PDF Tools: honest Edit on real-world PDFs (pdf.edit_check, plain refusals, a browser-printed test page)

AGENTS.md

@@ -56,7 +56,7 @@ On a machine that already has clones of Makepad, OctoScript or Octoscript-Makepa
 4. **One kernel per process.** The kernel service starts octos on the first consumer and shares it; consumers never spawn their own. Apps reach the assistant only through `crates/app-peers`, never through the raw kernel protocol.
 5. **System apps ship inside the shells.** Their ids start with `os.`, they are packed by digest from each packaging's `system-apps.json`, and they are not released separately or through the store.
 6. **Test UI without taking over the screen.** Run hosted apps and shells with hidden windows and drive them over the local control surface: `MAKEPAD_HIDE_WINDOWS=1 MAKEPAD_REMOTE=<port>` (routes under `/help`; end with `/quit`), or `makepad_test`. Use `--test-action`, `MAKEPAD_WM_TEST_APP` and `--module` to reach a state without clicking.
-7. **Devices.** Use only a device you were given for the task. Install test builds under a separate package name; never replace the installed Home or flash an image unless asked. Anything not run on a device is **unverified**, and says so.
+7. **Devices.** Use only a device you were given for the task. Install test builds under a separate package name; never replace the installed Home or flash an image unless asked. Anything not run on a device is **unverified**, and says so. Launch-time test hooks (the `test_actions` in the `makepad.APP_CONFIG` intent extra and the other `makepad.*` extras or OpenHarmony launch parameters) are the local user's own setting on a desktop, like a command-line flag, and read in every build there; on a phone (Android, OpenHarmony) any app can start Home with extras, so a release build ignores them and only a development build reads them (`cfg(dev_mode)`: debug, or `--features dev-mode`; `rom/scripts/build-home.py --dev-mode` builds one as a test package). Read such a hook only through `crates/shell/src/launch_input.rs` (AppCard: `launch_var`), never with a bare `std::env::var`.
 8. **Commit with a public identity.** Author and committer are your GitHub noreply address (for the maintainer, `ymote <151983+ymote@users.noreply.github.com>`) or another address you mean to publish; never a work or machine-local address. Check `git config user.email` before the first commit in a clone: a repository-local identity on a shared machine leaked a work address into this project's history once, and removing it took a history rewrite.
 9. **Keep docs honest and bilingual.** Every command in a doc was run; anything not run is marked **unverified**. User-facing docs are `README.md` plus `README.zh-CN.md`, linked by the single switcher line under the title (`English | [简体中文](README.zh-CN.md)`), and change together. `AGENTS.md` files are English only.
 10. **Keep signing keys, keystores, tokens and personal paths out of the repository.** `rom/tests/test_no_local_paths.py` checks for local paths.

Cargo.toml

@@ -288,6 +288,9 @@ pdfcraft-automation = { git = "https://github.com/ymote/pdfcraft.git", rev = "61
 # reader, which keep `/M` with its zone (the engine's listing drops it).
 pdfcraft-cos = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }
 pdfcraft-annot = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }
+# The pdf service's edit check: the engine's own text editor, run on a copy of
+# the open document to see what an edit would do before PDF Tools makes it.
+pdfcraft-edit = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }
 # The pdf service's tests only: the engine's own scripted XFA form, the
 # hostile fixture of the scripts-off fence (ADR 0013).
 pdfcraft-xfa = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }

apps/AGENTS.md

@@ -30,7 +30,8 @@ app's own agent and `tools.json`, the system toolbox, `glance.publish` and
   takes `--static photos=<dir>`). `--system` lets an `os.*` id and an empty
   digest through, as the shell does. These flags are on App Hub `main`.
   `card-host` registers no host services: run Mail in a shell with
-  `MAKEPAD_APP_CONFIG='{"mail_demo":true}'`.
+  `MAKEPAD_APP_CONFIG='{"mail_demo":true}'` (a desktop reads it; on a phone it
+  needs a development build).
 - Validate on a phone through Home (`phone/`) built as a separate test
   package; never replace the device's installed Home.
 - Text on a page follows the host's appearance. On a phone, a page drawn by a
@@ -119,8 +120,18 @@ app's own agent and `tools.json`, the system toolbox, `glance.publish` and
   cleared before a write would fail with `storage_full:`. `pdf.comments`
   reads each date with its zone from the file once per version of the
   document (`src/review.rs`). `pdf.fields` marks
-  read-only fields, and `pdf.fill` refuses one. Errors start with a stable
-  code (`src/codes.rs`).
+  read-only fields, and `pdf.fill` refuses one. `pdf.edit_check` takes
+  `pdf.edit_text`'s arguments and says what that edit would do before PDF
+  Tools makes it (the font it would be drawn in, the lines of text it would
+  run into, text off the page), by running the engine's own editor
+  (pdfcraft-edit) on a copy opened from the open document's working bytes
+  and dropping it (`src/fit.rs`): no engine command, nothing written. Both
+  refuse an edit the engine won't make in plain words (text no available
+  font shows, such as Chinese, Japanese or Korean without the engine's
+  fallback face; a read-only or locked document; a stale paragraph number),
+  still `invalid:` (`codes::edit_refused`); the `--edit-sample` page of
+  `pdftools_fixture` reproduces the real-world cases. Errors start with a
+  stable code (`src/codes.rs`).
 - Declare an app's agent in its manifest and `bundle/tools.json`. Keep the
   input/output schemas consistent with the executor (octos requires an object
   output schema), and select the actual risk, sharing and confirmation policy.

apps/README.md

@@ -285,7 +285,7 @@ standalone launcher and ROM image). Each packaging:
    [`crates/shell`](../crates/shell) (its `app-hub` feature; the photo engine's
    `octosense-photo-service` comes with the desktop-only `craft-engines`, weighed
    per engine in [ADR 0013](../docs/adr/0013-craft-engines-as-pinned-services.md)), and registers them at startup (`crates/shell/src/apps.rs`, `register_host_services`): Mail with `register()` for real accounts, or `register_demo()`
-   when the shell's app config has `mail_demo: true`. Mail, News and, with the photo
+   when the shell's app config has `mail_demo: true` (a desktop reads it; a phone only in a development build). Mail, News and, with the photo
    engine, Photos install `on_notify` callbacks to the shell's common notice renderer; Calendar
    installs its card publisher. The shell registers `NoticeService` for
    remaining system-app namespaces; `llm` with the octos
@@ -460,7 +460,10 @@ MAKEPAD_APP_CONFIG='{"mail_demo":true}' cargo run --release -p octosense
 MAKEPAD_APP_CONFIG='{"mail_demo":true}' cargo run --release -p octosense-home --features mobile-only
 ```
 
-The demo keeps its password in a file, so no keychain prompt appears.
+The demo keeps its password in a file, so no keychain prompt appears. These are
+desktop builds, so they read `MAKEPAD_APP_CONFIG` as a local command-line
+setting; on a real phone the demo needs a development test build
+(`rom/scripts/build-home.py --dev-mode`).
 
 **Quick Deck's dev fixture.** `card-host` has no `deck` service, and the
 shipped bundle has no fixture code. Quick Deck's UI tests use

apps/README.zh-CN.md

@@ -222,7 +222,7 @@ WebView 页面、图库导出、邮件、新闻、Glance 或单次模型调用
    path 依赖；photo 引擎的 `octosense-photo-service` 随仅限桌面的 `craft-engines` 引入，
    按引擎权衡见 [ADR 0013](../docs/adr/0013-craft-engines-as-pinned-services.zh-CN.md)），并在启动时注册
    （`crates/shell/src/apps.rs` 的 `register_host_services`）：Mail 服务在真实账户下用
-   `register()`，Shell 的应用配置中 `mail_demo: true` 时用 `register_demo()`。
+   `register()`，Shell 的应用配置中 `mail_demo: true` 时（桌面端读取；手机端仅限开发版）用 `register_demo()`。
    Mail、News 以及（带 photo 引擎时）Photos 安装 `on_notify` 回调，调用 Shell 共用通知渲染器；Calendar 安装卡片发布器。
    Shell 为其余系统应用命名空间注册 `NoticeService`；`llm` 服务使用 octos 内核的 core 目录以及
    Shell 的二维码扫描器和图片选择器（见 [`llm` 服务](#llm-服务)）。App Hub 只在根目录
@@ -379,7 +379,7 @@ MAKEPAD_APP_CONFIG='{"mail_demo":true}' cargo run --release -p octosense
 MAKEPAD_APP_CONFIG='{"mail_demo":true}' cargo run --release -p octosense-home --features mobile-only
 ```
 
