From 068de91f1862236c8d340d6092f1875c5a322582 Mon Sep 17 00:00:00 2001
From: tannevaled <tannevaled@users.noreply.github.com>
Date: Fri, 4 Sep 2026 08:29:05 +0200
Subject: [PATCH 1/3] Split a container across a sheet, and stop refusing what
 pdf.js draws
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The splittable predicate is now asked of the whole CHAIN rather than of
one node, as pdf.js asks it (Subform[$isSplittable], template.js:4940-4975):
the container above first, the recursion ending at the <template> element
which answers yes, and every other kind of node — an <area> above all —
inheriting the base answer, no. The keep intact clause belongs to a subform
and not to an exclGroup, which was read at template.js:2405-2429 rather
than assumed.

What that predicate refuses is not dropped. pdf.js's checkDimensions returns
true outright while the sheet has had nothing that moves in one piece
(layout.js:266-268), and the one that claims that pass switches
noLayoutFailure on before its own check runs, so it cannot fail either, and
neither can anything inside it. Everything after it on the sheet is checked,
and what does not fit sends the whole chain to the next content area — which
is what splitting the containers above it means. There it is first in its
turn and goes down whatever its height.

So a container taller than a whole content area is no longer a refusal: it
comes out one per sheet, overflowing, as pdf.js draws it. Over the corpus
that places 4 260 more fields — 75 490 of 81 750 on 2 864 sheets — and every
one of them is a positioned subform the size of a page, which no rule would
ever have split.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 corpus_test.go   |   2 +-
 flow_test.go     |  11 +++-
 layout.go        |  18 +++++-
 paginate.go      | 142 +++++++++++++++++++++++++++++++++--------------
 paginate_test.go | 108 +++++++++++++++++++++++++++++------
 5 files changed, 216 insertions(+), 65 deletions(-)

diff --git a/corpus_test.go b/corpus_test.go
index fd9231b..af06c38 100644
--- a/corpus_test.go
+++ b/corpus_test.go
@@ -384,7 +384,7 @@ func TestPlacementOverTheCorpus(t *testing.T) {
 			case u.Kind == "field":
 				uf++
 				why[u.Why]++
-				if u.Why == tooTallForAPage || u.Why == noNextPage || u.Why == noRoomInside {
+				if u.Why == noNextPage || u.Why == noRoomInside {
 					pastTheBottom++
 				}
 			default:
diff --git a/flow_test.go b/flow_test.go
index d8dbb6e..3363fcb 100644
--- a/flow_test.go
+++ b/flow_test.go
@@ -306,6 +306,12 @@ func TestTheSlopAStackIsAllowed(t *testing.T) {
 	// heights written in millimetres and added up in points comes out a
 	// fraction over a page it was drawn to fill. One child, on a page twenty
 	// points tall.
+	//
+	// Z is a draw of no height at all, and it is there to claim the sheet's
+	// one free pass: the FIRST thing on a sheet that moves in one piece is not
+	// measured against anything (layout.js:266-268), so without it every
+	// height here would be allowed and the slop would not be under test. It
+	// takes no room, so the twenty points are still A's.
 	for _, tc := range []struct {
 		h      string
 		placed int
@@ -316,8 +322,9 @@ func TestTheSlopAStackIsAllowed(t *testing.T) {
 		{"22.6pt", 0}, // rounds to three, which is past it
 		{"30pt", 0},
 	} {
-		l := laidOut(t, page(`w="500pt" h="20pt"`, `<draw name="A" w="1pt" h="`+tc.h+`"/>`))
-		if n := len(l.Pages[0].Boxes); n != tc.placed {
+		l := laidOut(t, page(`w="500pt" h="20pt"`,
+			`<draw name="Z" w="1pt" h="0pt"/><draw name="A" w="1pt" h="`+tc.h+`"/>`))
+		if n := len(l.Pages[0].Boxes) - 1; n != tc.placed {
 			t.Errorf("a child %s tall on a 20pt page came out %d placed, want %d", tc.h, n, tc.placed)
 		}
 	}
diff --git a/layout.go b/layout.go
index 7d1b0d8..9f85d75 100644
--- a/layout.go
+++ b/layout.go
@@ -350,6 +350,17 @@ type placer struct {
 	// current content area the flow has got.
 	chain []*level
 	y     Measure
+	// free says nothing that has to move in one piece has been laid out on the
+	// sheet in hand yet, so the next thing that does cannot fail to fit. It is
+	// pdf.js's firstUnsplittable being null (layout.js:266-268), cleared once
+	// per sheet (template.js:5536-5538). See [placer.whole].
+	free bool
+	// noFail says the flow is inside that first container, whose whole subtree
+	// pdf.js also refuses to fail: noLayoutFailure is switched on before its
+	// own check and off again only on the way out of it
+	// (template.js:313-326, 5075-5178), and every checkDimensions branch reads
+	// it (layout.js:286, 319, 339, 361, 373).
+	noFail bool
 	// blocked is why the flow stopped, once it has: a height no arithmetic
 	// gives leaves everything below it in every open container with nowhere to
 	// begin.
@@ -510,8 +521,11 @@ func (p *placer) stack(n *FormNode, kids []*FormNode, lay string, f frame, wide
 			return
 		}
 		// pdf.js rounds before comparing and allows two points of slop
-		// (layout.js:275, 349). See [fitSlop].
-		if !fits(off+h, room) {
+		// (layout.js:275, 349). See [fitSlop]. Inside the first container of
+		// the sheet that moves in one piece there is no comparison at all:
+		// noLayoutFailure is on for the whole of its subtree, and every branch
+		// of checkDimensions returns true while it is. See [placer.noFail].
+		if !p.noFail && !fits(off+h, room) {
 			// A container this deep is one that moves in one piece, so what
 			// does not fit in it cannot be carried onto another page: it would
 			// leave the rest of the container behind.
diff --git a/paginate.go b/paginate.go
index e7f38cc..640a595 100644
--- a/paginate.go
+++ b/paginate.go
@@ -48,33 +48,78 @@ type level struct {
 	cols []Measure
 }
 
