[DWAA1660]

AcroForm variables were recreated for every script invocation, so buttons could not retain counters or saved form state, and catalog OpenAction never ran. Keep one sandboxed JavaScript realm per open document, initialize document scripts once, then run Open before interaction and Will Save before incremental/full serialization. Will Print uses the same realm.

Add field setAction, setItems, strokeColor and bounded plain-array/object toSource; dispatch hover, focus and mouse scripts in the UI and expose js_event through automation. Checkbox/radio Mouse Up actions see the newly stored value and update every dependent field widget. Script errors appear in the UI and console.

Integrate with current upstream background opening: OpenAction runs once during commit_open, including worker-prepared documents and reloads. Revert resets the realm while retaining upstream recovery handling. Browser printing reads geometry after the mutable Will Print hook. A timeout preserves the actionable XFA scripts-disabled explanation, with details retained in the console; ordinary exceptions remain visible.

Fixes #269.
Fixes #247 (related checkbox/radio JavaScript visibility failure).
Partially addresses #169: persistent script state is fixed; animation timers and page events remain unsupported, so this PR does not close #169.

Validation:

• 1,932 non-UI workspace tests passed, including engine/automation coverage; 239 engine tests and six targeted JavaScript UI tests passed.
• Strict workspace Clippy, formatting, assets, layers, dependency/advisory checks and parity passed. The browser UI compiles for wasm32.
• Full local cargo xtask ci passed all eight gates, with 3,032 tests passed and 15 ignored, in a validation-only tree containing PR Keep native open replies queued while dialogs and pickers are active #1953 plus a bounded readiness wait for the absolute GoToR consent test. Those temporary dependency/test changes were removed before publishing. Published-branch CI remains blocked by the upstream background-opening regressions below.
• New regressions cover worker preparation/registration, fresh state after reload, persistent globals, save/reopen, failed Will Save, field actions, checkbox visibility and script-error display. Existing XFA notification regressions also pass with the notice-priority fix.

Upstream CI blocker / maintainer action:
Current main's background-opening regressions affect the chosen-tool continuation and recent-file tests. Merge PR #1953, which was tested with this branch. PRs #1681 and #1764 overlap that repair. Its changes are excluded from this PR. The Windows test an_absolute_gotor_waits_for_consent_and_keeps_its_destination_across_tabs also needs a bounded readiness wait after Allow instead of assuming completion within three frames; its consent and destination assertions passed with that wait during validation. Merge/update that upstream work and refresh this branch before requiring a green complete CI run. Maintainer edits are enabled.

Limits: toSource serializes bounded plain data, not functions/RegExp/Date. Did Save/Did Print, page actions, animation timers and widget-specific dispatch remain partial; parity and ROADMAP record those limits.

[DWAA1660]

Merged upstream main (now b8ddf71) to clear the merge conflict. ROADMAP.md: the #269 log line sits at the top of main's progress log, and the M6 milestone note moved to docs/roadmap.md along with main's table. crates/engine/src/tests.rs: both sides' tests are kept.

On this branch Session::save_bytes takes &mut self because it runs Will Save, so tests added on main that saved through a shared reference didn't compile after the merge. I adjusted them: automation/tests/form_bulk.rs now goes through a new Automation::session_mut(), and ui-egui bookmarks, bulk_fields and fill_sign use Harness::state_mut(). Workspace clippy (Rust 1.99), fmt, and the engine/js/forms/automation tests plus the affected ui-egui tests all pass.

🤖 Generated with Claude Code