aspose-pdf-foss-for-python 0.1.0__tar.gz

aspose_pdf_foss_for_python-0.1.0/CHANGELOG.md

@@ -0,0 +1,3433 @@
+# Changelog
+
+All notable changes to Aspose.PDF FOSS for Python will be documented in this
+file.
+
+The project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- **Turn scanned spreads into individual PDF pages.**
+  `Document.split_spreads()` supports selected spreads, both reading axes,
+  reversed reading order, an adjustable split and a central gutter. Teams can
+  prepare scans for reading and distribution while keeping covers, text and
+  vector/image content in an independent document.
+
+- **Share PDF review comments through XFDF.**
+  Document and page exports carry supported annotations, markup geometry,
+  authors, dates and reply threads with page/type filters. Teams can hand off
+  review data without copying the full PDF or manually re-entering comments.
+
+- **Download rendered PDF pages as one image archive.**
+  `Document.export_pages_zip()` packages selected views as PNG, JPEG or optional
+  WebP, with configurable resolution/color and an optional page manifest.
+  Teams can share previews or feed image workflows without managing individual
+  export files; processing completes before the destination is written.
+
+- **Generate filled PDFs from a reusable template and a batch of records.**
+  `FormFiller` and `FormFillerOptions` create independent results with optional
+  field flattening, preserving template values omitted by a record. Teams can
+  prepare repeatable document batches without carrying answers between rows;
+  processing finishes before configured outputs are written.
+
+- **Update link URLs across a document.**
+  `Document.replace_link_urls()` and `Page.replace_link_urls()` support
+  literal/regex migrations, page selection and dry-run counts while retaining
+  link appearance and other action data. Plans are checked before editing,
+  helping maintain published PDF links without recreating the document.
+
+- **Create navigation bookmarks from text patterns.**
+  `Document.generate_outlines_from_text()` turns literal or regex matches into
+  page bookmarks, with capture groups for titles and reusable text filters.
+  Reports and document batches can gain navigation without manual bookmark
+  entry or heading styles; validation or extraction failures preserve the
+  existing tree.
+
+- **Exclude headers, footers and sidebars from extracted text.**
+  `exclude_regions` on page/document extraction, the facade and low-code text
+  workflows removes overlapping glyphs without editing the PDF. Rectangles
+  combine with page selection, inclusion clips and marked-artifact filtering,
+  helping indexing and document pipelines avoid repeated page decoration.
+
+- **Create grayscale and black-and-white PDF copies.**
+  `Document.rasterized_copy(mode="gray" | "bilevel")` prepares static documents
+  for scan processing, sharing and monochrome printing, with adjustable
+  threshold and optional dithering. Converted samples are stored directly as
+  8-bit grayscale or packed 1-bit images, with resource-aware output planning.
+
+- **Describe PDF form templates for reusable filling interfaces.**
+  `Form.to_schema()` and `Form.export_schema()` expose field types, labels,
+  effective constraints, choice options and typed defaults without exporting
+  current answers. Applications can inspect templates and build form workflows
+  with less custom PDF metadata handling, including streaming/encrypted inputs.
+
+- **Extract PDF structure for indexing and data pipelines.**
+  `Document.extract_blocks()` and `Page.extract_blocks()` return immutable
+  headings, paragraphs, lists and tables with original page indices and
+  position anchors. `export_blocks_json()` provides versioned UTF-8 JSON to
+  bytes, files or binary streams, with opt-in figure PNGs. Applications can
+  consume document structure directly without parsing generated markup.
+
+- **Clean up annotations by author and date.**
+  `Document.remove_annotations()` and `page.annotations.remove_matching()`
+  filter review markup by author, date range, subtype and page, with a dry-run
+  count before editing. Teams can clear superseded review rounds before
+  handoff while retaining unrelated feedback, links and forms by default.
+  Removal plans include owned popups and repairs to surviving reply links,
+  are validated before mutation, and do not decode page or appearance streams.
+
+- **Measure visible content without editing the PDF.**
+  `Page.get_content_bounds()` and `Document.get_content_bounds(pages=None)`
+  return visible ink bounds in page coordinates, with `None` for blank-looking
+  pages. Processing teams can inspect white margins and prepare crop or layout
+  decisions before changing documents. Measurement follows the current page
+  view, supports scans and optional annotation appearances, and reads selected
+  streaming pages one at a time without changing page boxes or content.
+
+- **Inventory PDF links for audits and content migrations.**
+  `Document.extract_links(pages=None)` and `Page.extract_links()` return
+  detached source coordinates, URI/local/remote targets and action-chain
+  diagnostics. Relative URIs use the catalog base; named destinations resolve
+  to current pages. Review teams can locate references needing updates without
+  opening each link. No target is executed, fetched or opened, and no page
+  content or image decoding is required.
+
+- **Find low-resolution image placements.**
+  `Document.find_low_resolution_images(min_dpi=150, pages=None)` reports image
+  locations, pixel dimensions and effective DPI for each weak placement,
+  including inline images and nested forms. Rotation, shear, reuse and page
+  UserUnit are accounted for without decoding image samples. Teams can locate
+  assets that need replacement before print or publication and automate
+  resolution checks. This does not assess sharpness or certify print quality.
+
+- **A contents page, built from the document's own headings.**
+  `generate_outlines` already turned them into bookmarks; `Document
+  .add_table_of_contents()` writes the same answer onto paper — the headings
+  down a page, indented by level, with dot leaders, the page each is on, and a
+  link that lands on the heading itself rather than on the top of its sheet.
+  - **The page numbers account for the contents.** Inserting it pushes every
+    page it points at further back, so the numbers cannot be read off the
+    document as it stands. They are not circular — how many lines there are
+    does not depend on what the numbers say — so the page count is settled
+    first, the pages are inserted, and only then is each heading's new place
+    worked out. `at=1` puts the contents after a cover, and a heading before
+    that keeps the number it had.
+  - **Page labels win over positions**: a contents saying `12` for a page the
+    reader sees as `xii` is wrong in the only way that matters.
+  - A heading too long for its line is shortened with an ellipsis rather than
+    run under its own page number; the leaders are right-aligned so they line
+    up down the page; a document with no headings gets **no page at all**.
+  - `title`, `max_level`, `prefer_structure`, `at`, `size`, `margin`,
+    `font_name`, `title_size`, `entry_size`, `indent`, `leader`, `links`,
+    `page_numbers` and `tag` are all adjustable; the sheet defaults to the size
+    of the page the contents goes in front of.
+  - `tag=True` marks the entries as `/TOCI` **inside a `/TOC`** (table 333) —
+    a row of `TOCI` at the root is not a table of contents, it is a row of
+    orphans.
+  - Checked with qpdf: every link resolves to exactly the page the line prints,
+    as an `/XYZ` at the heading's own coordinates, `--check` clean.
+
+- **SVG export can write words instead of curves.** Every glyph went out as the
+  outline its font gives it — exact, and about as selectable as a photograph of
+  a page: nothing could search it, copy from it or read it aloud.
+  - `Page.to_svg(text=…)`, `Page.save_as_svg(text=…)` and
+    `Document.save_as_svg(text=…)` take `"outlines"` (the default, unchanged),
+    `"text"` (`<text>` elements instead of curves) or `"both"` (the curves,
+    with unfilled `<text>` over them).
+  - **Every glyph carries its own `x`.** A viewer draws with whatever font it
+    resolves the name to, so its advances are not the PDF's; positioning each
+    glyph means the layout does not move even when the face does. Rotation,
+    skew and scale ride in the element's `transform`, whose y column is negated
+    so the words are not mirrored by the page's own flip.
+  - The face is *described* for a viewer to match — `Times, serif` with
+    `font-weight`/`font-style` off the PostScript name, and a generic family
+    from the descriptor flags — since an embedded program lives in the PDF, not
+    in the SVG.
+  - **Invisible text (rendering mode 3) is collected**, which is what makes a
+    scanned page's OCR layer searchable once exported.
+  - A glyph whose meaning nothing in the file states gets no `<text>` and keeps
+    its outlines: a guess would put the wrong word in someone's copy buffer.
+  - One element per line, per font, per colour — gluing two lines together
+    would hand whoever copies the text one word made of two.
+  - Checked against cairosvg: `"both"` renders **pixel-identically** to
+    `"outlines"` while `ElementTree` reads the words straight out, and
+    `"text"`'s ink lands in the same bounding box to within a pixel.
+  - The rasterizer gained one no-op sink (`_note_glyph`) for this; rendering is
+    unchanged by construction.
+
+- **`Document.sanitize()` takes out everything that is not what the document
+  shows.** Each piece was removable on its own — `info`, `javascript`,
+  `attachments`, `flatten_layers`, the annotation collections — but there was
+  no pass that did all of them, and no way to say what had been taken.
+  - Removed by default: `/Info`, the XMP packet and the producer's private
+    `/PieceInfo` store (catalog **and** pages); the `/Names /JavaScript` tree;
+    the open action when it *is* an action; the catalog's and every page's
+    `/AA`; any action on an annotation or field that runs script, launches a
+    file or sends data away, including one chained behind a harmless action
+    through `/Next`; embedded files, from the name tree and the `/AF` entries
+    that reach them; optional content, resolved as `flatten_layers` does so a
+    hidden layer's content is **deleted**; and markup annotations, which carry
+    an author and a date.
+  - Left alone by default: links (`links=True` to remove them) and the
+    interactive form (`forms=True`). A link that opens a URL keeps working —
+    that is what a link is for — while one that launches a program loses its
+    action and stays as a rectangle.
+  - Returns a `SanitizationReport` counting what went, so a caller can state
+    what was done rather than hope. `bool(report)` is `False` when the document
+    carried none of it.
+  - **The next save is a full rewrite.** Dropping a reference does not remove
+    the object, and an appended revision keeps the unsanitized one in front of
+    it in the same file — either way the attachment's bytes and the reviewer's
+    note would still be in there, findable with any COS tool. So the live graph
+    is garbage-collected on the way out and an incremental save is refused. A
+    qpdf-written document with ten findable secrets comes back with none of
+    them, `qpdf --check` clean and rendering unchanged.
+
+- **What fonts does this document use?** `FontRepository` answered what fonts
+  the *machine* has; nothing answered what a *document* draws with, though the
+  document knows exactly.
+  - `Document.fonts` lists them, one
+    [`DocumentFont`](src/aspose_pdf/document_fonts.py) each: the name with and
+    without its subset tag, the kind (and a composite font's descendant kind),
+    the encoding and whether it remaps codes, whether the glyphs are in the
+    file and under which key, what the program *is* and what it *costs*,
+    whether the text can be extracted, and which pages use it.
+  - The walk is the one the PDF/A, PDF/UA and PDF/X checks use, so the
+    inventory and the conformance reports cannot disagree about which fonts a
+    document has — including a font reached only through a form's default
+    resources, which is listed with no page and a *location* saying so.
+  - **Fonts are grouped, dictionaries are not.** A document that writes its own
+    `/Helv` on every page uses one font, not twenty. Two *subsets* of one
+    family stay apart, and so do two dictionaries that name one font but carry
+    different programs — folding either would hide a program.
+  - `program_bytes` is how big the program is with its filters undone;
+    `stored_bytes` is what it costs this file. They are different numbers and
+    answer different questions, so both are reported.
+  - Checked field by field against an independent pikepdf/qpdf walk of the same
+    files, ours and one qpdf wrote.
+
+- **A page can be taken from one document and put in another.**
+  `pages.insert(i, other.pages[j])` was refused outright — moving a page
+  between documents meant `extract_pages` into a scratch document, `merge` it,
+  then `move_page` it into position.
+  - `PageCollection.insert` and `PageCollection.add` now accept a `Page` of
+    another document and **import** it: the page and the graph it names —
+    resources, annotations, the fields its widgets belong to, the optional
+    content it mentions, its part of the structure tree, its label, and any
+    bookmark that pointed at it. It is the same import `Document.merge` does,
+    for one page and at a position; both now go through one
+    `Document._import_pages_from`.
+  - Checked with qpdf (`--check` clean, each page carrying its own
+    `/Resources`), pdfium and pdfminer.six, in both directions: a page out of
+    a qpdf-written file lands in ours intact, and a document we assemble this
+    way reads back correctly.
+  - Taking *every* page is still `merge`'s job, and a long run of pages is
+    cheaper through `extract_pages` plus a merge than one call each, since
+    each import walks the other document's forms, outlines and structure tree.
+
+- **A signature can now be seen.** A signature field is invisible until
+  something is drawn in it, and nothing could draw anything: `Document.sign`
+  took no appearance, and `Form.add_signature_field` authored an empty box its
+  own docstring described as such. A signed document showed no sign of being
+  signed outside a viewer's signature panel.
+  - `Document.sign(..., appearance=SignatureAppearance(...))` draws who signed,
+    when, why and where into the field's widget. The name is `signer_name`, or
+    the common name in the signing certificate when that is not given; the date
+    is the moment of the save. Any line can be turned off, labels dropped, or
+    the lot replaced with `text=` of your own.
+  - **An image** — a scanned signature, a seal, a logo — goes beside the text
+    (`image_position="left"`, `"right"`, `"top"`), behind it
+    (`"background"`), or alone (`"only"`), scaled to fit without being
+    squashed. Colours: `background`, `border_color`, `border_width`,
+    `text_color`.
+  - The size is chosen to fit the box, preferring one at which no entry wraps:
+    `Date: 2026-10-09 12:03:32 +0200` broken after the time, with the zone
+    offset alone underneath, reads worse than the same line a point smaller.
+  - **Non-Latin names work** through `font=`, which embeds a font the way
+    `Page.add_text` does. Without one, text the standard fonts cannot encode is
+    refused by name rather than drawn as the wrong letters.
+  - With no `field`, `SignatureAppearance(page=…, rect=…)` adds a visible field
+    there; an appearance with neither a field nor a rect is refused, since the
+    invisible field that would otherwise be added has nowhere to draw.
+  - **The signature covers the appearance.** It is written into the document
+    before the save serializes it, not into a later revision, so it cannot be
+    edited or lifted onto another document without breaking the signature.
+    pyHanko reports a file signed this way as `INTACT:UNTOUCHED` with
+    `coverage=ENTIRE_FILE`, and one byte changed inside the appearance as
+    `INVALID`. A signature field authored by qpdf/pikepdf and signed here comes
+    back the same way.
+
+- **A font the document only names can now be put into it.** A PDF may refer to
+  `Arial` and not carry it, and then its text draws differently wherever Arial
+  is different or absent — which PDF/A, PDF/UA and PDF/X all forbid, and which
+  no rewriting fixes, because the program is not in the file. The renderer
+  could already *draw* such a font from faces the caller made available
+  (`Document.font_substitution`); nothing could write one in.
+  - `Document.embed_fonts()` supplies it. With no arguments it covers the
+    Standard 14, Symbol and ZapfDingbats from the bundled metric-compatible
+    faces — no font source needed. `directory=` or
+    `sources=FontSubstitutionOptions(...)` (programs handed over, named
+    folders, the machine's own fonts) covers everything else, and with neither,
+    the document's own `font_substitution` is used.
+  - It returns what it could **not** supply, one message per font saying why:
+    no source answers to the name, the face's outlines are a kind that font
+    cannot carry, the font is a `CIDFontType0`, or it is a composite font whose
+    codes are not its CIDs (anything but an Identity CMap), so `/ToUnicode`
+    cannot say what to map. An empty list means every font in the document now
+    has a program.
+  - **Composite fonts too.** A `CIDFontType2` selects glyphs by index
+    (9.7.4.2), so another program's glyphs are not the ones its CIDs name: the
+    `/CIDToGIDMap` is rebuilt through `/ToUnicode` and the face's own `cmap`.
+    A document whose program was stripped and re-supplied renders
+    **pixel-identically** to the original under pdfium.
+  - The program goes under the key its kind uses and `/Subtype` is corrected to
+    match (table 122), since a TrueType program under a `/Type1` font is not an
+    embedded font at all. The document's `/Widths` and `/W` are kept, so
+    glyphs change and positions do not.
+  - `convert_to_pdfa`, `convert_to_pdfua` and `convert_to_pdfx` all run this
+    pass. PDF/UA previously embedded only the bundled Standard-14 faces and
+    ignored the document's font sources, so a named font it could have supplied
+    stayed missing.
+  - `convert_to_pdfa(font_lookup_directory=...)` searches that directory by
+    what each face **is** — the family and style in its own `name` table — not
+    by file name. It used to look for a file *called* `Arial.ttf` and attach
+    whatever was under that name: `arial.ttf` was missed, `Arial.otf` produced
+    a Type 1 key over an OpenType program, and 14 bytes of anything embedded as
+    a font program.
+  - Verified against qpdf (structure), pdfminer.six (text) and pdfium
+    (rendering), in both directions: a qpdf-written file with a named,
+    unembedded font comes back with a 50 KB `/FontFile2` that all three read.
+
+- **Resizing a page now takes its drawing with it.** `Page.size` and
+  `PdfPageEditor.resize` changed the **sheet** and left the drawing where it
+  was, so a smaller sheet cropped it and a larger one padded it. Nothing scaled
+  page content at all.
+  - `Page.resize(size, mode=…)`, `Document.resize_pages(size, mode=…, pages=…)`
+    and `PdfPageEditor.resize(..., scale_content=True)` scale the drawing onto
+    the new sheet; `Page.scale_content(factor)` scales it inside the sheet it is
+    already on, centred by default or `about="origin"`.
+  - `mode` is `"fit"`, `"fill"` or `"stretch"`; the drawing is centred and the
+    sheet keeps its own origin. The facade's default is unchanged, so nothing
+    that called it moved.
+  - **The page's operators are not rewritten**: the stream goes inside one
+    `q` ... `Q` with the matrix at the top (new
+    `content_isolation.wrap_in_force`). A stray `Q` — one with nothing to
+    restore, which a viewer ignores — would pop that very save once a `q` stands
+    in front of it, so one extra `q` is pushed per stray to consume them, and a
+    text object left open is ended first. A page that restores a state it never
+    saved cannot be wrapped without changing how it draws and is refused by
+    name.
+  - Annotations travel with the drawing: `/Rect`, `/QuadPoints`, `/Vertices`,
+    `/L`, `/CL`, each run of an `/InkList`, and `/RD`'s four distances, which
+    scale but are never shifted. A `resize` takes the crop and production boxes
+    too.
+  - Checked with pdfium: an A4 page fitted onto Letter comes out 612x792 with
+    every glyph box, its height and the link rectangle scaled by the same 0.9407
+    and shifted by the same 26 points, and our raster of the result differs from
+    pdfium's on 0.07% of samples.
+
+- **A bookmark tree from the document's headings.** `Document.outlines` could
+  be read and edited, but every bookmark had to be written by hand — and the
+  heading model needed to generate them had been computed for the HTML and
+  Markdown exports all along, just without a position to point at.
+  - `Document.generate_outlines()` makes an `OutlineItem` per heading, nested by
+    level. A **tagged** document is read from its structure tree (`/H1`..`/H6`,
+    or `/H` with the section nesting giving the level, `/RoleMap` followed) —
+    the author's own answer; an untagged one from the same size tiers `auto_tag`
+    infers, which is a heuristic and labelled one. `prefer_structure=False`
+    reads the pages either way.
+  - **Each bookmark lands on the heading, not on the top of its page.** The
+    place comes from the marked-content sequence the element owns — new
+    `auto_tag.mcid_spans` bounds it by byte range and the text objects inside
+    carry the coordinates — or from the inferred block's own anchor, which
+    `Block` now records. Written as `/XYZ` with the reader's magnification kept.
+  - Levels nest with skips: an `H3` after an `H1` becomes its child, not its
+    sibling. `max_level`, `open_to_level`, `replace=False` and `zoom=` adjust
+    the rest. It returns how many it made, and zero is the honest answer for a
+    document of uniform body text.
+  - Verified against qpdf's own outline reader — nesting, titles, each `/XYZ`
+    resolving to the right page and coordinate, the open state in the sign of
+    `/Count` — and the tree reads back identically after a qpdf rewrite.
+  - `OutlineItem` and `OutlineCollection` are now exported from `aspose_pdf`:
+    `Document.outlines` handed them out while a caller could not construct one
+    without reaching into the submodule.
+
+- **Permissions have names.** `/P` is a signed 32-bit integer whose unused bits
+  are all 1, so "everything allowed" is `-4` and "nothing allowed" is `-3904`,
+  and `Permissions.PRINT | Permissions.COPY` as plain integers is `20` — a `/P`
+  with every reserved bit cleared, which ISO 32000-1 Table 22 does not allow.
+  Every permission argument in the package took one of those numbers.
+  - `Permissions` (exported from `aspose_pdf`) is that integer with the names
+    attached. It **is** an `int` subclass, so `Document.permissions` still
+    compares, masks, hashes and passes anywhere the raw value did — the whole
+    suite passed unchanged — while `can_copy`, `allowed`, `denied`, `to_dict()`
+    and `repr` say what it means.
+  - `Permissions.all()`, `none()`, `allowing(...)`, `denying(...)`, `with_(...)`
+    and `without(...)` keep the reserved bits right. Flags are names or the
+    eight class constants; a number carrying any bit outside Table 22's eight is
+    refused rather than ORed in.
+  - Taken by `Document.encrypt`, `change_passwords`, `encrypt_for_recipients`,
+    `Recipient`, `PdfFileSecurity.encrypt_file`/`change_password` and the
+    low-code `EncryptOptions`; a raw integer still works everywhere.
+  - **Bit 12 qualifies bit 3**, which cross-checking against qpdf is what
+    showed: `print_high_resolution` granted while `print` is clear is a document
+    nobody may print, and qpdf reads it that way. The value is written as asked
+    rather than silently corrected, and `can_print_faithfully` asks for both.
+  - Verified flag for flag: a file granting exactly one permission is read by
+    qpdf's own `Pdf.allow` as granting exactly that one, for all eight; and a
+    `/P` qpdf wrote reads back here by name with no bit forced or cleared
+    (`tests/fixtures_permissions_qpdf_no_copy.pdf`).
+  - The public-key handler's word is **not** `/P`, which is why
+    `encrypt_for_recipients` defaults to `-1` where `encrypt` defaults to `-4`.
+    The two differ because the two words do, not because either is wrong; the
+    eight permissions sit at the same bit positions in both.
+
+- **Lists, authored.** The nested structure a list needs — `/L` of `/LI` of
+  `/Lbl` and `/LBody` — had been in the engine since `auto_tag` learned to
+  *recognise* one, but only for re-tagging content that was already on the page.
+  Writing a list meant placing every bullet and every line by hand.
+  - `Page.add_list(text_list, x, y)` takes a `TextList` of `ListItem`s: a marker
+    in a gutter, a body wrapped to the measure, sub-items a step further in.
+    `markers` cycles `•`, `–`, `·` by depth; an ordered list's `numbering`
+    cycles `decimal`, `lower-alpha`, `lower-roman`, each sub-list restarting its
+    own count, with Roman and alphabetic numbering going past the first round
+    (`z` then `aa`). `number_format`, `start` and a per-item `label` say
+    otherwise, `label=""` for an item with no marker at all.
+  - Markers are **right-aligned against the body**, so `9.` and `10.` line up on
+    their dots. pdfium reads every marker of a ten-item list as ending on one
+    edge and every body as starting on another.
+  - A list taller than the room left continues onto the next page, and an item's
+    marker always lands on the page its first line does — it rides that line.
+  - The `/L` carries the `/ListNumbering` of ISO 32000-1 Table 345 where the
+    markers have a standard name, so a reader that cannot see the glyphs knows
+    an ordered list from an unordered one; a marker no value describes writes no
+    attribute rather than the wrong one. A sub-list goes inside its parent
+    item's `/LBody`, where the standard puts it. A list continued onto the next
+    page **stays one list**, its far ids named with marked-content references.
+    A tagged list passes `convert_to_pdfua()` + `validate_pdfua()` with no
+    warnings and `convert_to_pdfa("2a")`.
+  - `engine/lists.py` reuses `text_faces` for the measuring and `text_blocks`
+    for the line objects and the line emitter, so a list, a text block and a
+    table place their baselines the same way and line up when set in sequence.
+
+- **Decoration now says it is decoration (`/Artifact`).** ISO 14289-1 7.1 has
+  every mark on a page of a tagged document be either tagged as real content or
+  marked as an artifact, and nothing this package authored said the second: a
+  perfectly tagged document stopped being conformant the moment it was stamped,
+  and `validate_pdfua()` reported it as valid with no warnings.
+  - `TextStamp`, `ImageStamp` and `PageStamp` are `/Pagination` artifacts with
+    `/Subtype /Watermark` by default; a `PageNumberStamp` is a `/Header` or a
+    `/Footer` when its alignment puts it at the top or the bottom of the sheet,
+    with the matching `/Attached` — read off what the caller already said rather
+    than guessed. Each carries the `/BBox` of where it landed on that page, all
+    four corners of a rotated stamp included. `artifact=False` puts a stamp on as
+    bare content; `artifact_type`/`artifact_subtype` override the defaults.
+  - Redaction bars became a `/Layout` artifact whose `/BBox` is what the bars
+    cover.
+  - **Imposition was deliberately left alone** even though `n_up` and `booklet`
+    place their pages through the same code as a stamp: an imposed page is the
+    sheet's real content and has to stay taggable. The decision moved to the
+    caller rather than living in the placement.
+  - `Page.add_text`, `add_image`, `draw_rectangle`, `draw_line` and `draw_path`
+    take `artifact=True`, or `artifact="Pagination"`/`"Layout"`/`"Page"`, so a
+    rule or a running head drawn by hand can say what it is. Asking for an
+    artifact *and* a tag is refused.
+  - `validate_pdfua()` now scans each page of a tagged document for marks that no
+    marked-content sequence encloses and names the page and the operators. A `Do`
+    invoking a **form** is followed rather than flagged, because a form may cover
+    its own content. Reported as warnings: the scan reads operators, and
+    `convert_to_pdfua()` offers a shell-only conversion whose content is untagged
+    by design.
+  - qpdf's own content parser resolves every property list written this way, and
+    pdfium renders a marked page and an unmarked one pixel for pixel the same.
+
+- **Regular expressions in `replace_text` and `redact_text`.** Searching
+  already understood patterns — `TextFragmentAbsorber` with
+  `TextSearchOptions(is_regular_expression=True)` — while editing took a literal
+  phrase only, so the one thing redaction is most wanted for, removing a *shape*
+  rather than a phrase, could not be asked for: `page.redact_text(r"\d{3}-\d{2}-\d{4}")`
+  found nothing and returned 0.