-// flowable says a container is one this slice carries across a page boundary:
-// its children before the break stay where they are and the rest go on.
+// splittable says a container is one this package breaks across a content
+// area boundary: the children it managed to place stay where they are, and
+// the rest of it goes on in the next one.
 //
-// pdf.js's rule (Subform[$isSplittable], template.js:4940-4975) is: not a
-// positioned layout, not a row, and not kept intact. This is that rule with
-// the first two clauses stated the other way round — only tb and table stack
-// downwards, which is the only direction this package computes — so it also
-// refuses lr-tb and rl-tb, which pdf.js would split and whose height this
-// package cannot arrive at in the first place.
+// It is a property of the CHAIN and not of the container, which is why it is a
+// method: pdf.js's rule (Subform[$isSplittable], template.js:4940-4975) begins
+// by asking the container above,
 //
-// The keep clause is not decoration: 1 355 elements in the corpus carry keep
-// intact="contentArea", which is a designer saying "do not let this table row
-// land half on one page and half on the next". A container that fails the test
-// moves in one piece.
+//	const parent = this[$getSubformParent]();
+//	if (!parent[$isSplittable]()) { return false; }
 //
-// The enclosing chain matters too, and is handled by construction rather than
-// by a test: this is only ever asked of a container the flow has already
-// reached, and the flow only reaches through containers that pass it.
-func flowable(n *FormNode) bool {
+// and only then looks at the container itself. Four things must all hold.
+//
+//  1. The container above it is splittable. The recursion ends at the
+//     <template> element, which answers yes (template.js:5401-5403). Every
+//     other kind of node answers no by inheriting the base
+//     (xfa_object.js:214-216), and the one that matters is <area>: it holds
+//     body content, it is not a subform, and $getSubformParent does not skip
+//     it (template.js:4901-4907), so nothing inside an area is ever split.
+//  2. Its own layout is neither "position" nor anything containing "row".
+//     Stated the other way round here — only tb and table — because those are
+//     the two this package stacks. pdf.js would also split lr-tb and rl-tb,
+//     whose height this package does not compute at all.
+//  3. Its <keep intact> is "none": an author's instruction not to let this
+//     land half on one sheet and half on the next. 1 355 elements of the
+//     corpus carry one. An exclGroup has the same predicate WITHOUT this
+//     clause (template.js:2405-2429) — read there rather than assumed — and
+//     that difference is kept.
+//  4. If the container above it has a layout ending in "-tb" and has already
+//     put something on the line in hand, it is not splittable. pdf.js gives
+//     the reason in full (template.js:4962-4970):
+//
+//     "If parent can fit in w=100 and there's already an element which takes
+//     90 then we've 10 for this element. Suppose this element has a tb layout
+//     and 5 elements have a width of 7 and the 6th has a width of 20: then
+//     this element (and all its content) must move on the next line. If this
+//     element is splittable then the first 5 children will stay at the end of
+//     the line: we don't want that."
+//
+//     This clause is not code here, and that is a measurement rather than an
+//     omission: the only containers this package ever flows through are tb and
+//     table, neither of which ends in "-tb", so the clause cannot change an
+//     answer. It needs numberInLine — how many children are already on the
+//     current line — which nothing here computes, and which is the lr-tb
+//     slice's to bring.
+//
+// pdf.js memoises the answer within one content area and says outright that it
+// must not be kept across them, because the content area can change
+// (template.js:4941-4942). Nothing is memoised here: the chain is a dozen deep
+// at most, and asking it afresh cannot be wrong for the reason pdf.js names.
+func (p *placer) splittable(n *FormNode) bool {
+	switch n.Kind {
+	case "template":
+		return true
+	case "subform", "exclGroup":
+	default:
+		return false
+	}
+	parent, ok := p.up[n]
+	if !ok || !p.splittable(parent) {
+		return false
+	}
 	switch layoutOf(n) {
 	case "tb", "table":
 	default:
 		return false
 	}
-	switch n.Template.Child("keep").Get("intact") {
-	case "contentArea", "pageArea", "parentSubform":
-		return false
+	if n.Kind == "subform" {
+		switch n.Template.Child("keep").Get("intact") {
+		case "contentArea", "pageArea", "parentSubform":
+			return false
+		}
 	}
 	return true
 }
@@ -87,16 +132,14 @@ func contentAreas(area *FormNode) []*Node {
 // noNextPage is why an element is not placed when the page set has run out.
 const noNextPage = "the form ran out of pages before it: its page set gives no page after the last one"
 
