[ymote]

Why

PDF Tools' Edit works on simple PDFs and breaks on real-world ones. On a page a web browser printed:

• Chinese text is refused with the engine's build note ("set CRAFT_FONTS_DIR to a craft-fonts checkout").
• The engine reads a title drawn in several fonts as one- or two-glyph "paragraphs".
• A replacement the paragraph's subset font can't show is set in a stand-in (Helvetica or Times) that runs over its neighbours.

Nothing told the person any of this before Apply.

What

pdf service (apps/pdf/host-service):

• pdf.edit_check (new, src/fit.rs) takes pdf.edit_text's arguments and answers {keeps_font, font, box, covers, off_page}:

  • the font the edit would be drawn in;
  • where the edited text would be;
  • how many other lines of text it would newly run into;
  • whether part of it would leave the page.

  It runs the engine's own editor (pdfcraft-edit's rewrite_block/replace_line, what text_edit runs) on a copy opened from the open document's working bytes, then drops the copy. No engine command runs and nothing is written. The engine's read-only and security checks apply. On a typical page it costs 0.4 to 0.6 ms (release); on a private 3.4 MB browser-printed page of 399 paragraphs (not committed) it costs 16 to 19 ms.

• Plain refusals. pdf.edit_text and pdf.edit_check refuse in words for a person, still invalid: (codes::edit_refused):

  • "PDF Tools can't edit Chinese, Japanese or Korean text yet."
  • other scripts name the characters ("PDF Tools can't type “Ж” into a PDF yet.");
  • a locked or read-only PDF;
  • a stale paragraph number.

• pdfcraft-edit joins the pins at the same ymote/pdfcraft revision. It was already in the graph, so Cargo.lock only gains one edge.

• pdftools_fixture --edit-sample <file> writes a page as a browser prints it. The glyphs are placeholders drawn here, with no font file copied. The page has:

  • a title in five pieces, in unnamed Type 3 fonts;
  • Chinese text in an embedded CID-keyed TrueType subset.

  It reproduces all three failures. The tests hold the check to what the edit then does (same font, same box), and show that a refusal changes nothing.

PDF Tools (apps/pdftools/bundle/main.splash):

• When it checks: the panel asks pdf.edit_check when a paragraph is clicked, and again once typing, the alignment or the colour pauses.
• What it says: "Set in Helvetica: this paragraph's font can't show all of this text.", "Longer than its box: it runs into 2 lines of text nearby.", "Part of it falls off the page.", or the refusal in red. A line kept in pieces gets "The PDF stores this line in 5 pieces: only this one changes."
• Apply: while there's a warning, Apply reads "Apply anyway". An edit not yet checked as it stands is checked first, and made at once only if there is nothing to say. Apply stays in view at the card's foot while the fields scroll.
• Older engines: an engine without the check edits as before.
• Font names read as a person would say them ("Menlo Regular", "Unnamed font").
• Model tests cover the new pure functions. They now also parse the whole script, views and handlers included, which the model VM never ran.

Docs: apps/pdftools/README.md and README.zh-CN.md gain an "Editing text" section, a Status line and the evidence folder; apps/AGENTS.md describes the service method.

Contract change: proposal for SERVICE.md "Edit"

SERVICE.md isn't changed here, because the coordinator owns it. Proposed text:

| pdf.edit_check | {doc, page, paragraph?, line?, text, align?, color?}, as pdf.edit_text | {keeps_font, font, box, covers, off_page}: what that edit would do, without making it |

pdf.edit_check makes the edit on a copy of the open document (its unsaved edits included) with the engine's own editor, and drops the copy, so nothing changes.

• keeps_font: whether the new text is drawn in the paragraph's (or line's) own font.
• font: the font it would be drawn in. That is either its own name ("" when the PDF names none, as pdf.lines says) or the stand-in (Helvetica, Times or Courier, bold or italic to match).
• box: where the edited text would be, [x, y, w, h]; null when none would show.
• covers: how many other lines of text on the page it would run into that the paragraph doesn't touch now.
• off_page: whether part of it would fall outside the page.

It refuses as pdf.edit_text would, in the same words.