+  - `regex=True`, or a compiled `re.Pattern` as the search (which needs no
+    flag), on `Document.replace_text`, `Document.redact_text`,
+    `Page.replace_text` and `Page.redact_text`.
+  - With a pattern the replacement is a **template**: `\1` and `\g<name>`
+    expand to what *each* match captured, as `re.sub` defines them. A literal
+    search keeps its replacement verbatim, backslashes and all.
+  - A pattern reaches across `TJ` elements and consecutive show operators,
+    because it is matched against the same logical run a literal phrase is; `^`
+    and `$` anchor to that run. A pattern matching the empty string is ignored.
+    A pattern that will not compile, and a template naming a group that is not
+    there, are reported as `PdfValidationException`.
+  - The redaction **overlay bars** came along for free: the locator shares the
+    editor's span alignment, so a pattern's bars land exactly where the
+    equivalent literal's would. Verified three ways — pikepdf/qpdf finds the
+    redacted numbers in neither the decoded streams nor the raw file bytes,
+    pdfminer.six and pdfium both read the text with them gone, and pdfium's
+    raster shows a solid bar over where the digits were.
+
+- **Flowing text.** Authored text could only be placed one string at a time at
+  one point. Wrapping it meant measuring the font yourself, or passing
+  `layout=TextLayoutOptions(...)` to `Page.add_text` — which shapes with
+  HarfBuzz and so refuses the Standard-14 fonts and needs the `text-layout`
+  extra. The plain case had no API at all, although the measuring it needs was
+  already written: the table generator has used the Standard-14 advances and an
+  embedded subset's CID widths since it landed.
+  - `Page.add_text_block(block, x, y)` takes a `TextBlock` of `Paragraph`s and
+    wraps each to the block's `width`, or to the room between *x* and the right
+    edge of the page. A plain string is one paragraph and a blank line starts a
+    new one; a single newline stays a hard break. Per paragraph: alignment,
+    font, size, colour, line height, space before and after, first-line indent
+    (negative for a hanging one), left and right indent, structure tag, and
+    `keep_together`.
+  - **Justification**, which is the part that needed thought. A justified line
+    is spread to the measure exactly — pdfium reads every one as ending on it to
+    the hundredth of a point — and the last line of a paragraph, the line before
+    every hard break, and a line of one word are all left alone. A simple font
+    is spread with `Tw`, a composite one with `TJ` adjustments, because
+    ISO 32000-1 9.3.3 says word spacing "shall not apply" to a two-byte code: an
+    Identity-encoded Type0 font ignores `Tw` entirely and the line would come
+    out unjustified.
+  - A block taller than the room left continues onto the next page, adding a
+    page like the one it is leaving when there is none. A paragraph continued
+    across pages stays **one** structure element, with the ids on the other
+    pages named as marked-content references (14.7.4.3) rather than the
+    paragraph being split into one `/P` per page — which would tell a reader the
+    sentence ended at the foot of the page. A tagged block passes
+    `convert_to_pdfua()` + `validate_pdfua()` and `convert_to_pdfa("2a")`.
+  - The faces the measuring runs on moved out of the table engine into
+    `engine.text_faces`, so a table and a block measure with the same code and
+    place their baselines the same way; the two line up when set one after the
+    other.
+
+- **PDF/X.** The print-exchange standards had no support at all: a document
+  could be checked and converted for PDF/A and PDF/UA, but the one standard
+  family that is about a file *printing* the same way everywhere was missing, so
+  preparing artwork for a press meant assembling the output intent, the
+  identification keys and the trim geometry by hand.
+  - `Document.validate_pdfx(standard)`, `Document.is_pdfx_compliant(standard)`
+    and `Document.convert_to_pdfx(standard, ...)`, with `PdfXStandard`,
+    `PdfXValidationResult`, `PdfXValidateOptions` and `PdfXValidator` in
+    `aspose_pdf.pdfx` mirroring the PDF/A and PDF/UA shapes. Five levels:
+    `PDF/X-1a:2001`, `PDF/X-1a:2003`, `PDF/X-3:2002`, `PDF/X-3:2003`, `PDF/X-4`.
+  - Checked: the identification keys, one `/GTS_PDFX` output intent with an
+    embedded ICC profile whose colour space suits the part, font embedding,
+    `/TrimBox`-or-`/ArtBox` with bleed and media containment, `/Trapped` saying
+    True or False, encryption, prohibited actions and annotations, transfer
+    functions, and — per part — transparency, optional content, JPEG 2000,
+    JBIG2, LZW, alternate images and device-independent colour.
+  - **The identification is a different shape in each part**, and the conversion
+    writes each part's own. Parts 1 to 3 use the information dictionary plus the
+    `pdfx` XMP schema; ISO 15930-1 omits the conformance letter from its version
+    string (`PDF/X-1:2001` with `PDF/X-1a:2001` as the conformance). PDF/X-4
+    identifies itself in XMP alone under the separate PDF/X ID schema
+    (`pdfxid`), and converting to it removes the legacy Info keys. `exiftool`
+    and `qpdf` read all five back as written.
+  - **The conversion does not invent a printing condition.** The output intent
+    is the promise a PDF/X file makes about the press, so without an
+    `icc_profile=` and without a usable one already in the document the
+    requirement is *returned* rather than a profile nobody chose being embedded
+    — the position already taken on a font whose program is not in the file.
+    Parts 3 and 4 fall back to the bundled sRGB profile, a real registered
+    characterization; PDF/X-1a admits no RGB intent and needs a CMYK profile.
+    Colour is never converted either.
+  - The header version is deliberately **not** a conformance rule here:
+    ISO 15930-4 clause 5 says the header shall not be used to decide it. The
+    conversion still raises the header to the part's own version, never lowers
+    it.
+  - No free validator covers PDF/X — veraPDF does not — so unlike every PDF/A
+    level this library produces, these rules are not corroborated by a reference
+    implementation. They were cross-checked with `qpdf`/`pikepdf` and `exiftool`
+    in both directions, and `supported-features.md` says so in those words.
+
+- **Tables.** There was no table API at all — no `Table`, no `Row`, no `Cell` —
+  so a report meant placing every string and every line by hand, measuring the
+  text first to know where the next one goes. The two pieces that makes hard were
+  already written and need no optional dependency: the Standard-14 advances in
+  `engine.std_metrics` and an embedded font's CID widths.
+  - `Page.add_table(table, x, y)` draws one: column widths or equal columns,
+    column spans, text wrapped to each column (newlines hard-break, long words
+    break rather than overflow), rows that grow to hold their lines, and style
+    falling back cell → row → table — fonts, sizes, colours, padding, both
+    alignments, borders, backgrounds, and a separate set for header rows.
+  - A table taller than the room left **continues onto the next page**, repeating
+    the header rows and adding a page like the one it is leaving when there is
+    none to continue onto. It returns where it ended, so the next thing on the
+    page knows where to go.
+  - The structure is tagged as it is drawn: a nested `/Table` of `/TR` of `/TH`
+    and `/TD` (14.8.4.3), each cell owning its marked-content sequence. A tagged
+    table passes `convert_to_pdfua()` + `validate_pdfua()` and
+    `convert_to_pdfa("2a")`, both of which require tagging; `tag=False` turns it
+    off.
+  - `font=` sets a whole table in an embedded Unicode font. A subset font grows as
+    it is *encoded*, so measuring from a width table taken before the text was
+    encoded answered zero for every character — the text is encoded first now,
+    and the table re-read when a CID is missing from it.
+
+- **The facade layer, from two classes to ten.** `PdfExtractor` and
+  `PdfFileEditor` were the whole of it, so ported code that reached for
+  `PdfFileInfo`, `PdfFileSecurity`, `PdfBookmarkEditor`, `PdfAnnotationEditor`,
+  `PdfFileStamp`, `PdfPageEditor`, `PdfXmpMetadata` or `PdfConverter` had to be
+  rewritten against `Document` by hand — which is the one thing a compatibility
+  surface exists to avoid.
+  - They add no capability: each is a composition of operations documented
+    elsewhere. What they add is the shape, and three habits of the layer: page
+    numbers are **1-based** (as in the Aspose facades, and as
+    `PdfFileEditor.extract` already was), a writing operation answers `True` or
+    `False` and records why in `last_exception`, and `bind_pdf` takes a path,
+    bytes, a stream or an **open `Document`** — which is borrowed, not taken over,
+    so the facade does not close a document the caller is still holding.
+  - `PdfFileStamp.add_header`/`add_footer`/`add_page_number` are running heads
+    built on the stamp placement, and `PdfPageEditor.move_page` reorders pages,
+    which needed the page sizes and boxes of an earlier change to be settable at
+    all.
+  - `PdfXmpMetadata.get_value` reads a **language alternative** — which is what
+    `dc:title` and `dc:description` are — as its default text rather than as the
+    array it is written as, with the field itself one line away through `packet`.
+
+- **A page can be placed on a page, and a document can be imposed.** Stamps drew
+  a line of text, an image or a page number; the one thing nobody could stamp was
+  a *page* — a letterhead, a background form, a watermark drawn in a PDF — even
+  though both pieces it takes were already there: the deep object copy a merge
+  makes, and the form-XObject placement every stamp goes through. Without it there
+  was no imposition either, so four pages could not be put on a sheet and a
+  document could not be laid out as a folded booklet.
+  - `PageStamp(page)` places a page as a reader shows it — its crop box, with its
+    `/Rotate` applied, which for a quarter turn swaps the form's width and height
+    — and imports everything it draws with, so the source document may be closed
+    straight afterwards. Every placement option applies, `background=True`
+    included, which is what a letterhead wants, and `opacity` goes into an
+    `/ExtGState` inside the form.
+  - `Document.n_up(rows, columns, …)` and `Document.booklet(…)` return a new
+    imposed document; `PdfFileEditor.make_n_up()` and `make_booklet()` are the
+    same two over files. Pages are scaled to fit their cell proportionally and
+    centred, the import memo is shared so a common font is copied once, and
+    nothing is rotated behind the caller's back — a landscape sheet is asked for
+    by passing one.
+  - `TextStamp(font=…)` sets a stamp in an **embedded Unicode font**, through the
+    same subset Type0/CID path page text uses, so a stamp can say what the
+    standard fonts' encodings have no codes for. `font_name` is then not checked
+    against the fourteen, since the face comes from the font.
+  - Checked with qpdf 12.4.2: a 4-up sheet carries four form XObjects whose BBox
+    is the source page's size, each invoked under its own scale-and-translate; a
+    booklet of six pages is four sheets of two A5 pages side by side, two of them
+    half empty; and a stamped page's `/Contents` becomes an array with the
+    background stamp first. poppler renders all of it, and the imported
+    letterhead's colours come out pixel-identical to ours.
+
+- **How a form field looks, and what a field, a page or the document does.** Two
+  holes, both on the authoring side. A field could be created but not styled:
+  `/MK` was written with a hardcoded black border and a white background, `/BS`
+  with a width of 1, the `/DA` colour was always black, and `border_color` and
+  `background` reached the widget of a **push button** only — while the appearance
+  generator had read `/MK /BC` and `/MK /BG` all along, so the drawing side was
+  waiting for entries nothing could set. And there were no actions anywhere: not a
+  field's `/AA` (the keystroke, format, validate and calculate scripts that make a
+  form compute), not a page's, not the catalog's, and not the document-level
+  scripts of `/Names /JavaScript` where the functions those call are defined.
+  `JavaScriptAction` existed with nowhere to put one but a link.
+  - Every factory now takes `border_color`, `background_color`, `border_width`,
+    `border_style`, `rotation` and `text_color`, and a `Field` has each as a
+    property plus `font_size` and `set_appearance(**options)`. Setting one entry
+    leaves the others alone; `None` removes one. A `font_size` of 0 is auto-size
+    (12.7.3.3), which the appearance generator already resolved.
+  - `Field.actions`, `Page.actions` and `Document.actions` are mappings of trigger
+    to action. `keystroke`, `format`, `validate` and `calculate` are written on the
+    **field** and the pointer and focus triggers on the **widget** — which is
+    where a viewer looks for each — and a trigger the owner does not have is
+    refused, since a viewer never fires one and the mistake would otherwise be
+    invisible.
+  - `Document.javascript` is the document-level script tree. It is written sorted,
+    because a viewer runs the scripts in key order, and each script goes **into**
+    the tree as a direct dictionary: an indirect action would stay in the file as
+    an orphan when the script was removed, with its source still readable.
+  - Checked with qpdf 12.4.2: `/DA` carries the size and the colour, `/AA /V` is on
+    the field and `/AA /U` on the widget, `/MK` holds `/BC`, `/BG` and `/R`, `/BS`
+    holds `/W` and `/S`, the page and catalog `/AA` are where the tables put them,
+    and the script tree is in key order.
+
+- **An annotation class per subtype, and the comment threads the property channel
+  could not carry.** Reading and writing annotations worked — every entry
+  travelled through `Annotation.properties`, which is what preserves subtypes this
+  API has no class for — but a caller had to know the standard's spellings
+  (`/IC`, `/QuadPoints`, `/Vertices`, `/InkList`, `/L`, `/LE`, `/CA`, `/BS`) and
+  get the corner order of a quadrilateral right by hand.
+  - `TextAnnotation`, `FreeTextAnnotation`, `SquareAnnotation`,
+    `CircleAnnotation`, `LineAnnotation`, `PolygonAnnotation`,
+    `PolyLineAnnotation`, `InkAnnotation`, the four text markups,
+    `StampAnnotation`, `FileAttachmentAnnotation`, `RedactAnnotation` and
+    `PopupAnnotation` name those entries. The typed properties *are* the property
+    channel — `square.interior_color` and `square.get_property("IC")` are the same
+    entry — and a subtype with no class of its own is still read as it was.
+  - Shared markup entries: `opacity`, `subject`, `creation_date`, `modified`, and
+    `border_width`/`border_style`/`border_dash`, which edit one `/BS` dictionary
+    entry at a time instead of replacing it.
+  - A factory per subtype, each computing a `/Rect` that holds what the annotation
+    draws (12.5.2) with room for the stroke and the line endings, and
+    `quad_from_rect` writing the corner order viewers expect (12.5.6.10) — the
+    order whose classic mistake draws a highlight as a bow tie. A single rectangle
+    handed to a text-markup factory is taken as the one quad it describes.
+  - **Replies and popups**: `annotation.reply(...)` writes `/IRT` and
+    `/RT /Reply`, `replies` and `in_reply_to` read the thread, and `add_popup()`
+    links a window **both ways** (`/Parent` and `/Popup`), since one without the
+    other leaves a window a viewer cannot associate with anything. These are
+    references between annotations, which the property channel drops on purpose,
+    so there had been no way to thread a comment at all.
+  - `Annotation.color` reads the same forms every other colour in the package
+    does: 1/3/4 components, a `"#rrggbb"` string, or an `aspose_pdf.Color`.
+  - Checked with qpdf 12.4.2: a reply's `/IRT` is the same object as the
+    annotation it answers, a popup and its annotation point at each other, and
+    `/BS`, `/CA`, `/IC`, `/QuadPoints` and `/LE` are written as the tables type
+    them.
+
+- **Paths, the stroke state, transparency and clipping, on the authoring side.**
+  A page could be given exactly two things: an axis-aligned rectangle and a
+  straight line. No curve, no circle, no polygon, no dash, no line cap or join,
+  no transparency, and no way to turn, scale or clip anything — while the
+  *renderer* had always drawn all of it, because that is what reading a PDF
+  means. `IPath` sat in the "Known Unsupported" table for exactly this reason:
+  there was nothing for a path to be drawn with.
+  - `GraphicsPath` collects the subpaths of ISO 32000-1 8.5.2 — `move_to`,
+    `line_to`, `curve_to`, `quadratic_to`, `close`, `rect`, `ellipse`, `circle`,
+    `polygon`, `polyline` — and the builders chain. A segment that continues a
+    subpath is refused on a path that has not been started, rather than writing an
+    operator with nothing to draw from.
+  - `Page.draw_path()` paints one: either fill rule, `line_width`, `line_cap`,
+    `line_join`, `miter_limit`, `dash` (a pattern or `(pattern, phase)`),
+    `opacity`/`fill_opacity`/`stroke_opacity`, `blend_mode`, and a `transform`.
+    The alpha and blend go into an `/ExtGState` that is **reused** when the page
+    already carries the same one, instead of one dictionary per drawing.
+  - `with page.graphics(transform=..., clip=..., opacity=...)` holds a state over
+    everything appended inside it — **text and images included**, which is how
+    either of those is turned, scaled or faded — and clips to a path with `W n`.
+    Sections nest, and the state is undone at the end.
+  - `draw_rectangle` and `draw_line` take all of the same options now, each being
+    one path; a plain rectangle or line still writes byte for byte what it wrote
+    before.
+  - `IPath` is no longer a placeholder and leaves the unsupported table: it
+    collects segments and `draw_path` draws it, reading its own `fill_mode` and
+    `transform` for whichever the call does not give.
+  - Checked against poppler 26.09 at 288 dpi — curves, dashes, caps, joins,
+    even-odd fills, transforms, clips, alpha and blend modes all render
+    pixel-identical (0–4 levels of 255). At 72 dpi a one-point hairline's
+    antialiasing differs between any two rasterizers, the *undashed* reference
+    case included, so the comparison is made where the geometry is what is being
+    measured.
+
+- **Named destinations, and the two bookmark entries that go with them.** The
+  engine resolved these names on the way *in* all along — a bookmark written by
+  name already reported the right page — but nothing could list, add, repoint or
+  remove one, so the indirection that keeps a link valid when its target moves
+  was unreachable.
+  - `Document.destinations` is a mapping of name to destination. It reads both
+    places a PDF keeps them (the `/Names /Dests` tree and the older `/Dests`
+    dictionary), types each value where this API has a class for it, and lists an
+    entry it cannot type rather than hiding it. Assigning takes a `Destination` or
+    a page index; a page the document does not have is refused rather than
+    clamped.
+  - A write edits **one** name. The tree is rewritten as a single ordered node,
+    because a name tree must stay sorted by key, and every other value is carried
+    over as the same object it already was — so an entry this API cannot express
+    comes through untouched. A name already defined in the older dictionary is
+    updated there instead of being duplicated into the tree; a removal clears
+    both places.
+  - A **name is now a target** wherever a typed destination is:
+    `page.add_link(rect, "chapter-2")`, `OutlineItem(destination="chapter-2")` and
+    `Document.open_action = "chapter-2"`. `OutlineItem.destination_name` reads it
+    back. Repointing the name moves every reference to it at once.
+  - `OutlineItem.color` is the bookmark's `/C` title colour (three DeviceRGB
+    numbers, as Table 153 types it) and `OutlineItem.open` its unfolded state,
+    written as the **sign of `/Count`** with the magnitude Table 153 asks for:
+    every row opening the item would show, counting what an already-open child
+    unfolds in turn. The outline root's `/Count` is now that same total rather
+    than the number of top-level items, which was only right while everything was
+    closed — which, before this, it always was.
+  - Checked against qpdf 12.4.2: the tree it reads back is sorted and every value
+    resolves to a page, its own outline API resolves a bookmark's name, and a file
+    qpdf has rewritten still reads here with its names, colours and open states
+    intact.
+
+- **The low-code plugin catalogue, from four workflows to fourteen.**
+  `aspose_pdf.lowcode` shipped `Merger`, `Splitter`, `Optimizer` and
+  `TextExtractor` — while its own `Plugin` enum already named `EXTRACTOR`,
+  `CONVERTER`, `GENERATOR` and `EDITOR`, with no class behind any of the four. A
+  batch job that rotates a scan, drops a page, stamps a draft mark or turns pages
+  into PNGs had to be written against `Document` by hand, data sources and all.
+  - New plugins, each a composition of operations that already existed:
+    `ImageExtractor` (one result per embedded image, as a real image file),
+    `ImagesToPdf` (JPEG/PNG in, one page per image, each page cut to its picture
+    at a given dpi or fitted inside a named page size), `Converter` (HTML,
+    Markdown, SVG, TIFF, PNG, JPEG — one result per input for the first and the
+    fourth, one per page for the others), `PdfAConverter`, `Rotator`,
+    `PageRemover`, `Stamper`, `FormFlattener`, `Encryptor` and `Decryptor`.
+  - `Splitter` grew **selections**: `SplitOptions(selections=[range(0, 3), [3, 4],
+    slice(5, None)])` emits one document per selection instead of one per page.
+    Each entry is what `Document.extract_pages` takes, a slice is resolved against
+    the input's own length, and a selection naming a page the document does not
+    have is refused rather than trimmed.
+  - `Document.to_tiff()` returns the bytes of a multi-page TIFF, which only
+    `save_as_tiff()` could produce before — every other export had both forms, and
+    the plugin layer works in bytes.
+  - `PageSize` equality now compares the pair as a file holds it (six decimal
+    places, ISO 32000-1 7.3.3), so `page.size == PageSize.A4` is true for a
+    document that has been saved and reloaded. It was false by half a nanometre.
+  - Checked against qpdf 12.4.2 and poppler 26.09: an images-to-PDF file is two A4
+    pages carrying one image XObject each, the PNG kept as Flate and the JPEG
+    passed through as `/DCTDecode` without re-encoding; an encrypted result needs
+    its password in qpdf's eyes too; and Pillow reads the multi-page TIFF as three
+    Deflate frames.
+
+- **Authored colour is grey, RGB or CMYK, by one rule everywhere a colour is
+  taken.** `Page.add_text`, `draw_rectangle` and `draw_line` went through
+  `normalize_rgb`, which refused anything that was not exactly three components:
+  `fill_color=(0, 0.2, 1, 0.05)` raised "RGB color must contain exactly three
+  channels", so a page could not be painted in ink or in grey. Every other part
+  of the package already read 1/3/4 components — a stamp's colour, an
+  annotation's `/C` and `/IC`, a field's `/MK` background — which left the page
+  authoring API as the one place a print workflow could not use.
+  - One component now writes `g`/`G`, three `rg`/`RG`, four `k`/`K` (ISO 32000-1
+    8.6.8: the three device spaces a content stream can set without naming a
+    colour space first). qpdf 12.4.2 parses the operators and operands back, and
+    poppler 26.09 renders grey and RGB to the same pixel we do.
+  - Every colour argument — `color`, `stroke_color`, `fill_color`, a stamp's
+    `color`, `redact_text(overlay_color=)` — reads a component sequence, a single
+    number for grey, a `"#rgb"`/`"#rrggbb"` string, or an `aspose_pdf.Color`.
+  - `Color` became a usable value object instead of a shell with an `r` property
+    and no `g` or `b`: `Color.gray`, `Color.rgb`, `Color.cmyk`, `Color.from_hex`,
+    `components`, `color_space`, equality and a repr, exported from `aspose_pdf`
+    and from `aspose_pdf.drawing`. The ported `Color(pattern, r, g, b)`
+    constructor still builds an RGB colour. A `Color` carrying a
+    `GradientAxialShading` raises `UnsupportedFeatureException` when asked for
+    components — there is no shading-pattern writer for it to feed.
+  - Grey and RGB channels may be 0..1 or 0..255, which is what `Page.add_text`
+    already accepted; **a stamp's colour now takes that scale too** rather than
+    refusing anything above 1. CMYK is 0..1 only: a percentage and an 8-bit value
+    cannot be told apart from a fraction, so `(0, 20, 100, 10)` is refused with a
+    message saying why instead of being divided by 255.
+  - A **redaction bar** takes an ink as well, and a colour it cannot read is now
+    refused instead of quietly drawn black — the bar is what makes the removal
+    visible, so the wrong colour is worse than an error.
+
+- **A page can be created at any size, and every one of its five boxes can be
+  read and set.** A new page was 612x792 and nothing else: `pages.add()` took no
+  size, `Page.media_box` was a read-only alias of `rect`, and of the five boxes
+  ISO 32000-1 Table 30 defines only `/CropBox` was reachable — a document of A4
+  pages, or a page carrying the trim and bleed a print shop asks for, could not
+  be authored at all.
+  - `PageSize` carries the ISO A sizes `A0`-`A6`, the ISO B sizes `B4`/`B5` and
+    the US `LETTER`, `LEGAL`, `TABLOID`, `LEDGER`, `EXECUTIVE` and `STATEMENT`,
+    with `landscape()`, `portrait()`, `rotated()`, `scaled()`, `as_rect(x, y)`,
+    `from_mm()`, `from_inches()` and `by_name()` for the ones not listed. The ISO
+    sizes are exact conversions from millimetres, so A4 is
+    595.275591 x 841.889764 pt rather than a printer's rounding of it.
+  - `pages.add(PageSize.A4)`, `pages.add(size="legal")` and
+    `pages.insert(0, size=(300, 400))` create a page of that size; without one a
+    blank page is still US Letter. A size given twice, or alongside a page to
+    copy, is refused rather than one of the two being quietly dropped.
+  - `Page.media_box` and `Page.size` now set the sheet. `size` takes a
+    `PageSize`, a name or a `(width, height)` pair and resizes from the existing
+    origin, so content keeps the coordinates it was authored at. The value
+    reaches both places a size is held — the page list the renderer measures and
+    the `/MediaBox` a save writes — so a resized page renders and reopens at its
+    new size, and it is written on the page, overriding a `/MediaBox` inherited
+    from a page-tree node without touching the other pages under it.
+  - `Page.bleed_box`, `Page.trim_box` and `Page.art_box` read and set the
+    production boxes of 14.11.2. Each reports the box in effect: the stated entry
+    intersected with the media box, since none of the three "shall ordinarily
+    extend beyond" the sheet, or the crop box they default to where the page
+    states nothing usable. The entry written to the file is the one that was set,
+    unclipped, exactly as `/CropBox` is written, and assigning `None` removes it.
+    The three are **not inheritable**, so a `/TrimBox` on a page-tree node is not
+    the page's trim box.
+  - `Page.get_box(boundary)` / `Page.set_box(boundary, rect)` take the
+    `PageBoundary` that `/ViewArea` and `/PrintArea` are written with, so code
+    holding one can ask the page for the geometry it names.
+  - The media box is the one box that must have an area and cannot be removed: an
+    empty one is replaced with US Letter when read, so accepting one when written
+    would make the assignment look as though it had never happened. The other
+    four may be written as given, since a reader intersects them and falls back.
+
+### Fixed
+
+- **Five annotation subtypes could be given an appearance and nothing said so.**
+  `Annotation.generate_appearance` builds one for fifteen subtypes;
+  its docstring named ten, omitting `FreeText`, `Stamp`, `Caret`, `Text` and
+  `FileAttachment`, and `supported-features.md` omitted the last two. A
+  docstring listing ten of fifteen is worse than one listing none — it reads as
+  a complete answer. All three lists now agree, and a test holds them to each
+  other and to what the code actually produces, since this is drift that
+  returns.
