thumbnails());
+    let thumbs = h.state().combine_thumbnails();
+    assert!(matches!(thumbs[0], CombineThumb::Ready { page: 2, .. }), "\"3, 1\" starts with page 3: {:?}", thumbs[0]);
+    assert!(matches!(thumbs[1], CombineThumb::Ready { page: 0, .. }));
+    let CombineThumb::Ready { width, height, .. } = thumbs[1] else { unreachable!() };
+    assert!(width > 0 && height > 0 && width <= 768 && height <= 768, "{width}×{height}");
+    // A new range is a new thumbnail, never the old page.
+    h.state_mut().combine_draft[0].range = "2".into();
+    assert!(settle(&mut h, |app| matches!(app.combine_thumbnails()[0], CombineThumb::Ready { page: 1, .. })));
+    // A range that can't be used shows no page at all.
+    h.state_mut().combine_draft[0].range = "9".into();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_thumbnails()[0], CombineThumb::None);
+}
+
+#[test]
+fn a_locked_file_shows_no_page_until_unlocked_and_undo_locks_it_again() {
+    let mut h = grid_of(vec![("one.pdf", fixture(1)), ("secret.pdf", protected("pw", "owner"))], vec2(1400.0, 900.0));
+    assert!(settle(&mut h, |app| ready(&app.combine_thumbnails()[0])));
+    assert_eq!(h.state().combine_thumbnails()[1], CombineThumb::None, "nothing is drawn of a locked file");
+    assert!(h.state_mut().combine_unlock_rows(&[1], "pw"));
+    assert!(settle(&mut h, |app| ready(&app.combine_thumbnails()[1])), "{:?}", h.state().combine_thumbnails());
+    // Undo brings back the locked file: its unlocked thumbnail goes with the password.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert!(h.state().combine_draft[1].lock.is_some());
+    assert_eq!(h.state().combine_thumbnails()[1], CombineThumb::None);
+    // Unlocked again (a new branch of the history): drawn again, from this unlock.
+    assert!(h.state_mut().combine_unlock_rows(&[1], "pw"));
+    assert!(settle(&mut h, |app| ready(&app.combine_thumbnails()[1])), "{:?}", h.state().combine_thumbnails());
+}
+
+#[test]
+fn many_files_render_only_what_is_in_view_a_few_at_a_time() {
+    // The first few are slow to draw, so renders are still under way while the frames are watched
+    // (small pages can all be drawn before the first look).
+    let files: Vec<(String, Vec<u8>)> = (0..200).map(|i| (format!("scan{i:03}.pdf"), if i < 6 { heavy() } else { fixture(1) })).collect();
+    let mut h = grid_after(files.iter().map(|(n, b)| (n.as_str(), b.clone())).collect(), vec2(1200.0, 800.0), 0);
+    let mut most = 0;
+    let mut done = false;
+    for _ in 0..800 {
+        h.run_steps(1);
+        // Every render thread counts, including those of finished renders not yet exited.
+        most = most.max(h.state_mut().combine_thumbnail_threads());
+        let app = h.state();
+        if app.combine_thumbnails().first().is_some_and(ready) && app.combine_thumbnails_rendering() == 0 {
+            done = true;
+            break;
+        }
+        std::thread::sleep(Duration::from_millis(5));
+    }
+    assert!(done, "the first cards render");
+    assert!(most > 0, "renders were seen under way");
+    assert!(most <= 3, "never more than three render threads at once ({most})");
+    let thumbs = h.state().combine_thumbnails();
+    let drawn = thumbs.iter().filter(|t| ready(t)).count();
+    assert!(drawn > 0 && drawn < 60, "only the cards in view (and a row either side) are rendered: {drawn} of 200");
+    assert_eq!(thumbs.last(), Some(&CombineThumb::None), "the last card, far out of view, isn't rendered");
+}
+
+#[test]
+fn removing_a_file_while_it_renders_and_closing_the_tab_leave_nothing_behind() {
+    let files: Vec<(String, Vec<u8>)> = (0..12).map(|i| (format!("f{i}.pdf"), fixture(2))).collect();
+    let mut h = grid_of(files.iter().map(|(n, b)| (n.as_str(), b.clone())).collect(), vec2(1400.0, 900.0));
+    // Remove files straight away, while their thumbnails may still be rendering.
+    h.state_mut().select_combine_rows(&[0, 1, 2]);
+    h.key_press(Key::Delete);
+    assert!(settle(&mut h, |app| app.combine_thumbnails_rendering() == 0 && app.combine_thumbnails().iter().take(4).all(ready)));
+    assert_eq!(h.state().combine_thumbnails().len(), 9);
+    // Undo brings them back, and their thumbnails follow.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    assert!(settle(&mut h, |app| app.combine_draft.len() == 12 && app.combine_thumbnails().iter().take(3).all(ready)));
+    // Closing the tab forgets everything.
+    h.state_mut().select_combine_rows(&[0]);
+    h.key_press(Key::Delete);
+    h.run_steps(1);
+    h.state_mut().close_combine_tab();
+    h.run_steps(2);
+    assert!(h.state().combine_thumbnails().is_empty());
+    assert_eq!(h.state().combine_thumbnails_rendering(), 0);
+    assert_eq!(h.state().combine_thumbnail_textures(), 0, "no thumbnail texture is kept");
+    assert!(settle(&mut h, |app| app.combine_thumbnail_threads_exited()), "every render thread exits");
+}
+
+#[test]
+fn switching_to_the_list_lets_renders_under_way_finish() {
+    let files: Vec<(String, Vec<u8>)> = (0..6).map(|i| (format!("f{i}.pdf"), heavy())).collect();
+    let mut h = grid_after_one(files.iter().map(|(n, b)| (n.as_str(), b.clone())).collect(), vec2(1400.0, 900.0));
+    assert!(h.state().combine_thumbnails_rendering() > 0, "renders are under way");
+    // Straight to the list, while the grid's first thumbnails are still rendering.
+    h.state_mut().set_option("combine-view", "list").unwrap();
+    assert!(settle(&mut h, |app| app.combine_thumbnails_rendering() == 0), "renders finish and let go of their threads");
+    for _ in 0..20 {
+        h.run_steps(1);
+        assert_eq!(h.state().combine_thumbnails_rendering(), 0, "nothing new starts in the list");
+    }
+    assert!(h.state().combine_thumbnails().contains(&CombineThumb::None), "the rest wait for the grid");
+    assert!(settle(&mut h, |app| app.combine_thumbnail_threads_exited()), "and their threads exit");
+    // Back in the grid, the rest follow.
+    h.get_by_label("Grid view").click();
+    assert!(settle(&mut h, |app| app.combine_thumbnails().iter().all(ready)));
+}
+
+#[test]
+fn combine_follows_the_order_shown_in_the_grid() {
+    let mut h = grid_of_pages(&[("one.pdf", 2), ("two.pdf", 1), ("three.pdf", 1)]);
+    let (three, one) = (card(&h, "three.pdf"), card(&h, "one.pdf"));
+    drag(&mut h, three.center(), one.center() - vec2(one.width() * 0.3, 0.0));
+    assert_eq!(names(&h), ["three.pdf", "one.pdf", "two.pdf"]);
+    h.get_by_label("Combine").click();
+    h.run_steps(3);
+    let app = h.state();
+    assert_eq!(app.views.len(), 1, "the result opens");
+    assert_eq!(texts_of(app, 0), ["Page 1", "Page 1", "Page 2", "Page 1"]);
+    let doc = app.session.get(app.views[0].id).unwrap();
+    assert_eq!(doc.info.outline.iter().map(|o| o.title.as_str()).collect::<Vec<_>>(), ["three", "one", "two"]);
+}
+
+#[test]
+fn long_and_unusual_names_are_shortened_on_the_card_but_kept_whole() {
+    let long = "Überweisungsbestätigung für das dritte Quartal 2026 – Endfassung (unterschrieben).pdf";
+    let mut h = grid_of(vec![(long, fixture(1)), ("日本語のファイル名.pdf", fixture(1)), ("a&b <c> 'd'.pdf", fixture(1))], vec2(1400.0, 900.0));
+    // The card's label is the whole name; only the drawing is shortened.
+    h.get_by_label(long);
+    h.get_by_label("日本語のファイル名.pdf");
+    h.get_by_label("a&b <c> 'd'.pdf");
+    assert!(settle(&mut h, |app| app.combine_thumbnails().iter().all(ready)));
+}
+
+#[test]
+fn long_thin_pages_get_thumbnails_within_the_size_limits() {
+    // Regression: the scale came from the rounded width alone, so a strip 1 pt wide and 999 pt
+    // long asked for a 9×8192 raster, over the GPU texture limit (a panic in load_texture).
+    let files = vec![
+        ("strip.pdf", fixture_sized(1, 1.0, 999.0)),
+        ("tall.pdf", fixture_sized(1, 10.0, 3000.0)),
+        ("wide.pdf", fixture_sized(1, 3000.0, 10.0)),
+        ("big.pdf", fixture_sized(1, 14400.0, 14400.0)),
+    ];
+    let mut h = grid_of(files, vec2(1400.0, 900.0));
+    assert!(settle(&mut h, |app| app.combine_thumbnails().iter().all(|t| *t != CombineThumb::None && *t != CombineThumb::Pending)));
+    for t in h.state().combine_thumbnails() {
+        match t {
+            CombineThumb::Ready { width, height, .. } => assert!(width <= 768 && height <= 768, "{width}×{height}"),
+            other => panic!("each strip gets a thumbnail: {other:?}"),
+        }
+    }
+}
+
+#[test]
+fn a_bad_page_range_on_a_card_says_where_to_fix_it() {
+    let mut h = grid_of_pages(&[("a.pdf", 3), ("b.pdf", 1)]);
+    h.state_mut().combine_draft[0].range = "9".into();
+    h.run_steps(2);
+    let a = card(&h, "a.pdf");
+    h.hover_at(a.center());
+    for _ in 0..60 {
+        h.run_steps(1);
+        if h.query_by_label_contains("Switch to List view to change the pages it takes").is_some() {
+            break;
+        }
+    }
+    h.get_by_label_contains("Switch to List view to change the pages it takes");
+}
+
+#[test]
+fn a_file_whose_pages_cant_be_measured_says_there_is_no_preview() {
+    // An RC4 owner password opens the file for combining but not for reading it here, so the
+    // page's size is unknown and nothing is drawn. Regression: the card was a blank white page.
+    // The fixture must keep the size unknown: if the inspector learns RC4 owner passwords, this
+    // needs another file it can't measure (the check below says so rather than pass vacuously).
+    let mut h =
+        grid_of(vec![("one.pdf", fixture(1)), ("old.pdf", protected_with(pdfcraft_cos::Algorithm::Rc4_128, "pw", "owner"))], vec2(1400.0, 900.0));
+    assert!(h.state_mut().combine_unlock_rows(&[1], "owner"));
+    assert!(settle(&mut h, |app| ready(&app.combine_thumbnails()[0])));
+    assert!(h.state().combine_draft[1].lock.is_none(), "unlocked for combining");
+    assert_eq!(h.state().combine_thumbnails()[1], CombineThumb::None, "nothing rendered (is the page size still unknown?)");
+    assert_eq!(h.state().combine_thumbnails_rendering(), 0);
+    // Screen readers hear it too, not only in the tooltip.
+    let description = |h: &Harness<'static, PdfCraftApp>, name: &str| h.get_by_label(name).accesskit_node().description().unwrap_or_default();
+    assert!(description(&h, "old.pdf").contains("No preview"), "{}", description(&h, "old.pdf"));
+    assert_eq!(description(&h, "one.pdf"), "1 page");
+    let tip_of = |h: &mut Harness<'static, PdfCraftApp>, name: &str, text: &str| {
+        let at = card(h, name).center();
+        h.hover_at(at);
+        (0..60).any(|_| {
+            h.run_steps(1);
+            h.query_by_label_contains(text).is_some()
+        })
+    };
+    assert!(tip_of(&mut h, "old.pdf", "No preview"), "the card says why it shows no page");
+    h.hover_at(egui::pos2(5.0, 890.0));
+    h.run_steps(3);
+    assert!(!tip_of(&mut h, "one.pdf", "No preview"), "a card with its page doesn't");
+}
+
+#[test]
+fn thumbnails_under_way_finish_on_home_and_in_a_document_tab() {
+    // Regression: they were only collected while the Combine page was drawn.
+    let files: Vec<(String, Vec<u8>)> = (0..6).map(|i| (format!("f{i}.pdf"), heavy())).collect();
+    let mut h = grid_after_one(files.iter().map(|(n, b)| (n.as_str(), b.clone())).collect(), vec2(1400.0, 900.0));
+    assert!(h.state().combine_thumbnails_rendering() > 0, "renders are under way");
+    // Home.
+    h.state_mut().combine_tab.focused = false;
+    h.run_steps(1);
+    assert!(!h.state().combine_showing());
+    assert!(settle(&mut h, |app| app.combine_thumbnails_rendering() == 0 && app.combine_thumbnail_threads_exited()));
+    // A document tab: the same.
+    h.state_mut().open_combine_tab();
+    h.run_steps(1);
+    h.state_mut().open_bytes("doc.pdf", None, fixture(1)).unwrap();
+    h.run_steps(1);
+    assert!(h.state().active.is_some());
+    assert!(settle(&mut h, |app| app.combine_thumbnails_rendering() == 0 && app.combine_thumbnail_threads_exited()));
+}
+
+#[test]
+fn a_focused_card_still_takes_the_arrow_keys() {
+    // Regression: the keys were ignored whenever any widget, a card included, had focus.
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1)]);
+    h.get_by_label("a.pdf").click();
+    h.run_steps(1);
+    h.get_by_label("a.pdf").focus();
+    h.run_steps(1);
+    h.key_press(Key::ArrowRight);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [1]);
+}
+
+#[test]
+fn a_drag_is_dropped_when_the_list_changes_under_it() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1), ("d.pdf", 1)]);
+    h.state_mut().select_combine_rows(&[3]);
+    h.key_press(Key::Delete);
+    h.run_steps(2);
+    assert_eq!(names(&h), ["a.pdf", "b.pdf", "c.pdf"]);
+    // A drag begins; undo brings d.pdf back while it is under way; then the card is dropped.
+    let (a, c) = (card(&h, "a.pdf"), card(&h, "c.pdf"));
+    let to = c.center() + vec2(c.width() * 0.3, 0.0);
+    h.hover_at(a.center());
+    h.run_steps(1);
+    h.drag_at(a.center());
+    h.run_steps(1);
+    for k in 1..=3 {
+        h.hover_at(a.center() + (to - a.center()) * (k as f32 / 6.0));
+        h.run_steps(1);
+    }
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(1);
+    assert_eq!(names(&h), ["a.pdf", "b.pdf", "c.pdf", "d.pdf"]);
+    h.hover_at(to);
+    h.run_steps(1);
+    h.drop_at(to);
+    h.run_steps(3);
+    assert_eq!(names(&h), ["a.pdf", "b.pdf", "c.pdf", "d.pdf"], "the gap it was aimed at no longer means the same: nothing moves");
+}
+
+#[test]
+fn a_card_dragged_to_the_bottom_edge_scrolls_the_grid_and_still_drops() {
+    let files: Vec<(String, Vec<u8>)> = (0..30).map(|i| (format!("f{i:02}.pdf"), fixture(1))).collect();
+    let mut h = grid_of(files.iter().map(|(n, b)| (n.as_str(), b.clone())).collect(), vec2(820.0, 860.0));
+    let from = card(&h, "f00.pdf").center();
+    let totals = h.get_by_label_contains("30 files").rect();
+    let edge = egui::pos2(from.x, totals.top() - 30.0);
+    h.hover_at(from);
+    h.run_steps(1);
+    h.drag_at(from);
+    h.run_steps(1);
+    h.hover_at(edge);
+    // Held at the edge, the grid scrolls; the card dragged leaves the rows drawn.
+    for _ in 0..80 {
+        h.run_steps(1);
+    }
+    assert!(h.query_by_label("f00.pdf").is_none(), "scrolled away from the first row");
+    // A card wholly in view (rows just outside it are drawn too, to scroll smoothly).
+    let top = h.get_by_label("Grid view").rect().bottom() + 40.0;
+    let (target_name, target) = (1..30)
+        .map(|i| format!("f{i:02}.pdf"))
+        .find_map(|n| h.query_by_label(&n).map(|c| c.rect()).filter(|r| r.top() > top && r.bottom() < totals.top() - 20.0).map(|r| (n, r)))
+        .expect("a card in view");
+    let to = target.center() - vec2(target.width() * 0.3, 0.0);
+    h.hover_at(to);
+    h.run_steps(1);
+    h.drop_at(to);
+    h.run_steps(3);
+    let order = names(&h);
+    let at = order.iter().position(|n| n == "f00.pdf").unwrap();
+    assert!(at > 0, "moved from the start: {order:?}");
+    assert_eq!(order.get(at + 1), Some(&target_name), "dropped before {target_name}: {order:?}");
+}
+
+#[test]
+fn a_locked_card_offers_unlock_on_a_right_click() {
+    let mut h = grid_of(vec![("one.pdf", fixture(1)), ("secret.pdf", protected("pw", "owner"))], vec2(1400.0, 900.0));
+    h.get_by_label("secret.pdf").click_secondary();
+    h.run_steps(2);
+    // The menu's item comes after the toolbar's button of the same name.
+    h.get_all_by_label("Unlock…").last().unwrap().click();
+    h.run_steps(2);
+    h.get_by_label("Unlock secret.pdf");
+    assert_eq!(h.state().combine_selection(), [1], "the card right-clicked is the one unlocked");
+}
+
+fn disabled(h: &Harness<'static, PdfCraftApp>, label: &str) -> bool {
+    h.get_by_label(label).accesskit_node().is_disabled()
+}
+
+/// Ctrl/⌘ with the wheel at `at` (a positive `dy` zooms in).
+fn ctrl_wheel(h: &mut Harness<'static, PdfCraftApp>, at: Pos2, dy: f32) {
+    h.hover_at(at);
+    h.run_steps(1);
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(0.0, dy),
+        phase: egui::TouchPhase::Move,
+        modifiers: Modifiers::COMMAND,
+    });
+    h.run_steps(3);
+}
+
+#[test]
+fn the_toolbar_sizes_the_cards_within_limits_and_the_size_is_kept_in_the_settings() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 2)]);
+    assert_eq!(h.state().combine_zoom, 1.0);
+    let before = card(&h, "a.pdf");
+    h.get_by_label("Larger pages").click();
+    h.run_steps(3);
+    assert_eq!(h.state().combine_zoom, 1.25);
+    let after = card(&h, "a.pdf");
+    assert!(after.width() > before.width() && after.height() > before.height(), "{before:?} → {after:?}");
+    // Larger until it can't go further: 200%, and the button says so.
+    for _ in 0..10 {
+        if disabled(&h, "Larger pages") {
+            break;
+        }
+        h.get_by_label("Larger pages").click();
+        h.run_steps(2);
+    }
+    assert_eq!(h.state().combine_zoom, 2.0);
+    assert!(disabled(&h, "Larger pages"));
+    // The percentage resets it.
+    h.get_by_label("Reset page size").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_zoom, 1.0);
+    for _ in 0..10 {
+        if disabled(&h, "Smaller pages") {
+            break;
+        }
+        h.get_by_label("Smaller pages").click();
+        h.run_steps(2);
+    }
+    assert_eq!(h.state().combine_zoom, 0.6);
+    let smallest = card(&h, "a.pdf");
+    assert!(smallest.width() < before.width() && smallest.height() < before.height(), "{smallest:?}");
+    // Kept in the settings, and read back; a damaged setting is clamped or ignored.
+    let saved = h.state().persist();
+    let mut fresh = PdfCraftApp::new();
+    fresh.restore(&saved);
+    assert_eq!(fresh.combine_zoom, 0.6);
+    fresh.restore(r#"{"combine_zoom": 99}"#);
+    assert_eq!(fresh.combine_zoom, 2.0);
+    fresh.restore(r#"{"combine_zoom": "big"}"#);
+    assert_eq!(fresh.combine_zoom, 2.0);
+    // Scriptable in percent, with a clear refusal outside the range.
+    let app = h.state_mut();
+    app.set_option("combine-zoom", "150%").unwrap();
+    assert_eq!(app.combine_zoom, 1.5);
+    for bad in ["59", "201", "big", "NaN", "inf", ""] {
+        assert!(app.set_option("combine-zoom", bad).is_err(), "{bad:?}");
+    }
+    assert_eq!(app.combine_zoom, 1.5);
+    // The list has no card size.
+    h.get_by_label("List view").click();
+    h.run_steps(2);
+    assert!(h.query_by_label("Larger pages").is_none() && h.query_by_label("Page size").is_none());
+}
+
+#[test]
+fn the_slider_sizes_the_cards_from_smallest_to_largest() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 1)]);
+    let slider = h.get_by_label("Page size").rect();
+    drag(&mut h, slider.center(), slider.right_center() + vec2(40.0, 0.0));
+    assert_eq!(h.state().combine_zoom, 2.0);
+    let slider = h.get_by_label("Page size").rect();
+    drag(&mut h, slider.center(), slider.left_center() - vec2(40.0, 0.0));
+    assert_eq!(h.state().combine_zoom, 0.6);
+    // The cards are still there and in order.
+    assert_eq!(names(&h), ["a.pdf", "b.pdf"]);
+    assert!(card(&h, "a.pdf").left() < card(&h, "b.pdf").left());
+}
+
+#[test]
+fn ctrl_keys_and_ctrl_wheel_size_the_cards_and_leave_the_window_alone() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1)]);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Equals);
+    h.run_steps(3);
+    assert_eq!(h.state().combine_zoom, 1.25);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Plus);
+    h.run_steps(3);
+    assert_eq!(h.state().combine_zoom, 1.5);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Minus);
+    h.run_steps(3);
+    assert_eq!(h.state().combine_zoom, 1.25);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Num0);
+    h.run_steps(3);
+    assert_eq!(h.state().combine_zoom, 1.0);
+    assert_eq!(h.ctx.zoom_factor(), 1.0, "the window's text keeps its size");
+    // Ctrl/⌘ with the wheel over the grid: in, then out.
+    let at = card(&h, "b.pdf").center();
+    ctrl_wheel(&mut h, at, 120.0);
+    let zoomed = h.state().combine_zoom;
+    assert!(zoomed > 1.0, "{zoomed}");
+    let at = card(&h, "b.pdf").center();
+    ctrl_wheel(&mut h, at, -240.0);
+    assert!(h.state().combine_zoom < zoomed, "{}", h.state().combine_zoom);
+    // Not over the grid (the toolbar): nothing.
+    let now = h.state().combine_zoom;
+    let toolbar = h.get_by_label("Grid view").rect().center();
+    ctrl_wheel(&mut h, toolbar, 120.0);
+    assert_eq!(h.state().combine_zoom, now);
+    // Nor in the list.
+    h.get_by_label("List view").click();
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Equals);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_zoom, now);
+}
+
+#[test]
+fn zooming_keeps_the_card_under_the_pointer_in_place_and_thumbnails_never_go_blank() {
+    let files: Vec<(String, Vec<u8>)> = (0..40).map(|i| (format!("f{i:02}.pdf"), fixture(1))).collect();
+    let mut h = grid_of(files.iter().map(|(n, b)| (n.as_str(), b.clone())).collect(), vec2(1400.0, 900.0));
+    // Scroll down a little, so the grid isn't simply at its top.
+    let first = card(&h, "f00.pdf");
+    h.hover_at(first.center());
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(0.0, -300.0),
+        phase: egui::TouchPhase::Move,
+        modifiers: Modifiers::NONE,
+    });
+    h.run_steps(6);
+    // A card fully in view, below the toolbar, with its thumbnail drawn.
+    let toolbar = h.get_by_label("Grid view").rect().bottom();
+    let pick = files
+        .iter()
+        .map(|(n, _)| n.as_str())
+        .find(|n| h.query_by_label(n).is_some_and(|c| c.rect().top() > toolbar + 80.0 && c.rect().bottom() < 820.0))
+        .expect("a card in view")
+        .to_string();
+    let i = names(&h).iter().position(|n| *n == pick).unwrap();
+    assert!(settle(&mut h, |app| ready(&app.combine_thumbnails()[i])));
+    let CombineThumb::Ready { height: small, .. } = h.state().combine_thumbnails()[i] else { unreachable!() };
+    let before = card(&h, &pick);
+    h.hover_at(before.center());
+    h.run_steps(1);
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(0.0, 120.0),
+        phase: egui::TouchPhase::Move,
+        modifiers: Modifiers::COMMAND,
+    });
+    // The wheel zooms smoothly over several frames; in every one the card stays put.
+    let mut zooms = Vec::new();
+    for frame in 0..12 {
+        h.run_steps(1);
+        zooms.push(h.state().combine_zoom);
+        let now = card(&h, &pick);
+        assert!((now.top() - before.top()).abs() < 2.0, "frame {frame}: the card under the pointer moved: {before:?} → {now:?}");
+    }
+    assert!(h.state().combine_zoom > 1.0, "{zooms:?}");
+    // Its thumbnail never went blank: the smaller one stands in until the sharper one arrives.
+    for _ in 0..400 {
+        h.run_steps(1);
+        match h.state().combine_thumbnails()[i] {
+            CombineThumb::Ready { height, .. } if height > small => break,
+            CombineThumb::Ready { .. } => {}
+            ref other => panic!("went blank: {other:?}"),
+        }
+        std::thread::sleep(Duration::from_millis(10));
+    }
+    assert!(matches!(h.state().combine_thumbnails()[i], CombineThumb::Ready { height, .. } if height > small), "re-rendered larger");
+}
+
+#[test]
+fn dragging_and_arrow_keys_work_at_the_smallest_and_largest_sizes() {
+    let mut columns = Vec::new();
+    for zoom in ["60", "200"] {
+        let files: Vec<(String, Vec<u8>)> = (0..24).map(|i| (format!("f{i:02}.pdf"), fixture(1))).collect();
+        let mut h = grid_of(files.iter().map(|(n, b)| (n.as_str(), b.clone())).collect(), vec2(1400.0, 900.0));
+        h.state_mut().set_option("combine-zoom", zoom).unwrap();
+        h.run_steps(3);
+        let (a, c) = (card(&h, "f00.pdf"), card(&h, "f02.pdf"));
+        drag(&mut h, a.center(), c.center() + vec2(c.width() * 0.3, 0.0));
+        assert_eq!(&names(&h)[..4], ["f01.pdf", "f02.pdf", "f00.pdf", "f03.pdf"], "at {zoom}%");
+        // Down moves one row: as many files as fit across.
+        h.get_by_label("f01.pdf").click();
+        h.run_steps(1);
+        h.key_press(Key::ArrowDown);
+        h.run_steps(2);
+        let row = h.state().combine_selection();
+        assert_eq!(row.len(), 1);
+        assert!(row[0] > 1, "at {zoom}%: {row:?}");
+        columns.push(row[0]);
+    }
+    assert!(columns[0] > columns[1], "more cards fit across when they are smaller: {columns:?}");
+}
+
+#[test]
+fn zooming_quickly_never_runs_more_than_three_render_threads() {
+    let files: Vec<(String, Vec<u8>)> = (0..60).map(|i| (format!("f{i:02}.pdf"), if i < 6 { heavy() } else { fixture(1) })).collect();
+    let mut h = grid_after(files.iter().map(|(n, b)| (n.as_str(), b.clone())).collect(), vec2(1400.0, 900.0), 0);
+    let mut most = 0;
+    for k in 0..80 {
+        let key = if (k / 5) % 2 == 0 { Key::Equals } else { Key::Minus };
+        h.key_press_modifiers(Modifiers::COMMAND, key);
+        h.run_steps(1);
+        let threads = h.state_mut().combine_thumbnail_threads();
+        most = most.max(threads);
+        assert!(threads <= 3, "frame {k}: {threads} render threads");
+        std::thread::sleep(Duration::from_millis(3));
+    }
+    assert!(most > 0, "renders were seen under way");
+    // And it settles: the cards in view all get their thumbnails.
+    assert!(settle(&mut h, |app| app.combine_thumbnails_rendering() == 0 && app.combine_thumbnails().first().is_some_and(ready)));
+}
+
+/// The grid with 40 one-page files, scrolled down by `dy`; and where the top of the grid is.
+fn scrolled_grid(dy: f32) -> (Harness<'static, PdfCraftApp>, f32) {
+    let files: Vec<(String, Vec<u8>)> = (0..40).map(|i| (format!("f{i:02}.pdf"), fixture(1))).collect();
+    let mut h = grid_of(files.iter().map(|(n, b)| (n.as_str(), b.clone())).collect(), vec2(1400.0, 900.0));
+    // Unscrolled, the first card sits a fixed space (12 points) below the top of the grid.
+    let top = card(&h, "f00.pdf").top() - 12.0;
+    let at = card(&h, "f00.pdf").center();
+    h.hover_at(at);
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(0.0, -dy),
+        phase: egui::TouchPhase::Move,
+        modifiers: Modifiers::NONE,
+    });
+    h.run_steps(8);
+    (h, top)
+}
+
+/// The first card (in list order) still showing below `top`.
+fn first_in_view(h: &Harness<'static, PdfCraftApp>, top: f32) -> String {
+    names(h).into_iter().find(|n| h.query_by_label(n).is_some_and(|c| c.rect().bottom() > top)).expect("a card in view")
+}
+
+#[test]
+fn zooming_from_the_toolbar_while_scrolled_keeps_the_top_cards_in_place() {
+    // Regression: with the pointer over the toolbar, a card drawn just above the view (under the
+    // toolbar) was taken as the one to keep in place, and the cards in view jumped.
+    for how in ["keys", "button", "slider"] {
+        let (mut h, top) = scrolled_grid(700.0);
+        let anchor = first_in_view(&h, top);
+        let before = card(&h, &anchor).top();
+        let over_toolbar = egui::pos2(card(&h, &anchor).center().x, h.get_by_label("Grid view").rect().center().y);
+        h.hover_at(over_toolbar);
+        h.run_steps(1);
+        match how {
+            "keys" => h.key_press_modifiers(Modifiers::COMMAND, Key::Equals),
+            "button" => h.get_by_label("Larger pages").click(),
+            _ => {
+                let s = h.get_by_label("Page size").rect();
+                drag(&mut h, s.center(), s.right_center() + vec2(40.0, 0.0));
+            }
+        }
+        h.run_steps(3);
+        assert!(h.state().combine_zoom > 1.0, "{how}");
+        let after = card(&h, &anchor).top();
+        assert!((after - before).abs() < 2.0, "{how}: {anchor} moved from {before} to {after}");
+    }
+}
+
+#[test]
+fn zooming_out_at_the_bottom_leaves_no_gap_below_the_last_card() {
+    let (mut h, _) = scrolled_grid(20_000.0);
+    h.state_mut().set_option("combine-zoom", "200").unwrap();
+    h.run_steps(2);
+    // Over the middle of the grid.
+    h.hover_at(egui::pos2(900.0, 600.0));
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(0.0, -20_000.0),
+        phase: egui::TouchPhase::Move,
+        modifiers: Modifiers::NONE,
+    });
+    h.run_steps(8);
+    let bottom = card(&h, "f39.pdf").bottom();
+    h.get_by_label("Smaller pages").click();
+    for frame in 0..6 {
+        h.run_steps(1);
+        let now = card(&h, "f39.pdf").bottom();
+        assert!((now - bottom).abs() < 2.0, "frame {frame}: the last card left a gap below it ({bottom} → {now})");
+    }
+    assert_eq!(h.state().combine_zoom, 1.75);
+}
+
+#[test]
+fn the_size_slider_takes_the_arrow_keys_when_it_has_the_keyboard() {
+    // Regression: the grid's arrow keys moved the selection instead.
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1)]);
+    h.get_by_label("a.pdf").click();
+    h.run_steps(1);
+    h.get_by_label("Page size").focus();
+    h.run_steps(1);
+    h.key_press(Key::ArrowRight);
+    h.run_steps(2);
+    assert!(h.state().combine_zoom > 1.0, "{}", h.state().combine_zoom);
+    assert_eq!(h.state().combine_selection(), [0], "the selection stays");
+    let node = h.get_by_label("Page size");
+    assert!(node.accesskit_node().numeric_value().is_some_and(|v| v > 100.0), "read out as a percentage");
+}
+
+#[test]
+fn the_toolbar_fits_the_smallest_window() {
+    // 820 points is the narrowest the window goes.
+    let mut h = grid_after(vec![("a.pdf", fixture(1)), ("b.pdf", fixture(1))], vec2(820.0, 700.0), 4);
+    h.get_by_label("a.pdf").click();
+    h.run_steps(1);
+    h.get_by_label("b.pdf").click_modifiers(Modifiers::COMMAND);
+    h.run_steps(2);
+    let controls: Vec<egui::Rect> = [
+        "Add open documents",
+        "Undo",
+        "Redo",
+        "Grid view",
+        "List view",
+        "2 selected",
+        "Smaller pages",
+        "Page size",
+        "Reset page size",
+        "Larger pages",
+    ]
+    .iter()
+    .map(|l| h.get_by_label(l).rect())
+    .collect();
+    for (i, a) in controls.iter().enumerate() {
+        assert!(a.right() <= 820.0, "{i}: {a:?} is off the window");
+        for b in controls.iter().skip(i + 1) {
+            assert!(!a.intersects(*b), "{a:?} overlaps {b:?}");
+        }
+    }
+}
+
+/// The pointer over a card (its centre, below the bar of actions at the top of its page).
+fn hover_card(h: &mut Harness<'static, PdfCraftApp>, name: &str) {
+    let at = card(h, name).center();
+    h.hover_at(at);
+    h.run_steps(2);
+}
+
+/// A primary click at a point, as a user makes one.
+fn click_at(h: &mut Harness<'static, PdfCraftApp>, at: Pos2) {
+    h.hover_at(at);
+    h.run_steps(1);
+    for pressed in [true, false] {
+        h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.run_steps(1);
+    }
+    h.run_steps(1);
+}
+
+#[test]
+fn hovering_a_card_shows_its_trash_and_magnifier_and_only_then() {
+    let mut h = grid_of(vec![("a.pdf", fixture(1)), ("b.pdf", fixture(3)), ("secret.pdf", protected("pw", "owner"))], vec2(1400.0, 900.0));
+    h.hover_at(egui::pos2(5.0, 890.0));
+    h.run_steps(2);
+    assert!(h.query_by_label("Preview").is_none() && h.query_by_label("Remove a.pdf").is_none(), "nothing until a card is hovered");
+    hover_card(&mut h, "a.pdf");
+    h.get_by_label("Preview");
+    h.get_by_label("Remove a.pdf");
+    // Over the bar itself it stays (the pointer is still on the card).
+    let bar = h.get_by_label("Preview").rect().center();
+    h.hover_at(bar);
+    h.run_steps(2);
+    h.get_by_label("Remove a.pdf");
+    // Another card: its own.
+    hover_card(&mut h, "b.pdf");
+    h.get_by_label("Remove b.pdf");
+    assert!(h.query_by_label("Remove a.pdf").is_none());
+    // A locked file has nothing to show large, but can still be removed.
+    hover_card(&mut h, "secret.pdf");
+    h.get_by_label("Remove secret.pdf");
+    assert!(h.query_by_label("Preview").is_none(), "no magnifier on a locked file");
+}
+
+#[test]
+fn the_card_trash_removes_only_that_file_and_undo_brings_it_back() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1), ("d.pdf", 1)]);
+    h.get_by_label("b.pdf").click();
+    h.run_steps(1);
+    h.get_by_label("c.pdf").click_modifiers(Modifiers::COMMAND);
+    h.run_steps(1);
+    // The trash of a card that isn't selected: that file only, the selection stays.
+    hover_card(&mut h, "a.pdf");
+    h.get_by_label("Remove a.pdf").click();
+    h.run_steps(2);
+    assert_eq!(names(&h), ["b.pdf", "c.pdf", "d.pdf"]);
+    assert_eq!(h.state().combine_selection(), [0, 1], "b and c stay selected");
+    // The trash of a selected card: still that file only.
+    hover_card(&mut h, "b.pdf");
+    h.get_all_by_label("Remove b.pdf").last().unwrap().click();
+    h.run_steps(2);
+    assert_eq!(names(&h), ["c.pdf", "d.pdf"]);
+    assert_eq!(h.state().combine_selection(), [0], "c stays selected");
+    // One undo step each.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert_eq!(names(&h), ["b.pdf", "c.pdf", "d.pdf"]);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert_eq!(names(&h), ["a.pdf", "b.pdf", "c.pdf", "d.pdf"]);
+}
+
+#[test]
+fn the_magnifier_shows_the_file_large_and_flips_through_the_pages_it_adds() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 4)]);
+    h.state_mut().combine_draft[1].range = "3, 1".into();
+    h.get_by_label("a.pdf").click();
+    h.run_steps(1);
+    assert!(settle(&mut h, |app| ready(&app.combine_thumbnails()[1])));
+    let CombineThumb::Ready { width: card_width, .. } = h.state().combine_thumbnails()[1] else { unreachable!() };
+    hover_card(&mut h, "b.pdf");
+    h.get_by_label("Preview").click();
+    h.run_steps(2);
+    // The card under it says nothing over it (its tooltip, its actions).
+    for _ in 0..150 {
+        h.run_steps(1);
+    }
+    assert!(h.query_by_label_contains("4 pages ·").is_none(), "no card tooltip over the preview");
+    assert!(h.query_by_label("Remove b.pdf").is_none(), "no card actions over the preview");
+    // The first page it adds: page 3.
+    let (name, page, _) = h.state().combine_preview().expect("shown large");
+    assert_eq!((name.as_str(), page), ("b.pdf", 2));
+    h.get_by_label("Page 1 of 2");
+    assert!(disabled(&h, "Previous page"));
+    // Rendered larger than its card.
+    assert!(
+        settle(&mut h, |app| matches!(app.combine_preview(), Some((_, _, CombineThumb::Ready { width, .. })) if width > card_width)),
+        "{:?}",
+        h.state().combine_preview()
+    );
+    // The arrow keys flip, and stop at the ends; the grid's selection doesn't move.
+    h.key_press(Key::ArrowRight);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_preview().map(|p| p.1), Some(0), "then page 1");
+    h.get_by_label("Page 2 of 2");
+    assert!(disabled(&h, "Next page"));
+    h.key_press(Key::ArrowRight);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_preview().map(|p| p.1), Some(0));
+    h.get_by_label("Previous page").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_preview().map(|p| p.1), Some(2));
+    assert_eq!(h.state().combine_selection(), [0]);
+    // Esc closes it; so do the close button and a click outside.
+    h.key_press(Key::Escape);
+    h.run_steps(2);
+    assert!(h.state().combine_preview().is_none());
+    for how in ["close", "outside"] {
+        hover_card(&mut h, "b.pdf");
+        h.get_by_label("Preview").click();
+        h.run_steps(2);
+        assert!(h.state().combine_preview().is_some(), "{how}");
+        match how {
+            "close" => h.get_by_label("Close").click(),
+            _ => click_at(&mut h, egui::pos2(6.0, 6.0)),
+        }
+        h.run_steps(2);
+        assert!(h.state().combine_preview().is_none(), "{how}");
+    }
+    assert_eq!(names(&h), ["a.pdf", "b.pdf"], "nothing else changed");
+}
+
+#[test]
+fn a_right_click_on_a_card_offers_preview_and_remove() {
+    let mut h = grid_of_pages(&[("a.pdf", 2), ("b.pdf", 1)]);
+    h.get_by_label("a.pdf").click_secondary();
+    h.run_steps(2);
+    // The menu's items come after the card's own buttons of the same name.
+    h.get_all_by_label("Preview").last().unwrap().click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_preview().map(|p| (p.0, p.1)), Some(("a.pdf".to_string(), 0)));
+    h.key_press(Key::Escape);
+    h.run_steps(2);
+    h.get_by_label("b.pdf").click_secondary();
+    h.run_steps(2);
+    h.get_all_by_label("Remove b.pdf").last().unwrap().click();
+    h.run_steps(2);
+    assert_eq!(names(&h), ["a.pdf"]);
+}
+
+#[test]
+fn the_preview_closes_when_its_file_leaves_and_keeps_to_three_render_threads() {
+    let files: Vec<(String, Vec<u8>)> = (0..12).map(|i| (format!("f{i:02}.pdf"), heavy())).collect();
+    let mut h = grid_after_one(files.iter().map(|(n, b)| (n.as_str(), b.clone())).collect(), vec2(1400.0, 900.0));
+    hover_card(&mut h, "f03.pdf");
+    h.get_by_label("Preview").click();
+    let (mut most, mut rendered) = (0, false);
+    for frame in 0..60 {
+        h.run_steps(1);
+        let threads = h.state_mut().combine_thumbnail_threads();
+        most = most.max(threads);
+        assert!(threads <= 3, "frame {frame}: {threads} render threads");
+        // The large page itself is rendered (under way, or done) among them.
+        rendered |= matches!(h.state().combine_preview(), Some((_, _, CombineThumb::Pending | CombineThumb::Ready { .. })));
+        std::thread::sleep(Duration::from_millis(5));
+    }
+    assert!(most > 0);
+    assert!(rendered, "the preview's own render ran: {:?}", h.state().combine_preview());
+    // The file leaves the list (as undo of its adding would): the preview closes, nothing stays.
+    h.state_mut().combine_draft.retain(|f| f.name != "f03.pdf");
+    h.run_steps(2);
+    assert!(h.state().combine_preview().is_none());
+    assert!(settle(&mut h, |app| app.combine_thumbnails_rendering() == 0 && app.combine_thumbnail_threads_exited()));
+}
+
+#[test]
+fn space_shows_the_selected_file_large_in_the_grid_and_the_list() {
+    // The way to the preview without a pointer (screen readers, the keyboard).
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 2), ("c.pdf", 1)]);
+    h.key_press(Key::Space);
+    h.run_steps(2);
+    assert!(h.state().combine_preview().is_none(), "nothing selected, nothing shown");
+    h.get_by_label("a.pdf").click();
+    h.run_steps(1);
+    h.key_press(Key::ArrowRight);
+    h.run_steps(1);
+    h.key_press(Key::Space);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_preview().map(|p| p.0), Some("b.pdf".to_string()), "the file the keyboard is on");
+    // While it shows, the grid's keys wait: an arrow flips its pages, Delete removes nothing.
+    h.key_press(Key::ArrowRight);
+    h.key_press(Key::Delete);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_preview().map(|p| p.1), Some(1));
+    assert_eq!(names(&h).len(), 3);
+    assert_eq!(h.state().combine_selection(), [1]);
+    h.key_press(Key::Escape);
+    h.run_steps(2);
+    assert!(h.state().combine_preview().is_none());
+    // The list too.
+    h.get_by_label("List view").click();
+    h.run_steps(2);
+    h.key_press(Key::Space);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_preview().map(|p| p.0), Some("b.pdf".to_string()));
+}
+
+#[test]
+fn flipping_quickly_ends_on_the_page_shown_and_leaving_the_tab_closes_the_preview() {
+    let mut h = grid_of_pages(&[("a.pdf", 6)]);
+    hover_card(&mut h, "a.pdf");
+    h.get_by_label("Preview").click();
+    h.run_steps(1);
+    // A page a frame, faster than they render.
+    for _ in 0..4 {
+        h.key_press(Key::ArrowRight);
+        h.run_steps(1);
+    }
+    assert_eq!(h.state().combine_preview().map(|p| p.1), Some(4));
+    assert!(
+        settle(&mut h, |app| matches!(app.combine_preview(), Some((_, 4, CombineThumb::Ready { page: 4, .. })))),
+        "the render shown is of the page shown: {:?}",
+        h.state().combine_preview()
+    );
+    // Home, then back: the preview is gone, not waiting there.
+    h.state_mut().combine_tab.focused = false;
+    h.run_steps(2);
+    assert!(h.state().combine_preview().is_none());
+    h.state_mut().open_combine_tab();
+    h.run_steps(2);
+    assert!(h.state().combine_preview().is_none());
+    assert!(h.query_by_label("Page 5 of 6").is_none());
+}
+
+#[test]
+fn space_on_a_focused_button_presses_it_and_previews_only_what_can_be_shown() {
+    // Regression: with a file selected, Space opened the preview whatever had the keyboard.
+    let mut h =
+        grid_of(vec![("a.pdf", fixture(2)), ("old.pdf", protected_with(pdfcraft_cos::Algorithm::Rc4_128, "pw", "owner"))], vec2(1400.0, 900.0));
+    h.get_by_label("a.pdf").click();
+    h.run_steps(1);
+    h.get_by_label("List view").focus();
+    h.run_steps(1);
+    h.key_press(Key::Space);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_view, CombineView::List, "the focused button was pressed");
+    assert!(h.state().combine_preview().is_none());
+    // A file whose pages can't be measured has nothing to show large (its card has no magnifier).
+    h.get_by_label("Grid view").click();
+    h.run_steps(1);
+    assert!(h.state_mut().combine_unlock_rows(&[1], "owner"));
+    h.run_steps(2);
+    h.get_by_label("old.pdf").click();
+    h.run_steps(1);
+    h.key_press(Key::Space);
+    h.run_steps(2);
+    assert!(h.state().combine_preview().is_none(), "nothing to show");
+}
+
+#[test]
+fn a_drag_held_while_the_tab_closes_and_reopens_moves_nothing() {
+    // Regression: closing the tab started the list's revisions over, so a drag begun before could
+    // match a new list and move one of its files.
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 1), ("c.pdf", 1)]);
+    let (a, c) = (card(&h, "a.pdf"), card(&h, "c.pdf"));
+    h.hover_at(a.center());
+    h.run_steps(1);
+    h.drag_at(a.center());
+    h.run_steps(1);
+    h.hover_at(a.center() + vec2(30.0, 0.0));
+    h.run_steps(1);
+    // While held: the tab closes, and the same files come back.
+    h.state_mut().close_combine_tab();
+    h.state_mut().use_files(FilePurpose::Combine, ["a.pdf", "b.pdf", "c.pdf"].iter().map(|n| (n.to_string(), fixture(1))).collect());
+    h.run_steps(2);
+    let to = c.center() + vec2(c.width() * 0.3, 0.0);
+    h.hover_at(to);
+    h.run_steps(1);
+    h.drop_at(to);
+    h.run_steps(3);
+    assert_eq!(names(&h), ["a.pdf", "b.pdf", "c.pdf"], "the old drag moves nothing in the new list");
+}
+
+// ---- Stage 3: a file shown as its pages ----
+
+/// The label of a page card: "Page 3 · b.pdf".
+fn page_card(page: usize, name: &str) -> String {
+    format!("Page {page} · {name}")
+}
+
+/// Expand a file from its card's hover bar.
+fn expand(h: &mut Harness<'static, PdfCraftApp>, name: &str) {
+    hover_card(h, name);
+    h.get_by_label("Expand").click();
+    h.run_steps(2);
+}
+
+#[test]
+fn expanding_a_file_shows_the_pages_it_adds_in_order_with_their_numbers() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 4)]);
+    h.state_mut().combine_draft[1].range = "3, 1, 4".into();
+    h.run_steps(2);
+    // A single page has nothing to expand.
+    hover_card(&mut h, "a.pdf");
+    assert!(h.query_by_label("Expand").is_none());
+    expand(&mut h, "b.pdf");
+    assert_eq!(h.state().combine_expanded(), [1]);
+    assert!(h.query_by_label("b.pdf").is_none(), "the file's card gives way to its pages");
+    // The pages it adds, in the range's order, each saying which page of which file.
+    let xs: Vec<f32> = [3, 1, 4].iter().map(|p| card(&h, &page_card(*p, "b.pdf")).left()).collect();
+    assert!(xs.windows(2).all(|w| w[0] < w[1]), "pages 3, 1, 4 in that order: {xs:?}");
+    assert!(h.query_by_label(&page_card(2, "b.pdf")).is_none(), "page 2 isn't added, so isn't shown");
+    // Each renders its own page.
+    assert!(settle(&mut h, |app| {
+        let pages = app.combine_page_thumbnails(1);
+        pages.len() == 3 && pages.iter().all(|(p, t)| matches!(t, CombineThumb::Ready { page, .. } if page == p))
+    }));
+    // A page card collapses the file again.
+    hover_card(&mut h, &page_card(1, "b.pdf"));
+    h.get_by_label("Collapse").click();
+    h.run_steps(2);
+    assert!(h.state().combine_expanded().is_empty());
+    h.get_by_label("b.pdf");
+}
+
+#[test]
+fn expand_all_and_collapse_all_from_the_toolbar_and_a_right_click() {
+    let mut h = grid_of(
+        vec![("a.pdf", fixture(1)), ("b.pdf", fixture(3)), ("c.pdf", fixture(2)), ("secret.pdf", protected("pw", "owner"))],
+        vec2(1400.0, 900.0),
+    );
+    assert!(disabled(&h, "Collapse all"), "nothing to collapse yet");
+    h.get_by_label("Expand all").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_expanded(), [1, 2], "every file adding more than one page; not a single page, not a locked file");
+    assert!(disabled(&h, "Expand all"));
+    h.get_by_label("Collapse all").click();
+    h.run_steps(2);
+    assert!(h.state().combine_expanded().is_empty());
+    // On a right click too (the pointer then off the card, so its hover bar is gone and the
+    // label is the menu's alone).
+    h.get_by_label("c.pdf").click_secondary();
+    h.run_steps(2);
+    h.hover_at(egui::pos2(5.0, 890.0));
+    h.run_steps(2);
+    h.get_by_label("Expand").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_expanded(), [2]);
+    h.get_by_label(&page_card(2, "c.pdf")).click_secondary();
+    h.run_steps(2);
+    h.hover_at(egui::pos2(5.0, 890.0));
+    h.run_steps(2);
+    h.get_by_label("Collapse").click();
+    h.run_steps(2);
+    assert!(h.state().combine_expanded().is_empty());
+}
+
+#[test]
+fn expanding_is_a_view_kept_across_views_and_zoom_and_never_an_undo_step() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 3)]);
+    let undo = disabled(&h, "Undo");
+    expand(&mut h, "b.pdf");
+    assert_eq!(disabled(&h, "Undo"), undo, "not an edit: the undo history is as it was");
+    assert!(disabled(&h, "Redo"));
+    h.get_by_label("List view").click();
+    h.run_steps(2);
+    h.get_by_label("Grid view").click();
+    h.run_steps(2);
+    h.get_by_label("Larger pages").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_expanded(), [1], "still shown as its pages");
+    h.get_by_label(&page_card(3, "b.pdf"));
+    // Its range edited down to one page: that page's card (a part of a file can be one page).
+    h.state_mut().combine_draft[1].range = "2".into();
+    h.run_steps(2);
+    h.get_by_label(&page_card(2, "b.pdf"));
+    // A bad range: its card again, no longer expanded, and it doesn't come back expanded by
+    // itself when the range is fixed.
+    h.state_mut().combine_draft[1].range = "9".into();
+    h.run_steps(2);
+    h.get_by_label("b.pdf");
+    assert!(h.state().combine_expanded().is_empty(), "no longer expanded");
+    assert!(disabled(&h, "Collapse all"));
+    h.state_mut().combine_draft[1].range = String::new();
+    h.run_steps(2);
+    h.get_by_label("b.pdf");
+    assert!(h.state().combine_expanded().is_empty());
+    expand(&mut h, "b.pdf");
+    h.get_by_label(&page_card(2, "b.pdf"));
+    // The file removed (its file selected with the keys, then Delete): forgotten; undo brings
+    // the file back as its card.
+    h.get_by_label("a.pdf").click();
+    h.run_steps(1);
+    h.key_press(Key::ArrowRight);
+    h.run_steps(1);
+    assert_eq!(h.state().combine_selection(), [1]);
+    h.key_press(Key::Delete);
+    h.run_steps(2);
+    assert_eq!(names(&h), ["a.pdf"]);
+    assert!(h.state().combine_expanded().is_empty());
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert_eq!(names(&h), ["a.pdf", "b.pdf"]);
+    h.get_by_label("b.pdf");
+}
+
+#[test]
+fn a_page_click_selects_that_page_and_the_arrows_step_rows_of_cards() {
+    // a, then b's 6 pages, then eight more files: rows of cards below b's last page whatever
+    // the window's width.
+    let mut files = vec![("a.pdf".to_string(), fixture(1)), ("b.pdf".to_string(), fixture(6))];
+    files.extend((0..8).map(|i| (format!("f{i}.pdf"), fixture(1))));
+    let mut h = grid_of(files.iter().map(|(n, b)| (n.as_str(), b.clone())).collect(), vec2(1000.0, 1100.0));
+    expand(&mut h, "b.pdf");
+    let top = card(&h, "a.pdf").top();
+    let cols = ["a.pdf".to_string(), page_card(1, "b.pdf"), page_card(2, "b.pdf"), page_card(3, "b.pdf"), page_card(4, "b.pdf")]
+        .iter()
+        .filter(|n| (card(&h, n).top() - top).abs() < 1.0)
+        .count();
+    assert!((2..5).contains(&cols), "a row of cards is shorter than a + b's pages ({cols})");
+    h.get_by_label(&page_card(2, "b.pdf")).click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_selected_pages(), [(1, 1)], "that page");
+    assert!(h.state().combine_selection().is_empty(), "no file");
+    assert!(h.get_by_label(&page_card(2, "b.pdf")).accesskit_node().is_selected() == Some(true));
+    assert!(h.get_by_label(&page_card(5, "b.pdf")).accesskit_node().is_selected() == Some(false), "only that page");
+    // Ctrl adds, Shift takes a run.
+    h.get_by_label(&page_card(4, "b.pdf")).click_modifiers(Modifiers::COMMAND);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_selected_pages(), [(1, 1), (1, 3)]);
+    h.get_by_label(&page_card(6, "b.pdf")).click_modifiers(Modifiers::SHIFT);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_selected_pages(), [(1, 3), (1, 4), (1, 5)], "from the last page clicked");
+    // Down goes a row of cards from b's last page, to the file below it; Up comes back to b.
+    let last = card(&h, &page_card(6, "b.pdf"));
+    h.key_press(Key::ArrowDown);
+    h.run_steps(2);
+    let below = h.state().combine_selection();
+    assert_eq!(below.len(), 1);
+    assert!(h.state().combine_selected_pages().is_empty(), "the keys select files again");
+    let name = names(&h)[below[0]].clone();
+    assert!(below[0] > 1, "a file after b: {name}");
+    let r = card(&h, &name);
+    assert!((r.left() - last.left()).abs() < 1.0 && r.top() > last.top(), "the card right below b's last page: {r:?} vs {last:?}");
+    h.key_press(Key::ArrowUp);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_selection(), [1]);
+    h.key_press(Key::ArrowLeft);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_selection(), [0], "left and right step by file");
+}
+
+#[test]
+fn dragging_a_page_moves_that_page_even_between_another_files_pages() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 4), ("c.pdf", 1)]);
+    expand(&mut h, "b.pdf");
+    // b's page 2 dragged after c: that page alone moves; b is now in two parts.
+    let (p2, c) = (card(&h, &page_card(2, "b.pdf")), card(&h, "c.pdf"));
+    drag(&mut h, p2.center(), c.center() + vec2(c.width() * 0.3, 0.0));
+    let parts =
+        |h: &Harness<'static, PdfCraftApp>| h.state().combine_parts_shown().into_iter().map(|(n, p)| format!("{n}:{p:?}")).collect::<Vec<_>>();
+    assert_eq!(parts(&h), ["a.pdf:[0]", "b.pdf:[0, 2, 3]", "c.pdf:[0]", "b.pdf:[1]"]);
+    // One undo step puts it back, as one file again.
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert_eq!(parts(&h), ["a.pdf:[0]", "b.pdf:[0, 1, 2, 3]", "c.pdf:[0]"]);
+    // Within its file: only its order changes (page 4 to the front).
+    let (p4, p1) = (card(&h, &page_card(4, "b.pdf")), card(&h, &page_card(1, "b.pdf")));
+    drag(&mut h, p4.center(), p1.center() - vec2(p1.width() * 0.3, 0.0));
+    assert_eq!(parts(&h), ["a.pdf:[0]", "b.pdf:[3, 0, 1, 2]", "c.pdf:[0]"]);
+    // Selected pages go together, in their order: pages 1 and 3 (now 2nd and 4th) before a.
+    h.get_by_label(&page_card(1, "b.pdf")).click();
+    h.run_steps(1);
+    h.get_by_label(&page_card(3, "b.pdf")).click_modifiers(Modifiers::COMMAND);
+    h.run_steps(2);
+    let (p3, a) = (card(&h, &page_card(3, "b.pdf")), card(&h, "a.pdf"));
+    drag(&mut h, p3.center(), a.center() - vec2(a.width() * 0.3, 0.0));
+    assert_eq!(parts(&h), ["b.pdf:[0, 2]", "a.pdf:[0]", "b.pdf:[3, 1]", "c.pdf:[0]"]);
+    // A file's card still moves its whole file, and a drop among a file's pages goes to its nearer end.
+    let (cc, early) = (card(&h, "c.pdf"), card(&h, &page_card(3, "b.pdf")));
+    drag(&mut h, cc.center(), early.center() - vec2(early.width() * 0.3, 0.0));
+    assert_eq!(names(&h), ["b.pdf", "c.pdf", "a.pdf", "b.pdf"], "the second of that part's two pages: its end");
+}
+
+#[test]
+fn a_long_file_expanded_renders_only_its_pages_in_view_within_three_threads() {
+    let mut h = grid_of(vec![("long.pdf", fixture(300)), ("b.pdf", fixture(1))], vec2(1400.0, 900.0));
+    h.get_by_label("Expand all").click();
+    let mut most = 0;
+    for _ in 0..200 {
+        h.run_steps(1);
+        let threads = h.state_mut().combine_thumbnail_threads();
+        most = most.max(threads);
+        assert!(threads <= 3, "{threads} render threads");
+        if h.state().combine_thumbnails_rendering() == 0 && h.state().combine_page_thumbnails(0).first().is_some_and(|(_, t)| ready(t)) {
+            break;
+        }
+        std::thread::sleep(Duration::from_millis(5));
+    }
+    let pages = h.state().combine_page_thumbnails(0);
+    assert_eq!(pages.len(), 300);
+    let drawn = pages.iter().filter(|(_, t)| ready(t)).count();
+    assert!(drawn > 0 && drawn < 60, "only the pages in view (and a row either side): {drawn} of 300");
+    assert!(h.query_by_label(&page_card(300, "long.pdf")).is_none(), "the last page, far out of view, isn't even laid out as a widget");
+}
+
+#[test]
+fn a_page_cards_magnifier_opens_the_preview_on_that_page() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 5)]);
+    // Pages 3, 1, 4: page 4 is the third the file adds.
+    h.state_mut().combine_draft[1].range = "3, 1, 4".into();
+    h.run_steps(2);
+    expand(&mut h, "b.pdf");
+    hover_card(&mut h, &page_card(4, "b.pdf"));
+    h.get_by_label("Preview").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_preview().map(|p| (p.0, p.1)), Some(("b.pdf".to_string(), 3)));
+    h.get_by_label("Page 3 of 3");
+    // A page card's own actions: Collapse, Remove page, Preview (its file can't be removed from
+    // it); nothing is selected yet, so no "Remove b.pdf" anywhere.
+    h.get_by_label("Remove page");
+    h.key_press(Key::Escape);
+    h.run_steps(2);
+    hover_card(&mut h, &page_card(4, "b.pdf"));
+    h.get_by_label("Collapse");
+    assert!(h.query_by_label("Remove b.pdf").is_none());
+    // Space on a page card that has the keyboard: that page too.
+    h.get_by_label(&page_card(1, "b.pdf")).click();
+    h.run_steps(2);
+    h.get_by_label(&page_card(1, "b.pdf")).focus();
+    h.run_steps(2);
+    h.key_press(Key::Space);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_preview().map(|p| p.1), Some(0), "page 1, the second the file adds");
+    h.get_by_label("Page 2 of 3");
+}
+
+#[test]
+fn combining_with_files_expanded_gives_the_same_document() {
+    let mut h = grid_of_pages(&[("one.pdf", 2), ("two.pdf", 3)]);
+    h.state_mut().combine_draft[1].range = "3, 1".into();
+    h.get_by_label("Expand all").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_expanded(), [0, 1]);
+    h.get_by_label("Combine").click();
+    h.run_steps(3);
+    let app = h.state();
+    assert_eq!(app.views.len(), 1, "the result opens");
+    assert_eq!(texts_of(app, 0), ["Page 1", "Page 2", "Page 3", "Page 1"]);
+}
+
+#[test]
+fn collapsing_brings_the_files_card_into_view() {
+    // Many files after it, so the grid stays long once it collapses (it would otherwise scroll
+    // back by itself).
+    let mut files = vec![("long.pdf".to_string(), fixture(60))];
+    files.extend((0..40).map(|i| (format!("f{i:02}.pdf"), fixture(1))));
+    let mut h = grid_of(files.iter().map(|(n, b)| (n.as_str(), b.clone())).collect(), vec2(1400.0, 900.0));
+    expand(&mut h, "long.pdf");
+    // Down to its last pages.
+    h.hover_at(egui::pos2(900.0, 600.0));
+    for _ in 0..80 {
+        if h.query_by_label(&page_card(60, "long.pdf")).is_some_and(|c| c.rect().top() > 300.0 && c.rect().bottom() < 880.0) {
+            break;
+        }
+        h.event(egui::Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Point,
+            delta: vec2(0.0, -120.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: Modifiers::NONE,
+        });
+        h.run_steps(3);
+    }
+    hover_card(&mut h, &page_card(60, "long.pdf"));
+    h.get_by_label("Collapse").click();
+    for _ in 0..20 {
+        h.run_steps(1);
+    }
+    let r = card(&h, "long.pdf");
+    let toolbar = h.get_by_label("Grid view").rect().bottom();
+    assert!(r.bottom() > toolbar && r.top() < 900.0, "the file's card is in view: {r:?}");
+}
+
+#[test]
+fn a_file_too_long_to_spread_out_offers_no_expand() {
+    // 2001 pages: more cards than are laid out comfortably every frame.
+    let mut h = grid_of(vec![("huge.pdf", fixture(2001)), ("b.pdf", fixture(3))], vec2(1400.0, 900.0));
+    hover_card(&mut h, "huge.pdf");
+    assert!(h.query_by_label("Expand").is_none());
+    h.get_by_label("Expand all").click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_expanded(), [1], "only the file that can be");
+}
+
+#[test]
+fn removing_pages_from_the_hover_bar_the_toolbar_and_delete_never_touches_the_file() {
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 4)]);
+    let original = h.state().combine_draft[1].bytes.clone();
+    expand(&mut h, "b.pdf");
+    let parts =
+        |h: &Harness<'static, PdfCraftApp>| h.state().combine_parts_shown().into_iter().map(|(n, p)| format!("{n}:{p:?}")).collect::<Vec<_>>();
+    // A page card's trash: that page.
+    hover_card(&mut h, &page_card(2, "b.pdf"));
+    h.get_by_label("Remove page").click();
+    h.run_steps(2);
+    assert_eq!(parts(&h), ["a.pdf:[0]", "b.pdf:[0, 2, 3]"]);
+    // Two selected: the toolbar's trash says so, and takes both.
+    h.get_by_label(&page_card(1, "b.pdf")).click();
+    h.run_steps(1);
+    h.get_by_label(&page_card(4, "b.pdf")).click_modifiers(Modifiers::COMMAND);
+    h.run_steps(2);
+    h.hover_at(egui::pos2(5.0, 890.0));
+    h.run_steps(1);
+    h.get_by_label("Remove 2 pages").click();
+    h.run_steps(2);
+    assert_eq!(parts(&h), ["a.pdf:[0]", "b.pdf:[2]"]);
+    // Delete on the last page left: the file leaves the list.
+    h.get_by_label(&page_card(3, "b.pdf")).click();
+    h.run_steps(2);
+    h.key_press(Key::Delete);
+    h.run_steps(2);
+    assert_eq!(parts(&h), ["a.pdf:[0]"]);
+    // Each was one undo step; the file itself was never changed.
+    for expected in [vec!["a.pdf:[0]", "b.pdf:[2]"], vec!["a.pdf:[0]", "b.pdf:[0, 2, 3]"], vec!["a.pdf:[0]", "b.pdf:[0, 1, 2, 3]"]] {
+        h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+        h.run_steps(2);
+        assert_eq!(parts(&h), expected);
+    }
+    assert!(std::sync::Arc::ptr_eq(&h.state().combine_draft[1].bytes, &original), "the same, untouched bytes");
+}
+
+#[test]
+fn a_split_file_counts_once_and_combines_with_one_bookmark() {
+    let mut h = grid_of_pages(&[("one.pdf", 2), ("two.pdf", 3)]);
+    expand(&mut h, "one.pdf");
+    expand(&mut h, "two.pdf");
+    let totals = |h: &Harness<'static, PdfCraftApp>| {
+        let n = h.get_by_label_contains(" pages · ");
+        let a = n.accesskit_node();
+        a.label().or(a.value()).unwrap_or_default().to_string()
+    };
+    let before = totals(&h);
+    assert!(before.starts_with("2 files · 5 pages · "), "{before}");
+    // one's page 2 between two's pages 1 and 2.
+    let (p2, t2) = (card(&h, &page_card(2, "one.pdf")), card(&h, &page_card(2, "two.pdf")));
+    drag(&mut h, p2.center(), t2.center() - vec2(t2.width() * 0.3, 0.0));
+    assert_eq!(names(&h), ["one.pdf", "two.pdf", "one.pdf", "two.pdf"]);
+    // Still two files, of the same size (each counted once), and the parts aren't "added more
+    // than once".
+    assert_eq!(totals(&h), before);
+    hover_card(&mut h, &page_card(2, "one.pdf"));
+    for _ in 0..60 {
+        h.run_steps(1);
+    }
+    assert!(h.query_by_label_contains("Added more than once").is_none());
+    h.hover_at(egui::pos2(5.0, 890.0));
+    h.run_steps(2);
+    h.get_by_label("Combine").click();
+    h.run_steps(3);
+    let app = h.state();
+    assert_eq!(app.views.len(), 1, "the result opens");
+    assert_eq!(texts_of(app, 0), ["Page 1", "Page 1", "Page 2", "Page 2", "Page 3"], "the order shown");
+    let doc = app.session.get(app.views[0].id).unwrap();
+    assert_eq!(doc.info.outline.iter().map(|o| o.title.as_str()).collect::<Vec<_>>(), ["one", "two"], "one bookmark per file");
+}
+
+#[test]
+fn pages_picked_out_of_sight_or_before_an_undo_are_let_go_of() {
+    // Regression: a page picked, then hidden (its file collapsed, or the list shown) or undone,
+    // stayed picked, and the trash or Delete took it.
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 4), ("c.pdf", 1)]);
+    let parts =
+        |h: &Harness<'static, PdfCraftApp>| h.state().combine_parts_shown().into_iter().map(|(n, p)| format!("{n}:{p:?}")).collect::<Vec<_>>();
+    expand(&mut h, "b.pdf");
+    // Collapsed from its hover bar: nothing picked, Delete takes nothing.
+    h.get_by_label(&page_card(2, "b.pdf")).click();
+    h.run_steps(2);
+    hover_card(&mut h, &page_card(3, "b.pdf"));
+    h.get_by_label("Collapse").click();
+    h.run_steps(2);
+    assert!(h.state().combine_selected_pages().is_empty());
+    h.key_press(Key::Delete);
+    h.run_steps(2);
+    assert_eq!(parts(&h), ["a.pdf:[0]", "b.pdf:[0, 1, 2, 3]", "c.pdf:[0]"]);
+    // In the list: the same.
+    expand(&mut h, "b.pdf");
+    h.get_by_label(&page_card(2, "b.pdf")).click();
+    h.run_steps(2);
+    h.get_by_label("List view").click();
+    h.run_steps(2);
+    assert!(h.state().combine_selected_pages().is_empty());
+    h.get_by_label("Grid view").click();
+    h.run_steps(2);
+    // After an undo: let go of, and a Delete then changes nothing and keeps the redo.
+    let (p2, c) = (card(&h, &page_card(2, "b.pdf")), card(&h, "c.pdf"));
+    drag(&mut h, p2.center(), c.center() + vec2(c.width() * 0.3, 0.0));
+    assert_eq!(parts(&h), ["a.pdf:[0]", "b.pdf:[0, 2, 3]", "c.pdf:[0]", "b.pdf:[1]"]);
+    // Page 3, the second of b's first part: after the undo that place is page 2, another page.
+    h.get_by_label(&page_card(3, "b.pdf")).click();
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert!(h.state().combine_selected_pages().is_empty());
+    assert!(!disabled(&h, "Redo"));
+    h.key_press(Key::Delete);
+    h.run_steps(2);
+    assert_eq!(parts(&h), ["a.pdf:[0]", "b.pdf:[0, 1, 2, 3]", "c.pdf:[0]"]);
+    assert!(!disabled(&h, "Redo"), "a Delete with nothing picked makes no undo step");
+    // A file picked (by dragging its card) lets go of the pages: Delete takes the file.
+    h.get_by_label(&page_card(2, "b.pdf")).click();
+    h.run_steps(2);
+    let (cc, a) = (card(&h, "c.pdf"), card(&h, "a.pdf"));
+    drag(&mut h, cc.center(), a.center() - vec2(a.width() * 0.3, 0.0));
+    assert_eq!(h.state().combine_selection(), [0]);
+    assert!(h.state().combine_selected_pages().is_empty());
+    h.key_press(Key::Delete);
+    h.run_steps(2);
+    assert_eq!(parts(&h), ["a.pdf:[0]", "b.pdf:[0, 1, 2, 3]"]);
+}
+
+#[test]
+fn a_files_parts_join_when_what_was_between_them_goes_and_one_file_cannot_be_combined() {
+    let mut h = grid_of_pages(&[("one.pdf", 2), ("two.pdf", 1)]);
+    let parts =
+        |h: &Harness<'static, PdfCraftApp>| h.state().combine_parts_shown().into_iter().map(|(n, p)| format!("{n}:{p:?}")).collect::<Vec<_>>();
+    expand(&mut h, "one.pdf");
+    // one's page 2 after two: one is in two parts.
+    let (p2, two) = (card(&h, &page_card(2, "one.pdf")), card(&h, "two.pdf"));
+    drag(&mut h, p2.center(), two.center() + vec2(two.width() * 0.3, 0.0));
+    assert_eq!(parts(&h), ["one.pdf:[0]", "two.pdf:[0]", "one.pdf:[1]"]);
+    // two goes: one's parts meet and are one entry again, in the same undo step.
+    hover_card(&mut h, "two.pdf");
+    h.get_by_label("Remove two.pdf").click();
+    h.run_steps(2);
+    assert_eq!(parts(&h), ["one.pdf:[0, 1]"]);
+    // One file is nothing to combine, however it is split.
+    assert!(h.get_by_label("Combine").accesskit_node().is_disabled());
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(2);
+    assert_eq!(parts(&h), ["one.pdf:[0]", "two.pdf:[0]", "one.pdf:[1]"]);
+}
+
+#[test]
+fn files_picked_by_automation_let_go_of_the_pages_picked() {
+    // Regression (found by review): selecting rows through the API left a page picked, and
+    // Delete took that page instead of the file.
+    let mut h = grid_of_pages(&[("a.pdf", 1), ("b.pdf", 3)]);
+    expand(&mut h, "b.pdf");
+    h.get_by_label(&page_card(2, "b.pdf")).click();
+    h.run_steps(2);
+    assert_eq!(h.state().combine_selected_pages(), [(1, 1)]);
+    h.state_mut().select_combine_rows(&[0]);
+    h.run_steps(2);
+    assert!(h.state().combine_selected_pages().is_empty());
+    h.key_press(Key::Delete);
+    h.run_steps(2);
+    assert_eq!(h.state().combine_parts_shown(), [("b.pdf".to_string(), vec![0, 1, 2])], "the file picked goes, b keeps its pages");
+}
diff --git a/crates/ui-egui/tests/commands.rs b/crates/ui-egui/tests/commands.rs
index d7677e315..f12a32203 100644
--- a/crates/ui-egui/tests/commands.rs
+++ b/crates/ui-egui/tests/commands.rs
@@ -311,6 +311,38 @@ fn the_shortcuts_dialog_lists_the_real_bindings() {
     h.get_by_label("Zoom in / out (also pinch or ⌘-scroll)");
 }
 