-// tooTallForAPage is why an element that cannot be split is not placed when it
-// does not fit a whole empty content area.
-const tooTallForAPage = "it is taller than a whole content area and cannot be broken, " +
-	"so it could only be placed by splitting it across a page boundary, which this slice does not do"
-
 // noRoomInside is why an element is not placed where the container holding it
 // writes a height too small for what it holds. It cannot be carried to another
 // page: a container that is not split takes its contents with it.
+//
+// It is not reported for the first such container of a sheet, which pdf.js
+// refuses to fail — see [placer.whole] and [placer.noFail].
 const noRoomInside = "there is no room left for it inside the container holding it, " +
-	"which is not one this slice splits across a page boundary"
+	"which is not one this package splits across a page boundary"
 
 // body lays the form's outermost subform out across as many pages as it needs.
 func (p *placer) body(root *FormNode) {
@@ -112,7 +155,7 @@ func (p *placer) body(root *FormNode) {
 	// page it starts on. Neither happens on an outermost subform in the
 	// corpus; the check is here so that one would not be flowed as if its
 	// origin were its top left.
-	if !flowable(root) || anchored(root.Template) || rotateOf(root.Template) != 0 {
+	if !p.splittable(root) || anchored(root.Template) || rotateOf(root.Template) != 0 {
 		p.place(root, frame{x: p.area.X, y: p.area.Y, avail: p.avail, wide: p.wide})
 		return
 	}
@@ -147,7 +190,7 @@ func (p *placer) flow(n *FormNode) {
 			p.rejectKids(kids[i:], noNextPage)
 			return
 		}
-		if flowable(kid) {
+		if p.splittable(kid) {
 			if !p.push(kid, 0, 0) {
 				continue
 			}
@@ -179,28 +222,36 @@ func (p *placer) whole(kid *FormNode, lv *level, lay string) bool {
 			"a %s layout stacks its children, and the height of the one above it is not computed: %s", lay, why)
 		return false
 	}
-	if !fits(p.y+h, lv.bottom) {
-		switch {
-		case !fits(lv.top+h, lv.bottom) && p.chain[0] == lv:
-			// It could not be placed on an empty page either, and there is no
-			// container above it whose own height is what is too small.
-			p.rejectAll(kid, tooTallForAPage)
-			return true
-		case !fits(lv.top+h, lv.bottom):
-			p.rejectAll(kid, noRoomInside)
-			return true
-		case !p.advance(nil):
+	// The first thing that moves in one piece cannot fail to fit, and that is
+	// pdf.js's rule rather than a concession. checkDimensions returns true
+	// outright while the sheet has had none (layout.js:266-268), and the one
+	// that claims it switches noLayoutFailure on before its own check runs
+	// (setFirstUnsplittable, template.js:313-319; called at :5079 for a
+	// subform, :2484 for an exclGroup, :1927 for a draw and :2878 for a
+	// field), so it cannot fail either. Everything after it on that sheet is
+	// checked, and what does not fit sends the whole chain to the next content
+	// area — which is what splitting the containers above it MEANS. There it
+	// is first in its turn, and goes down whatever its height.
+	//
+	// This is why a container taller than a whole content area is not a
+	// refusal: it comes out one per sheet, overflowing, exactly as pdf.js
+	// draws it.
+	for !p.free && !fits(p.y+h, lv.bottom) {
+		if !p.advance(nil) {
 			p.blocked = noNextPage
 			p.rejectAll(kid, noNextPage)
 			return false
-		case !fits(p.y+h, lv.bottom):
-			// The new content area is smaller than the one it came from.
-			p.rejectAll(kid, tooTallForAPage)
-			return true
 		}
 	}
+	// pdf.js marks the first one whether or not it needed the pass, and leaves
+	// noLayoutFailure on for the whole of its subtree — it is unset only on
+	// the way out of that same node (template.js:321-326, 5175-5178). So what
+	// is inside it is not checked either. See [placer.noFail].
+	first := p.free
+	p.free, p.noFail = false, first
 	p.touch()
 	p.placeAt(kid, frame{x: lv.x, y: p.y, avail: lv.bottom - p.y, wide: lv.wide, cols: lv.cols}, nil)
+	p.noFail = false
 	p.y += h
 	return true
 }
@@ -288,7 +339,7 @@ func (p *placer) seat(lv *level, parentX, parentBottom, parentWide Measure) {
 	lv.top = p.y + lv.yoff + lv.in.top
 	lv.bottom = lv.top + room
 	// A container of the flowing chain is always a tb or a table
-	// ([flowable]), and neither is ever a cell of a row, so there is no
+	// ([placer.splittable]), and neither is ever a cell of a row, so there is no
 	// column width to hand [innerWide].
 	lv.wide = innerWide(lv.node, parentWide, 0, layoutOf(lv.node), lv.in)
 	p.y = lv.top
@@ -425,6 +476,11 @@ func (p *placer) startPage(area *FormNode) {
 	}
 	p.layout.Pages = append(p.layout.Pages, page)
 	p.touched = append(p.touched, 0)
+	// pdf.js clears firstUnsplittable and noLayoutFailure once per SHEET,
+	// before the loop over that sheet's content areas (template.js:5536-5538),
+	// so a second content area of the same sheet does not hand out a second
+	// free pass. See [placer.whole].
+	p.free = true
 	p.used[area] = true
 	p.placeAt(area, frame{avail: given(page.Height), wide: given(page.Width)}, nil)
 }
diff --git a/paginate_test.go b/paginate_test.go
index d39764e..731b408 100644
--- a/paginate_test.go
+++ b/paginate_test.go
@@ -89,14 +89,17 @@ func TestAPositionedContainerMovesInOnePieceToo(t *testing.T) {
 		"0: draw f.A 0,0 1x20", "1: draw f.G.B 2,3 1x4"})
 }
 