+
+- **Appending a page from another document silently corrupted it.**
+  `pages.insert` refused a foreign page, but `pages.add` accepted one and
+  copied the page dictionary alone. The content kept naming `/F1` while the
+  page carried no `/Resources` of its own, so the name resolved to the
+  **target's** `/F1` — text written in Courier-Bold came out in whatever font
+  the target happened to have under that name, with no error anywhere. pdfium
+  rendered it; only the wrong letterforms showed it. `add` now takes the same
+  import as `insert`, so the page brings its own resources.
+
+- **An embedded composite font failed our own PDF/A and PDF/X font checks.**
+  Both looked for `/FontDescriptor` on the top-level font dictionary, where a
+  `Type0` font legitimately has none — table 121 does not give it one, and
+  9.7.4 puts it on the descendant along with the program. Every CID-font
+  document was therefore reported as `missing FontDescriptor`, embedded or not,
+  and could not be made to validate. Both now follow `/DescendantFonts`, and
+  judge the program by the key its kind uses (table 126: `/FontFile3` for a
+  `CIDFontType0`, `/FontFile2` or `/FontFile3` for a `CIDFontType2`). A
+  composite font that really carries no program now reads as *not embedded*
+  rather than as missing a descriptor. The PDF/UA check already did this
+  correctly and is unchanged.
+
+- **A section holding a graphics state open could not survive the next append.**
+  Found while building the above: content isolation saves and restores what a
+  page's existing content leaves behind, so appending an unbalanced `q` on its own
+  had its `Q` inserted before the very next fragment — the text meant to be inside
+  a rotated section landed outside it, and the page's stream ended up unbalanced
+  (poppler: "Restoring state when no valid states to pop"). A section now collects
+  what is drawn inside it and appends the whole thing as one balanced fragment,
+  which leaves isolation doing exactly what it did before.
+
+- **`Form.flatten` said it flattened "all fields in the form".** It is
+  `Document.flatten`: a page's annotations are baked in with the fields, because
+  flattening is one operation in the engine and not two. The docstring now says
+  so, rather than suggesting a fields-only form of it that nothing implements.
+
+- **A pattern used inside a form XObject was anchored to the page.** ISO 32000-1
+  8.7.3.1 maps pattern space to the default coordinate space of the content
+  stream the pattern is *used in*, so a form's matrix is part of it. A tiling
+  pattern filled inside a form drawn at `1 0 0 1 5 5 cm` laid its tiles from the
+  page's origin and then clipped them to the form's box: the first column of
+  every row came out five units narrow and the rest sat five units off. MuPDF and
+  pdfium place the tiles from the form's origin and agree to the pixel; so do we
+  now, and so does a **shading** pattern, which was anchored the same wrong way.
+  A pattern used inside a pattern cell is anchored to the cell, one level further
+  in, as the same clause says. The CTM in force at the moment of the fill still
+  does not move the tiles.
+
+- **A form XObject's text ran into the page's own with no separator at all.**
+  Headers, footers, stamps and anything a layout tool reuses live in form
+  XObjects, and their text is placed by a matrix of their own — so after reading
+  one the extractor said "nothing has been shown yet", and the next string on the
+  page got no separator: `inside a form` and `on the page` came out as
+  `inside a formon the page`. A form's text is now a line of its own, whichever
+  side of the page's text it is drawn on.
+
+- **A text-positioning move that did not advance along the line produced a
+  space.** Two strings at the same position are stacked, not side by side, so
+  `under` drawn over `OVER` read as `under OVER`; `T*` with the default zero
+  leading and a plain `0 0 Td` did the same. A move that goes back to where the
+  last string started, or behind it, starts a new line, which is what MuPDF and
+  poppler both answer. Horizontal position is tracked for this, and `BT` resets
+  it as ISO 32000-1 9.4.1 requires — a `Td` in a new text object used to count
+  from wherever the previous one had left the pen, which could put a string to
+  the right of one that is in fact to its left.
+
+- **A damaged bookmark tree took the whole document with it.** Four shapes of
+  damage refused to open at all: an `/Outlines` object that would not tokenise,
+  an outline list whose `/First` pointed at an object that is not there (which
+  ISO 32000-1 7.3.10 defines as a reference to null, not an error), an item that
+  was its own `/First` and `/Next`, and nesting past the internal depth ceiling.
+  A bookmark list is not the page content, and MuPDF, pdfium and poppler open
+  every one of these files and read their pages. The walk now ends where the
+  damage is, with a warning naming it, and the bookmarks above it are kept — a
+  **resource limit** still raises, because that ceiling is the caller's and not
+  the file's fault.
+
+- **A cross-reference table that parsed but named nothing was trusted.** A table
+  truncated to its free entry led straight to "no PDF objects found in the
+  input", although the objects were still in the file and the reconstruction scan
+  would have found them — it ran only when the table failed to *parse*. The scan
+  runs for an empty table too, so the refusal only ever follows a reconstruction
+  that found nothing; a trailer that parsed keeps naming the catalog, so a stale
+  `trailer` fragment appended after `%%EOF` cannot take it over.
+
+- **A `/Resources` or a `/Font` entry that is not a dictionary raised
+  `AttributeError` out of text extraction.** A damaged file may hold a number
+  where a font belongs; without metrics the text still comes out, which is what
+  every reference reader does with such a page.
+
+- **Merging left the structure tree behind, so merged-in pages lost their
+  tagging.** Assembling an accessible document out of parts is most of the
+  reason to merge, and the parts arrived untagged: the pages came with their
+  `/P <</MCID 0>> BDC` marked content intact while the elements describing it
+  stayed in the source. Merged into a tagged document the result was worse than
+  untagged — it went on saying `/MarkInfo /Marked true`, so it advertised a
+  structure tree that covered only half its pages; merged into an untagged one,
+  there was no `/StructTreeRoot` at all and the marked content was orphaned.
+  (An earlier fix had stopped the imported page *claiming* a key it could not
+  index, which prevented it inheriting someone else's headings but left the
+  tagging lost.) The elements travel now: each page's entry in the source parent
+  tree is imported under a fresh key, the top of each imported subtree is
+  re-parented onto this document's `/StructTreeRoot` — spliced into its
+  `Document` element when both have one, since ISO 14289-2 8.2.5.2 wants a
+  single one at the root — and `/RoleMap` and `/ClassMap` are unioned. Taking a
+  *subset* of pages brings only the elements that describe those pages: a kept
+  element's marked-content ids are dropped when they belong to a page that
+  stayed behind, so nothing arrives describing content that is not there.
+
+- **Every filled rectangle and every clip was one pixel too wide.** The
+  rasteriser had four rules for turning a span's floating-point `x` range into
+  pixel columns: glyph outlines and strokes used the pixel-centre rule, while
+  path fill, the clip mask and shading-pattern fill covered `floor(x_from)` to
+  `ceil(x_to)` *inclusive* — one column too many for any integer-aligned edge.
+  Rows had always been chosen by their centres, so the error was asymmetric: a
+  1-point vertical rule rendered two pixels across and a 1-point horizontal rule
+  one pixel down, and a clip leaked a column of content past its right edge (a
+  zero-width clipping rectangle, which encloses nothing, let a whole column
+  through). Fills now keep the pixels whose centres are inside, as the glyph path
+  already did; clips keep every pixel of which the region covers any area, which
+  is conservative and what MuPDF, pdfium and poppler all do. Measured on thirteen
+  rectangles × fill and clip: of the twenty-three cases where all three
+  references agree with each other, they agreed with us on none before and on all
+  twenty-three now.
+
+- **CCITT-compressed images decoded to noise.** Group 4 is how a scanned
+  bilevel page is almost always stored, and the decoder could follow hardly any
+  of it: of ten bitmaps encoded by libtiff, one came back correct — the
+  all-black one, where a single run per row hid the errors. Two causes, both in
+  the tables rather than the loop. The code words were wrong: the black table
+  was largely a copy of the white one (black run 8 carried the white run 8 code,
+  the black 64 make-up code was the white one), and both tables held codes that
+  prefixed other codes, which cannot happen in a Huffman set and makes a
+  one-bit-at-a-time read stop early. And the two-dimensional decoder knew only
+  V0, VR1, VL1, horizontal and pass, treating everything that begins `0000` as
+  an unsupported extension — so VR2, VL2, VR3 and VL3 could never be read —
+  while `b1` was found as the first pixel of the opposite colour rather than the
+  first *changing element* of it. The tables are regenerated from ITU-T T.4,
+  including the 1792–2560 make-up codes that were missing altogether (every page
+  scanned above 300 dpi needs them), and the row decoder is rewritten in terms of
+  changing elements, the way the standard states it. **Group 3 is decoded now
+  too**: `K >= 0` used to take a fast path that returned the encoded bytes as if
+  they were the bitmap. Measured against MuPDF, pdfium and poppler, which agree
+  with each other and with the source on all twenty documents of the matrix: we
+  agreed on two, and now on twenty.
+
+- **A rectangle of noise where an image failed to decode.** When a filter could
+  not run, the still-compressed bytes were painted as samples — which looks like
+  data, and so is worse than the picture being absent. An image whose stream
+  cannot be decoded is now reported and skipped, with a warning. DCT and JPEG
+  2000 are unaffected: their bytes are passed through on purpose, and the
+  renderer decodes them itself.
+
+- **A text field authored with an embedded font rendered blank in every
+  engine.** `add_text_field(font=…)` embeds a Type0 (CID) font so a non-Latin
+  value renders, and the appearance it bakes shows that value's CIDs. The font
+  graph, though, was written the moment the field was created — before the value
+  had been encoded — and nothing rewrote it afterwards, so the embedded program
+  kept no glyph at all, `/W` was an empty array and `/CIDToGIDMap` held the
+  single entry CID 0. The appearance asked for CIDs the font could not draw:
+  pdfium, MuPDF and this library all rendered nothing, while all three still read
+  the field *value* back correctly. The program, widths and CID map are now
+  rewritten once every widget has asked for its glyphs — the refresh the
+  page-text path has always done — and the widget's `/MK` background and `/BS`
+  border are painted under the value, so the box is visible whether or not the
+  value draws anything.
+
+- **Text hidden by optional content was extracted anyway, and whitespace-only
+  text came back as raw CID bytes.** One cause: `extract_page_text` read an
+  *empty* extraction as a parse failure and fell back to the best-effort pass,
+  which reads every string in the stream as bytes and does not track the `/OC`
+  state. So a page whose every word sat in an optional-content group that is off
+  extracted that text regardless, and a page whose only text was a space came
+  back as `'\x00\x01'` — binary where a caller expects characters — because
+  extraction stripped the whitespace and so produced the empty string that was
+  mistaken for failure. An empty result is an answer now: the parser reports
+  through `showed_text` whether the stream asked for any text at all, which is
+  what tells a page that draws none from a stream the parser could not follow,
+  and the recovery pass still runs for the latter. Surrounding whitespace is kept
+  as well, which is what MuPDF and pdfium return — extraction reports what the
+  page draws.
+
+- **A font subset kept every table it was not erasing glyphs from, roughly
+  doubling the embedded program.** One line of text in Arial Unicode (50377
+  glyphs) embedded 869768 bytes, of which the 12 glyphs actually used were 2636:
+  `hdmx` was 302288 bytes, `LTSH` 50381, `GSUB` 66612 and `DSIG` 9648. None of
+  them is read for an embedded font — layout tables because a content stream
+  already carries positioned glyph codes, device metrics and hinting aids because
+  the program is rasterised from `glyf` and `hmtx`, and `DSIG` because it signs
+  the *unmodified* font and so signs nothing after erasure. They are dropped with
+  the glyphs now, which is the set fontTools' own subsetter drops by default,
+  less the colour and bitmap tables that a consumer may draw from. That font's
+  program goes from 869768 to 428568 bytes (142651 to 65364 deflated) and the
+  page renders byte-identically, with the same agreement with MuPDF and pdfium as
+  before. `optimize_resources(subset_fonts=True)` benefits too: it was shrinking
+  the file only because the stream deflates well.
+
+- **Converting to PDF/A-1 or -2 could not remove an attachment added in the same
+  session.** Those levels prohibit embedded files (ISO 19005-1 6.1.11), but the
+  removal sat inside the catalog's `/Names` branch — and a document has no
+  `/Names` dictionary until a save writes one, so an attachment added in this
+  session survived the conversion, which only warned about it and produced a file
+  veraPDF rejects. The attachments and the `/AF` array that points at them are
+  dropped now whether the document has been saved or not, so the conversion
+  produces a conformant file instead of a warning. veraPDF passes PDF/A-1B and
+  -2B output that started with an attachment.
+
+- **A base PDF/A-4 document whose attachment was not a PDF at all was reported
+  valid.** ISO 19005-4 6.9 requires *every* embedded file to conform to PDF/A-1,
+  -2 or -4 — veraPDF puts it as "All of the embedded files shall be compliant
+  with ISO 19005-1, 19005-2 or 19005-4" and fails such a file. The check read it
+  as a rule about PDF payloads only and skipped anything else, so a spreadsheet
+  attached to a base part-4 file passed. The existence of PDF/A-4f settles the
+  reading: that level is defined to carry embedded files of any type and
+  *requires* an `/EmbeddedFiles` key, which would add nothing if the base level
+  already permitted arbitrary attachments. A non-PDF payload and one that cannot
+  be read are both reported now, naming `4f` as the level that allows them, and
+  the check reads attachments added in the session as well as the object graph —
+  the same blind spot the part-4 `/Info` check had. `4f` is unaffected, and a
+  conforming PDF/A payload still passes.
+
+- **Every PDF/UA-2 document the converter produced was rejected by veraPDF, and
+  our own check passed it.** ISO 14289-2 8.2.5.2, by way of ISO 32000-2 Annex L
+  and ISO/TS 32005, requires the structure tree root to contain a single
+  `Document` structure element as its only child; veraPDF states it three ways —
+  exactly one `Document`, no `Hn` under the root, no `P` under the root — and the
+  authored headings and paragraphs were attached to `/StructTreeRoot` itself.
+  `convert_to_pdfua(part=2)` now adds that element, moving whatever the root held
+  into it in order and re-parenting each child, and leaves a root that already
+  has one alone so converting twice changes nothing. `validate_pdfua(part=2)`
+  reports a root holding none, more than one, or anything other than a
+  `Document`. Part 1 has no such rule: its output never had the wrapper and still
+  does not. veraPDF now passes both parts.
+
+- **An attachment was never declared an associated file, so PDF/A-3 output was
+  rejected.** ISO 19005-3 6.8 and ISO 19005-4 6.9 require every embedded file to
+  be associated with the document or a part of it, which an `/AF` array
+  expresses; veraPDF checks it as `isAssociatedFile`. Each file specification
+  carried an `/AFRelationship` saying what the relationship was, but nothing put
+  the specification in an `/AF` array to say there was one — so **veraPDF failed
+  every PDF/A-3 document with an attachment**, relationship and all. The catalog
+  now carries an `/AF` array naming each attachment's file specification, for
+  every document as `/AFRelationship` and `/Subtype` already were, and the array
+  is dropped with the last attachment so it never dangles. veraPDF now passes
+  our PDF/A-3B and PDF/A-4f output with an attachment.
+
+- **An attachment added without a MIME type made every PDF/A-4f file fail
+  veraPDF.** ISO 19005-3 6.8 and ISO 19005-4 6.9 require a media type in an
+  embedded file stream's `/Subtype` and name `application/octet-stream` as the
+  value to use when the type is not known; `add_attachment` without `mime=`
+  wrote no `/Subtype` at all, so the level that exists to carry attachments
+  rejected every document that had one. The same file with an explicit
+  `mime="text/plain"` passed, so only the default was missing. It is written for
+  every attachment now, PDF/A or not, on the same footing as `/AFRelationship`.
+  Reading it back follows the rule already used for `/AFRelationship`'s
+  `Unspecified`: a declared `application/octet-stream` says nothing an absent
+  `/Subtype` did not, so `FileSpecification.mime_type` reports `None` for it
+  rather than a type the producer never chose. veraPDF now passes our PDF/A-4f
+  output with and without an explicit type.
+
+- **Every PDF/A-4 file the converter produced was rejected by veraPDF, and our
+  own validator passed it.** ISO 19005-4 clause 6.1.3 forbids `/Info` in the
+  trailer unless the catalog carries a `/PieceInfo`, and allows nothing but
+  `/ModDate` in it where it is allowed — part 4 dropped the `/Title` requirement
+  that parts 1 to 3 have and replaced it with this prohibition. The conversion
+  did the opposite: its step 2 is "ensure /Info has a /Title", and it added one.
+  `convert_to_pdfa` now drops the dictionary for part 4 (keeping a `/ModDate`
+  where a `/PieceInfo` allows it), including entries `doc.info` cannot see — an
+  `/Info` value with no text form is deliberately kept by the metadata view and
+  would otherwise have survived. `validate_pdfa` reports both 6.1.3 rules and no
+  longer demands a title for part 4, reading the pending `info` view as well as
+  the object graph so a document about to be written non-conformant is not passed.
+  veraPDF now passes our PDF/A-4, `4e` and `4f` output, alongside 1B, 2B, 3B
+  and 2A.
+
+- **A document could not be reopened with its own owner password once the user
+  password reached 31 characters.** Every revision up to 4 was affected -- RC4
+  40-bit, RC4 128-bit and AES-128 -- and not only opening: `decrypt()` and
+  `change_passwords()` failed the same way, so the owner could neither remove nor
+  rotate the password of a file this library had written. Algorithm 7 recovers
+  the *padded* user password from `/O`, always exactly 32 bytes, and the padded
+  form is what the key derivation takes; the code turned it back into plaintext
+  first by searching for the two bytes the padding begins with. A 31-byte
+  password leaves exactly one of them and a 32-byte or longer one leaves none, so
+  the search failed, the recovered password fell back to the empty string and the
+  derived key was wrong. A user password merely containing those two bytes was
+  cut in the wrong place. The recovered bytes are now used as they stand. qpdf,
+  pdfium and MuPDF all open the affected files with the owner password at every
+  length, so the `/O` written was correct throughout and only the reading was
+  wrong; AES-256 was never affected, checking `/OE` directly instead.
+
+- **`flatten()` raised `IndexError` on a streamed document.** It read
+  `self.page_contents[i]` -- the content *cache*, which a document opened with
+  `open_streaming` has not filled -- instead of asking for the page, so it failed
+  for every page that had an annotation or a form field to flatten. A page with
+  none reaches a `continue` before that line, which is why flattening a plain
+  streamed document worked and flattening a useful one did not. The same defect
+  `extract_text` once had. It now asks for the content it is about to edit, so
+  only the pages that are actually flattened are decoded and a document with
+  nothing to flatten stays lazy. With this the eager and lazy load paths agree on
+  every operation measured: 28 operations over 18 documents, no divergence.
+
+- **Saving a document opened with `open_streaming` deleted its attachments.**
+  `from_file_lazy` never read them, and `_sync_attachments_to_cos` reads an empty
+  mapping as *the caller removed them all* -- so the save dropped the
+  `/Names /EmbeddedFiles` tree and left the `/Filespec` and `/EmbeddedFile`
+  objects unreachable: 1023 bytes in, 975 out, `attachments == []` on reopening,
+  with no warning and no exception, with or without an intervening edit. They
+  were invisible before any save too (`attachments`, `embedded_files` and
+  `get_embedded_file` all came back empty), along with their mime type,
+  description and dates.
+
+- **A signed document reported no signatures in streaming mode.** `signatures`
+  gave 1 through `Document(path)` and 0 through `Document.open_streaming(path)`
+  for the same file, so a caller asking whether a document is signed was told
+  "no" about a signed one. The bytes were never at risk -- `can_append` and
+  `existing_signatures_bind` read the COS graph rather than that list, so the
+  save still appended a revision and left the signature intact.
+
+  Both are read at load now, beside the metadata and the outlines; only page
+  content and the resources a page reaches are deferred. The payloads are
+  bounded by the same `PdfLoadLimits` as any other stream.
+
+- **Converting a document to PDF/A twice left the first conversion in the file.**
+  `convert_to_pdfa` registered a new XMP stream, a new ICC profile, a new
+  `/OutputIntent` and a new `/OutputIntents` array each time it ran and pointed
+  the catalog at them, abandoning the previous four: converting twice left 4
+  unreachable objects and 1055 bytes of dead streams, a third conversion 8 and
+  2110, without bound. `convert_to_pdfua` leaked its predecessor's XMP packet the
+  same way, and so did an ordinary edit of `xmp_metadata`. The catalog entries are
+  replaced where they stand now, so repeated conversion leaves nothing behind and
+  the file size does not move; a level change still rewrites the packet. The ICC
+  profile is the exception: a `/DestOutputProfile` stream can also be a page's
+  `/ICCBased` colour space, so one holding the right bytes already is kept and one
+  holding other bytes is left alone with a new profile written beside it. Nothing
+  about the output was invalid before -- `optimize()` swept the dead objects up --
+  it was waste in files written to be archived.
+
+- **A page whose `/MediaBox` had no area could not be rendered.** It raised
+  `PdfValidationException("page box must have positive area")`, and `Page.rect`
+  reported the degenerate rectangle as though it were the page's size; the same
+  went for coordinates that were not numbers, which silently became zeroes. Such
+  a `/MediaBox` is now replaced with US Letter -- absent, not an array, too
+  short, not numbers, not finite, or no area -- which is what pdfium and MuPDF
+  both answer for every one of those shapes, MuPDF in the media box itself and
+  not merely when drawing. Corners are ordered too, so `[612 792 0 0]` reads as
+  the rectangle it describes, again matching MuPDF; a rectangle at negative
+  coordinates is kept, as both references keep it. Our `Page.rect` now equals
+  MuPDF's `mediabox` on all nine shapes tested. The `/MediaBox` written back is
+  still the one the file held -- MuPDF and qpdf keep a degenerate one as well.
+
+- **An attribute set on a name the object does not have was accepted and lost.**
+  `d.pages[0].rotate = 270` -- the property is `rotation` -- raised nothing and
+  did nothing: `Page` is rebuilt on every access, so the value went to a
+  throwaway object and was gone before the next statement, and the document saved
+  upright. `Page`, `PageCollection`, `Annotation` and its subclasses,
+  `AnnotationCollection`, `Field`, `Form`, `UnsignedContent`,
+  `UnsignedContentAbsorber`, `OutlineItem` and `OutlineCollection` now declare
+  their attributes with `__slots__`, as `Layer`, `LayerConfiguration`,
+  `LayerCollection` and `pages._LayerSection` already did, so Python refuses an
+  undeclared name with `AttributeError`. The properties and the documented
+  writable attributes are unaffected. `aspose_pdf.utils._object_to_dict`, which
+  read `__dict__`, reads the declared names for such an object instead of
+  falling back to a repr string -- which is what its docstring already promised.
+
+- **A crop box reaching outside the media box was used as it stood.** ISO 32000-1
+  Table 30 says it "shall be intersected with the media box" to determine what of
+  the page is visible; without that, a page whose crop box was larger than its
+  media box rendered at the crop box's size -- 2000x2000 for a Letter page --
+  inventing sheet the document does not describe, and one overhanging an edge
+  placed its content against a corner that is not on the page. The intersection
+  is taken now, wherever the value is used: rendering, text export, stamp
+  placement and `Page.crop_box`, which reports the box in effect. An empty crop
+  box no longer makes a page unrenderable (it used to raise "page box must have
+  positive area"), and one lying entirely off the page gives the media box too.
+  The entry written to the file is still the one that was set, unclipped, as qpdf,
+  pdfium and MuPDF all keep it. Measured across six shapes, the rendered size now
+  matches both pdfium and MuPDF everywhere the two agree, and MuPDF where pdfium
+  reports a page of no size.
+
+- **One 16-bit sample got three different 8-bit values depending on which path
+  reduced it.** Coming in from a PNG it was shifted down to its high byte, going
+  out to one it was truncated (`value * 255 // 65535`), and inside a JPEG 2000
+  codestream it was rounded -- the same question answered three ways, each a
+  step from the others, so the same pixel embedded and then exported did not
+  come back as itself. There is one rule now, in `engine/image_resample`: the
+  rounded linear rescale, which ISO 15948 (PNG) 10.4 calls the most accurate way
+  to reduce a sample's depth, against the shortcuts it calls "slightly less
+  accurate" but faster -- a trade worth making for a screen, not for samples
+  stored in a document or written to a file the caller keeps. Nothing changes at
+  1, 2, 4 or 8 bits, where the rescale is exact, and an 8-bit value widened to
+  16 the correct way (`value * 257`) still comes back unchanged. A 16-bit image
+  can now read 1/255 away from pdfium (which truncates) or MuPDF (which shifts),
+  which is less than either of them is from the true value; the shift also
+  flattened every value from `0xFF00` up onto 255, losing the top of the range.
+
+- **A file cut off inside a stream failed to open at all.** Truncation is the
+  commonest damage a transfer does to a PDF, and a `/Length` that no longer
+  reaches `endstream` was already treated as damage to recover from -- but a
+  missing `endstream` raised `endstream not found for stream` and failed the
+  whole document, so a three-page file cut in its first content stream gave
+  nothing back although the page dictionary before the cut was intact. The
+  stream is now the bytes that are there, logged as such. qpdf and MuPDF both
+  read such a file; measured across cuts, the recovered page counts are qpdf's
+  and the per-page text is MuPDF's, and for the one synthetic case where the
+  stream is not at the end of the file our bytes are MuPDF's exactly. A cut
+  landing inside an *object* rather than a stream is still refused, which is
+  what qpdf and MuPDF do with it.
+
+- **`unpack_samples` was documented as discarding half of every 16-bit sample.**
+  Its docstring said 16-bit "keeps the high byte"; the code returns the whole
+  big-endian value, which is what its callers need -- a `/Mask` colour-key range
+  is expressed in the image's own component range, and the conversion to 8 bits
+  is `to_8bpc_bytes`' job. The test that was meant to pin this asserted the high
+  byte on `0x1234`, a value where both rules give `0x12`, so it passed either
+  way; it now uses values that tell them apart. Measured over all 65536 values
+  on a 16-bit greyscale image, our renderer and image export agree with pdfium
+  exactly (bar 8 values where pdfium's float arithmetic lands a step away),
+  while MuPDF answers `v >> 8` throughout -- one step higher over half the
+  range. The rules differ by at most 1/255 and neither is the rounded value, so
+  the divergence is documented rather than changed.
