[tannevaled]

ISO 32000-1, 12.5.6.23:

If a portion of an image is contained in a redaction region, that portion of
the image data shall be destroyed; clipping or image masks shall not be used
to hide that data.

Redact refused every region a picture was drawn across — which, for a scanned
page, is every region there is. It now overwrites the samples under the region
and writes the picture back.

What it can do that to

A picture whose samples are plain (one the reader has already unfiltered),
eight bits a component, DeviceGray or DeviceRGB, drawn upright and drawn
once on the page.

Everything else is refused by its own name, with the reason, at Redact —
where a caller can still choose another region or another tool — because one
function plans the change for both the check and the write:

refused	why
a JPEG (or any /Filter)	it would have to be decoded and re-encoded: a size and a quality question of its own
drawn turned or skewed	the box it covers looks the same as an upright one's, so mapping the region through it destroys more than was asked for
drawn more than once	replacing the picture replaces it for every Do, so blanking one placement blanks the others, elsewhere on the page
inline	it is written into the content stream; there is no resource to write back
/ImageMask, /SMask, /Mask, /Decode	they change what a sample means
not 8 bits a component	this blanks whole bytes
/Indexed, /ICCBased, …	a zero sample in a palette is the palette's first colour, which may be white

extract v0.11.0's Image.Matrix was added for the upright test; this PR bumps
to it.

Two traps, both with a test that would catch them again

⛔ The page's /Resources are rebuilt, not copied. Copying them would have
left the original picture in the file beside the blanked one — referenced by
nothing, holding every pixel the redaction promised to remove. That is defect
#74 one object along. The test walks every object of the written file and
decodes it, because samples are compressed and a raw grep cannot see them.
decorate goes through the same function, or a page both redacted and stamped
would have had its original picture put back, silently.

⛔ The sample grid counts down while the page counts up. Row zero is the
picture's top row and v runs from its bottom edge. Reading one for the other
blanks the mirror image of what was asked for, which looks like a redaction
until somebody compares it with the page — so the test gives every row its own
colour and names which rows must survive. A region ending part way into a sample
destroys all of it: a third of a secret is a secret.

Gate: ok github.com/go-pdfkit/ops 13.8s coverage: 100.0% of statements,
covblocks: 0 blocks uncovered.

Closes #80 for the plain case; the JPEG half stays open there.

🤖 Generated with Claude Code