+#[test]
+fn localized_shortcuts_update_immediately_and_keep_command_ids_and_key_bindings() {
+    let mut h = harness();
+    h.ctx.set_os(OperatingSystem::Windows);
+    h.state_mut().set_option("language", "de").unwrap();
+    h.state_mut().execute("help.shortcuts");
+    h.run_steps(3);
+    h.get_by_label("Strg+Umschalt+S");
+    h.state_mut().set_option("language", "en").unwrap();
+    h.run_steps(2);
+    h.get_by_label("Ctrl+Shift+S");
+    h.state_mut().set_option("language", "de").unwrap();
+    h.ctx.set_os(OperatingSystem::Mac);
+    h.run_steps(2);
+    h.get_by_label("⇧⌘S");
+    h.key_press(Key::Escape);
+    h.run_steps(2);
+    h.ctx.set_os(OperatingSystem::Windows);
+    h.key_press_modifiers(Modifiers::CTRL | Modifiers::COMMAND, Key::K);
+    h.run_steps(3);
+    assert!(h.state().palette_open, "the localized Strg+K display still binds Ctrl+K");
+    // Searching by the stable command id still works in a translated interface.
+    h.state_mut().set_option("palette", "view.read_mode").unwrap();
+    h.run_steps(2);
+    h.key_press(Key::Enter);
+    h.run_steps(3);
+    assert_eq!(h.state().mode, pdfcraft_ui_egui::Mode::Read);
+    assert!(!h.state().palette_open);
+    let doc = h.state().session.get(h.state().views[0].id).unwrap();
+    assert!(!doc.dirty);
+}
+
 /// Menu ▸ View open, with egui told the app runs on `os`.
 fn view_menu(os: OperatingSystem) -> Harness<'static, PdfCraftApp> {
     let mut h = harness();
diff --git a/crates/ui-egui/tests/comments.rs b/crates/ui-egui/tests/comments.rs
index b2ba694c7..236f4e817 100644
--- a/crates/ui-egui/tests/comments.rs
+++ b/crates/ui-egui/tests/comments.rs
@@ -360,6 +360,64 @@ fn comment_properties_change_appearance_and_author() {
     assert_eq!(doc.can_undo(), Some("Change comment properties"), "one undo step");
 }
 
+/// #686: rectangles, ovals, polygons and clouds can be filled, from the quick bar for new ones
+/// and from Properties for existing ones; "No fill" takes it away again.
+#[test]
+fn shapes_take_a_fill_colour_from_the_quick_bar_and_properties() {
+    use pdfcraft_ui_egui::comments::CommentTool;
+    let mut h = harness(|app| app.set_option("quick", "square").unwrap());
+    h.run_steps(2);
+    // No fill by default; the quick bar says so.
+    h.get_by_label("Fill colour: none");
+    h.state_mut().comment_prefs.set_fill(CommentTool::Rectangle, Some([1.0, 0.5, 0.0]));
+    // Tools without an interior keep no fill.
+    h.state_mut().comment_prefs.set_fill(CommentTool::Line, Some([1.0, 0.5, 0.0]));
+    assert_eq!(h.state().comment_prefs.style(CommentTool::Line).fill, None);
+    h.run_steps(2);
+    drag_pt(&mut h, (40.0, 100.0), (140.0, 40.0));
+    let fill_of = |h: &Harness<'static, PdfCraftApp>, index: usize| {
+        let s = h.state();
+        let doc = s.session.get(s.views[0].id).unwrap();
+        let p = doc.comment_props(0, index).unwrap();
+        assert!(p.fillable);
+        p.fill
+    };
+    assert_eq!(fill_of(&h, 0), Some([1.0, 0.5, 0.0]), "the new rectangle is filled");
+    // Quick bar ▸ Fill colour ▸ No fill: the next rectangle has none.
+    h.state_mut().set_option("quick", "square").unwrap();
+    h.run_steps(2);
+    h.get_by_label("Fill colour").click();
+    h.run_steps(2);
+    h.get_by_label("No fill").click();
+    h.run_steps(2);
+    assert_eq!(h.state().comment_prefs.style(CommentTool::Rectangle).fill, None);
+    drag_pt(&mut h, (160.0, 100.0), (260.0, 40.0));
+    assert_eq!(fill_of(&h, 1), None);
+
+    // Properties ▸ Fill colour changes an existing one, as one undo step.
+    h.state_mut().open_comment_props(0, 0);
+    h.run_steps(2);
+    h.get_by_label("Rectangle Properties");
+    h.get_by_label("Fill colour");
+    assert_eq!(h.state().comment_props.as_ref().unwrap().original.fill, Some([1.0, 0.5, 0.0]));
+    h.get_by_label("No fill").click();
+    h.run_steps(2);
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(fill_of(&h, 0), None);
+    let undo = h.state().session.get(h.state().views[0].id).unwrap().can_undo().map(str::to_owned);
+    assert_eq!(undo.as_deref(), Some("Change comment properties"));
+    h.state_mut().open_comment_props(0, 1);
+    h.run_steps(2);
+    h.state_mut().comment_props.as_mut().expect("open").edited.fill = Some([0.0, 0.0, 1.0]);
+    h.get_by_label("OK").click();
+    h.run_steps(3);
+    assert_eq!(fill_of(&h, 1), Some([0.0, 0.0, 1.0]));
+    // Make Current Properties Default carries the fill into the tool.
+    h.state_mut().make_comment_default(0, 1);
+    assert_eq!(h.state().comment_prefs.style(CommentTool::Rectangle).fill, Some([0.0, 0.0, 1.0]));
+}
+
 #[test]
 fn the_panel_filters_and_sorts() {
     let mut h = harness(|app| {
diff --git a/crates/ui-egui/tests/create.rs b/crates/ui-egui/tests/create.rs
index f8f0e3392..ee81616b5 100644
--- a/crates/ui-egui/tests/create.rs
+++ b/crates/ui-egui/tests/create.rs
@@ -69,17 +69,13 @@ fn opening_images_and_text_converts_them_to_new_pdfs() {
     assert!(app.open_bytes("junk.png", None, b"\x89PNG\r\n\x1a\nnot really".to_vec()).is_err());
 }
 
-#[test]
-fn reduce_file_size_writes_a_compact_copy() {
-    use egui_kittest::Harness;
-    let dir = std::env::temp_dir().join(format!("pdfcraft-reduce-{}", std::process::id()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let out = dir.join("reduced.pdf");
-    let out2 = out.clone();
-    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
+/// Open `name` and run Reduce File Size on it, saving to `out` without a dialog.
+fn reduce(name: &'static str, bytes: Vec<u8>, out: &std::path::Path) -> egui_kittest::Harness<'static, PdfCraftApp> {
+    let out2 = out.to_path_buf();
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(move |_cc| {
         let mut app = PdfCraftApp::new();
         app.set_option("language", "en").unwrap();
-        app.open_bytes("notes.txt", None, "lorem ipsum ".repeat(500).into_bytes()).unwrap();
+        app.open_bytes(name, None, bytes).unwrap();
         app.save_override = Some(out2.to_string_lossy().into_owned());
         app
     });
@@ -87,15 +83,49 @@ fn reduce_file_size_writes_a_compact_copy() {
     assert!(h.state_mut().execute("optimize.reduce"));
     // It runs on a worker thread like the PDF Optimizer, with the progress card meanwhile.
     let start = std::time::Instant::now();
-    while (h.state().optimize_run.is_some() || !out.exists()) && start.elapsed() < std::time::Duration::from_secs(30) {
+    while h.state().optimize_run.is_some() && start.elapsed() < std::time::Duration::from_secs(30) {
         h.run_steps(1);
         std::thread::sleep(std::time::Duration::from_millis(10));
     }
-    h.run_steps(1);
+    h.run_steps(2);
     assert!(h.state().optimize_run.is_none() && h.state().progress_notice.is_none(), "the run finished");
+    h
+}
+
+#[test]
+fn reduce_file_size_writes_a_compact_copy() {
+    use egui_kittest::kittest::Queryable;
+    // A photo-like picture, stored losslessly: Reduce recompresses it as JPEG.
+    let (w, h) = (600u32, 400u32);
+    let px: Vec<u8> = (0..w * h).flat_map(|i| [(i % w * 255 / w) as u8 ^ (i & 7) as u8, (i / w * 255 / h) as u8, 128]).collect();
+    let mut photo = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut photo, w, h);
+        enc.set_color(png::ColorType::Rgb);
+        enc.set_depth(png::BitDepth::Eight);
+        enc.write_header().unwrap().write_image_data(&px).unwrap();
+    }
+    let dir = std::env::temp_dir().join(format!("pdfcraft-reduce-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let out = dir.join("reduced.pdf");
+    let h = reduce("photo.png", photo, &out);
     let bytes = std::fs::read(&out).unwrap();
     assert!(bytes.starts_with(b"%PDF-"));
+    assert!(bytes.len() < h.state().session.docs()[0].bytes.len(), "the copy is smaller");
     assert!(h.state().session.docs()[0].dirty, "the open document is unchanged");
+    h.get_by_label_contains("% smaller");
+}
+
+#[test]
+fn reduce_file_size_saves_nothing_when_the_file_is_already_small() {
+    use egui_kittest::kittest::Queryable;
+    let dir = std::env::temp_dir().join(format!("pdfcraft-reduce-small-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let out = dir.join("reduced.pdf");
+    // A new text PDF is already compact: a copy would be no smaller (#490).
+    let h = reduce("notes.txt", "lorem ipsum ".repeat(500).into_bytes(), &out);
+    assert!(!out.exists(), "no copy was written");
+    h.get_by_label_contains("This file is already as small as it can be made");
 }
 
 #[test]
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 2d080a429..518399f91 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -6,7 +6,7 @@ use egui::{Key, Modifiers};
 use egui_kittest::Harness;
 use egui_kittest::kittest::{NodeT, Queryable};
 use pdfcraft_render::{PageRenderer, RenderRequest, RequestKind};
-use pdfcraft_ui_egui::{CloseRequest, PdfCraftApp};
+use pdfcraft_ui_egui::{CloseRequest, Dialog, PdfCraftApp};
 
 /// An `n`-page document with a proper xref table; page `i` shows "Page i+1".
 fn fixture(n: usize) -> Vec<u8> {
@@ -356,6 +356,46 @@ fn the_save_prompt_answers_to_the_keyboard() {
     let _ = std::fs::remove_file(out);
 }
 
+#[test]
+fn keys_leave_the_document_under_a_dialog_alone() {
+    // Issue #870: ⌘W with Preferences open closed the file underneath it, and in the page grid
+    // Delete deleted the selected page. While a dialog is open its keys are its own.
+    let mut h = organize(3);
+    h.get_by_label("Page 2").click();
+    h.run_steps(2);
+    h.get_by_label("Rotate clockwise").click();
+    h.run_steps(3);
+    assert!(h.state_mut().execute("app.preferences"));
+    h.run_steps(3);
+    let shift = Modifiers::COMMAND | Modifiers::SHIFT;
+    for (m, key) in [
+        (Modifiers::COMMAND, Key::W),
+        (shift, Key::W),
+        (Modifiers::COMMAND, Key::Z),
+        (Modifiers::COMMAND, Key::D),
+        (Modifiers::COMMAND, Key::F),
+        (Modifiers::NONE, Key::Delete),
+        (Modifiers::NONE, Key::Backspace),
+    ] {
+        h.key_press_modifiers(m, key);
+        h.run_steps(3);
+        let app = h.state();
+        assert_eq!(app.views.len(), 1, "{m:?}+{key:?} closed the file");
+        assert!(app.close_request.is_none(), "{m:?}+{key:?} asked to close the file");
+        assert!(app.session.get(app.views[0].id).unwrap().can_undo().is_some(), "{m:?}+{key:?} undid the rotation");
+        assert!(app.views[0].find.is_none(), "{m:?}+{key:?} opened Find");
+        assert_eq!(app.dialog, Some(Dialog::Preferences), "{m:?}+{key:?} replaced Preferences");
+    }
+    assert_eq!(page_texts(h.state()), ["Page 1", "Page 2", "Page 3"], "a page was deleted under the dialog");
+    h.key_press(Key::Escape);
+    h.run_steps(3);
+    assert!(h.state().dialog.is_none(), "Escape closes Preferences");
+    assert_eq!(h.state().views[0].target_pages(), [1], "Escape went to the dialog, not the page selection");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::W);
+    h.run_steps(3);
+    assert!(h.state().close_request.is_some(), "with the dialog closed, ⌘W closes the file again");
+}
+
 #[test]
 fn clean_tabs_close_without_asking() {
     let mut h = harness(1, |_| {});
@@ -661,6 +701,7 @@ fn combining_files_opens_a_new_unsaved_tab() {
 #[test]
 fn combine_files_takes_chosen_pages_in_the_order_listed() {
     let mut h = harness(1, |app| {
+        app.set_option("combine-view", "list").unwrap();
         app.use_files(pdfcraft_ui_egui::FilePurpose::Combine, vec![("one.pdf".into(), fixture(3)), ("two.pdf".into(), fixture(2))]);
     });
     h.run_steps(3);
@@ -727,6 +768,7 @@ fn closing_the_combine_tab_forgets_its_list() {
 #[test]
 fn combine_lists_size_and_warns_before_combining() {
     let mut h = harness(1, |app| {
+        app.set_option("combine-view", "list").unwrap();
         app.use_files(
             pdfcraft_ui_egui::FilePurpose::Combine,
             vec![
@@ -792,9 +834,13 @@ fn combine_names(h: &Harness<'static, PdfCraftApp>) -> Vec<String> {
     h.state().combine_draft.iter().map(|f| f.name.clone()).collect()
 }
 
+/// Files in the Combine tab's list view (the table: headings, page ranges, row links).
 fn combine_of(names: &[(&str, usize)]) -> Harness<'static, PdfCraftApp> {
     let files: Vec<(String, Vec<u8>)> = names.iter().map(|(n, p)| (n.to_string(), fixture(*p))).collect();
-    let mut h = harness(1, move |app| app.use_files(pdfcraft_ui_egui::FilePurpose::Combine, files));
+    let mut h = harness(1, move |app| {
+        app.set_option("combine-view", "list").unwrap();
+        app.use_files(pdfcraft_ui_egui::FilePurpose::Combine, files);
+    });
     h.run_steps(3);
     h
 }
@@ -887,6 +933,7 @@ fn undo_and_redo_restore_the_combine_list() {
 #[test]
 fn protected_files_that_can_be_combined_are_flagged() {
     let mut h = harness(1, |app| {
+        app.set_option("combine-view", "list").unwrap();
         app.use_files(
             pdfcraft_ui_egui::FilePurpose::Combine,
             vec![("one.pdf".into(), fixture(1)), ("no-copy.pdf".into(), protected("", "owner", -1 ^ 16))],
@@ -1380,6 +1427,28 @@ fn split_dialog_writes_one_file_per_part() {
     let _ = std::fs::remove_dir_all(dir);
 }
 
+#[test]
+fn split_at_bookmarks_with_equal_titles_keeps_every_part() {
+    let dir = temp_path("split-dup-titles");
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let mut h = organize(3);
+    h.state_mut().export_dir_override = Some(dir.to_string_lossy().into_owned());
+    for (index, title) in [(0, "Same"), (1, "Same"), (2, "same")] {
+        h.state_mut().apply_edit(pdfcraft_engine::Edit::AddBookmark { parent: vec![], index, title: title.into(), page: index });
+    }
+    h.state_mut().split_draft.mode = pdfcraft_ui_egui::SplitMode::Bookmarks;
+    h.state_mut().run_command("page.split");
+    h.run_steps(3);
+    h.get_by_label_contains("Creates 3 files from 3 pages");
+    h.get_by_label("Split").click();
+    h.run_steps(3);
+    let mut names: Vec<String> = std::fs::read_dir(&dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+    names.sort();
+    assert_eq!(names, ["doc - Same (2).pdf", "doc - Same.pdf", "doc - same (3).pdf"]);
+    let _ = std::fs::remove_dir_all(dir);
+}
+
 #[test]
 fn split_before_selected_pages() {
     let dir = temp_path("split-sel");
@@ -1445,6 +1514,35 @@ fn password_prompt_opens_and_security_tab_reports_the_details() {
     h.get_by_label("User password");
 }
 
+/// #785: the notice's message used to be laid out before its buttons, so in a narrow document
+/// area (a side panel open) it ran under "Security settings" and on into the panel, and it sat
+/// off the buttons' centre line.
+#[test]
+fn the_security_notice_wraps_beside_its_buttons_and_lines_up_with_them() {
+    // Wide: one line. Narrower: wrapped. Narrowest: cut short (the full text is on hover).
+    for (width, wraps) in [(1700.0, false), (1250.0, true), (900.0, false)] {
+        let mut h = Harness::builder().with_size(egui::vec2(width, 800.0)).build_eframe(|_cc| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.open_bytes("locked.pdf", None, protected("", "owner", 0b0100)).unwrap();
+            app.set_option("panel", "bookmarks").unwrap();
+            app
+        });
+        h.run_steps(4);
+        let msg = h.get_by_label_contains("This document is secured").rect();
+        let button = h.get_by_label("Security settings").rect();
+        let dismiss = h.get_by_label("Dismiss").rect();
+        assert!(msg.right() <= button.left() + 0.5, "{width}: the message stops before the buttons: {msg:?} vs {button:?}");
+        assert!(button.right() <= dismiss.left() + 0.5, "{width}: {button:?} vs {dismiss:?}");
+        assert!((button.center().y - dismiss.center().y).abs() <= 0.5, "{width}: the buttons share a centre line");
+        assert!(msg.top() >= button.top(), "{width}: the message stays inside the bar: {msg:?} vs {button:?}");
+        let lines = (msg.height() / 14.0).floor().max(1.0);
+        let first_line = msg.top() + msg.height() / lines / 2.0;
+        assert!((first_line - button.center().y).abs() <= 1.5, "{width}: first line centred on the buttons: {msg:?} vs {button:?}");
+        assert_eq!(msg.height() > button.height(), wraps, "{width}: {msg:?}");
+    }
+}
+
 #[test]
 fn restricted_documents_show_a_notice_and_block_page_changes() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
@@ -2135,3 +2233,24 @@ fn the_delete_key_deletes_pages_picked_in_the_pages_panel_but_never_every_page()
     assert_eq!(page_texts(h.state()), ["Page 1"]);
     assert_eq!(h.state().views[0].current, 0);
 }
+
+#[test]
+fn host_dirty_hears_when_unsaved_work_appears_and_goes() {
+    let reports = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
+    let sink = reports.clone();
+    let mut h = harness(2, move |app| {
+        app.set_option("organize", "on").unwrap();
+        app.host_dirty = Some(Box::new(move |dirty| sink.lock().unwrap().push(dirty)));
+    });
+    assert_eq!(reports.lock().unwrap().last(), Some(&false), "a freshly opened document has nothing unsaved");
+    h.get_by_label("Rotate clockwise").click();
+    h.run_steps(3);
+    assert_eq!(reports.lock().unwrap().last(), Some(&true), "an edit is unsaved work");
+
+    let out = temp_path("host-dirty.pdf");
+    h.state_mut().save_override = Some(out.to_string_lossy().into_owned());
+    h.key_press_modifiers(Modifiers::COMMAND, Key::S);
+    h.run_steps(3);
+    assert_eq!(reports.lock().unwrap().last(), Some(&false), "saving clears it");
+    let _ = std::fs::remove_file(out);
+}
diff --git a/crates/ui-egui/tests/fill_sign.rs b/crates/ui-egui/tests/fill_sign.rs
index 96df83af2..2b447df63 100644
--- a/crates/ui-egui/tests/fill_sign.rs
+++ b/crates/ui-egui/tests/fill_sign.rs
@@ -124,6 +124,39 @@ fn text_marks_and_date() {
     assert!(v.iter().any(|(t, _)| t == "Stamp"));
 }
 