+
+- **A document with no pages reported one page.** Six shapes of page-less input
+  -- a bare header, a header and `%%EOF`, a header followed by garbage, a header
+  with one object that is not a page, a catalog with no `/Pages`, and a
+  well-formed but empty page tree -- were each answered with `len(doc.pages) == 1`
+  and a blank Letter sheet invented on load, so a caller that checked the count
+  was told the file had a page and then rendered a sheet the file never
+  described. qpdf and pdfium refuse all six; MuPDF refuses the three with no PDF
+  object in them and reports 0 pages for the three that have a structure to
+  read. That split is the rule now: an input with no object in it raises
+  `PdfParseException`, and a document whose page tree is empty or absent reports
+  no pages -- it still opens, saves (qpdf and MuPDF read 0 pages from what we
+  write), encrypts and can be authored into, `validate()` rejects it, and
+  `repair()` is where a page gets added. `SimplePdf.from_bytes_safe`, the
+  tolerant loader, repairs as before.
+
+- **A JPEG 2000 codestream with packed packet headers did not decode.** A packet
+  normally carries its header in front of its body; it may instead gather every
+  header into a `PPT` segment in a tile header or a `PPM` segment in the main
+  header (ISO 15444-1 A.7.4, A.7.5), and the bundled decoder refused such a file
+  outright — so on a default install, without the `images` extra and its
+  OpenJPEG, the image was simply missing. Both are read now, with the segments
+  reassembled by their `Zppt`/`Zppm` indices and a `PPM` stream's `Nppm` runs
+  handed to the tile-parts in codestream order. The test fixtures were made by
+  moving a real codestream's packet headers, one packet at a time, and OpenJPEG
+  decodes every one of them to the same pixels as the original.
+
+- **A variable TrueType always drew its default master.** Variable CFF2 was
+  instanced; `glyf` fonts, whose deltas live in `gvar`, were not read at all. A
+  modern system font ships as one variable file rather than four static faces,
+  so a substitute asked for Bold came back Regular. New `engine/gvar.py` applies
+  the deltas -- scaled by each region's weight at the requested coordinates,
+  with the points a tuple omits inferred from their neighbours (OpenType's IUP)
+  and a composite's deltas moving its components -- and the axis machinery
+  `fvar`/`avar` now lives in `engine/font_variations.py`, shared with the CFF2
+  path. Checked against fontTools' instancer on eight combinations of real
+  variable fonts and axes: over 2 400 glyphs and 100 000 points, no contour
+  differed in structure and no coordinate by more than 1.5 font units, which is
+  fontTools' rounding and not a difference in the deltas.
+
+- **A Bézier stopped being a Bézier.** The interpreter turned every curve into
+  twelve line segments and dropped the control points, which cost twice. The
+  raster kept a fixed flat on each segment — a 250 pt circle was off by half a
+  point at *any* resolution, where pdfium and MuPDF have no error — and SVG
+  export, whose point is a resolution-independent facsimile, wrote those
+  segments out as `L` commands. Flattening now takes its step count from the
+  curve's length in device pixels, so the error stays under a fifth of a pixel
+  at every scale, and each subpath records the cubics its points stand in for so
+  the exporter writes them as `C`. On a page of 24 stroked circles the SVG went
+  from 20 760 bytes with 1 152 `L` commands to 7 138 bytes with 96 `C`, and
+  MuPDF — which reads SVG as well as PDF — renders the export and the original
+  with no pixel differing beyond antialiasing, where the old export differed on
+  0.56% of the page.
+
+- **Replacing or hiding an image did not change the document.**
+  `ImagePlacement.replace` set the bytes on the object in hand and `hide` set a
+  flag on it, so a save afterwards still wrote the picture that was there — the
+  placement had no reference to the document at all. A placement collected by
+  `ImagePlacementAbsorber` is now bound to the document it came from, and both
+  methods redefine the image XObject while leaving the page's drawing operations
+  alone, so the new picture appears exactly where the old one was. Hiding
+  redefines the image as a single fully transparent pixel. Both follow MuPDF's
+  `Page.replace_image` / `Page.delete_image`, are per-object like MuPDF's, and
+  both now return whether the document was changed. pdfium and MuPDF render
+  every case identically, and a replacement leaves no second copy of the image
+  behind: the file comes out the size it went in.
+
+- **An XMP property whose namespace is declared on its own element was read as
+  absent.** Found while cross-checking PDF/X identification against pikepdf: the
+  packet reader matched `name>`, so
+  `<pdfxid:GTS_PDFXVersion xmlns:pdfxid="...">PDF/X-4</...>` — how pikepdf
+  writes a property in a namespace nothing else in the packet uses — reported the
+  property as missing, which rejected a conforming file written by another tool.
+  The opening tag may now carry attributes. This is the reader the PDF/UA
+  identification checks share.
+
+- **A justified line's gaps were read back as two spaces each.** Found while
+  building the above: a gap in a justified line holds a space *and* a
+  displacement — the space is the text, the displacement is the slack that
+  spreads the line — and the text extractor counted both, so `extract_text()`
+  returned `"one  two  three"` for a line that says `one two three`.
+  pdfminer.six reads such a line the same way; pdfium does not. A gap that
+  follows a space now adds nothing, since the word boundary is already there.
+
+- **`PdfFileSecurity.change_password(permissions=…)` could never work.** The
+  facade has offered `permissions` and `algorithm` since it was written and
+  forwarded them to `Document.change_passwords`, which has neither — so either
+  one returned `False` with a `TypeError` in `last_exception`, swallowed by the
+  facade's own report-rather-than-raise contract, which is why no test caught
+  it. `Document.change_passwords` now takes both, `None` keeping what the
+  document has, so a password change can deliberately re-permission or re-cipher
+  a document instead of needing a decrypt and a re-encrypt.
+
+### Added
+
+- **Stamps.** A document could not be stamped: `SimplePdf.set_watermark` set a
+  field only the retired V0 writer read, so through `Document` it saved a file
+  with no watermark in it. `TextStamp`, `ImageStamp` and `PageNumberStamp` now
+  go on through `Page.add_stamp` and `Document.add_stamp(stamp, pages=...)`,
+  with opacity, rotation, zoom, alignment and indents, and `background` to put
+  the mark under the page's own content. A stamp is a form XObject in its own
+  `q`/`Q`, placed inside the box a reader shows and with the page's `/Rotate`
+  undone so it stands upright; one stamp on many pages is one object. The
+  behaviour and the matrices are qpdf's `--overlay`/`--underlay`, and every
+  placement and opacity was read back out of pdfium's and MuPDF's rasters.
+
+- **The standard fonts' real metrics.** `StandardFonts.get_glyph_width`
+  answered 600 for every glyph of every font, so text set in a standard font
+  could not be measured -- a centred `"Page 1 of 10"` was out by a quarter of
+  its length. New `engine/std_metrics.py` carries the advance widths and the
+  face bounds of all fourteen, indexed by the code this library writes for
+  each. Read from MuPDF's built-in faces and checked against pdfium: every
+  glyph lands within 0.0002 pt of where pdfium puts it.
+
+- **How a document asks to be opened and shown.** `/PageMode`, `/PageLayout`,
+  `/OpenAction` and `/ViewerPreferences` survived a load and save but could
+  not be read or written. `Document.page_mode`, `Document.page_layout`,
+  `Document.open_action` (a `Destination` or an `Action`) and
+  `Document.viewer_preferences` now cover them, with `PageMode`, `PageLayout`,
+  `ReadingDirection`, `PrintScaling`, `DuplexMode` and `PageBoundary` for the
+  values ISO 32000-1 tables 28 and 150 allow. An entry that is missing, of the
+  wrong type, or outside those lists reads as its default, as pdf.js and
+  PDFBox resolve it; `/PrintPageRange` follows pdf.js and is spoken in 0-based
+  page indices. Both directions were checked against pdf.js, PDFBox and MuPDF.
+
+- **Layers that exclude one another.** `/RBGroups` -- the radio buttons of a
+  viewer's layers panel -- was read into a configuration but never enforced,
+  so switching one layer on left the others of its group on and the saved file
+  said so. `LayerCollection.make_exclusive` declares such a group,
+  `exclusive_groups` lists them, and `Layer.visible = True` now switches off
+  every other member of each group naming that layer, the way pdf.js and MuPDF
+  do; switching one off leaves the rest alone. Removing a layer drops it from
+  the arrays instead of leaving them naming a group that is gone.
+
+- **Long-term validation for encrypted documents.** `Document.add_ltv` and
+  `add_document_timestamp` refused an encrypted document; the store and the
+  timestamp field are now written through the encrypting writer with the
+  file's own key, and validation reads the store back with it, so a
+  password- or certificate-protected file reaches PAdES-LTA. Checked with
+  pyHanko on AES-256, AES-128, RC4 and certificate-recipient documents.
+
+- **A found text fragment knows where it is.** `TextFragment` gains `rect`
+  and `quads` in default user space, `font_name`, `font_size` and `color`,
+  filled in when a page (or a document's pages) is visited. The boxes are the
+  redactor's own locator's, checked against MuPDF and pdfium; text that cannot
+  be tracked to a single run is left unplaced rather than boxed wrongly.
+
+- **FDF and XFDF.** `Form.export_fdf`/`export_xfdf` write a form's data and
+  `Form.import_fdf`/`import_xfdf` fill a form from it, redrawing the fields
+  and applying FDF's field and widget flags. Checked against Apache PDFBox in
+  both directions; a signature's value is never carried.
+
+- **Form fields say more than their value.** `Field` gains `partial_name`,
+  `alternate_name`, `mapping_name`, `flags`, `read_only` and `required`
+  (settable), `no_export`, `default_value`, `max_length`, `multiline`,
+  `password`, `comb`, `options`, `multi_select`, `editable`,
+  `export_values`, and `widgets` with each widget's page and rectangle.
+  Inheritable attributes come from the nearest ancestor; every property was
+  compared with pdf.js, pdfium, qpdf and MuPDF.
+
+- **Page labels.** `/PageLabels` was neither read nor written. `Page.label`
+  returns the label a viewer shows (`"iii"`, `"A-1"`, or `None` without
+  labels), and `Document.page_labels` maps the page each range starts at to a
+  `PageLabel(style, prefix, start)` that can be set and deleted. A malformed
+  tree reads as most of pdfium, qpdf, pdf.js and MuPDF read it, and letters
+  repeat as the specification says. Inserting and deleting pages moves the
+  ranges as MuPDF does; merged and extracted pages keep their labels as with
+  qpdf's `--pages`.
+
+- **Export settings that were silently ignored now work.** `HtmlSaveOptions`
+  and `MarkdownSaveOptions` reached `Document.save` with everything but
+  `split_into_pages` / `extract_images` dropped. Figures now go to files when a
+  folder is named (`resources_directory`; `image_directory` or
+  `resources_directory_name`), each image once and linked by a relative URL;
+  `markdown_format` selects GFM or CommonMark (tables as HTML blocks);
+  `max_distance_between_text_lines` sets where lines stop joining a paragraph
+  (default now 1.6 font sizes, the value the export always used); and
+  `use_area_clipping` leaves out content anchored outside the crop box, as
+  MuPDF does. The XPS/APS intermediate-file settings raise, since no such file
+  is produced. The same controls are keyword arguments of `to_html`,
+  `to_markdown`, `save_as_html` and `save_as_markdown`.
+
+- **Signing through `Document`.** `Document.sign(field, certificate=...,
+  private_key=...)` fills a signature field -- or, with no field named, an
+  invisible one it adds -- with an `adbe.pkcs7.detached` or, with
+  `pades=True`, a CAdES (PAdES-B) signature, optionally timestamped from a
+  network or local authority (PAdES-T), with an embedded chain, reason,
+  location and contact, or as a certifying signature (`certify=`).
+  `Document.add_ltv(certificates=..., crls=..., ocsp_responses=...)` adds the
+  signatures' validation material and any given to a `/DSS` (PAdES-LT), and
+  `Document.add_document_timestamp(...)` appends an RFC 3161 document
+  timestamp (PAdES-LTA). All three are made by `save()`, in call order, each
+  as a revision appended to the bytes the save writes -- incrementally when
+  the document is signed already -- so every earlier signature stays valid;
+  the document is then reloaded from the file it wrote, so `signatures` lists
+  the new ones and a later save appends to them. Arguments are checked when
+  the call is made: a field that does not exist, is not a signature field or
+  is signed already, a key that is not the certificate's, a key type the
+  chosen encoding cannot sign with, a certification on a signed document.
+  Encrypted documents are signed, stored and timestamped with their own key;
+  signing a document being encrypted for certificate recipients is refused,
+  since it could not be reopened after the save. Every combination checked in pyHanko (intact, valid, trusted, whole
+  file covered, benign modification levels) and opened in pdfium and MuPDF.
+
+### Fixed
+
+- **An embedded Standard-14 font was not an embedded font.** PDF/A conversion
+  attaches a bundled metric-compatible substitute, which is an sfnt, as
+  `/FontFile2` -- but left the dictionary saying `/Subtype /Type1`, and a Type 1
+  font's program is `/FontFile` or `/FontFile3`, never `/FontFile2` (ISO 32000-1
+  table 122). veraPDF 1.30.2 read that as "the font program is not embedded",
+  correctly, so *every* PDF/A file this library produced failed the one rule the
+  embedding exists to satisfy -- while this library's own check looked for any
+  `FontFile*` key and reported the document compliant. Such a font is now
+  written as `/TrueType`, and the check requires the program under the key its
+  kind uses. pdfium renders the converted page identically, pixel for pixel.
+
+- **Fonts were looked for on pages only.** The embedding pass and the PDF/A
+  check both walked page `/Resources`, so a font reachable only through the
+  AcroForm's `/DR` -- the `/Helv` a form field's appearance is drawn with -- an
+  annotation's appearance stream, or a form XObject's own resources was neither
+  embedded nor reported. Both now walk every font used for rendering, and each
+  complaint says where the font was found.
+
+- **PDF/UA conversion left fonts unembedded**, though ISO 14289-1 7.21.4.1
+  requires them embedded and this library's own PDF/UA check reported it. It
+  embeds them now, as the PDF/A conversion does.
+
+  With these three, veraPDF's font rule passes on every sample
+  `scripts/write_conformance_samples.py` writes, for all seven PDF/A levels and
+  both PDF/UA parts.
+
+### Removed
+
+- **The second writer.** `SimplePdf` had two: the COS writer for a document with
+  an object graph, and an older one for a document assembled in memory. Nothing
+  the public API does produces the second kind — every load builds a graph,
+  malformed input included — which is how features only that writer knew about
+  came to sit in the engine doing nothing (see the entry below). A document with
+  no graph is now given one and serialised like any other, and the 511-line
+  writer is gone. Six of the seven shapes it used to serialise — pages, text,
+  metadata, an outline, an attachment, an empty page — come out of qpdf, pdfium
+  and MuPDF with identical facts. The seventh differs on purpose: writing
+  `encrypted = True` by hand no longer encrypts, because that field says how a
+  document *arrived* and `encrypt()` is what asks for encryption. `encrypt()` on
+  a document assembled in memory still produces a file qpdf and MuPDF need the
+  password to open.
+
+- **Engine methods that could not take effect.** The writer above was written to
+  only when a `SimplePdf` has no COS graph, which no path through `Document`
+  produces, so `SimplePdf.set_watermark`, `sign`, `add_signature`, `hide_image`
+  and `replace_image` did nothing at all through the public API. Worse,
+  `sign`/`add_signature` fabricated a signature: an orphan `/Sig` holding
+  `/Contents <0000>`, over no byte range, referenced by no field, in a document
+  with no `/AcroForm`. All five are gone, together with that writer's branches
+  for them -- a watermark is what `Page.add_stamp` does on any document and
+  signing is what `Document.sign` does for real. Verified in qpdf: the file the
+  legacy writer produces is object-for-object what it was, minus the forged
+  signature, and MuPDF and pdfium read it the same.
+
+- **Code no caller could reach**: `SimplePdf.save_incremental` (a wrapper over
+  `to_bytes_incremental`, which is the path `Document.save(incremental=True)`
+  uses), `supports_incremental_update`, `extract_attachment` (the working one
+  is `PdfExtractor.extract_attachment`), `_field_font_family`, `_get_array`,
+  `incremental_update.write_incremental` and `_build_signature_placeholder`,
+  `encryption._validate_key_length`, `pdf_parser_cos._match`,
+  `image_export.looks_like_encoded_image`, `font_authoring.pdf_base_name` and
+  `is_subset`, and the two compatibility wrappers `text_edit._group_show_runs`
+  and `ccitt._pack_rows` -- whose tests now exercise the live helpers they
+  wrapped, `_walk_show_runs` and `_pack_row`, so the rules they asserted are
+  still asserted where they are used.
+
+### Fixed
+
+- **`PdfExtractor` read documents beside the engine instead of through it.**
+  It parsed page content itself, so a document whose content is loaded lazily
+  extracted nothing at all and a page with a damaged content stream lost the
+  text the engine recovers; each page now comes from
+  `SimplePdf.extract_page_text`. Its images were the decoded samples rather
+  than an image file -- writing one to a `.png` produced a file nothing opens
+  -- and are now reconstructed as `save_image` writes them, through a new
+  `SimplePdf.image_file()` that both paths share. `get_next_image()` takes an
+  optional path or stream to write to, and `get_next_image_name()` names the
+  image the cursor is on.
+
+- **An extended sequential JPEG (`SOF1`) decoded to nothing without Pillow.**
+  Such a frame is coded exactly like a baseline one for 8-bit Huffman scans
+  (ITU-T T.81 F.1.2) and libjpeg, pdfium and MuPDF all read it that way; the
+  pure-Python decoder refused it, so the image was missing wherever Pillow was
+  not installed. It is now decoded as baseline, while a 12-bit frame still
+  falls back.
+
+- **A field under a parent without a name disappeared.** `/T` is optional,
+  and a nameless node's kids take the name above it -- pdf.js, qpdf and MuPDF
+  all read the kid of such a parent as `inner`, not `box.inner` -- but the
+  form stopped at the nameless node, so the field was neither listed nor
+  settable.
+
+- **Setting a value on a field whose type is stated by its parent treated it
+  as a text field.** `/FT` and `/Ff` were read from the field alone, so a list
+  box kid of a parent carrying the type could not take several values, and a
+  check box kid would get text instead of a state.
+
+- **A field whose value is set on its parent read as `None`.** `/V` is
+  inheritable (ISO 32000-1 table 220) and pdfium, pdf.js, qpdf and MuPDF all
+  give the kid its parent's value; it was only looked for on the field
+  itself.
+
+- **Saving HTML, Markdown or SVG ignored `overwrite`, and a failed export
+  destroyed the file it was replacing.** `save(path, DocFormat.HTML)` replaced
+  an existing file even with `overwrite=False`; it now refuses, checking every
+  file an export would write before writing any. The HTML, Markdown, SVG,
+  TIFF, raster, extracted-image and attachment writers truncated their target
+  before writing it, so a full disk or a killed process left it empty; they
+  now write atomically, as a PDF save does. Content anchored outside the crop
+  box, which no viewer shows, is no longer exported by default
+  (`clip_to_page=False` restores it).
+
+- **A document timestamp's coverage was unclear, and a second one looked like
+  tampering.** `engine.dss.add_document_timestamp` left the `<` and `>` of its
+  `/Contents` inside the signed ranges, so pyHanko could not match the gap to
+  the token and reported the timestamp's coverage as unclear; and every
+  timestamp was a field named `Timestamp`, so renewing an archive timestamp
+  made two fields of one name, which pyHanko rejects as a suspicious
+  modification of every signature before it. The gap now runs over the
+  delimiters, as it does for a signature, and a later timestamp is
+  `Timestamp2`, `Timestamp3`, ... It also refuses an encrypted document, whose
+  field name it would have written in clear.
+
+- **A second `/DSS` replaced the first.** `enable_ltv` and `build_dss` wrote a
+  new store from the signatures' own material, dropping revocation data an
+  earlier call had added and every `/VRI` entry but one. An existing store is
+  now extended in place: its streams are referred to again, only new material
+  is added, its `/VRI` entries are carried over unchanged (pyHanko treats a
+  changed one as tampering), and nothing new means no revision at all.
+
+- **A certifying signature could follow another signature.** `sign_field`
+  with `certify_permissions` on an already signed document added `/Perms`
+  after the earlier signatures, which pyHanko reports as a change they did not
+  allow. A DocMDP signature "shall be the first signed field in the document"
+  (ISO 32000-1 12.8.2.2.1), and is now refused otherwise.
+
+- **An Ed25519 signature was digested with SHA-256.** RFC 8419 pairs Ed25519
+  with SHA-512 when signed attributes are present, and pyHanko rejects any
+  other pairing. Ed25519 now signs with SHA-512 (a seed value demanding
+  another digest is refused), and Ed448, which needs SHAKE256, is refused
+  rather than signed with a digest validators reject.
+
+- **`aspose_pdf.generated.*` was an older, broken copy of the library.**
+  `generated.document.Document` merged documents as blank pages, broke a signed
+  file's signature on save, accepted a wrong password in `decrypt`, and always
+  reported `info`, `version`, `form`, `outlines` and `permissions` as `None`;
+  `generated.forms.UnsignedContentAbsorber.extract()` returned its own keyword
+  arguments; `generated.pdfa` held inert look-alikes of the PDF/A classes. Each
+  module now re-exports the canonical class, as `generated.security` already
+  did, so both import paths behave identically. Code that relied on the old
+  copies' own signatures -- an absorber built without a document,
+  `PdfAValidateOptions.set_option`, `optimize(compress_images=...)` -- now gets
+  the canonical ones.
+
+- **A PNG with a transparent background was placed as an opaque rectangle.**
+  `Page.add_image` (and push-button icons) stripped the alpha channel of
+  grey+alpha and RGBA PNGs and ignored `tRNS`. Transparency is now written as a
+  soft mask: the alpha channel, a palette's per-entry opacity, or the colour a
+  grey or RGB `tRNS` names, compared at the image's own bit depth (a 16-bit
+  pixel that shares only the key's high byte stays opaque). Placed over a red
+  background, every kind renders in pdfium and MuPDF as Pillow composites it.
+
+- **A signed document looked unsigned through the public `Document`.**
+  `Document` had no `signatures`, so `SignaturesCompromiseDetector(Document(...))`
+  reported "unsigned document" -- also for a file whose page was replaced after
+  signing -- and `UnsignedContentAbsorber` read `is_signed` flags that pages,
+  fields and annotations do not have, reporting everything in a fully signed
+  document as unsigned, the signature field included. `Document.signatures` now
+  lists the signatures, and the absorber reports what is new or different since
+  the newest signature that verifies, compared object by object with the signed
+  revision (decrypted first where the file is encrypted): replaced page content,
+  an annotation added or edited later, a field filled in after signing with its
+  widget. On files signed by pyHanko with RSA, RSA-PSS and ECDSA keys, and on
+  every layout this library signs, it reports nothing unsigned.
+
+- **Content added to an existing page could land off the page, be clipped away
+  or be invisible.** `Page.add_text`, `add_image`, `draw_rectangle`,
+  `draw_line`, `Page.layer(...)` and redaction bars appended their content
+  after the page's own, which left its graphics state as it found it -- so a
+  page ending with a `cm` it never undid drew text placed at (300, 400) at
+  (603, 800), off a Letter-sized page; a clipping path left in force hid the
+  addition entirely, `3 Tr` made added text invisible and a dash pattern turned
+  an added solid line into a dashed one. pdfium and MuPDF showed all of these.
+  The page's content is now saved before and restored after when, and only
+  when, it leaves state behind; its streams are referenced rather than
+  rewritten, so incremental saves still only append, and pages this library
+  authors are unchanged. Adding to one of several pages that shared a
+  `/Contents` array also no longer added to all of them.
+
+- **Signing a document that had been updated before could destroy it.** The
+  incremental-update builder behind signing, the `/DSS` and document
+  timestamps took its next object number from the newest cross-reference
+  section, which lists only what that revision changed. After any earlier
+  update that rewrote a low-numbered object -- a catalog touched by a save, a
+  field filled in by another tool -- it handed out numbers older revisions
+  still owned: signing gave the signature dictionary the page's number, the new
+  revision replaced the page, pdfium could not open the result and MuPDF found
+  no text in it, while the signature itself validated. The appended revision's
+  `/Size` shrank with it. New objects are now numbered above the trailer's
+  `/Size` and every object header in the file. Signing files written by this
+  library, qpdf (object streams, linearized, QDF), MuPDF, a hybrid-reference
+  layout and a two-revision file now validates intact in pyHanko and opens in
+  pdfium, MuPDF and qpdf.
+
+- **A PDF with anything in front of its header did not open.** The reader
+  required the data to start with `%PDF-`, where Acrobat accepts the header
+  anywhere in the first 1024 bytes and pdfium, MuPDF and qpdf read such files.
+  A prefix left by a mail client or an HTTP capture usually arrives after the
+  file was written, so every offset in it is short by the prefix's length; the
+  parser now notices when `startxref` lands on a cross-reference section only
+  once moved by the header's position, and moves every offset -- table,
+  `/Prev`, `/XRefStm` -- by as much. Saving such a file incrementally writes it
+  whole instead, so its offsets are right again. The version is read from the
+  header wherever it stands.
+
+- **One stream could make a document unopenable.** An object was taken to end at
+  the first `endobj` after its header, so a content stream that merely contains
+  the word `endobj` -- in a comment, in a string -- had its correct `/Length`
+  rejected as running past the object, and the document failed to open. A
+  wrong `/Length` (too long, too short or negative, the usual damage from a
+  transfer that rewrites line endings) failed it the same way, as did an
+  object missing its `endobj` before the cross-reference table. pdfium, MuPDF
+  and qpdf read all of these. `/Length` is now trusted when `endstream` follows
+  it, a wrong one is replaced by the closing `endstream` (never one inside the
+  data, never a later object's), and an indirect `/Length` is followed: streams
+  measured by one -- pdfTeX and matplotlib write them -- now hold exactly the
+  bytes qpdf reads instead of the end-of-line before `endstream`.
+
+- **Hybrid-reference files lost everything kept in object streams, and saving
+  one broke it.** A file written to stay readable by PDF 1.4 software (ISO
+  32000-1 7.5.8.4) indexes its objects in object streams in a cross-reference
+  stream named by the trailer's `/XRefStm`, and lists only the rest in its
+  classic table. `/XRefStm` was never read, so those objects -- typically the
+  page tree, fonts and document information -- did not exist: the document
+  opened with no text and no title, and a full save wrote a file without its
+  page tree, which qpdf and MuPDF refuse to open. The stream is now merged
+  into its revision, the table's in-use entries answering first; a broken
+  `/XRefStm` is ignored. qpdf, MuPDF and pdfium agree on every layout tested
+  but one, where the table lists the packed objects as free; there this reads
+  as pdfium does.