-func TestWhatFitsNoSheetAtAllIsReportedRatherThanTurnedForEverAfter(t *testing.T) {
+func TestTheFirstThingOnASheetGoesDownWhateverItsHeight(t *testing.T) {
 	// The brick is taller than a whole content area, so no sheet will ever
-	// hold it. Turning the page would not help and would leave a blank sheet
-	// behind, so it is reported and the stack goes on without it.
+	// hold it. pdf.js does not refuse it: checkDimensions returns true while
+	// the sheet has had nothing that moves in one piece (layout.js:266-268),
+	// so it goes down and hangs over the bottom. What follows it does not fit
+	// beside it and turns the page, where it is first in its turn.
 	l := laidOut(t, sheets(`>`+sheet("P", "", "20", ""), `
 	  <draw name="A" w="1pt" h="50pt"/><draw name="B" w="1pt" h="5pt"/>`))
-	same(t, "the sheets", byPage(l), []string{"0: draw f.B 0,0 1x5"})
-	same(t, "what was left off", notLaid(l), []string{"f.A: " + tooTallForAPage})
+	same(t, "the sheets", byPage(l), []string{
+		"0: draw f.A 0,0 1x50", "1: draw f.B 0,0 1x5"})
+	same(t, "what was left off", notLaid(l), nil)
 }
 
 func TestWhatFitsNoRoomInsideAContainerThatMovesWholeIsReported(t *testing.T) {
@@ -104,13 +107,34 @@ func TestWhatFitsNoRoomInsideAContainerThatMovesWholeIsReported(t *testing.T) {
 	// second child has nowhere to go: carrying it onto another sheet would
 	// leave the rest of the group behind, which is the one thing keeping a
 	// container intact forbids.
+	//
+	// Z is there so that the group is not the FIRST thing on the sheet that
+	// moves in one piece. That one is laid out with noLayoutFailure on for its
+	// whole subtree (template.js:5075-5178) and nothing inside it is checked
+	// at all, which the test below this one is about.
 	l := laidOut(t, sheets(`>`+sheet("P", "", "100", ""), `
+	  <draw name="Z" w="1pt" h="5pt"/>
 	  <subform name="G" layout="tb" h="10pt"><keep intact="contentArea"/>
 	    <draw name="A" w="1pt" h="9pt"/><draw name="B" w="1pt" h="9pt"/></subform>`))
-	same(t, "the sheets", byPage(l), []string{"0: draw f.G.A 0,0 1x9"})
+	same(t, "the sheets", byPage(l), []string{
+		"0: draw f.Z 0,0 1x5", "0: draw f.G.A 0,5 1x9"})
 	same(t, "what was left off", notLaid(l), []string{"f.G.B: " + noRoomInside})
 }
 
+func TestNothingInsideTheFirstContainerOfASheetIsCheckedAtAll(t *testing.T) {
+	// The same group, now first on the sheet. pdf.js switches noLayoutFailure
+	// on before the first unsplittable container's own check and off again
+	// only on the way out of it (template.js:313-326, 5075-5178), and every
+	// branch of checkDimensions returns true while it is on — so B goes down
+	// inside a group ten points tall that already holds nine.
+	l := laidOut(t, sheets(`>`+sheet("P", "", "100", ""), `
+	  <subform name="G" layout="tb" h="10pt"><keep intact="contentArea"/>
+	    <draw name="A" w="1pt" h="9pt"/><draw name="B" w="1pt" h="9pt"/></subform>`))
+	same(t, "the sheets", byPage(l), []string{
+		"0: draw f.G.A 0,0 1x9", "0: draw f.G.B 0,9 1x9"})
+	same(t, "what was left off", notLaid(l), nil)
+}
+
 func TestASheetTheBodyNeverReachedIsNotShipped(t *testing.T) {
 	// A break after the last child asks for a sheet nothing then goes on.
 	l := laidOut(t, sheets(`>`+sheet("P", "", "100", ""), `
@@ -299,28 +323,36 @@ func TestAPageAreaWithNoPageSetAroundItIsNowhereToGoOn(t *testing.T) {
 		"f.S.A1: " + noNextPage, "f.S.A2: " + noNextPage})
 }
 
