Stapler 0.4.1

A reliability and privacy release. Everything still runs on your device: no
new permissions, no new network requests.

Fixed
- Redaction: marks now stay on the right page after you delete, move or
reorder pages, or undo. Rotated text can be found and redacted, and
gradients and comment pop-ups under a mark are removed too.
- Two rare files could freeze or crash the tab: a PDF with certain bytes in
its embedded image data, and a tiny malformed TIFF. Both are handled now.
- Lost work: crops and annotations now count as unsaved changes, pressing
Escape no longer discards the "Restore your previous session?" offer, and
inserting an image with Insert pages no longer hangs.
- Protect: unticked permissions now apply even when you leave the owner
password empty.
- Forms: merging two filled copies of the same form keeps both sets of
answers. Flattening never prints hidden fields and never drops a value.
- Kept on export: attachments, portfolios, the document's title and author,
and its opening view now survive page edits, merges and compression.
Anything that can't be carried over is named. Every export includes the
same edits, whichever tool saves it, and watermarks are no longer applied
twice.
- Compress now shrinks images drawn smaller than the page, and uncompressed
images it used to call "already optimized". It still never saves a file
larger than the original.
- Conversions: extracted images are no longer scrambled, rotated and
right-to-left text come out in the right order, PowerPoint picture crops
are honoured, OCR text lands in the right place (and pages that already
have text are skipped), and Markdown code keeps its indentation.
- Files: folder exports never overwrite existing files, a cancelled batch
writes nothing, and large ZIP files no longer freeze the page. Remove
blank pages no longer flags a page holding one short line of text, and a
damaged file gets a clear "try Repair" message.
- Accessibility and languages: form fields, table cells, file tabs and hints
are announced properly, keyboard focus is no longer lost, shortcut hints
match your platform, counts use correct plural forms, and sizes and dates
follow your language. The "System" theme option is back.
- The command palette keeps keyboard focus from the moment it opens.

Changed
- Large documents use about half the memory: working through a 100 MB PDF
now peaks around 850 MB instead of 1.7 GB.
- The privacy policy, store listing and in-app privacy panel now describe
the one optional download (the OCR language model, about 3 MB, only after
you agree) and exactly what is kept on your device. They list the real
per-tool limits instead of saying "no limits".
- About 2 MB smaller to download.

Stapler is an offline PDF toolkit. Everything runs on your device: nothing is uploaded, there is no account, and the extension asks for no permissions.

This release covers everything since 0.2.1. Version 0.3.0 was never published on its own.

• Fast web view. An option in the review before saving puts page 1 first, so a browser can start showing a PDF before the rest has downloaded. It is off by default, which keeps files smallest.
• Colour option in Compress. Choose shades of grey or black and white for scanned documents. Stapler never saves a file larger than the original, and it tells you which pages could not be converted.
• Exact pixel size in Image to size and PDF to images. Set a width and a height, with the proportions locked by default. If a size target can't be reached, Stapler now says how far off it was.
• Folder search reads scanned pages. This is optional. OCR runs only after you approve the one-time download of its language model, and recognized text is marked as such in the results.
• Safer sharing on the web app. The installable web app now asks before opening files shared to it that it cannot confirm came from your device.

• Redaction is more thorough. It now also removes content hidden inside repeating patterns, under thick or widened lines and outlined text, and under image masks. Its built-in check fails if anything is left behind, and redacted files no longer double in size.
• Honest file sizes. Image to size, Grayscale and Compress never quietly save a file larger than you started with. Their "Reached" messages are measured on the saved file, and sizes use KB and MB (1 KB = 1000 bytes) everywhere.
• Your work is safer.
• Undo after saving works correctly.
• "Clear all local data" now tells you if anything could not be deleted.
• Restoring a session respects the document limit.
• Repair keeps your edits.
• Web app updates. The web app no longer mixes old and new code after an update, and other open tabs reload safely.
• Face and logo blur now reaches images in comments and fill patterns.
• Form fields line up on cropped and rotated pages.
• Read aloud follows page edits.
• Compare exports use the real page sizes and can be cancelled cleanly.
• Speed. Scrolling through large documents and merging big files is smoother, and heavy work no longer freezes the screen.
• Accessibility. Tooltips are accessible to screen readers, and every screen passes automated accessibility checks in light and dark themes.

The Firefox package passes Mozilla's add-on validator with 0 errors and 0 warnings, and every package is about 275 KB smaller than the first 0.3.0 build.

Bug-fix release. No new tools, no behavior changes to any existing tool's output —
this release closes gaps a recent internal audit found in state handling and
resource cleanup, and finishes translation coverage that shipped incomplete in 0.2.0.

• Switching tools or documents while a job was running could clobber the active-job
  progress bar, defeat the unsaved-changes guard, leak Compare's second file source,
  or let a slow Sign panel form-field fetch overwrite state for a document you'd
  already switched away from.
• A batch of concurrency and edge-case issues found across an internal audit:
  concurrent confirmation dialogs could hang forever, OPFS unavailability crashed
  the app instead of falling back to memory, undo/redo history could be corrupted
  by overlapping operations, and several tools (compression, redaction, scan
  cleanup, OCR, batch processing) mishandled degenerate or adversarial inputs.
  Full details in docs/AUDIT-FINDINGS.md and docs/AUDIT-EDGE-CASES-2026-09-15.md.
• Document and page-selection state updates are now batched, session auto-save no
  longer re-enters itself under rapid changes, and worker job handles and render
  canvases now release their memory immediately instead of waiting on garbage
  collection.

• Completed translations for all 10 supported locales — 173 strings added by the
  Word/Excel/PowerPoint converters and the export-review flow were previously
  English-only outside the default locale.

Every fix in this release is covered by an existing or new automated test.
tsc --noEmit, eslint, prettier --check, the design-token/contrast/invariant
checks, all 1425 unit tests, the automated QA-05 structural PDF validation, and
the 8-test zero-network e2e suite all pass against the built extension.

New: six beta PDF conversion tools, all fully offline like everything else in Stapler.

• PDF ⇄ Word (.docx) — structural conversion with headings, paragraphs, tables and images; bold/italic/hyperlinks preserved.
• PDF ⇄ Excel (.xlsx) — detects table-like text and writes it to sheets, or draws a workbook's sheets as a paginated grid.
• PDF ⇄ PowerPoint (.pptx) — places each page's text/images onto slides, or draws each slide as a PDF page.

Every conversion is labeled beta, states plainly what it does and doesn't preserve, and shows a mandatory preview before the save button unlocks — so you always see the actual output before it's written. No permission and no network request was added.