+
+- **ReportLab documents opened without their metadata, and encrypted ones did
+  not open at all.** ReportLab writes a comment into the trailer dictionary of
+  every file (`% ReportLab generated PDF document -- digest (opensource)`), and
+  the object tokenizer did not treat `%` as the start of a comment, which ISO
+  32000-1 7.2.3 allows anywhere white-space may stand. The trailer failed, the
+  reader rebuilt the cross-reference table by scanning the file, and the scan
+  parsed the trailer with the same tokenizer and lost it again: title and
+  author were gone, and an encrypted ReportLab file -- whose `/Encrypt` is in
+  that trailer -- failed with a resource-limit error under either password.
+  Comments are now white-space in objects and trailers alike (form feed too),
+  and the trailer extractor steps over comments and strings holding `<<`, `>>`
+  or `(`. pdfium, MuPDF and qpdf read every case in the new tests; text and
+  metadata from the rest of a mixed corpus are unchanged.
+
+- **Extracting a page copied every page its links pointed at.** Importing a
+  page followed its link annotations' page references, so a link to a page
+  that was not being copied brought that page -- content and resources -- into
+  the result as an orphan no page tree lists. Extracting a table-of-contents
+  page from a 60-page document wrote a 40 KB file from a 32 KB source, holding
+  all 60 pages. Such a reference now becomes `null`, as qpdf writes it (16 KB,
+  one page). Links by *name* were copied as names, which the source catalog
+  alone defines: in an extract they went nowhere, and in a merge they resolved
+  against the other document's names, sending a second copy's links into the
+  first copy. They are now carried as the destinations they name, as
+  bookmarks are.
+
+- **Bookmarks by name, by action or with no target read as page 1, and saving
+  made that true.** `OutlineItem.page_index` was read from a `/Dest` array
+  only, so a bookmark naming its destination -- through the `/Names /Dests`
+  tree most writers use, or the older `/Dests` dictionary, directly or in a
+  `/GoTo` action -- read as page 0, and so did every bookmark that lands on no
+  page: one with no target (ISO 32000-1 makes both `/Dest` and `/A` optional),
+  a URI, an undefined name. Opening and saving a document gave a target-less
+  bookmark a jump to page 1 -- a PyMuPDF page deletion leaves exactly such
+  bookmarks. Named destinations now resolve as in pdfium and MuPDF,
+  `page_index` is `None` where a bookmark lands on no page, and such bookmarks
+  are written back as they were. Merging carried a named bookmark across as
+  its name, which the merged document resolved against its own names -- a
+  second copy of a file sent its bookmarks into the first copy's pages -- and
+  dropped page-less bookmarks; names are now carried as the destinations they
+  name.
+
+- **A page with comments could not be read, flattened or edited.** A sticky
+  note's `/Popup` is an annotation whose `/Parent` is the note, and a reply's
+  `/IRT` is the note it answers. The annotation property channel inlined
+  whatever an entry referenced, so reading a note walked note -> popup -> note
+  and raised `Annotation property graph contains a cycle`: `page.annotations`,
+  `Document.flatten()` and `annotations.delete()` failed on every page carrying
+  a comment written by Acrobat or MuPDF. Another annotation, like a page, is
+  now never a property value (typed `/Annot`, or untyped with `/Subtype` and
+  `/Rect`); editing a note and saving keeps its popup and replies linked, as
+  pikepdf and PyMuPDF read the result.
+
+- **Text in a CMap written without line breaks came out as raw codes.** Every
+  CMap reader -- ToUnicode, and an embedded Encoding CMap's codespaces,
+  `cidrange`, `cidchar` and `WMode` -- went line by line and recognised an
+  operator only at the end of a line. A one-line CMap, an entry on the
+  `beginbfchar` line or an entry split over two lines gave no mappings, so
+  extraction, search and substitute-glyph rendering saw codes like
+  `\x01\x02`. They now share one PostScript tokenizer (comments and strings
+  skipped, whitespace inside hex strings ignored, an odd final digit padded).
+  `bfrange` destinations were also read as one integer, which dropped every
+  ligature range (`<00660066>`) and surrogate-pair range (`<D835DC00>`); they
+  now count up in the last UTF-16 unit. Thirteen layouts extract exactly as
+  pdfium, MuPDF and pdfminer.six do; on malformed CMaps where they disagree the
+  majority reading is used. Text from twenty PDFs written by ReportLab, PyMuPDF,
+  cairo and matplotlib is unchanged.
+- **A form's `/F1` was drawn in the page's `/F1`.** The renderer cached outline
+  fonts by resource name, so when a page and a form XObject it draws both name
+  a font `/F1` -- most generators name their first font that -- whichever ran
+  first drew both; GraphicsAbsorber measured text boxes through a second
+  name-keyed cache. Fonts are now cached by font dictionary, as Type 3 fonts
+  already were.
+
+- **Lab colour was painted as RGB, and Lab, Separation and DeviceN images as
+  their raw components.** The shared colour converter counted Lab's three
+  components and read them as red, green and blue, so `60 40 -30 sc` filled
+  yellow where pdfium and MuPDF paint mauve, and every Lab shading was wrong.
+  The image decoder knew grey, RGB, CMYK and device palettes and nothing else:
+  a Separation or DeviceN image's tints were drawn as grey or RGB, and a Lab
+  image or a palette over Lab, read as bytes over 255 when L\* spans 0-100,
+  came out near black. `optimize(image_compression_quality=...)` baked that
+  into the file -- a Lab photo was rewritten as a near-black DeviceRGB JPEG --
+  and `save_image` exported it. Lab now converts to sRGB as both references
+  render it (relative to the space's own white, unclamped by `/Range` for
+  fills; image a\* and b\* as the byte less 128; palette entries over the
+  base `/Range`), and one sample conversion serves the renderer, image export
+  (eager and streamed) and `optimize`, which agree pixel for pixel. A spot or
+  DeviceN image now joins the overprint preview as a fill in its space does.
+- **A palette image's `/Decode` rounded to an index.** Both references
+  truncate `Dmin + s * (Dmax - Dmin) / (2^bpc - 1)`: `[1 0]` on 8-bit samples
+  selects entry 1 for sample 0 and entry 0 for the rest, where every cell came
+  out as entry 1. Image export and `optimize` ignored a palette's `/Decode`
+  entirely, and `optimize` inverted an image with `/Decode [1 0]` twice once
+  its samples had been converted -- a Separation image came out as its
+  negative. The array is now applied once, wherever the samples are mapped.
+
+- **Type 3 fonts rendered as black boxes.** The renderer knew TrueType, Type 1
+  and CID fonts, and drew a placeholder box for any glyph it could not outline
+  -- including every Type 3 glyph, which is not an outline but a content
+  stream (ISO 32000-1 9.6.5). matplotlib's PDF backend writes Type 3 fonts by
+  default, so every title, axis label and tick number of a matplotlib chart
+  came out as a row of boxes; SVG export, a separate path, drew them right.
+  Glyph procedures now run under `FontMatrix * text space * Tm * CTM`, with the
+  font's `/Resources` (or the page's), advancing by `/Widths` with character
+  and word spacing, horizontal scaling and `TJ` kerning applied; a `d1` glyph
+  ignores its own colour operators and paints in the text's colour; a glyph may
+  show text in another Type 3 font. A real matplotlib chart and ten targeted
+  cases (colour, flipped and non-uniform font matrices, rotation, kerning,
+  widths, font resources, nesting, invisible text) agree with pdfium and MuPDF.
+- **Invisible text did not advance.** `Tr 3` returned before moving the text
+  matrix, so `3 Tr (hidden) Tj 0 Tr (seen) Tj` drew the visible word on top of
+  the invisible one -- in any font. It now takes up the room it always had.
+
+- **Check boxes written by MuPDF rendered empty.** MuPDF draws a check mark as
+  ZapfDingbats `(3)` and declares the font with `/Encoding /WinAnsiEncoding`.
+  The renderer overlaid that named Latin encoding on the font's built-in one,
+  so code 0x33 became the glyph `three`, which ZapfDingbats does not have, and
+  nothing was drawn -- on the live form and in the flattened copy alike. The
+  same happened to Symbol under any named base. pdfium and MuPDF keep the
+  built-in encoding for these two fonts whatever base is named, and now so do
+  we: WinAnsi, Standard and MacRoman render exactly like no `/Encoding`.
+  `/Differences` still apply, and are now read in the font's own glyph names
+  -- `a20`, the heavy check mark, is no Adobe Glyph List name and used to be
+  ignored -- through new code-to-glyph-name tables for both fonts (from their
+  Adobe AFM encoding vectors, checked to cover exactly the codes of the
+  existing Unicode tables). A difference naming a glyph the font lacks draws
+  nothing, as in pdfium.
+
+- **The renderer composed transforms in the wrong order.** ISO 32000-1 writes
+  `cm` as `CTM' = M * CTM`, `Td` as `Tlm = [1 0 0 1 tx ty] * Tlm`, a glyph
+  advance as `Tm = [1 0 0 1 tx 0] * Tm` and a form as painted under
+  `Matrix * CTM`: the newer matrix applies first. Ten sites applied it last.
+  Nothing showed while the transforms commuted, which is why no test or sweep
+  caught it; when they did not, a `cm` inside a scaled `cm` -- how Microsoft's
+  print-to-PDF places every image -- drew off the page, a word set with
+  `20 0 0 20 x y Tm /F1 1 Tf` piled its letters on top of each other, `Td` and
+  `T*` under a rotated or scaled `Tm` moved lines the wrong way, and any form
+  XObject with a scaling or rotating `/Matrix` vanished outright. A new helper
+  states the product in the specification's order, and a sweep of thirteen
+  non-commuting cases now agrees with pdfium and MuPDF to a pixel (it
+  disagreed on all thirteen before). `ImagePlacementAbsorber` had the same
+  inversion in its own helper, whose formula contradicted its docstring, and
+  reported such an image at its unscaled position. The glyph-box fallback for
+  an unresolvable font also drew nothing under a scaled `Tm`: its padding had
+  a floor of half a *text-space* unit, the whole box at size 1.
+- **One real written as `.8` made a document impossible to open.** ISO 32000-1
+  7.3.3 lists `-.002` among its own examples of a real, and MuPDF and
+  Ghostscript write them; the COS tokenizer recognised a number only by a
+  digit or a sign, so `/MK << /BG [1 1 .8] >>` in a MuPDF-written form failed
+  the whole file. And a number with nothing after it -- the last member of an
+  object stream, typically a stream's `/Length` -- sent the reference
+  lookahead past the end of the input, so the object was lost.
+- **Flattening replaced a form's own appearance with ours.** Every text and
+  choice field was rebuilt from its value before flattening, so a form from
+  another producer was flattened with a different drawing -- font sizes
+  changed, `/MK` rotation lost, a selection bar added to list boxes. A widget
+  that carries an appearance now keeps it, as 12.5.5 describes, and only
+  `/NeedAppearances true` rebuilds them; MuPDF renders its own form, flattened
+  here, pixel-identical to the live form.
+
+- **Saving a signed document broke its signatures, even unchanged.** `save()`
+  rewrote every document in full, and a rewrite moves every byte a signature
+  covers: open a signed PDF, save it without touching it, and pyHanko reports
+  the signature as no longer intact -- in a file whose `/SigFlags 3` still
+  declared *AppendOnly*, the flag ISO 32000-1 defines for exactly this. The
+  default is now to append: `incremental` defaults to `None`, which writes an
+  incremental update whenever the file carries signatures (the AppendOnly bit,
+  or a signed field), and a full rewrite otherwise. An untouched signed
+  document now saves back byte for byte; an edited one gains a revision on top
+  of the signed bytes and its signatures stay valid. Verified with pyHanko on
+  documents signed by this library and by pyHanko. `incremental=False` still
+  forces a full rewrite and now warns that it invalidates the signatures, as
+  does a save that must rewrite because the protection is changing.
+  **Behaviour change:** a signed document saved with default arguments is
+  now appended to rather than rewritten, so an optimisation run on one
+  (`optimize()` then `save()`) grows the file unless `incremental=False` is
+  passed.
+
+- **Changing a document's passwords lifted every permission restriction, and
+  `decrypt` accepted any password.** `change_passwords` re-encrypted with
+  `encrypt`'s defaults, so a document that forbade printing and copying came
+  out of a routine password change allowing both -- `/P` -4, confirmed with
+  qpdf on files from both qpdf and this library -- and moved to AES-256
+  whatever cipher it had used. It now keeps the permissions and the cipher and
+  changes only the passwords. `Document.decrypt(password)` checked its
+  argument behind a flag that is off after a load, so on any loaded document
+  `decrypt("anything")` took the protection off; it now accepts only the user
+  or the owner password, checked against the file's own `/Encrypt`, and
+  refuses the rest. Both methods now agree on which passwords count: either
+  of the document's, where `change_passwords` had accepted only the one the
+  document was opened with, and an owner password given to `encrypt` in this
+  session could not `decrypt` at all.
+
+- **A save that failed destroyed the file it was saving over.** Every PDF save
+  to a path wrote with `Path.write_bytes`, which truncates its target before
+  writing. Saving a document over the file it came from -- what
+  `overwrite=True` is for -- therefore erased the original the moment the
+  write began, and a write that then failed left nothing behind. Reproduced on
+  a real, nearly full volume: the save raised `ENOSPC` and the only copy of the
+  document was a **0-byte file** that no longer opened. Full saves, incremental
+  saves and the low-code plugins' file output now go through one writer that
+  stages the bytes beside the target, fsyncs them and renames them over it, so
+  the same save now fails with the same `ENOSPC` and the original is untouched,
+  with no staging file left behind. Symlinks, permission bits and the refusal
+  to write a read-only file behave as before.
+
+- **A streamed document converted to PDF/A came out non-conformant, and the
+  validator, also streamed, called it valid.** Three more paths read streaming
+  mode's deliberately empty content cache as though it were the document.
+  `convert_to_pdfa` iterated that cache to rewrite DeviceCMYK operators, so on
+  a document opened with `open_streaming` it rewrote nothing -- and left the
+  CMYK content under the sRGB OutputIntent it had just installed.
+  `validate_pdfa` skipped its device-colour scan of page content the same way,
+  so that exact file passed when opened streamed and failed when opened
+  eagerly: convert and check in streaming mode, and a non-conformant file is
+  reported conformant. And `repair()` padded the empty cache with one blank
+  entry per page, after which every page of the document read as empty. All
+  three now read each page through `get_page_content`; a streamed conversion
+  writes what an eager one writes (identical apart from IDs and timestamps,
+  pixel-identical under pdfium).
+
+- **HTML and Markdown export dropped every word inside a form XObject.**
+  Headers, footers and stamps usually live in forms, and the export's layout
+  analysis reads the page's own content stream, where a form is one `Do` -- so
+  those words vanished from `to_html` and `to_markdown` while `extract_text`,
+  which walks into forms, kept them: two of our outputs disagreeing on the same
+  page. Each text object a form shows now joins the page's own, positioned
+  where it lands (the form's `/Matrix`, then the CTM of its `Do`) so it sorts
+  into reading order, and decoded with the form's own resources, or the page's
+  where it declares none. Text is keyed by element rather than by byte offset,
+  since a form's offsets are into its own stream and collided with the page's.
+  Reading order matches MuPDF on every case tested: placed by `cm`, by
+  `/Matrix`, by both under a scale, nested, a footer drawn first. `replace_text`
+  still does not edit inside forms, and now says why: a form is often shared by
+  every page that shows it.
+
+- **Outlined text rendered solid.** Table 106 gives four rendering modes that
+  stroke a glyph -- `Tr` 1 (stroke), 2 (fill then stroke), and their clipping
+  twins 5 and 6 -- and the renderer had all four fall through to the fill. An
+  outlined headline or a hollow watermark came out as solid filled text, in the
+  *fill* colour, which mode 1 explicitly does not use. The glyph's outline is
+  now stroked with the stroke colour and the graphics state's pen; mode 2 fills
+  and then strokes; the clipping twins paint exactly as their counterparts.
+  Measured against pdfium and MuPDF, which agree with each other to within a
+  fraction of a percent on all eight modes, every mode now matches. The SVG
+  export already had this right, which is where the two disagreed.
+  Contours are closed before stroking: only the TrueType backend returns a
+  closed loop, so an embedded CFF or Type 1 glyph would otherwise be drawn with
+  one side of every loop missing.
+
+- **A document opened with `open_streaming` extracted no text, and could not
+  delete a page.** Streaming mode leaves `page_contents` empty on purpose --
+  content is decoded per page on demand -- but three paths read that list as
+  though it were the document. `extract_page_text` indexed it directly, so
+  every page of every streamed document extracted as `""`, silently, and
+  `Document.extract_text` counted it, so the whole document did too; the
+  page-text cursor reported no pages at all. `pages.delete` deleted from it
+  unconditionally and raised `IndexError: list assignment index out of range`
+  for **every index** — while the two parallel lists right below it were
+  already guarded for exactly this. Text now comes through `get_page_content`,
+  which serves both modes, page counts come from the pages, and deletion
+  shifts the page's identity without decoding anything: a streamed document
+  stays lazy through both. Deleting from a streamed document now matches the
+  eager path page for page across every deletion pattern tested.
+
+- **Metadata could not be removed at all: `doc.info.clear()` cleared nothing.**
+  The sync wrote every key it found in `Document.info` and never deleted one,
+  so `del`, `pop`, `clear()` and assigning a smaller dictionary all left the
+  file exactly as it was — a document stripped of its author and title before
+  being shared went out with both, and nothing said so. (`doc.info = {}` did
+  not even reach the sync, which returned early on an empty dictionary.) An
+  entry that is gone from the dictionary is now removed from `/Info`, on a full
+  save and on an incremental one; verified with pikepdf, exiftool and poppler,
+  which no longer see the stripped entries. An entry `Document.info` never
+  showed — an array, a dictionary, anything with no faithful text — is not
+  removed by editing what you could see, and a warning names what stayed
+  behind. `/Info` has one writer again: the title `convert_to_pdfa` adds goes
+  through `metadata` like everything else, rather than being written straight
+  into the COS dictionary where the next save would have taken it for a key the
+  caller had deleted.
+
+- **Opening a file and saving it turned its `/Trapped` flag into our own
+  `repr`.** Every `/Info` value that was not a string was read with `str()` on
+  the parser's object, so `/Trapped /True` arrived in `Document.info` as the
+  text `"PdfName(/True)"` and was written back as the *string*
+  `(PdfName\(/True\))`. No API call was needed: a plain load-and-save
+  destroyed it, and the same happened to a producer's own entries — a boolean
+  became `(PdfBoolean(True))`, an array became a string holding a list of
+  reprs. A consumer asking whether the document is trapped got a string that
+  cannot equal `/True`, which pikepdf confirms. One rendering rule now serves
+  both directions: a name reads as its text, a boolean as `true`/`false`, a
+  number as its digits, and a value with no faithful text (an array, a
+  dictionary) is left out of `Document.info` instead of being flattened into
+  it. On save an entry whose text has not changed is left exactly as the file
+  had it, whatever its type, and `/Trapped` is written as a **name** — `"true"`,
+  `"True"` and `"/True"` all reaching `/True`, an unrecognised value passed
+  through as a name, an empty one as the entry's own default `/Unknown`.
+  Verified with pikepdf and exiftool, which now read the flag they should.
+
+- **A metadata sync invented dates and wrote non-dates into date fields.** The
+  `/Info` ↔ XMP synchronisation read a PDF date with a regex that was anchored
+  only at the start and defaulted every missing component: `D:2026` — a legal
+  date meaning that year (ISO 32000-1 7.9.4 truncates from the right) — became
+  `2026-01-01`, and `2026-09-10`, an ISO date that had found its way into
+  `/Info`, became **`2026-01-01`**: a wrong date that looks right. A stray
+  digit (`D:202609100`), an hour of 30, trailing prose — all were read as far
+  as they parsed. And when conversion failed outright the raw text was written
+  into `xmp:CreateDate` regardless, so `"10 September 2026"` ended up in a
+  property that holds a date, in the packet PDF/A conformance is judged on.
+  Both converters now match the whole string, check that every component is in
+  range, and preserve precision in both directions (`D:2026` ↔ `2026`); the one
+  thing they pad is a lone hour, because XMP's shortest time is `hh:mm`. What
+  is not a date is refused, and the sync **skips** it with a logged warning
+  instead of copying it — the neighbouring properties still sync. Verified
+  against pikepdf, exiftool and poppler: all three agree with the new readings,
+  and pikepdf itself mangles 10- and 12-digit dates (`D:2026091008` →
+  `2026-09-01T00:00:08`) where the other two agree with us.
+
+- **`info['CreationDate'] = datetime.now()` failed at save time, three frames
+  down, naming nothing.** The document information dictionary maps names to
+  **text strings** (ISO 32000-1 14.3.3), dates among them written in the
+  `D:YYYYMMDDHHmmSSOHH'mm'` form of 7.9.4 — but nothing checked, so a
+  `datetime`, an `int`, a `None` or a non-string key travelled down to the COS
+  layer and died there with `PdfString value must be bytes or str` (or
+  `PdfName must be a string`) on `save()`, long after the assignment that
+  caused it and without naming the entry, the type it got or what it wanted.
+  The contract is now checked where `/Info` is written, so it cannot be
+  bypassed: the refusal is a `PdfValidationException` naming the entry and the
+  offending type, and a value that looks like a date is additionally told how a
+  PDF date is spelled — `value.strftime("D:%Y%m%d%H%M%S+00'00'")`, a suggestion
+  a test takes out of the message and round-trips, so it stays true. `str`,
+  `bytes` and `bytearray` are accepted as before.
+
+- **One circular reference in a page's resources cost the whole page.** A form
+  XObject whose own `/Resources` name that same form makes the resource graph
+  point back at itself — malformed, and writers do produce it. The converter
+  refused the whole graph, so the page lost its fonts, its images and its text;
+  and because the renderer converts a form's resources as it draws, `render()`,
+  `save_as_image()` and `to_svg()` **raised** rather than returning a page at
+  all. The offending edge is dropped now and everything beside it survives,
+  which is what pdfminer and MuPDF do; the drop is logged rather than silent. A
+  cyclic **page tree** is still refused: there is no document behind that one.
+
+- **Text drawn through a form XObject was not extracted at all.** A form is a
+  piece of content a page draws with `Do` (ISO 32000-1 8.10) — headers,
+  footers, stamps, and anything a layout tool reuses live in one. The renderer
+  walks into a form and so does the graphics absorber, but the text reader
+  consumed the `Do` operand and moved on, so a page whose words were all inside
+  forms extracted as empty. It walks in now, with the form's own `/Resources`
+  governing inside it and the page's standing in where a form declares none (or
+  declares an empty set, which older writers use to mean the same). Nested
+  forms are followed to a bounded depth, so a form that draws itself stops.
+  An **image** XObject is not a content stream and is not read as one, nor are
+  its samples inlined into the page's resources to look for words in them.
+  `extract_text`, `Document.extract_text` and the text absorbers all see a
+  form's text now; pdfminer and MuPDF agree.
+
+- **A subset of pages adopted the whole document's fields and layers.** The
+  rule for taking part of a document is written down — what belongs to the
+  pages comes, the document's own belongings do not — but two things came
+  regardless of whether the pages reached them. Every field of the source
+  `/AcroForm` was adopted, so a page split off on its own carried the *other*
+  pages' fields: controls listed in the form that no page in the document
+  draws, and nothing can fill. Every optional content group was adopted too, so
+  the same split carried layers nothing in it names — entries in a viewer's
+  layers panel that switch nothing on or off. A subset now takes a field only
+  when one of its widgets came, and a layer only when a page reaches it.
+  Whole-document merges are unchanged: every page comes, so everything is
+  reached, and a layer an author left empty or a field whose widgets were never
+  placed is theirs to keep — the same way attachments were already handled.
+
+- **An imported page kept its index into a structure tree it had left
+  behind.** A page's `/StructParents` and an annotation's `/StructParent` (ISO
+  32000-1 14.7.4.4) are keys into *their own document's* `/ParentTree`.
+  Merging does not carry the structure tree across — that is a reasoned
+  boundary — but the key came anyway. Merged into a tagged document, the
+  imported page arrived holding `/StructParents 0` and so claimed the target's
+  first page's headings as its own content, with two pages answering to one
+  entry; extracted or concatenated into a fresh document, it pointed at a
+  `/StructTreeRoot` that was not there. The page import drops both keys now.
+  Checked by reading the structure tree back with pdfium's own reader.
+
+- **`PdfFileEditor.insert` brought a page's drawing and nothing it drew with.**
+  It was the last of the model-only page copies, handing the engine a list of
+  page rectangles and a list of content bytes: the inserted page arrived with
+  no `/Resources`, so every font and image its content named resolved to no
+  object, and its annotations, links and form fields were dropped. `Document.
+  merge` and `PdfFileEditor.concatenate`/`extract` had already been moved onto
+  the real page import; this was the one left behind. It goes through the same
+  `SimplePdf.append` now, which grew an *at* so that inserting and appending
+  stay one routine rather than two, and an insert at the end is byte-for-byte
+  the document a merge produces. The model-only `insert_pages` had no callers
+  left and is gone.
+
+- **An incremental update to a file indexed by a cross-reference stream broke
+  the chain.** The update always appended a *classic* `xref` table, and ISO
+  32000-1 7.5.8.4 lets a classic trailer's `/Prev` name only a classic table —
+  so the chain pointed at something no reader can read as one. Everything
+  before the update was lost, and only a reader that gave up and rescanned the
+  whole file found the pages again. An update now writes the same kind of
+  section it chains to, written plain and unencrypted as 7.5.8.2 requires.
+
+- **An object stream answered for objects it no longer held.** Reading a
+  revision chain, inflating an object stream cached *every* member, including
+  numbers a later revision had re-issued as plain objects, so the stale copy
+  outranked the newer one for the life of the document. The rule — the newest
+  revision to mention an object owns it — was being applied to the plain xref
+  entries and not to these, nor to an object a revision had *freed*.
+
+- **A full save copied `/Prev` out of the source trailer.** A full rewrite has
+  no previous revision, so the offset pointed past the end of the file it was
+  written into, and reading it back fell into a full-file reconstruction scan.
+  Only the keys that name something in the file being written are carried now
+  — `/Root`, `/Info`, `/ID`, `/Encrypt` — which is the list its
+  cross-reference-stream sibling already used four lines away.