+/// The open type box, found as the focused text input.
+fn type_box_rect(h: &Harness<'static, PdfCraftApp>) -> egui::Rect {
+    h.query_all_by_role(egui::accesskit::Role::TextInput).find(|n| n.is_focused()).expect("an open type box").rect()
+}
+
+#[test]
+fn clicking_elsewhere_with_add_text_keeps_the_typed_text() {
+    let mut h = harness();
+    h.state_mut().execute("sign.fill.text");
+    click(&mut h, 50.0, 250.0);
+    h.event(egui::Event::Text("Ada Lovelace".into()));
+    h.run_steps(1);
+    // Still on Add text: the next click starts a new box, and must keep the first one.
+    click(&mut h, 50.0, 150.0);
+    h.run_steps(2);
+    let v = items(&h);
+    assert_eq!(v, vec![("FreeText".to_string(), Some("Ada Lovelace".to_string()))]);
+    assert!(h.state().views[0].fill_text.as_ref().is_some_and(|t| t.text.is_empty()), "a new, empty box is open");
+}
+
+#[test]
+fn the_type_box_grows_as_text_is_typed() {
+    let mut h = harness();
+    h.state_mut().execute("sign.fill.text");
+    click(&mut h, 50.0, 250.0);
+    h.run_steps(2);
+    let empty = type_box_rect(&h).width();
+    h.event(egui::Event::Text("Ada Lovelace, Countess of Lovelace".into()));
+    h.run_steps(3);
+    let full = type_box_rect(&h).width();
+    assert!(full > empty * 2.0, "the box widens with its text: {empty} -> {full}");
+}
+
 #[test]
 fn signing_draws_a_signature_once_and_places_it() {
     let mut h = harness();
@@ -1016,3 +1049,189 @@ fn drawn_and_typed_signatures_stay_upright_on_rotated_pages() {
         assert!(differ * 10 < ink, "rotation {rotation}: {differ} of {ink} ink pixels differ from the unturned page");
     }
 }
+
+/// Press, move in steps and release, from one user-space point to another.
+fn drag(h: &mut Harness<'static, PdfCraftApp>, from: (f32, f32), to: (f32, f32)) {
+    let (a, b) = (at(h, from.0, from.1), at(h, to.0, to.1));
+    h.hover_at(a);
+    h.run_steps(1);
+    h.drag_at(a);
+    h.run_steps(1);
+    for k in 1..=5 {
+        h.hover_at(a + (b - a) * (k as f32 / 5.0));
+        h.run_steps(1);
+    }
+    h.drop_at(b);
+    h.run_steps(4);
+}
+
+fn rects(h: &Harness<'static, PdfCraftApp>) -> Vec<[f32; 4]> {
+    let s = h.state();
+    s.session.get(s.views[0].id).unwrap().info.annotations.iter().map(|a| a.rect).collect()
+}
+
+/// A placed signature moves while a Fill & Sign tool is still active (as in Acrobat), instead of
+/// the drag doing nothing and a click stamping another mark on top of it. Elsewhere on the page
+/// the tool still places its mark.
+#[test]
+fn fill_and_sign_tools_pick_up_placed_marks_to_move_and_resize_them() {
+    for tool in ["sign.fill.signature", "sign.fill.initials", "sign.fill.text", "sign.fill.check", "sign.fill.date"] {
+        let mut h = harness();
+        h.state_mut().signature = Some(SavedSig::Typed("Ada Lovelace".into()));
+        h.state_mut().initials = Some(SavedSig::Typed("AL".into()));
+        h.state_mut().execute("sign.fill.signature");
+        click(&mut h, 40.0, 250.0);
+        let [placed] = rects(&h)[..] else { panic!("one signature: {:?}", rects(&h)) };
+        assert!(h.state_mut().execute(tool));
+        h.run_steps(2);
+        let mid = ((placed[0] + placed[2]) / 2.0, (placed[1] + placed[3]) / 2.0);
+        h.hover_at(at(&h, mid.0, mid.1));
+        h.run_steps(2);
+        assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Move, "{tool}: a placed mark can be picked up");
+
+        drag(&mut h, mid, (mid.0 + 40.0, mid.1 - 60.0));
+        assert!(matches!(h.state().quick_tool, QuickTool::Fill(_)), "{tool}: the tool stays");
+        let moved = [placed[0] + 40.0, placed[1] - 60.0, placed[2] + 40.0, placed[3] - 60.0];
+        let [now] = rects(&h)[..] else { panic!("{tool}: still one mark: {:?}", rects(&h)) };
+        assert_rect(now, moved);
+        let doc = h.state().session.get(h.state().views[0].id).unwrap();
+        assert_eq!(doc.can_undo(), Some("Move comment"), "{tool}");
+        assert_eq!(h.state().views[0].comments.selected, Some((0, 0)), "{tool}");
+
+        // The selected signature's handle resizes it.
+        let corner = at(&h, moved[2], moved[1]);
+        h.hover_at(corner);
+        h.run_steps(2);
+        h.drag_at(corner);
+        h.run_steps(1);
+        h.hover_at(corner + egui::vec2(30.0, 10.0));
+        h.run_steps(2);
+        h.drop_at(corner + egui::vec2(30.0, 10.0));
+        h.run_steps(3);
+        assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().can_undo(), Some("Resize comment"), "{tool}");
+        assert_eq!(rects(&h).len(), 1, "{tool}");
+
+        // A click on it selects it rather than placing another mark on top.
+        h.state_mut().views[0].comments.selected = None;
+        let r = rects(&h)[0];
+        click(&mut h, (r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+        assert_eq!(rects(&h).len(), 1, "{tool}: no mark stamped on the signature");
+        assert_eq!(h.state().views[0].comments.selected, Some((0, 0)), "{tool}");
+        assert!(h.state().views[0].fill_text.is_none(), "{tool}: no text box opened on the signature");
+    }
+    // A drawn signature in a saved and reopened file (read by the viewer, not the editor).
+    let mut h = harness();
+    h.state_mut().signature = Some(SavedSig::Drawn(vec![vec![[0.05, 0.1], [0.3, 0.2], [0.55, 0.05], [0.95, 0.15]]]));
+    h.state_mut().execute("sign.fill.signature");
+    click(&mut h, 40.0, 250.0);
+    let saved = h.state().session.save_bytes(h.state().views[0].id).unwrap();
+    let mut h = harness_bytes(&saved);
+    let [placed] = rects(&h)[..] else { panic!("one signature: {:?}", rects(&h)) };
+    h.state_mut().execute("sign.fill.check");
+    let mid = ((placed[0] + placed[2]) / 2.0, (placed[1] + placed[3]) / 2.0);
+    drag(&mut h, mid, (mid.0 + 40.0, mid.1 - 60.0));
+    assert_rect(rects(&h)[0], [placed[0] + 40.0, placed[1] - 60.0, placed[2] + 40.0, placed[3] - 60.0]);
+
+    // Away from Fill & Sign marks, the tool still places (checks stay repeatable), also on other
+    // comments.
+    let mut h = harness();
+    h.state_mut().signature = Some(SavedSig::Typed("Ada Lovelace".into()));
+    h.state_mut().execute("sign.fill.signature");
+    click(&mut h, 40.0, 250.0);
+    let id = h.state().views[0].id;
+    let square = pdfcraft_engine::Shape::Rectangle { rect: [100.0, 80.0, 200.0, 140.0] };
+    let style = pdfcraft_engine::Style::default_for(&square);
+    let new = pdfcraft_engine::NewAnnotation { page: 0, shape: square, style, contents: String::new(), author: "Ada".into() };
+    h.state_mut().session.apply(id, pdfcraft_engine::Edit::AddAnnotation(new)).unwrap();
+    h.run_steps(2);
+    h.state_mut().execute("sign.fill.check");
+    click(&mut h, 60.0, 100.0);
+    click(&mut h, 150.0, 110.0);
+    assert_eq!(items(&h).len(), 4, "{:?}", items(&h));
+    assert_eq!(h.state().quick_tool, QuickTool::Fill(FillTool::Check));
+}
+
+/// A drawn signature resizes from its handles like typed and image ones: the corners keep its
+/// shape, the strokes scale with it, and the size survives undo, redo and saving.
+#[test]
+fn drawn_signatures_resize_from_their_corners() {
+    let mut h = harness();
+    h.state_mut().signature = Some(SavedSig::Drawn(vec![vec![[0.05, 0.1], [0.3, 0.2], [0.55, 0.05], [0.95, 0.15]]]));
+    h.state_mut().execute("sign.fill.signature");
+    click(&mut h, 40.0, 250.0);
+    let [placed] = rects(&h)[..] else { panic!("one signature: {:?}", rects(&h)) };
+    assert_eq!(h.state().quick_tool, QuickTool::Select);
+    assert_eq!(h.state().views[0].comments.selected, Some((0, 0)), "the placed signature is selected");
+
+    // The top-right corner handle, dragged out and a little up.
+    let corner = at(&h, placed[2], placed[3]);
+    h.hover_at(corner);
+    h.run_steps(2);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::ResizeNeSw);
+    h.drag_at(corner);
+    h.run_steps(1);
+    for k in 1..=10 {
+        h.hover_at(corner + egui::vec2(6.0 * k as f32, -(k as f32)));
+        h.run_steps(1);
+    }
+    h.drop_at(corner + egui::vec2(60.0, -10.0));
+    h.run_steps(4);
+    let doc = h.state().session.get(h.state().views[0].id).unwrap();
+    assert_eq!(doc.can_undo(), Some("Resize comment"));
+    let [now] = rects(&h)[..] else { panic!("still one signature: {:?}", rects(&h)) };
+    let ratio = |r: [f32; 4]| (r[2] - r[0]) / (r[3] - r[1]);
+    assert!(now[2] - now[0] > placed[2] - placed[0] + 20.0, "wider: {placed:?} -> {now:?}");
+    assert!((ratio(now) - ratio(placed)).abs() < 0.02 * ratio(placed), "same shape: {placed:?} -> {now:?}");
+    assert!((now[0] - placed[0]).abs() < 0.01 && (now[1] - placed[1]).abs() < 0.01, "the opposite corner stays put");
+
+    let id = h.state().views[0].id;
+    h.state_mut().session.undo(id).unwrap();
+    assert_rect(rects(&h)[0], placed);
+    h.state_mut().session.redo(id).unwrap();
+    assert_rect(rects(&h)[0], now);
+    let saved = h.state().session.save_bytes(id).unwrap();
+    let h = harness_bytes(&saved);
+    assert_rect(rects(&h)[0], now);
+}
+
+/// A signature placed over a form field is picked up by the Select tool: the field under it
+/// doesn't take the press. Away from the signature, a click still fills the field.
+#[test]
+fn select_tool_picks_up_a_signature_over_a_form_field() {
+    let mut h = harness_bytes(include_bytes!("data/form.pdf"));
+    h.state_mut().signature = Some(SavedSig::Typed("Ada Lovelace".into()));
+    h.state_mut().execute("sign.fill.signature");
+    click(&mut h, 150.0, 270.0);
+    let [placed] = rects(&h)[..] else { panic!("one signature: {:?}", rects(&h)) };
+    // Onto the `city` text field (user space y 180..200).
+    let mid_y = (placed[1] + placed[3]) / 2.0;
+    let id = h.state().views[0].id;
+    let index = h.state().session.get(id).unwrap().info.annotations[0].index;
+    let dy = (190.0 - mid_y) as f64;
+    h.state_mut().session.apply(id, pdfcraft_engine::Edit::MoveAnnotation { page: 0, index, dx: 0.0, dy }).unwrap();
+    h.state_mut().views[0].comments.selected = None;
+    h.state_mut().quick_tool = QuickTool::Select;
+    h.run_steps(3);
+    let [over] = rects(&h)[..] else { panic!("one signature: {:?}", rects(&h)) };
+    let mid = ((over[0] + over[2]) / 2.0, (over[1] + over[3]) / 2.0);
+
+    h.hover_at(at(&h, mid.0, mid.1));
+    h.run_steps(2);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Move);
+    // A hand's drag: a few points per frame, so it starts while still over the field.
+    let (a, b) = (at(&h, mid.0, mid.1), at(&h, mid.0, mid.1 + 80.0));
+    h.drag_at(a);
+    h.run_steps(1);
+    for k in 1..=40 {
+        h.hover_at(a + (b - a) * (k as f32 / 40.0));
+        h.run_steps(1);
+    }
+    h.drop_at(b);
+    h.run_steps(4);
+    assert_rect(rects(&h)[0], [over[0], over[1] + 80.0, over[2], over[3] + 80.0]);
+    assert!(h.state().views[0].forms.focus.is_none(), "the field under the signature isn't focused");
+
+    // Clear of the signature, the field still takes the click.
+    click(&mut h, 270.0, 190.0);
+    assert_eq!(h.state().views[0].forms.focus.as_ref().map(|f| f.name.as_str()), Some("city"));
+}
diff --git a/crates/ui-egui/tests/object_selection.rs b/crates/ui-egui/tests/object_selection.rs
new file mode 100644
index 000000000..343483378
--- /dev/null
+++ b/crates/ui-egui/tests/object_selection.rs
@@ -0,0 +1,383 @@
+//! Multi-object editing through the real shell. Synthetic artwork and standard-font text only.
+use egui::{Key, Modifiers, Pos2};
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_engine::{AddedText, Edit, EditableObject};
+use pdfcraft_ui_egui::PdfCraftApp;
+
+fn fixture(clipping: bool) -> Vec<u8> {
+    fixture_with_background(clipping, false)
+}
+
+fn fixture_with_background(clipping: bool, background: bool) -> Vec<u8> {
+    let stream = |body: &str, dict: &str| format!("<< {dict} /Length {} >>\nstream\n{body}\nendstream", body.len());
+    let mut objects = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 400 500] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Figure 6 0 R >> >> >>"
+            .into(),
+        stream(
+            &format!(
+                "{}q BT {} Tr /F1 18 Tf 40 430 Td (Group headline) Tj ET Q q 1 0 0 1 40 340 cm /Figure Do Q BT /F1 12 Tf 240 90 Td (Keep here) Tj ET",
+                if background { "q /Background Do Q " } else { "" },
+                if clipping { 4 } else { 0 }
+            ),
+            "",
+        ),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        stream("1 0.2 0.1 rg 0 0 60 30 re f", "/Type /XObject /Subtype /Form /BBox [0 0 60 30]"),
+    ];
+    if background {
+        objects[2] = objects[2].replace("/Figure 6 0 R", "/Figure 6 0 R /Background 7 0 R");
+        objects.push(stream("1 1 1 rg 0 0 400 500 re f", "/Type /XObject /Subtype /Form /BBox [0 0 400 500]"));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        out.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    out
+}
+
+fn harness() -> Harness<'static, PdfCraftApp> {
+    harness_with(false)
+}
+
+fn harness_with(clipping: bool) -> Harness<'static, PdfCraftApp> {
+    harness_document(clipping, false)
+}
+
+fn harness_document(clipping: bool, background: bool) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.session = pdfcraft_engine::Session::new().with_clock(|| 1_700_000_000);
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("group.pdf", None, fixture_with_background(clipping, background)).unwrap();
+        let id = app.views[0].id;
+        app.session
+            .apply(
+                id,
+                Edit::AddText { page: 0, text: AddedText { text: "Added note".into(), rect: [130.0, 340.0, 230.0, 370.0], ..Default::default() } },
+            )
+            .unwrap();
+        let saved = app.session.save_bytes(id).unwrap();
+        app.session.mark_saved(id, saved, None).unwrap();
+        app.set_option("zoom", "100").unwrap();
+        assert!(app.execute("edit.edit_text"));
+        app
+    });
+    for _ in 0..60 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    h
+}
+
+fn at(h: &Harness<'static, PdfCraftApp>, x: f32, y: f32) -> Pos2 {
+    let r = h.state().views[0].page_screen_rect(0).unwrap();
+    r.min + egui::vec2(x, y) * (r.width() / 400.0)
+}
+fn objects(h: &Harness<'static, PdfCraftApp>) -> Vec<EditableObject> {
+    let app = h.state();
+    app.session.get(app.views[0].id).unwrap().editable_objects(0).unwrap()
+}
+fn click(h: &mut Harness<'static, PdfCraftApp>, p: Pos2, mods: Modifiers) {
+    h.hover_at(p);
+    h.run_steps(2);
+    for pressed in [true, false] {
+        h.event_modifiers(egui::Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed, modifiers: mods }, mods);
+    }
+    h.run_steps(4);
+}
+fn marquee(h: &mut Harness<'static, PdfCraftApp>) {
+    let (a, b) = (at(h, 25.0, 45.0), at(h, 235.0, 175.0));
+    h.hover_at(a);
+    h.run_steps(2);
+    h.drag_at(a);
+    h.run_steps(2);
+    h.hover_at(b);
+    h.run_steps(2);
+    h.drop_at(b);
+    h.run_steps(4);
+    h.get_by_label("3 objects selected");
+}
+fn drag(h: &mut Harness<'static, PdfCraftApp>, a: Pos2, b: Pos2) {
+    h.hover_at(a);
+    h.run_steps(2);
+    h.drag_at(a);
+    h.run_steps(2);
+    h.hover_at(b);
+    h.run_steps(2);
+    h.drop_at(b);
+    h.run_steps(4);
+}
+
+#[test]
+fn marquee_and_mixed_group_drag_move_once_and_undo_together() {
+    let mut h = harness();
+    let before = objects(&h);
+    marquee(&mut h);
+    let (a, b) = (at(&h, 55.0, 70.0), at(&h, 80.0, 100.0));
+    drag(&mut h, a, b);
+    let after = objects(&h);
+    for old in &before {
+        let new = after.iter().find(|o| o.target == old.target).unwrap();
+        let shift = if old.text.as_deref() == Some("Keep here") { [0.0, 0.0] } else { [25.0, -30.0] };
+        for i in 0..4 {
+            assert!((new.rect[i] - old.rect[i] - shift[i % 2]).abs() < 0.01, "{old:?} -> {new:?}");
+        }
+    }
+    h.get_by_label("3 objects selected");
+    let app = h.state();
+    assert_eq!(app.session.get(app.views[0].id).unwrap().can_undo(), Some("Move objects"));
+    if let Ok(path) = std::env::var("PDFCRAFT_GROUP_SHOT") {
+        h.render().unwrap().save(path).unwrap();
+    }
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    assert_eq!(objects(&h), before);
+    h.get_by_label("Shift-click to select several objects. Drag empty space to select an area.");
+    h.key_press_modifiers(Modifiers::COMMAND | Modifiers::SHIFT, Key::Z);
+    h.run_steps(4);
+    assert_eq!(objects(&h), after);
+}
+
+#[test]
+fn modifier_clicks_extend_an_ordinary_selection_and_toggle_objects() {
+    let mut h = harness();
+    let p = at(&h, 55.0, 70.0);
+    click(&mut h, p, Modifiers::NONE);
+    assert!(h.state().views[0].line_editor.is_some());
+    let p = at(&h, 60.0, 145.0);
+    click(&mut h, p, Modifiers::SHIFT);
+    h.get_by_label("2 objects selected");
+    assert!(h.state().views[0].line_editor.is_none());
+    let p = at(&h, 155.0, 140.0);
+    click(&mut h, p, Modifiers::COMMAND);
+    h.get_by_label("3 objects selected");
+    let p = at(&h, 60.0, 145.0);
+    click(&mut h, p, Modifiers::CTRL);
+    h.get_by_label("2 objects selected");
+    assert!(!h.state().session.get(h.state().views[0].id).unwrap().dirty);
+    h.key_press(Key::Escape);
+    h.run_steps(3);
+    h.get_by_label("Shift-click to select several objects. Drag empty space to select an area.");
+}
+
+#[test]
+fn escaping_a_group_drag_and_switching_tools_do_not_edit() {
+    let mut h = harness();
+    let before = objects(&h);
+    marquee(&mut h);
+    let (a, b) = (at(&h, 55.0, 70.0), at(&h, 90.0, 110.0));
+    h.hover_at(a);
+    h.run_steps(2);
+    h.drag_at(a);
+    h.run_steps(2);
+    h.hover_at(b);
+    h.run_steps(2);
+    assert_eq!(objects(&h), before, "only a preview while held");
+    h.key_press(Key::Escape);
+    h.run_steps(2);
+    h.drop_at(b);
+    h.run_steps(4);
+    assert_eq!(objects(&h), before);
+    marquee(&mut h);
+    assert!(h.state_mut().execute("edit.text"));
+    h.run_steps(4);
+    assert_eq!(objects(&h), before);
+}
+
+#[test]
+fn a_changed_text_editor_is_kept_when_group_selection_is_requested() {
+    let mut h = harness();
+    let before = objects(&h);
+    let p = at(&h, 55.0, 70.0);
+    click(&mut h, p, Modifiers::NONE);
+    h.state_mut().views[0].line_editor.as_mut().unwrap().text = "A draft still being edited".into();
+    let p = at(&h, 60.0, 145.0);
+    click(&mut h, p, Modifiers::SHIFT);
+    assert_eq!(h.state().views[0].line_editor.as_ref().unwrap().text, "A draft still being edited");
+    assert_eq!(objects(&h), before);
+}
+
+#[test]
+fn a_document_change_invalidates_old_selection_before_the_next_drag() {
+    let mut h = harness();
+    marquee(&mut h);
+    let id = h.state().views[0].id;
+    h.state_mut()
+        .session
+        .apply(id, Edit::AddText { page: 0, text: AddedText { text: "A new item".into(), rect: [40.0, 210.0, 150.0, 240.0], ..Default::default() } })
+        .unwrap();
+    h.run_steps(4);
+    h.get_by_label("Shift-click to select several objects. Drag empty space to select an area.");
+    assert_eq!(objects(&h).len(), 5);
+}
+
+#[test]
+fn refusing_one_object_keeps_the_whole_group_and_its_selection() {
+    let mut h = harness_with(true);
+    let before = objects(&h);
+    marquee(&mut h);
+    let (a, b) = (at(&h, 55.0, 70.0), at(&h, 80.0, 100.0));
+    drag(&mut h, a, b);
+    assert_eq!(objects(&h), before);
+    h.get_by_label("3 objects selected");
+    assert!(h.state().toast.as_ref().unwrap().0.contains("Text used as a clipping path cannot be moved with this selection."));
+    assert!(!h.state().session.get(h.state().views[0].id).unwrap().dirty);
+}
+
+#[test]
+fn a_group_drag_released_beyond_the_page_finishes_once() {
+    let mut h = harness();
+    let before = objects(&h);
+    marquee(&mut h);
+    let (a, b) = (at(&h, 55.0, 70.0), at(&h, 415.0, 100.0));
+    drag(&mut h, a, b);
+    let after = objects(&h);
+    for (old, new) in before.iter().zip(&after) {
+        let delta = if old.text.as_deref() == Some("Keep here") { 0.0 } else { 360.0 };
+        assert!((new.rect[0] - old.rect[0] - delta).abs() < 0.01);
+    }
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(4);
+    assert_eq!(objects(&h), before);
+}
+
+#[test]
+fn group_selection_can_be_extended_by_an_additive_marquee() {
+    let mut h = harness();
+    let p = at(&h, 55.0, 70.0);
+    click(&mut h, p, Modifiers::SHIFT);
+    h.get_by_label("1 object selected");
+    let (a, b) = (at(&h, 25.0, 120.0), at(&h, 235.0, 175.0));
+    h.hover_at(a);
+    h.run_steps(2);
+    h.event_modifiers(
+        egui::Event::PointerButton { pos: a, button: egui::PointerButton::Primary, pressed: true, modifiers: Modifiers::SHIFT },
+        Modifiers::SHIFT,
+    );
+    h.run_steps(2);
+    h.hover_at(b);
+    h.run_steps(2);
+    h.drop_at(b);
+    h.run_steps(4);
+    h.get_by_label("3 objects selected");
+    assert!(!h.state().session.get(h.state().views[0].id).unwrap().dirty);
+}
+
+#[test]
+fn group_drag_respects_document_rotation_and_view_rotation() {
+    for document_rotation in [0, 90, 180, 270] {
+        let mut h = harness();
+        assert!(h.state_mut().apply_edit(Edit::RotatePages { pages: vec![0], degrees: document_rotation }));
+        h.state_mut().views[0].rotate_view(true);
+        h.run_steps(4);
+        let before = objects(&h);
+        let targets: Vec<_> = before.iter().filter(|o| o.text.as_deref() != Some("Keep here")).map(|o| o.target).collect();
+        for target in &targets {
+            let app = h.state();
+            let doc = app.session.get(app.views[0].id).unwrap();
+            let o = before.iter().find(|o| o.target == *target).unwrap();
+            let p = pdfcraft_ui_egui::canvas::PageXform {
+                rect: app.views[0].page_screen_rect(0).unwrap(),
+                rot: 90,
+                pw: doc.info.pages[0].width,
+                ph: doc.info.pages[0].height,
+            }
+            .user_rect(&doc.info, 0, o.rect.map(|v| v as f32))
+            .center();
+            click(&mut h, p, Modifiers::SHIFT);
+        }
+        h.get_by_label("3 objects selected");
+        let app = h.state();
+        let doc = app.session.get(app.views[0].id).unwrap();
+        let xf = pdfcraft_ui_egui::canvas::PageXform {
+            rect: app.views[0].page_screen_rect(0).unwrap(),
+            rot: 90,
+            pw: doc.info.pages[0].width,
+            ph: doc.info.pages[0].height,
+        };
+        let start =
+            xf.user_rect(&doc.info, 0, before.iter().find(|o| o.text.as_deref() == Some("Group headline")).unwrap().rect.map(|v| v as f32)).center();
+        let end = start + egui::vec2(21.0, 33.0);
+        let from = xf.screen_to_view(start);
+        let to = xf.screen_to_view(end);
+        let delta = doc.object_move_offset(0, [f64::from(to.0 - from.0), f64::from(to.1 - from.1)]).unwrap();
+        drag(&mut h, start, end);
+        for (old, new) in before.iter().zip(objects(&h)) {
+            let expected = if targets.contains(&old.target) { delta } else { [0.0, 0.0] };
+            for i in 0..4 {
+                assert!((new.rect[i] - old.rect[i] - expected[i % 2]).abs() < 0.01, "rotation {document_rotation}");
+            }
+        }
+    }
+}
+
+#[test]
+fn group_drags_cancel_on_focus_loss_tab_switch_home_and_modal_dialogs() {
+    for case in 0..5 {
+        let mut h = harness();
+        let before = objects(&h);
+        marquee(&mut h);
+        let (a, b) = (at(&h, 55.0, 70.0), at(&h, 90.0, 110.0));
+        h.hover_at(a);
+        h.run_steps(2);
+        h.drag_at(a);
+        h.run_steps(2);
+        h.hover_at(b);
+        h.run_steps(2);
+        match case {
+            0 => h.input_mut().focused = false,
+            1 => {
+                h.state_mut().open_bytes("other.pdf", None, fixture(false)).unwrap();
+            }
+            2 => h.state_mut().active = None,
+            3 => h.state_mut().dialog = Some(pdfcraft_ui_egui::Dialog::About),
+            _ => h.state_mut().request_document_url("https://example.invalid/", pdfcraft_ui_egui::LinkOrigin::Link),
+        }
+        h.run_steps(2);
+        h.drop_at(b);
+        h.run_steps(2);
+        h.input_mut().focused = true;
+        h.state_mut().active = Some(0);
+        h.state_mut().dialog = None;
+        h.state_mut().pending_link = None;
+        h.run_steps(4);
+        assert_eq!(objects(&h), before, "cancelled gesture case {case}");
+        assert!(!h.state().session.get(h.state().views[0].id).unwrap().dirty, "case {case}");
+        h.get_by_label("3 objects selected");
+    }
+}
+
+#[test]
+fn modifier_selection_picks_foreground_text_and_added_items_over_background_artwork() {
+    let mut h = harness_document(false, true);
+    let before = objects(&h);
+    assert_eq!(before.len(), 5);
+    for (x, y) in [(55.0, 70.0), (150.0, 135.0), (60.0, 145.0)] {
+        let p = at(&h, x, y);
+        click(&mut h, p, Modifiers::SHIFT);
+    }
+    h.get_by_label("3 objects selected");
+    let (a, b) = (at(&h, 55.0, 70.0), at(&h, 80.0, 100.0));
+    drag(&mut h, a, b);
+    let after = objects(&h);
+    for old in before {
+        let new = after.iter().find(|o| o.target == old.target).unwrap();
+        let stationary = old.text.as_deref() == Some("Keep here") || (old.target.kind == pdfcraft_engine::ObjectKind::Image && old.target.index == 0);
+        let shift = if stationary { [0.0, 0.0] } else { [25.0, -30.0] };
+        assert!(new.rect.iter().enumerate().all(|(i, value)| (value - old.rect[i] - shift[i % 2]).abs() < 0.01), "{old:?} -> {new:?}");
+    }
+}
diff --git a/crates/ui-egui/tests/recovery.rs b/crates/ui-egui/tests/recovery.rs
index 8cc9eebfc..8d25965ff 100644
--- a/crates/ui-egui/tests/recovery.rs
+++ b/crates/ui-egui/tests/recovery.rs
@@ -153,19 +153,24 @@ fn quitting_cleanly_leaves_nothing_behind() {
     assert_eq!(files_in(&s), 0);
 }
 
-#[test]
-fn encrypted_documents_are_autosaved_encrypted_and_recovered_with_the_password() {
-    let mut doc = pdfcraft_cos::Document::open(std::sync::Arc::new(fixture(2))).unwrap();
+/// `bytes` protected with an open password (AES-256).
+fn encrypted(bytes: Vec<u8>, password: &str) -> Vec<u8> {
+    let mut doc = pdfcraft_cos::Document::open(std::sync::Arc::new(bytes)).unwrap();
     doc.set_encryption(&pdfcraft_cos::NewEncryption {
         algorithm: pdfcraft_cos::Algorithm::Aes256,
-        user_password: "pw",
+        user_password: password,
         owner_password: "owner",
         permissions: -1,
         encrypt_metadata: true,
         seed: [2; 32],
     })
     .unwrap();
-    let bytes = pdfcraft_cos::write_full(&doc, &Default::default()).unwrap();
+    pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
+}
+
+#[test]
+fn encrypted_documents_are_autosaved_encrypted_and_recovered_with_the_password() {
+    let bytes = encrypted(fixture(2), "pw");
     let s = store("encrypted");
     crashed_session(&s, bytes, Some("pw"), None);
     let meta = s.list().remove(0);
@@ -190,6 +195,42 @@ fn encrypted_documents_are_autosaved_encrypted_and_recovered_with_the_password()
     let _ = Modifiers::NONE;
 }
 
+/// #813: cancelling the password prompt of a recovered snapshot must not hand its path and
+/// recovery entry to the next encrypted document that is unlocked (Save would then overwrite
+/// the snapshot's original file and delete the snapshot).
+#[test]
+fn a_cancelled_recovery_password_does_not_attach_to_the_next_unlocked_document() {
+    let s = store("cancelled");
+    crashed_session(&s, encrypted(fixture(2), "pw-a"), Some("pw-a"), Some("/docs/A.pdf"));
+    assert_eq!(s.list().len(), 1);
+    let mut h = harness(s.clone());
+    h.get_by_label("Recover").click();
+    h.run_steps(3);
+    assert!(h.state().password_prompt.is_some(), "the snapshot asks for its password");
+    h.get_by_label("Cancel").click();
+    h.run_steps(3);
+    assert!(h.state().password_prompt.is_none());
+    assert!(h.state().views.is_empty());
+
+    let app = h.state_mut();
+    app.open_bytes("B.pdf", Some("/docs/B.pdf".into()), encrypted(fixture(1), "pw-b")).unwrap();
+    app.submit_password(Some("pw-b".into()));
+    h.run_steps(3);
+    let app = h.state();
+    assert_eq!(app.views.len(), 1);
+    let b = app.session.get(app.views[0].id).unwrap();
+    assert_eq!(b.path.as_deref(), Some("/docs/B.pdf"), "B keeps its own path");
+    assert!(!b.dirty, "B is clean: it is not the recovered document");
+    assert_eq!(s.list().len(), 1, "A's snapshot is still in the store");
+    assert_eq!(app.recoverable.len(), 1, "and on offer again");
+
+    // Closing B (clean, so no prompt) must not remove A's snapshot either.
+    h.state_mut().execute("file.close");
+    h.run_steps(3);
+    assert!(h.state().views.is_empty());
+    assert_eq!(s.list().len(), 1, "A's snapshot survives closing B");
+}
+
 #[test]
 fn incomplete_entries_are_ignored_and_cleaned_up() {
     let s = store("partial");
diff --git a/crates/ui-egui/tests/signing.rs b/crates/ui-egui/tests/signing.rs
index 09c3246ed..516f84461 100644
--- a/crates/ui-egui/tests/signing.rs
+++ b/crates/ui-egui/tests/signing.rs
@@ -258,6 +258,7 @@ fn os_store_identities_are_not_persisted() {
             issuer: "Test issuer".into(),
             email: String::new(),
             expires: "2030.01.01".into(),
+            unusable: None,
         });
     }
     let saved = app.persist();
@@ -282,6 +283,7 @@ fn windows_store_identity_does_not_ask_for_a_file_password() {
         issuer: "Test issuer".into(),
         email: String::new(),
         expires: "2030.01.01".into(),
+        unusable: None,
     });
     let draft = h.state_mut().sign_draft.as_mut().unwrap();
     draft.step = SignStep::Choose;
@@ -311,6 +313,7 @@ fn long_digital_id_names_stay_inside_the_picker() {
         issuer: long,
         email: String::new(),
         expires: "2030.01.01".into(),
+        unusable: None,
     });
     h.state_mut().sign_draft.as_mut().unwrap().step = SignStep::Choose;
     h.run_steps(3);
@@ -334,3 +337,42 @@ fn long_digital_id_names_stay_inside_the_picker() {
         );
     }
 }
+
+/// A store certificate that can't sign is shown with its reason (so the user learns why an
+/// identity Acrobat lists is missing, issue #179) but is never selected or chosen.
+#[test]
+fn an_unusable_id_is_shown_with_its_reason_and_cannot_be_chosen() {
+    let mut h = harness(dir());
+    // Not a `windows:` path: those are replaced by the real store listing when signing starts.
+    h.state_mut().digital_ids.push(pdfcraft_ui_egui::DigitalIdEntry {
+        path: "store-test:broken".into(),
+        name: "Broken signer".into(),
+        issuer: String::new(),
+        email: String::new(),
+        expires: String::new(),
+        unusable: Some("its private key can't be opened: the key is missing from its key store (Windows error 0x80090016)".into()),
+    });
+    h.state_mut().start_signing(0, None, None, None);
+    h.run_steps(3);
+    let draft = h.state().sign_draft.as_ref().unwrap();
+    assert_eq!(draft.step, SignStep::Choose, "shown, with its reason, rather than skipped to Configure");
+    assert_eq!(draft.selected, None);
+    h.get_by_label("Broken signer").click();
+    h.run_steps(3);
+    assert_eq!(h.state().sign_draft.as_ref().unwrap().selected, None);
+    h.get_by_label("Continue").click();
+    h.run_steps(3);
+    assert_eq!(h.state().sign_draft.as_ref().unwrap().step, SignStep::Choose);
+    // A usable ID after it is the one selected to begin with.
+    h.state_mut().digital_ids.push(pdfcraft_ui_egui::DigitalIdEntry {
+        path: "store-test:fine".into(),
+        name: "Working signer".into(),
+        issuer: "Test issuer".into(),
+        email: String::new(),
+        expires: "2030.01.01".into(),
+        unusable: None,
+    });
+    h.state_mut().start_signing(0, None, None, None);
+    h.run_steps(3);
+    assert_eq!(h.state().sign_draft.as_ref().unwrap().selected, Some(1));
+}
diff --git a/crates/ui-egui/tests/ui.rs b/crates/ui-egui/tests/ui.rs
index 5dd4371f2..a10ad230f 100644
--- a/crates/ui-egui/tests/ui.rs
+++ b/crates/ui-egui/tests/ui.rs
@@ -511,6 +511,7 @@ fn pdfs_dropped_on_the_combine_tab_join_its_list() {
         app
     });
     h.run_steps(3);
+    h.state_mut().set_option("combine-view", "list").unwrap();
     h.state_mut().execute("page.combine");
     h.run_steps(2);
     // An absolute path is read from disk, with its modified time.
diff --git a/crates/ui-egui/tests/view.rs b/crates/ui-egui/tests/view.rs
index 222df48ad..bc216c235 100644
--- a/crates/ui-egui/tests/view.rs
+++ b/crates/ui-egui/tests/view.rs
@@ -214,6 +214,30 @@ fn wheel_turns_one_page_per_notch_and_per_trackpad_swipe() {
     assert_eq!(h.state().views[0].current, 1, "one swipe back turns one page back");
 }
 
+#[test]
+fn precise_touchpad_wheel_scrolls_one_to_one() {
+    // A precision touchpad's pixel delta scrolls the page by that amount in the same frame,
+    // instead of egui easing it over several frames so the page lags the finger (#759). A single
+    // 200 px precise event is well over egui's 8 px smoothing threshold, so without the fix only
+    // a fraction would land on the first frame.
+    let mut h = harness_stepping(1.0 / 60.0, &[("layout", "continuous"), ("zoom", "100")]);
+    let at = h.state().views[0].viewport_rect().center();
+    h.hover_at(at);
+    h.run_steps(2);
+    let before = rect(&h, 0).expect("page 1 on screen").min.y;
+    h.event(wheel(MouseWheelUnit::Point, -200.0, TouchPhase::Move));
+    // A few frames for the event to reach the ScrollArea and the new offset to be drawn. The
+    // page jumps the full 200 px at once; an eased path would ramp there over ~0.1 s (6 frames).
+    h.run_steps(4);
+    let moved = before - rect(&h, 0).expect("page 1 still laid out").min.y;
+    assert!(moved > 190.0, "a 200 px precise swipe scrolls ~200 px at once, not an eased fraction: moved {moved}");
+    // And it stops with the finger: idle frames must not drift on a leftover easing tail.
+    let settled = rect(&h, 0).unwrap().min.y;
+    h.run_steps(20);
+    let drift = settled - rect(&h, 0).unwrap().min.y;
+    assert!(drift.abs() < 2.0, "no easing tail after the swipe: drifted {drift}");
+}
+
 #[test]
 fn page_display_commands_switch_layouts() {
     let mut h = harness(&[]);
diff --git a/crates/ui-egui/tests/viewer.rs b/crates/ui-egui/tests/viewer.rs
index 46c04cc0f..e6465d2cb 100644
--- a/crates/ui-egui/tests/viewer.rs
+++ b/crates/ui-egui/tests/viewer.rs
@@ -130,6 +130,45 @@ fn view_history_select_all_and_find_options() {
     assert_eq!(h.state().views[0].find.as_ref().unwrap().matches.len(), 5);
 }
 
+#[test]
+fn find_shortcuts_advance_and_retreat_matches() {
+    let mut h = harness();
+    h.state_mut().active = Some(0);
+    h.run_steps(2);
+    h.state_mut().views[0].open_find();
+    h.state_mut().views[0].find.as_mut().unwrap().query = "page".into();
+    h.state_mut().views[0].rerun_find();
+    // Find runs in the background: wait by a deadline, not a frame count, which a loaded machine
+    // can use up before the last page is searched.
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(20);
+    while std::time::Instant::now() < deadline {
+        h.run_steps(2);
+        std::thread::sleep(std::time::Duration::from_millis(5));
+        if h.state().views[0].find.as_ref().unwrap().matches.len() >= 15 {
+            break;
+        }
+    }
+    let n = h.state().views[0].find.as_ref().unwrap().matches.len();
+    assert_eq!(n, 15);
+    // Surrender text edit focus so canvas shortcut handler receives key events.
+    h.state_mut().views[0].find.as_mut().unwrap().focus = false;
+    h.ctx.memory_mut(|m| m.surrender_focus(egui::Id::new("find-input")));
+    h.run_steps(2);
+    let start = h.state().views[0].find.as_ref().unwrap().current.unwrap();
+    // ⌘G advances to next match.
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::G);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].find.as_ref().unwrap().current, Some((start + 1) % n));
+    // ⇧⌘G retreats to previous match.
+    h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::G);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].find.as_ref().unwrap().current, Some(start));
+    // ⇧⌘G again wraps backwards.
+    h.key_press_modifiers(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT, egui::Key::G);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].find.as_ref().unwrap().current, Some((start + n - 1) % n));
+}
+
 #[test]
 fn layouts_fit_height_labels_and_system_theme() {
     use pdfcraft_ui_egui::canvas::{Fit, PageLayout};
diff --git a/crates/xfa/README.md b/crates/xfa/README.md
index c32f0df02..3008e3dea 100644
--- a/crates/xfa/README.md
+++ b/crates/xfa/README.md
@@ -23,7 +23,8 @@ the automation tools) works on it unchanged. The engine does this when it opens
   container without a width is as wide as its content; flow across content areas and pages with
   page masters chosen by occurrence; a table's header row repeats after a break; presence
   `hidden` takes no space, `invisible` takes space; repeating subforms get their initial
-  instances; fields that compute the page number or count on layout show the numbers.
+  instances, in flowed content and in a top-to-bottom container inside positioned content (a
+  table in an area) alike; fields that compute the page number or count on layout show the numbers.
 - **PDF** (`pdf::write_form`): pages with content streams in the standard 14 fonts (Arial and
   friends → Helvetica, Courier New → Courier, serif faces → Times; nothing is embedded), JPEG
   XObjects, and widgets: text (multi-line, max length, alignment), date (Acrobat's `AFDate`
@@ -34,7 +35,8 @@ the automation tools) works on it unchanged. The engine does this when it opens
   twice. The XFA packets stay, so Adobe's viewers keep rendering the form from them.
 
 - **Data** (`data`): the `datasets` packet. On layout, a field takes its value from the data
-  node at its SOM path (dates in ISO form, check and radio states by their on values), and a
+  node at its data path: its SOM path without areas, which are named in SOM expressions but are
+  not data scopes (`data_path`, as Adobe's viewers bind) (dates in ISO form, check and radio states by their on values), and a
   repeating subform or row gets as many instances as the data has. `write_datasets` merges the
   AcroForm fields' values (by `/PCSom`, or by the Designer field names of a static form) into
   the existing `xfa:data`: only the bound nodes' text changes and missing nodes are added, so
diff --git a/crates/xfa/src/data.rs b/crates/xfa/src/data.rs
index 78b0cc9e0..ac80d419b 100644
--- a/crates/xfa/src/data.rs
+++ b/crates/xfa/src/data.rs
@@ -4,13 +4,15 @@
 //!
 //! Binding is the default "normal" one: a field's data node is named after the field and nested
 //! under nodes named after its named ancestor subforms, repeated instances as repeated sibling
-//! elements. Explicit `bind ref` expressions are not followed.
+//! elements. Areas are named in SOM expressions but are not data scopes, so their contents bind
+//! under the area's parent ([`data_path`]). Explicit `bind ref` expressions are not followed.
 
 use std::collections::HashMap;
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
 
 use crate::XfaError;
+use crate::model::{Node, Template};
 use crate::packets::{Encoding, encode};
 
 const XFA_DATA_NS: &str = "http://www.xfa.org/schema/xfa-data/1.0/";
@@ -96,6 +98,62 @@ pub fn som_to_path(som: &str) -> DataPath {
         .collect()
 }
 
+/// The data path the object at `som` binds to: [`som_to_path`] without the areas on the way.
+/// An area is a named container in the form, so it is part of SOM expressions, but only
+/// subforms, exclusion groups and fields are data scopes: what an area holds binds under the
+/// area's parent, as Adobe's viewers write it. The template tells which segments are areas;
+/// segments it doesn't have (page-set objects, or a SOM from another template) are kept.
+pub fn data_path(tpl: &Template, som: &str) -> DataPath {
+    let mut out = DataPath::new();
+    // The template children the next segment is looked up in; `None` until the root matched,
+    // and again once a segment is not a container the template has.
+    let mut level: Option<&[Node]> = None;
+    for (i, (name, index)) in som_to_path(som).into_iter().enumerate() {
+        let found = match level {
+            None if i == 0 && tpl.root.common.name.as_deref() == Some(name.as_str()) => Some(Container::Children(&tpl.root.children)),
+            None => None,
+            Some(children) => match named(children, &name, 0) {
+                Some(Node::Subform(sf)) => Some(Container::Children(&sf.children)),
+                Some(Node::Area(a)) => Some(Container::Area(&a.children)),
+                _ => None,
+            },
+        };
+        match found {
+            Some(Container::Area(children)) => level = Some(children),
+            Some(Container::Children(children)) => {
+                level = Some(children);
+                out.push((name, index));
+            }
+            None => {
+                level = None;
+                out.push((name, index));
+            }
+        }
+    }
+    out
+}
+
+enum Container<'a> {
+    Children(&'a [Node]),
+    /// Contents bind under the area's parent.
+    Area(&'a [Node]),
+}
+
+/// The child of `nodes` named `name`, looking through unnamed subforms and areas (which have no
+/// SOM segment of their own).
+fn named<'a>(nodes: &'a [Node], name: &str, depth: usize) -> Option<&'a Node> {
+    if depth > MAX_DEPTH {
+        return None;
+    }
+    nodes.iter().find(|n| n.common().name.as_deref() == Some(name)).or_else(|| {
+        nodes.iter().find_map(|n| match n {
+            Node::Subform(sf) if sf.common.name.is_none() => named(&sf.children, name, depth + 1),
+            Node::Area(a) if a.common.name.is_none() => named(&a.children, name, depth + 1),
+            _ => None,
+        })
+    })
+}
+
 /// What a field holds, for writing the datasets.
 #[derive(Clone, Debug, PartialEq)]
 pub enum FieldData {
@@ -342,11 +400,30 @@ struct Want {
     ensure: bool,
 }
 
-fn wanted(doc: &Document, fields: &[FieldDatum]) -> Vec<Want> {
+/// `tpl`, or the document's own template when none is given (parsed once).
+fn with_template<T>(doc: &Document, tpl: Option<&Template>, f: impl FnOnce(Option<&Template>) -> T) -> T {
+    match tpl {
+        Some(t) => f(Some(t)),
+        None => {
+            let parsed = crate::script::template_of(doc).ok();
+            f(parsed.as_ref())
+        }
+    }
+}
+
+/// [`data_path`] when the template is known, else [`som_to_path`].
+fn path_of(tpl: Option<&Template>, som: &str) -> DataPath {
+    match tpl {
+        Some(t) => data_path(t, som),
+        None => som_to_path(som),
+    }
+}
+
+fn wanted(doc: &Document, fields: &[FieldDatum], tpl: Option<&Template>) -> Vec<Want> {
     let mut out = Vec::new();
     for f in fields {
         let som = som_of(doc, f);
-        let path = som_to_path(&som);
+        let path = path_of(tpl, &som);
         if path.is_empty() {
             continue;
         }
@@ -415,7 +492,8 @@ fn build_children(wants: &[Want], warnings: &mut Vec<String>) -> String {
 
 /// The `xfa:data` element for `fields`, built afresh.
 pub fn build_data(doc: &Document, fields: &[FieldDatum]) -> String {
-    format!("<xfa:data>{}</xfa:data>", build_children(&wanted(doc, fields), &mut Vec::new()))
+    let wants = with_template(doc, None, |t| wanted(doc, fields, t));
+    format!("<xfa:data>{}</xfa:data>", build_children(&wants, &mut Vec::new()))
 }
 
 fn fresh_datasets(data_children: &str) -> String {
@@ -749,7 +827,18 @@ pub fn write_datasets(doc: &mut Document, fields: &[FieldDatum]) -> Result<Datas
 /// [`write_datasets`], replacing the stream `reuse` in place when the packet is that stream
 /// (written earlier in the same edit) rather than adding another.
 pub fn write_datasets_reusing(doc: &mut Document, fields: &[FieldDatum], reuse: Option<ObjRef>) -> Result<DatasetsWrite, XfaError> {
-    let wants = wanted(doc, fields);
+    write_datasets_with(doc, None, fields, reuse)
+}
+
+/// [`write_datasets_reusing`] with the form's parsed template when the caller has it (it says
+/// which SOM segments are areas, see [`data_path`]); `None` parses the document's.
+pub fn write_datasets_with(
+    doc: &mut Document,
+    tpl: Option<&Template>,
+    fields: &[FieldDatum],
+    reuse: Option<ObjRef>,
+) -> Result<DatasetsWrite, XfaError> {
+    let wants = with_template(doc, tpl, |t| wanted(doc, fields, t));
     rewrite(doc, &[Op::Values(&wants)], reuse)
 }
 
@@ -980,11 +1069,21 @@ fn rewrite(doc: &mut Document, ops: &[Op], reuse: Option<ObjRef>) -> Result<Data
 /// The values the datasets hold for `fields`: `(field name, what it should hold)`, only for
 /// fields the data mentions.
 pub fn read_values(doc: &Document, fields: &[FieldDatum]) -> Vec<(String, FieldData)> {
+    read_values_with(doc, None, fields)
+}
+
+/// [`read_values`] with the form's parsed template when the caller has it; `None` parses the
+/// document's.
+pub fn read_values_with(doc: &Document, tpl: Option<&Template>, fields: &[FieldDatum]) -> Vec<(String, FieldData)> {
+    with_template(doc, tpl, |t| values_at(doc, t, fields))
+}
+
+fn values_at(doc: &Document, tpl: Option<&Template>, fields: &[FieldDatum]) -> Vec<(String, FieldData)> {
     let Ok(Some(p)) = crate::read_packets(doc) else { return Vec::new() };
     let Some(data) = parse_datasets(&p.xdp) else { return Vec::new() };
     let mut out = Vec::new();
     for f in fields {
-        let path = som_to_path(&som_of(doc, f));
+        let path = path_of(tpl, &som_of(doc, f));
         let Some(text) = data.text_at(&path) else { continue };
         let value = match &f.data {
             FieldData::Text(_) => FieldData::Text(match date_pattern_of(doc, f) {
diff --git a/crates/xfa/src/fixtures.rs b/crates/xfa/src/fixtures.rs
index b42a3d2bb..f91cc7c50 100644
--- a/crates/xfa/src/fixtures.rs
+++ b/crates/xfa/src/fixtures.rs
@@ -208,6 +208,55 @@ endif</script></event></field>
     .to_string()
 }
 