-func TestWhatANestedContainerCannotFitInsideItselfIsReported(t *testing.T) {
-	// The inner subform stacks and may be split, but it writes ten points of
-	// its own height and B is twenty tall — so B fits nowhere inside it, and
-	// turning the page would not help: In would have ten points again. The
-	// sheet is not turned for something a fresh one could not hold either.
+func TestANestedContainerIsBrokenAcrossTheSheetAndGoesOnBelowWhatFollowsIt(t *testing.T) {
+	// The inner subform stacks and may be split, and it writes ten points of
+	// its own height, so B — twenty tall — has nowhere to go inside it on this
+	// sheet. It is not dropped: In keeps A where A fits, the sheet turns, and
+	// In begins again at the top of the next content area with B. That is what
+	// pdf.js's saved generator does, and what it means for a container to be
+	// split rather than moved.
+	//
+	// C then follows B rather than A, because what In contributes to the stack
+	// above it is what it holds ON THIS sheet (template.js:5222).
 	l := laidOut(t, sheets(`>`+sheet("P", "", "100", ""), `
 	  <subform name="Out" layout="tb">
 	    <subform name="In" layout="tb" h="10pt">
 	      <draw name="A" w="1pt" h="9pt"/><draw name="B" w="1pt" h="20pt"/></subform>
 	    <draw name="C" w="1pt" h="5pt"/></subform>`))
 	same(t, "the sheets", byPage(l), []string{
-		"0: draw f.Out.In.A 0,0 1x9", "0: draw f.Out.C 0,10 1x5"})
-	same(t, "what was left off", notLaid(l), []string{"f.Out.In.B: " + noRoomInside})
+		"0: draw f.Out.In.A 0,0 1x9",
+		"1: draw f.Out.In.B 0,0 1x20", "1: draw f.Out.C 0,20 1x5"})
+	same(t, "what was left off", notLaid(l), nil)
 }
 
-func TestASheetSmallerThanTheOneBeforeItCanStillBeTooSmall(t *testing.T) {
+func TestASheetSmallerThanTheOneBeforeItStillTakesTheFirstThing(t *testing.T) {
 	// P1 has room for the brick and P2 does not. The brick fits no room left
-	// on P1, so the sheet turns — and on P2 it does not fit at all.
+	// on P1, so the sheet turns — and on P2 it is the first thing that moves
+	// in one piece, which pdf.js will not fail whatever its height.
 	l := laidOut(t, sheets(`>`+sheet("P1", "", "30", `<occur max="1"/>`)+sheet("P2", "", "10", ""), `
 	  <draw name="A" w="1pt" h="20pt"/><draw name="B" w="1pt" h="20pt"/>`))
-	same(t, "the sheets", byPage(l), []string{"0: draw f.A 0,0 1x20"})
-	same(t, "what was left off", notLaid(l), []string{"f.B: " + tooTallForAPage})
+	same(t, "the sheets", byPage(l), []string{
+		"0: draw f.A 0,0 1x20", "1: draw f.B 0,0 1x20"})
+	same(t, "what was left off", notLaid(l), nil)
 }
 
 func TestAMarginNobodyCanReadStopsTheContainerRatherThanTheForm(t *testing.T) {
@@ -389,3 +421,45 @@ func TestABreakToASheetThatIsSpentTakesTheSequenceInstead(t *testing.T) {
 		"1: draw f.F.A2 7,0 1x15",
 		"2: draw f.S.B 7,0 1x5"})
 }
+
+func TestSplittabilityIsAskedOfTheWholeChainAndNotOfOneNode(t *testing.T) {
+	// pdf.js asks the container ABOVE before it looks at the container itself
+	// (template.js:4943-4946), and the answer is no as soon as anything in the
+	// chain says no. A tb subform inside a positioned one is not splittable,
+	// however splittable it looks on its own.
+	//
+	// Nothing this package flows through can reach that case, because the flow
+	// only ever descends through containers that already passed — so this is
+	// the witness that the chain is ASKED rather than assumed, and the guard
+	// that would catch a flow that one day descends somewhere else.
+	form := Expand(parse(t, `<template><subform name="f" layout="tb">
+	  <subform name="Pos"><subform name="In" layout="tb"/></subform>
+	  <area name="Ar"><subform name="Under" layout="tb"/></area>
+	  <subform name="Kept" layout="tb"><keep intact="contentArea"/></subform>
+	  <exclGroup name="X" layout="tb"><keep intact="contentArea"/></exclGroup>
+	  <exclGroup name="Row" layout="row"/>
+	  <field name="L"/></subform></template>`), nil)
+	p := &placer{up: map[*FormNode]*FormNode{}}
+	p.mapUp(form.Root)
+	named := map[string]*FormNode{}
+	form.Root.Walk(func(n *FormNode) { named[n.Name] = n })
+	for _, tc := range []struct {
+		name string
+		want bool
+		why  string
+	}{
+		{"f", true, "tb, and the <template> above it ends the recursion saying yes"},
+		{"Pos", false, "a positioned layout is never split"},
+		{"In", false, "tb, but the positioned container above it is not splittable"},
+		{"Ar", false, "an <area> inherits the base answer, which is no"},
+		{"Under", false, "tb, but nothing inside an area is ever split"},
+		{"Kept", false, "a subform kept intact is an author saying do not break this"},
+		{"X", true, "an exclGroup has the same rule WITHOUT the keep clause"},
+		{"Row", false, "a layout containing row is never split"},
+		{"L", false, "a field is not a container"},
+	} {
+		if got := p.splittable(named[tc.name]); got != tc.want {
+			t.Errorf("%s came out %v, want %v: %s", tc.name, got, tc.want, tc.why)
+		}
+	}
+}