+
+- **Setting a form field's value left it drawing the old one.** An appearance
+  stream *is* what a reader draws: ISO 32000-1 12.7.3.3 lets it trust the
+  stream and never look at `/V` unless the AcroForm sets `/NeedAppearances`,
+  and this library writes `/NeedAppearances false` — a promise that the streams
+  are current. Assigning to `Field.value` wrote `/V` and stopped, so a filled
+  form showed its **authored** value in every reader that follows the rule
+  (a text field's stream still said `(Hello) Tj` after the value became
+  `CHANGED VALUE HERE`), while readers that regenerate anyway showed the new
+  one. The generator was already here — `generate_appearances()` runs it over
+  the whole form — and the setter now runs it over the one field it changed,
+  leaving every other field's appearance, including a hand-made one, alone.
+  Text, multiline, combo, list box, check box and radio all follow their value
+  now; verified with pikepdf and by rendering before and after in MuPDF.
+
+- **The two paths that build a field's inherited attributes had drifted.** The
+  bulk appearance generator never seeded `rv`, so a rich-text field reached
+  that way could not inherit an ancestor's `/RV` while the same field reached
+  while being authored could. There is one definition now.
+
+- **An annotation with no `/AP` was drawn as nothing.** ISO 32000-1 12.5.2
+  gives an annotation the properties its appearance is made of — a `Square`'s
+  `/IC` and `/C`, a `Line`'s `/L`, a `Highlight`'s `/QuadPoints` — and a reader
+  generates the appearance when the file does not carry one, which plenty of
+  writers do not. The library could already build them (`generate_appearances()`
+  writes them into the document); the *renderer* never asked, so every such
+  annotation was missing from a rendered page and from the SVG export. It asks
+  now, through a new `SimplePdf.build_annotation_appearance`, and throws the
+  stream away rather than editing the document it is drawing. Where pdfium and
+  MuPDF agree on what to draw — `Square`, `Circle`, `Ink`, `FreeText` — so do
+  we now.
+
+- **A note or attachment icon filled its whole rectangle.** 12.5.6.4 and
+  12.5.6.15: a `Text` or `FileAttachment` annotation's icon is a fixed size and
+  the rectangle does not scale it, so a 120-point box got a 120-point sticky
+  note where both readers draw a small one centred in the space. It is drawn at
+  twenty points now, which is where readers settle.
+
+- **A blend mode over bare page blended against paper that is not there.** ISO
+  32000-1 11.4.7: a page's contents are a transparency group, and that group is
+  *isolated* — it begins with nothing behind it, and the paper is joined once,
+  at the end. The canvas was the paper instead, opaque from the first pixel, so
+  `Screen` over bare page came out white where it should leave the colour
+  alone, and every other non-Normal mode was wrong in its own way wherever it
+  painted over nothing. The compositing formula already had the term for it
+  (11.3.8, `(1 - αb) · Cs`); it was simply never reached, because the page
+  canvas carried no alpha to be zero. It does now, and the finished page meets
+  the background in one pass at the end. All sixteen blend modes match pdfium
+  and MuPDF, over bare page and over paint alike.
+
+  The pass costs almost nothing: a pixel nothing reached still holds the
+  background it was filled with and a fully covered one needs no help, so only
+  partial coverage — `ca`/`CA` below 1, or a soft mask — is mixed, and a page
+  with none of it is finished by a single scan in C (0.6 ms on a 1.6-megapixel
+  supersampled canvas). Coverage is stored as the floor of the alpha rather
+  than rounded to nearest, so its complement is exactly the backdrop's share;
+  measured over thirteen `ca` values that agrees with pdfium on all thirteen,
+  where rounding agreed on nine.
+
+- **A pattern only painted path fills.** ISO 32000-1 8.7.3: a pattern is
+  selected with `scn`/`SCN` in a Pattern colour space, and from then on it *is*
+  the fill or the stroke colour. `SCN` was ignored outright, so a stroke drawn
+  with a pattern came out in whatever colour happened to be set — black on a
+  fresh page — and glyphs were filled straight from `fill_color`, so text
+  filled with a pattern (how a gradient headline is drawn) came out solid. Both
+  now paint the pattern, tiling and shading alike: a glyph hands over its
+  outlines the way a path hands over its subpaths, while a stroke — which has
+  no such path, only the area the pen covered — has its coverage collected as a
+  mask and the clip narrowed to it, after which the same tiler runs for all
+  three. Setting a plain colour, or a colour space, puts the pattern down again
+  (8.6.8), on the stroking side as well as the filling one. Verified against
+  pdfium and MuPDF.
+
+- **`BT` cleared the whole text state, which is graphics state.** ISO 32000-1
+  9.4.1 gives `BT` two jobs — the text matrix and the text *line* matrix — and
+  9.3.1 puts everything else a text object uses in the **graphics** state: the
+  font and its size, `Tc`, `Tw`, `Tz`, `TL`, `Tr`, `Ts`. Those outlive a text
+  object and are saved and restored by `q`/`Q`. Both readers reset all of it at
+  `BT`, so a page that selects its font once and then opens a text object per
+  line — which is how a great many generators write one — rendered every line
+  after the first at the 12pt fallback in the wrong face, and its text was
+  *extracted* with no font at all, silently dropping every character the
+  encoding was needed for (`café` came back as `caf`). A `TL` set in an earlier
+  object was lost the same way, so `T*` moved nowhere and ran two lines
+  together.
+
+- **Text rendering modes 4 to 7 did not clip.** Table 106: they add what they
+  show to the clipping path, which is applied once, at `ET`. The renderer
+  stored `Tr` and never looked at it past mode 3, so a text-shaped window — the
+  usual way to put a picture inside letters — clipped nothing and the picture
+  covered the page. Mode 7 now collects outlines without painting, the
+  accumulated glyphs intersect the clip at `ET`, and the result is graphics
+  state like any other clip, so `Q` restores it. A glyph that contributes no
+  outline (a space) still opens the window, and so leaves it empty; a showing
+  operator given an empty string builds no clipping path at all. Verified
+  against both pdfium and MuPDF.
+
+- **No filled path ever had a hole in it.** ISO 32000-1 8.5.3.3 settles which
+  points a path encloses by one of two rules, and the operator picks one — `f`
+  against `f*`, `B` against `B*`, `W` against `W*`. The rule belongs to the
+  *path*, not to any one subpath, because that is the point of it: a shape with
+  a hole is two subpaths and whether the hole is open depends on counting the
+  crossings of both. The renderer filled each subpath on its own, which is
+  neither rule, and dropped the star entirely — so a donut, a logo counter, a
+  letter drawn as vectors and a region clipped out with `W*` all came out
+  solid. Glyph outlines had their own correct nonzero filler, which is why type
+  looked right while artwork did not; that filler, the path fill, the clip
+  rasterizer and the shading fill are now one scanline pass that takes the rule
+  as an argument. The SVG export names the rule it uses (`fill-rule`,
+  `clip-rule`) instead of relying on the default. Verified against pdfium, and
+  the SVG against a browser engine.
+
+- **`/Mask` was ignored, so a masked image painted an opaque box.** ISO 32000-1
+  8.9.6 gives an image three ways to be transparent and it may use one:
+  `/SMask`, which was implemented, and `/Mask` in either of its two forms,
+  which was not. `/Mask` may name a **stencil**, whose set samples are the ones
+  *not* to paint — sampled over the image's unit square at whatever resolution
+  it has, with the sense stated by the stencil's own `/Decode` — or hold an
+  **array**, which is colour-key masking: `2 × n` bounds on the *raw* sample
+  values, dropping a pixel only when every one of its components falls inside
+  its own range. Both now produce the same per-pixel alpha map that `/SMask`
+  does, so the renderer and the SVG export needed nothing new to honour them,
+  and `/SMask` wins where a file writes both. A `/Mask` stream that does not
+  declare `/ImageMask true` is left alone, as table 89 requires it. Colour-key
+  masking is not applied to a `DCTDecode` or `JPXDecode` image, whose samples
+  are still a codestream at that point — 8.9.6.4 advises against keying a
+  lossily coded image anyway. Verified against pdfium.
+
+- **A stencil mask painted black instead of the colour that was set.** An image
+  with `/ImageMask true` is not a picture (ISO 32000-1 8.9.6.2): its one-bit
+  samples say where the *current fill colour* goes and where the page shows
+  through. The renderer decoded it as a one-bit grey image, so every stencil
+  came out black on white whatever colour was in force — and a stencil is how
+  scanned text, logos and Type 3 glyph bitmaps are drawn. It now paints the
+  fill colour, carrying that colour's own overprint behaviour with it, and
+  leaves masked-out samples untouched. The SVG export emits the same thing as
+  an RGBA image rather than a grey one.
+
+- **`/Decode` was collected and never read.** The array that says which
+  interval of its colour space a sample spans (8.9.5.2) reached the renderer's
+  image metadata and stopped there, so an inverted image rendered
+  un-inverted — including the `[1 0 1 0 1 0 1 0]` that Adobe CMYK JPEGs carry.
+  The image exporter honoured it for a single grey component and ignored it for
+  RGB, CMYK and Indexed. One implementation now serves the renderer, the SVG
+  export and the exporter: per component, at any bit depth, applied before the
+  colour conversion, and in *index* space for `/Indexed`, whose default range is
+  `[0, 2**bpc - 1]` rather than `[0 1]` because its samples are palette entries.
+  Verified against pdfium.
+
+- **An inline image's samples were read as content-stream tokens.** Between
+  `ID` and `EI` lie the image's bytes, and bytes spell whatever they happen to
+  spell — an operator nobody wrote, a name, an opening `(` that closes nowhere.
+  Lexed as tokens they were noise, and because a literal string runs to its
+  closing paren the noise usually swallowed the rest of the page: text drawn
+  after an inline image went missing from `extract_text()` and from the text
+  absorbers, and its marks went missing from the renderer, the SVG export and
+  the graphics absorber. The rule was implemented in exactly one place — the
+  layout reader behind `to_html()`/`to_markdown()` — and the tokenizer the
+  other four readers share did not know it. Both now go through one module,
+  which also applies the rule ISO 32000-1 8.9.7 gives for finding the end of
+  the data: unfiltered samples occupy exactly
+  `ceil(Width × BitsPerComponent × components / 8) × Height` bytes, so the
+  common case needs no searching for a free-standing `EI` — which samples can
+  imitate, and do. A declared length is still checked against the `EI` that
+  should follow it, and only a filtered image falls back to the search.
+
+### Added
+
+- **Inline images are painted.** `BI … ID … EI` reached the renderer as
+  nothing at all; the abbreviated dictionary is now expanded to the image
+  XObject it is a short spelling of (`/W` → `/Width`, `/Fl` → `/FlateDecode`,
+  `/RGB` → `/DeviceRGB` and the rest of table 93) and painted by the same code
+  as `Do`, including a `/ColorSpace` that names an entry in the page's
+  resources. Verified against pdfium across raw, Flate, ASCIIHex, ASCII85 and
+  RunLength data, 1/4/8 bits per component, grey, RGB, CMYK and Indexed
+  colour.
+
+- **Words ran together in text extracted from kerned `TJ` arrays.** The
+  displacements between a `TJ` array's strings are kerning inside a word or the
+  space between words, and telling them apart needs to know how wide the glyphs
+  are. A Standard 14 font is normally written *without* a `/Widths` array, its
+  metrics being the reader's to know, and the extractor then assumed 1000 units
+  for every glyph — about four times a typical lowercase letter — putting the
+  word-gap threshold four times too high. Ordinary word spacing was read as
+  kerning, so `Hello world` came out as `Helloworld`. The bundled
+  metric-compatible substitutes already answer this for the appearance
+  builders, which measure text with them to wrap and centre it; the extractor
+  asks them too now, and matches pdfminer across Helvetica, Times, Courier and
+  their bold and italic cuts.
+
+- **Extracted text had no lines, and the absorbers found no text at all.** The
+  content-stream reader answered every text-positioning operator with a space —
+  `Td`, `TD`, `Tm` and `T*` alike — though those four both start a new line and
+  shift along the one in progress. The line structure was discarded at exactly
+  the point where it was known, so a page of prose came out as one very long
+  line. The separator is now chosen where the text is *shown*, from the baseline
+  it is shown at. Alongside it, `'` (show on the next line) was declared as
+  taking three operands where ISO 32000-1 table 109 gives it one, so the
+  operator was skipped for want of operands and every line it drew was lost.
+
+- **`TextFragmentAbsorber` and `TextAbsorber` collected nothing from a real
+  document.** They look for an `extract_text()` method, and neither `Page` nor
+  `Document` had one — a hundred tests passed on them because every one fed a
+  stub with a `.text` attribute, and not one used a `Document`. Both now have
+  the accessor, sharing the single per-page routine that the whole-document
+  extractor and the page-at-a-time cursor also use instead of each repeating it.
+
+- **`add_text` drew the wrong glyphs for anything but ASCII.** The string in a
+  text-showing operator is a sequence of *codes*, and a simple font gives each
+  code a glyph through its encoding. `add_text` wrote the text's UTF-8 into one
+  and declared no encoding at all, so the font fell back to its built-in
+  StandardEncoding and drew whatever glyphs those bytes named: `café` came out
+  with two wrong letters where the accent was, `100€` with three, Cyrillic as a
+  row of Latin nonsense. Nothing failed and nothing warned, and reading the page
+  back through this library hid it because the extractor made the same
+  assumption — pdfminer and Acrobat did not. The font now declares
+  `WinAnsiEncoding` and the text is encoded into it, by inverting the very table
+  the reader resolves codes through, so what is written and what is read back
+  agree by construction. A character that encoding has no code for is refused,
+  naming it and pointing at `font=`, rather than drawn as a different one.
+  `Symbol` and `ZapfDingbats` keep their built-in encoding, which declaring a
+  base encoding would have replaced.
+
+- **`validate()` called every conforming document invalid, and broken ones
+  valid.** The structural check walked the object graph and rejected it if any
+  node was reachable from itself. A PDF object graph is not a tree: a page's
+  `/Parent`, an annotation's `/P`, an outline's `/Prev` all point back, and
+  `/Parent` is *required* on every page (ISO 32000-1 7.7.3.2) — so `validate()`
+  and `check()` returned `False` for every document this library wrote, and
+  deleting the required entry made them return `True`. They returned `True` for
+  genuinely broken files too, because what is actually wrong there is still a
+  perfectly traversable graph: a page missing from its parent's `/Kids` is never
+  reached, and a catalog whose `/Pages` names nothing simply ends the walk. The
+  walk now only has to terminate, and what makes a page tree a page tree is
+  checked directly — `/Count`, `/Parent` membership, no node reached twice, a
+  `/MediaBox` on every page.
+
+- **`repair()` left a salvaged document claiming a page it did not write.** The
+  page sync refused to add anything when the object graph had no pages yet, on
+  the grounds that there might be no page tree to add to. A document repaired
+  from a truncated file has one — an empty one — and pages in the model that
+  belong in it, so it saved with `/Count 0` while reporting one page. What
+  decides is now whether there is a tree, and `repair()` runs the sync after
+  making sure there is. Found by the fixed `validate()` on its first outing.
+
+- **The file-based editor workflows went through a second merge that lost the
+  same things `Document.merge` used to.** `PdfFileEditor.concatenate` and
+  `.extract`, and the low-code merger and splitter behind them, called a
+  different implementation: it built a fresh model from page rectangles and
+  content bytes, pooled the sources' images into one renamed namespace, and
+  rewrote the content streams to match. A concatenated page had no `/Resources`
+  of its own, every page in the result carried every image in it, and
+  annotations were dropped. Both are the same operation as appending a
+  document's pages, and are now the same code. Extraction adds one rule to it: a
+  subset of pages is a different document, so what belongs to the pages comes
+  and the document's embedded files do not, and a bookmark comes only if the page
+  it points at did — remapped to where that page landed, which also makes
+  extracting pages in a new order work. The content-stream renaming module the
+  old merge needed is deleted; nothing renames anything now.
+
+- **Every saved file was missing the comment that marks it binary.** A PDF that
+  holds binary data puts a comment of at least four bytes above 127 immediately
+  after `%PDF-x.y` (ISO 32000-1 7.5.2), so that a transfer in text mode or an
+  editor weighing line-ending translation copies the bytes as they stand.
+  ISO 19005-1 6.1.2 requires it, and this library wrote none — so every file it
+  produced failed PDF/A-1 on its second line, and its own conformance check
+  never looked, reporting a freshly converted PDF/A-1b document as having no
+  issues at all. All three writers emit it now, and the checker reports its
+  absence as a warning: it is the one requirement here that is not a property of
+  the object graph, since a full save supplies one and an incremental save,
+  which keeps the original bytes as its prefix, does not.
+
+### Added
+
+- **The PDF/A checker enforces the implementation limits.** ISO 32000-1 annex
+  C.1, which ISO 19005-1 6.1.13 adopts: a name of more than 127 bytes, a string
+  of more than 65535, an integer past ±2,147,483,647. A conforming reader is not
+  obliged to handle any of them, so a file that needs it to is not archivable —
+  and all three passed the checker in silence.
+
+- **A number too small or too large was written in a notation PDF does not
+  have.** A real is decimal digits with a period, and exponential notation is
+  not permitted (ISO 32000-1 7.3.3); Python writes small and large floats as
+  `1e-05` and `1.5e+20`, and the COS writer handed those straight to the file,
+  where `e` starts a keyword rather than continuing a number. Setting a crop box
+  a little too small was enough to produce a document this library could not
+  reload. Two neighbouring faults went with it: an infinity or a NaN was written
+  as the word Python names it by, and a whole number past +/-2,147,483,647 was
+  written without a period — an integer token outside the range annex C.1
+  guarantees, which qpdf resolves to null, silently deleting the annotation that
+  held it. Content streams had the rule right in their own function all along;
+  both paths share it now.
+
+- **A name containing a space or a delimiter produced a file nothing could
+  read.** A PDF name escapes any byte that is not a regular character as `#`
+  followed by two hex digits (ISO 32000-1 7.3.5); this library wrote the bytes
+  as they were. A space, a bracket or a parenthesis *ends* a name, so a document
+  with one anywhere came out unparseable — by other tools and by this library
+  itself, which raised `Unexpected token` on reloading what it had just written.
+  Reading was the mirror: `#20` was taken for three characters, so a name
+  another producer escaped came back wrong. Both are reachable from the public
+  surface wherever a caller names something — an annotation property's key, or
+  a value marked with `annotations.Name`. One place had noticed and fixed it for
+  itself, with a private pair of functions that escaped an attachment's media
+  type; those are gone, because a name now escapes whatever it holds.
+
+- **Non-Latin text was written in an encoding no other reader could decode.** A
+  PDF text string is PDFDocEncoded or UTF-16BE behind a `FEFF` byte order mark
+  (ISO 32000-1 7.9.2.2). This library wrote raw UTF-8, which is neither, so a
+  conforming reader took those bytes for PDFDocEncoding: every non-Latin title,
+  bookmark, annotation, field value and attachment name it produced showed as
+  mojibake in Acrobat and in every other tool. Reading its own files back hid it
+  completely, because the reader made the same assumption. Field names were the
+  exception — they went through the one encoder that was right — and that
+  mismatch is what made it visible from inside: the field-value setter matched
+  names with a hand-rolled UTF-8 decode, so `form["Ф"].value = "V"` found no
+  field, wrote nothing, reported success, and the value was gone after a save.
+  There is now one encoder and one decoder, used everywhere a text string is
+  written or read; the decoder also accepts UTF-16LE and marked UTF-8, which
+  other producers write. Checked against pikepdf in both directions.
+
+- **Merging a document brought across a tracing of its pages, not the pages.**
+  `Document.merge` copied each page's rectangle and its content bytes and
+  nothing else. A page without its `/Resources` names fonts and images that
+  resolve to no object, so it drew blank — or, worse, drew with whatever the
+  *target* had registered under the same name, which for two documents built by
+  this library is always `/F1`: merged text rendered in the wrong typeface with
+  nothing to show that anything was wrong. Everything else was dropped in
+  silence — annotations, form fields, bookmarks, attachments, layers. A page is
+  now imported: its dictionary is copied into the target's graph with every
+  object it reaches, once each, references remapped, and attributes inherited
+  from an ancestor of the source's page tree resolved onto it. The structures
+  those pages belong to come with them, since a widget whose field is not in
+  `/AcroForm /Fields` is a control the form does not know about, and an
+  optional content group missing from `/OCProperties` is not a layer any viewer
+  offers to switch. A field or attachment name used by both documents is given
+  to the newcomer under a numbered variant rather than replacing what is there.
+  The source document is untouched and shares no object with the result, and
+  merging no longer takes the other document's title.
+
+- **Opening a document and saving it rewrote every bookmark.** The outline model
+  read a bookmark back as one number — the index of the page its `/Dest` named —
+  and wrote it out again as "fit that page". A `/XYZ` view lost its position and
+  zoom; a bookmark carrying an *action* lost the action altogether and became a
+  jump to page 1. Nothing warned, and no structure check could notice, because
+  "fit page 1" is a perfectly well-formed destination. An index is also not an
+  identity: deleting or inserting a single page silently repointed every
+  bookmark past it, while link annotations — which keep the page *reference* —
+  were never affected. A bookmark loaded from a file now carries the target the
+  file held, verbatim, and that is what gets written back; naming a target
+  through `page_index` or `destination` replaces it. `OutlineItem.destination`
+  also reads the target back typed, so a bookmark's action or view can be
+  inspected and not only written.
+
+- **A literal string lost its parentheses and backslashes.** Inside `( ... )` a
+  backslash introduces an escape (ISO 32000-1 7.3.4.2); the reader consumed the
+  backslash *and* the character after it and kept neither. Since `\(`, `\)` and
+  `\\` are exactly what the writer escapes, any title, bookmark label,
+  annotation, field value or script containing a parenthesis or a backslash came
+  back short of them — a document could be opened and saved with its own text
+  quietly edited. The other escape forms had never been read at all: `\ddd` is
+  an octal byte, a backslash before an end-of-line joins the lines, and an
+  end-of-line without one is a single line feed however the file writes it. The
+  value is now assembled as bytes, so a high byte is the file's byte rather than
+  the UTF-8 of the character it resembles in Latin-1. Checked against pikepdf
+  over every escape form.
+
+- **An internal link can be read back.** `Page.annotations` raised
+  `Annotation property graph contains a cycle` for any link pointing at a page
+  of the same document — the commonest annotation there is — and because the
+  failure happened while building the collection, no annotation on that page
+  could be read at all. The property channel turns an annotation entry into
+  plain Python and resolves indirect references as it goes, so a `/Dest` pulled
+  in a copy of the page it named; that page lists the annotation holding the
+  destination, and the walk came back to where it started. A `/Dest`, or the
+  `/D` of a `/GoTo` action, now reads back as the `aspose_pdf.interactive`
+  destination it was written from, carrying the page index, and writing that
+  property back reproduces the page reference. A remote (`GoToR`) destination
+  keeps naming its page by number, since it belongs to another file.
+
+- **A link or bookmark written after inserting a page pointed at the wrong
+  one.** Both places that turn a page index into a page reference read
+  `_page_obj_ids`, a list kept by hand alongside the edits, which carries a `0`
+  placeholder for an inserted page until the next save: every page after the
+  insert was off by one, and a destination naming the inserted page itself was
+  written as `0 0 R` — the head of the free list (ISO 32000-1 7.5.4), never a
+  real object, so the link led nowhere. Both now resolve the page by walking
+  the page tree, which is right at every moment, and share one helper.
+
+### Added
+
+- **An encrypted save keeps the document it was given.** Encryption lived only
+  in the legacy writer, which rebuilds a file from an in-memory model, so
+  encrypting a loaded document silently discarded its form fields, attachments,
+  optional content and marked content — everything the model does not carry.
+  The COS writer applies the security handler itself now, enciphering each
+  object's strings and stream payload as it serialises them, so encryption is a
+  property of the bytes rather than a different way of writing the file. The
+  entries that have to stay readable stay readable: the `/Encrypt` dictionary
+  (a reader needs it *before* it has a key), the cross-reference stream, a
+  signature's `/Contents`, and `/Metadata` under `/EncryptMetadata false`.
+  Object streams work under encryption too — the `/ObjStm` is enciphered whole,
+  under its own object number, with the strings inside it left alone.
+  `optimize()` no longer switches off font subsetting, image recompression and
+  content de-duplication on an encrypted document; those were disabled because
+  the graph used to hold ciphertext, which it no longer does.
+
+- **`Document.update_attachment` changes one embedded file without replacing
+  it.** `add_attachment` supersedes an entry outright, so re-adding a name to
+  change its description silently dropped the MIME type, dates and
+  relationship the file already carried — and there was no other way to edit a
+  single field. An argument left out is now left alone, `new_name=` renames
+  (carrying the metadata across, and refusing to replace a different
+  attachment), and the resulting `FileSpecification` comes back.
+
+- **A form field's rich text is drawn in the font the field declares.** The
+  markup was laid out in a Standard-14 face whatever the `/DA` named, so a form
+  using an embedded brand font rendered visibly wrong type. Runs asking for
+  exactly that face now use it by reference to the form's own `/DR` resource,
+  measured with its `/Widths`, so wrapping follows the real advances too; a run
+  wanting bold, italic or another family still falls back to the Standard 14 of
+  the matching family, since an arbitrary embedded face has no bold sibling. A
+  Type0/CID field font is deliberately left out: its appearance is written in
+  CID codes, and drawing PDFDocEncoded literals with it would mis-encode every
+  word.
+
+- **Existing content can be put on a layer.** A layer could be created and
+  content authored onto it inside a `Page.layer` block, but a watermark, a
+  stamp or a reviewer's comments already in the document had no way onto one at
+  all. `Layer.add(content)` tags an `Annotation` or an `ImagePlacement`,
+  `Layer.remove` takes the tag off — only its own, so removing one layer never
+  reveals content belonging to another — and `Layer.contains` reports
+  membership, counting content that reaches the group through an `/OCMD`. The
+  renderer already honoured `/OC` on annotations and XObjects, so switching the
+  layer off stops drawing them immediately.
+
+- **Rich text is no longer stuck in Helvetica.** `/RC` and `/RV` markup now
+  honours `font-family`, choosing among the Standard 14 text faces — Helvetica,
+  Times and Courier, each in regular, bold, italic and bold-italic — and the
+  HTML monospace tags (`<tt>`, `<code>`, `<kbd>`, `<samp>`) select Courier. A
+  font stack takes the first name it recognises, and a name that signals no
+  family leaves the run with the one it inherited rather than resetting it to
+  the default. Each family is measured with its own advances, so wrapping and
+  alignment are right for Times and for fixed-pitch Courier instead of using
+  Helvetica's widths for all three. A form field's `/DA` font seeds the family
+  that markup naming none inherits, so a field declared in Times renders its
+  styled spans in Times.