+/// Shaped like a real Designer leave-request form: a positioned page whose unnamed subform holds
+/// an area (`box`) with a top-to-bottom table of positioned rows (`<occur min="3"/>`) and a
+/// read-only total that a FormCalc calculate works out over a fixed range of rows, as such forms
+/// do. `data` is `xfa:data` content as Adobe's viewers write it: areas are not data scopes, so
+/// there is no `box` element.
+pub fn leave_template(data: &str) -> String {
+    let datasets = if data.is_empty() {
+        String::new()
+    } else {
+        format!("<xfa:datasets xmlns:xfa=\"http://www.xfa.org/schema/xfa-data/1.0/\"><xfa:data>{data}</xfa:data></xfa:datasets>")
+    };
+    format!(
+        r##"<?xml version="1.0" encoding="UTF-8"?>
+<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
+<subform name="form" layout="tb">
+ <pageSet><pageArea name="front"><contentArea x="0.5in" y="0.5in" w="7.5in" h="10in"/><medium short="8.5in" long="11in"/></pageArea></pageSet>
+ <subform name="page" w="7.5in" h="9in">
+  <subform w="7.5in" h="8in">
+   <area name="box" x="0.25in" y="0.5in">
+    <subform name="table" layout="tb" w="5in">
+     <subform name="row" w="5in" h="0.3in"><occur min="3" max="-1"/>
+      <field name="reason" x="0in" w="3in" h="0.3in"><ui><textEdit/></ui></field>
+      <field name="days" x="3in" w="1in" h="0.3in"><ui><numericEdit/></ui></field>
+     </subform>
+    </subform>
+    <field name="carried" y="1.5in" w="2in" h="0.3in"><ui><numericEdit/></ui></field>
+    <field name="allowance" y="2in" w="2in" h="0.3in"><ui><numericEdit/></ui><value><float>30</float></value></field>
+    <field name="rest" y="2.5in" w="2in" h="0.3in" access="readOnly"><ui><numericEdit/></ui>
+     <calculate><script>
+      var left = carried + allowance
+      for i=0 upto 2 step 1 do
+       if (table.row[i].reason == "Regular") then
+        left = left - table.row[i].days
+       endif
+      endfor
+      this = left
+     </script></calculate></field>
+   </area>
+  </subform>
+ </subform>
+</subform>
+</template>
+{datasets}
+</xdp:xdp>
+"##
+    )
+}
+
 /// A 2 × 2 RGBA PNG: red, green / blue, transparent.
 pub fn tiny_png() -> Vec<u8> {
     TINY_PNG.to_vec()
diff --git a/crates/xfa/src/layout.rs b/crates/xfa/src/layout.rs
index fa5011361..615afbb0e 100644
--- a/crates/xfa/src/layout.rs
+++ b/crates/xfa/src/layout.rs
@@ -13,7 +13,7 @@ use std::sync::Arc;
 use base64::Engine;
 
 use crate::XfaError;
-use crate::data::{DataNode, is_on, iso_to_pattern, som_to_path};
+use crate::data::{DataNode, data_path, is_on, iso_to_pattern};
 use crate::model::*;
 use crate::text::{self, Block, Face, Span};
 
@@ -508,11 +508,7 @@ impl Layouter<'_> {
             self.new_page()?;
         }
         // Data adds instances of a repeating subform (rows added in another viewer).
-        let from_data = match (&sf.common.name, self.data) {
-            (Some(name), Some(d)) if sf.occur.max != Some(1) => d.count(&som_to_path(&ctx.som), name),
-            _ => 0,
-        };
-        let instances = instance_count(&sf.occur, from_data);
+        let instances = self.instances(node, &ctx.som);
         let ctx_parent = ctx;
         for i in 0..instances {
             let ctx = ctx_parent.with_som(&sf.common, sib + i);
@@ -583,11 +579,7 @@ impl Layouter<'_> {
                 && row.layout == Layout::Row
             {
                 // Rows added as data (in another viewer) repeat the row.
-                let from_data = match (&row.common.name, self.data) {
-                    (Some(name), Some(d)) if row.occur.max != Some(1) => d.count(&som_to_path(&ctx.som), name),
-                    _ => 0,
-                };
-                let instances = instance_count(&row.occur, from_data);
+                let instances = self.instances(child, &ctx.som);
                 for inst in 0..instances {
                     let h = self.row_height(row, &cols, inner_w, ctx, depth + 1);
                     if self.make_room(h)?
@@ -626,6 +618,17 @@ impl Layouter<'_> {
     /// The size a node takes when given `avail_w` of width. Containers are measured once per
     /// (node, width, depth): measuring a width-less container measures its content twice (for
     /// its width, then its height), which would otherwise be exponential in the nesting.
+    /// How many instances of `node` to lay out under the container at `parent_som`: a
+    /// repeating subform's `occur` and data instances ([`instance_count`]); one for anything else.
+    fn instances(&self, node: &Node, parent_som: &str) -> usize {
+        let Node::Subform(sf) = node else { return 1 };
+        let from_data = match (&sf.common.name, self.data) {
+            (Some(name), Some(d)) if sf.occur.max != Some(1) => d.count(&data_path(self.tpl, parent_som), name),
+            _ => 0,
+        };
+        instance_count(&sf.occur, from_data)
+    }
+
     fn size_of(&self, node: &Node, avail_w: f64, ctx: &Ctx, depth: usize) -> (f64, f64) {
         let c = node.common();
         let spent = self.measures.get().saturating_add(1);
@@ -659,6 +662,9 @@ impl Layouter<'_> {
 
     fn measure(&self, node: &Node, avail_w: f64, ctx: &Ctx, depth: usize) -> (f64, f64) {
         let c = node.common();
+        // The container's own SOM, under which its repeating children count their instances.
+        // Measurements are cached per template node, so instance 0 stands for all of them.
+        let som = ctx.with_som(c, 0).som;
         let ctx = ctx.child(c);
         // A container without a width is as wide as its content (a radio group beside its
         // question, say); a leaf without one takes what is available.
@@ -684,9 +690,13 @@ impl Layouter<'_> {
                     Node::Area(a) => self.positioned_height(&a.children, inner_w, &ctx, depth),
                     Node::Subform(s) => match s.layout {
                         Layout::Positioned => self.positioned_height(&s.children, inner_w, &ctx, depth),
-                        Layout::Tb => {
-                            s.children.iter().filter(|k| k.common().presence.occupies()).map(|k| self.size_of(k, inner_w, &ctx, depth + 1).1).sum()
-                        }
+                        // Each instance of a repeating child takes its height again.
+                        Layout::Tb => s
+                            .children
+                            .iter()
+                            .filter(|k| k.common().presence.occupies())
+                            .map(|k| self.size_of(k, inner_w, &ctx, depth + 1).1 * self.instances(k, &som) as f64)
+                            .sum(),
                         Layout::LrTb | Layout::RlTb => self.packed_height(&s.children, inner_w, &ctx, depth),
                         Layout::Table => {
                             let cols = self.columns(s, inner_w);
@@ -943,8 +953,12 @@ impl Layouter<'_> {
                                 continue;
                             }
                             let (w, h) = self.size_of(k, inner.w, &ctx, depth + 1);
-                            self.draw_node(k, Rect::new(inner.x, y, w, h), &ctx, depth + 1, sib_index(&s.children, i))?;
-                            y += h;
+                            // A repeating subform here (a table in an area of a positioned page,
+                            // say) gets its instances, as in a flowed one, one under another.
+                            for instance in 0..self.instances(k, &ctx.som) {
+                                self.draw_node(k, Rect::new(inner.x, y, w, h), &ctx, depth + 1, sib_index(&s.children, i) + instance)?;
+                                y += h;
+                            }
                         }
                     }
                     Layout::LrTb | Layout::RlTb => {
@@ -1061,7 +1075,7 @@ impl Layouter<'_> {
         let ctx = ctx.with_som(&g.common, sib);
         // The group's data node holds the selected button's on value.
         let selected: Option<String> =
-            self.data.and_then(|d| d.text_at(&som_to_path(&ctx.som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
+            self.data.and_then(|d| d.text_at(&data_path(self.tpl, &ctx.som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
         let inner = rect.inset(&g.common.margin);
         let group = self.unique_name(g.common.name.as_deref().unwrap_or("group"));
         let nodes: Vec<Node> = g.fields.iter().map(|f| Node::Field(Box::new(f.clone()))).collect();
@@ -1182,7 +1196,7 @@ impl Layouter<'_> {
                 let field_name = f.common.name.clone().unwrap_or_else(|| "an image field".into());
                 let text: Vec<u8> = self
                     .data
-                    .and_then(|d| d.text_at(&som_to_path(&som_path())))
+                    .and_then(|d| d.text_at(&data_path(self.tpl, &som_path())))
                     .map(|t| t.bytes().filter(|b| !b.is_ascii_whitespace()).collect())
                     .unwrap_or_default();
                 let from_data = if text.is_empty() {
@@ -1215,8 +1229,12 @@ impl Layouter<'_> {
             Ui::Barcode => {
                 // The value as text, where the bars would be.
                 self.warn_once("barcode fields show their value as text, not as bars");
-                let value =
-                    self.data.and_then(|d| d.text_at(&som_to_path(&som_path()))).map(str::to_string).or_else(|| f.value.plain()).unwrap_or_default();
+                let value = self
+                    .data
+                    .and_then(|d| d.text_at(&data_path(self.tpl, &som_path())))
+                    .map(str::to_string)
+                    .or_else(|| f.value.plain())
+                    .unwrap_or_default();
                 if !value.trim().is_empty() {
                     let mut para = fctx.para.clone();
                     para.h_align = HAlign::Center;
@@ -1244,7 +1262,7 @@ impl Layouter<'_> {
         let read_only = matches!(f.access, Access::ReadOnly | Access::Protected);
         // The data's value wins over the template's default.
         let data_value: Option<String> =
-            self.data.and_then(|d| d.value_at(&som_to_path(&som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
+            self.data.and_then(|d| d.value_at(&data_path(self.tpl, &som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
         // A choice list's default is a saved value too.
         let template_default = f.value.plain().map(|v| f.saved_value(v.trim())).filter(|v| !v.is_empty());
         let plain_value = data_value.clone().or_else(|| template_default.clone());
diff --git a/crates/xfa/src/lib.rs b/crates/xfa/src/lib.rs
index 6b4e31d4e..a1758ab47 100644
--- a/crates/xfa/src/lib.rs
+++ b/crates/xfa/src/lib.rs
@@ -21,8 +21,9 @@ pub mod text;
 use pdfcraft_cos::Document;
 
 pub use data::{
-    DataNode, DataOp, DataPath, DatasetsWrite, FieldData, FieldDatum, add_data_instances, build_data, iso_to_pattern, parse_datasets, pattern_to_iso,
-    read_values, remove_data_instance, som_to_path, write_data_ops, write_data_value, write_datasets, write_datasets_reusing,
+    DataNode, DataOp, DataPath, DatasetsWrite, FieldData, FieldDatum, add_data_instances, build_data, data_path, iso_to_pattern, parse_datasets,
+    pattern_to_iso, read_values, read_values_with, remove_data_instance, som_to_path, write_data_ops, write_data_value, write_datasets,
+    write_datasets_reusing, write_datasets_with,
 };
 pub use layout::{Action, BorderShape, Form, Item, MAX_PAGES, Page, Widget, WidgetKind, layout};
 pub use packets::{Encoding, Packets, decode as decode_packet, encode as encode_packet, read_packets};
diff --git a/crates/xfa/src/script.rs b/crates/xfa/src/script.rs
index c2088deee..255c7f45a 100644
--- a/crates/xfa/src/script.rs
+++ b/crates/xfa/src/script.rs
@@ -6,7 +6,7 @@ use std::collections::{BTreeMap, HashMap};
 
 use pdfcraft_cos::{Dict, Document, Object, PdfString};
 
-use crate::data::{DataNode, parse_datasets, som_to_path};
+use crate::data::{DataNode, data_path, parse_datasets};
 use crate::model::*;
 use crate::{Report, XfaError};
 
@@ -171,6 +171,8 @@ fn child_som(parent: &str, name: Option<&str>, index: usize) -> String {
 }
 
 struct Walker<'a> {
+    /// For data paths (areas are not data scopes).
+    tpl: &'a Template,
     data: Option<&'a DataNode>,
     ov: &'a Overrides,
     events: Vec<ScriptEvent>,
@@ -241,7 +243,7 @@ impl Walker<'_> {
 
     fn field(&mut self, f: &Field, parent_som: &str, index: usize, radio: Option<&str>) -> FormNode {
         let som = child_som(parent_som, f.common.name.as_deref().or(Some("field")), index);
-        let data_value = self.data.and_then(|d| d.value_at(&som_to_path(&som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
+        let data_value = self.data.and_then(|d| d.value_at(&data_path(self.tpl, &som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
         let value = match (radio, data_value) {
             // A radio button's value is its on value when the group picked it.
             (Some(selected), _) => {
@@ -281,7 +283,7 @@ impl Walker<'_> {
             match n {
                 Node::Subform(sf) => {
                     let from_data = match (&sf.common.name, self.data) {
-                        (Some(name), Some(d)) if sf.occur.max != Some(1) => d.count(&som_to_path(parent_som), name),
+                        (Some(name), Some(d)) if sf.occur.max != Some(1) => d.count(&data_path(self.tpl, parent_som), name),
                         _ => 0,
                     };
                     let instances = crate::layout::instance_count(&sf.occur, from_data);
@@ -344,7 +346,8 @@ impl Walker<'_> {
                 }
                 Node::ExclGroup(g) => {
                     let som = child_som(parent_som, g.common.name.as_deref().or(Some("group")), sib);
-                    let selected = self.data.and_then(|d| d.text_at(&som_to_path(&som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
+                    let selected =
+                        self.data.and_then(|d| d.text_at(&data_path(self.tpl, &som))).map(|t| t.trim().to_string()).filter(|t| !t.is_empty());
                     self.push_events(&som, &g.scripts, None, None, None);
                     let fields: Vec<Node> = g.fields.iter().map(|f| Node::Field(Box::new(f.clone()))).collect();
                     let mut children = Vec::new();
@@ -378,7 +381,7 @@ impl Walker<'_> {
 /// from the template and `ov`) and every scripted event, in document order, within
 /// [`MAX_FORM_NODES`] objects.
 pub fn form_tree(tpl: &Template, data: Option<&DataNode>, ov: &Overrides) -> LiveForm {
-    let mut w = Walker { data, ov, events: Vec::new(), nodes: 0, truncated: false };
+    let mut w = Walker { tpl, data, ov, events: Vec::new(), nodes: 0, truncated: false };
     let root = Node::Subform(Box::new(tpl.root.clone()));
     let mut nodes = w.children(std::slice::from_ref(&root), "", 0);
     let mut root_node = nodes.pop().unwrap_or_default();
diff --git a/crates/xfa/src/tests.rs b/crates/xfa/src/tests.rs
index 4a4d8ad5d..a690e7f3c 100644
--- a/crates/xfa/src/tests.rs
+++ b/crates/xfa/src/tests.rs
@@ -1041,3 +1041,71 @@ fn pictures_are_embedded_once_across_relayouts_and_bad_data_pictures_are_reporte
     }
     assert!(find_image(&t.root.children).is_some_and(|n| n > 1_200_000));
 }
+
+/// A repeating subform drawn inside positioned content (a top-to-bottom table in an area of a
+/// positioned subform) gets its `occur` instances, as in Adobe's viewers: real Designer forms
+/// have tables like this whose calculations read every row. Before, only one row was laid
+/// out, and the field after the table was placed as if there were one.
+#[test]
+fn repeating_subforms_inside_positioned_content_get_their_instances() {
+    let xdp = r##"<?xml version="1.0" encoding="UTF-8"?>
+<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
+<subform name="form" layout="tb">
+ <pageSet><pageArea name="front"><contentArea x="0.5in" y="0.5in" w="7.5in" h="10in"/><medium short="8.5in" long="11in"/></pageArea></pageSet>
+ <subform name="page1" w="7.5in" h="8in">
+  <area name="box" x="0.5in" y="1in">
+   <subform name="wrap" layout="tb" w="4in">
+    <subform name="table" layout="tb" w="4in">
+     <subform name="row" w="4in" h="0.3in"><occur min="3" max="-1"/>
+      <field name="reason" w="4in" h="0.3in"><ui><textEdit/></ui></field>
+     </subform>
+    </subform>
+    <field name="after" w="4in" h="0.3in"><ui><textEdit/></ui></field>
+   </subform>
+  </area>
+ </subform>
+</subform>
+</template>
+</xdp:xdp>
+"##;
+    let form = layout_xml(xdp).unwrap();
+    let all: Vec<&Widget> = form.pages.iter().flat_map(widgets).collect();
+    let rows: Vec<&Widget> = all.iter().copied().filter(|w| w.som.ends_with(".reason[0]")).collect();
+    let soms: Vec<&str> = rows.iter().map(|w| w.som.as_str()).collect();
+    assert_eq!(
+        soms,
+        [
+            "form[0].page1[0].box[0].wrap[0].table[0].row[0].reason[0]",
+            "form[0].page1[0].box[0].wrap[0].table[0].row[1].reason[0]",
+            "form[0].page1[0].box[0].wrap[0].table[0].row[2].reason[0]",
+        ],
+        "one widget per instance, each with its own SOM index"
+    );
+    // The rows are stacked, not drawn on top of each other…
+    let step = rows[1].rect.y - rows[0].rect.y;
+    assert!(step.abs() > 1.0, "rows overlap: {:?}", rows.iter().map(|w| w.rect).collect::<Vec<_>>());
+    assert!(((rows[2].rect.y - rows[1].rect.y) - step).abs() < 0.01, "rows are evenly spaced");
+    // …and what follows the table is placed after all of them (the table was measured with
+    // its instances, not with one row).
+    let after = all.iter().find(|w| w.som.ends_with(".after[0]")).expect("the field after the table");
+    assert!(((after.rect.y - rows[2].rect.y) - step).abs() < 0.01, "after: {:?}, last row: {:?}", after.rect, rows[2].rect);
+}
+
+/// Areas are named in SOM expressions but are not data scopes; unnamed subforms and areas have
+/// no segment at all. What the template doesn't have is kept as it is.
+#[test]
+fn data_paths_leave_areas_out() {
+    let (tpl, _) = parse(&crate::fixtures::leave_template("")).unwrap();
+    let path = |som: &str| data_path(&tpl, som).into_iter().map(|(n, i)| format!("{n}[{i}]")).collect::<Vec<_>>().join(".");
+    // The area `box` (inside an unnamed subform) is dropped; indexes are kept.
+    assert_eq!(path("form[0].page[0].box[0].table[0].row[2].days[0]"), "form[0].page[0].table[0].row[2].days[0]");
+    assert_eq!(path("form[0].page[0].box[0].rest[0]"), "form[0].page[0].rest[0]");
+    // No area on the way: as som_to_path.
+    assert_eq!(path("form[0].page[0]"), "form[0].page[0]");
+    // Unknown segments, past a leaf, or a SOM from another template: kept.
+    assert_eq!(path("form[0].page[0].box[0].nothing[0].x[1]"), "form[0].page[0].nothing[0].x[1]");
+    assert_eq!(path("form[0].page[0].box[0].rest[0].box[0]"), "form[0].page[0].rest[0].box[0]");
+    assert_eq!(path("other[0].box[0].rest[0]"), "other[0].box[0].rest[0]");
+    assert_eq!(data_path(&tpl, ""), Vec::new());
+}
diff --git a/crates/xfdf/README.md b/crates/xfdf/README.md
index f30155b63..fd2852584 100644
--- a/crates/xfdf/README.md
+++ b/crates/xfdf/README.md
@@ -12,11 +12,13 @@ let report = import(&mut doc, &bytes)?;                 // XFDF, FDF, XML, CSV o
 - **XFDF** (ISO 19444-1): every comment type PdfCraft knows (text, free text, line, square,
   circle, polygon, polyline, markup, stamp, caret, ink, attachments, sound, redact) with rect,
   name, author, subject, dates, flags, colours, opacity, width, icon, quads, line ends, ink,
-  default appearance, pop-ups and reply threads (`inreplyto`); field values nested by name.
+  default appearance, callouts (`callout`, `fringe`, `intent`, `head`), pop-ups and reply threads
+  (`inreplyto`); field values nested by name.
 - **FDF**: fields (with `/Kids` hierarchies) and comments as direct objects.
 - **Form data**: Acrobat's XML (`xfdf:original` keeps names that aren't XML names), CSV and
   tab-delimited text (a row of names, a row of values).
 
