Field-tree removal JSON and callback operations

The Windows and native Linux C ABI operation entry points accept forms.remove; JSON contains complete field names, and PDF bytes travel through callback IO

{
  "schemaVersion": 1,
  "type": "forms.remove",
  "fields": ["customer.address"],
  "fieldLimits": {
    "maxWidgets": 4096,
    "maxOperations": 1000000,
    "maxNameBytes": 1048576,
    "maxWorkingBytes": 33554432
  }
}

fields must be an array of nonempty strings without NUL characters; each string matches a decoded Unicode complete field name exactly and case-sensitively

Selecting an ancestor removes its complete subtree; overlapping parent and child names count each removed terminal field once, while duplicate names fail

An empty array or valid unmatched names is a no-op; malformed ownership, ambiguous selected names and protected field selection fail

Input and publication

Without input IO, the operation uses the handle's committed document; explicit input IO supplies an independent PDF that remains private until publication succeeds

Use password when authentication of encrypted input requires it; structure permissions and authenticated signature policy still apply

The engine prepares the candidate, publishes PDF output, publishes bounded result JSON, checks cancellation, and then adopts the candidate as the handle's committed document

Read, write, result-publication, policy, budget and cancellation failures retain the previous committed context and permit a normal retry on the same handle

Context rollback cannot retract bytes already delivered to an external callback sink; callers must stage and publish their sinks transactionally

Repeating removal against the committed result returns zero and publishes the exact current revision; check the returned status before using any delivered output

Result and limits

Success returns schemaVersion: 1, statusCode: 0, status: "ok", removedFields, mediaType: "application/pdf" and fieldProfile: "complete-field-tree-removal-v1"

removedFields counts terminal fields, including terminal fields reached through a selected ancestor; it does not count Widgets or structural ancestors separately

Optional fieldLimits lowers the effective positive capacities; maxWidgets maps to native MaxAnnotations, while operation memory, object, page, output, result and elapsed-time limits remain independent

The engine admits selector storage before constructing the native name array; ownership validation also charges decoded complete field names to maxNameBytes

Optional signaturePolicy configures the existing authenticated CMS policy, including the CAdES, timestamp and trust requirements supported by the selected operation entry point

A failed result sink can prevent delivery of a complete error JSON document; always check the operation's returned status

Ordinary Windows file jobs expose the same forms.remove selection through their existing file-path schema; native Linux uses the callback operation API and caller-owned file IO

See native field-tree semantics and the native file-output method