+
+- **PDF/A-4 now checks that an attached PDF is PDF/A itself.** ISO 19005-4 6.9
+  requires it — an attachment has to declare `pdfaid:part` 1, 2 or 4, with part
+  3 deliberately absent because carrying arbitrary files is what PDF/A-3 is
+  *for* — and only the `"4f"` level lifts the rule; `"4e"` adds 3D and rich
+  media and nothing else. Validation reads the attachment's declaration and
+  then checks it against the same rules as any other document, so one that
+  merely claims PDF/A does not pass, with each problem named for the file it
+  came from. Whether an attachment is a PDF is decided by its bytes rather than
+  by the MIME type its producer declared. The structural half descends two
+  levels; below that the declaration is taken at its word and a warning says
+  so.
+
+- **An encrypted document can be saved incrementally.** `save(incremental=True)`
+  refused any encrypted document; it now appends a revision enciphered with the
+  file's own key, keeping `/Encrypt` in the new trailer, so the original bytes
+  — and any signature over them — stay untouched. Changing the protection is
+  still refused, and now says why: adding it, removing it or changing the
+  password re-keys every object, and the ones in the preserved prefix cannot
+  follow. Building a `/DSS` into an encrypted document is refused for the same
+  kind of reason, rather than writing validation material nobody can read.
+
+- **A signed document can be encrypted.** Signing an encrypted document used to
+  fall back to the rebuilding writer, losing the same structure. It now takes
+  the same path as any other signature — an appended revision over the saved
+  bytes — enciphered with the file's own key, with `/Contents` written over it
+  in the clear as ISO 32000-1 7.6.2 requires. pyHanko validates the result as
+  covering the entire file, with the document's form fields still present.
+
+- **`convert_to_pdfua(part=2)` moves the tag tree into the standard structure
+  namespace.** It declared the namespace on the structure root and stopped
+  there, so a tree carried over from part 1 kept the unqualified types
+  ISO 14289-2 replaced: the declaration says the namespace exists, an element's
+  `/NS` says its type comes from it. Every element now names it, an element
+  that already names a different namespace keeps it, and `validate_pdfua(2)`
+  reports the ones that do not — after the root declaration, so the thing to
+  fix first is not buried.
+
+- **A render can say where it spent its time.** Pass a `PerformanceLogger`
+  (`aspose_pdf.visualization`) to `Page.render()` and it records seconds per
+  phase into a dictionary you own — nothing is timed without one, so a plain
+  render pays nothing, and two renders in different threads keep their own
+  numbers. This is what that class was for: it was a working stopwatch that
+  nothing in the package ever fed. `VirtualizationPerformance`, the
+  process-global one beside it, stays a caller-only stopwatch — a library that
+  timed itself into module-level state would interleave two documents rendered
+  at once.
+
+- **CI cross-validates the library's output against an independent
+  implementation.** Every other test asks whether the library agrees with
+  itself; a new `cross-validate` job asks whether qpdf agrees — it parses and
+  rewrites documents covering layers, tagging, PDF/A-4, PDF/UA-2, optimization
+  and signing, and reads their structure back out (including that a signature's
+  byte range really covers the whole file). `tests/test_cross_validation.py`
+  skips when pikepdf is absent, so a plain checkout stays green. The same job
+  writes one conformance sample per level with
+  `scripts/write_conformance_samples.py` and runs veraPDF over them, publishing
+  its report as an artifact — advisory rather than gating, because the useful
+  output is which rules a sample fails.
+
+- **`auto_tag` sees four shapes it used to miss.** A table row may now leave a
+  column **blank** (it gets an empty `/TD`, so the cells after it stay in their
+  own columns instead of shifting left) and a cell reaching past the next
+  column is a **merge** carrying `/ColSpan`, which the HTML export writes as
+  `colspan`. A **wide-gutter table** is no longer cut into page columns first:
+  a clear gap whose text fills less than a third of the band, with content on
+  both sides of every line, is a table's column gap, and splitting it read the
+  rows inside out. A list item indented past the one before it opens a
+  **sub-list** inside that item's `/LBody` rather than continuing flat. And a
+  list whose markers are **drawn rather than typed** — a glyph-sized image
+  beside each line — becomes an `/L` whose items carry the image as their
+  `/Lbl`, instead of loose paragraphs with pictures between them.
+
+- **PDF/A-4 and PDF/UA-2 — the PDF 2.0 conformance parts — are validated and
+  produced.** Both are defined *on* PDF 2.0 rather than capped by it, so the
+  header is required to be exactly 2.0 and conversion raises an older one.
+  ISO 19005-4 dropped the accessible/basic/unicode split: the levels are `"4"`
+  (no conformance letter at all), `"4e"` (engineering — the level that exists
+  to permit 3D and rich media) and `"4f"` (embedded files of any type), plus a
+  required `pdfaid:rev` of 2020. ISO 14289-2 adds a `pdfuaid:rev` of 2024 and
+  the PDF 2.0 standard structure namespace in the struct root's `/Namespaces`;
+  reach it with `validate_pdfua(part=2)` and `convert_to_pdfua(part=2)`.
+
+- **A signature field's `/SV` seed value is honoured, not just read.** It is
+  the field author's instruction to whoever signs, and only `/SubFilter` and
+  `/Reasons` were checked — a field demanding SHA-512, a particular handler, a
+  timestamp or a certifying signature got one that quietly ignored the demand.
+  Every entry now either binds or is refused, and several are *followed*:
+  `/DigestMethod` picks the digest (SHA-1 and RIPEMD160 are refused rather than
+  silently downgraded to), `/TimeStamp /URL` supplies the authority when the
+  caller named none, and `/LockDocument /true` makes the signature certify.
+  `/MDP` binds regardless of `/Ff`, being the one entry with no flag.
+  `Form.add_signature_field(seed_value=…)` can author all of them.
+
+- **Whole-document signing and field signing are one path.**
+  `SimplePdf.signing_creds` used to synthesise its own field and patch its own
+  byte range inside the legacy writer, which meant a signed save rebuilt the
+  file from the in-memory model — silently dropping form fields and anything
+  else only the COS writer preserves. It now authors a field (or reuses one the
+  caller already authored, seed value and all), saves normally, and fills it
+  with `sign_field`.
+
+- **Layers resolve for printing and exporting, not only for the screen.** A
+  group's `/Usage` dictionary says what it should do for an event and the
+  configuration's `/AS` usage application dictionaries are what apply it —
+  neither was read, so a watermark marked "do not print" printed anyway.
+  `Document.layers.resolve("Print")` now reports the states an event calls for
+  and `apply_usage("Print")` adopts them, which makes flattening a print copy
+  actually drop the watermark. `Layer.set_usage(printing=False)` writes both
+  halves, because a `/Usage` entry no `/AS` entry mentions changes nothing.
+  Zoom ranges and BCP 47 language tags are evaluated when a magnification or
+  locale is supplied, and left alone when one is not.
+
+- **Alternate optional content configurations are listed and can be applied.**
+  `Document.layers.configurations` reports `/D` and every `/Configs` entry with
+  the layers it shows and locks, `apply_configuration(name)` adopts a preset as
+  the document's state, and `save_configuration(name)` snapshots the current
+  states as a new one. Removing a layer now also purges it from the alternates
+  and from the usage applications, instead of only from `/D`.
+
+- **The optimizer subsets the last two font kinds it left whole.** *CFF2*
+  (`/FontFile3` with `/Subtype /OpenType`, PDF 2.0) is now erased glyph by
+  glyph like every other embedded program, as a CIDFontType0 or as a simple
+  font resolved through the sfnt's own `cmap`. CFF2 removed `endchar`, so an
+  erased glyph there is a zero-length charstring, and its advance width — which
+  CFF2 keeps in `hmtx` — is untouched. The `FDArray`/`FDSelect`, each Font
+  DICT's `Private` and the `ItemVariationStore` move with it, so a subset
+  variable font still instantiates; verified against fontTools at four weights.
+  *MacExpertEncoding* is now bundled alongside Standard/WinAnsi/MacRoman, as
+  are the predefined **Expert** and **ExpertSubset** CFF charsets, whose glyph
+  ordering the specification fixes rather than the font storing it. A
+  `/BaseEncoding` outside the four names PDF 32000-1 allows still keeps the
+  font whole — that name is malformed rather than unsupported, and guessing
+  which was meant could erase a used glyph.
+
+- **An Expert-encoded CFF or Type 1 font draws real glyphs instead of boxes.**
+  The same two tables the optimizer needed are what the renderer was missing:
+  a font under `/MacExpertEncoding` now resolves its oldstyle figures and small
+  caps through its charset, and extracts as text through the Adobe Glyph List.
+
+- **A variable CFF2 font can be drawn at a chosen instance.** The
+  ItemVariationStore's regions are read, `fvar` supplies the axes (with `avar`
+  applied) and each `blend` resolves to `default + Σ scalar x delta`, verified
+  against fontTools' own instancer. Substitute faces use it to reach a style:
+  a modern system font ships as one variable file rather than four static
+  ones, so asking for Bold now moves the `wght` axis instead of settling for
+  the default master.
+
+### Fixed
+
+- **Inserting an existing page produced a blank one.** `pages.insert(index,
+  page)` is documented as taking an existing page, but carried over only the
+  media box and the content bytes: the new page named fonts and images that
+  were not in *its* resources, so every reference dangled, nothing was drawn,
+  and no structural error showed for it — annotations were dropped too. A copy
+  now keeps the page's resources, rotation and boxes, takes its own content
+  stream so the two can be edited apart, and gets fresh copies of the
+  annotations (widgets excepted: one is a form field's presence on a page, and
+  duplicating it would put a single field in two places). A page from another
+  document is refused rather than half-copied — `Document.merge` is what brings
+  pages across.
+
+- **A rich-text field whose widget was a separate object never showed its
+  markup.** `/RV` is a field-level entry, like `/V`, so a field with its widget
+  under `/Kids` — which is what this library's own `Form.add_text_field`
+  produces — keeps it on the field. It was read off the widget alone, so every
+  such field rendered its plain `/V` and the markup was never seen. It is now
+  inherited down the field tree beside `/V`.
+
+- **Opening a document and saving it made the file bigger, every time.**
+  Outlines and attachments live in the model, not the COS graph, and are
+  rebuilt on each save — claiming fresh object numbers as they went, so four
+  objects and several hundred bytes of superseded copies accumulated per round
+  trip. An incremental save was worse: an object rebuilt under a new number can
+  never compare equal to the one it replaces, so the whole tree was appended
+  every time. Each rebuild now takes over the numbers its previous copy
+  occupied, which makes an unchanged save byte-for-byte identical and an
+  unchanged incremental save append nothing whatsoever.
+
+- **Saving a loaded document dropped every attachment's MIME type, description
+  and dates.** They were read into the model at load and then ignored by the
+  writer, so a round trip silently discarded them — and, incidentally, kept an
+  otherwise untouched document from reproducing itself. What the file carried
+  is now written back out, with anything the caller set taking precedence.
+
+- **Every appended revision this library wrote had a malformed cross-reference
+  section.** Entries are read by offset — a fixed twenty bytes each — and one
+  byte too many put every entry after the first in a subsection out of step.
+  Only the first still read, which is why a signature (whose appended objects
+  are rarely consecutive) looked fine while an incremental save of two
+  neighbouring objects did not: qpdf reported the file as damaged and rebuilt
+  the table. The unit test measured each line after splitting on newlines, so
+  it saw twenty bytes where the file had twenty-one; it now measures the
+  section the way a reader indexes into it.
+
+- **Re-saving a document opened with a password destroyed every string in it.**
+  Strings are decrypted at load; without the writer putting the cipher back
+  they were emitted in the clear under a trailer that still declared
+  `/Encrypt`, so every reader dutifully "decrypted" them into noise — a title,
+  a field name, a bookmark, an attachment name. qpdf read the title of such a
+  file as an empty string. The writer now re-enciphers what it emits, and
+  `tests/test_cross_validation.py` checks the result against qpdf.
+
+- **A cross-reference stream with a PNG predictor could not be read at all.**
+  `/Predictor 12` is what qpdf, Ghostscript and Acrobat write, so this is the
+  shape most real cross-reference streams have. Two things stopped it: the
+  decode limit was sized to the entries rather than to the predictor'd rows
+  inflate actually produces, so the stream was rejected as oversized, and
+  `/DecodeParms` reached the filter layer as a COS dictionary, whose
+  `get("Predictor")` misses — the predictor was skipped in silence and the
+  entries read one byte out of step. Object streams were unreachable in such a
+  file as a result.
+
+- **`Document.decrypt(password)` did not remove the protection.** It unlocked
+  the document for reading and left `/Encrypt` in place, so the next save wrote
+  an encrypted file — and, before the fix above, a corrupt one. It is the
+  counterpart of `encrypt` again: the dictionary goes, `/O` and `/U` with it,
+  and the next save is a plain file.
+
+- **`MacRomanEncoding` was the Mac OS Roman character set, not the table PDF
+  defines.** All 256 codes carried a name, where Annex D.2 defines 208 and
+  leaves the rest to the font's own encoding — and once a name resolves,
+  nothing looks at the font again. A font whose encoding put something else at
+  `0xB0` had the glyph named `infinity` kept and the glyph it actually shows
+  erased. The base table is now PDF's (with `space`, not `nbspace`, at `0xCA`),
+  and the 36 extra Mac OS Roman names that are real glyphs are kept as a
+  supplement consulted *after* the font — where they still resolve the codes a
+  Mac-produced font leaves to convention.
+
+- **`IPath` accepted path segments and dropped them.** The compatibility
+  surfaces are meant to be constructible but to raise when used, so a caller
+  finds out at the call rather than from a blank page;
+  `IPath.append_cubic_bezier_curve` silently did nothing instead. It now raises
+  `UnsupportedFeatureException` like every other placeholder. `FillMode` and
+  `IMatrix` beside it are genuine value objects and are unchanged.
+
+- **Pages were written without a resource dictionary.** `/Resources` is
+  required and inheritable (ISO 32000-1 table 30), and qpdf reported every
+  document this library produced as needing repair. It now goes on the page
+  tree root, where a page that has none inherits it — putting an empty one on
+  each page instead would shadow whatever a caller hung on an ancestor.
+
+- **PDF/A-3 rejected the embedded files it exists to carry.** The check
+  compared the requested level against the literal `"3"`, which no real level
+  string ever equals, so `"3b"` fell on the prohibited side along with
+  PDF/A-1 and -2. Asking for a PDF/A level that does not exist (`"4a"`, a typo)
+  no longer falls back to PDF/A-1b either, which used to write metadata
+  claiming a level nobody asked for.
+
+- **A signature's `/ByteRange` left the `/Contents` delimiters inside the signed
+  ranges.** Excluding only the hex digits still yields a verifiable signature,
+  but a validator matches the gap against the `/Contents` string to prove the
+  signature covers the document — and could not, reporting the coverage as
+  indeterminate instead of "entire file" (confirmed with pyHanko before and
+  after). The gap now runs from the `<` through the `>`.
+
+- **A signature dictionary was written as `/Type /Signature`**, which is not a
+  PDF object type; ISO 32000-1 table 252 says `/Sig`. `/ContactInfo` was
+  written but never read back, so it was always `None` on a loaded signature.
+
+- **A corrupt CFF2 INDEX could stall the optimizer.** A CFF2 INDEX counts its
+  items in a uint32 rather than CFF1's uint16, so a malformed font could ask
+  for four billion offsets out of a few bytes and be walked entry by entry. The
+  count is now rejected when it cannot fit in the data that follows it.
+
+- **A variable CFF2 font drew garbage, not its default master.** The CFF DICT
+  parser stopped at CFF1's operator range, so the Top DICT's `vstore`
+  (operator 24) was read as an operand and the ItemVariationStore was never
+  found. With no region counts the `blend` operator could not tell a delta from
+  a coordinate, and the deltas went on to be drawn as part of the outline. Both
+  that and the two-byte length prefix in front of the store are fixed.
+
+- **The optimizer recompresses the images it used to refuse.** Anything that
+  was not 8-bit device gray/RGB/CMYK under a raster filter kept its original
+  bytes however large: an Indexed, Lab, Separation or DeviceN image, a
+  1/2/4/16-bit one, a stencil mask, and every CCITT, JBIG2 or JPEG 2000
+  payload -- which is most of a scanned document. Each is now brought to
+  device samples first: a palette is folded into the samples (the space
+  becomes `DeviceRGB`), a non-device space is converted through the same
+  colour machinery the renderer uses, sub-byte and 16-bit samples are
+  normalised to 8, and an opaque codec is decoded like any other filter. A
+  stencil is a shape rather than a picture, so it is downscaled and re-packed
+  at one bit per sample instead of being JPEG-encoded. The never-grow guard
+  still has the last word, so an image is only rewritten when that actually
+  saves bytes.
+
+- **`GraphicsAbsorber` collects every mark a page makes.** It reported painted
+  paths and placed XObject images and nothing else: text runs, inline
+  (`BI`/`ID`/`EI`) images and `sh` shading fills were simply missing, a stroked
+  path's box stopped at the geometry rather than covering the ink, and any
+  colour set through a non-device space came back as `None`. All four are now
+  covered. A text element carries the box its glyphs occupy, measured with the
+  renderer's own font metrics -- so the reported box and the ink agree -- and
+  invisible text (rendering mode 3 or 7) is still left out, because it puts
+  nothing on the page. Only a pattern, which has no single colour, still
+  reports no colour.
+
+### Fixed
+
+- **An `/Indexed` fill colour was read as a grey level.** `Indexed` is not a
+  shading colour space, so the shared converter had no branch for it and passed
+  the palette *index* through as a colour component: `1 scn` in a two-entry
+  palette painted white instead of the colour it names. The renderer and the
+  graphics absorber both take the fix.
+
+- **Layers can be created, written to and resolved.** Optional content was
+  read-only: the layers a document declared could be listed and switched, but
+  not created, not written to and never resolved. `Document.layers.add(name)`
+  now creates a group (building the whole `/OCProperties` structure when the
+  document had none), `Page.layer(layer)` is a context manager that marks
+  everything authored inside it as belonging to that layer, and
+  `Document.layers.remove(layer)` drops a group while leaving its content
+  unconditionally visible.
+- **`Document.flatten_layers()` resolves optional content for good.** Switching
+  a layer off changes what is *drawn*; the content stayed in the file and came
+  back the moment somebody switched it on again -- a hidden draft watermark is
+  still a draft watermark when the file leaves your hands. Flattening deletes
+  what the configuration hides (marked content, XObject invocations and
+  annotations alike) from the page's *existing* content streams rather than
+  leaving them behind as unreferenced objects, drops every surviving `/OC`
+  reference and marked-content wrapper, and removes `/OCProperties` -- leaving
+  an ordinary PDF that renders byte-identically to what was visible.
+
+- **Documents export as HTML and Markdown.** `DocFormat.HTML` and
+  `DocFormat.MARKDOWN` were placeholders that raised. `Document.to_html()`,
+  `to_markdown()`, `save_as_html()`, `save_as_markdown()` and
+  `Document.save(path, DocFormat.HTML)` now produce real documents, as do the
+  `HtmlSaveOptions` and `MarkdownSaveOptions` containers. This is a conversion
+  to a *flowing document*, not a facsimile: the same layout analysis
+  `auto_tag()` uses infers headings, paragraphs, bulleted and numbered lists,
+  tables and figures, and the text is decoded exactly as `extract_text()`
+  decodes it -- so the export and the tag tree agree by construction rather
+  than by coincidence. Images are embedded through the same reconstruction
+  `save_image()` performs, and Markdown is GFM escaped only where a character
+  would otherwise change the meaning.
+
+### Fixed
+
+- **A widely spaced table is no longer read as page columns.** The column
+  splitter cut at the widest gap between text anchors, and a table's cells
+  leave exactly the gap a two-column page does -- so a page with a table came
+  out column-major, its prose interleaved with cell contents and the grid never
+  reaching table detection. A gutter now has to be *whitespace*: a split is
+  rejected when any line's extent runs across it, which the full-width prose
+  above and below a table always does. `auto_tag()` gets the same fix.
+
+- **Pages export as SVG.** `DocFormat.SVG` was a placeholder that raised.
+  `Page.to_svg()`, `Page.save_as_svg()`, `Document.save_as_svg()` and
+  `Document.save(path, DocFormat.SVG)` now write real vectors. The exporter
+  subclasses the rasterizer and replaces only its paint sinks, so every
+  operator, transform and resource lookup is the same code that renders the
+  page -- which is what keeps the two outputs agreeing. Paths carry their fill
+  rule, strokes their width, dash pattern, cap and join, clips become
+  `<clipPath>`, text becomes glyph outlines, images embedded PNGs placed by
+  their matrix, and axial/radial shadings SVG gradients; a mesh or
+  function shading is sampled into an image rather than dropped. Verified by
+  rendering the output with cairo and comparing against this library's own
+  raster.
+
+### Fixed
+
+- **`Q` restores the clipping path.** The renderer intersected one global mask
+  and never gave it back, so everything after a `q … W n … Q` stayed clipped to
+  a region that had already ended -- which is most documents with a figure in
+  them. The clip is graphics state (ISO 32000-1 8.4.4) and is now saved and
+  restored with it, at no copying cost: `q` stacks a reference and the clip
+  builder makes a new mask instead of editing in place.
+
+- **JPEG 2000 decodes without Pillow.** `/JPXDecode` needed the optional
+  `images` extra, and without it the filter raised, the stream decoder fell
+  back to handing the *raw codestream* to its caller, and the rasterizer
+  painted those compressed bytes as if they were samples -- a page of noise
+  where the scan should be. `aspose_pdf.engine.jpeg2000` is a pure-Python
+  decoder covering the JP2 container and the bare codestream, tier-2 packet
+  decoding (tag trees, all five progression orders, precincts, quality layers,
+  tiles, SOP/EPH markers), the EBCOT tier-1 block decoder over the MQ
+  arithmetic coder, the 5/3 and 9/7 wavelets, both colour transforms and
+  component subsampling. The reversible path is lossless -- it reproduces the
+  encoder's input exactly -- and the irreversible path agrees with OpenJPEG to
+  within a step or two per channel; both were cross-checked against it over
+  tiles, precincts, progression orders, code-block sizes, layers and bit depths.
+  Pillow is still preferred when installed, being several hundred times faster
+  on a full-size scan, and an image that neither decoder can read is now left
+  undrawn rather than painted as noise.
+
+- **Public-key encryption (`/Adobe.PubSec`).** A document encrypted for
+  certificate recipients could not be opened at all -- not a degraded read, a
+  hard failure -- and there was no way to produce one.
+  `Document.encrypt_for_recipients([Recipient(cert), ...])` now writes one and
+  `Document(source, certificate=..., private_key=...)` opens one. There is no
+  password: a random seed is wrapped in a CMS `EnvelopedData` per recipient and
+  the file key is a hash over that seed and every recipient blob. Each
+  recipient carries its **own** permissions -- one reader may print and another
+  only read the same file -- which no password scheme can express. AES-256
+  (`adbe.pkcs7.s5`), AES-128 and RC4-128 (`adbe.pkcs7.s4`) are written; on read,
+  `/Recipients` is found in the crypt filter or the dictionary depending on
+  `/V`, and PKCS#1 v1.5 or OAEP key transport over AES-CBC or 3DES-CBC content
+  encryption is accepted. Encrypting to a certificate whose `keyUsage` forbids
+  key transport is refused rather than producing a file the recipient cannot
+  open. Verified in both directions against pyHanko and, for the CMS layer,
+  OpenSSL.
+
+- **Non-embedded fonts can be drawn with real faces.** The renderer only ever
+  had the bundled Latin and symbol substitutes, so a font with no embedded
+  program that was not one of the Standard 14 drew glyph boxes -- and a
+  composite (Type0/CID) font had no substitute path at all, which is every
+  East Asian PDF that leaves the system fonts unembedded. Assigning a
+  `FontSubstitutionOptions` (to `Document.font_substitution`, or per call to
+  `Page.render` / `Document.render_page`) points the renderer at font
+  directories, font programs supplied as bytes, or the platform's own fonts
+  (`FontSubstitutionOptions.system()`). A face is resolved by the document's
+  `/BaseFont` name against the real `name` tables of the indexed fonts, then --
+  for a composite font -- by the well-known families of its character
+  collection, so a PDF naming `SimSun` renders on a machine that only has
+  `PingFang SC`, and finally by `cmap` coverage of the text itself. CIDs reach
+  Unicode through the font's own `/ToUnicode` and Adobe's bundled
+  CID-to-Unicode table for the collection. Advances still come from the PDF's
+  `/Widths` / `/W`, so a substitute changes which glyphs are drawn, never where
+  they sit (a simple font that omits `/Widths` for a code still falls back to
+  the face's own advance, as it did for the bundled substitutes). Indexing reads only each face's table directory, `name` table and
+  `OS/2` ranges -- about 1200 system faces in under a second -- and pulls a
+  whole program (lifting a TrueType Collection face out of its collection) only
+  for a face that wins. Discovery is opt-in: without options rendering is
+  byte-for-byte what it was, and independent of what the machine has installed.
+  `SystemFontSource` also now looks in macOS's `/System/Library/AssetsV2`,
+  where downloadable system fonts (PingFang, Hiragino and the other CJK
+  families) are installed.
+
+- **Optional content (layers) is honoured.** Nothing in the package looked at
+  `/OC`, so a hidden layer — a draft watermark, an alternate language, a CAD
+  overlay — was painted and extracted like any other content. Rendering, text
+  extraction and `GraphicsAbsorber` now skip content in a group the default
+  configuration turns off: marked-content sections (with nested `BDC`/`BMC`
+  tracked to the matching `EMC`), image and form XObjects carrying their own
+  `/OC`, and annotations. `/OCMD` is resolved under its `/P` policy and simple
+  `/VE` expressions, and `/BaseState` is honoured.
+- **`Document.layers`.** Lists the document's optional content groups with
+  their names and state; setting `layer.visible` rewrites the default
+  configuration's `/ON`/`/OFF`, which the renderer, the extractor and a later
+  `save()` all follow.
+- **Rendered pages encode to compressed TIFF, JPEG, greyscale and bilevel.** A
+  raster could only be written as PNG or as an *uncompressed* RGB TIFF — an A4
+  page at 300 dpi came to about 25 MB of file for a page of text. `to_tiff()`
+  now Deflate-compresses by default (`compression="none"` keeps the raw strip),
+  `to_jpeg(quality=…)` uses the bundled encoder, and `mode="gray"`/`"bilevel"`
+  (with a `threshold=`) cut a text page down further; `save()` picks the format
+  from the suffix, `.jpg`/`.jpeg` included. Both encoders record the render
+  resolution — TIFF in its resolution tags, JPEG as the JFIF pixel density.