-Import replaces comments with the same `/NM`, draws appearances PdfCraft can draw, and sets
-values through the form's own checks (formats, validation, recalculation); read-only fields take
-imported values, as in Acrobat. XML is read with `roxmltree`.
+Import replaces comments with the same `/NM` (and drops the replaced comment's pop-up), draws
+appearances PdfCraft can draw, and sets values through the form's own checks (formats,
+validation, recalculation); read-only fields take imported values, as in Acrobat. XML is read
+with `roxmltree`.
diff --git a/crates/xfdf/src/lib.rs b/crates/xfdf/src/lib.rs
index 190080611..91c3d2454 100644
--- a/crates/xfdf/src/lib.rs
+++ b/crates/xfdf/src/lib.rs
@@ -2,7 +2,7 @@
 //!
 //! - **XFDF** (ISO 19444-1, Acrobat's "Export all to data file" / "Import comments", and form
 //!   data): comments with their geometry, colours, flags, authors, dates, replies, pop-ups,
-//!   ink, quadrilaterals and line ends; field values, nested by name.
+//!   ink, quadrilaterals, line ends and callouts; field values, nested by name.
 //! - **FDF** (ISO 32000-2 §12.7.8): fields and comments in PDF syntax.
 //! - Form data as **XML**, **CSV** and **tab-delimited text** (Acrobat's Export data formats).
 //!
@@ -244,6 +244,21 @@ fn xfdf_annots(doc: &Document, out: &mut String) {
                 let name = |o: &Object| o.as_name().map(|x| String::from_utf8_lossy(x).into_owned()).unwrap_or_else(|| "None".into());
                 let _ = write!(attrs, " head=\"{}\" tail=\"{}\"", name(&le[0]), name(&le[1]));
             }
+            // A callout: its leader path, text-box inset, intent and (single-name) line ending.
+            let cl = nums_of(doc, d.get(b"CL"));
+            if cl.len() == 4 || cl.len() == 6 {
+                let _ = write!(attrs, " callout=\"{}\"", cl.iter().map(|v| n(*v)).collect::<Vec<_>>().join(","));
+                let rd = nums_of(doc, d.get(b"RD"));
+                if rd.len() == 4 {
+                    let _ = write!(attrs, " fringe=\"{}\"", rd.iter().map(|v| n(*v)).collect::<Vec<_>>().join(","));
+                }
+                if let Some(it) = d.get(b"IT").map(|o| doc.resolve(o)).and_then(|o| o.as_name().map(|x| String::from_utf8_lossy(x).into_owned())) {
+                    let _ = write!(attrs, " intent=\"{}\"", esc(&it));
+                }
+                if let Some(le) = d.get(b"LE").map(|o| doc.resolve(o)).and_then(|o| o.as_name().map(|x| String::from_utf8_lossy(x).into_owned())) {
+                    let _ = write!(attrs, " head=\"{}\"", esc(&le));
+                }
+            }
             if let Some(irt) = d.get(b"IRT").and_then(Object::as_ref).and_then(|r| names.get(&r)) {
                 let _ = write!(attrs, " inreplyto=\"{}\"", esc(irt));
             }
@@ -264,6 +279,12 @@ fn xfdf_annots(doc: &Document, out: &mut String) {
                 }
                 out.push_str("</inklist>");
             }
+            // Polygon and polyline points (XFDF `<vertices>`: `x,y;x,y;…`).
+            let vertices = nums_of(doc, d.get(b"Vertices"));
+            let pts: Vec<String> = vertices.as_chunks::<2>().0.iter().map(|p| format!("{},{}", n(p[0]), n(p[1]))).collect();
+            if !pts.is_empty() {
+                let _ = write!(out, "<vertices>{}</vertices>", pts.join(";"));
+            }
             if let Some(pd) = d.get(b"Popup").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().cloned()) {
                 let r = nums_of(doc, pd.get(b"Rect"));
                 if r.len() == 4 {
@@ -601,6 +622,20 @@ fn annot_from_xml(node: roxmltree::Node, subtype: &str, page_ref: ObjRef) -> Opt
             Object::Array(vec![Object::name(node.attribute("head").unwrap_or("None")), Object::name(node.attribute("tail").unwrap_or("None"))]),
         );
     }
+    if let Some(cl) = node.attribute("callout").map(csv).filter(|c| c.len() == 4 || c.len() == 6) {
+        d.set(b"CL".to_vec(), arr(&cl));
+        if let Some(rd) = node.attribute("fringe").map(csv).filter(|r| r.len() == 4) {
+            d.set(b"RD".to_vec(), arr(&rd));
+        }
+        d.set(b"IT".to_vec(), Object::name(node.attribute("intent").unwrap_or("FreeTextCallout")));
+        // A callout's /LE is one name, not the head/tail pair of a line.
+        match node.attribute("head") {
+            Some(h) => d.set(b"LE".to_vec(), Object::name(h)),
+            None => {
+                d.remove(b"LE");
+            }
+        }
+    }
     for child in node.children().filter(|c| c.is_element()) {
         match child.tag_name().name() {
             "contents" => {
@@ -617,6 +652,14 @@ fn annot_from_xml(node: roxmltree::Node, subtype: &str, page_ref: ObjRef) -> Opt
                     .collect();
                 d.set(b"InkList".to_vec(), Object::Array(list));
             }
+            "vertices" => {
+                // Whole x,y pairs only; a stray trailing number is dropped.
+                let mut v = csv(child.text().unwrap_or(""));
+                v.truncate(v.len() - v.len() % 2);
+                if !v.is_empty() {
+                    d.set(b"Vertices".to_vec(), arr(&v));
+                }
+            }
             _ => {}
         }
     }
@@ -635,13 +678,21 @@ fn place(doc: &mut Document, page_ref: ObjRef, d: Dict) -> Result<ObjRef, DataEr
         .and_then(|a| a.as_array().cloned())
         .unwrap_or_default();
     let mut kept = Vec::new();
+    let mut removed: Vec<ObjRef> = Vec::new();
     for a in annots {
         let same = nm.is_some()
             && a.as_ref().and_then(|r| doc.get(r).as_dict().and_then(|x| x.get(b"NM").and_then(|n| n.as_string().map(|s| s.to_text())))) == nm;
-        if !same {
+        if same {
+            removed.extend(a.as_ref());
+        } else {
             kept.push(a);
         }
     }
+    // The replaced note's pop-up goes with it; otherwise it stays on the page pointing at a note that is no longer there.
+    kept.retain(|a| {
+        let Some(x) = a.as_ref().map(|r| doc.get(r)).and_then(|o| o.as_dict().cloned()) else { return true };
+        x.name(b"Subtype") != Some(b"Popup".as_slice()) || x.reference(b"Parent").is_none_or(|p| !removed.contains(&p))
+    });
     let r = doc.add(Object::Dict(d));
     // Our own appearance where we can draw one; others keep none (viewers draw a default).
     let _ = pdfcraft_annot::set_appearance(doc, r);
diff --git a/crates/xfdf/src/tests.rs b/crates/xfdf/src/tests.rs
index ca1debe49..33b3a5a88 100644
--- a/crates/xfdf/src/tests.rs
+++ b/crates/xfdf/src/tests.rs
@@ -331,3 +331,117 @@ fn unicode_annotation_colours_are_ignored_without_panicking() {
         assert_eq!(report.comments, 1);
     }
 }
+
+/// Importing the same note again must not leave the earlier pop-up on the page.
+#[test]
+fn reimporting_a_note_replaces_its_popup() {
+    let xfdf = concat!(
+        r#"<xfdf xmlns="http://ns.adobe.com/xfdf/"><annots><text page="0" name="n1" rect="10,10,30,30"><contents>body</contents>"#,
+        r#"<popup page="0" rect="40,10,140,60" open="no"/></text></annots></xfdf>"#,
+    );
+    let mut doc = blank();
+    for _ in 0..3 {
+        import(&mut doc, xfdf.as_bytes()).unwrap();
+    }
+    let page = pdfcraft_model::pages(&doc)[0].obj;
+    let annots = doc.get(page).as_dict().and_then(|p| p.get(b"Annots").cloned()).and_then(|a| doc.resolve(&a).as_array().cloned()).unwrap();
+    let refs: Vec<ObjRef> = annots.iter().filter_map(|a| a.as_ref()).collect();
+    let is_popup = |r: &ObjRef| doc.get(*r).as_dict().and_then(|d| d.name(b"Subtype")) == Some(b"Popup".as_slice());
+    let popups: Vec<ObjRef> = refs.iter().copied().filter(is_popup).collect();
+    assert_eq!(popups.len(), 1, "one current pop-up, not one per import");
+    let parent = doc.get(popups[0]).as_dict().and_then(|d| d.reference(b"Parent")).unwrap();
+    assert!(refs.contains(&parent), "the pop-up belongs to a note that is still on the page");
+}
+
+/// The `/Vertices` of every annotation on the document's pages, by subtype.
+fn vertices(doc: &Document) -> Vec<(String, Vec<f64>)> {
+    let mut out = Vec::new();
+    for p in pdfcraft_model::pages(doc) {
+        for a in p.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() {
+            let Some(d) = doc.resolve(&a).as_dict().cloned() else { continue };
+            let sub = String::from_utf8_lossy(d.name(b"Subtype").unwrap_or_default()).into_owned();
+            let v = nums_of(doc, d.get(b"Vertices"));
+            if !v.is_empty() {
+                out.push((sub, v));
+            }
+        }
+    }
+    out
+}
+
+/// storytold/pdfcraft#809: XFDF exchange dropped polygon and polyline vertices, so the
+/// imported comments had no shape (and no appearance).
+#[test]
+fn xfdf_keeps_polygon_and_polyline_vertices() {
+    let mut src = blank();
+    let meta = |id: &str| Meta { date: Some("D:20261002120000Z".into()), id: id.into() };
+    let polygon = Shape::Polygon { vertices: vec![[100.0, 100.0], [200.0, 120.0], [150.0, 220.5]], cloud: false };
+    let polyline = Shape::PolyLine {
+        vertices: vec![[50.0, 300.0], [120.0, 380.0], [200.0, 310.0]],
+        start: pdfcraft_annot::LineEnding::None,
+        end: pdfcraft_annot::LineEnding::ClosedArrow,
+    };
+    for (page, shape, id) in [(0, polygon, "pg"), (1, polyline, "pl")] {
+        let new = NewAnnotation { page, style: Style::default_for(&shape), shape, contents: id.into(), author: "Ada".into() };
+        add_annotation(&mut src, &new, &meta(id)).unwrap();
+    }
+    let xfdf = export_xfdf(&src, true, false, "shapes.pdf");
+    assert!(xfdf.contains("<vertices>100,100;200,120;150,220.5</vertices>"), "{xfdf}");
+    assert!(xfdf.contains("<vertices>50,300;120,380;200,310</vertices>"), "{xfdf}");
+    let mut dst = blank();
+    let r = import(&mut dst, xfdf.as_bytes()).unwrap();
+    assert_eq!(r.comments, 2, "{r:?}");
+    assert_eq!(vertices(&dst), vertices(&src));
+    // The imported shapes are drawn again.
+    for p in pdfcraft_model::pages(&dst) {
+        for a in p.dict.get(b"Annots").map(|a| dst.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default() {
+            let d = dst.resolve(&a).as_dict().cloned().unwrap();
+            assert!(d.get(b"AP").is_some(), "{d:?}");
+        }
+    }
+    // Acrobat-style input: a stray trailing number is dropped and only whole points are kept.
+    let odd = r#"<?xml version="1.0"?><xfdf xmlns="http://ns.adobe.com/xfdf/"><annots>
+        <polygon page="0" rect="0,0,50,50" name="odd"><vertices>1,2;3,4;5,6;7</vertices></polygon>
+        <polygon page="0" rect="0,0,50,50" name="none"><vertices>junk</vertices></polygon>
+        </annots></xfdf>"#;
+    let mut dst = blank();
+    import(&mut dst, odd.as_bytes()).unwrap();
+    assert_eq!(vertices(&dst), vec![("Polygon".to_string(), vec![1.0, 2.0, 3.0, 4.0, 5.0, 6.0])]);
+}
+
+#[test]
+fn xfdf_keeps_callout_leader_inset_and_ending() {
+    let mut src = blank();
+    let shape = Shape::Callout {
+        rect: [40.0, 300.0, 180.0, 360.0],
+        knee: [260.0, 330.0],
+        point: [320.0, 200.0],
+        font_size: 12.0,
+        ending: pdfcraft_annot::LineEnding::ClosedArrow,
+    };
+    let meta = Meta { date: Some("D:20261002120000Z".into()), id: "c1".into() };
+    add_annotation(
+        &mut src,
+        &NewAnnotation { page: 0, style: Style::default_for(&shape), shape, contents: "leader".into(), author: "Ada".into() },
+        &meta,
+    )
+    .unwrap();
+    let xfdf = export_xfdf(&src, true, false, "form.pdf");
+    let mut dst = blank();
+    import(&mut dst, xfdf.as_bytes()).unwrap();
+    let callout_keys = |doc: &Document| {
+        let page = pdfcraft_model::pages(doc).remove(0);
+        let annots = page.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default();
+        let d = annots.iter().filter_map(|a| doc.resolve(a).as_dict().cloned()).find(|d| d.name(b"Subtype") == Some(b"FreeText")).unwrap();
+        (
+            nums_of(doc, d.get(b"Rect")),
+            nums_of(doc, d.get(b"CL")),
+            nums_of(doc, d.get(b"RD")),
+            d.name(b"IT").map(<[u8]>::to_vec),
+            d.get(b"LE").and_then(|o| o.as_name()).map(<[u8]>::to_vec),
+        )
+    };
+    let want = callout_keys(&src);
+    assert_eq!(want.1.len(), 6, "{want:?}");
+    assert_eq!(callout_keys(&dst), want, "{xfdf}");
+}
diff --git a/docs/architecture.md b/docs/architecture.md
new file mode 100644
index 000000000..eb56cdb3e
--- /dev/null
+++ b/docs/architecture.md
@@ -0,0 +1,112 @@
+# PdfCraft architecture
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (first public architecture document, written from the code on main) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+
+How PdfCraft is built today. The design rationale and the planned crates live in
+`plan/architecture.md` and `plan/adr/` (local-only); this file describes what is on `main`. Each
+crate's `README.md` has the detail.
+
+## Shape
+
+One Cargo workspace (`Cargo.toml`, edition 2024, Rust ≥ 1.90, `MIT OR Apache-2.0`), 31 library
+crates in `crates/`, three binaries in `apps/`, build tooling in `xtask/`, and patched third-party
+crates in `vendor/`. About 152k lines of Rust and 1,765 tests (2026-10-10). Rust only: no
+handwritten JS/TS, in the product or the build.
+
+| Binary | What it is |
+|---|---|
+| `apps/pdfcraft` | The desktop app (macOS, Windows, Linux, FreeBSD): eframe/egui on wgpu, single instance, Apple events, update check on request |
+| `apps/pdfcraft-cli` | `inspect`, `edit`, `combine`, `extract`, `split`, `run` (any automation tool or a JSON script), `tools`, `ui` (drive the running app), and the opt-in `mcp` server |
+| `apps/pdfcraft-web` | The same egui shell compiled to WebAssembly |
+
+## Layers
+
+`cargo xtask layers` enforces the layering (`xtask/src/layers.rs`). A crate may depend only on
+crates in lower layers; nothing below L7 may depend on egui, winit, eframe or rfd; L0–L1 crates are
+standalone and publishable.
+
+| Layer | Crates today | Role |
+|---|---|---|
+| L0 foundation | `geom`, `filters`, `crypt` | Geometry; stream filters (Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength); standard security handler R2–R6 (RC4, AES-128/256, SASLprep) |
+| L1 objects | `cos` | Lazy, tolerant parser with xref repair; copy-on-write object graph; incremental and full writers with object streams; decryption on load and re-encryption on save |
+| L2 core model | `content`, `model`, `fonts` | Content-stream operators with source spans and a serializer; typed page tree with inherited attributes and display geometry (`/UserUnit`, `/Rotate`); font metrics and encodings for generated appearances |
+| L3 core services | `render`, `annot`, `forms`, `js`, `xfa` | Rendering and inspection (bootstrap: vendored `hayro`, `lopdf`); annotation builders and appearance streams; AcroForm model, filling, appearances; sandboxed JavaScript (boa) and FormCalc; XFA template layout and data |
+| L4 features | `edit`, `organize`, `redact`, `xfdf`, `sign`, `ocr`, `create`, `export`, `optimize`, `preflight`, `a11y`, `compare`, `measure`, `print` | One crate per Acrobat tool family |
+| L6 façade | `engine` | Session, open documents, edit history, the command registry and tool catalogue. Frontends never reach past it |
+| L7 platform and frontends | `platform`, `ui-egui`, `automation` | OS services; the egui shell (desktop and web); headless JSON-Schema tools, CLI and MCP |
+
+Planned crates that the layer table already reserves (`arlington`, `color`, `ops`, `text`, `ml`,
+`security`, `prepress`, `search`, `media`, `ai`, `viewport`, `tools`, `ui-common`) don't exist yet.
+
+## Data model and editing
+
+The PDF object graph *is* the model (`crates/engine/README.md` §The editing model):
+
+1. Each open document holds a `pdfcraft_cos::Document`: the parsed objects plus a copy-on-write
+   overlay. Unknown data is preserved because nothing is rebuilt that wasn't understood.
+2. An edit runs on a clone; on success the previous state goes onto the undo stack. Clones share
+   unchanged data, so snapshots are cheap.
+3. After every edit an incremental write produces the working file (original bytes plus one
+   revision); the view is refreshed from those bytes, so what you see is what Save writes.
+4. Saves are incremental and atomic. A full rewrite happens only where it must: redaction, PDF/A
+   conversion, print imposition, a changed password, Save As with garbage collection.
+5. Autosave and crash recovery keep encrypted documents encrypted. Signed documents are protected
+   from rewrites.
+
+## Rendering and text
+
+- Pages are rasterized on the CPU by the vendored `hayro` family (`hayro`, `hayro-interpret`,
+  `hayro-syntax`, `hayro-jbig2`), with local patches for appearance states, layers, resource
+  limits, cancellation, tiles and `/UserUnit` (`vendor/README.md`). A render pool renders visible
+  pages first, then neighbours and thumbnails; tiles keep deep zoom sharp; a watchdog skips
+  pathological pages.
+- The raster is uploaded to the GPU as a texture; egui draws the interface through wgpu (OpenGL
+  fallback when a device can't be configured).
+- Text extraction (reading order, columns, vertical CJK, rotated text) feeds find, select, copy,
+  redaction, export and compare; word-F1 0.98 against `pdftotext` on the corpus.
+- The replacement (M2, ADR-0004) is the `model` crate, our own font engine and DisplayList devices;
+  only the first pieces of `model` exist. See [gaps.md](gaps.md) gap 2.
+
+## File I/O
+
+- PDF in: any revision chain, xref tables or streams, hybrid files, damaged files (repaired and
+  logged), all standard-security revisions. Image codecs (DCT, JPX, JBIG2, CCITT) decode through
+  the bootstrap renderer.
+- PDF out: incremental or full saves, object streams, re-encryption, resource de-duplication when
+  combining.
+- Other formats: images and text in (`create`); PNG/JPEG/TIFF, text, RTF, Word and HTML out
+  (`export`, `render`); FDF/XFDF/XML/CSV/TXT form and comment data (`xfdf`); PKCS #12, X.509,
+  PEM/DER certificates (`sign`). Full matrix: [file-format-parity.md](file-format-parity.md).
+
+## Agent control
+
+Every user-facing feature is reachable headlessly (`AGENTS.md` §3):
+
+- the **command registry** (`crates/engine/src/commands.rs`, 184 commands) generates menus,
+  shortcuts and the command palette;
+- the **automation tool table** (`crates/automation`, 141 tools) is shared by `pdfcraft-cli run`
+  and the opt-in **MCP server** (stdio only; `pdfcraft-cli mcp`), confined to `--root`;
+- the opt-in **UI control channel** (`pdfcraft --control FILE`; loopback, per-launch token) lets an
+  agent inspect, click, type, run commands and take screenshots of the real interface.
+
+## Safety
+
+- `unsafe_code = "forbid"` workspace-wide; crates deny `unwrap`/`expect`/`panic!`; engine entry
+  points keep a last-resort `catch_unwind` (`AGENTS.md` §4).
+- Every input-derived size is bounded (decompression, images, recursion, content per page).
+- `cargo xtask fuzz` runs nightly; every finding becomes a synthetic regression test.
+
+## Build and quality gates
+
+`cargo xtask ci` runs fmt, clippy (`-D warnings`), tests, the layering check, the WASM check,
+`xtask assets` (asset licences and hashes), `xtask parity` (checklist claims must cite real commands,
+tools and tests) and `xtask deny` (dependency licences). Other tasks: `xtask fuzz`, `xtask corpus` and `xtask check` (robustness
+sweep over the pinned pdf.js corpus), `xtask text-oracle` (word F1 against `pdftotext`),
+`xtask demo-pdf`, `xtask screenshots`, `xtask models` (OCR models), `xtask version`. Releases are
+built by `.github/workflows/release.yml` ([releasing.md](releasing.md)).
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | major | Created from the code on main (crate list, `xtask/src/layers.rs`, crate READMEs, `vendor/README.md`) |
diff --git a/docs/editing-multiple-objects.md b/docs/editing-multiple-objects.md
new file mode 100644
index 000000000..2eb7d84a5
--- /dev/null
+++ b/docs/editing-multiple-objects.md
@@ -0,0 +1,87 @@
+# Move several objects together
+
+In **Edit a PDF → Edit text & images**, select several items on the same page:
+
+- **Shift-click**, **Ctrl-click**, or **Command-click** toggles an item. An ordinary selected
+  paragraph, image, or added item becomes the first member when you extend its selection.
+- Drag through empty page space to draw a selection rectangle. Items intersecting the rectangle
+  are selected; hold one of those modifiers to add to the selection.
+- Drag the selection to move all its items by the same distance. Blue outlines preview the move;
+  releasing commits it as **one undo step**. Escape cancels the gesture or clears the selection.
+- Switching tabs, opening Home or a modal dialog, or losing window focus cancels a drag preview.
+  Returning to the document keeps the selection without committing a release from elsewhere.
+- Modifier-clicks prefer added items and text over background artwork, so labels remain selectable.
+- Clear the selection or double-click an item to return to ordinary text editing and image resizing.
+  Finish or discard a text draft before starting a multi-selection.
+
+The supported items are the existing paragraph boxes, raster Image XObjects, whole Form artwork,
+and text/images added by PdfCraft. A Form remains one item, including its nested artwork and
+resources. Added items appear once in the selection inventory. Selections stay on one page and
+contain at most 1,000 items; pages with more than 10,000 recognised objects are refused for group
+selection. Content streams must decode completely within 64 MiB each and 128 MiB per page, with
+a 1,024-level graphics-state limit and 100,000 content operations. These limits apply to both the
+original page and the moved result; unreadable or missing streams are refused. Moving between pages,
+arbitrary paths, inline images, group resizing, align/distribute,
+and vertical or clipping text are outside this operation's scope. A refusal changes nothing.
+
+Added streams move by changing their outer placement, preserving drawing bytes, fonts, crop paths,
+and image transforms even if the page was rotated after the item was added. Their original local
+coordinate basis is retained in `/PCAdded/MoveOrigin` so metadata and source placement agree after
+repeated moves. Ordinary content updates replace that stream and reset the basis.
+
+Existing text moves without retyping, font substitution, or reflow: its original encoded glyph
+strings and kerning are replayed with temporary numeric `TJ` adjustments and text rise. The reader
+performs the original glyph advances, so following unselected text keeps its position. Paragraph
+indices can change when detection groups lines differently after a move. The UI remaps its own
+selection only when the new geometry matches uniquely; other document edits clear stale selection.
+
+## Engine
+
+`Document::editable_objects(page)` returns a mixed inventory with zero-based `ObjectTarget`
+references and user-space rectangles. Apply `Edit::MoveObjects { page, objects, offset }` through
+`Session`. Targets resolve together before mutation. Permission checks, dirty state, history,
+incremental saving, and refreshing use the same transaction as other edits.
+
+`Document::object_move_offset(page, [dx, dy])` converts a displayed-page vector (points, right/down)
+to the user-space vector required by the edit, accounting for the crop box, `/Rotate`, and `/UserUnit`.
+A frontend with an additional view rotation converts its pointer positions to displayed page space
+first. Duplicate, missing, non-finite, oversized, or unsupported targets fail atomically. Engine callers
+re-list after changes; the automation generation guard detects stale references before the edit.
+
+## CLI and MCP
+
+Both frontends use the same tools. `object_list` returns a document `generation` and items with
+`kind` (`added`, `text`, or `image`), 1-based `index`, `type`, displayed `rect`, and optional `text`.
+Treat those references as belonging to that generation and pass it back when moving:
+
+```json
+[
+  {"tool":"doc_open","args":{"path":"input.pdf"}},
+  {"tool":"object_list","args":{"doc":1,"page":1}}
+]
+```
+
+After choosing references from the returned list, use a move call like this in the same MCP
+session. For a CLI script, include `doc_open` in that script before the move:
+
+```json
+[
+  {"tool":"object_move","args":{
+    "doc":1,"page":1,"generation":0,
+    "objects":[{"kind":"text","index":1},{"kind":"image","index":1}],
+    "offset":[24,18]
+  }},
+  {"tool":"doc_save","args":{"doc":1,"path":"moved.pdf"}}
+]
+```
+
+Use the actual generation and references from your document, rather than assuming these example
+values. `offset` is in displayed points: positive x moves right, positive y moves down. The optional
+generation guard rejects a changed document before interpreting references. Re-list after any edit,
+undo, redo, or save; there is no claim that an index persists across generations. Run a script with
+`pdfcraft-cli run --script steps.json --root DIR` or call these tools through the opt-in MCP server.
+
+Regression coverage: `crates/edit/src/tests.rs` (glyph bytes, neighbours, split streams, shared Forms,
+rotated/cropped/UserUnit pages and refusal), `crates/engine/src/tests.rs` (permissions, history,
+rendering and save/reopen), `crates/automation/tests/automation.rs` (generation guards and hostile
+references), and `crates/ui-egui/tests/object_selection.rs` (real-shell selection and gestures).
diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md
new file mode 100644
index 000000000..4fc21f59d
--- /dev/null
+++ b/docs/file-format-parity.md
@@ -0,0 +1,112 @@
+# File format parity
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (first format matrix; Acrobat's formats from its bundle) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+
+Every format Acrobat Pro reads or writes, and PdfCraft's support for it. Acrobat's list comes from
+its bundle's `Info.plist` `CFBundleDocumentTypes` (what it opens) and its public documentation
+(Create PDF and Export PDF). PdfCraft's support comes from the code and
+`parity/acrobat-features.toml`. Summary in [target-app-parity.md](target-app-parity.md); gaps
+in [gaps.md](gaps.md).
+
+Legend: **R** read/import, **W** write/export. Fidelity: *high* (tested against an external oracle
+or round-trips exactly), *good* (tested, known limits), *basic* (works, visibly lossy), *none*.
+
+**File formats and conversion ≈ 40% ready** (estimated): PDF itself is strong except encrypted
+output interoperability; the conversion formats users reach for most (Word, Excel, PowerPoint,
+Office to PDF, OCR beyond English) are weak or missing. **120–220 h** to parity (within the
+features total).
+
+## PDF
+
+| Format | Acrobat | PdfCraft | Fidelity | Tests and evidence |
+|---|---|---|---|---|
+| PDF 1.0–1.7, ISO 32000-1 | R W | R W | high for reading and unencrypted writing | 958-file pdf.js corpus open/edit/save; `qpdf --check` on saved outputs; `xtask check` baselines |
+| PDF 2.0 (ISO 32000-2) | R W | R W (2.0-only features ignored but preserved) | good | No UTF-8 strings, `/AF`, DPart, namespaces ([pdf-spec-parity.md](pdf-spec-parity.md)) |
+| Encrypted PDF (standard security R2–R6) | R W | R W | **reading high; writing fails in Acrobat and Reader** | `crates/crypt`, `crates/cos` tests; all 7 corpus encrypted files open; **#774** |
+| Certificate-encrypted PDF (public-key handler) | R W | none (clear message) | none | `core.unsupported-handlers` |
+| Linearized PDF (Fast Web View) | R W | R (as normal PDF); no W | none for W | `core.linearization` planned |
+| Damaged PDF | R (repair) | R (repair, logged) | high | `core.repair-broken-files`, nightly fuzzing |
+| PDF/A-1, 2, 3, 4 | R W, verify | R; verify/convert 2b and 3b (partial) | basic | `optimize.pdfa-*`; veraPDF not yet used as oracle |
+| PDF/X, PDF/UA, PDF/E, PDF/VT | R W, verify | R only | none | [pdf-spec-parity.md](pdf-spec-parity.md) |
+| PDF Portfolio (collection) | R W | R as a PDF with attachments; no portfolio view | none | `organize.portfolio-*` planned |
+| XFA forms (in PDF) | R W (fill) | R, lay out dynamic forms, fill, save datasets (partial) | basic | `form.xfa-*` partial; `crates/xfa` tests |
+
+## Data and interchange formats
+
+| Format | Acrobat | PdfCraft | Fidelity | Tests and evidence |
+|---|---|---|---|---|
+| FDF (`.fdf`) comments and form data | R W | R W | good | `crates/xfdf`; bugs #807, #809, #819 in comment exchange |
+| XFDF (`.xfdf`, ISO 19444-1) | R W | R W | good | as above |
+| XML form data | R W | R W | good | `form.data-xml-csv-txt` |
+| XDP (`.xdp`, XFA data package) | R | none | none | Acrobat opens `.xdp` as a document type |
+| CSV / tab-delimited form data | W (merge to spreadsheet) | R W; merge to spreadsheet | good | `form.merge-to-spreadsheet` |
+| Comment summary (PDF) | W | W (comments only layout) | basic | `comment.summarize` partial |
+| Measurement CSV | W | W | good | `comment.measure-export` |
+| Compare report (PDF) | W | W | good | `misc.compare-report` |
+| Action Wizard sequences (`.sequ`) | R W | own JSON actions; no `.sequ` | none for `.sequ` | `misc.action-wizard-*` |
+| Security settings (`.acrobatsecuritysettings`), `.apf` profiles, `.secstore` | R W | none | none | out of scope unless asked |
+| Search index (`.pdx`) | R W | none | none | `view.search-index` planned |
+| JDF / MJD job definitions | R | none | none | `print.jdf` planned (P3) |
+| Preflight profiles (`.kfp`) and reports | R W | none | none | gap 9 |
+| PDF Optimizer settings (`.optimize`) | R W | none (dialog settings not saved as presets) | none | `optimize.optimizer-presets` planned |
+
+## Certificates and keys
+
+| Format | Acrobat | PdfCraft | Fidelity | Tests and evidence |
+|---|---|---|---|---|
+| PKCS #12 digital IDs (`.p12`, `.pfx`) | R W | R W (self-signed IDs) | high | OpenSSL-made fixtures (`crates/sign/tests/data/README.md`) |
+| Certificates (`.cer`, `.der`, `.pem`, `.p7c`, `.p7b`) | R W | R (`.cer/.pem/.der/.p12` trust import); W public certificate | good; `.p7c/.p7b` bundles not read | `sign.trust-import` partial, `sign.export-certificate` |
+| CMS / PKCS #7 signatures, RFC 3161 tokens, OCSP, CRL | R W | R W | high | `pdfsig` and OpenSSL oracles |
+
+## Create PDF from
+
+| Source | Acrobat | PdfCraft | Fidelity | Tests and evidence |
+|---|---|---|---|---|
+| JPEG, PNG, TIFF (multipage), GIF, BMP, JPEG 2000 | yes | yes (ICC profiles kept; DPI choices) | good | `create.from-images`, `create.from-multipage-tiff` |
+| PCX | yes | no | none | in Acrobat's document types |
+| Plain text | yes | yes | good | `create.from-text` |
+| Clipboard (image or text) | yes | yes | good | `create.from-clipboard` |
+| Screenshot | yes | no | none | `create.from-screenshot` planned |
+| Word, Excel, PowerPoint (and Visio, Publisher on Windows) | yes | no | none | `create.from-office` planned (LibreOffice sidecar) |
+| HTML file, web page URL | yes | no | none | `create.from-html`, `create.from-web-page` planned |
+| RTF | yes | no | none | |
+| PostScript / EPS (Distiller) | yes | no | none | `create.distiller` planned (P3) |
+| Markdown | no | no | none | `create.from-markdown` planned (P2; not an Acrobat feature) |
+| Scanner | yes | no | none | `ocr.scanner-acquire` planned |
+| Several files at once | yes | yes (PDFs, images and text) | good | `create.create-multiple` |
+
+## Export PDF to
+
+| Target | Acrobat | PdfCraft | Fidelity | Tests and evidence |
+|---|---|---|---|---|
+| Word (`.docx`) | yes, layout-preserving | flowing document: paragraphs, headings, bold/italic, colour, images, tables | **basic** (#773: layout lost, fake borders, duplicated pages) | `create.export-docx` partial |
+| Word 97–2003 (`.doc`) | yes | no | none | |
+| Excel (`.xlsx`), XML Spreadsheet 2003 | yes | no | none | `create.export-xlsx` planned |
+| PowerPoint (`.pptx`) | yes | no | none | `create.export-pptx` planned |
+| RTF | yes | yes | basic | `create.export-rtf` |
+| HTML (single page, multiple pages) | yes | single file with headings, paragraphs, images, tables | basic | `create.export-html` partial |
+| Plain text | yes | yes (reading order) | good (word-F1 0.98 vs `pdftotext`) | `create.export-text`, `xtask text-oracle` |
+| Accessible text (from tags) | yes | no | none | `create.export-accessible-text` planned |
+| PNG, JPEG, TIFF | yes | yes | good | `create.export-png`, `create.export-jpeg-tiff` |
+| JPEG 2000 | yes | no | none | `create.export-jpeg2000` planned |
+| All embedded images | yes | yes | good | `create.export-all-images` |
+| XML 1.0 | yes | no | none | `create.export-xml` planned |
+| SVG | no (dropped by Adobe) | no | none | `create.export-svg` planned |
+| PostScript, EPS | yes | no | none | `create.export-ps`, `create.export-eps` planned |
+
+## OCR (scans to searchable PDF)
+
+| Capability | Acrobat | PdfCraft | Fidelity |
+|---|---|---|---|
+| Searchable image (invisible text layer) | yes | yes (Tr 3 text fitted to word boxes) | good for English |
+| Editable text and images output | yes | no | none |
+| Languages | dozens (Latin with accents, Cyrillic, Greek, CJK, Arabic, Hebrew, Indic) | Latin without accents only (ocrs models) | **basic** (#744) |
+| Deskew, rotation, despeckle, background and halo removal, descreen | yes | no | none |
+| Camera images (edges, perspective, whiteboard, card) | yes | no | none |
+| MRC (adaptive) compression, PDF/A output of scans | yes | no | none |
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | major | Created from Acrobat 26.002.21931's `CFBundleDocumentTypes`, Acrobat's public Create/Export documentation, and PdfCraft's code and checklist |
diff --git a/docs/gaps.md b/docs/gaps.md
new file mode 100644
index 000000000..d1e90e348
--- /dev/null
+++ b/docs/gaps.md
@@ -0,0 +1,305 @@
+# Where PdfCraft falls short of Acrobat Pro
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** minor (alpha markers removed after the gate was re-judged: no gap blocks alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+
+Every known shortfall, one entry each, ranked by what it costs users. This is the work list: agents
+choose from the top unless the owner says otherwise, and prefer these over new P2/P3 checklist
+features. The numbers behind it are in [target-app-parity.md](target-app-parity.md); the per-feature
+detail is in `parity/acrobat-features.toml` (`cargo xtask parity --partial` lists what each partial
+feature lacks).
+
+No gap blocks the [alpha gate](roadmap.md#alpha-gate); gaps 1 and 8 hold the convert-and-share
+workflow's partial sub-cases and are the first beta items.
+
+Hours are Opus 5.5 agent wall-clock hours. "Doc" names the parity document the gap belongs to.
+When a gap closes, delete its entry, note it in the [ROADMAP.md](../ROADMAP.md) progress log and
+update the numbers.
+
+## Summary
+
+| # | Gap | Kind | Hours | Doc |
+|---|---|---|---|---|
+| 1 | Encrypted files we write don't open in Acrobat | file format | 8–15 | [file-format-parity.md](file-format-parity.md) |
+| 2 | Rendering is borrowed and its fidelity unmeasured | feature, spec | 110–190 | [pdf-spec-parity.md](pdf-spec-parity.md) |
+| 3 | Editing existing text is fragile on real files | feature | 100–180 | [target-app-parity.md](target-app-parity.md) |
+| 4 | No printing on Windows or the web | feature, platform | 15–30 | [hardware-parity.md](hardware-parity.md) |
+| 5 | Chinese UI shows missing-glyph boxes in releases | localization | 6–12 | [localization-parity.md](localization-parity.md) |
+| 6 | Open-issue backlog of wrong results in shipped features | stability | 45–80 | this file |
+| 7 | OCR reads only unaccented Latin | feature | 40–75 | [file-format-parity.md](file-format-parity.md) |
+| 8 | Office export weak, Office import absent | file format | 55–100 | [file-format-parity.md](file-format-parity.md) |
+| 9 | No Preflight; PDF/A partial; PDF/X and PDF/UA absent | standards | 65–115 | [pdf-spec-parity.md](pdf-spec-parity.md) |
+| 10 | Signatures: no PKCS #11, timestamp servers or online revocation | feature, hardware | 40–70 | [pdf-spec-parity.md](pdf-spec-parity.md) |
+| 11 | Accessibility: checker only, no tagging tools | feature | 40–70 | [target-app-parity.md](target-app-parity.md) |
+| 12 | No measured fidelity harness against Acrobat | quality | (in 2) | [target-app-parity.md](target-app-parity.md) |
+| 13 | Performance budgets and lazy loading of very large files | performance | 25–45 | this file |
+| 14 | Arabic not mirrored; no Hindi, Indonesian, Korean, Vietnamese | localization | 30–50 | [localization-parity.md](localization-parity.md) |
+| 15 | Forms: JavaScript object model, actions, submit, XFA depth | feature | 40–75 | [pdf-spec-parity.md](pdf-spec-parity.md) |
+| 16 | UI precision gaps (multi-select move, rulers, accelerators, windows) | UI/UX | 30–60 | [ui-parity.md](ui-parity.md) |
+| 17 | Certificate security and other protect gaps | feature, spec | 15–30 | [pdf-spec-parity.md](pdf-spec-parity.md) |
+| 18 | Print production tools absent | feature | 25–45 | [target-app-parity.md](target-app-parity.md) |
+| 19 | Preferences mostly missing | UI/UX | 15–25 | [ui-parity.md](ui-parity.md) |
+| 20 | Scanners, GPU page rendering, pen pressure, Read Out Loud | hardware | 25–50 | [hardware-parity.md](hardware-parity.md) |
+| 21 | Compare: no side-by-side view or filters | feature | 10–20 | [target-app-parity.md](target-app-parity.md) |
+| 22 | PDF 2.0 extras, linearization, Arlington validation | spec | 20–35 | [pdf-spec-parity.md](pdf-spec-parity.md) |
+| 23 | Local AI provider (summarize, ask, alt text, redaction suggestions) | AI | 20–40 | [target-app-parity.md](target-app-parity.md) |
+| 24 | Checklist not diffed against Acrobat's own menus | measurement | 4–8 | [target-app-parity.md](target-app-parity.md) |
+
+## The gaps
+
+### 1. Encrypted files we write don't open in Acrobat
+
+- **Missing:** interoperable encryption output. A document protected with a password in PdfCraft
+  opens in PdfCraft, SumatraPDF, PDF24 and LibreOffice, but Adobe Reader, Acrobat and PDF-XChange
+  report it as damaged.
+- **Evidence:** [#774](https://github.com/storytold/pdfcraft/issues/774) (2026-10-10, confirmed by a
+  second user). Our encryption tests round-trip through our own reader and `qpdf --check`, which
+  is more lenient than Acrobat.
+- **Impact:** blocking. Passwords are the most common reason to touch security; a file a recipient
+  can't open is data loss in practice. Partial sub-case of the convert-and-share gate row (unencrypted sharing works), so not an alpha blocker; the first beta item.
+- **Fix:** find the divergence (likely `/Encrypt` dictionary or R6 `/Perms`/`/OE`/`/UE` details, or
+  a string/stream encrypted that must not be), then add an interop suite that opens every kind of
+  output we write in other readers (pdf.js, MuPDF and Poppler as oracle processes; Acrobat by hand
+  on the owner's Mac).
+- **Estimate:** 8–15 h. **Doc:** [file-format-parity.md](file-format-parity.md).
+
+### 2. Rendering is borrowed and its fidelity unmeasured
+
+- **Missing:** our own renderer (M2: `model` crate, font engine, DisplayList devices, ADR-0004), or
+  an owner decision to adopt another engine; and any measurement of rendering against Acrobat.
+- **Evidence:** pages are drawn by vendored `hayro` 0.7 with 22 local patches to `hayro-interpret`,
+  9 to `hayro`, 3 to `hayro-jbig2` and 13 to `hayro-syntax` (`vendor/README.md`); `lopdf` still
+  backs document inspection. All 7 rendering P0 features are `partial`. User reports: TikZ pattern
+  fills drawn wrong ([#794](https://github.com/storytold/pdfcraft/issues/794)), blurry text at
+  1080p/1440p ([#730](https://github.com/storytold/pdfcraft/issues/730)), fixed zoom sizes differ
+  from Acrobat ([#739](https://github.com/storytold/pdfcraft/issues/739)). An outside author
+  proposes his MIT/Apache renderer as the bridge
+  ([#841](https://github.com/storytold/pdfcraft/issues/841)).
+- **Impact:** every page a user sees. Wrong glyphs, shadings or blend modes erode trust faster than
+  any missing feature.
+- **Fix:** first a fidelity harness (gap 12), then the renderer: own devices (150–250 h in the old
+  plan) or an adopted engine plus our own font and text layers.
+- **Estimate:** 110–190 h (includes the harness). **Owner decision needed** on #841 vs M2.
+  **Doc:** [pdf-spec-parity.md](pdf-spec-parity.md).
+
+### 3. Editing existing text is fragile on real files
+
+- **Missing:** robust in-place editing of text PdfCraft didn't write: subset fonts without the
+  needed glyphs, CJK and right-to-left text, rotated text, lists, superscript/subscript, keeping
+  structure tags, find and replace in edit mode; vector and object editing; arrange and align.
+- **Evidence:** `edit.text-edit` is partial (font reused or Helvetica substituted);
+  `edit.rtl-cjk-editing`, `edit.rotated-text-editing`, `edit.keep-tags-on-edit`,
+  `edit.vector-edit`, `edit.edit-object-tool` are planned. Users:
+  [#766](https://github.com/storytold/pdfcraft/issues/766) (editing Arabic text),
+  [#844](https://github.com/storytold/pdfcraft/issues/844) (can't move several elements),
+  [#787](https://github.com/storytold/pdfcraft/issues/787) (move images between pages),
+  [#791](https://github.com/storytold/pdfcraft/issues/791).
+- **Impact:** "Edit PDF" is one of Acrobat Pro's top reasons to buy. Substituting Helvetica changes
+  how a document looks.
+- **Estimate:** 100–180 h (the longest feature pole, M7). **Doc:** [target-app-parity.md](target-app-parity.md).
+
+### 4. No printing on Windows or the web
+
+- **Missing:** a Windows spooler (and printer properties), browser printing.
+- **Evidence:** [#756](https://github.com/storytold/pdfcraft/issues/756): on Windows 11 the Print
+  dialog only saves a PDF. `crates/print/README.md`: "Not yet: Windows and web spoolers".
+- **Impact:** Windows is most of Acrobat's market. Printing is a P0 workflow.
+- **Estimate:** 15–30 h. **Doc:** [hardware-parity.md](hardware-parity.md).
+
+### 5. Chinese UI shows missing-glyph boxes in releases
+
+- **Missing:** a Simplified Chinese (`Hans`) UI face in release builds and a working fallback.
+- **Evidence:** [#826](https://github.com/storytold/pdfcraft/issues/826),
+  [#688](https://github.com/storytold/pdfcraft/issues/688),
+  [#728](https://github.com/storytold/pdfcraft/issues/728),
+  [#758](https://github.com/storytold/pdfcraft/issues/758),
+  [#689](https://github.com/storytold/pdfcraft/issues/689) (Flatpak). `AGENTS.md` §1.1 bars Noto
+  CJK (Source Han rebranded), so craft-fonts needs another openly licensed Hans face.
+- **Impact:** the second-largest language group sees a broken interface although the catalog is 97%
+  translated.
+- **Estimate:** 6–12 h (font sourcing in craft-fonts plus the fallback chain). **Doc:**
+  [localization-parity.md](localization-parity.md).
+
+### 6. Open-issue backlog of wrong results in shipped features
+
+- **Missing:** fixes for ≈ 25 filed reports of features marked `shipped` that give wrong results,
+  plus triage of ≈ 220 other open issues.
+- **Evidence:** 245 open issues on 2026-10-10, e.g. XFDF exchange loses polygon vertices and turns
+  callouts into text boxes (#809, #819), page deletion leaves null destinations (#817, #821),
+  automatic URL linking panics on Unicode text (#816), autosave skips new unsaved PDFs (#815),
+  saving ignores typing in an open paragraph (#811), automation reports success after replacing an
+  earlier result (#799, #800), Shift-Cmd-G goes forward (#810).
+- **Impact:** every one is a user who lost trust. #816 is a crash, which outranks feature work
+  (`AGENTS.md` §4).
+- **Estimate:** 45–80 h (≈ 0.2–0.4 h per issue). **Doc:** this file.
+
+### 7. OCR reads only unaccented Latin
+
+- **Missing:** every other script and accented Latin; editable-text output; deskew, rotation,
+  despeckle, background and camera clean-up; MRC compression; pluggable engines; OCR in the
+  browser; scanner input.
+- **Evidence:** `ocr.ocr-languages` partial ("the models read only the Latin alphabet without
+  accents"); 19 of 26 OCR features planned; [#744](https://github.com/storytold/pdfcraft/issues/744)
+  (Dutch). Acrobat ships on-device recognition for dozens of languages.
+- **Impact:** scanned documents are a core Pro workflow outside English.
+- **Estimate:** 40–75 h, partly blocked on openly licensed models. **Doc:**
+  [file-format-parity.md](file-format-parity.md).
+
+### 8. Office export weak, Office import absent
+
+- **Missing:** Word export that keeps layout; Excel and PowerPoint export; creating PDFs from Office,
+  HTML, web pages and PostScript; SVG/XML/EPS/PS/JPEG 2000 export.
+- **Evidence:** `create.export-docx` partial; [#773](https://github.com/storytold/pdfcraft/issues/773)
+  (an invoice converted to Word loses its layout, gains table borders and duplicates pages);
+  `create.export-xlsx`, `create.export-pptx`, `create.from-office`, `create.from-html` planned.
+- **Impact:** "Export PDF" and "Create PDF" are two of Acrobat's most used tools.
+- **Gate:** lossy or missing sub-cases of the convert-and-share workflow (partial, not blocking).
+  First beta items: Create PDF from Office (LibreOffice sidecar, 10–20 h) and a Word export that
+  keeps layout (20–35 h).
+- **Estimate:** 55–100 h. **Doc:** [file-format-parity.md](file-format-parity.md).
+
+### 9. No Preflight; PDF/A partial; PDF/X and PDF/UA absent
+
+- **Missing:** Preflight (profiles, single checks and fixups, results tree, reports, droplets);
+  PDF/A-1, PDF/A-4 and conformance levels a/u; PDF/X verify and convert; PDF/UA-1/2 verify; PDF/E,
+  PDF/VT; output-intent choice; transparency flattening.
+- **Evidence:** 12 Preflight features and 9 standards features planned; `optimize.pdfa-validate`,
+  `optimize.pdfa-convert` partial (2b/3b structural rules; CMYK documents get no output intent).
+  Acrobat ships hundreds of built-in Preflight profiles.
+- **Impact:** blocks print shops, archives and accessibility compliance work.
+- **Estimate:** 65–115 h. **Doc:** [pdf-spec-parity.md](pdf-spec-parity.md).
+
+### 10. Signatures: no PKCS #11, timestamp servers or online revocation
+
+- **Missing:** PKCS #11 tokens and smart cards on macOS and Linux; timestamp-server preferences;
+  fetching OCSP/CRL online for LTV; FieldMDP and locking fields on signing; the OS trust store; EU
+  Trusted Lists; signature graphics and saved appearances; compare signed version; signing in the
+  browser.
+- **Evidence:** `sign.pkcs11`, `sign.timestamp-servers`, `sign.field-mdp`, `sign.os-trust`,
+  `sign.eutl` planned; `sign.pades-bt`, `sign.ltv`, `sign.ocsp-crl` partial (caller-supplied
+  evidence). Users ask for Acrobat-like validation
+  ([#824](https://github.com/storytold/pdfcraft/issues/824),
+  [#775](https://github.com/storytold/pdfcraft/issues/775),
+  [#718](https://github.com/storytold/pdfcraft/issues/718)).
+- **Impact:** government and legal users sign with tokens and need B-LT/B-LTA.
+- **Estimate:** 40–70 h; tokens need hardware to test. **Doc:** [pdf-spec-parity.md](pdf-spec-parity.md).
+
+### 11. Accessibility: checker only, no tagging tools
+
+- **Missing:** autotag (document and fields), Tags, Order and Content panels, tag properties,
+  Reading Order tool, artifact marking, table editor, role map, Make Accessible action, Read Out
+  Loud; full keyboard operation of PdfCraft itself and a screen-reader audit.
+- **Evidence:** all 32 checker rules shipped, but 21 tagging and reading features planned;
+  `a11y.keyboard-only` (P0) planned, `a11y.app-screen-reader` partial.
+- **Impact:** remediation work is impossible; PdfCraft itself is not yet usable without a mouse.
+- **Estimate:** 40–70 h. **Doc:** [target-app-parity.md](target-app-parity.md).
+
+### 12. No measured fidelity harness against Acrobat
+
+- **Missing:** side-by-side comparison of rendering, text extraction, form calculation and
+  signature validation against Acrobat on synthetic fixtures.
+- **Evidence:** none exists; only text extraction has an oracle (word-F1 0.98 against `pdftotext`).
+  Acrobat captures must stay local in `plan/acrobat/` (clean-room, `AGENTS.md` §1.1).
+- **Impact:** until it exists, every quality number here is a judgement.
+- **Estimate:** counted in gap 2 (≈ 20–30 h of it). **Doc:** [target-app-parity.md](target-app-parity.md).
+
+### 13. Performance budgets and lazy loading of very large files
+
+- **Missing:** `misc.performance-budgets` (P0) and `core.lazy-loading` (P0): open GB files within a
+  memory budget, with budgets checked on Tier-1 platforms.
+- **Evidence:** #307 brought a 9,156-page file from > 10 GiB to ≈ 500 MiB inspection, but
+  file-backed input and global memory budgets remain open; blurry fonts at common resolutions
+  (#730).
+- **Estimate:** 25–45 h. **Doc:** this file.
+
+### 14. Arabic not mirrored; no Hindi, Indonesian, Korean, Vietnamese
+
+- **Missing:** a right-to-left layout (panels, menus, alignment), bidirectional text in the text
+  layout itself (wrapping, typed text); catalogs for Hindi, Indonesian, Korean and Vietnamese
+  (Acrobat ships Korean; it ships Arabic in its Middle East edition; it ships none of the other
+  three).
+- **Evidence:** [localization.md](localization.md) §Arabic; `misc.rtl-ui` planned.
+- **Estimate:** 30–50 h (Arabic RTL 20–35, four catalogs 10–15 plus review). **Doc:**
+  [localization-parity.md](localization-parity.md).
+
+### 15. Forms: JavaScript object model, actions, submit, XFA depth
+
+- **Missing:** the wider Acrobat JavaScript object model (annotations, layers, dialogs), document
+  actions, the Actions tab triggers that run JavaScript, form submission, the debugger, barcode
+  fields, rich-text values; XFA flattening and complete dynamic-form fidelity.
+- **Evidence:** `form.js-host` partial, `form.document-actions`, `form.submit-form`,
+  `edit.action-javascript`, `form.js-debugger`, `form.xfa-flatten` planned; XFA layout, FormCalc
+  and data partial.
+- **Estimate:** 40–75 h. **Doc:** [pdf-spec-parity.md](pdf-spec-parity.md).
+
+### 16. UI precision gaps
+
+- **Missing:** moving several selected objects together (#844), nudging with arrow keys, single-key tool accelerators,
+  rulers, grids and guides, loupe and dynamic zoom, multiple windows and split view, comment
+  pop-ups that can be moved, connector lines, customisable quick tools, column text selection
+  (#740); shortcut display and touchpad scrolling bugs (#746, #759, #721), macOS window controls
+  (#789).
+- **Estimate:** 30–60 h. **Doc:** [ui-parity.md](ui-parity.md).
+
+### 17. Certificate security and other protect gaps
+
+- **Missing:** encrypting for certificate recipients (and opening such files), security policies,
+  attachment-only encryption, redaction pattern locales and partial-word redaction, folder
+  redaction, protected view, URL and attachment trust.
+- **Estimate:** 15–30 h. **Doc:** [pdf-spec-parity.md](pdf-spec-parity.md).
+
+### 18. Print production tools absent
+
+- **Missing:** Output Preview, separations, total area coverage, overprint preview, ink manager,
+  colour conversion, printer marks, fix hairlines, flattener preview, colour management settings;
+  print as image; PostScript output.
+- **Evidence:** 18 print-production features planned (L area).
+- **Estimate:** 25–45 h (part of the L area's 30–55). **Doc:** [target-app-parity.md](target-app-parity.md).
+
+### 19. Preferences mostly missing
+
+- **Missing:** most of Acrobat's twenty or so preference pages (General, Documents, Commenting, Forms, Identity,
+  Signatures, Security, Measuring, Units and guides, Convert, …). Today: Interface language,
+  Documents and view, Identity, Fill & Sign, JavaScript.
+- **Estimate:** 15–25 h. **Doc:** [ui-parity.md](ui-parity.md).
+
+### 20. Scanners, GPU page rendering, pen pressure, Read Out Loud
+
+- **Missing:** TWAIN/WIA/ICA/SANE scanning; GPU-accelerated page rendering (pages are rasterized on
+  the CPU and uploaded); pressure-sensitive ink; platform text-to-speech.
+- **Estimate:** 25–50 h; scanners need hardware. **Doc:** [hardware-parity.md](hardware-parity.md).
+
+### 21. Compare: no side-by-side view or filters
+
+- **Missing:** synchronised side-by-side view, filters by change type, page ranges, scanned
+  documents.
+- **Estimate:** 10–20 h. **Doc:** [target-app-parity.md](target-app-parity.md).
+
+### 22. PDF 2.0 extras, linearization, Arlington validation
+
+- **Missing:** UTF-8 text strings, associated files (`/AF`), document parts, structure namespaces;
+  linearized save (Fast Web View); deterministic save; structural validation against the Arlington
+  model.
+- **Estimate:** 20–35 h. **Doc:** [pdf-spec-parity.md](pdf-spec-parity.md).
+
+### 23. Local AI provider
+
+- **Missing:** the opt-in provider interface (local model or the user's own endpoint) and the
+  features on it: summarize, ask with page citations, alternate-text and redaction suggestions.
+  Acrobat's AI Assistant is a cloud service and out of scope.
+- **Estimate:** 20–40 h. **Doc:** [target-app-parity.md](target-app-parity.md).
+
+### 24. Checklist not diffed against Acrobat's own menus
+
+- **Missing:** a menu and tool listing captured from Acrobat (names only, `plan/acrobat/`, never
+  committed) diffed against the checklist, so that features the checklist never listed show up.
+  Also correct `misc.localization` and `misc.installers`, which are still `planned` though both
+  ship.
+- **Estimate:** 4–8 h. **Doc:** [target-app-parity.md](target-app-parity.md).
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | minor | Removed the alpha markers: with the cross-app gate rule, gaps 1 and 8 are partial sub-cases, not blockers; stage alpha |
+| 2026-10-10 | minor | Marked the alpha blockers (gap 1 and the Office part of gap 8) after the core-workflow gate put the stage at pre-alpha |
+| 2026-10-10 | major | Created. Ranked 24 gaps from the 2026-10-10 re-measure, the open GitHub issues and the former ROADMAP.md §Where we're lacking and where we're going (renderer, hardening, fidelity, editing, Pro workflows, 1.0 polish), which this file replaces |
diff --git a/docs/hardware-parity.md b/docs/hardware-parity.md
new file mode 100644
index 000000000..1e68f0bf8
--- /dev/null
+++ b/docs/hardware-parity.md
@@ -0,0 +1,43 @@
+# Hardware and platform parity
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (first hardware and platform matrix) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+
+Each hardware feature Acrobat Pro uses, per platform, ours against Acrobat's. Acrobat runs on macOS
+and Windows (plus a limited web viewer/editor in Document Cloud); PdfCraft runs on macOS, Windows,
+Linux, FreeBSD and the web. Gaps ranked in [gaps.md](gaps.md).
+
+**Hardware ≈ 35% ready, 25–50 h** (additional to the features total; scanners, smart cards and
+printing are counted in their feature areas). **Platforms ≈ 70% ready, 15–30 h.**
+
+## Hardware
+
+| Feature | Acrobat (macOS / Windows) | PdfCraft macOS | PdfCraft Windows | PdfCraft Linux / FreeBSD | PdfCraft web | Evidence |
+|---|---|---|---|---|---|---|
+| GPU page rendering | yes (Page Display ▸ GPU-accelerated rendering) | no: CPU raster, GPU for UI compositing (wgpu, Metal) | no (wgpu DX12, GL fallback) | no (wgpu Vulkan/GL) | no (WebGL/WebGPU UI) | `crates/render`; gap 20 |
+| Multi-threaded rendering | yes | yes (render pool, tiles, watchdog) | yes | yes | single thread | `view.render-priority` |
+| HiDPI / Retina | yes | yes | yes, per-monitor DPI v2 (#324, #725) | yes | yes | text blurry at 1080p/1440p (#730) |
+| Multiple monitors | yes, multiple windows | one window | one window; surfaces fit the GPU limit (#577) | one window | n/a | `view.multiple-windows` planned |
+| Printers | all, PostScript, printer properties | CUPS spooler | **none** (#756) | CUPS spooler | **none** | `crates/print/README.md` |
+| Scanners (TWAIN, WIA, ICA) | yes | none | none | none (SANE) | n/a | `ocr.scanner-acquire` planned |
+| Smart cards and USB tokens | yes (PKCS #11, CryptoTokenKit, CNG) | Keychain identities (software keys) | CNG store keys, with PIN prompts for cards (#742) | none (PKCS #11 planned) | none | `sign.pkcs11` planned |
+| Pen and touch | Touch mode, pen ink, Windows Ink | trackpad pinch zoom; ink from pointer, no pressure | ink from pointer, no pressure or touch mode | as macOS | pointer | touchpad scrolling not 1:1 (#759) |
+| Keyboard input methods (IME) | yes | yes; Japanese and Korean IME fixes patched into winit | yes (Microsoft Korean cursor fix) | X11 and Wayland IME fixes | browser | `vendor/README.md` winit patches 2–10 |
+| Screen readers | VoiceOver, NVDA, JAWS | AccessKit labels (partial) | AccessKit (partial) | AccessKit (partial) | partial | `a11y.app-screen-reader` partial |
+| Text to speech (Read Out Loud) | yes | none | none | none | none | `a11y.read-aloud` planned |
+| Apple Silicon / ARM64 | native | native | ARM64 build (#61) | ARM64 builds | n/a | `release.yml` |
+
+## Platforms
+
+| Platform | Acrobat | PdfCraft | Packaging | Gaps |
+|---|---|---|---|---|
+| macOS | yes | yes | signed and notarized DMG | — |
+| Windows (x64, x86, ARM64) | yes (x64, ARM64) | yes | signed installers | printing (#756) |
+| Linux | no | yes | AppImage, deb, rpm, Flatpak, tarball | Chinese faces in Flatpak (#689) |
+| FreeBSD | no | yes | package | — |
+| Web | Acrobat online (cloud) | yes (WASM, offline in the browser) | static site | printing, OCR, crash recovery, PKCS #12 signing, hosted deployment |
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | major | Created from the code, `vendor/README.md`, `.github/workflows/release.yml`, the print crate's README and user issues |
diff --git a/docs/localization-parity.md b/docs/localization-parity.md
new file mode 100644
index 000000000..0ea3daa7e
--- /dev/null
+++ b/docs/localization-parity.md
@@ -0,0 +1,72 @@
+# Localization parity
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (first per-language status, measured from the catalogs) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+
+Per-language status of PdfCraft's interface against Acrobat Pro's. How translations work and how to
+add a language: [localization.md](localization.md). Summary in [ROADMAP.md](../ROADMAP.md).
+
+## How this was measured
+
+- **Strings translated** is measured: the catalogs in `crates/ui-egui/src/i18n/<code>.tsv`, counted
+  as distinct `(context, English)` keys with a non-empty translation. The denominator is the union
+  of keys across all catalogs, **2,143**. Cross-check: of the 1,151 distinct `tl!("…")` literals in
+  `crates/ui-egui/src`, every full catalog covers 96.5–99.4% (7 literals are in no catalog yet).
+  English is built in.
+- **Not counted:** error details from the engine and the operating system, which are shown in
+  English inside a translated frame; there is no translated user documentation or help yet (Acrobat
+  ships localized help).
+- **Script support** comes from [localization.md](localization.md), the vendored winit IME patches
+  (`vendor/README.md`) and user reports.
+- **Native review**: "community" means a native speaker contributed or corrected the catalog in a
+  pull request or issue; "no" means no record of review. No catalog has had a formal review.
+- **Acrobat** ships 24 interface localizations on macOS (`.lproj`: cs, da, de, en, es, fi, fr, hu,
+  it, ja, ko, nl, no, pl, pt, ru, sv, tr, uk, zh_CN, zh_TW, plus en_AE, en_IL, fr_MA) and Middle
+  East / North Africa editions (MEA Arabic, MEH Hebrew, NAF French; `Resources/Sequences/`).
+
+## The twelve key languages
+
+| Language | Code | UI strings translated | Dialogs / tooltips / help | Script support | Native review | Status | Acrobat ships it | To `full` (h) |
+|---|---|---|---|---|---|---|---|---|
+| English | `en` | built in (100%) | all; README and docs | Latin | yes | **full** | yes | 0 |
+| Simplified Chinese | `zh-hans` | 2,088 (97.4%) | dialogs and tooltips through `tl!`; no help | CJK text and IME work, but **release builds have no Hans face**: many characters show as boxes (#826, #688, #728, #758; Flatpak #689) | no | partial | yes | 6–12 |
+| Spanish | `es` | 2,046 (95.5%) | dialogs and tooltips; no help | Latin | no | partial | yes | 2–4 |
+| Hindi | `hi` | 0 | none | Devanagari not tested (egui shapes Telugu conjuncts, so shaping is likely workable); no Devanagari face in craft-fonts | no | none | no | 10–18 |
+| Arabic | `ar` | 2,143 (100%) | dialogs and tooltips; no help | Letters joined and lines reordered at load, but **layout not mirrored**, wrapped lines break at the wrong end, typed text runs left to right (`localization.md` §Arabic) | no | partial | yes (Middle East edition) | 25–45 |
+| French | `fr` | 2,128 (99.3%) | dialogs and tooltips; no help | Latin | no | partial | yes | 1–2 |
+| Portuguese (Brazil) | `pt-br` | 2,130 (99.4%) | dialogs and tooltips; no help | Latin | community (#288) | partial | yes | 1–2 |
+| Indonesian | `id` | 0 | none | Latin | no | none | no | 3–5 |
+| Japanese | `ja` | 2,123 (99.1%) | dialogs and tooltips; no help | BIZ UDPGothic from craft-fonts; IME patched on macOS, Windows, X11, Wayland; vertical text renders but can't be edited | no | partial | yes | 4–8 |
+| German | `de` | 2,128 (99.3%) | dialogs and tooltips; no help | Latin | community, in progress (#828: terminology, clipping) | partial | yes | 2–4 |
+| Korean | `ko` | 0 | none | Hangul IME patched (Microsoft and Apple Korean, `vendor/README.md` winit 3, 6, 9, 10); no Hangul UI face in craft-fonts | no | none | yes | 6–10 |
+| Vietnamese | `vi` | 0 | none | Latin with stacked diacritics; bundled Inter covers them (not tested) | no | none | no | 3–5 |
+
+**Localization dimension ≈ 59%**: the mean over the twelve, counting a catalog's percentage but only
+60% for Chinese and Arabic until their script problems are fixed, and 0 for the four missing
+languages. **≈ 60–115 h** to bring all twelve to `full`, of which ≈ 35–60 h is engineering (Hans
+face, RTL layout, bidi text) and the rest catalogs and fixes; native-speaker review needs humans.
+
+No language is `full` except English: every catalog leaves engine error details in English, and
+none has translated help.
+
+## Other shipped languages
+
+| Language | Code | UI strings translated | Status | Acrobat ships it |
+|---|---|---|---|---|
+| Traditional Chinese | `zh-hant` | 2,016 (94.1%) | partial (same Hans/Hant face caveat) | yes |
+| Russian | `ru` | 2,043 (95.3%) | partial | yes |
+| Bulgarian | `bg` | 2,094 (97.7%) | partial | no |
+| Czech | `cs` | 135 (6.3%) | menus only | yes |
+| Telugu | `te` | 2,058 (96.0%) | partial (the release-pinned craft-fonts has no Telugu face yet) | no |
+| Hungarian | `hu` | 2,126 (99.2%) | partial | yes |
+| Ukrainian | `uk` | 2,142 (100%) | partial | yes |
+| Italian | `it` | 2,130 (99.4%) | partial | yes |
+
+**8 other languages** ship (15 catalogs plus English, 16 interface languages in Preferences).
+Acrobat languages PdfCraft lacks: Danish, Dutch, Finnish, Norwegian, Polish, Swedish, Turkish,
+Hebrew.
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | major | Created. Catalog counts measured from `crates/ui-egui/src/i18n/*.tsv` against the 2,143-key union; Acrobat's localizations from its bundle's `.lproj` and Sequences folder names |
diff --git a/docs/localization.md b/docs/localization.md
index de74c4e8a..31fec64c1 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -2,6 +2,8 @@
 
 Choose **Menu > Edit > Preferences…** (Command-comma on macOS, Ctrl-comma elsewhere) **> Interface language** and select **Auto**, **English**, **日本語**, **简体中文**, **繁體中文**, **Русский**, **Български**, **Čeština**, **Português (Brasil)**, **Deutsch**, **Español**, **Français**, **తెలుగు**, **Magyar**, **Українська**, **Italiano** or **العربية**. The change applies immediately and persists between launches. Command ids, document contents and file names are unchanged.
 
+Displayed keyboard shortcuts use the same active interface language. For example, German shows `Strg+K` and `Strg+Umschalt+S` in the toolbar, menus, command palette, tooltips and Keyboard shortcuts dialog; macOS keeps its modifier symbols (`⌘`, `⇧`, `⌃`). Key names have their own `key` catalog context, so the Delete key can read `Entf` while the command remains `Löschen`. A missing key-name entry falls back to the English key name. Actual bindings and machine-facing command ids remain stable.
+
 **Auto** (the default) follows the system language: `LC_ALL`, `LC_MESSAGES` or `LANG`, then the preferred-languages list on macOS. Any Portuguese locale (`pt_BR`, `pt_PT`) uses the Brazilian catalog, any French locale (`fr`, `fr_FR`, `fr_CA`, `fr_BE`) the French one, any German locale (`de`, `de_DE`, `de_AT`, `de_CH`) the German one, and Chinese locales for Taiwan, Hong Kong and Macau (`zh_TW`, `zh_HK`, `zh_MO`, `zh-Hant`) the Traditional Chinese one; other Chinese locales (`zh`, `zh_CN`, `zh_SG`, `zh-Hans`) the Simplified Chinese one. Telugu locales (`te`, `te_IN`) use the Telugu catalog, Bulgarian locales (`bg`, `bg_BG`) the Bulgarian one, and Hungarian locales (`hu`, `hu_HU`) the Hungarian one, and Ukrainian locales (`uk`, `uk_UA`) the Ukrainian one, and Italian locales (`it`, `it_IT`, `it_CH`) the Italian one, and Arabic locales (`ar`, `ar_MA`, `ar_EG`, `ar_SA`, …) the Arabic one. A system language without a catalog shows English. On Windows, **Auto** uses the Windows display languages, in preference order, when no supported locale is selected by those environment variables. Neutral `C`/`POSIX` locale values (including `C.UTF-8`) inherited from a launcher do not override the Windows display language; explicitly named supported locales such as `fr_FR.UTF-8` still do. The query asks Windows directly (`GetUserPreferredUILanguages`, through the `sys-locale` crate) without starting a process, and is cached for the process. If detection fails or the display language has no catalog, PdfCraft shows English.
 
 The control channel exposes the setting through `ui.set`:
@@ -12,15 +14,13 @@ The control channel exposes the setting through `ui.set`:
 
 The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `de`, `es`, `fr`, `te`, `hu`, `uk`, `it`, `ar`), in any case. `ui.state` reports `language` as written in the preferences (`auto`, `en`, `ja`, `zh-hans`, `zh-hant`, `ru`, `bg`, `cs`, `pt-br`, `de`, `es`, `fr`, `te`, `hu`, `uk`, `it` or `ar`). Unknown values return an error without changing the current setting. Preferences saved before this setting existed follow the system language.
 
-Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian and Arabic translate them (about 1,800 entries each); Czech and Brazilian Portuguese cover the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
-Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian and Brazilian Portuguese translate them (about 1,800 entries each); Czech covers the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing.
+Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese and Arabic translate them (about 2,000–2,140 entries each); Czech covers the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing. Per-language coverage, script support and what each language still needs are in [localization-parity.md](localization-parity.md).
 
 The Ukrainian catalog has 2,047 entries, written from the meaning of the English labels using Ukrainian computing vocabulary. Commands use infinitives; fixed-count messages use count-neutral wording. Plural-aware messages use the three [CLDR Ukrainian integer forms](https://www.unicode.org/cldr/charts/48/supplemental/language_plural_rules.html#uk): `1 сторінка`, `2 сторінки`, `5 сторінок`; 11–14 take the third form, while 21 and 22 return to the first and second. Calendar dates use genitive month names (`9 жовтня 2026`), while headings use standalone names (`Жовтень 2026`). Home recommendation cards grow to fit translated text; the toolbar search hint truncates before the shortcut, with the full label available on hover.
 
 Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Bulgarian, Czech, Brazilian Portuguese, German, Spanish, French, Hungarian and Italian need only the bundled Latin faces (tested in `tests/fonts.rs`). Hungarian uses the same one/other plural rule as English: 1 is singular, and every other count — including 0 — is the other form. After a numeral the noun stays singular (`1 oldal`, `2 oldal`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
-The Brazilian Portuguese catalog has 2,000 entries: the ~1,826-entry gist André Cardoso posted in [#288](https://github.com/storytold/pdfcraft/issues/288), the labels added since, and a review of the existing wording. Portuguese, like French, treats 0 and 1 as singular (`1 página`, `2 páginas`).
 
-Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Bulgarian, Czech, Brazilian Portuguese, German, Spanish, French and Hungarian need only the bundled Latin faces (tested in `tests/fonts.rs`). Hungarian uses the same one/other plural rule as English: 1 is singular, and every other count — including 0 — is the other form. After a numeral the noun stays singular (`1 oldal`, `2 oldal`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
+The Brazilian Portuguese catalog has 2,000 entries: the ~1,826-entry gist André Cardoso posted in [#288](https://github.com/storytold/pdfcraft/issues/288), the labels added since, and a review of the existing wording. Portuguese, like French, treats 0 and 1 as singular (`1 página`, `2 páginas`).
 