From e9189809fea21c2948c79667e1f61e29018530a6 Mon Sep 17 00:00:00 2001
From: tannevaled <tannevaled@users.noreply.github.com>
Date: Fri, 4 Sep 2026 08:29:15 +0200
Subject: [PATCH 2/3] Reflow the splittable rule's list, as gofmt writes it

---
 paginate.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/paginate.go b/paginate.go
index 640a595..f420c11 100644
--- a/paginate.go
+++ b/paginate.go
@@ -67,15 +67,18 @@ type level struct {
 //     (xfa_object.js:214-216), and the one that matters is <area>: it holds
 //     body content, it is not a subform, and $getSubformParent does not skip
 //     it (template.js:4901-4907), so nothing inside an area is ever split.
+//
 //  2. Its own layout is neither "position" nor anything containing "row".
 //     Stated the other way round here — only tb and table — because those are
 //     the two this package stacks. pdf.js would also split lr-tb and rl-tb,
 //     whose height this package does not compute at all.
+//
 //  3. Its <keep intact> is "none": an author's instruction not to let this
 //     land half on one sheet and half on the next. 1 355 elements of the
 //     corpus carry one. An exclGroup has the same predicate WITHOUT this
 //     clause (template.js:2405-2429) — read there rather than assumed — and
 //     that difference is kept.
+//
 //  4. If the container above it has a layout ending in "-tb" and has already
 //     put something on the line in hand, it is not splittable. pdf.js gives
 //     the reason in full (template.js:4962-4970):

From 311c13c486bd1e3c680112b9fc8bc445c5816131 Mon Sep 17 00:00:00 2001
From: tannevaled <tannevaled@users.noreply.github.com>
Date: Fri, 4 Sep 2026 08:31:07 +0200
Subject: [PATCH 3/3] Say in the doc and the README what is split and what
 merely fits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The package comment and the README described a slice that did not split
containers and reported a too-tall one unplaced. Both now say the rule as
pdf.js states it — the chain, its four clauses, the <area> terminus, and the
exclGroup's missing keep clause — and say plainly that what moves whole is
still put on the paper, one per sheet, hanging over the bottom.

The judge tables carry the new population, and the pairing audit with them:
of 156 574 body boxes on the agreeing forms, 149 433 paired and NONE were
dropped because the two sides counted differently. 460 of the 461 keyed but
missing from pdf.js's dump are presence="hidden".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 README.md | 140 ++++++++++++++++++++++++++++++++++++++++++++----------
 doc.go    |  40 +++++++++++-----
 2 files changed, 142 insertions(+), 38 deletions(-)

diff --git a/README.md b/README.md
index 2159493..1229ff2 100644
--- a/README.md
+++ b/README.md
@@ -135,16 +135,53 @@ Breaks are not a corner: **435 of the 560 forms carry a `<breakBefore>`**, and
 2 155 of the 2 561 in the corpus are `startNew="1"`, which means "a fresh sheet
 here, once".
 
-A container that would have to be **broken in two** for its parts to fit is not
-broken. pdf.js keeps `[$extra].children`, a generator and a `failingNode` to do
-that (`layout.js:38-53`); this does not. A container that *may* be split
-(`Subform[$isSplittable]`, `template.js:4940-4975`) has its children
-distributed across sheets instead, which is the same thing where the container
-itself draws nothing. One that may not — a positioned layout, a row, or
-anything with `keep intact` — moves whole, and is reported unplaced where it
-fits no sheet at all. 1 355 elements in the corpus carry
-`keep intact="contentArea"`, which is a designer saying "do not let this row
-land half on one page and half on the next".
+### Splitting a container is a chain question, not a node question
+
+A container that *may* be split is broken across the boundary: what it placed
+before the break stays where it is, and the rest of it begins again at the top
+of the next content area — which is what pdf.js's saved generator and
+`failingNode` do (`layout.js:38-53`).
+
+Whether it may is **a property of the whole chain above it**, and
+`Subform[$isSplittable]` (`template.js:4940-4975`) asks the container above
+before it looks at the container itself. Four things must all hold:
+
+1. the container above it is splittable — the recursion ends at the
+   `<template>` element, which answers yes (`template.js:5401-5403`), and every
+   other kind of node inherits the base answer, no (`xfa_object.js:214-216`).
+   The one that matters is `<area>`: it holds body content, it is not a
+   subform, and `$getSubformParent` does not skip it — so **nothing inside an
+   area is ever split**;
+2. its own layout is neither `position` nor anything containing `row`;
+3. its `<keep intact>` is `none`. 1 355 elements in the corpus carry
+   `keep intact="contentArea"`, a designer saying "do not let this row land
+   half on one page and half on the next". An `exclGroup` has the same
+   predicate **without** this clause (`template.js:2405-2429`), read there
+   rather than assumed;
+4. if the container above it has a layout ending in `-tb` and has already put
+   something on the line in hand, it is not splittable. That clause is not code
+   here and the doc comment says why: no container this package flows through
+   ends in `-tb`, so it cannot change an answer, and it needs `numberInLine`,
+   which the `lr-tb` slice will bring.
+
+### What moves whole is still put on the paper
+
+A container that may not be split is not dropped for being too tall.
+`checkDimensions` returns true outright while the sheet has had nothing that
+moves in one piece (`layout.js:266-268`), and the one that claims that pass has
+`noLayoutFailure` switched on before its own check runs
+(`setFirstUnsplittable`, `template.js:313-319`), so it cannot fail either — and
+nor can anything inside it, because the flag is cleared only on the way out of
+that same node.
+
+Everything after it on the sheet **is** checked, and what does not fit sends
+the whole chain to the next content area, which is what splitting the
+containers above it *means*. There it is first in its turn, and goes down
+whatever its height. So a container taller than a whole content area comes out
+one per sheet, hanging over the bottom, exactly as pdf.js draws it. The pass is
+handed out once per **sheet**, not once per content area: pdf.js clears
+`firstUnsplittable` in the page loop, before the loop over that sheet's content
+areas (`template.js:5536-5538`).
 