+- **`Document.save_as_tiff()` writes a multi-page TIFF.** Every page becomes one
+  image in a single file (`pages=` selects and orders them), rendered and
+  encoded one at a time so only the compressed result accumulates.
+- **`GraphicsAbsorber` actually absorbs graphics.** `visit()` cleared its
+  collection and returned nothing at all, while the documentation described it
+  as collecting a page's graphic elements. It now walks the content stream the
+  way the rasterizer does — tracking `q`/`Q`/`cm`, descending into form
+  XObjects with each `/Matrix` composed, bounded in depth and terminating on a
+  form that draws itself — and reports each painted path and placed image as a
+  `GraphicElement`: bounding box in page space (curves bounded exactly, not by
+  their control points), paint operation, image resource name, device fill and
+  stroke colour, and stroke width in page space. Text, inline images and `sh`
+  fills are out of scope and documented as such.
+- **`Document.encrypt(..., algorithm=…)`.** The engine has always supported
+  AES-256, AES-128 and RC4, but the public API could only reach the default.
+  Names are normalised (`aes256`, `AES_128`, `rc4-128`), and an unrecognised
+  one raises `PdfSecurityException` instead of silently falling back to a
+  weaker cipher.
+
+- **The page rasterizer draws annotations.** It rendered page content only, so
+  every highlight, stamp, sticky note and form-field widget was missing from a
+  rendered page even with its `/AP` present. Each visible annotation's normal
+  appearance is now composited, placed by fitting its `/Matrix`-transformed
+  `/BBox` to `/Rect` (ISO 32000-1 12.5.5), with `/AS` selecting among appearance
+  states and Hidden/NoView annotations and `Popup` subtypes skipped. A malformed
+  annotation is skipped rather than allowed to abort the page.
+  `Page.render(draw_annotations=False)` (also on `Document.render_page`) keeps
+  the old content-only behaviour.
+
+- **Standard icons for `Text` and `FileAttachment` annotations.** Two of the
+  most common annotations in a reviewed document could not synthesise an
+  appearance at all — `generate_appearances()` declined and left them with no
+  `/AP`. Both now draw their standard `/Name` icon as vector artwork (`Comment`,
+  `Key`, `Note`, `Help`, `NewParagraph`, `Paragraph`, `Insert`; `PushPin`,
+  `Graph`, `Paperclip`, `Tag`), honouring `/C`, squared and centred in the
+  annotation rectangle, with an unknown name falling back to the subtype's
+  default the way a viewer does.
+
+- **`Page.add_image()` accepts every PNG form.** Adam7 **interlacing** and bit
+  depths **1/2/4/16** were hard rejections; an ordinary interlaced or 16-bit PNG
+  could not be embedded at all. The decoder now reassembles the seven interlace
+  passes and normalises each allowed depth to 8 bits per sample — 16-bit keeps
+  the high byte, sub-byte greyscale is scaled to full range, and palette indices
+  are looked up rather than scaled, which would have corrupted the colour. Bit
+  depths a colour type does not allow (ISO 15948 table 11) are now rejected with
+  a specific message instead of being decoded as garbage.
+
+- **PDF/A-1 conversion drops inert transparency groups.** A `/Group /S
+  /Transparency` on a page or form XObject is removed when nothing it reaches
+  actually uses transparency — no ExtGState soft mask, non-Normal blend or alpha
+  below 1, no image `/SMask`/`/Mask`, no nested group. Producers stamp such
+  groups routinely, so this converts a real class of documents losslessly. The
+  scan is conservative (every ExtGState in a resource dictionary counts, not just
+  the ones the content selects), and transparency that is genuinely used stays
+  and is reported: flattening it correctly requires compositing the page against
+  its backdrop — rasterizing away live text and vectors — which is the caller's
+  decision, not a silent repair.
+- **Push-button icons.** `Form.add_push_button(icon=…)` takes JPEG or
+  non-interlaced 8-bit PNG bytes, wraps them in a form XObject as `/MK /I` (an
+  icon must be a *form*, not an image), and draws it into the normal, rollover
+  and down faces scaled proportionally and centred. `/MK /IF` is written to
+  match the baked appearance, and `/MK /TP` is 1 for an icon alone or 2 with the
+  caption below it.
+- **Submit and reset form actions.** `SubmitFormAction` and `ResetFormAction`
+  join the typed action API, covering the `/Fields` name list, the
+  include/exclude flag, and the FDF / HTML / XFDF / PDF submit format. Action
+  serialization now emits arrays and integers, not only strings.
+
+- **The optimizer's DPI target follows form XObjects.** Display size was
+  measured from page-level placements only, so an image drawn inside a form was
+  invisible to `image_target_dpi` and kept its full resolution. Forms are now
+  descended into, composing each form's `/Matrix` with the CTM at its `Do`, with
+  bounded nesting and cycle detection.
+- **ICC-based CMYK images are recompressed.** `/ICCBased` with `/N 4` is CMYK,
+  which the JPEG encoder already handled; only the colour-space probe rejected
+  it.
+- **An inverting `/Decode` array is folded into the samples.** `[1 0]` per
+  component — the common form on inverted scans — is reproduced exactly by
+  inverting the samples and dropping the array, so such images are no longer
+  skipped. Other sample remappings are still left alone.
+- **Masks are downscaled with the image that carries them.** A mask was skipped
+  outright, so a full-resolution soft mask survived a downscale of its image.
+  Masks now follow the image's display size but are never JPEG-encoded.
+
+### Fixed
+
+- **`ImagePlacementAbsorber` found nothing when handed a page.** It understood
+  only the internal engine object, so `visit(document.pages[0])` — the obvious
+  call, and the one the docs describe — returned an empty list. It now accepts a
+  `Page` (that page's images), a `Document`, or the engine object, and still
+  accepts objects that carry image data directly.
+- **Image placement rectangles were scaled by the raster's pixel size.** An
+  image is painted into the unit square of its own space (ISO 32000-1 8.9.5.2),
+  so a 200×100 image drawn 100pt wide reported a 20000×5000pt rectangle.
+  `ImagePlacement.resolution` now reports real DPI — pixels over the size drawn
+  on the page — instead of a hardcoded 72.
+- **Pages that reuse a resource name lost all but the last image.** Resource
+  names are page-local and most producers restart at `/Im0` on every page, but
+  images were stored under the bare name, so each collision overwrote the
+  previous image's bytes, size and metadata. Images are now keyed uniquely per
+  document (a name taken by a different object gets a numbered suffix) while a
+  single XObject shared by several pages still stores one copy.
+- **Encrypted PDFs written by other tools could not be opened.** Only AES-256
+  worked. A 128-bit RC4 document (`/V 2 /R 3`) was misread as AES-128 because
+  the cipher was guessed from `/V`/`/R` alone instead of the crypt filter
+  `/StmF` selects, and AES-128 (`AESV2`) failed because the file key was used
+  directly as the object key: ISO 32000-1 Algorithm 1 derives a per-object key
+  from the object and generation number, with a `sAlT` suffix for AES. Both are
+  implemented now, and qpdf-produced fixtures for every standard-handler
+  flavour — RC4-40, RC4-128, AES-128, AES-256 revision 5 and 6 — are part of
+  the test suite. A failure to decrypt raises `PdfSecurityException` rather
+  than a bare cipher `ValueError`.
+- **Encrypted documents this library wrote were readable only by this library.**
+  Three defects compounded: the `/Encrypt` dictionary declared a revision whose
+  key derivation was not the one used (`/V 5 /R 5` for keys built with the
+  revision 6 algorithm 2.B, `/V 1 /R 2` for a 128-bit RC4 key), `/Perms` and
+  `/Length` were missing, and — worst — the trailer `/ID` was regenerated at
+  save time while the key had been derived from a different one, so every
+  conforming reader computed a different key and rejected the correct password.
+  The dictionary is now written to match the keys, the `/ID` is bound to the
+  derivation, and `/Perms` follows the revision 6 layout. Output opens in qpdf
+  with either password for all three algorithms.
+- **Strings in an encrypted document.** They were neither encrypted on write
+  nor decrypted on read, so a title or annotation text sat in the clear inside
+  an otherwise encrypted file. Strings are now encrypted with their object's
+  key (a signature's `/Contents` and the `/Encrypt` dictionary excepted) and
+  decrypted as objects are materialised, including for documents produced
+  elsewhere.
+- **Images and form XObjects vanished from an encrypted document.** Loading with
+  a password decrypts the page contents and then cleared the key, but every
+  other stream -- images, form XObjects, appearance streams -- is decoded on
+  demand from the COS graph and still needed it, so a rendered page of an
+  encrypted PDF came out with its images missing. The key the graph needs is
+  now kept for as long as those bytes are around, separately from the
+  writer-facing one.
+- **A document protected by an owner password only would not open.** An empty
+  user password is a valid password that every reader tries before asking for
+  one; loading demanded a password and raised instead.
+- **AES-256 revision 5 documents were rejected.** Password verification always
+  used the revision 6 hardened hash; revision 5 — the deprecated Adobe
+  extension, still found in the wild — is a single SHA-256 and is now handled
+  by revision.
+
+- **The PDF/A checker accepted DeviceCMYK under an sRGB output intent.** It only
+  required *some* structurally valid ICC profile, where ISO 19005-1 6.2.3.3 ties
+  each device colour family to the output intent's own space. The destination
+  profile's colour space is now read from the ICC header and matched against the
+  device colour actually used (DeviceGray is satisfied by any intent).
+- **Device colour set by operator went undetected.** The scan looked only for
+  the names `/DeviceRGB`/`/DeviceGray`/`/DeviceCMYK`, missing `k`/`K`, `rg`/`RG`
+  and `g`/`G` — the most common way content selects a device space — so most
+  non-conformant colour was never reported. `DeviceGray` is also tracked
+  separately from `DeviceRGB` now; folding them together would flag a valid
+  CMYK-intent document that only draws gray.
+
+## [0.1.0] - 2026-08-19
+
+### Added
+
+- **Every Adobe predefined CJK CMap is now bundled** — 141 names across Japan1,
+  Korea1, GB1 and CNS1 (both `-H` and `-V`), up from 8 name pairs. Text
+  extraction, editing, redaction geometry and glyph rendering now work without
+  `/ToUnicode` for the whole Unicode family (`UCS2`/`UTF8`/`UTF16`/`UTF32`,
+  including `HW` and `JIS2004` variants) and the legacy encodings (`RKSJ`,
+  `EUC`, `UHC`, `Johab`, `GBK`/`GBK2K`, `B5`, `ETen`, `HKscs`, the `pc`/`pv`/`ms`
+  platform variants). The `Adobe-<Ordering>-<N>` CMaps stay excluded: their
+  codes already are CIDs, not an encoding.
+- **Unicode-keyed CMaps take the scalar from the code**, not from
+  code → CID → Unicode. This already applied to `-UTF16-`; it now covers
+  `-UCS2-`, `-UTF8-` and `-UTF32-` too. Those codes *are* the character, so text
+  and code stay a bijection and a replacement can be written back — Adobe maps
+  both U+2F47 and U+65E5 to Japan1 CID 3284, which previously made such
+  characters extractable but not replaceable under those names.
+
+- **Font subsetting covers predefined encodings.** Simple fonts now resolve a
+  used code through `/Differences`, then the predefined base encoding, then the
+  font program's own built-in encoding — one shared step for TrueType, CFF and
+  Type 1. This lifts three limitations: a simple CFF with a PDF `/Encoding`
+  override, a simple CFF carrying a predefined (Standard) encoding, and a Type 1
+  font whose codes need a predefined base encoding were all left whole before.
+  A base encoding outside the bundled tables (`MacExpertEncoding`, unrecognised
+  names) still bails, so a used glyph is never erased.
+
+### Changed
+
+- **The bundled CMap tables are split one file per character collection**,
+  behind a small index. A document names exactly one collection through its
+  `CIDSystemInfo`, so only that file is decompressed; a single combined file
+  would make one CJK document pay for all four. `supported_cmap_names()` — called
+  while parsing every composite font — is now answered from the index alone
+  instead of loading the whole bundle. Despite carrying 8.8x more CMaps, the
+  worst-case resolve loads ~35 MB where the old combined bundle loaded ~24 MB.
+  Only the index digest is pinned in code; it pins each collection file in turn.
+  `scripts/build_cmap_data.py` now takes `--output-dir` instead of `--output`,
+  and refuses to emit a collection whose `usecmap` bases are not all in it.
+
+- **Signing an authored signature field.** `engine.sign_field.sign_field()`
+  fills the `/FT /Sig` field created by `Form.add_signature_field()` as an
+  incremental update: the original bytes are emitted verbatim, so a signature
+  already in the document stays valid and the surrounding COS structure
+  (widgets, other fields, outlines, annotations) is preserved instead of being
+  rebuilt. Several fields can be signed in turn. Covers `adbe.pkcs7.detached`
+  and PAdES (`pades=True`), an embedded chain, local/network timestamps, and
+  DocMDP certification (writing `/Perms /DocMDP`). Previously the only signing
+  path rebuilt the whole file and synthesised its own single field, so an
+  authored field could not be signed at all.
+- **Signature seed values and field locks.** `Form.add_signature_field()`
+  accepts `seed_value=` (`/SV`: `filter`, `sub_filter`, `digest_method`,
+  `reasons`, and `required` naming the entries whose ISO 32000-1 table 234
+  `/Ff` bit makes them binding) and `lock=` (`/Lock`: `action` of
+  `All`/`Include`/`Exclude` with `fields`). At signing time a required
+  `/SubFilter` or `/Reasons` is enforced, and a `/Lock` becomes a **FieldMDP**
+  signature reference.
+
+- **PDF/A conversion rewrites CMYK images to DeviceRGB.** `convert_to_pdfa`
+  already normalized DeviceCMYK *content* colour; it now also converts CMYK
+  **image XObjects** — `/DeviceCMYK` and ICC-CMYK (`/ICCBased` `/N 4`), raw or
+  `DCTDecode` — to 8-bit `DeviceRGB` re-encoded with `FlateDecode`, dropping the
+  stale `/Decode`/`/DecodeParms`. Pixels go through the same decode path the
+  renderer uses (Adobe de-inversion, YCCK), so the page looks the same.
+  Transparency remains reported, not converted.
+- **PDF/A conversion repoints `/Separation` and `/DeviceN` off CMYK.** A space
+  whose alternate resolves to DeviceCMYK or ICC-CMYK now gets a resampled Type 0
+  tint transform over `DeviceRGB` (PDF has no way to compose the original
+  transform with a CMYK→RGB conversion). The space keeps its kind, colorant
+  names and component count, so content streams selecting it need no rewriting,
+  and a Separation/DeviceN image keeps its tint samples. A linear transform is
+  reproduced exactly; a curved one to within a step or two per channel.
+- The page renderer now draws glyphs for Type0 fonts whose `/Encoding` names one
+  of the eight bundled predefined CJK CMaps, instead of falling back to boxes. It
+  splits the show string on the CMap's mixed single/double-byte codespaces, maps
+  each code to a CID against the descendant `CIDSystemInfo`, and fills the real
+  outlines through `CIDToGIDMap` (CIDFontType2) or the CFF charset
+  (CIDFontType0). Unbundled names, embedded CMap streams, and mismatched
+  collections still render as boxes.
+- `Document(...)` no longer discards its arguments. It now loads the supplied
+  source with the same semantics and errors as `Document.load_from(...)`, and
+  rejects unknown arguments, so `Document("input.pdf")` can no longer return an
+  empty document. `aspose_pdf.generated.document.Document` gained the same
+  signature.
+- Compatibility placeholders for unimplemented formats now fail explicitly
+  through the new `UnsupportedFeatureException` (also a `NotImplementedError`):
+  load options such as `SvgLoadOptions` are rejected by the constructor and
+  `load_from()`, and `Document.save(destination, save_format)` rejects
+  `SaveFormat.PPTX`, non-PDF `DocFormat` members, `HtmlSaveOptions`,
+  `MarkdownSaveOptions`, and `PrinterSettings` before writing anything.
+- Documented the full inventory of unimplemented compatibility surfaces in
+  `supported-features.md`.
+- Extended the scheduled security audit to install and audit the `text-layout`
+  extra (uharfbuzz, python-bidi, fonttools) alongside `images` and `woff2`, and
+  made the minimal-install CI job assert those three modules are absent too, so
+  every optional runtime dependency is covered by both gates.
+- Added function-based PDF shadings with multidimensional sampled functions,
+  shading matrix/domain/bounds/background handling, and Separation/DeviceN
+  alternate-colour conversion.
+- Replaced fixed patch-mesh tessellation with bounded device-scale-adaptive
+  subdivision and added composite preview for common CMYK and spot overprint
+  cases through `/OP`, `/op`, and `/OPM`.
+- Extended the attachment API with associated-file relationships and typed
+  removal: `Document.add_attachment(..., relationship=...)` writes a validated
+  `/AFRelationship` (`AF_RELATIONSHIPS`), `FileSpecification` exposes a
+  `relationship` field read back from the file spec, and
+  `Document.remove_attachment(name)` deletes an embedded file (dropping the
+  `/Names /EmbeddedFiles` tree when the last one is removed). Re-adding a name
+  now fully supersedes any previously loaded metadata.
+- Added public signature-field authoring: `Form.add_signature_field(name, page,
+  rect, ...)` creates an empty `/FT /Sig` field with a page widget, sets the
+  AcroForm `/SigFlags` SignaturesExist bit (preserving existing bits), renders an
+  empty box, and carries no value until signed. Signature fields round-trip,
+  report as a `signature` field type (new `FieldType.SIGNATURE`), and can be
+  removed like any other field. Signing an authored field and seed-value/lock
+  dictionaries remain out of scope.
+- Added a public byte-preserving incremental save: `Document.save(...,
+  incremental=True)` emits the original file bytes verbatim and appends only the
+  objects added or modified since load as a new revision chained through
+  `/Prev`. Change detection compares each object's canonical (key-sorted)
+  serialization against a re-parse of the original, so unchanged objects are not
+  re-emitted and an existing signature's byte range stays intact. Documents
+  built from scratch fall back to a full write; encrypted or to-be-signed
+  documents are rejected.
+- Corrected the overprint composite preview to work in the subtractive device
+  colorant model: a non-zero source colorant now replaces the backdrop colorant
+  while a zero-tint colorant leaves it untouched (nonzero-overprint semantics for
+  DeviceCMYK/DeviceGray, colorant isolation for Separation/DeviceN). The previous
+  blanket `Multiply` darkened untouched colorants and could not replace a
+  colorant with a lighter tint of itself.
+- Corrected project metadata links and added minimal-install CI coverage.
+- Added bounded fuzz targets and a redistributable parser corpus, replaced the
+  skipped signature-extraction placeholder with an end-to-end test, and applied
+  `PdfLoadLimits` to authored PNG and WOFF/WOFF2 decoding paths.
+
+### Fixed
+
+- **`PdfSignature.valid` returned `True` for tampered documents.** Its digest
+  comparison went through `cryptography`'s `load_der_pkcs7_signed_data`, which is
+  absent in some releases; that absence — and any error while walking the signed
+  attributes — was treated as success, so a document whose signed bytes had been
+  modified reported `valid is True` while `validate()` correctly reported
+  INVALID. Verification now goes through the same engine path `validate()` uses:
+  the digest algorithm comes from the CMS, the `messageDigest` attribute is
+  checked against the covered bytes, and the **signature value is verified**
+  against the signer certificate — which the old code never did at all. This also
+  fixes SHA-384/SHA-512 signatures, which the hardcoded SHA-256 comparison could
+  never match.
+- **Subsetting resolved base encodings through the stdlib codecs**, which
+  disagree with PDF's tables on real codes. MacRomanEncoding `0xDB` is
+  `currency`, but `mac_roman` decodes it as the euro sign — so the subsetter
+  reasoned about the wrong glyph. WinAnsiEncoding `0xA0`/`0xAD` are `space` and
+  `hyphen`, where `cp1252` gives NBSP and a soft hyphen, whose scalars are absent
+  from most fonts and made the subsetter give up and embed the whole font.
+  Resolution now goes through the bundled Adobe tables and the Adobe Glyph List.
+- **PDF/A conversion never reached form XObjects.** The CMYK content walker
+  tested `_get_page_resources()` — which returns a converted plain `dict` — with
+  `isinstance(..., PdfDictionary)`, a condition that can never hold, so DeviceCMYK
+  inside a form XObject was silently left in place. It now walks the live COS
+  resource dictionary (following inherited `/Resources`).
+- **Attachments in nested embedded-file name trees are no longer invisible.**
+  `/Names /EmbeddedFiles` was read only as a flat `/Names` array, so a document
+  whose tree another producer balanced into `/Kids` sub-nodes (ISO 32000-1
+  7.9.6) reported *no attachments at all* — silently, with no error. The tree is
+  now walked in full, preserving its order, with depth, cumulative entry count,
+  and revisited nodes bounded by the shared `PdfLoadLimits` budget.
+
+- **Typed action/destination API** (`aspose_pdf.interactive`): destination value
+  objects (`FitDestination`, `XYZDestination`, `FitH/V/R/B`…) and actions
+  (`GoToAction`, `URIAction`, `GoToRAction`, `NamedAction`, `JavaScriptAction`,
+  `LaunchAction`), wired to link annotations (`Page.add_link(rect, target)`),
+  outline items (`OutlineItem(..., destination=…)`, replacing the previous
+  fixed fit-to-page `/Dest`), and push-button widgets
+  (`Form.add_push_button(..., action=…)`). Serialized to COS `/A` and `/Dest`.
+- **Push-button visual states.** Push buttons now generate normal/rollover/down
+  (`/AP` `N`/`R`/`D`) appearances, and `Form.add_push_button` accepts
+  `border_color` / `background` (`/MK` `/BC` / `/BG`); the rollover and down faces
+  are shaded variants of the background.
+- **Type0 (CID) field fonts.** `Form.add_text_field(font=…)` embeds a Type0 font
+  in the AcroForm `/DR` and bakes a CID-encoded `/AP`, so a non-Latin field value
+  renders through the embedded CID font. (`generate_appearances` leaves the baked
+  Type0 appearance intact; Type0 rich text `/RC` falls back to the plain `/DA`.)
+- **PDF/A conversion embeds Standard-14 fonts and normalizes DeviceCMYK.**
+  `convert_to_pdfa` now embeds non-embedded Standard-14 and Symbol/ZapfDingbats
+  fonts with the bundled metric-compatible substitute (synthesizing `/Widths`
+  from that face) even without a `font_lookup_directory`, and rewrites
+  DeviceCMYK content color (`k`/`K` and `/DeviceCMYK` fills/strokes) to RGB using
+  the renderer's device conversion so appearance is unchanged. CMYK image
+  XObjects, Separation/DeviceN, ICC-CMYK, and transparency stay reported, not
+  converted.
+- **Composite (Type0) text renders through embedded (stream) CMaps.** A font
+  whose `/Encoding` is a CMap *stream* (rather than Identity or a bundled
+  predefined name) is decoded with the same parser extraction uses and fills the
+  descendant font's real glyphs instead of boxes. Named predefined CMaps outside
+  the eight bundled tables remain boxed (no bundled code→CID table).
+- **True vertical writing (`WMode 1`).** Vertical CMaps — bundled or embedded —
+  now offset each glyph by its `/W2`/`/DW2` position vector and advance the text
+  downward by the vertical displacement, instead of advancing horizontally.
+- Bundled the full **Adobe Glyph List** (4281 names) as a deterministic,
+  integrity-checked data file, and resolve glyph names through the Adobe AGL
+  algorithm (exact list, `.`-suffix stripping, `_` ligature components, then the
+  algorithmic `uniXXXX`/`uXXXX` forms). Text extraction and code→Unicode now
+  handle named glyphs such as `aacute`, `Euro`, `afii10017`, and `f_f_i`, not
+  just `uniXXXX`. Generated by `scripts/build_agl_data.py`; no runtime fontTools.
+- Simple **CFF and Type 1 fonts under a predefined encoding now render real
+  glyphs instead of boxes.** Added CFF charset `name→gid` resolution and the
+  bundled Standard/WinAnsi/MacRoman code→name tables, so a font whose `/Encoding`
+  names a base encoding (or supplies `/Differences`) resolves through the font's
+  own charset. Expert/MacExpert encodings remain boxed.
+- **CFF2 outline programs are rasterized** (default instance): the parser reads
+  the CFF2 header, 32-bit INDEXes, FDArray/FDSelect, and Type 2 charstrings, and
+  collapses variable-font `blend`/`vsindex` to the default master (region deltas
+  dropped). CFF2 tables are also extracted from an OpenType wrapper. CFF2 is left
+  whole by the optimizer and still rejected for authoring.
+- **WOFF2 font collections** (`ttcf`) are reconstructed into a TrueType
+  Collection (shared tables deduplicated) via a new `build_ttc` assembler, after
+  which the existing TTC face selection applies.
+- `Document.replace_text` / `Page.replace_text` now shape right-to-left and
+  complex-script replacements (HarfBuzz + Unicode bidi) instead of encoding them
+  code-for-code, and match such phrases in their stored visual order. A
+  replacement is reused in the run's own embedded font when that font already
+  carries every shaped glyph (an embedded, Identity-encoded `CIDFontType2` whose
+  shaped advances match `/W` with no positioning adjustment); otherwise a
+  shaping-capable `font=` is embedded and the replacement drawn at the match
+  baseline, with optional `layout=TextLayoutOptions(...)` for direction, script,
+  and features. When neither path applies the edit raises rather than emit
+  misshaped glyphs, and reshaping needs the optional `text-layout` extra. Simple
+  LTR/ASCII replacements keep the previous exact byte-splice.
+- The page renderer can join complex-script runs that fall back to a bundled
+  substitute face, drawing cursive-connected forms instead of isolated glyphs
+  (order-preserving, so nothing is reordered or repositioned), controlled by the
+  new `shape_substitute_text` flag on `Document.render_page` / `Page.render`
+  (default on). It needs the `text-layout` extra and is active only when the
+  substitute face covers the script; the bundled Liberation/DejaVu faces cover
+  Latin and symbol only, so it is a safe no-op for other scripts today. Embedded
+  fonts are unaffected — their glyphs are already final.
+
+[0.1.0]: https://github.com/aspose-pdf-foss/Aspose-PDF-FOSS-for-Python/releases/tag/v0.1.0