 ## Arabic and right-to-left text
 
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
new file mode 100644
index 000000000..6c74039f5
--- /dev/null
+++ b/docs/pdf-spec-parity.md
@@ -0,0 +1,132 @@
+# PDF specification and standards parity
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (first spec-coverage checklist) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+
+How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
+what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
+the parts of the format users never see named but always feel. Feature-level detail is in
+`parity/acrobat-features.toml`; the gaps are ranked in [gaps.md](gaps.md).
+
+Legend: **own** (our code), **borrowed** (the vendored `hayro` bootstrap or `lopdf`), **partial**,
+**none**. "Evidence" names tests or checklist ids.
+
+**PDF specification and standards ≈ 60% ready** (estimated): syntax, encryption, annotations,
+AcroForm, redaction and signatures are our own and well tested; graphics, fonts and image codecs
+are borrowed; PDF 2.0 additions and most subset standards are missing. **150–260 h** to parity
+(within the features total; most of it is the renderer and font engine, and Preflight).
+
+## ISO 32000-2 by clause
+
+| Clause | Topic | Acrobat | PdfCraft | Evidence / what's missing |
+|---|---|---|---|---|
+| §7.2–7.5 | Syntax, objects, file structure, xref tables and streams, object streams, hybrid files, incremental updates | full | **own**, tolerant, repairs damaged files | `crates/cos`; corpus 958 files; fuzzed nightly |
+| §7.4 | Stream filters: Flate, LZW, ASCII85, ASCIIHex, RunLength, predictors | full | **own** | `crates/filters` |
+| §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode only) | `core.image-filters` partial; own codecs M1.1/M1.2; no JBIG2/CCITT encoding (Optimizer) |
+| §7.5.8 | Linearization | R W | R only | `core.linearization` planned |
+| §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; **written files rejected by Acrobat (#774)** |
+| §7.6.5 | Public-key security handler | full | none | `core.open-public-key`, `protect.certificate-encryption` planned |
+| §7.6.2 | Unencrypted signature `/Contents` | yes | yes | signing encrypted documents (#753) |
+| §7.9.2 | Text strings incl. PDF 2.0 UTF-8 | full | PDFDocEncoding and UTF-16; UTF-8 none | `core.pdf20-utf8-strings` planned |
+| §7.11 | File specifications, embedded files | full | read and save attachments; no add/delete/describe | `organize.attachments-*` planned |
+| §7.12 | Extensions dictionary | yes | preserved | |
+| §8 | Graphics: paths, colour spaces, patterns, shadings, images, XObjects | full | **borrowed** renderer; own content parser and serializer (`crates/content`) for editing and redaction | rendering P0s partial |
+| §8.6 | ICC-based colour, output intents, colour management | full | ICC preserved; sRGB output intent for PDF/A; no colour management settings or soft proofing | `print.color-management` planned |
+| §9 | Text and fonts: Type 1, TrueType, OpenType/CFF, Type 3, CID-keyed, CMaps, ToUnicode | full | **borrowed** rendering; own text extraction (word-F1 0.98); standard-14 metrics for generated appearances; embedded fonts reused for editing, else Helvetica | `view.render-type3`, `view.render-cid-fonts` partial; no own font engine; no font embedding/subsetting for arbitrary new text beyond craft-fonts Japanese |
+| §10 | Rendering: transfer functions, halftones, overprint, smoothness | full | borrowed; no overprint preview | `print.overprint-preview` planned |
+| §11 | Transparency: blend modes, soft masks, groups, knockout | full | borrowed (knockout shipped) | `view.render-transparency` partial |
+| §12.1–12.3 | Viewer preferences, page layout, page labels, outlines, destinations | full | **own**: initial view, page labels, bookmarks edit and from structure, named destinations rewired on copy | named-destination editing panel planned |
+| §12.4 | Page transitions, thumbnails, articles, presentations | full | none (thumbnails discarded or kept) | `organize.page-transitions`, `view.articles-panel` planned |
+| §12.5 | Annotations | 28 types | see table below | |
+| §12.6 | Actions | 19 types | see table below | |
+| §12.7 | Interactive forms (AcroForm): fields, appearances, calculation order, JavaScript actions | full | **own**: all field types, regenerated appearances, Acrobat's AF functions and event order, sandboxed JavaScript (boa) | `form.js-host` partial (object-model subset); submit planned |
+| §12.7.8 | XFA (deprecated in PDF 2.0; Acrobat still fills XFA) | static and dynamic | **own**, partial: template layout, FormCalc, XFA JavaScript model, datasets | `form.xfa-*` partial; no flattening |
+| §12.8 | Digital signatures | see table below | | |
+| §12.9 | Measurement and geospatial | full | 2D measuring with viewports and calibration; no geospatial | `comment.geospatial` planned |
+| §12.10 | Document requirements | yes | none | |
+| §13 | Multimedia: sound, movies, screen, rich media, 3D (U3D, PRC) | yes | preserved untouched; not played or shown | `misc.rich-media-*`, `misc.3d-view` planned (P3) |
+| §14.3 | Metadata: info dictionary, XMP | full, XMP editor | info dictionary edited; XMP kept in step for PDF/A; no XMP editor or custom properties | `organize.xmp-editor` planned |
+| §14.6–14.8 | Marked content, logical structure, tagged PDF | full, with editing tools | read (checker, bookmarks from structure, redaction of tags); no tag editing or autotag | gap 11 |
+| §14.9 | Accessibility support: alt text, ActualText, language | full | alt text figure by figure, language, title | `a11y.alt-text-workflow` |
+| §14.10 | Web capture | yes | none | |
+| §14.11 | Prepress: page boxes, output intents, trapping, OPI | full | page boxes and crop; sRGB output intent | `print.*` production planned |
+| §14.12 | Document parts (DPart) | yes | none | `core.pdf20-dpart` planned |
+| §14.13 | Associated files (`/AF`) | yes | none | `core.pdf20-associated-files` planned |
+| — | Structural validation (Arlington PDF model) | yes (Preflight syntax checks) | none | `core.arlington-validation` planned |
+| — | Optional content (layers) | full | **own** toggle and default state; set-OCG-state actions; no layer editing | `view.layers-panel` |
+| — | Redaction (`/Redact` annotations, applying) | full | **own**: removes glyphs, image pixels, vectors, XObject content, annotations, fields and tags; verifies no residue | `protect.redact-*`, `protect.redaction-verification` |
+
+## Annotations (§12.5.6)
+
+| Type | Acrobat | PdfCraft | Notes |
+|---|---|---|---|
+| Text (note), Popup | create, edit | create, edit; pop-ups not movable windows | `comment.popups` planned |
+| Link | create, edit | create, edit, from URLs | `edit.link-*` |
+| FreeText (text box, typewriter, callout) | create, rich text | create; rich text written but no per-run formatting | `comment.text-box` partial |
+| Line, Square, Circle, Polygon, PolyLine | create | create, all ten line endings | |
+| Highlight, Underline, Squiggly, StrikeOut | create | create | |
+| Caret (insert/replace text) | create | create; not snapped to text | `comment.insert-text` partial |
+| Stamp | create, custom, dynamic | create, custom, dynamic, Sign Here | stamp management planned |
+| Ink | create, erase | create, erase | no pressure |
+| FileAttachment | create | create | |
+| Sound | create, play | preserved | P3 |
+| Redact | create, apply | create, apply | own |
+| Widget | create, edit | create, edit | AcroForm |
+| Watermark | create | page-content watermarks (as Acrobat writes them); `/Watermark` annotations preserved | |
+| Screen, Movie, RichMedia, 3D | create, play | preserved | P3 |
+| PrinterMark, TrapNet | create (print production) | preserved | |
+| Projection | create (PDF 2.0) | preserved | |
+
+## Actions (§12.6.4)
+
+| Action | Acrobat | PdfCraft |
+|---|---|---|
+| GoTo | yes | yes (page with Fit; named destinations and zoom partial) |
+| GoToR, GoToE | yes | none (preserved; the Optimizer can remove invalid ones) |
+| Launch | yes (restricted) | none |
+| Thread | yes | none |
+| URI | yes | yes |
+| Sound, Movie, Rendition, GoTo3DView, RichMediaExecute | yes | none (P3) |
+| Hide | yes | yes |
+| Named | yes | safe list (print, page navigation) |
+| SubmitForm | yes | explained, not sent |
+| ResetForm | yes | yes |
+| ImportData | yes | via Import form data, not as an action |
+| JavaScript | yes | yes in fields and buttons (sandboxed); document actions none |
+| SetOCGState | yes | yes |
+| Trans | yes | none |
+
+## Digital signatures (§12.8, ETSI EN 319 142 PAdES)
+
+| Capability | Acrobat | PdfCraft |
+|---|---|---|
+| Sub-filters `adbe.pkcs7.detached`, `ETSI.CAdES.detached`; read `adbe.pkcs7.sha1`, `adbe.x509.rsa_sha1` | yes | yes |
+| PAdES B-B | yes | yes (PKCS #12, macOS Keychain, Windows store with PIN) |
+| PAdES B-T (signature timestamp), document timestamps | yes, with configured TSA | partial: works when a TSA is given; no timestamp-server preferences |
+| PAdES B-LT, B-LTA (DSS/VRI, OCSP/CRL) | yes, fetched online | partial: evidence supplied by the caller; no online fetching |
+| DocMDP certification | yes | yes |
+| FieldMDP (lock fields) | yes | none |
+| UR3 usage rights | preserved, Reader-extending is Adobe-only | none (P3) |
+| Seed values | yes | none |
+| Validation: chain, key usage, EKU, critical extensions, changes after signing, signed version | yes | yes; name constraints and issuer critical extensions missing |
+| Trust: own store, OS store, AATL, EUTL | yes | own store only; AATL out of scope; OS and EUTL planned |
+| Smart cards and tokens (PKCS #11, CryptoTokenKit) | yes | Windows CNG store (with PIN prompt) only |
+
+## Subset standards
+
+| Standard | Acrobat | PdfCraft | Hours |
+|---|---|---|---|
+| PDF/A-1a/b (ISO 19005-1) | verify, convert | none | |
+| PDF/A-2a/b/u, PDF/A-3a/b/u | verify, convert | **partial**: 2b and 3b structural rules and conversion (sRGB intent; not CMYK) | |
+| PDF/A-4, 4e, 4f | verify, convert | none | |
+| PDF/X-1a, X-3, X-4 (ISO 15930) | verify, convert | none | |
+| PDF/UA-1, PDF/UA-2 (ISO 14289) | verify (Preflight), checker | Accessibility Checker (32 rules, Acrobat's own), no PDF/UA verification | |
+| PDF/E, PDF/VT | verify, convert | none | |
+| Preflight (profiles, fixups, reports) | hundreds of profiles | none | |
+| Factur-X / ZUGFeRD (e-invoice in PDF/A-3) | Preflight checks | none | |
+| **All subset standards** | | | **65–115** (gap 9) |
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | major | Created from the code, `vendor/README.md` and `parity/acrobat-features.toml`, against ISO 32000-2 and Acrobat Pro 26.002.21931's documented capabilities |
diff --git a/docs/releasing.md b/docs/releasing.md
index 06b1c2ce6..8f88a4684 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -204,3 +204,44 @@ unsigned and the run shows a warning.
 a PowerShell parse, xmllint (WiX, plist, MIME), `desktop-file-validate`, `appstreamcli validate`, and
 the MSI icon-id check. The FreeBSD and Windows ARM64 workflows also exercise their packaging before a
 release does.
+
+## Scanner detections
+
+Antivirus and reputation scanners sometimes flag a released file. Check the facts before you change
+code or answer publicly. The first report was [issue #747](https://github.com/storytold/pdfcraft/issues/747),
+a match of the `CobaltStrikeBeacon` family rule.
+
+1. **Confirm the file is the release.** Compare its SHA-256 with `SHA256SUMS.txt` on the GitHub
+   Release. Only a file whose hash matches the release says anything about that release.
+2. **Record the signature.** `packaging/windows/security-audit.ps1` prints the Authenticode status:
+   - `Valid`: the signature verifies.
+   - `NotSigned`: no signature, as in developer and test builds. Not evidence of compromise by itself.
+   - `HashMismatch`: the file changed after it was signed. Investigate.
+   - `NotTrusted` or `UnknownError`: a signature exists but did not validate on this machine. Compare
+     the signer and the hash with the release.
+3. **Extract the payloads without running them.** Scan the executables inside the MSI and the
+   portable zip, not only the outer installer. `7z x -oDIR pdfcraft-<version>-windows-x64.msi`
+   extracts them. The payload names are WiX-internal, so tell the executables apart by their file
+   type. Don't install or run the MSI or the extracted files.
+4. **Scan with YARA and keep every match.** Use your own copies of YARA and the rule. PdfCraft
+   bundles neither, and the helper never runs in the app, the installer or CI:
+
+   ```powershell
+   pwsh packaging/windows/security-audit.ps1 -Path .\pdfcraft.exe, .\pdfcraft-cli.exe -YaraExe C:\tools\yara64.exe -YaraRule C:\rules\CobaltStrikeBeacon.yar
+   ```
+
+   The output lists each matched identifier with its offset, and the SHA-256 of the rule file.
+   Record where the rule came from and its revision. For CAPEv2's `CobaltStrikeBeacon` rule, that is
+   the commit that last changed `data/yara/CAPE/CobaltStrikeBeacon.yar`.
+5. **Find the condition branch.** Family rules usually have alternative branches, such as
+   `all of ($x*) or 2 of ($a*) or ...`. Copy the rule, make one rule per branch with only the strings
+   it uses, and scan again to see which branch fired.
+6. **Interpret with care.** A match on generic repeated-byte patterns says much less than a match on
+   distinctive code or strings, and it does not show that the software belongs to the family. Rules
+   change too: CAPEv2 commit `9b599185` (2024-12-05) lengthened this rule's two repeated-byte patterns
+   from 4 to 16 bytes to reduce false positives, so an older rule revision can match files that the
+   current one does not. Don't alter PdfCraft's binaries to change a scanner's result. That changes
+   nothing about the software.
+7. **Report.** To the scanner, send the file's SHA-256, the release URL, the rule name and revision,
+   and the matched identifiers and offsets. Report PdfCraft problems at
+   <https://github.com/storytold/pdfcraft/issues> with the same facts.
diff --git a/docs/roadmap.md b/docs/roadmap.md
new file mode 100644
index 000000000..216270a7a
--- /dev/null
+++ b/docs/roadmap.md
@@ -0,0 +1,127 @@
+# PdfCraft roadmap: milestones and what's next
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** minor (localized shortcut labels, #496; alpha gate added; convert-and-share re-judged with the cross-app rule → alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+
+Forward-looking: the milestones, the current focus and what comes next. The parity numbers behind
+it are in [target-app-parity.md](target-app-parity.md), the ranked work list in [gaps.md](gaps.md),
+and the one-page summary in [ROADMAP.md](../ROADMAP.md). Detailed task lists and acceptance tests
+live in `plan/execution-plan.md` (local-only, gitignored).
+
+Keep it current: update the milestone row and the [ROADMAP.md](../ROADMAP.md) progress log at the
+end of every session; re-estimate when a milestone lands.
+
+## Alpha gate
+
+The stage standard's gate: Acrobat Pro's everyday core workflows must each work end to end on the
+main platform (macOS), with the work saved and reopened. Any `no`, or a `partial` that blocks the
+workflow, keeps PdfCraft pre-alpha; those rows are the alpha checklist. Assessed 2026-10-10 with the
+rule applied across the Crafting Apps: a row blocks only when a typical user cannot complete the
+workflow at all with the app on its main platform for typical inputs; degraded fidelity, lossy
+exchange with Acrobat users or a missing sub-case is `partial, not blocking` (a beta item).
+
+| Core workflow | Works end to end? | Evidence | Hours to pass |
+|---|---|---|---|
+| View, search and print | yes | Render, find, select, panels, tiles; 500-page scrolling test; Print with CUPS on macOS and Linux (Windows printing missing, #756, a beta item). Rendering borrowed from `hayro` | 0 |
+| Organize, combine and split pages | yes | `organize.*` P0s shipped with tests; links, fields, layers and bookmarks carried over; open fixes #817, #821 are edge cases | 0 |
+| Comment and review | yes | Every markup type with appearances, replies, status, XFDF/FDF; comments saved in the PDF reopen in other readers. XFDF fidelity bugs #809, #819 | 0 |
+| Fill and sign forms | yes | All AcroForm field types, Acrobat's AF functions, Fill & Sign, PAdES signatures validated with `pdfsig`/OpenSSL | 0 |
+| Edit text and images | partial, not blocking | Editing a paragraph of Latin text works (embedded font reused, else Helvetica substituted, rewrapped); added text and images stay editable. Fails for CJK/RTL (#766), can't move several objects (#844); a beta item (gap 3) | 0 (beta: 100–180) |
+| Convert and share (Office ↔ PDF, password protection) | partial, not blocking | Unencrypted PDFs we save open in Acrobat and other readers (958-file corpus round trip, `qpdf --check`); export to Word, RTF, HTML, text and images works, lossily (#773: an invoice's layout lost in Word); Create PDF works from images, text, the clipboard and many files at once. Missing sub-cases: password-protected output that Acrobat and Reader accept (#774; the file opens in PdfCraft, SumatraPDF, PDF24 and LibreOffice), an in-app Create PDF from Office (Office on macOS saves PDF itself), Excel/PowerPoint export. All beta items (gaps 1, 8) | 0 (beta: 40–70 for #774, Office→PDF and a layout-keeping Word export) |
+
+**Result: alpha.** Every core workflow can be completed on macOS; two are lossy or missing sub-cases
+(editing CJK/RTL text; encrypted output for Acrobat users, Office→PDF, Word layout), which are the
+first beta items. Ready for real work, ≈ 49%, is inside the alpha band. (A first application of the
+gate the same day judged convert and share as blocking and put PdfCraft at pre-alpha; re-judged with
+the shared rule, encryption and Office→PDF are sub-cases and Word export is lossy, not absent.)
+
+## Current focus
+
+In order. Each item names its entry in [gaps.md](gaps.md).
+
+1. **Convert and share:** encrypted output that Acrobat opens (gap 1, #774, small and the most
+   damaging), then Create PDF from Office and a Word export that keeps layout (gap 8, #773).
+2. **Fix the crash and wrong-result reports** filed against shipped features (gap 6), starting with
+   the panic in #816.
+3. **Printing on Windows** (gap 4, #756) and **a Chinese UI face in releases** (gap 5, #826).
+4. **A fidelity harness against Acrobat, then the renderer decision** (gaps 12 and 2). Owner
+   decision needed: our own M2 devices, or #841's proposal as the bridge.
+5. **Editing existing content** (gap 3, M7): fonts, subsets, reflow, CJK and RTL.
+6. **Pro workflows:** OCR languages (gap 7), Office export/import (gap 8), Preflight and PDF/A/X/UA
+   (gap 9), signatures with tokens, timestamp servers and online LTV (gap 10), accessibility
+   tagging (gap 11).
+7. **1.0 polish (M14):** performance budgets and lazy loading (gap 13), right-to-left layout and the
+   missing languages (gap 14), keyboard-only operation, a screen-reader audit.
+
+Decided against for now (owner, 2026-10-05): self-installing updates and an update check at start.
+Help ▸ Check for updates is manual only.
+
+## Milestones
+
+"Plan size" is the original single-agent sizing. "Done" is the estimated share of that milestone's
+*acceptance criteria* that are met, not lines of code. "Remaining" is re-measured on 2026-10-10 at
+the measured rate (see [target-app-parity.md](target-app-parity.md#effort-and-calibration)); the
+total matches the parity estimate.
+
+| M | Milestone | Plan size (h) | Done | Remaining (h, 2026-10-10) | Notes |
+|---|---|---|---|---|---|
+| M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 98% | 1–2 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
+| M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 80% | 20–40 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
+| M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
+| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; late browser startup downloads preserve the current document and Save target (#171). |
+| M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web |
+| M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export; flatten; Fill & Sign; agent tools.<br>Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
+| M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA |
+| M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
+| M8 | Security + redaction | 100–180 | 68% | 15–30 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize.<br>Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
+| M9 | Signatures (PAdES, validation) | 160–280 | 60% | 40–70 | Done: new `sign` crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL.<br>Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites. Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11 |
+| M10 | OCR, create, export, print | 200–350 | 33% | 120–215 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, CUPS spooler, print-ready PDF).<br>Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; Create PDF from multiple files (PDFs, images and text, edited as pages in the grid). Missing: OCR languages beyond Latin, editable-text OCR output, Office export/import, Windows/web printing |
+| M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
+| M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools).<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export. Missing: autotag, Tags/Order/Content panels, Reading Order tool, alt-text workflow, compare, geospatial/3D measurement, search index, XFA |
+| M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
+| M14 | 1.0 polish: performance, localization, installers | 120–250 | 15% | 80–150 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese and Arabic (logical-order catalog put into display order; layout not yet mirrored); Czech covers the menus. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation |
+| | **Total** | **2,085–3,840** | **≈ 49% ready** | **≈ 770–1,400** | Area view of the same work: [target-app-parity.md](target-app-parity.md#by-feature-area) |
+
+## Upcoming milestones, ranked
+
+| Rank | Next milestone | Closes | Estimate (h) |
+|---|---|---|---|
+| 0 | Convert and share: encrypted output opens in Acrobat, Create PDF from Office, Word export keeps layout | gap 1, part of gap 8 | 40–70 |
+| 1 | Backlog and platform: crash and wrong-result reports fixed, Windows printing, Chinese UI face | gaps 4, 5, 6 | 65–120 |
+| 2 | Fidelity harness and renderer decision (M2) | gaps 2, 12 | 110–190 |
+| 3 | Editing existing content (M7) | gap 3 | 100–180 |
+| 4 | Pro conversion: OCR languages and clean-up, Office export/import (M10) | gaps 7, 8 | 95–175 |
+| 5 | Standards: Preflight, PDF/A all parts, PDF/UA, PDF/X (M11) | gap 9 | 65–115 |
+| 6 | Signatures for institutions: PKCS #11, timestamp servers, online LTV (M9) | gap 10 | 40–70 |
+| 7 | Accessibility tagging (M12) | gap 11 | 40–70 |
+| 8 | 1.0 polish: performance, RTL, languages, keyboard-only (M14) | gaps 13, 14 | 55–95 |
+
+Beta needs ranks 1–7 in substance (≈ 400–700 h; see [target-app-parity.md](target-app-parity.md#stage)).
+
+## Critical path
+
+M0 → M1 → M2 → M3 → M4 had to happen in order, and did, except that M2's own renderer was deferred
+behind the `hayro` bootstrap. After M4, M5–M13 run in parallel across crates. The long poles are
+M2 (renderer), M7 (content editing), M10 (OCR and Office), M11 (Preflight and standards) and M12
+(tagging and XFA).
+
+## Risks most likely to push estimates up
+
+- Fidelity of text editing: fonts, subsets, reflow, CJK and RTL.
+- XFA dynamic layout on real government and bank forms.
+- Real-world signature chains, revocation and tokens.
+- The rendering long tail: Type 3 fonts, broken fonts, shadings, blend modes.
+- Correctness of PDF/A, PDF/X and PDF/UA conversion.
+- Interoperability: files other readers (above all Acrobat) reject, as in #774.
+- OCR and AI quality limited by what openly licensed models exist.
+- CPU rendering performance on the web.
+- Hostile input: every fuzz run so far has found new crashes or hangs.
+- Unmeasured fidelity: without an Acrobat comparison harness, quality gaps surface as user reports.
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | minor | M14: localized shortcut key names (#496), including runtime switching and native layout checks. Estimates unchanged. |
+| 2026-10-10 | minor | Re-judged convert and share with the cross-app gate rule (only a workflow that can't be completed at all blocks): partial, not blocking → stage alpha |
+| 2026-10-10 | minor | Added the alpha gate (six core workflows; convert and share fails → pre-alpha, 40–70 h to alpha) and rank 0 in the upcoming milestones |
+| 2026-10-10 | major | Created from ROADMAP.md §Milestones, §Critical path, §Risks and §Where we're lacking. Merged the duplicated M1, M2, M3 and M14 rows, re-measured Done and Remaining, added Current focus and the ranked upcoming milestones |
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
new file mode 100644
index 000000000..dc7443adf
--- /dev/null
+++ b/docs/target-app-parity.md
@@ -0,0 +1,301 @@
+# PdfCraft parity with Adobe Acrobat Pro
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** minor (readiness table with hours per audience; full number restated as the standard's additive weighted sum, 47% → 49%; earlier: second look: cross-cutting double count removed, mainstream-practitioner number added, core-workflow gate applied → alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+
+The authoritative assessment of how close PdfCraft is to Acrobat Pro. [ROADMAP.md](../ROADMAP.md)
+summarizes it; [gaps.md](gaps.md) lists every shortfall one by one; the deep-dive checklists are
+[pdf-spec-parity.md](pdf-spec-parity.md), [file-format-parity.md](file-format-parity.md),
+[ui-parity.md](ui-parity.md), [hardware-parity.md](hardware-parity.md) and
+[localization-parity.md](localization-parity.md).
+
+**Scope.** Parity means the *offline* feature set of Acrobat Pro. Adobe's cloud services (Document
+Cloud storage, Acrobat Sign requests, shared review, the AI Assistant, Adobe Express, the Adobe
+Approved Trust List) are out of scope: 23 such features are tracked as `na` in
+`parity/acrobat-features.toml` and excluded from every percentage.
+
+## Headline
+
+| | Value | Kind |
+|---|---|---|
+| **Feature breadth**, tier-weighted | **≈ 67%** | measured (checklist; weights below) |
+| Feature breadth, unweighted | 56.9% (423 shipped + 74 partial of 808) | measured (`cargo xtask parity` arithmetic) |
+| Must-have (P0) features | 94.2% (226 + 23 partial of 252) | measured |
+| Feature breadth, mainstream practitioner | ≈ 70% tier-weighted (63.2% unweighted: 292 + 44 partial of 497; P0 95.3%) | measured ([split below](#mainstream-practitioner-vs-full-acrobat-pro)) |
+| **Ready for real work**, full Acrobat Pro | **≈ 49%** (range 45–53%) | estimated (weighted sum over dimensions, [below](#by-dimension)) |
+| **Ready for real work**, mainstream practitioner | **≈ 55%** (range 50–60%) | estimated ([split below](#mainstream-practitioner-vs-full-acrobat-pro)) |
+| **Ready for real work**, essentials user | **≈ 66%** (range 60–70%) | estimated ([below](#essentials-user)) |
+| **Stage** | **alpha** (passes the core-workflow gate) | see [Stage](#stage) |
+| Remaining to beta | ≈ 400–700 Opus 5.5 agent-hours | estimated |
+| Remaining to full parity | ≈ 780–1,400 Opus 5.5 agent-hours | estimated |
+
+### Readiness by audience
+
+| Audience | Ready | Opus 5.5 agent-hours to ≈ 95% | Work that dominates |
+|---|---|---|---|
+| Full Acrobat Pro (ready for real work) | ≈ 49% | ≈ 780–1,400 h (≈ 300–550 h wall clock with 3–5 agents; 60–70% parallelizes) | Own renderer and fidelity harness, editing existing content, OCR and Office conversion, Preflight and PDF/A/X/UA, accessibility tagging, signatures for institutions |
+| Mainstream practitioner | ≈ 55% | ≈ 500–900 h (≈ 200–400 h wall clock; ≈ 60% parallelizes) | Rendering fidelity, editing existing text (CJK, RTL, subsets), conversion (Word layout, Excel, PowerPoint, Office→PDF), OCR languages, Windows printing, the bug backlog |
+| Essentials user | ≈ 66% | ≈ 180–330 h (≈ 90–180 h wall clock; ≈ 50% parallelizes) | Rendering fidelity on everyday files, Windows printing, launch and GPU stability, encrypted output Acrobat opens (#774), simple text fixes, Word export layout, Chinese UI glyphs |
+
+Hours are calibrated as in [Effort and calibration](#effort-and-calibration) (≈ 1k kept lines per agent-hour for new features, 3–10× slower for hardening and fidelity). The audiences are nested subsets, so essentials ≤ mainstream ≤ full.
+
+The gap between the numbers is the story of this release: most of what an Acrobat user reaches
+for *exists*, but much of it is shallower than Acrobat's, rendering is still borrowed, quality has
+never been measured side by side with Acrobat, and the first public releases (0.4.0, 0.5.0) drew
+245 open issues in two days, including one that makes our encrypted files unreadable in Acrobat
+([#774](https://github.com/storytold/pdfcraft/issues/774)).
+
+## How this was measured
+
+- **Target identified from the installed app.** `/Applications/Adobe Acrobat DC/Adobe Acrobat.app`,
+  `CFBundleShortVersionString` 26.002.21931. Inspected without launching it and without opening
+  anything inside `Contents/Resources/JavaScripts/` (clean-room rules, `AGENTS.md` §2): the
+  `Info.plist` `CFBundleDocumentTypes` (the formats it opens: see
+  [file-format-parity.md](file-format-parity.md)), the `.lproj` folder names (24 localizations,
+  plus the MEA/MEH/NAF Middle East and North Africa editions named in `Resources/Sequences/`), the
+  names in `Contents/Plugins/` (Accessibility, AcroForm, Checkers, Comments, DigSig, EScript,
+  MakeAccessible, PPKLite, ReadOutLoud, Reflow, SaveAsRTF, Search, Spelling, WebLink, …),
+  `Contents/Frameworks/` (AdobeJP2K, Adobe3D, AdobeCoolType, AdobeLinguistic, the OCR-capable
+  `OnDeviceIntelligence_SDK`, …) and the `PDF Optimizer` and `Sequences` (Action Wizard) folders.
+  Names and listings only.
+- **Feature breadth from the checklist.** `parity/acrobat-features.toml` tracks 831 Acrobat Pro
+  features (808 in scope). `cargo xtask parity` (in `xtask ci`) rejects any `shipped` claim whose
+  command, automation tool or cited test does not exist. The numbers here were computed from the
+  file on `origin/main` at 5d590604 (2026-10-10) with the same arithmetic as the tool (partial
+  counts half). The checklist itself was written from Acrobat's public documentation, not diffed
+  against a menu dump, so it can miss features; that risk is one of the gaps.
+- **Ready for real work by judgement, from evidence:** the code (152k lines of Rust in `crates/`,
+  `apps/` and `xtask`, 1,765 tests, 184 registered commands, 141 automation tools); the vendored
+  renderer's patch list (`vendor/README.md`); user reports on GitHub (245 open, 107 closed issues on
+  2026-10-10); release packaging (`.github/workflows/release.yml`); and knowledge of Acrobat Pro's
+  feature set from Adobe's public documentation.
+- **Not measured, and the largest uncertainty:** no side-by-side comparison of rendering, text
+  extraction or form behaviour against Acrobat exists yet. Every "ready" figure below is an
+  estimate.
+
+### Weights
+
+Feature breadth weights the checklist's tiers by how much Acrobat users rely on them: **P0 50%,
+P1 30%, P2 15%, P3 5%** → 0.50 × 94.2 + 0.30 × 61.0 + 0.15 × 12.0 + 0.05 × 2.3 ≈ **67%**.
+
+Ready for real work weights the areas by how often an Acrobat Pro user reaches for them (judgement:
+Adobe publishes no usage data): view 16%, comment 12%, edit 12%, organize 10%, forms 10%,
+create/export 9%, sign 7%, protect 5%, print 5%, OCR 4%, core 3%, optimize/standards 3%,
+accessibility 2%, automation/preferences 2%. That gives the Features dimension, ≈ 49%.
+
+The **full ready-for-real-work number is an additive weighted sum over the dimensions** (standard
+method; weights by what decides whether a professional can switch): features 40%, file formats and
+conversion 12%, UI/UX 10%, PDF specification 8%, stability 8%, performance 6%, localization 5%,
+platforms 5%, hardware 4%, ecosystem 1%, AI 1%:
+0.40 × 49 + 0.12 × 40 + 0.10 × 55 + 0.08 × 60 + 0.08 × 50 + 0.06 × 40 + 0.05 × 59 + 0.05 × 70 +
+0.04 × 35 + 0.01 × 30 + 0.01 × 0 = 49.25 → **≈ 49%**.
+
+History: the first version of this file subtracted 9 points from the area figure for cross-cutting
+shortfalls (40%); the second look found that a double count (Windows printing, encrypted-output
+interop and Chinese glyphs were already scored in their areas) and used a 2-point deduction (47%);
+this version replaces the deduction with the standard's weighted sum over dimensions (49%). Method
+aligned with the standard, no new evidence. Multiplicative discounts are used only for the
+mainstream and essentials numbers.
+
+## Mainstream practitioner vs full Acrobat Pro
+
+The checklist covers all of Acrobat Pro, including surfaces a typical practitioner rarely opens.
+Splitting it (measured from `parity/acrobat-features.toml`):
+
+| Slice | Features | Shipped | Partial | Unweighted | Tier-weighted | P0 |
+|---|---|---|---|---|---|---|
+| Mainstream: view, comment (without measuring), edit, organize, forms (without XFA and JavaScript tooling), protect and redact, OCR, create and export, compress (Reduce File Size, Optimizer), print (without print production) | 497 | 292 | 44 | 63.2% | ≈ 70% | 95.3% (193) |
+| Specialist: core internals, digital-signature PKI, accessibility remediation, automation and preferences, Preflight and PDF/A/X/UA, print production, measuring, XFA and JavaScript tooling | 311 | 131 | 30 | 46.9% | ≈ 63% | 90.7% (59) |
+| All | 808 | 423 | 74 | 56.9% | ≈ 67% | 94.2% (252) |
+
+So the checklist is **not** dominated by niche surface (38% of rows), and the P0 tier, which is
+mostly mainstream, is at 94–95% in both slices. What holds the mainstream number down is P1 depth
+(69%) and the P2 long tail (13%: rulers, loupe, portfolios, spell check, Bates across files).
+
+**Ready for real work, mainstream practitioner ≈ 55%**, weighting the mainstream areas by use and
+scoring only their mainstream features: view 20% × 60, comment 15% × 70, edit 15% × 35,
+organize 12% × 75, fill and sign 12% × 70, convert 10% × 30, protect and redact 6% × 55,
+OCR 4% × 20, compress 3% × 60, print 3% × 50 = 55.6%. Read-only, review, form-filling and page
+workflows are close to Acrobat; editing existing content, conversion and OCR are not.
+
+### Essentials user
+
+Someone who uses Acrobat for the everyday basics and never opens the rest. Scored on those features
+only, by depth, then discounted for what such a user actually runs into. Advanced options, Pro
+workflows, exchange edge cases and everything outside the mainstream slice are excluded.
+
+| Core feature | Weight | Depth | Evidence |
+|---|---|---|---|
+| Open the PDFs people send and read them (render, zoom, scroll, page through) | 20% | 80% | Repair of damaged files, 958-file corpus; rendering borrowed but broadly right (#794 is a TikZ pattern) |
+| Find, select and copy text | 8% | 85% | Find, options, results list; word-F1 0.98 |
+| Print | 8% | 55% | Good on macOS and Linux; nothing on Windows, where most such users are (#756) |
+| Highlight, sticky notes, text comments | 12% | 85% | All markup types, replies, properties |
+| Fill in forms | 10% | 85% | Every AcroForm field type, Acrobat's formatting and calculations |
+| Fill & Sign: typed, drawn or image signature | 10% | 85% | Fill & Sign tools; flatten on save |
+| Rotate, delete, reorder and extract pages | 8% | 85% | Organize grid, drag reorder, thumbnails |
+| Combine files | 6% | 85% | Combine tab with bookmarks per file |
+| Fix a typo in existing text | 5% | 40% | Latin paragraphs only; font may be substituted |
+| Export to Word or images | 5% | 45% | Images good; Word loses layout (#773) |
+| Reduce file size | 3% | 75% | Reduce File Size, Optimizer |
+| Protect with a password | 3% | 30% | Works in PdfCraft; Acrobat and Reader reject the file (#774) |
+| Undo, save, autosave | 2% | 90% | Undo after save, atomic saves, crash recovery |
+
+Weighted depth: **≈ 75%**. Discounts an essentials user hits: launch and stability (54 issues about
+installing, launching, GPU and windows; OpenGL fallback) −5 points; discoverability and clarity
+(an Acrobat-like shell with Home and All tools, but tool-mode friction such as #825 and #721) −2;
+opening what people send (Chinese UI glyph boxes #826, CJK documents #758) −2.
+**Essentials user ≈ 66%** (60–70%).
+
+### User sentiment (second look, 2026-10-10)
+
+Practitioners' praise is real and consistent with these numbers:
+
+- **Adoption:** 7,595 GitHub stars, 2,661 forks; release downloads 177,301 (v0.4.0) and 39,447
+  (v0.5.0, its first day).
+- **Praise:** 23 of 359 issues written by users carry explicit praise ("amazing bit of software"
+  #693, "ridiculously fast and awesome PDF editor" #320, "brilliant" #542, "fantastic and very useful"
+  #369, "Gigantic stuff… I love it" #449). Switching reports: #179 switched from Adobe Reader on
+  Windows ("covers nearly everything I used Reader for"); #232 replacing macOS Preview; #273
+  "open source alternative to Acrobat"; #195 would "replace Acrobat completely" once hardware-token
+  signing exists.
+- **What users hit** (issue titles, excluding 35 agent-filed `fix(...)` reports): installation,
+  launch and GPU/window problems 54, rendering and display 46, editing text and images 41, CJK and
+  other fonts and glyphs 41, signing and certificates 35, printing 23, forms 18, conversion and
+  export 16, OCR 5. Roughly two thirds are bugs (≈ 213 vs ≈ 111 feature requests), concentrated in
+  core paths rather than niche features.
+
+The praise comes overwhelmingly from Reader-class work (view, annotate, fill, sign, organize), where
+the mainstream number is highest; the requests and bugs cluster on editing, CJK, printing,
+conversion and signing tokens, which is where the gaps are. That supports raising the full number
+from 40% to 47% (the double count; restated as 49% by the weighted-sum method) and reporting the mainstream 55% beside it; it does not support
+calling PdfCraft a replacement for Acrobat Pro yet.
+
+## By dimension
+
+Hours are Opus 5.5 agent wall-clock hours, low–high. Rows marked *within features* are part of the
+features total and are shown for orientation; the others add to it.
+
+| Dimension | Ready | Weight | Remaining (h) | Counted | Evidence | Doc |
+|---|---|---|---|---|---|---|
+| Features (14 areas) | ≈ 49% depth; 67% breadth | 40% | 610–1,100 | base | Area table below | this file |
+| UI/UX fidelity | ≈ 55% | 10% | 30–60 | additional | Acrobat-style shell, All tools, Home, command palette; missing single-key accelerators, rulers/guides, multiple windows, popups; user reports #739, #744, #746, #759, #789, #844 | [ui-parity.md](ui-parity.md) |
+| File formats and conversion | ≈ 40% | 12% | 120–220 | within features | PDF read/write strong but encrypted output fails in Acrobat (#774); export Word is layout-poor (#773); no Excel/PowerPoint export, no Office/HTML/PostScript import | [file-format-parity.md](file-format-parity.md) |
+| PDF specification and standards | ≈ 60% | 8% | 150–260 | within features | ISO 32000 syntax, encryption, annotations and AcroForm strong; rendering and fonts borrowed from `hayro`; PDF 2.0 extras, linearization, public-key security absent; PDF/A partial, PDF/X/UA none | [pdf-spec-parity.md](pdf-spec-parity.md) |
+| Hardware | ≈ 35% | 4% | 25–50 | additional | Page raster is CPU only (Acrobat has GPU rendering); Windows CNG and macOS Keychain keys sign, no PKCS #11; no scanners; Windows has no printing (#756) | [hardware-parity.md](hardware-parity.md) |
+| Localization | ≈ 59% over the 12 key languages | 5% | 35–60 | additional | 15 catalogs, 13 at 94–100%; Chinese UI shows tofu in releases (#826, #688); Arabic not mirrored; no Hindi, Indonesian, Korean, Vietnamese | [localization-parity.md](localization-parity.md) |
+| Performance | ≈ 40% | 6% | 25–45 | additional | 500-page smooth scrolling and large-file memory work (#307) done; no performance budgets (`misc.performance-budgets`), no lazy loading of GB files; blurry text at 1080p/1440p (#730) | [gaps.md](gaps.md) |
+| Stability | ≈ 50% | 8% | 45–80 | additional | Never-crash rules and nightly fuzzing; 245 open issues, many of them `fix(...)` reports of wrong results in shipped features (#799–#821) | [gaps.md](gaps.md) |
+| Platforms | ≈ 70% | 5% | 15–30 | additional | macOS (signed, notarized), Windows x64/x86/ARM64 (signed), Linux (AppImage, deb, rpm, Flatpak), FreeBSD, web (WASM). Acrobat has no Linux, FreeBSD or full web editor; we lack Windows and web printing, web OCR and web recovery | [hardware-parity.md](hardware-parity.md) |
+| Ecosystem and plug-ins | ≈ 30% | 1% | 10–20 | within features | No plug-in SDK or folder-level JavaScript; Action Wizard partial. Agent automation (CLI, MCP, UI control channel) has no Acrobat equivalent | [gaps.md](gaps.md) |
+| AI features | ≈ 0% (in scope) | 1% | 20–40 | within features | Acrobat's AI Assistant is cloud-only (out of scope). Local, opt-in provider interface (`misc.ai-provider`) not started | [gaps.md](gaps.md) |
+| **Total (weighted sum)** | **≈ 49%** | 100% | **≈ 780–1,400** | | | |
+
+## By feature area
+
+Breadth is measured from the checklist (partial = ½). Ready is estimated. Hours are remaining to
+full parity in that area.
+
+| Area | Features | Shipped | Partial | Breadth | Ready | Remaining (h) | What's strong / what's missing |
+|---|---|---|---|---|---|---|---|
+| A Core model and fidelity | 56 | 42 | 2 | 76.8% | 70% | 25–45 | Parser, repair, R2–R6 encryption, incremental and atomic saves, undo, autosave, crash recovery, revisions. Missing: encrypted output that Acrobat opens (#774), lazy loading of GB files, linearization, PDF 2.0 extras, Arlington validation, public-key security, own image codecs |
+| B View and navigation | 92 | 52 | 11 | 62.5% | 55% | 110–190 | Shell, layouts, zoom, find, panels, tiles, web build, 500-page scrolling. **Pages are drawn by the vendored `hayro`** (22 + 9 local patches): all 7 rendering P0s are partial. Missing: own renderer or a decided replacement (#841), multiple windows, split view, rulers/guides, loupe, reflow, search across files |
+| C Content editing | 61 | 29 | 7 | 53.3% | 30% | 100–180 | Edit existing paragraphs (font reused or Helvetica substituted, rewrapped), added text and images stay editable, header/footer, watermarks, backgrounds, Bates, links. Missing: robust editing of real-world text (subset fonts, CJK, RTL #766, rotated), lists, vector/object editing, arrange/align, spell check, multi-select move (#844) |
+| D Organize pages | 76 | 45 | 3 | 61.2% | 70% | 12–25 | Organize grid, insert/extract/replace/split/combine with links, fields, layers and bookmarks carried over; page labels, boxes, bookmarks from structure. Missing: transitions, attachments editing, portfolios, struct-tree merge, field-name conflicts; open fixes #817, #818, #821 |
+| E Comments and review | 65 | 46 | 9 | 77.7% | 70% | 12–25 | Every markup type with appearances, replies, status, filters, stamps (custom, dynamic), XFDF/FDF, summaries, flatten, 2D measuring. Missing: rich-text runs, popup windows, summary layouts with pages, per-type hiding; XFDF fidelity bugs #807, #809, #819 |
+| F Forms and JavaScript | 79 | 58 | 8 | 78.5% | 65% | 40–75 | Fill and author every AcroForm field type, Acrobat's AF functions in Acrobat's event order, sandboxed JavaScript (boa), data exchange, Fill & Sign; XFA static/dynamic layout, FormCalc and XFA data (partial). Missing: wider JavaScript object model, document actions, submit, debugger, barcode fields, XFA flattening and full dynamic fidelity |
+| G Protect, redact, sanitize | 41 | 23 | 2 | 58.5% | 55% | 15–30 | Passwords and permissions, Remove security, redaction that removes glyphs, pixels, vectors, annotations and tags, with verification; word lists, patterns, FOIA/Privacy Act codes; sanitize. Missing: certificate security, pattern locales, custom code sets, partial-word redaction, folder redaction, protected view |
+| H Digital signatures | 45 | 23 | 10 | 62.2% | 45% | 40–70 | PAdES B-B signing and validation (PKCS #12, macOS Keychain, Windows store with PIN prompts), certification, encrypted documents, certificate usage checks; B-T, LTV, OCSP/CRL with caller-supplied evidence. Missing: PKCS #11 and smart cards outside Windows, timestamp-server preferences, online revocation fetching, FieldMDP and field locking, OS trust store, EU Trusted Lists, compare signed version |
+| I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, despeckle, camera images, MRC compression, scanners |
+| J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Missing: Office/HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
+| K Optimize and standards | 58 | 15 | 10 | 34.5% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2/CCITT |
+| L Print | 39 | 15 | 1 | 39.7% | 35% | 30–55 | Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, print-ready PDF, CUPS on macOS/Linux. Missing: **printing on Windows (#756) and the web**, print as image, PostScript, all print-production tools (output preview, separations, ink manager, printer marks, colour conversion) |
+| M Accessibility | 61 | 38 | 1 | 63.1% | 30% | 40–70 | Accessibility Checker (all 32 rules, report, fixes), alternate text, title and language. Missing: autotag, Tags/Order/Content panels, Reading Order tool, artifact marking, table editor, Read Out Loud, full keyboard operation of the app, screen-reader audit |
+| N Automation, preferences, misc | 75 | 20 | 5 | 30.0% | 35% | 25–45 | CLI, MCP, UI control channel, 141 automation tools, Action Wizard (run, create), compare (text, visual, report). Missing: most Preferences pages, side-by-side compare, Action Wizard management, custom commands, AI providers, rich media/3D, hosted web app |
+| **All** | **808** | **423** | **74** | **56.9%** | **≈ 49%** | **610–1,100** | Plus 175–325 h of cross-cutting work (dimension table) |
+
+Shipped features rest on thin evidence: 141 of 423 cite exactly one test, and only a handful cite
+an external oracle (`pdftotext`, `pdfsig`, OpenSSL, `qpdf --check`, a corpus).
+
+The checklist lags reality in two places: `misc.localization` is still `planned` although 15
+catalogs ship, and `misc.installers` is `planned` although signed macOS, Windows and Linux packages
+ship (`.github/workflows/release.yml`). Neither moves the numbers by more than 0.2 points; fix them
+with evidence when next touched.
+
+## Stage
+
+**alpha.** Ready for real work, ≈ 49%, is inside the 40–75% band, and every one of Acrobat Pro's
+six everyday workflows can be completed end to end on macOS. Under the gate rule shared by all the
+Crafting Apps, a workflow blocks only when a typical user can't complete it at all; lossy exchange
+or a missing sub-case is a beta item. **Converting and sharing** is therefore partial, not
+blocking: unencrypted PDFs we save open everywhere and export to Word, RTF, HTML, text and images
+works, but password-protected output is rejected by Acrobat and Reader (#774), there is no in-app
+Create PDF from Office, and Word export loses layout (#773). The gate table, with evidence, is in
+[roadmap.md](roadmap.md#alpha-gate). (Earlier the same day this row was judged blocking and the
+stage set to pre-alpha; see the revision history.)
+
+| Core workflow | Works end to end? |
+|---|---|
+| View, search and print | yes |
+| Organize, combine and split pages | yes |
+| Comment and review | yes |
+| Fill and sign forms | yes |
+| Edit text and images | partial, not blocking (Latin text with embedded or standard fonts) |
+| Convert and share (Office ↔ PDF, password protection) | partial, not blocking (encryption interop #774, Office→PDF and Word layout #773 are beta items) |
+
+**To reach beta** (≈ 75% ready, no blocking gap in PDF interchange), ≈ 26 points and
+**≈ 400–700 agent-hours**:
+
+| Beta requirement | Hours |
+|---|---|
+| Encrypted output opens in Acrobat and Reader (#774), with an interop suite that opens our outputs in other readers | 8–15 |
+| Rendering: a fidelity harness against Acrobat captures (local, clean-room) and fixing what it finds; settle the renderer (own M2 devices, or #841's proposal); Chinese UI faces in releases | 80–140 |
+| Editing existing text robust on real files: subset fonts, CJK, RTL, rotated text | 70–120 |
+| Printing on Windows and the web | 15–30 |
+| OCR in the major languages (accents, Cyrillic, CJK), deskew and rotation | 35–60 |
+| Export: Word that keeps layout; Excel and PowerPoint | 45–80 |
+| Signatures: timestamp servers, online revocation and LTV, PKCS #11, OS trust | 30–55 |
+| PDF/A (all parts and levels), PDF/UA validation, a first Preflight | 45–80 |
+| Accessibility tagging: autotag, Tags panel, Reading Order | 35–60 |
+| Open-issue backlog, stability and performance budgets | 40–70 |
+| **Total** | **≈ 400–700** |
+
+## Effort and calibration
+
+**Calibrated against this repository's own history.**
+
+- The repo is 11 days old (first commit 2026-09-30 05:17), with 591 commits and 371 merged pull
+  requests (all since 2026-10-04). Rust in `crates/`, `apps/` and `xtask/` grew from 37.7k lines
+  (2026-10-02) to 82.6k (10-04), 99.2k (10-08) and 152.7k (10-10).
+- The previous ROADMAP measured about **1.0k kept, tested lines per agent-hour** (72k lines in
+  roughly 65–75 agent-hours). New features land at about that rate: medium P1 features such as
+  redaction word lists (#757, 314 lines), bookmarks from structure (#754, 588 lines) and signing
+  encrypted documents (#753, 308 lines) each took about 1–3 agent-hours including tests, with 2–4 h
+  from PR to merge, mostly CI. Large arcs take longer: XFA dynamic layout, its JavaScript and
+  FormCalc (#121, #230, #301; ≈ 13k lines) about 15–25 agent-hours; the Arabic interface
+  (#692, 2.7k lines) about 3–5.
+- Hardening and fidelity work is 3–10× slower per line than new features: the 2026-10-07 → 10-10
+  block landed ≈ 330 commits but moved the checklist by only 12 shipped features (411 → 423), because most of
+  it was never-crash work, Windows fixes, localization and XFA.
+
+The previous estimate (2026-10-07) was **600–1,100 h** to full parity. Since then XFA, signature
+timestamps/LTV and signing encrypted documents progressed (≈ −60 h), but the first public releases
+surfaced work the estimate did not hold: 245 open issues, missing Windows printing, Acrobat
+interoperability of encrypted output, Chinese UI glyphs and Word-export layout (≈ +200–300 h).
+Hence **≈ 780–1,400 h** now. Roughly 60–70% parallelizes across crates (3–5 agents: ≈ 300–550 h
+wall clock).
+
+**Needs a human:** the renderer decision (own M2 devices vs an outside renderer, #841); Acrobat
+oracle captures on the owner's Mac (synthetic fixtures only); native-speaker review of every
+catalog; smart cards and PKCS #11 tokens, scanners and Windows printers to test against; any
+licensed OCR or AI model.
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | minor | Readiness table: hours to ≈ 95% per audience (full 780–1,400, mainstream 500–900, essentials 180–330). Full number restated as the standard's additive weighted sum over dimensions with written weights: 47% → 49%. Method aligned with the standard, no new evidence |
+| 2026-10-10 | minor | Added the essentials-user score (≈ 66%): weighted depth of 13 everyday features, discounted for launch, discoverability and opening others' files |
+| 2026-10-10 | minor | Consistency check across apps: re-judged the convert-and-share gate row with the shared rule (blocking only when the workflow can't be completed at all; lossy exchange and missing sub-cases are beta items). Encrypted output (#774) and Office→PDF are sub-cases, Word export is lossy not absent → partial, not blocking; stage pre-alpha → **alpha**. Numbers unchanged |
+| 2026-10-10 | minor | Second look requested by the owner after practitioners praised PdfCraft: user sentiment gathered (stars, downloads, 23 praising issues, switching reports, issue themes); checklist split into mainstream (497) and specialist (311) features; the 9-point cross-cutting deduction removed as a double count (Windows printing, interop and glyphs were already scored in their areas). Ready for real work 40% → 47%; mainstream practitioner ≈ 55% added. Core-workflow alpha gate applied: convert and share fails → stage alpha → **pre-alpha**, ≈ 40–70 h from alpha |
+| 2026-10-10 | major | Created from ROADMAP.md §Estimate summary and §Honest assessment (2026-10-05/07). Full re-measure against Acrobat Pro 26.002.21931: checklist recomputed (56.9% unweighted, ≈ 67% tier-weighted), ready for real work ≈ 40%, stage alpha, hours re-calibrated (780–1,400 h to parity, 400–700 h to beta), dimension and area tables |
+| 2026-10-07 | minor | (in ROADMAP.md) 806 tracked features, 51.0% shipped, effort-weighted ≈ 30–35%, 600–1,100 h |
+| 2026-10-05 | major | (in ROADMAP.md) First honest assessment by dimension and area |
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
new file mode 100644
index 000000000..403f490d9
--- /dev/null
+++ b/docs/ui-parity.md
@@ -0,0 +1,84 @@
+# UI and interaction parity
+
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (first UI/UX checklist) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+
+How PdfCraft's tools, panels, shortcuts and feel compare with Acrobat Pro's current interface (the
+2023+ "new Acrobat": All tools pane on the left, quick-action toolbar, Home view). Behaviour is
+observed clean-room (`plan/acrobat/02-ui-ux.md`, local-only; `AGENTS.md` §2); nothing from Adobe's
+interface is copied. Gaps ranked in [gaps.md](gaps.md).
+
+**UI/UX fidelity ≈ 55% ready** (estimated), **30–60 h** additional to the features total.
+
+## Measured
+
+- **184 registered commands** (`crates/engine/src/commands.rs`), every one in the menus, the
+  command palette and the automation `command_run` tool; menus are generated from the registry
+  (`view.menus-from-registry`).
+- **141 automation tools** (`crates/automation/src/tools.rs`), so every UI action can be checked
+  headlessly.
+- **View area of the checklist: 62.5% breadth** (52 shipped, 11 partial of 92).
+
+No dump of Acrobat's menu tree has been diffed against the registry yet (gap 24).
+
+## Shell and navigation
+
+| Element | Acrobat | PdfCraft | Status |
+|---|---|---|---|
+| Home view (recent files, recommended tools) | yes | yes | shipped |
+| All tools pane, tool sets | yes | yes, with milestone badges | shipped |
+| Quick-action toolbar, customisable | yes | fixed | partial (`view.customize-quick-tools` planned) |
+| Command search | "Search tools" | command palette (⌘K), matches translated and English labels | shipped |
+| Document tabs | yes | yes, with unsaved marker | shipped |
+| Multiple windows, drag a tab out | yes | no | planned |
+| Split window, spreadsheet split | yes | no | planned |
+| Read mode, full screen | yes | yes | shipped; presentation options planned |
+| Light, dark, system theme | yes | yes | shipped |
+| Side panels: thumbnails, bookmarks, attachments, layers, comments, fields, signatures | yes | yes; panels keep their width (#704) | shipped |
+| Destinations, articles, model tree, Tags, Order, Content panels | yes | no | planned |
+| Message bars (restricted, signed, PDF/A, forms) | yes | restricted and signed; no PDF/A view mode | partial |
+
+## Tools, handles and precision
+
+| Behaviour | Acrobat | PdfCraft | Status / evidence |
+|---|---|---|---|
+| Zoom: wheel, pinch, keys, marquee, fit page/width/height/visible | yes | yes | shipped |
+| Fixed zoom percentages match Acrobat's physical size | yes | differ (#739, documented in #736) | gap |
+| Dynamic zoom, loupe, pan-and-zoom window | yes | no | planned |
+| Hand tool, middle-button pan, autoscroll | yes | hand tool; Linux autoscroll | partial |
+| Text selection, column select | yes, Alt-drag columns | reading-order selection; no column mode (#740) | partial |
+| Select and move several objects at once | yes | no (#844) | gap |
+| Object handles: corners keep proportion, edges free | yes | yes for added images and signatures | shipped |
+| Arrange, align and distribute page objects | yes | fields only | partial |
+| Rulers, grids, snap to grid, guides | yes | no | planned |
+| Cursor coordinates, line weights | yes | no | planned |
+| Measuring snap to paths, endpoints, midpoints, intersections | yes | yes | shipped |
+| Nudge selected objects with arrow keys (Shift for larger steps) | yes | no: arrow keys scroll and turn pages | gap |
+| Single-key tool accelerators (H, V, Z, …) | yes, opt-in | no | planned |
+| Context menus on pages, thumbnails, comments, fields | yes | thumbnails, comments, fields | partial |
+| Comment pop-ups as movable windows, connector lines | yes | inline in the panel | planned |
+| Disabled commands explain why | no | yes | ahead |
+
+## Shortcuts and modifiers
+
+| Item | Acrobat | PdfCraft | Status |
+|---|---|---|---|
+| Platform shortcuts for registered commands | yes | yes; ⌘ on macOS, Ctrl elsewhere (#695) | shipped; find bar still shows ⌘ on Windows (#746) |
+| Keyboard shortcuts reference | yes | yes | shipped |
+| Full keyboard operation of the app | yes | no | planned (`a11y.keyboard-only`, P0) |
+| Shift-⌘-G finds previous | yes | goes forward (#810) | bug |
+
+## Dialogs and preferences
+
+| Item | Acrobat | PdfCraft | Status |
+|---|---|---|---|
+| Print dialog with preview | yes | yes | shipped |
+| Document Properties (description, security, fonts, initial view, custom, advanced) | yes | all but Custom and XMP | partial |
+| Field Properties (General, Appearance, Position, Options, Actions, Format, Validate, Calculate, Signed) | yes | all but Signed | partial |
+| Comment properties and properties bar | yes | yes | shipped |
+| Preferences | ≈ 20 pages | Interface language, Documents and view, Identity, Fill & Sign, JavaScript | partial (gap 19) |
+
+## Revision history
+
+| Date | Change | Summary |
+|---|---|---|
+| 2026-10-10 | major | Created from the command registry, automation tools, the View area of the checklist and open UI issues |
diff --git a/packaging/icons.sh b/packaging/icons.sh
index e8b2c9960..da8228ff5 100755
--- a/packaging/icons.sh
+++ b/packaging/icons.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Regenerate every app icon from assets/app-icon/pdfcraft.svg (the master vector).
+# Regenerate the app icons from assets/app-icon/pdfcraft.svg and the Windows PDF file icon
+# from assets/app-icon/pdfcraft-document.svg. Both are master vectors.
 #
 # Needs: resvg (brew install resvg / cargo install resvg) and python3 (stdlib only, for the .ico).
 # On macOS, iconutil also writes the .icns. The outputs are committed, so building and packaging
@@ -39,13 +40,15 @@ done
 mkdir -p "$DIR/hicolor/scalable/apps"
 cp "$SVG" "$DIR/hicolor/scalable/apps/$ID.svg"
 