Both methods refuse an edit the engine won't make with invalid: and words for a person:

• text no font the engine has can show: "PDF Tools can't edit Chinese, Japanese or Korean text yet.", and other characters are named;
• a document that opens for reading only, or whose security settings forbid changes;
• a paragraph or line number that is no longer on the page.

What ran

• cargo test --locked -p octosense-pdf-service: 68 passed, 1 ignored (timings); first_call 1 passed, 1 ignored; skill 1 passed.
• cargo clippy --locked -p octosense-pdf-service --all-targets --no-deps -- -D warnings: clean.
• cargo test --locked -p octosense-shell --lib pdftools_model: 22 passed.
• python3 tools/setup.py --check --cargo and bash tools/check-shell-graph.sh -p octosense: ok. python3 -m unittest discover -s rom/tests -p 'test_no_local_paths.py': ok.
• Timings in release, by hand: cargo test --release --locked -p octosense-pdf-service --lib -- --ignored --nocapture timings.
• Shell run. A desktop shell with the real engine, on the Linux build host's private headless weston, at the runtime's 64 ms budget, light and dark, on the --edit-sample page. It ran at c50104da; the evidence is in apps/pdftools/tests/evidence/edit-20261011/.
  • The first run found Apply pushed out of view in the default window; that is fixed in c50104da.
  • The driver is a scratch script over the Linux launch of tests/ui.py from PDF Tools on Linux: the journeys on a headless weston, and their evidence #495. It isn't committed yet.
• Not run: a hidden shell on macOS. The maintainer's RC6 app was open when this started, and later another session was running OctoSense install/restart tests on the Mac. Edit on macOS is unverified.

Known, not changed here

• The edit box over the page is sized when you click and doesn't grow as you type, so a longer draft shows only its last line. This predates the change.
• The engine still splits browser-printed titles into pieces, and it can't type Chinese, Japanese or Korean characters a paragraph's font lacks. This PR makes PDF Tools say so; it doesn't fix the engine. See the coordinator's report for the font-bundling and engine-update research.

🤖 Generated with Claude Code

[ymote]

Merged in a train (#488 → #501 → #495) on two local runs of the train head 37008bb, which contains this PR's head dabda6d. Merged in order with gh pr merge --admin --merge --match-head-commit; main's tree after the last merge equals the tested tree.

• Run 1: tools/ci-local.sh --only all --linux-host --offload, PASSED in 22m21s (55 PASS, 8 SKIPPED). On the Linux build host: 53 steps, among them the ubuntu jobs (apps.yml services and kernel-security) and the Linux process sandbox (Landlock, seccomp). Its 8 skips are rom.yml's Linux steps, which need a JDK, the Android SDK and node; run 2 ran them.
• Run 2: tools/ci-local.sh --only all on the Mac with JDK 17, Android SDK 35 and node 24, PASSED in 23m32s (59 PASS), nothing skipped. The train touches rom/ (Read launch-time test hooks only in development builds #488), so the two-run rule applies to it.

