feat(pdf): expose bounded PDFium page inventory and source-layout rasters

[ZhiXiao-Lin]

Problem

A3S Parser cannot truthfully admit PDF pages into its Visual, Balanced, Planned, or Deep profiles because the released Office Rust boundary has no page-level PDF contract.

Reproduced on Office main at ac094d58bf04b6710cebc58da86c9e1eca680a7b and the Parser-pinned revision 7903df9b58bf979cfeccdf4f66d9041434542a91:

• DocumentKind has only Word, Spreadsheet, and Presentation.
• NativeOfficeUnitLocator has Document, Worksheet, and Slide, but no Page.
• NativeOfficeLayoutRenderer has no concrete PDF provider.
• NativeOfficePptxImageLayoutRenderer correctly returns typed unsupported results outside its exact PNG-slide contract.
• Consequently A3sOfficeBackend::support(DocumentFormat::Pdf) is empty and Parser must reject PDF before creating run state.

This is the PDF follow-up to #1. The semantic screenshot path is not acceptable source-layout evidence.

Required contract

Expose an object-safe, Send + Sync, browser-neutral Office API backed by PDFium that:

• inventories every PDF page under an explicit hard unit bound;
• uses a one-based page locator with stable page identity and canonical path;
• binds immutable source size and SHA-256 before and after inventory/render;
• reports media box/crop box, effective rotation, physical surface, and page pixel dimensions;
• renders exactly one selected page under explicit deadline and output-byte limits;
• returns a source-layout receipt with PNG SHA-256, size, dimensions, rotation, PDFium engine version/binary identity, DPI, viewport, locale/timezone, and deterministic render-profile SHA-256;
• performs no external fetch and grants no Browser or filesystem authority to the Parser agent;
• distinguishes corrupt, encrypted/password-required, unsupported-feature, source-mutated, timeout, page-limit, and output-limit failures with stable typed codes.

The core contract must not require a3s-use-browser or chromiumoxide in Parser. A PDFium implementation may live behind an injected Office provider or an Office-owned optional runtime boundary.

Acceptance criteria

• A generated two-page fixture inventories pages 1 and 2 in stable order and rejects page 0, page 3, duplicate/reordered/foreign locators, and truncated inventories.
• Rendering page 1 never includes page 2 pixels and vice versa; repeated renders have identical profile and pixel identities.
• Normal, scanned/image-only, non-default crop box, and 0/90/180/270-degree page fixtures retain exact canvas geometry.
• Encrypted, corrupt, zero-page, over-unit-limit, over-output-limit, timeout, and source-mutation cases fail with the required stable codes before publication.
• Output is staged privately, atomically published without clobbering, rehashed from disk, and removed or left unpublished after failure.
• Parser integration tests prove governed render → OCR → canonical canvas/region output, frontend overlay projection, transfer-policy enforcement, and full-process backend/model-free resume.
• Parser dependency CI continues to reject a3s-use-browser and chromiumoxide.
• Office and Parser documentation advertise PDF only after the full fixture and cross-platform gates pass.

[ZhiXiao-Lin]

Integration progress:

• Office PR feat(pdf): add native PDFium page layout provider #5 is merged at 21e0d51 with the optional browser-neutral, host-injected PDFium Chromium/7881 page provider.
• Parser PR A3S-Lab/Parser#1 is merged at 1b4b6a6160113efd0cf82b96cc4decfb4f5a2af4.
• Parser now exposes a separate raster-only PDF backend, complete one-based page inventory, Visual render-to-Unlimited-OCR, A3S Code Planned visual-only routing, canonical canvases/regions, and path-free frontend overlay projection.
• Parser CI passed MSRV, Linux, macOS, and Windows. Linux checksum-verifies PDFium 7881 and runs real backend plus Visual/Planned integration tests. Dependency guards confirm that Parser resolves neither a3s-use-browser nor chromiumoxide.

The issue remains open for the unfinished acceptance gates: complete retained-render rotation/encrypted/corrupt fixtures, real cross-platform runtime evidence, release-scale page-count soak, and avoiding the current full-document re-inventory before each page render. Parser resume is model/OCR-free after confirmation, but still reconstructs the PDF backend and therefore requires the same host PDFium runtime.

[ZhiXiao-Lin]

Progress update: #6 is merged at ccf0665365adf08676efdfd38dc598a689e22f1d. Office now exposes inspect_inventoried_page, so Parser can retain one complete admitted PDF inventory and select pages without reopening or fully reinventorying the PDF for every render. Render-time immutable-source and exact-page profile verification remain authoritative, and the a3s-office + pdfium core graph remains Browser/Chromium-free.

The issue remains open for the outstanding acceptance evidence: release-scale 10,000-page soak, remaining fixture coverage, and cross-platform packaging/runtime verification. Parser integration is being pinned to the merged revision next.

[ZhiXiao-Lin]

Parser integration is now merged in A3S-Lab/Parser#2 at 00516e1c6c61a1e07e8db9db606afae8df665f01, and the monorepo gitlinks are synchronized by A3S-Lab/a3s#77 at 3e60ce993826379b0c63c67b49344bff217aa106.

A3sOfficePdfBackend retains the complete native inventory and uses a locator-to-offset index with inspect_inventoried_page; current-request source/budget/timeout checks and render-time source/profile verification remain intact. Parser MSRV and Linux/macOS/Windows CI passed, including the Linux real PDFium render → OCR → canonical overlay and agentic-plan path. Browser/Chromium and external SRT dependency guards remain clean.

The inventory-reuse slice is complete. This issue remains open for the 10,000-page soak, remaining PDF fixtures, and cross-platform PDFium packaging/runtime evidence.