-# Windows .ico: PNG-compressed entries, 16-256 px.
-ICO_PNGS=()
-for s in 16 20 24 32 40 48 64 128 256; do
-  render "$SVG" "$s" "$TMP/ico-$s.png"
-  ICO_PNGS+=("$TMP/ico-$s.png")
-done
-python3 - "$DIR/pdfcraft.ico" "${ICO_PNGS[@]}" <<'PY'
+# Windows .ico: PNG-compressed entries, 16-256 px. The document icon has its own resource
+# in pdfcraft.exe; the app icon remains the first/default icon.
+for name in pdfcraft pdfcraft-document; do
+  ICO_PNGS=()
+  for s in 16 20 24 32 40 48 64 128 256; do
+    render "$DIR/$name.svg" "$s" "$TMP/$name-$s.png"
+    ICO_PNGS+=("$TMP/$name-$s.png")
+  done
+  python3 - "$DIR/$name.ico" "${ICO_PNGS[@]}" <<'PY'
 import struct, sys
 out, pngs = sys.argv[1], sys.argv[2:]
 blobs = [open(p, "rb").read() for p in pngs]
@@ -58,6 +61,7 @@ for b in blobs:
     offset += len(b)
 open(out, "wb").write(head + entries + data)
 PY
+done
 
 # macOS .icns.
 if command -v iconutil >/dev/null; then
diff --git a/packaging/macos/dmg/README.md b/packaging/macos/dmg/README.md
index ec902e30f..460f7bdeb 100644
--- a/packaging/macos/dmg/README.md
+++ b/packaging/macos/dmg/README.md
@@ -2,8 +2,8 @@
 
 What Finder shows when the DMG opens: a 660 × 400 pt background with the app icon and the
 `Applications` link side by side. `package.sh` copies these files into the image; nothing here is
-generated at build time, so the DMG still builds with `hdiutil makehybrid` (no mounted device, no
-Finder scripting on CI, nothing extra installed in the signing job).
+generated at build time, so the DMG builds with a plain `hdiutil create -srcfolder` (no Finder
+scripting on CI, nothing extra installed in the signing job).
 
 | File | What |
 |---|---|
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index c73581a24..e04be13c8 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -137,15 +137,40 @@ ln -s /Applications "$STAGE/Applications"
 mkdir -p "$STAGE/.background"
 cp "$HERE/dmg/background.tiff" "$STAGE/.background/background.tiff"
 cp "$HERE/dmg/dmg-layout.DS_Store" "$STAGE/.DS_Store"
-rm -f "$DMG" "$WORK/raw.dmg"
-# makehybrid + convert builds the image without attaching a device, unlike `create -srcfolder`,
-# which is flaky on CI runners ("Resource busy") and hangs in sandboxed sessions.
-# The volume name has no version: .DS_Store finds the background through an alias that includes it.
-hdiutil makehybrid -hfs -hfs-volume-name "PdfCraft" -hfs-openfolder "$STAGE" -o "$WORK/raw.dmg" "$STAGE"
-hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
-rm -f "$WORK/raw.dmg"
+rm -f "$DMG"
+# `hdiutil create -srcfolder` writes the files as they are. `makehybrid -hfs` gave every file a
+# com.apple.FinderInfo (a Finder location of -1,-1), which `codesign --verify --strict` rejects as
+# "Finder information, or similar detritus" on the app in the image and on a copy installed from it,
+# so MDM and compliance checks reported a correctly notarized app as damaged (#390). `create`
+# attaches a device while it copies, which fails now and then on CI runners ("Resource busy"), so
+# it gets a few tries. The volume name has no version: .DS_Store finds the background through an
+# alias that includes it.
+# Usage: hdiutil_retry <what> <hdiutil args…>; tries five times with growing pauses.
+hdiutil_retry() {
+  local what="$1" attempt
+  shift
+  for attempt in 1 2 3 4 5; do
+    if hdiutil "$@"; then
+      return 0
+    fi
+    [ "$attempt" = 5 ] && { echo "hdiutil $what failed 5 times" >&2; return 1; }
+    warn "hdiutil $what failed (attempt $attempt of 5); retrying in $((attempt * 10))s"
+    sleep $((attempt * 10))
+  done
+}
+hdiutil_retry create create -srcfolder "$STAGE" -volname "PdfCraft" -fs HFS+ -format UDZO -imagekey zlib-level=9 -ov "$DMG"
 sign "$DMG"
 codesign --verify --strict --verbose=2 "$DMG"
+# The app inside the image must still pass --strict, so a makehybrid-style regression can't ship.
+MOUNT="$WORK/dmg-check"
+rm -rf "$MOUNT"
+mkdir -p "$MOUNT"
+hdiutil_retry attach attach -nobrowse -readonly -mountpoint "$MOUNT" "$DMG" >/dev/null
+if ! codesign --verify --strict --deep --verbose=2 "$MOUNT/PdfCraft.app"; then
+  hdiutil_retry detach detach "$MOUNT" >/dev/null || true
+  exit 1
+fi
+hdiutil_retry detach detach "$MOUNT" >/dev/null
 if [ "$NOTARIZE" = 1 ]; then
   notarize "$DMG"
   xcrun stapler staple "$DMG"
diff --git a/packaging/windows/package.ps1 b/packaging/windows/package.ps1
index c556652d9..524280b97 100644
--- a/packaging/windows/package.ps1
+++ b/packaging/windows/package.ps1
@@ -87,6 +87,12 @@ $Stage = Join-Path $TargetDir "windows-package\$Arch"
 Remove-Item -Recurse -Force $Stage -ErrorAction SilentlyContinue
 New-Item -ItemType Directory -Force -Path $Stage | Out-Null
 Copy-Item (Join-Path $Bin 'pdfcraft.exe'), (Join-Path $Bin 'pdfcraft-cli.exe') $Stage
+# The document icon embeds Lucide artwork: carry its ISC notice and the project licences
+# beside the binaries in both distributions.
+foreach ($f in 'LICENSE-MIT', 'LICENSE-APACHE', 'NOTICE') {
+  Copy-Item (Join-Path $Root $f) $Stage
+}
+Copy-Item (Join-Path $Root 'assets\app-icon\LICENSE-document.txt') $Stage
 
 & (Join-Path $PSScriptRoot 'sign.ps1') (Join-Path $Stage 'pdfcraft.exe') (Join-Path $Stage 'pdfcraft-cli.exe')
 
@@ -122,6 +128,9 @@ $Portable = Join-Path $TargetDir "windows-package\pdfcraft-$Version-windows-$Arc
 Remove-Item -Recurse -Force $Portable -ErrorAction SilentlyContinue
 New-Item -ItemType Directory -Force -Path $Portable | Out-Null
 Copy-Item (Join-Path $Stage '*.exe') $Portable
+foreach ($f in 'NOTICE', 'LICENSE-document.txt') {
+  Copy-Item (Join-Path $Stage $f) $Portable
+}
 Copy-Item -Recurse $Models (Join-Path $Portable 'models')
 foreach ($f in 'README.md', 'LICENSE', 'LICENSE-MIT', 'LICENSE-APACHE') {
   $p = Join-Path $Root $f
diff --git a/packaging/windows/pdfcraft.wxs b/packaging/windows/pdfcraft.wxs
index 200800af6..11d2e39ab 100644
--- a/packaging/windows/pdfcraft.wxs
+++ b/packaging/windows/pdfcraft.wxs
@@ -70,10 +70,13 @@
              PdfCraft entry to pick was the advertised Start Menu shortcut, which Windows can't
              run as a file handler ("This app can't run on your PC"). -->
         <RegistryValue Root="HKLM" Key="Software\Classes\PdfCraft.Document" Value="PDF Document" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\PdfCraft.Document\DefaultIcon" Value="[#PdfcraftExe],0" Type="string" />
+        <!-- A negative index selects the stable icon resource ID, rather than its position.
+             Resource 1 is the app's lion; resource 2 is the PDF document (build.rs). -->
+        <RegistryValue Root="HKLM" Key="Software\Classes\PdfCraft.Document\DefaultIcon" Value="&quot;[#PdfcraftExe]&quot;,-2" Type="string" />
         <RegistryValue Root="HKLM" Key="Software\Classes\PdfCraft.Document\shell\open\command" Value="&quot;[#PdfcraftExe]&quot; &quot;%1&quot;" Type="string" />
         <RegistryValue Root="HKLM" Key="Software\Classes\.pdf\OpenWithProgids" Name="PdfCraft.Document" Value="" Type="string" />
         <RegistryValue Root="HKLM" Key="Software\Classes\Applications\pdfcraft.exe" Name="FriendlyAppName" Value="PdfCraft" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\pdfcraft.exe\DefaultIcon" Value="&quot;[#PdfcraftExe]&quot;,-2" Type="string" />
         <RegistryValue Root="HKLM" Key="Software\Classes\Applications\pdfcraft.exe\SupportedTypes" Name=".pdf" Value="" Type="string" />
         <RegistryValue Root="HKLM" Key="Software\Classes\Applications\pdfcraft.exe\shell\open\command" Value="&quot;[#PdfcraftExe]&quot; &quot;%1&quot;" Type="string" />
         <RegistryValue Root="HKLM" Key="Software\PdfCraft\Capabilities" Name="ApplicationName" Value="PdfCraft" Type="string" />
@@ -136,6 +139,19 @@
       <Component Id="PdfcraftCli">
         <File Id="PdfcraftCliExe" Source="$(var.BinDir)\pdfcraft-cli.exe" KeyPath="yes" />
       </Component>
+      <!-- The embedded PDF icon's ISC notice and project licences travel with the binaries. -->
+      <Component Id="PdfcraftDocumentIconLicense">
+        <File Id="PdfcraftDocumentIconLicenseFile" Source="$(var.BinDir)\LICENSE-document.txt" KeyPath="yes" />
+      </Component>
+      <Component Id="PdfcraftMitLicense">
+        <File Id="PdfcraftMitLicenseFile" Source="$(var.BinDir)\LICENSE-MIT" KeyPath="yes" />
+      </Component>
+      <Component Id="PdfcraftApacheLicense">
+        <File Id="PdfcraftApacheLicenseFile" Source="$(var.BinDir)\LICENSE-APACHE" KeyPath="yes" />
+      </Component>
+      <Component Id="PdfcraftNotice">
+        <File Id="PdfcraftNoticeFile" Source="$(var.BinDir)\NOTICE" KeyPath="yes" />
+      </Component>
     </ComponentGroup>
 
     <!-- OCR models (#103), with their licences and ATTRIBUTION.txt, in models\ beside pdfcraft.exe
diff --git a/packaging/windows/security-audit.ps1 b/packaging/windows/security-audit.ps1
new file mode 100644
index 000000000..8bda7a807
--- /dev/null
+++ b/packaging/windows/security-audit.ps1
@@ -0,0 +1,90 @@
+<#
+.SYNOPSIS
+  Record the facts behind a scanner detection of PdfCraft Windows files: SHA-256, Authenticode
+  status and, with -YaraExe and -YaraRule, the matched strings and offsets of an external YARA rule.
+
+.DESCRIPTION
+  Read-only. It never changes, runs or unpacks the files it inspects, makes no network connection
+  itself and needs no administrator rights. Neither YARA nor any rule is bundled or downloaded: pass
+  your own copies. See docs/releasing.md ("Scanner detections").
+
+  A YARA match only means that a byte pattern occurred in the file. It is not proof of malware.
+  Report the rule file's SHA-256 (printed here), the matched identifiers and offsets, and the
+  condition branch that fired.
+
+.EXAMPLE
+  pwsh packaging/windows/security-audit.ps1 -Path dist\release\pdfcraft-0.5.0-windows-x64-portable\pdfcraft.exe
+
+.EXAMPLE
+  pwsh packaging/windows/security-audit.ps1 -Path .\pdfcraft.exe, .\pdfcraft-cli.exe -YaraExe C:\tools\yara64.exe -YaraRule C:\rules\CobaltStrikeBeacon.yar
+#>
+param(
+  [Parameter(Mandatory)] [string[]] $Path,
+  [string] $YaraExe,
+  [string] $YaraRule
+)
+$ErrorActionPreference = 'Stop'
+
+function Invoke-Yara([string[]] $Arguments) {
+  # Native stderr would end the script under $ErrorActionPreference = 'Stop' (Windows PowerShell 5.1),
+  # so capture it as text and judge the result by the exit code.
+  $ErrorActionPreference = 'Continue'
+  $lines = @(& $YaraExe @Arguments 2>&1 | ForEach-Object { "$_" })
+  return [pscustomobject] @{ Code = $LASTEXITCODE; Lines = $lines }
+}
+
+if (([bool] $YaraExe) -ne ([bool] $YaraRule)) { throw 'Pass -YaraExe and -YaraRule together.' }
+Write-Output "Scanned (UTC): $((Get-Date).ToUniversalTime().ToString('yyyy-MM-dd HH:mm:ss'))"
+if ($YaraExe) {
+  foreach ($tool in $YaraExe, $YaraRule) {
+    if (-not (Test-Path -LiteralPath $tool -PathType Leaf)) { throw "not found: $tool" }
+  }
+  $YaraExe = (Resolve-Path -LiteralPath $YaraExe).ProviderPath
+  $YaraRule = (Resolve-Path -LiteralPath $YaraRule).ProviderPath
+  Write-Output "YARA:         $((Invoke-Yara @('--version')).Lines | Select-Object -First 1) ($YaraExe)"
+  Write-Output "Rule:         $YaraRule"
+  Write-Output "Rule SHA-256: $((Get-FileHash -LiteralPath $YaraRule -Algorithm SHA256).Hash)"
+} else {
+  Write-Output 'YARA:         not run (pass -YaraExe and -YaraRule to scan with an external rule)'
+}
+
+$failed = $false
+foreach ($item in $Path) {
+  if (-not (Test-Path -LiteralPath $item -PathType Leaf)) {
+    Write-Output "error: not a file: $item"
+    $failed = $true
+    continue
+  }
+  $file = (Resolve-Path -LiteralPath $item).ProviderPath
+  $sig = Get-AuthenticodeSignature -LiteralPath $file
+  $signer = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { '(none)' }
+  $stamper = if ($sig.TimeStamperCertificate) { $sig.TimeStamperCertificate.Subject } else { '(none)' }
+
+  Write-Output ''
+  Write-Output "== $file"
+  Write-Output "Size:         $((Get-Item -LiteralPath $file).Length) bytes"
+  Write-Output "SHA-256:      $((Get-FileHash -LiteralPath $file -Algorithm SHA256).Hash)"
+  Write-Output "Authenticode: $($sig.Status) ($($sig.StatusMessage))"
+  Write-Output "Signer:       $signer"
+  Write-Output "Timestamper:  $stamper"
+
+  if ($YaraExe) {
+    $scan = Invoke-Yara @('-s', '-m', $YaraRule, $file)
+    if ($scan.Code -ne 0) {
+      Write-Output "YARA:         failed with exit code $($scan.Code)"
+      $scan.Lines | ForEach-Object { Write-Output "  $_" }
+      $failed = $true
+      continue
+    }
+    $ruleLines = @($scan.Lines | Where-Object { $_ -and $_ -notmatch '^0x' })
+    $stringLines = @($scan.Lines | Where-Object { $_ -match '^0x' })
+    Write-Output "YARA:         $($ruleLines.Count) rule match(es), $($stringLines.Count) string match(es)"
+    $scan.Lines | Where-Object { $_ } | ForEach-Object { Write-Output "  $_" }
+  }
+}
+
+if ($YaraExe) {
+  Write-Output ''
+  Write-Output 'A YARA match is a pattern match, not a verdict. Keep the rule revision, identifiers, offsets and branch with any report.'
+}
+if ($failed) { exit 1 }
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 09f1d8582..f9d5f61a3 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -1251,7 +1251,7 @@ status = "shipped"
 commands = []
 tools = ["doc_info"]
 evidence = ["crates/ui-egui/tests/ui.rs::opening_a_pdf_shows_comments_and_bookmarks", "crates/ui-egui/tests/control.rs::state_and_view_options", "crates/ui-egui/tests/view.rs::bookmark_destinations_scroll_to_their_position"]
-notes = "A bookmark goes to its destination's position and zoom, not just its page"
+notes = "A bookmark goes to its destination's position and zoom, not just its page. The panel shows the first 10,000 bookmarks, nested 33 levels deep at most, and says so; bookmark_list pages through every bookmark in the file (up to 33 levels deep)."
 
 [[feature]]
 id = "view.highlight-current-bookmark"
@@ -1481,6 +1481,18 @@ tools = []
 evidence = ["crates/ui-egui/tests/ui.rs::drag_selects_text_and_copy_returns_it", "crates/ui-egui/tests/ui.rs::selection_works_in_every_view_rotation", "crates/ui-egui/tests/text_select.rs::quick_clicks_select_a_word_then_the_line_then_the_page", "crates/ui-egui/tests/text_select.rs::quick_clicks_with_the_highlighter_mark_only_the_word", "crates/ui-egui/tests/text_select.rs::shift_click_extends_the_selection_from_its_anchor"]
 notes = "Drag to select; ⇧-click extends the selection to the click, keeping its anchor (same page only); with the Select tool, quick clicks select a word (two), the line (three) or all the text on the page (four). The markup and Redact tools mark a double-clicked word and stop there. Missing: selection across pages (dragging or ⇧-clicking onto another page), paragraph selection, and ⌘A across the whole document (it selects the current page)."
 
+[[feature]]
+id = "view.column-select"
+title = "Column select (Alt/Option-drag a rectangle of text)"
+area = "B"
+tier = "P2"
+milestone = "M3"
+status = "shipped"
+commands = ["edit.column_select"]
+tools = ["text_extract"]
+evidence = ["crates/render/src/text.rs::a_column_selection_takes_one_table_column", "crates/render/src/text.rs::a_column_selection_across_columns_reads_row_by_row", "crates/render/src/text.rs::right_to_left_rows_read_right_to_left", "crates/render/src/text.rs::vertical_lines_keep_reading_order", "crates/ui-egui/tests/column_select.rs::alt_drag_selects_only_the_text_inside_the_rectangle", "crates/ui-egui/tests/column_select.rs::the_column_select_tool_needs_no_modifier", "crates/ui-egui/tests/column_select.rs::alt_drag_with_the_highlighter_marks_only_the_column", "crates/automation/tests/automation.rs::text_extract_with_a_rect_takes_one_column"]
+notes = "Issue #740. Holding Alt (Option on macOS) when a drag starts selects only the text inside the rectangle drawn, with the Select tool, the text markup tools and Redact (with Highlight and Redact the drag must start on text, since off text they draw an area box). Edit ▸ Column select does the same with a plain drag. A glyph counts when its centre is inside. Copy gives one row per visual line, top to bottom; pieces side by side (table cells) are separated by a tab, right to left in right-to-left rows; vertical text keeps reading order. text_extract takes the same rectangle as rect. Platforms: on Linux desktops whose window manager moves windows with Alt-drag (Xfce, Cinnamon and MATE by default; KDE Plasma 5 and other setups with Alt as the window modifier; GNOME and Plasma 6 use Super) the drag never reaches PdfCraft, so use Edit ▸ Column select or change that setting. On Windows, releasing Alt does not open a system menu (the window has no native menu). The web build has the same Linux caveat in the browser. Checked by hand on Linux (Fedora) with the Column select tool; Alt/Option-drag, and macOS and Windows generally, rest on the kittest tests. Missing: selection across pages, ⇧-click extending a column, a default shortcut, and a check of Acrobat's own copied-text format (not observed)."
+
 [[feature]]
 id = "view.copy-text"
 title = "Copy selected text"
@@ -2127,11 +2139,11 @@ title = "Edit object tool for any page object"
 area = "C"
 tier = "P1"
 milestone = "M11"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["edit.edit_text"]
+tools = ["object_list", "object_move"]
+evidence = ["crates/ui-egui/tests/object_selection.rs::marquee_and_mixed_group_drag_move_once_and_undo_together", "crates/automation/tests/automation.rs::mixed_objects_move_through_tools_with_generation_and_one_undo", "crates/edit/src/tests.rs::group_moves_preserve_glyph_bytes_and_unselected_text_state", "crates/engine/src/tests.rs::mixed_object_moves_are_one_undo_step_and_survive_save_reopen"]
+notes = "Same-page mixed selection (#844): Shift/Ctrl/Command-click toggles, empty-space marquee (additive with modifiers), drag previews and one atomic undo step for existing paragraphs, Image/Form XObjects and added text/images. Source glyph bytes, fonts and kerning retained; unselected text and shared Form resources stay put. Generation-scoped references with optional automation guard; count and geometry bounded; unsupported vertical/clipping text refused without partial changes. Still missing: arbitrary paths, inline images, cross-page movement, group resizing, arrange/align and a general object editor. See docs/editing-multiple-objects.md."
 
 [[feature]]
 id = "edit.object-properties"
@@ -2914,8 +2926,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.combine"]
 tools = ["doc_combine"]
-evidence = ["crates/organize/src/tests.rs::combine_nests_source_bookmarks_and_keeps_attachments"]
-notes = ""
+evidence = ["crates/organize/src/tests.rs::combine_nests_source_bookmarks_and_keeps_attachments", "crates/organize/src/tests.rs::a_file_split_around_another_is_copied_once_with_one_bookmark", "crates/organize/src/tests.rs::grouped_runs_keep_their_order_repeats_and_separate_files", "crates/engine/src/tests.rs::a_file_split_around_another_combines_in_order_with_one_bookmark", "crates/ui-egui/tests/combine_grid.rs::a_split_file_counts_once_and_combines_with_one_bookmark", "crates/automation/tests/automation.rs::combine_extract_and_split"]
+notes = "Also when a file's pages are split around other files' pages (Combine files grid): the file is copied once, so it keeps one bookmark at its first page, its nested bookmarks, links between its own pages, its form fields and one copy of its attachments. doc_combine does the same with groups."
 
 [[feature]]
 id = "organize.combine-choose-pages"
@@ -2939,7 +2951,19 @@ status = "shipped"
 commands = ["page.combine"]
 tools = ["doc_combine"]
 evidence = ["crates/ui-egui/tests/editing.rs::column_headings_sort_the_list_and_flip_on_the_second_click", "crates/ui-egui/tests/editing.rs::ctrl_and_shift_clicks_select_several_files_that_move_and_go_together", "crates/ui-egui/tests/editing.rs::undo_and_redo_restore_the_combine_list", "crates/automation/tests/automation.rs::combine_extract_and_split"]
-notes = "Sort by any column (name in natural order, pages, size, modified, warnings), ascending or descending; multi-select (Ctrl/Shift) and move up/down, Alt+arrows or drag; every change undoable. doc_combine combines in the order its paths are given."
+notes = "Sort by any column (name in natural order, pages, size, modified, warnings), ascending or descending; multi-select (Ctrl/Shift) and move up/down, Alt+arrows or drag (rows in the list, cards in the grid); every change undoable. doc_combine combines in the order its paths are given."
+
+[[feature]]
+id = "organize.combine-thumbnails"
+title = "Thumbnail (grid) view of the files before combining"
+area = "D"
+tier = "P2"
+milestone = "M4"
+status = "shipped"
+commands = ["page.combine"]
+tools = ["doc_combine"]
+evidence = ["crates/ui-egui/tests/combine_grid.rs::combine_shows_a_grid_by_default_and_the_view_is_kept_in_the_settings", "crates/ui-egui/tests/combine_grid.rs::cards_select_like_the_list_and_the_selection_survives_switching_views", "crates/ui-egui/tests/combine_grid.rs::dragging_a_card_moves_it_and_undo_puts_it_back", "crates/ui-egui/tests/combine_grid.rs::a_dragged_selection_moves_together_to_the_first_and_last_gaps", "crates/ui-egui/tests/combine_grid.rs::thumbnails_show_the_first_page_each_file_takes", "crates/ui-egui/tests/combine_grid.rs::many_files_render_only_what_is_in_view_a_few_at_a_time", "crates/ui-egui/tests/combine_grid.rs::long_thin_pages_get_thumbnails_within_the_size_limits", "crates/ui-egui/tests/combine_grid.rs::combine_follows_the_order_shown_in_the_grid", "crates/ui-egui/src/combine_grid.rs::render_threads_never_exceed_three_while_files_come_and_go", "crates/ui-egui/src/combine_grid.rs::textures_over_budget_go_longest_unseen_first_and_those_in_view_stay", "crates/ui-egui/src/combine_grid.rs::on_the_web_one_thumbnail_waits_at_a_time", "crates/ui-egui/tests/combine_grid.rs::a_file_whose_pages_cant_be_measured_says_there_is_no_preview", "crates/ui-egui/tests/combine_grid.rs::the_toolbar_sizes_the_cards_within_limits_and_the_size_is_kept_in_the_settings", "crates/ui-egui/tests/combine_grid.rs::ctrl_keys_and_ctrl_wheel_size_the_cards_and_leave_the_window_alone", "crates/ui-egui/tests/combine_grid.rs::zooming_keeps_the_card_under_the_pointer_in_place_and_thumbnails_never_go_blank", "crates/ui-egui/tests/combine_grid.rs::zooming_quickly_never_runs_more_than_three_render_threads", "crates/ui-egui/tests/combine_grid.rs::hovering_a_card_shows_its_trash_and_magnifier_and_only_then", "crates/ui-egui/tests/combine_grid.rs::the_card_trash_removes_only_that_file_and_undo_brings_it_back", "crates/ui-egui/tests/combine_grid.rs::the_magnifier_shows_the_file_large_and_flips_through_the_pages_it_adds", "crates/ui-egui/tests/combine_grid.rs::the_preview_closes_when_its_file_leaves_and_keeps_to_three_render_threads", "crates/ui-egui/tests/combine_grid.rs::a_right_click_on_a_card_offers_preview_and_remove", "crates/ui-egui/tests/combine_grid.rs::space_shows_the_selected_file_large_in_the_grid_and_the_list", "crates/ui-egui/tests/combine_grid.rs::expanding_a_file_shows_the_pages_it_adds_in_order_with_their_numbers", "crates/ui-egui/tests/combine_grid.rs::expand_all_and_collapse_all_from_the_toolbar_and_a_right_click", "crates/ui-egui/tests/combine_grid.rs::expanding_is_a_view_kept_across_views_and_zoom_and_never_an_undo_step", "crates/ui-egui/tests/combine_grid.rs::dragging_a_page_moves_that_page_even_between_another_files_pages", "crates/ui-egui/tests/combine_grid.rs::combining_with_files_expanded_gives_the_same_document", "crates/ui-egui/tests/combine_grid.rs::a_page_click_selects_that_page_and_the_arrows_step_rows_of_cards", "crates/ui-egui/tests/combine_grid.rs::a_page_cards_magnifier_opens_the_preview_on_that_page", "crates/ui-egui/tests/combine_grid.rs::a_long_file_expanded_renders_only_its_pages_in_view_within_three_threads", "crates/ui-egui/tests/combine_grid.rs::collapsing_brings_the_files_card_into_view", "crates/ui-egui/tests/combine_grid.rs::a_file_too_long_to_spread_out_offers_no_expand", "crates/ui-egui/src/combine_grid.rs::the_next_page_of_a_file_reuses_its_open_document_until_it_closes", "crates/ui-egui/tests/combine_grid.rs::removing_pages_from_the_hover_bar_the_toolbar_and_delete_never_touches_the_file", "crates/ui-egui/tests/combine_grid.rs::a_split_file_counts_once_and_combines_with_one_bookmark", "crates/ui-egui/src/combine_ui.rs::a_page_moved_between_another_files_pages_splits_its_file_and_parts_rejoin", "crates/ui-egui/src/combine_ui.rs::removing_pages_drops_emptied_parts_and_joins_what_meets", "crates/ui-egui/src/combine_ui.rs::page_lists_become_the_shortest_range", "crates/ui-egui/tests/combine_grid.rs::pages_picked_out_of_sight_or_before_an_undo_are_let_go_of", "crates/ui-egui/tests/combine_grid.rs::a_files_parts_join_when_what_was_between_them_goes_and_one_file_cannot_be_combined", "crates/organize/src/tests.rs::a_page_shown_twice_gets_its_own_annotations", "crates/engine/src/tests.rs::a_page_with_a_form_field_shown_twice_keeps_one_field", "crates/ui-egui/tests/combine_grid.rs::files_picked_by_automation_let_go_of_the_pages_picked"]
+notes = "Combine files shows a card per file (the default; Grid/List toggle kept in the settings, --combine-view grid|list): the first page the file contributes (its page range's first page), stacked when it contributes more, and its name shortened in the middle. Cards are sized from 60% to 200% (toolbar slider, buttons and percentage reset, Ctrl/⌘ +/−/0, Ctrl/⌘ with the wheel or a pinch over the grid; kept in the settings, --combine-zoom 60..200), keeping the card under the pointer in place. Hovering a card shows its own actions along the top of its page: remove that file only (whatever else is selected; undoable) and a magnifier that shows the file large, flipping through the pages it adds (buttons, Left/Right; Esc, close or a click outside closes it), also on the card's right-click menu, and Space shows the selected file large (the way there by keyboard). Cards select (click, Ctrl, Shift, arrows by card and by row), drag to reorder (one undo step; the grid scrolls at its edges) and share the list's toolbar. Thumbnails render off the UI thread, only for cards in view, sized to both sides of the page and at most 768 px; at most three render threads at once, counted as threads until they exit (no watchdog replacements; a page stuck for good in one step that can't be interrupted keeps its thread, and so its place, for the rest of the run); textures out of view are dropped over a 32 MB budget (those in view are kept). Locked, unreadable and bad-range files show why instead of a page, and a file whose page size can't be read (e.g. opened with an RC4 owner password) says No preview; page ranges are edited in the list. On the web a thumbnail, and the page shown large, render on the UI thread (one per frame, and only one waits at a time), so a very slow or very large page stalls that frame. A file that adds more than one page (up to 2000) expands into its pages (hover bar, right-click, or Expand all / Collapse all in the toolbar): one card per page it adds, in its range's order, each saying Page N and the file's name, on a tinted band; a click on a page selects that page, Up/Down step rows of cards, dragging a file's card moves the whole file (a drop among a file's pages goes to its nearer end), and its magnifier opens the preview on that page; expanding is a view, not an undo step, and changes nothing in the combined file; a page's render reuses its file's open document for a moment rather than reading the file again. With a file expanded, single pages are selected (click, Ctrl, Shift), dragged anywhere (a page moved between another file's pages splits its file into parts, shown as rows in the list with their own page ranges; parts side by side join again) and removed (a page card's trash, the toolbar, Delete), each one undo step, never changing the files themselves; a split file still counts and combines as one file."
 
 [[feature]]
 id = "organize.combine-options"
@@ -3614,8 +3638,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.ink"]
 tools = ["comment_add"]
-evidence = ["crates/ui-egui/tests/comments.rs::shapes_and_ink_are_drawn_by_dragging", "crates/annot/src/tests.rs::ink_strokes_are_smooth_curves_through_their_points"]
-notes = "one ink annotation per stroke; strokes are drawn as smooth curves through their points, as in Acrobat"
+evidence = ["crates/ui-egui/tests/comments.rs::shapes_and_ink_are_drawn_by_dragging", "crates/annot/src/tests.rs::ink_strokes_are_smooth_curves_through_their_points", "crates/annot/src/tests.rs::drawings_resize_by_scaling_their_strokes"]
+notes = "one ink annotation per stroke; strokes are drawn as smooth curves through their points, as in Acrobat; resize with the 8 handles (the strokes scale into the new box)"
 
 [[feature]]
 id = "comment.eraser"
@@ -3662,8 +3686,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.square"]
 tools = ["comment_add", "comment_edit"]
-evidence = ["crates/ui-egui/tests/comments.rs::shapes_and_ink_are_drawn_by_dragging", "crates/annot/src/tests.rs::restyle_and_resize_redraw_the_appearance"]
-notes = "resize with the 8 handles"
+evidence = ["crates/ui-egui/tests/comments.rs::shapes_and_ink_are_drawn_by_dragging", "crates/annot/src/tests.rs::restyle_and_resize_redraw_the_appearance", "crates/annot/src/tests.rs::shapes_can_be_filled_and_unfilled", "crates/ui-egui/tests/comments.rs::shapes_take_a_fill_colour_from_the_quick_bar_and_properties"]
+notes = "resize with the 8 handles; fill colour or no fill (#686) from the quick bar, Properties and comment_edit `fill`; fill swatches are the comment palette only (no custom colour picker yet)"
 
 [[feature]]
 id = "comment.oval"
@@ -3782,8 +3806,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["comment.list"]
 tools = ["comment_edit"]
-evidence = ["crates/ui-egui/tests/comments.rs::comment_properties_change_appearance_and_author", "crates/annot/src/tests.rs::author_subject_and_note_icon_change"]
-notes = "Appearance (colour, opacity, thickness, note icon), General (author, subject), Review History"
+evidence = ["crates/ui-egui/tests/comments.rs::comment_properties_change_appearance_and_author", "crates/annot/src/tests.rs::author_subject_and_note_icon_change", "crates/ui-egui/tests/comments.rs::shapes_take_a_fill_colour_from_the_quick_bar_and_properties"]
+notes = "Appearance (colour, fill colour for rectangles/ovals/polygons, opacity, thickness, note icon), General (author, subject), Review History"
 
 [[feature]]
 id = "comment.properties-bar"
@@ -3795,7 +3819,7 @@ status = "shipped"
 commands = ["comment.note"]
 tools = ["comment_edit"]
 evidence = ["crates/annot/src/tests.rs::restyle_and_resize_redraw_the_appearance", "crates/ui-egui/tests/comments.rs::the_opacity_set_for_a_tool_goes_into_its_new_comments"]
-notes = "quick-bar colour swatches, opacity (10–100 %) and line thickness per tool; colour from the context menu"
+notes = "quick-bar colour swatches, fill colour (rectangle, oval, polygon, cloud), opacity (10–100 %) and line thickness per tool; colour from the context menu"
 
 [[feature]]
 id = "comment.lock-comment"
@@ -5142,7 +5166,7 @@ milestone = "M12"
 status = "partial"
 commands = ["file.open"]
 tools = ["doc_open", "doc_info", "form_fields", "form_fill", "js_run"]
-evidence = ["crates/xfa/src/tests.rs::layout_places_captions_fields_and_sizes_containers_to_their_content", "crates/xfa/src/tests.rs::tables_break_across_pages_and_repeat_their_header_row", "crates/xfa/src/tests.rs::rendering_into_the_pdf_replaces_the_placeholder_page_and_adds_fields", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/automation/tests/automation.rs::dynamic_xfa_forms_open_render_fill_and_save_through_tools", "crates/ui-egui/tests/xfa.rs::a_dynamic_xfa_form_is_laid_out_and_filled", "crates/xfa/src/tests.rs::nested_width_less_subforms_lay_out_in_polynomial_time", "crates/js/src/tests.rs::instance_managers_add_remove_and_count", "crates/xfa/src/tests.rs::the_form_tree_carries_values_presence_instances_and_the_events", "crates/engine/src/tests.rs::xfa_scripts_initialize_calculate_validate_toggle_and_add_rows", "crates/automation/tests/automation.rs::xfa_scripts_run_for_buttons_and_field_changes_through_tools", "crates/ui-egui/tests/xfa.rs::xfa_buttons_run_their_scripts_in_the_app", "crates/engine/src/tests.rs::hostile_xfa_open_scripts_are_merged_capped_kept_from_printing_and_noted", "crates/engine/src/tests.rs::runaway_xfa_calculations_at_open_end_quickly_with_a_report", "crates/xfa/src/tests.rs::the_live_form_of_nested_repeating_subforms_stops_at_its_node_budget", "crates/xfa/src/tests.rs::data_ops_of_one_event_are_one_datasets_rewrite", "crates/xfa/src/tests.rs::choice_lists_signatures_passwords_and_pictures_become_fields_and_images", "crates/xfa/src/tests.rs::choice_values_come_from_the_data_as_saved_values_and_several_for_lists", "crates/xfa/src/tests.rs::pictures_are_sized_from_their_headers_and_hostile_ones_are_refused_unallocated", "crates/engine/src/tests.rs::xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save"]
+evidence = ["crates/xfa/src/tests.rs::layout_places_captions_fields_and_sizes_containers_to_their_content", "crates/xfa/src/tests.rs::tables_break_across_pages_and_repeat_their_header_row", "crates/xfa/src/tests.rs::rendering_into_the_pdf_replaces_the_placeholder_page_and_adds_fields", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/automation/tests/automation.rs::dynamic_xfa_forms_open_render_fill_and_save_through_tools", "crates/ui-egui/tests/xfa.rs::a_dynamic_xfa_form_is_laid_out_and_filled", "crates/xfa/src/tests.rs::nested_width_less_subforms_lay_out_in_polynomial_time", "crates/js/src/tests.rs::instance_managers_add_remove_and_count", "crates/xfa/src/tests.rs::the_form_tree_carries_values_presence_instances_and_the_events", "crates/engine/src/tests.rs::xfa_scripts_initialize_calculate_validate_toggle_and_add_rows", "crates/automation/tests/automation.rs::xfa_scripts_run_for_buttons_and_field_changes_through_tools", "crates/ui-egui/tests/xfa.rs::xfa_buttons_run_their_scripts_in_the_app", "crates/engine/src/tests.rs::hostile_xfa_open_scripts_are_merged_capped_kept_from_printing_and_noted", "crates/engine/src/tests.rs::runaway_xfa_calculations_at_open_end_quickly_with_a_report", "crates/xfa/src/tests.rs::the_live_form_of_nested_repeating_subforms_stops_at_its_node_budget", "crates/xfa/src/tests.rs::data_ops_of_one_event_are_one_datasets_rewrite", "crates/xfa/src/tests.rs::choice_lists_signatures_passwords_and_pictures_become_fields_and_images", "crates/xfa/src/tests.rs::choice_values_come_from_the_data_as_saved_values_and_several_for_lists", "crates/xfa/src/tests.rs::pictures_are_sized_from_their_headers_and_hostile_ones_are_refused_unallocated", "crates/engine/src/tests.rs::xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save", "crates/xfa/src/tests.rs::repeating_subforms_inside_positioned_content_get_their_instances", "crates/engine/src/tests.rs::xfa_rows_in_areas_are_laid_out_read_calculated_and_written_where_adobe_binds_them"]
 notes = "laid out from the template on open by the xfa crate (positioned, tb, lr-tb, table/row, page masters, breaks, repeated header rows, captions, rich text, JPEG/PNG/GIF images) into real pages and AcroForm fields (text, password, date with AFDate formats, check boxes, radio groups, drop-downs and list boxes with shown/saved item pairs and multi-select, signature fields, image fields showing their picture (pictures decoded once per document, at most 20 million pixels, and reused across re-layouts), buttons with reset/print/save/URL), filled from the datasets packet (including rows another viewer added), saved as an incremental revision with the values merged into the datasets so Adobe's viewers show them; doc_info reports xfa_layout. XFA JavaScript and FormCalc (form.xfa-formcalc) run in the js crate's XFA object model (xfa.form, SOM resolution, rawValue, presence, access, instance managers, xfa.host, xfa.layout, xfa.event): initialize and calculate on open, exit, validate and calculate after a field changes, click for buttons (through js_run and the app), with rows added and removed, subforms shown and hidden, and the form laid out again, all as one undo step and kept in the file. Hostile scripts are bounded per event (merged and capped effects, messages and console lines, lower loop limits and a time budget on open and calculate, one datasets rewrite per event, print/save/links/focus from clicks only, a runaway script abandoned and the form's scripts turned off) and what open-time scripts changed is noted. Missing: loops inside nested calls are only stopped by abandoning their thread, and script memory is not capped; the change event per keystroke; xfa.template, connections and data descriptions; a hidden instance of a repeating subform hides them all; choosing a new picture for an image field; barcodes are drawn as their text, not bars; keep rules; metrics are approximate and Acrobat fidelity is eyeballed on real forms, not measured (#60)"
 