Run 2's table

Job	Step	Result	Time
ci-local / drift	The local mapping fits the workflows	PASS	-
desktop.yml / desktop	Prepare the pinned framework sources	PASS	1s
desktop.yml / desktop	Compile the desktop with the shared runtime	PASS	3m15s
desktop.yml / desktop	One copy of every shell source	PASS	-
desktop.yml / desktop	Desktop tools and scripts	PASS	14s
desktop.yml / desktop	In-app updater and installer handoff	PASS	4s
desktop.yml / desktop	One Makepad, App Hub, octos and Rinx in the locked graph	PASS	5s
desktop.yml / desktop	The native apps' generated places match native-apps.json	PASS	0s
desktop.yml / native-host-api	Prepare the pinned framework sources	PASS	0s
desktop.yml / native-host-api	Build the native acceptance host and pinned Hub CLI	PASS	9s
desktop.yml / native-host-api	Signed app tool calls a real OS permission API	PASS	3s
phone.yml / home	Prepare pinned sources and the reviewed runtime patch	PASS	0s
phone.yml / home	Validate launcher icons and Apple asset catalogs	PASS	3s
phone.yml / home	Compile Home and its bundled modules	PASS	3m17s
phone.yml / home	Verify the single runtime graph	PASS	3s
phone.yml / home	The native apps' generated places match native-apps.json	PASS	0s
phone.yml / home	The pinned octos revision	PASS	-
phone.yml / home	Build octos (unless cached)	PASS	-
phone.yml / home	Build Home, App Hub admission and runtime policy tests	PASS	43s
phone.yml / home	Test Home, App Hub admission and runtime policy	PASS	40s
phone.yml / home	Two-lane scenario (real kernel, scripted model)	PASS	31s
phone.yml / home	Build opt-in AppCard tests	PASS	34s
phone.yml / home	Test opt-in AppCard	PASS	6s
phone.yml / home	Build craft-engine relay and system-chat tests	PASS	39s
phone.yml / home	Test craft-engine relay and system chat	PASS	50s
phone.yml / home	Build linked Terminal tests	PASS	32s
phone.yml / home	Test linked Terminal	PASS	6s
phone.yml / home	Build Wasm and runtime policy tests	PASS	8s
phone.yml / home	Test Wasm and runtime policy	PASS	16s
apps.yml / services	python3 tools/setup.py	PASS	1s
apps.yml / services	Shared system app interface	PASS	-
apps.yml / services	Kernel service	PASS	21s
apps.yml / services	OctoSense release updater	PASS	6s
apps.yml / services	App peers	PASS	26s
apps.yml / services	AI providers config	PASS	10s
apps.yml / services	Connected provider protocols and Linux host adapter	PASS	32s
apps.yml / services	L0 in-card chat (sys.chat, host side)	PASS	12s
apps.yml / services	System toolbox (workflow templates)	PASS	1m57s
apps.yml / kernel-security	python3 tools/setup.py	PASS	1s
apps.yml / kernel-security	The pinned octos revision	PASS	0s
apps.yml / kernel-security	Build octos (unless cached)	PASS	-
apps.yml / kernel-security	Real-kernel tests	PASS	30s
apps.yml / apps	python3 tools/setup.py	PASS	1s
apps.yml / apps	Host services (Mail, AI providers, News)	PASS	1m12s
apps.yml / apps	Connected accounts and Rinx editor	PASS	1m14s
apps.yml / apps	Shell AI services (crates/ai-host)	PASS	2m29s
apps.yml / apps	AppCard runtime setup safeguards	PASS	0s
apps.yml / apps	AppCard clippy (own crates; shared runtime compiles)	PASS	52s
apps.yml / apps	AppCard transport and store	PASS	15s
apps.yml / apps	One Makepad, App Hub, octos and Rinx in the locked graph	PASS	4s
rom.yml / product	python3 -m unittest discover -s tests -v	PASS	38s
rom.yml / product	Check generated Agent Binder client	PASS	0s
rom.yml / product	bash -n scripts/stage-forks.sh scripts/publish-release.sh scripts/apply-to-tree.sh scripts/build-rom.sh	PASS	-
rom.yml / web-installer	npm ci --ignore-scripts --no-audit --no-fund	PASS	7s
rom.yml / web-installer	npm test	PASS	1s
rom.yml / web-installer	npx playwright install --with-deps chromium	PASS	1s
rom.yml / web-installer	npm run test:browser	PASS	5s
rom.yml / web-installer	python3 -m unittest discover -s tests -p test_installer_manifest.py -v	PASS	0s
rom.yml / web-installer	bash -n scripts/release.sh	PASS	-

Notes:

• GitHub runs Python 3.12; this run used Python 3.9.6
• apps.yml:services runs on ubuntu-latest in GitHub; here on macOS, so #[cfg(target_os = "linux")] code in it is not exercised (--linux-host runs it on Linux)
• apps.yml:kernel-security runs on ubuntu-latest in GitHub; here on macOS, so #[cfg(target_os = "linux")] code in it is not exercised (--linux-host runs it on Linux)

Run 2's first attempt on the same head stopped at one failure outside this train: crates/wasm-host/tests/runtime.rs an_endless_loop_stops_at_its_deadline_and_spends_the_instance measured 189.8 ms against its 190 ms floor (its deadline fired a tick early). The rerun passed every step.

GitHub's native Windows acceptance (embedded-browser.yml, which local CI cannot replace) passed on this head: run 38163147191. Main after the train: cf06ac5, whose tree equals the tested tree.