[KleiKodesh]

An incremental save wrote /Size from the document's last object number. That number includes object numbers an editing session reserved with EPDFLayer_RaiseLastObjectNumber() and never used, so a save that only touched a few objects could claim a /Size dozens of numbers past the highest object in the file. qpdf reports that as an error (/Size larger than the highest object number + 1).

Now an incremental save (plain or a layer delta) takes its /Size, and the cross-reference stream's object number, from the highest object number the file actually defines:

• the input's last object number and its trailer's /Size, so /Size never shrinks below the input's;
• the objects this save wrote (including an inline encryption dictionary).

A layer delta is cumulative from its base, so it writes every object the base lacks and the rule holds there too. Full saves are unchanged: their single cross-reference subsection still lists reserved numbers as free entries (complete-xref).

The change sits under the existing save-traversal rule; the ledger entry says so.

Tests

• New embedder test EPDFLayerEmbedderTest.SaveLayerDeltaSizeIgnoresUnusedReservedNumbers: a layer reserves 64 numbers, creates one annotation at the first, and the delta's /Size is that annotation's number + 1.
• Not built or run locally (no emscripten/clang toolchain on the machine this was written on); CI hasn't run yet.