 [[feature]]
@@ -5166,8 +5190,8 @@ milestone = "M12"
 status = "partial"
 commands = ["file.open", "file.save"]
 tools = ["doc_open", "form_fill", "doc_save"]
-evidence = ["crates/xfa/src/tests.rs::the_datasets_packet_is_written_from_the_fields_and_read_back", "crates/xfa/src/tests.rs::data_fills_the_fields_and_adds_rows", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally"]
-notes = "the datasets packet inside the PDF: read on open (values, dates in ISO form, check and radio states, extra rows for repeating subforms) and rewritten after every form edit from the fields' SOM paths (/PCSom). Missing: importing or exporting a standalone XML/XDP data file, explicit bind refs, data descriptions"
+evidence = ["crates/xfa/src/tests.rs::the_datasets_packet_is_written_from_the_fields_and_read_back", "crates/xfa/src/tests.rs::data_fills_the_fields_and_adds_rows", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/xfa/src/tests.rs::data_paths_leave_areas_out", "crates/engine/src/tests.rs::xfa_rows_in_areas_are_laid_out_read_calculated_and_written_where_adobe_binds_them"]
+notes = "the datasets packet inside the PDF: read on open (values, dates in ISO form, check and radio states, extra rows for repeating subforms) and rewritten after every form edit from the fields' SOM paths (/PCSom), with areas left out of data paths as Adobe binds them. Missing: importing or exporting a standalone XML/XDP data file, explicit bind refs, data descriptions"
 
 [[feature]]
 id = "form.xfa-flatten"
@@ -5226,8 +5250,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["sign.fill.signature", "sign.fill.initials", "sign.fill.signature.change", "sign.fill.initials.change", "sign.fill.signature.remove", "sign.fill.initials.remove"]
 tools = ["fill_sign_add", "comment_edit", "comment_image_preview"]
-evidence = ["crates/ui-egui/tests/fill_sign.rs::drawn_and_typed_signatures_stay_upright_on_rotated_pages", "crates/automation/tests/automation.rs::typed_signatures_stay_upright_on_rotated_pages", "crates/ui-egui/tests/fill_sign.rs::image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen", "crates/ui-egui/src/comments.rs::proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis", "crates/ui-egui/tests/fill_sign.rs::image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles", "crates/ui-egui/tests/fill_sign.rs::embedded_image_signature_live_gestures_follow_document_and_view_rotation", "crates/automation/tests/automation.rs::image_signature_preview_layers_are_read_only_and_survive_encrypted_save", "crates/engine/src/signature_image.rs::embedded_signature_preview_preserves_alpha_without_editing_the_document", "crates/engine/src/signature_image.rs::oversized_embedded_signature_preview_is_rejected_before_decoding", "crates/ui-egui/tests/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save"]
-notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded), drawn or imported from local PNG/JPEG images; all three are placed upright and anchored as displayed on pages with /Rotate (#299); saved in settings with preview cards and add/change/remove controls; changes leave placed annotations untouched; images preserve alpha, aspect ratio and EXIF orientation, fit within 150 pt by 32 pt (24 pt for initials), and are normalized without source paths or metadata; image previews follow the pointer at placement size with zoom and rotation; signatures/initials place once then select the new annotation; embedded image signatures resize and move live, hiding the frame during movement and restoring it on release; corner handles preserve the original aspect ratio of the embedded image with the opposite corner anchored, while edge midpoint handles stretch width or height independently; cached background layers preserve page content and alpha, including reopened/encrypted documents; Escape cancels a gesture without committing; stamps resize through selection handles or comment_edit with their original appearance; native and web asynchronous pickers; fill_sign_add accepts path instead of text; image imports capped at 4 MiB, 4 megapixels and 4096 pixels per side"
+evidence = ["crates/ui-egui/tests/fill_sign.rs::drawn_signatures_resize_from_their_corners", "crates/ui-egui/tests/fill_sign.rs::drawn_and_typed_signatures_stay_upright_on_rotated_pages", "crates/automation/tests/automation.rs::typed_signatures_stay_upright_on_rotated_pages", "crates/ui-egui/tests/fill_sign.rs::image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen", "crates/ui-egui/src/comments.rs::proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis", "crates/ui-egui/tests/fill_sign.rs::image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles", "crates/ui-egui/tests/fill_sign.rs::embedded_image_signature_live_gestures_follow_document_and_view_rotation", "crates/automation/tests/automation.rs::image_signature_preview_layers_are_read_only_and_survive_encrypted_save", "crates/engine/src/signature_image.rs::embedded_signature_preview_preserves_alpha_without_editing_the_document", "crates/engine/src/signature_image.rs::oversized_embedded_signature_preview_is_rejected_before_decoding", "crates/ui-egui/tests/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save", "crates/ui-egui/tests/fill_sign.rs::fill_and_sign_tools_pick_up_placed_marks_to_move_and_resize_them", "crates/ui-egui/tests/fill_sign.rs::select_tool_picks_up_a_signature_over_a_form_field"]
+notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded), drawn or imported from local PNG/JPEG images; all three are placed upright and anchored as displayed on pages with /Rotate (#299); saved in settings with preview cards and add/change/remove controls; changes leave placed annotations untouched; images preserve alpha, aspect ratio and EXIF orientation, fit within 150 pt by 32 pt (24 pt for initials), and are normalized without source paths or metadata; image previews follow the pointer at placement size with zoom and rotation; signatures/initials place once then select the new annotation; while a Fill & Sign tool is active, marks already placed are picked up as with Select (hover shows the move cursor, a click selects, a drag moves, the selected mark's handles resize) and the tool places only away from them; embedded image signatures resize and move live, hiding the frame during movement and restoring it on release; corner handles preserve the original aspect ratio of the embedded image with the opposite corner anchored, while edge midpoint handles stretch width or height independently; cached background layers preserve page content and alpha, including reopened/encrypted documents; Escape cancels a gesture without committing; stamps resize through selection handles or comment_edit with their original appearance; native and web asynchronous pickers; fill_sign_add accepts path instead of text; image imports capped at 4 MiB, 4 megapixels and 4096 pixels per side"
 
 [[feature]]
 id = "form.fill-sign-flatten"
@@ -5822,8 +5846,8 @@ milestone = "M9"
 status = "shipped"
 commands = ["sign.digital", "sign.certify"]
 tools = ["sign_windows_ids", "sign_document"]
-evidence = ["crates/sign/tests/pdf.rs::signing_with_windows_store_identities", "crates/sign/tests/pdf.rs::a_windows_store_identity_signs_with_its_issuers", "crates/sign/tests/pdf.rs::windows_store_enumeration_and_missing_identity", "crates/automation/tests/automation.rs::digital_ids_signing_and_validation_through_tools", "crates/ui-egui/tests/signing.rs::windows_store_identity_does_not_ask_for_a_file_password"]
-notes = "Current User Personal (My) CNG identities: RSA PKCS #1 v1.5 and DER-encoded ECDSA P-256/P-384. Keys never leave Windows; windows:<fingerprint|common name> for agents and Windows store labels in the desktop ID picker. The signature embeds the issuers Windows chains the certificate to. Tested with throwaway software-backed RSA-2048, P-256 and P-384 certificates (run with --ignored). Smart cards and tokens whose driver registers a CNG key storage provider sign with the provider's own PIN dialog (checked by hand with a SafeNet token only; no hardware in CI); direct PKCS #11 still planned."
+evidence = ["crates/sign/tests/pdf.rs::signing_with_windows_store_identities", "crates/sign/tests/pdf.rs::a_windows_store_identity_signs_with_its_issuers", "crates/sign/tests/pdf.rs::windows_store_enumeration_and_missing_identity", "crates/automation/tests/automation.rs::digital_ids_signing_and_validation_through_tools", "crates/ui-egui/tests/signing.rs::windows_store_identity_does_not_ask_for_a_file_password", "crates/ui-egui/tests/signing.rs::an_unusable_id_is_shown_with_its_reason_and_cannot_be_chosen"]
+notes = "Current User Personal (My) CNG identities: RSA PKCS #1 v1.5 and DER-encoded ECDSA P-256/P-384. Keys never leave Windows; windows:<fingerprint|common name> for agents and Windows store labels in the desktop ID picker. The signature embeds the issuers Windows chains the certificate to. Store certificates that can't sign (no private key, another key type, a key CNG can't open) are reported with the reason and Windows error code (greyed in the picker, `unusable` in sign_windows_ids) rather than left out; keys that need a prompt to open are listed and prompt at signing. Tested with throwaway software-backed RSA-2048, P-256 and P-384 certificates and a key-less certificate (run with --ignored). Smart cards and tokens whose driver registers a CNG key storage provider sign with the provider's own PIN dialog (checked by hand with a SafeNet token only; no hardware in CI); still missing: the Local Machine store, legacy CryptoAPI-only providers, P-521/Brainpool/Ed25519 keys, direct PKCS #11."
 
 [[feature]]
 id = "sign.encrypted-documents"
@@ -6970,8 +6994,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["export.all_images"]
 tools = ["doc_export_all_images"]
-evidence = ["crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/automation/tests/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/export.rs::export_dialogs_write_images_and_text"]
-notes = "each image once (page resources and nested forms); JPEG unchanged, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks, soft mask as alpha); JPX/JBIG2/CCITT/separations reported as skipped; minimum size filter"
+evidence = ["crates/create/src/tests.rs::images_export_as_jpeg_unchanged_and_others_as_png", "crates/create/src/tests.rs::indexed_and_one_bit_images_decode", "crates/create/src/tests.rs::jpeg_images_with_a_soft_mask_export_as_png_with_alpha", "crates/create/src/tests.rs::soft_masks_of_another_size_and_stencil_and_colour_key_masks_become_alpha", "crates/automation/tests/automation.rs::exporting_all_images_through_tools", "crates/ui-egui/tests/export.rs::export_dialogs_write_images_and_text"]
+notes = "each image once (page resources and nested forms); JPEG unchanged unless it has transparency, others PNG (gray/RGB/CMYK/ICC/Indexed, 1–16 bpc, stencil masks); transparency as PNG alpha: /SMask (scaled to the image size, /Matte un-blended), stencil /Mask and colour-key /Mask, JPEG images included (#645); JPX/JBIG2/CCITT masks are left out (image exported opaque); JPX/JBIG2/CCITT/separations reported as skipped; minimum size filter"
 
 [[feature]]
 id = "create.export-html"
@@ -7130,8 +7154,8 @@ milestone = "M11"
 status = "shipped"
 commands = ["optimize.reduce"]
 tools = ["doc_reduce"]
-evidence = ["crates/ui-egui/tests/create.rs::reduce_file_size_writes_a_compact_copy", "crates/engine/src/tests.rs::create_and_reduce", "crates/automation/tests/automation.rs::creating_and_reducing_through_tools", "crates/automation/tests/automation.rs::optimizing_through_tools"]
-notes = "images above 225 ppi to 150 ppi JPEG medium, thumbnails dropped, resources merged, object streams; runs in the background with a progress bar and Cancel"
+evidence = ["crates/ui-egui/tests/create.rs::reduce_file_size_writes_a_compact_copy", "crates/ui-egui/tests/create.rs::reduce_file_size_saves_nothing_when_the_file_is_already_small", "crates/engine/src/tests.rs::create_and_reduce", "crates/automation/tests/automation.rs::creating_and_reducing_through_tools", "crates/automation/tests/automation.rs::optimizing_through_tools", "crates/optimize/tests/optimize.rs::an_identity_decode_array_does_not_stop_reduce"]
+notes = "images above 225 ppi to 150 ppi JPEG medium, thumbnails dropped, resources merged, object streams; scanner images with the default decode array are included; a copy that isn't smaller is not saved (\"already as small as it can be made\"); runs in the background with a progress bar and Cancel"
 
 [[feature]]
 id = "optimize.compatibility-level"
@@ -7154,8 +7178,8 @@ milestone = "M11"
 status = "partial"
 commands = ["optimize.advanced"]
 tools = ["doc_optimize"]
-evidence = ["crates/ui-egui/tests/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy", "crates/automation/tests/automation.rs::optimizing_through_tools", "crates/ui-egui/src/optimize_ui.rs::the_progress_card_shows_the_stage_and_cancels", "crates/engine/src/tests.rs::an_optimize_job_reports_its_stages_and_can_be_cancelled"]
-notes = "Images, Discard Objects, Discard User Data, Clean Up; runs in the background with a progress bar (per image) and Cancel; no Fonts or Transparency panels, no space audit"
+evidence = ["crates/ui-egui/tests/create.rs::the_pdf_optimizer_dialog_saves_an_optimized_copy", "crates/automation/tests/automation.rs::optimizing_through_tools", "crates/ui-egui/src/optimize_ui.rs::the_progress_card_shows_the_stage_and_cancels", "crates/engine/src/tests.rs::an_optimize_job_reports_its_stages_and_can_be_cancelled", "crates/optimize/tests/optimize.rs::images_and_forms_nothing_draws_are_dropped", "crates/automation/tests/automation.rs::a_deleted_image_is_not_kept_by_reduce_or_optimize"]
+notes = "Images, Discard Objects, Discard User Data, Clean Up (also drops images and forms the pages list but never draw, such as deleted images); runs in the background with a progress bar (per image) and Cancel; no Fonts or Transparency panels, no space audit"
 
 [[feature]]
 id = "optimize.downsample-images"
@@ -9122,8 +9146,8 @@ milestone = "M13"
 status = "shipped"
 commands = ["actions.wizard"]
 tools = ["action_list", "action_run"]
-evidence = ["crates/engine/src/tests.rs::actions_run_their_steps_on_files", "crates/automation/tests/automation.rs::actions_through_tools", "crates/ui-egui/tests/actions.rs::run_and_create_actions"]
-notes = "Pick an action and files; results go to a chosen folder, in the background with progress."
+evidence = ["crates/ui-egui/tests/actions.rs::desktop_actions_preserve_duplicate_names_and_results_from_earlier_runs", "crates/engine/src/tests.rs::actions_run_their_steps_on_files", "crates/automation/tests/automation.rs::actions_through_tools", "crates/ui-egui/tests/actions.rs::run_and_create_actions"]
+notes = "Desktop output filenames receive numbered suffixes when occupied, preserving every batch result and previous outputs. Pick an action and files; results go to a chosen folder, in the background with progress."
 
 [[feature]]
 id = "misc.action-wizard-create"
@@ -9830,8 +9854,8 @@ milestone = "M14"
 status = "partial"
 commands = ["app.preferences"]
 tools = []
-evidence = ["crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::neutral_locale_does_not_override_display_language", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::arabic_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::arabic_lookups_are_in_display_order", "crates/ui-egui/src/i18n/mod.rs::arabic_plurals_follow_the_six_cldr_forms", "crates/ui-egui/src/i18n/mod.rs::arabic_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::arabic_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::arabic_labels_have_glyphs", "crates/ui-egui/src/bidi.rs::rtl_labels_keep_placeholders_whole", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::german_certificate_subject_has_a_distinct_context", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::ukrainian_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::ukrainian_integer_plurals_cover_teens_and_large_counts", "crates/ui-egui/src/i18n/mod.rs::ukrainian_calendar_uses_month_case_for_dates", "crates/ui-egui/src/i18n/mod.rs::ukrainian_catalog_does_not_leave_english_ui_text", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::ukrainian_history_and_diagnostics_preserve_user_values"]
-notes = "Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian/Ukrainian/Italian/Arabic and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu|uk|it|ar and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. Engine/OS error details stay untranslated. Auto detects the Windows display language after explicitly named supported locale overrides; neutral C/POSIX launcher locales are skipped on Windows, with Chinese script/region mapping and English fallback. Arabic (ar and every ar-* locale) covers commands, dialogs and panels with the six CLDR plural forms; its labels are put into display order when the catalog loads, because egui joins Arabic letters but lays words out left to right. Missing: a right-to-left layout (Arabic labels sit in the left-to-right layout, a wrapped Arabic paragraph breaks at the wrong end, and text typed into a field is not reordered), Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases (the pinned craft-fonts revision has an Arabic face; its Noto Sans CJK SC is never embedded, AGENTS.md §1.1), a full localization audit."
+evidence = ["crates/ui-egui/src/commands.rs::localized_shortcut_labels_follow_language_and_platform", "crates/ui-egui/src/i18n/mod.rs::keyboard_key_names_have_a_separate_context_and_english_fallback", "crates/ui-egui/tests/commands.rs::localized_shortcuts_update_immediately_and_keep_command_ids_and_key_bindings", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::neutral_locale_does_not_override_display_language", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::arabic_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::arabic_lookups_are_in_display_order", "crates/ui-egui/src/i18n/mod.rs::arabic_plurals_follow_the_six_cldr_forms", "crates/ui-egui/src/i18n/mod.rs::arabic_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::arabic_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::arabic_labels_have_glyphs", "crates/ui-egui/src/bidi.rs::rtl_labels_keep_placeholders_whole", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::german_certificate_subject_has_a_distinct_context", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::ukrainian_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::ukrainian_integer_plurals_cover_teens_and_large_counts", "crates/ui-egui/src/i18n/mod.rs::ukrainian_calendar_uses_month_case_for_dates", "crates/ui-egui/src/i18n/mod.rs::ukrainian_catalog_does_not_leave_english_ui_text", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::ukrainian_history_and_diagnostics_preserve_user_values"]
+notes = "Shortcut modifiers and key names use a dedicated catalog context across toolbar, menus, palette, Help and tooltips, with English fallback and macOS symbols preserved. Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian/Ukrainian/Italian/Arabic and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu|uk|it|ar and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. Engine/OS error details stay untranslated. Auto detects the Windows display language after explicitly named supported locale overrides; neutral C/POSIX launcher locales are skipped on Windows, with Chinese script/region mapping and English fallback. Arabic (ar and every ar-* locale) covers commands, dialogs and panels with the six CLDR plural forms; its labels are put into display order when the catalog loads, because egui joins Arabic letters but lays words out left to right. Missing: a right-to-left layout (Arabic labels sit in the left-to-right layout, a wrapped Arabic paragraph breaks at the wrong end, and text typed into a field is not reordered), Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases (the pinned craft-fonts revision has an Arabic face; its Noto Sans CJK SC is never embedded, AGENTS.md §1.1), a full localization audit."
 
 [[feature]]
 id = "misc.prefs-reading"
@@ -9987,7 +10011,7 @@ status = "planned"
 commands = []
 tools = []
 evidence = []
-notes = "Windows MSI creates a Start menu shortcut and an optional (default on) desktop shortcut and confirms full-UI completion with Finish (#143); packaging/windows/test-msi.ps1 checks the compiled MSI and windows-arm64.yml checks installation/removal. Signed installers across platforms remain planned."
+notes = "Windows MSI creates a Start menu shortcut and an optional (default on) desktop shortcut and confirms full-UI completion with Finish (#143); packaging/windows/test-msi.ps1 checks the compiled MSI and windows-arm64.yml checks installation/removal. PDF files use a dedicated embedded document icon when PdfCraft is chosen as the default reader (confirmed in Windows Explorer); first-page thumbnails remain unsupported. Signed installers across platforms remain planned."
 
 [[feature]]
 id = "misc.web-deploy"
diff --git a/vendor/README.md b/vendor/README.md
index 429d68dc3..650d92964 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -12,7 +12,11 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
+| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) revision 2–4 passwords are tried as given and then in PDFDocEncoding (`legacy_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Convert to PDFDocEncoding`): passwords arrive as UTF-8 text, so a password with characters outside ASCII (`Çok güzel`, `ılık€`) written in PDFDocEncoding, as ISO 32000-2 §7.6.4.3.2 asks and qpdf and Acrobat write it, was always wrong | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `crypto::pdfcraft_password_tests`, `pdfcraft-engine` `tests::legacy_passwords_with_turkish_characters_open` |
+| lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589); (4) the object lookup keeps its cycle history through compressed objects, requires an ordinary in-file container, and caps the chain of indirect lookups at 16 (a chain of new objects, each a `/Length` compressed in a container whose own `/Length` names the next, or a stream whose `/Length` names the next stream, overflowed the stack: a dev build's 2 MiB thread within 800 hops); (5) object-stream members are parsed within their own extent (up to the next distinct offset), an entry whose offset repeats an earlier entry's is skipped (so a repeated object number can resolve to its earlier entry), and offsets are processed in index order | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding`; (4) `inspect::tests::compressed_object_self_container_does_not_recurse`, `inspect::tests::compressed_object_mutual_containers_do_not_recurse`, `inspect::tests::object_stream_length_cycle_does_not_recurse`, `inspect::tests::compressed_object_container_chain_does_not_recurse`, `inspect::tests::compressed_length_chain_does_not_recurse`, `inspect::tests::plain_stream_length_chain_does_not_recurse`, `inspect::tests::compressed_objects_and_indirect_stream_length_still_load`, `inspect::tests::compressed_length_in_a_container_with_an_indirect_length_still_loads`; (5) `inspect::tests::object_stream_member_extents_bound_owned_strings`, `inspect::tests::object_stream_member_extents_preserve_index_order_and_whitespace` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it` |
+| lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
+| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) direct arrays and dictionaries share a reader-local nesting cap of 128, counted while skipping and while parsing a dictionary (its lenient repair reads, rather than skips, an object found where a key belongs, so `<< << …` recursed through that read); deeper objects return `None` instead of overflowing the stack (including unused trailer values, trailer entries, content operands and marked-content properties); a chain of 65 direct stitching functions now stops at this cap, before the 64-function guard | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `raster::tests::deeply_nested_direct_objects_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_content_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_the_trailer_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_as_marked_content_properties_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap`, `raster::tests::nesting_at_the_cap_fits_a_512_kib_stack` (native only), `raster::tests::function_limits_depth_guard_refuses_a_chain_of_references` |
 | winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. (2) on Wayland, a seat's text input is destroyed when the seat goes away, not whenever it loses a capability: losing any capability (a touch screen or tablet unplugged, a remote-desktop session ending) destroyed it, and only an added capability recreated it, so IME stopped working until restart. Port of [winit#4747](https://github.com/rust-windowing/winit/pull/4747); (3) on Windows, an IME composition reports its cursor from `GCS_CURSORPOS` only when `WM_IME_COMPOSITION` says it is set, and at the end of the composition otherwise: the Microsoft Korean IME never sets it, so the cursor read as 0 (egui then drew no caret while composing; it now draws it after the syllable). Port of [winit#4746](https://github.com/rust-windowing/winit/pull/4746); (4) on Windows, a hidden window is not maximized until it is shown, and a hidden window shown while maximized gets one `ShowWindow(SW_MAXIMIZE)`: `SW_MAXIMIZE` shows a hidden window, so PdfCraft, which eframe keeps hidden until its first frame is drawn, appeared unpainted (white) when it restored a maximized window, and could lose its focus. Port of [winit#4587](https://github.com/rust-windowing/winit/pull/4587) (the later, focus-safe form of [winit#4575](https://github.com/rust-windowing/winit/pull/4575)); (5) on X11, when allowing or disallowing IME replaces the focused window's input context (egui does it each time a text field gains or loses focus), the new context is focused: no focus event follows, so it stayed unfocused until the window lost and regained focus. Port of [winit#4727](https://github.com/rust-windowing/winit/pull/4727); (6) on macOS, `insertText` commits through IME when a composition was started (`pending_commit`, set by `setMarkedText`) rather than when marked text is left: input methods that end a composition with `unmarkText` before `insertText` lost the text, and Apple Korean dropped the key typed after a syllable (`한` then `5` or `;`); other `insertText` calls stay `KeyboardInput`; a commit outside a key press (a candidate clicked with the mouse, dictation) clears the marked text and leaves no key to swallow, as in [winit#4748](https://github.com/rust-windowing/winit/pull/4748) (without it the next key, such as Backspace, was lost). `validAttributesForMarkedText` lists the underline and marked-clause attributes, without which some input methods don't compose. Port of [winit#4650](https://github.com/rust-windowing/winit/pull/4650), the 0.30 backport of [winit#4651](https://github.com/rust-windowing/winit/pull/4651) (merged on winit master), with the underline attribute spelled as AppKit's `NSUnderlineStyleAttributeName` (`NSUnderline`); (7) on macOS, disallowing IME with a composition in progress (focus leaving a text field) tells the input method to discard its marked text (`discardMarkedText`): it kept composing it once IME was allowed again, so the abandoned syllable came back (`하`, then `가` typed in the next field, became `학`, then `하` + `가`; Japanese `か` then `さ` became `傘`). Port of [winit#4745](https://github.com/rust-windowing/winit/pull/4745); (8) on macOS, text inserted outside a key press without a composition (the emoji picker) is reported as `Ime::Commit`; it was dropped. Port of the emoji-picker part of [winit#4749](https://github.com/rust-windowing/winit/pull/4749) (0.30 backport of [winit#4748](https://github.com/rust-windowing/winit/pull/4748)); its `selectedRange` change for dictation is left out because it switches on press-and-hold for every held key (an accent menu instead of key repeat, and the chosen accent added after the repeated letters); (9) on macOS, a key whose text was committed through IME isn't also sent as `KeyboardInput` unless AppKit forwards it as a command (Enter): Apple Korean answers Space with no syllable in progress with `setMarkedText(" ")`, `insertText(" ")`, `setMarkedText("")`, and the last call reset winit's state, so the space arrived twice. Same goal as [winit#4478](https://github.com/rust-windowing/winit/pull/4478), whose changes don't reach this call order (macOS 14); to be proposed upstream there; (10) on macOS, when the first key in a fresh app reaches Apple Korean's `insertText` as a raw compatibility jamo instead of starting a composition, that key is interpreted once more, synchronously, before it is sent as `KeyboardInput` (g k s typed ㅎㅏㄴ instead of 한); only an unmodified, non-repeated first key whose one callback inserts that same jamo, with IME enabled and nothing composed, focus and input source unchanged, is retried (`ime_startup.rs`). Port of [winit#4744](https://github.com/rust-windowing/winit/pull/4744), with its policy tests. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11; (2) `pdfcraft` `tests/winit_wayland_text_input.rs`; the capability change itself needs a Wayland session and an input method; (3) `pdfcraft` `tests/winit_windows_ime_cursor.rs`; composing itself needs the Microsoft Korean IME; (4) `pdfcraft` `tests/winit_windows_hidden_maximized.rs`; the start-up itself needs Windows and a window that was closed maximized; (5) `pdfcraft` `tests/winit_x11_ime_focus.rs`; switching fields itself needs an X11 session and an input method (IBus, fcitx5); (6) `pdfcraft` `tests/winit_macos_ime_commit.rs`; composing itself needs macOS and an input method; (7) `pdfcraft` `tests/winit_macos_ime_discard.rs`; composing itself needs macOS and an input method; (8) `pdfcraft` `tests/winit_macos_emoji_picker.rs`; the picker itself needs macOS; (9) `pdfcraft` `tests/winit_macos_korean_space.rs`; composing itself needs macOS and Apple Korean; (10) `pdfcraft` `tests/winit_macos_korean_first_key.rs` and `ime_startup.rs`'s own tests (run them with `rustc --test`); typing itself needs macOS and Apple Korean |
 | egui-wgpu | 0.36.2 | MIT OR Apache-2.0 | (1) `winit::surface_fit`: a window's surface is configured within the device's `max_texture_dimension_2d`, both sides shrunk by one factor that egui then draws at (`pixels_per_point × render_scale`), so the whole window is drawn into the surface (on DX12 it is stretched over the window and lines up with the pointer; wgpu's GL backend copies it unscaled into a corner); the longer side becomes exactly the limit; the depth and MSAA textures follow, and a recreated surface starts again from the window's own size. egui-wgpu configured the window's size as is, and `Surface::configure` panics beyond the limit: a window restored at another monitor's scale (opening an Outlook attachment on a mixed-DPI laptop asked an 8192-pixel device for 8600 × 3423, #577) or stretched across monitors closed PdfCraft, before its window appeared when it happened at start-up ([emilk/egui#8361](https://github.com/emilk/egui/issues/8361)). The published crate leaves out egui's licence files; `LICENSE-APACHE` and `LICENSE-MIT` are from the 0.36.2 tag; (2) `winit::catch_errors`: a new window's surface is configured inside wgpu error scopes (validation, out of memory, internal), and a failure is returned as `WgpuError::ConfigureSurface` (for the root window at start-up eframe returns it as `Error::Wgpu`, which PdfCraft retries with OpenGL); nothing is kept for the window. wgpu's default handler panicked instead, and eframe configures the root surface before the app is created, so a driver that can't configure one closed PdfCraft at launch (a 2015 Intel GPU through wgpu's GL backend timed out waiting for the GPU to go idle, `GpuWaitTimeout`, #519). Unchanged, so still a panic: an error in a later reconfigure (resize, a lost surface), a device lost during the first configure (wgpu reports it only to a callback), and a window shown at zero size (first configured on resize) | (1) `pdfcraft` `tests::a_window_larger_than_the_gpu_limit_gets_a_surface_within_it`, `tests::surface_fit_never_empties_or_overflows_a_surface`, and `tests::egui_wgpu_carries_the_surface_size_fit`, which keeps the patch in the build and in the paths that size a surface; (2) `pdfcraft` `tests::a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic` (a real device: an error inside `catch_errors` is returned, not a panic) and `tests::egui_wgpu_returns_a_surface_it_cannot_configure_as_an_error`, which keeps it around `add_surface`'s configure |
 
diff --git a/vendor/hayro-interpret/src/function/type3.rs b/vendor/hayro-interpret/src/function/type3.rs
index 2d3720d48..f63668f17 100644
--- a/vendor/hayro-interpret/src/function/type3.rs
+++ b/vendor/hayro-interpret/src/function/type3.rs
@@ -174,8 +174,10 @@ mod tests {
             Some(smallvec![0.5])
         );
         let data = function_limits_stitching(65);
-        let object = Object::from_bytes(data.as_bytes()).unwrap();
-        assert!(Function::new(&object).is_none());
+        // Direct nesting beyond the hayro-syntax cap (PdfCraft patch) is refused while parsing,
+        // before this guard; the guard is tested with indirect references in pdfcraft-render
+        // (`function_limits_depth_guard_refuses_a_chain_of_references`).
+        assert!(Object::from_bytes(data.as_bytes()).is_none());
     }
 
     fn function_limits_fanout(children: usize) -> String {
diff --git a/vendor/hayro-syntax/src/byte_reader.rs b/vendor/hayro-syntax/src/byte_reader.rs
index 9ea295728..f3c7a20e0 100644
--- a/vendor/hayro-syntax/src/byte_reader.rs
+++ b/vendor/hayro-syntax/src/byte_reader.rs
@@ -2,6 +2,10 @@
 
 use core::ops::Range;
 
+/// PdfCraft patch: how deeply direct arrays and dictionaries may nest (the same cap as `pdfcraft-cos`; a
+/// chain of 64 direct stitching functions is exactly this deep).
+const MAX_CONTAINER_DEPTH: usize = 128;
+
 /// A reader for reading bytes and PDF objects.
 #[derive(Clone, Debug)]
 pub struct Reader<'a> {
@@ -9,19 +13,34 @@ pub struct Reader<'a> {
     pub data: &'a [u8],
     /// The current byte-offset.
     pub offset: usize,
+    // PdfCraft patch: bound direct-object nesting while skipping arrays and dictionaries
+    // and while parsing dictionaries (`Dict::skip`, `Array::skip`, `parse_dict_with`).
+    skip_depth: usize,
 }
 
 impl<'a> Reader<'a> {
     /// Create a new reader.
     #[inline]
     pub fn new(data: &'a [u8]) -> Self {
-        Self { data, offset: 0 }
+        Self { data, offset: 0, skip_depth: 0 }
     }
 
     /// Create a new reader at the given offset.
     #[inline]
     pub fn new_with(data: &'a [u8], offset: usize) -> Self {
-        Self { data, offset }
+        Self { data, offset, skip_depth: 0 }
+    }
+
+    pub(crate) fn enter_container(&mut self) -> Option<()> {
+        if self.skip_depth >= MAX_CONTAINER_DEPTH {
+            return None;
+        }
+        self.skip_depth += 1;
+        Some(())
+    }
+
+    pub(crate) fn leave_container(&mut self) {
+        self.skip_depth -= 1;
     }
 
     /// Returns `true` if the reader has reached the end of the data.
diff --git a/vendor/hayro-syntax/src/crypto/mod.rs b/vendor/hayro-syntax/src/crypto/mod.rs
index 2d407ad09..d531be539 100644
--- a/vendor/hayro-syntax/src/crypto/mod.rs
+++ b/vendor/hayro-syntax/src/crypto/mod.rs
@@ -162,18 +162,27 @@ pub(crate) fn get(
     };
 
     let mut decryption_key = if revision <= 4 {
-        let key = decryption_key_rev1234(
-            password,
-            encrypt_metadata,
-            revision,
-            byte_length,
-            &owner_string,
-            permissions,
-            id,
-        )?;
-        authenticate_user_password_rev234(revision, &key, id, &user_string)?;
-
-        key
+        // PdfCraft patch: (see vendor/README.md hayro-syntax (14)) the password is tried as
+        // given and then in PDFDocEncoding, which revisions 2–4 specify.
+        let mut found = Err(DecryptionError::PasswordProtected);
+        for candidate in legacy_passwords(password) {
+            found = decryption_key_rev1234(
+                &candidate,
+                encrypt_metadata,
+                revision,
+                byte_length,
+                &owner_string,
+                permissions,
+                id,
+            )
+            .and_then(|key| {
+                authenticate_user_password_rev234(revision, &key, id, &user_string).map(|()| key)
+            });
+            if found.is_ok() {
+                break;
+            }
+        }
+        found?
     } else {
         decryption_key_rev56(dict, revision, password, &owner_string, &user_string)?
     };
@@ -448,6 +457,45 @@ fn compute_hash_rev56(
     Ok(result)
 }
 
+/// `PdfCraft` patch: the byte strings to try as a revision 2–4 password. Revisions 2–4 take the
+/// password in `PDFDocEncoding` (ISO 32000-2 §7.6.4.3.2, Algorithm 2 a), but the password arrives
+/// as UTF-8 text: first the bytes as given (what earlier versions used, and what some writers
+/// store), then, for text with characters outside ASCII that `PDFDocEncoding` all has ("ılık€",
+/// "Çok güzel"), its `PDFDocEncoding` bytes.
+fn legacy_passwords(password: &[u8]) -> Vec<Vec<u8>> {
+    let mut out = vec![password.to_vec()];
+    if let Ok(text) = core::str::from_utf8(password)
+        && !text.is_ascii()
+        && let Some(doc) = text.chars().map(pdf_doc_byte).collect::<Option<Vec<u8>>>()
+    {
+        out.push(doc);
+    }
+    out
+}
+
+/// `PdfCraft` patch: `PDFDocEncoding` (ISO 32000-2 Annex D) of `c`, `None` when it has none.
+/// It differs from Latin-1 in 0x18–0x1F and 0x80–0xA0 (0x9F is undefined).
+fn pdf_doc_byte(c: char) -> Option<u8> {
+    const LOW: [char; 8] = ['˘', 'ˇ', 'ˆ', '˙', '˝', '˛', '˚', '˜'];
+    const HIGH: [char; 33] = [
+        '•', '†', '‡', '…', '—', '–', 'ƒ', '⁄', '‹', '›', '−', '‰', '„', '“', '”', '‘', '’', '‚',
+        '™', 'fi', 'fl', 'Ł', 'Œ', 'Š', 'Ÿ', 'Ž', 'ı', 'ł', 'œ', 'š', 'ž', '\u{FFFD}', '€',
+    ];
+    let at = |table: &[char], base: u8| {
+        table
+            .iter()
+            .position(|&t| t == c && t != '\u{FFFD}')
+            .and_then(|i| u8::try_from(i).ok())
+            .map(|i| base + i)
+    };
+    at(&LOW, 0x18)
+        .or_else(|| at(&HIGH, 0x80))
+        .or_else(|| match u32::from(c) {
+            0x18..=0x1F | 0x80..=0xA0 => None,
+            n => u8::try_from(n).ok(),
+        })
+}
+
 /// Algorithm 2: Computing a file encryption key in order to encrypt a document (revision 4 and earlier)
 fn decryption_key_rev1234(
     password: &[u8],
@@ -460,7 +508,7 @@ fn decryption_key_rev1234(
 ) -> Result<Vec<u8>, DecryptionError> {
     let mut md5_input = vec![];
 
-    // TODO: Convert to PDFDocEncoding.
+    // (PDFDocEncoding: see `legacy_passwords`, PdfCraft patch.)
     // a) Pad or truncate password to 32 bytes using PASSWORD_PADDING.
     let mut padded_password = [0_u8; 32];
     let copy_len = password.len().min(32);
@@ -672,3 +720,24 @@ fn decryption_key_rev56(
     // "b". Bytes 0-3 of the decrypted Perms entry, treated as a little-endian integer, are the user
     // permissions. They shall match the value in the P key.
 }
+
+#[cfg(test)]
+mod pdfcraft_password_tests {
+    use super::*;
+
+    #[test]
+    fn legacy_passwords_are_tried_as_given_then_in_pdf_doc_encoding() {
+        assert_eq!(legacy_passwords(b"pw"), [b"pw".to_vec()]);
+        assert_eq!(
+            legacy_passwords("ılık€".as_bytes()),
+            ["ılık€".as_bytes().to_vec(), vec![0x9A, b'l', 0x9A, b'k', 0xA0]]
+        );
+        assert_eq!(
+            legacy_passwords("Çok".as_bytes()),
+            ["Çok".as_bytes().to_vec(), vec![0xC7, b'o', b'k']]
+        );
+        // PDFDocEncoding has no ş: only the bytes as given.
+        assert_eq!(legacy_passwords("şifre".as_bytes()), ["şifre".as_bytes().to_vec()]);
+        assert_eq!(legacy_passwords(&[0xFF, 0x00]), [vec![0xFF, 0x00]]);
+    }
+}
diff --git a/vendor/hayro-syntax/src/object/array.rs b/vendor/hayro-syntax/src/object/array.rs
index 332f09ab8..d39230f7d 100644
--- a/vendor/hayro-syntax/src/object/array.rs
+++ b/vendor/hayro-syntax/src/object/array.rs
@@ -71,8 +71,10 @@ object!(Array<'a>, Array);
 impl Skippable for Array<'_> {
     fn skip(r: &mut Reader<'_>, is_content_stream: bool) -> Option<()> {
         r.forward_tag(b"[")?;
+        r.enter_container()?;
 
-        loop {
+        // PdfCraft patch: leave even when an element's skip fails through `?`.
+        let result = (|| loop {
             r.skip_white_spaces_and_comments();
 
             if let Some(()) = r.forward_tag(b"]") {
@@ -82,7 +84,9 @@ impl Skippable for Array<'_> {
             } else {
                 r.skip::<MaybeRef<Object<'_>>>(false)?;
             }
-        }
+        })();
+        r.leave_container();
+        result
     }
 }
 
diff --git a/vendor/hayro-syntax/src/object/dict.rs b/vendor/hayro-syntax/src/object/dict.rs
index 55ea355ea..1e016b567 100644
--- a/vendor/hayro-syntax/src/object/dict.rs
+++ b/vendor/hayro-syntax/src/object/dict.rs
@@ -177,8 +177,10 @@ impl Debug for Dict<'_> {
 impl Skippable for Dict<'_> {
     fn skip(r: &mut Reader<'_>, is_content_stream: bool) -> Option<()> {
         r.forward_tag(b"<<")?;
+        r.enter_container()?;
 
-        loop {
+        // PdfCraft patch: leave even when a value or garbage fails through `?`.
+        let result = (|| loop {
             r.skip_white_spaces_and_comments();
 
             if let Some(()) = r.forward_tag(b">>") {
@@ -198,7 +200,9 @@ impl Skippable for Dict<'_> {
                     r.skip::<MaybeRef<Object<'_>>>(is_content_stream)?;
                 }
             }
-        }
+        })();
+        r.leave_container();
+        result
     }
 }
 
@@ -362,7 +366,26 @@ pub(crate) fn probe_dict<'a>(
     })
 }
 
+// PdfCraft patch: an object where a key belongs is read, not skipped, so a dictionary
+// holding another one there (`<< << …`) recursed without a bound. Count each parsed
+// dictionary like a skipped one, and leave on every exit of the parse below.
 fn parse_dict_with<'a, F>(
+    r: &mut Reader<'a>,
+    ctx: &ReaderContext<'a>,
+    start_tag: Option<&[u8]>,
+    end_tag: &[u8],
+    on_entry: F,
+) -> Option<(&'a [u8], bool)>
+where
+    F: FnMut(Name<'a>, usize, &Reader<'a>) -> Option<()>,
+{
+    r.enter_container()?;
+    let result = parse_dict_with_inner(r, ctx, start_tag, end_tag, on_entry);
+    r.leave_container();
+    result
+}
+
+fn parse_dict_with_inner<'a, F>(
     r: &mut Reader<'a>,
     ctx: &ReaderContext<'a>,
     start_tag: Option<&[u8]>,
diff --git a/vendor/lopdf/src/object_stream.rs b/vendor/lopdf/src/object_stream.rs
index 8b4c423a9..5a921b4ba 100644
--- a/vendor/lopdf/src/object_stream.rs
+++ b/vendor/lopdf/src/object_stream.rs
@@ -86,31 +86,61 @@ impl ObjectStream {
             warn!("object stream: the object stream dictionary specifies a wrong number of objects")
         }
 
-        let chunks_filter_map = |chunk: &[_]| {
+        // PdfCraft patch: bound members by the next distinct offset and parse each offset
+        // only once, so overlapping or duplicate entries cannot amplify decoded content.
+        let mut extents = BTreeMap::new();
+        for (index, chunk) in numbers[..len].chunks(2).enumerate() {
+            if let &[Some(_), Some(offset)] = chunk {
+                let offset = first_offset.saturating_add(offset as usize);
+                if offset < content.len() {
+                    extents.entry(offset).or_insert((index, content.len()));
+                }
+            }
+        }
+        let mut end = content.len();
+        for (&offset, (_, extent_end)) in extents.iter_mut().rev() {
+            *extent_end = end;
+            end = offset;
+        }
+
+        let chunks_filter_map = |(index, chunk): (usize, &[_])| {
             let id = chunk[0]?;
-            let offset = first_offset + chunk[1]? as usize;
+            let offset = first_offset.saturating_add(chunk[1]? as usize);
 
             if offset >= content.len() {
                 warn!("out-of-bounds offset in object stream");
                 return None;
             }
+            let &(first_index, extent_end) = extents.get(&offset)?;
+            if index != first_index {
+                warn!("duplicate offset in object stream");
+                return None;
+            }
             // Skip leading whitespace — some PDFs emit newlines before objects in ObjStm
             let mut start = offset;
-            while start < content.len() && content[start].is_ascii_whitespace() {
+            while start < extent_end && content[start].is_ascii_whitespace() {
                 start += 1;
             }
-            if start >= content.len() {
+            if start >= extent_end {
                 warn!("only whitespace after offset in object stream");
                 return None;
             }
-            let object = parser::direct_object(&content[start..])?;
+            let object = parser::direct_object(&content[start..extent_end])?;
 
             Some(((id, 0), object))
         };
         #[cfg(feature = "rayon")]
-        let objects = numbers[..len].par_chunks(2).filter_map(chunks_filter_map).collect();
+        let objects = numbers[..len]
+            .par_chunks(2)
+            .enumerate()
+            .filter_map(chunks_filter_map)
+            .collect();
         #[cfg(not(feature = "rayon"))]
-        let objects = numbers[..len].chunks(2).filter_map(chunks_filter_map).collect();
+        let objects = numbers[..len]
+            .chunks(2)
+            .enumerate()
+            .filter_map(chunks_filter_map)
+            .collect();
 
         Ok(ObjectStream {
             objects,
diff --git a/vendor/lopdf/src/reader.rs b/vendor/lopdf/src/reader.rs
index e048e3acf..df471371d 100644
--- a/vendor/lopdf/src/reader.rs
+++ b/vendor/lopdf/src/reader.rs
@@ -493,6 +493,10 @@ pub const MAX_BRACKET: usize = 100;
 
 pub const MAX_NESTING_DEPTH: usize = 100;
 
+/// PdfCraft patch: a valid stream /Length resolves in at most three lookups (the length, the object stream holding
+/// it, and that stream's own /Length); longer lookup chains overflowed the stack.
+const MAX_LOOKUP_DEPTH: usize = 16;
+
 /// Cap on reconstructed cross-reference entries, bounding memory on hostile inputs.
 const MAX_RECONSTRUCTED_OBJECTS: usize = 1_000_000;
 
@@ -1149,7 +1153,7 @@ impl Reader<'_> {
     }
 
     /// Load a compressed object from an object stream (for lightweight metadata extraction)
-    fn get_compressed_object(&self, id: ObjectId) -> Result<Object> {
+    fn get_compressed_object(&self, id: ObjectId, already_seen: &mut HashSet<ObjectId>) -> Result<Object> {
         let entry = self.document.reference_table.get(id.0).ok_or(Error::MissingXrefEntry)?;
 
         let container_id = match entry {
@@ -1157,15 +1161,30 @@ impl Reader<'_> {
             _ => return Err(Error::MissingXrefEntry),
         };
 
+        // PdfCraft patch: require an in-file container (PDF 7.5.7) and retain the caller's cycle history through
+        // indirect stream /Length lookups; `get_object` caps the depth of that history.
+        if !matches!(
+            self.document.reference_table.get(container_id),
+            Some(XrefEntry::Normal { .. })
+        ) {
+            return Err(Error::InvalidObjectStream(
+                "Object stream container must be an ordinary in-file object".into(),
+            ));
+        }
         let container_id = (container_id, 0);
-        let mut already_seen = HashSet::new();
-        let container_obj = self.get_object(container_id, &mut already_seen)?;
+        let container_obj = self.get_object(container_id, already_seen)?;
         let container_stream = container_obj.as_stream()?;
         let object_stream = ObjectStream::new_with_limit(container_stream, self.max_decompressed_size)?;
         object_stream.objects.get(&id).cloned().ok_or(Error::MissingXrefEntry)
     }
 
     pub fn get_object(&self, id: ObjectId, already_seen: &mut HashSet<ObjectId>) -> Result<Object> {
+        // PdfCraft patch: each top-level lookup starts with an empty set and every nested lookup adds one object, so
+        // the set's size is the depth of the lookup chain.
+        if already_seen.len() >= MAX_LOOKUP_DEPTH {
+            warn!("lookup chain deeper than {MAX_LOOKUP_DEPTH} at object {} {}", id.0, id.1);
+            return Err(Error::ReferenceLimit);
+        }
         if already_seen.contains(&id) {
             warn!("reference cycle detected resolving object {} {}", id.0, id.1);
             return Err(Error::ReferenceCycle(id));
@@ -1175,7 +1194,7 @@ impl Reader<'_> {
         if let Some(entry) = self.document.reference_table.get(id.0)
             && matches!(entry, XrefEntry::Compressed { .. })
         {
-            return self.get_compressed_object(id);
+            return self.get_compressed_object(id, already_seen);
         }
 
         let offset = self.get_offset(id)?;