 ### The recursion pdf.js dies on is not in the branch it looks to be in
 
@@ -373,6 +410,43 @@ sides puts the count back to **0**.
 It is slice 4's fault in a new place: a comparison at fault announcing itself
 as a disagreement about the subject.
 
+## Splitting, and 4 260 fields that were never a splitting problem
+
+### What it is worth: 4 260 more fields, and none of them wanted splitting
+
+| | slice 5 | slice 6 |
+|---|---:|---:|
+| **placed** | **71 230** | **75 490** |
+| taller than a whole content area, and cannot be broken | 4 214 | **0** |
+| past the last sheet the page set gives | 1 887 | 1 887 |
+| no room inside a container that moves in one piece | 107 | 61 |
+| under `lr-tb` | 4 303 | 4 303 |
+| anchored by a corner, with no size of its own | 9 | 9 |
+| sheets | 2 737 | 2 864 |
+
+**The disagreement first.** "Most of the 6 208 want a container broken across a
+sheet" is not what they wanted. All 4 214 of the largest bucket are
+**positioned subforms**, and a positioned layout fails clause 2 of
+`$isSplittable`: no rule anywhere would ever have split one of them. They are
+whole-page subforms — `form1.Page1`, `topmostSubform.Page5` — six to thirty
+points taller than the content area they are drawn for, one per printed sheet,
+which is how LiveCycle writes a multi-page form.
+
+What was refusing them was not the absence of a splitter. It was a fit-check
+this package applied and pdf.js does not: **the first thing on a sheet that
+moves in one piece is never measured against anything.** Because the first
+whole-page subform was rejected, the flow never turned the page at all, and
+every later one was rejected against the same sheet. `us-irs__fw9` came out on
+one sheet with 321 fields unplaced, against pdf.js's six sheets.
+
+The reconciliation is exact: 4 214 too-tall placed + 46 freed from
+`noRoomInside` (inside the first such container of a sheet, pdf.js checks
+nothing either) = **4 260**, and 71 230 + 4 260 = **75 490**. No count went
+down anywhere this time.
+
+**1 887 past the last sheet did not move**, which is worth saying: turning more
+pages did not exhaust any page set that was not exhausted before.
+
 ### Checked against pdf.js, which CAN see all of this
 
 The judge from slices 2 and 3 is extended rather than replaced, and one thing
@@ -398,32 +472,48 @@ into the "pdf.js placed it by flexbox" one, where they belong.
 |---|---:|---:|
 | boxes where pdf.js emits a real place | 176 | |
 | **agree exactly** | **176** | **100.00%** |
-| boxes pdf.js placed by flexbox | 152 446 | |
-| ... at the flow container's own origin, where a first child goes | 149 488 | |
-| ... below or to the right of it, where the rest go | 2 958 | |
+| boxes pdf.js placed by flexbox | 161 820 | |
+| ... at the flow container's own origin, where a first child goes | 157 108 | |
+| ... below or to the right of it, where the rest go | 4 712 | |
 | ... **above or to the left of it, which would be outside it** | **0** | **0.00%** |
 
 | which sheet they went on | | |
 |---|---:|---:|
-| forms where this package placed **every** element of the body | 431 | |
-| of those, agreeing with pdf.js on the number of sheets | **428** | 99.3% |
-| boxes paired on those forms | 117 378 | |
-| **on the same sheet as pdf.js put them** | **117 378** | **100.00%** |
+| forms where this package placed **every** element of the body | 473 | |
+| of those, agreeing with pdf.js on the number of sheets | **469** | 99.2% |
+| boxes paired on those forms | 149 433 | |
+| **on the same sheet as pdf.js put them** | **149 433** | **100.00%** |
 | on another sheet | 0 | 0.00% |
-| forms where fewer elements were placed, and so fewer sheets used | 35 | |
-| ... the same number of sheets | 17 | |
+| forms where fewer elements were placed, and so fewer sheets used | 5 | |
+| ... the same number of sheets | 5 | |
 | ... **MORE** sheets, which would be a defect | **0** | 0.00% |
 
