PDF.R1: integrate shared reader with bounded nesting checks

docs/pdf-backend.md

@@ -1,13 +1,13 @@
-# PDF writer backend
+# PDF backend
 
 PDF writing uses `craft-pdf` from `storytold/craft-libs`, pinned to
-`c3487320b2d1de657b860b3c8abb44e1f2b32bd8`. Its `write` feature supplies Krilla configuration,
+`89dcbb3060377a26c99a6d80caa16084366704c4`. Its `write` feature supplies Krilla configuration,
 metadata construction, fallible font preparation and serialization, and native unwind guards.
-The dependency disables default features and enables only `write`.
+The dependency disables default features and enables `write` and `interpret`.
 
 VectorCraft owns document traversal, drawing, font selection and embedding policy, colour
 conversion, presets, page boxes, layers, editing data, postprocessing and print composition.
-The existing Hayro reader dependencies and editable import adapters keep their current sources.
+Editable import keeps its VectorCraft adapter, layer routing, colour policy and text decisions.
 Desktop printer submission remains in `craft-print`.
 
 The shared writer vendors Krilla 0.8.2 with an unwind-safe cleanup and poisoning patch.
@@ -24,3 +24,45 @@ VectorCraft retains its finite-coordinate checks and the existing behavior that
 outside the writer's supported coordinate range. Font preparation checks the shared
 512 MiB per-font copy limit and variation coordinates before allocation; failure preserves
 VectorCraft's reported outline fallback. The writer is not a peak-memory or runtime budget.
+
+PDF reading uses the same shared revision's patched Hayro syntax 0.7.2, interpreter 0.7.0
+and JBIG2 0.3.0. The application explicitly preserves its existing accepted file sizes with
+`OpenOptions { max_input_bytes: usize::MAX, ..Default::default() }`; this migration adds no
+new file-size ceiling. Ordinary decoded streams use the shared backend's immutable
+per-document limits. Those limits are separate from streaming page-content budgets and
+do not bound aggregate document or process memory. Password classification and the
+existing permissions-password fallback remain application policy.
+
+The layer and overprint pre-scan consumes `ContentReader` windows through `TypedIter`,
+retaining graphics and marked-content state between windows. It does not collect a whole
+page before scanning. Reaching the scan's operator, nesting or instruction-window limit,
+a reported failed/truncated stream, a cap-reaching filtered form, or an undecidable final
+operand tail returns an import error and discards the partial document. Previously the
+operator limit could return a partial layer routing with a warning. Interpreter completion
+warnings also become errors before a document is returned. Whitespace and comments at
+EOF remain valid. The typed iterator does not classify every malformed operator, so this
+is known-incomplete rejection rather than a general PDF validity certificate.
+
+The three patched Hayro crates and Krilla are selected in the root `[patch.crates-io]`
+from the same immutable revision as `craft-pdf`. `cargo xtask pdf-deps` rejects missing,
+duplicate, local-path, registry and mismatched revisions for those five packages.
+`craft-print` and `craft-ui` keep their existing independent revisions.
+
+Dependency asset hashes and sources are in `ASSETS.md`; redistributed license texts are
+in `licenses/pdf-backend`. Package staging carries those texts together with `NOTICE`
+and `ASSETS.md`. Fonts and profiles remain dependency data; this repository adds no font
+or profile binaries. Native page interpretation has a shared unwind guard; WASM aborts
+and process-wide allocation failures cannot be caught.
+
+The app retains the raw PDF-object nesting guard and the imported document-depth cap.
+Before recursive operand parsing, decoded page content is checked through the same incremental
+reader used by layer scanning and interpretation. Its nesting check carries literal-string,
+comment, hexadecimal-string and dictionary-delimiter state across 64 KiB scratch windows;
+lowering the ordinary stream-materialization limit still produces the app's specific error for
+content nested more than 256 levels. The shared parser separately caps direct containers at
+128 levels: the low-limit regression previously returned an incomplete-content error, so it
+demonstrates restored preflight coverage and error classification, not a successful import or
+a crash bypass.
+Known decoder truncation remains an import error. The scratch bound does not cover whole-filter
+fallback decoding or aggregate parser/process memory. Synthetic regressions exercise lowered
+ordinary limits, split delimiters and lexical state across content boundaries.