refactor(pdf): use shared writer for export and print (PDF.W1)

docs/architecture.md

@@ -1,6 +1,6 @@
 # Architecture
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-13 · **Change:** minor (verified PngSuite downloads, #1729; synthetic control-input budgets, #1709; desktop printing uses craft-print; Windows 7 fallback retained) · **Target:** Adobe Illustrator 2026 (30.x)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-13 · **Change:** minor (shared PDF writer; app output policy and existing reader retained; verified PngSuite downloads, #1729; synthetic control-input budgets, #1709; desktop printing uses craft-print; Windows 7 fallback retained) · **Target:** Adobe Illustrator 2026 (30.x)
 
 How VectorCraft is built today. The design rationale lives in the local, gitignored `plan/architecture.md`;
 this file describes what is committed. Day-to-day rules (clean-room, never crash, quality gates) are in
@@ -59,6 +59,12 @@ reaches the status bar, and Quit waits for pending submissions. Windows 7 retain
 and the installed viewer's Print/PrintTo verb;
 its target excludes the shared backend because Windows.Data.Pdf is unavailable there.
 
+PDF writing uses the optional `craft-pdf` writer at an immutable craft-libs revision. Shared
+configuration, metadata, font preparation and guarded serialization leave drawing, colour
+policy, layers, editing data and print composition in this app. The reader keeps its existing
+Hayro dependencies. `cargo xtask pdf-deps` verifies the shared writer and patched Krilla source;
+see [pdf-backend.md](pdf-backend.md).
+
 ## Agent control
 
 - **Control channel:** JSON lines on a local TCP port (`--control 7979`), with real egui pointer and keyboard
@@ -84,6 +90,7 @@ saves copies in the background. See [development.md](development.md#robustness-v
 |---|---|---|
 | 2026-10-13 | minor | Pinned PngSuite HTTPS files verified by SHA-256 before publication; bounded downloads replace archive extraction (#1729). Scores and hours unchanged. |
 | 2026-10-13 | minor | Bounded synthetic control input (#1709): counts and queued events validated before mutation; control-channel bursts yield between frames. Scores and hours unchanged. |
+| 2026-10-13 | minor | PDF writer setup and guarded finalization use craft-pdf; drawing and output policy remain app-owned. |
 | 2026-10-12 | minor | Desktop PDF spooler shared through craft-print; exact physical sizes, composed copies and Windows 7 fallback retained. Scores and remaining gaps unchanged. |
 | 2026-10-10 | minor | Added the `three-d` crate |
 | 2026-10-10 | major | First version, from the workspace, the layering table and the existing docs |

docs/pdf-backend.md

@@ -0,0 +1,26 @@
+# PDF writer backend
+
+PDF writing uses `craft-pdf` from `storytold/craft-libs`, pinned to
+`c3487320b2d1de657b860b3c8abb44e1f2b32bd8`. Its `write` feature supplies Krilla configuration,
+metadata construction, fallible font preparation and serialization, and native unwind guards.
+The dependency disables default features and enables only `write`.
+
+VectorCraft owns document traversal, drawing, font selection and embedding policy, colour
+conversion, presets, page boxes, layers, editing data, postprocessing and print composition.
+The existing Hayro reader dependencies and editable import adapters keep their current sources.
+Desktop printer submission remains in `craft-print`.
+
+The shared writer vendors Krilla 0.8.2 with an unwind-safe cleanup and poisoning patch.
+The root `[patch.crates-io]` selects that copy from the same immutable revision: Cargo does
+not inherit a dependency workspace's patches. A failed page or surface cleanup poisons the
+backend document, so serialization cannot return an incomplete PDF after unwinding.
+The shared crate's compile-time backend marker and `cargo xtask pdf-deps` (included in CI)
+check that the patched writer is used. Krilla retains its MIT OR Apache-2.0 licensing;
+its upstream provenance and authored patch are recorded in the shared repository.
+
+Export and print construction, drawing and postprocessing run inside the shared native
+unwind guard. These guards do not catch WASM aborts or process-wide allocation failures.
+VectorCraft retains its finite-coordinate checks and the existing behavior that omits art
+outside the writer's supported coordinate range. Font preparation checks the shared
+512 MiB per-font copy limit and variation coordinates before allocation; failure preserves
+VectorCraft's reported outline fallback. The writer is not a peak-memory or runtime budget.