v0.35.0

A redaction destroys the pixels under it

ISO 32000-1 §12.5.6.23: "If a portion of an image is contained in a redaction
region, that portion of the image data shall be destroyed; clipping or image
masks shall not be used to hide that data."

Redact used to refuse every region a picture was drawn across — which, for a
scanned page, is every region there is. It now overwrites the samples under the
region and writes the picture back.

It does that to a picture whose samples are plain (already unfiltered by the
reader), eight bits a component, DeviceGray or DeviceRGB, drawn upright
and drawn once. Everything else is still refused by its own name, with
its reason, at Redact rather than at the write: a /Filter (a JPEG would have
to be decoded and re-encoded), a turned or skewed placement, a picture drawn
twice, an inline image, /ImageMask, /SMask, /Mask, /Decode, samples that
are not 8 bits, and any colour space outside those two — a zero sample in an
/Indexed space is the palette's first colour, which may be white.

⛔ The page's /Resources are rebuilt, not copied, or the original picture
would stay in the file beside the blanked one, referenced by nothing and holding
every pixel the redaction promised to remove — defect #74 one object along. The
test walks every object of the written file and decodes it.

⛔ The sample grid counts down while the page counts up. Row zero is the
picture's top row and v runs from its bottom edge; reading one for the other
blanks the mirror image of what was asked for. A region ending part way into a
sample destroys all of it.

Requires go-pdfkit/extract v0.11.0, whose Image.Matrix is what the upright
test reads. Closes #80 for the plain case; the JPEG half stays open there.

🤖 Generated with Claude Code