Portable XFA password appearances

Unit: HPDFXFAHeadless

HPDFXFAWriteHeadlessPDF consumes XFA passwordEdit fields as native text widgets with the PDF password flag and an embedded-font masked appearance on Windows and Linux

The appearance contains one asterisk per Unicode scalar value: a supplementary character represented by a UTF-16 surrogate pair produces one asterisk, while combining marks and ZWJ each contribute their own asterisk

The native /V retains the complete authored Unicode value; appearance masking does not provide encryption or remove that value from the PDF

For example, A😀B produces three asterisks, and é produces two because the combining accent is a separate scalar

Limits and cancellation

The adapter checks cancellation while counting scalars and checks the remaining aggregate glyph budget before allocating the mask string

TXFAHeadlessPDFResult.GlyphUnits counts the actual generated asterisks for password appearances; the existing UTF-16 accounting for ordinary text and other appearance consumers is unchanged

Two supplementary characters fit a remaining MaxGlyphs budget of two; a budget of one fails before mask allocation

The original value remains subject to input and object-byte limits, and all fields share the aggregate appearance budget

Preparation, budget and cancellation failures leave the caller's destination position, length and existing bytes unchanged; destination write errors follow the stream's own partial-write behavior

Verification

Tests/Linux/XFAHeadlessPasswordTests.pas and the Windows and Linux password runners verify exact budgets, cancellation boundaries, stream preservation and retry behavior

The independent verifier checks native values, flags, actual AP CID sequences, ToUnicode and embedded glyph IDs, then renders and extracts the saved PDFs with MuPDF

Automatic XFA creation describes the other native field and drawing consumers