-The three sheet-count disagreements are not pagination and not text. Two
-(`us-opm__sf813`, `us-opm__sf39a`) have a **positioned** outermost subform, and
-pdf.js's `checkDimensions` position arm (`layout.js:355-364`) sends children
-reaching past the bottom of the content area onto a second sheet; this package
-does not fit-check a positioned layout at all.
+**The pairing itself was re-audited, not just the rate.** Splitting changes
+which boxes are comparable, so the question is what the judge never gets to
+compare. Of 156 574 body boxes on the 469 agreeing forms: 149 433 paired,
+6 680 unnamed and so never keyed, 461 keyed but absent from pdf.js's dump —
+**460 of those 461 are `presence="hidden"`**, which pdf.js emits as
+`display:none` and the dump does not carry — and **0** dropped because the two
+sides produced a different number of boxes for one key. That last zero is the
+one that matters: splitting did not create a single new mispairing.
+
+Four forms disagree on the sheet count. Two (`us-opm__sf813`, `us-opm__sf39a`)
+are the same two as before and are not pagination: they have a **positioned**
+outermost subform, and pdf.js's `checkDimensions` position arm
+(`layout.js:355-364`) sends children reaching past the bottom of the content
+area onto a second sheet, which this package does not fit-check at all. Two
+(`us-uscis__i-600a`, `us-uscis__i-821`) are newly visible: they were nowhere
+near fully placed before — `i-600a` came out on **one** sheet against pdf.js's
+fourteen — and now come out on thirteen. In both, every box agrees up to a
+`<breakBefore targetType="pageArea" startNew="1"/>` and is one sheet behind
+after it. That is a question about breaks, not about splitting, and it is not
+diagnosed to the line here.
 
 **What none of this covers**: where inside a container the children ended up
 (two orderings come to the same total, and no height tells them apart);
 borders, margins and insets on positioned layouts; anything under a rotated
-ancestor; breaking one container in two across a sheet; and real per-glyph
+ancestor; where a break inside a container that moves whole would have sent
+the page; and real per-glyph
 advances, which nothing here has and which the comparison is therefore blind
 to in both directions. It also could not run on 77 of the 560 forms — 70
 because pdf.js's `selectFont` dereferences a null typeface when no font is
diff --git a/doc.go b/doc.go
index aa6cdb8..3872dd5 100644
--- a/doc.go
+++ b/doc.go
@@ -95,26 +95,40 @@
 // is a state machine rather than "another of the same" — the page set's
 // relation, each page area's occur, the parity of the page number, and the
 // explicit breaks the template writes — and [Place] follows pdf.js's
-// (template.js:4064-4236, 5418-5657). A container that MAY be split has its
-// children distributed across sheets; one that may not — a positioned layout,
-// a row, anything with keep intact — moves whole. Breaking one container in
-// two is a slice of its own.
+// (template.js:4064-4236, 5418-5657).
+//
+// A container that MAY be split is broken across the boundary: what it placed
+// before the break stays where it is, and the rest of it begins again at the
+// top of the next content area. Whether it may is a property of the whole
+// CHAIN above it and not of the container alone, which is pdf.js's rule and
+// the reason [placer.splittable] recurses upward. One that may not — a
+// positioned layout, a row, anything with keep intact, anything inside an
+// <area> — moves whole.
+//
+// What moves whole is still put on the paper. The first such container of each
+// sheet is not measured against anything: pdf.js's checkDimensions returns
+// true while the sheet has had none (layout.js:266-268) and the one that
+// claims that pass cannot fail either, nor can anything inside it. Everything
+// after it on that sheet is checked, and what does not fit turns the page —
+// where it is first in its turn. So a container taller than a whole content
+// area comes out one per sheet, hanging over the bottom, which is what pdf.js
+// draws.
 //
 // Everything it does not reach — lr-tb and the two layouts that fill from the
-// right, a container taller than any sheet, a form that runs out of pages —
-// comes back in [Layout.Unplaced] with
-// the reason written out, one element at a time. Nothing of the body is
-// dropped. A page area's own furniture is drawn once on every sheet that page
-// area makes, which is the one thing not in one-to-one correspondence with the
-// boxes on the paper.
+// right, a form that runs out of pages, an element with no room inside a
+// container that moves whole — comes back in [Layout.Unplaced] with the reason
+// written out, one element at a time. Nothing of the body is dropped. A page
+// area's own furniture is drawn once on every sheet that page area makes,
+// which is the one thing not in one-to-one correspondence with the boxes on
+// the paper.
 //
 // Measured over the same 560 packages:
 //
 //	81 750 fields in the body of the expanded forms
-//	71 230 placed, 130 846 draws with them, on 2 737 sheets
-//	 6 208 have a place computed and nowhere left to put it: taller than a
-//	       whole content area, or past the last sheet the page set gives
+//	75 490 placed, 140 585 draws with them, on 2 864 sheets
 //	 4 303 sit under lr-tb, which wraps its children onto lines
+//	 1 887 are past the last sheet the page set gives
+//	    61 have no room inside a container that moves in one piece
 //	     9 are anchored by a corner, with no size of their own
 //
 // # What checks it