-演示邮箱的密码存放在文件中，因此不会弹出钥匙串提示。
+演示邮箱的密码存放在文件中，因此不会弹出钥匙串提示。这些都是桌面构建，会把 `MAKEPAD_APP_CONFIG` 当作本机命令行设置读取；在真实手机上，演示邮箱需要开发版测试构建（`rom/scripts/build-home.py --dev-mode`）。
 
 **Quick Deck 的开发夹具。** `card-host` 没有 `deck` 服务，而随 Shell 发布的
 bundle 中没有任何夹具代码。Quick Deck 的 UI 测试使用 bundle 之外的

apps/appcard/app/app/Cargo.toml

@@ -28,6 +28,13 @@ default = ["standalone"]
 # dev monitor. A host that mounts the app as a widget (`octos_app::AppShell`)
 # builds with `default-features = false` and brings its own.
 standalone = []
+# A development build (build.rs sets `dev_mode`; debug builds are development
+# builds without it). Only a development build reads the launch-time hooks:
+# the `MAKEPAD_*` settings an Android intent extra or OpenHarmony launch
+# parameter can carry (provisioning, seeding, auto prompt, fake GPS, proxy,
+# dumps; `launch_var` in src/lib.rs). The shell's `dev-mode` turns it on for
+# the hosted app.
+dev-mode = ["octosense-kernel/dev-mode"]
 
 [dependencies]
 # One framework source, locked by Octoscript-Makepad/runtime.json.

apps/appcard/app/app/build.rs

@@ -22,6 +22,14 @@ fn main() {
     {
         println!("cargo:rustc-cfg=mobile");
     }
+    // `dev_mode` — a development build, as the shell's build.rs decides it:
+    // debug assertions, or feature `dev-mode`. Only then does the app read
+    // its launch-time `MAKEPAD_*` hooks (`launch_var` in src/lib.rs): on a
+    // phone another app can set them when it starts this one.
+    println!("cargo:rustc-check-cfg=cfg(dev_mode)");
+    if env::var_os("CARGO_FEATURE_DEV_MODE").is_some() || env::var_os("CARGO_CFG_DEBUG_ASSERTIONS").is_some() {
+        println!("cargo:rustc-cfg=dev_mode");
+    }
 }
 
 // Pin source contents, resources and lockfiles, including local path patches.

apps/appcard/app/app/src/app/l0_card.rs

@@ -319,8 +319,7 @@ fn kit_for(source: &str) -> String {
     // Measurement only. Nothing sets this in normal operation, and an unreadable
     // path is ignored rather than fatal — a missing override should render the
     // shipped look, not a blank screen.
-    let axis = std::env::var("MAKEPAD_L0_PALETTE_OVERRIDE")
-        .ok()
+    let axis = crate::launch_var("MAKEPAD_L0_PALETTE_OVERRIDE")
         .and_then(|p| std::fs::read_to_string(p).ok())
         .unwrap_or_default();
     // Axes BEFORE the env override, so a measurement run still wins over what
@@ -1856,7 +1855,7 @@ fn render_capturing(
     // was chased through six layers on the evidence of a screenshot, which can
     // only ever say "not there" and never says which layer dropped it. Every
     // other layer already has a probe; this was the gap.
-    if let Ok(path) = std::env::var("MAKEPAD_DUMP_DSL") {
+    if let Some(path) = crate::launch_var("MAKEPAD_DUMP_DSL") {
         let _ = std::fs::write(&path, &dsl);
     }
     let captured = LAST_CAPTURED