ElyOffice/tasks/reviews/C00.4-r1.md

FAIL

What I ran and confirmed:

• I mounted engines/LibreOffice_26.2.6_MacOS_aarch64.dmg (297 798 926 bytes). nm -gU shows libreofficekit_hook, libreofficekit_hook_2 and lok_preinit. The only VCL plugin is libvclplug_osxlo.dylib.
• I rebuilt the three LOK spikes against reference/libreoffice-core/include and ran them on a fresh profile:
  • Threaded mode dies with NSWindow should only be instantiated on the main thread!.
  • Unipoll with runLoop never calls the poll callback.
  • Unipoll with GCD prints "polls so far: 0". It then gives BuildId 8221e31, a size of 12808 × 16408, an all-zero tile and a PDF.
• init.cxx:4277/4348 and configure.ac:5950-5952 match the doc.
• The patch is byte-identical to the engines/lo-src working-tree diff. It applies cleanly to the pinned init.cxx. The LO build is still running, so the patch has not yet been shown to compile; the doc defers that to C07.1.
• MuPDF: the lib sizes match. The rebuilt mupdf_spike on the LOK PDF gives 1 page, 612x792, 1224x1584, 8241 dark pixels, and the CJK text.
• libmupdf-pkcs7.a imports OpenSSL EVP symbols.
• CEF: the index sizes match, and the macosarm64 URL answers 200 with 132224904 bytes.
• The tessdata sizes match.
• libetpan 6dc099a fails on md5.c with default flags and builds with CFLAGS=-std=gnu17.
• tests/scripts/*.sh and agents_md.py exit 0.

docs/engineering-risks.md:22 — The doc says upstream master's init.cxx has "没有出图块的支持". That is false. Master contains bd2d0bec67, "coda-m: Don't skip the tile painting on macOS" (committed 2025-12-10). It changes the exact guard the doc cites, from defined(UNX) && !defined(MACOSX) to defined(UNX). That is the same change as the patch's second hunk. Scenario: someone checks upstream before C07.1 and finds the doc wrong. Nothing in the doc says why a backport is not enough. With that commit, macOS takes the #else branch, which uses SetOutputSizePixelScaleOffsetAndLOKBuffer. AquaSalVirtualDevice does not override SetSizeUsingBuffer, in either the pin or master. So upstream's path still ignores pBuffer under Aqua, and that is the real reason the CoreGraphics hunk is needed. The doc never states this. Fix: cite bd2d0bec67, say what it fixes and what it does not, and base the need for the patch on the Aqua SetSizeUsingBuffer fact.

docs/engineering-risks.md:38 and :42 — R-03 does not record a blocker. The locked MailCore 2 (1b48bab) includes <libetpan/mailgmail.h> and <libetpan/mailactivesync.h>. Neither the pinned submodule libetpan 6dc099a (2022-06-27) nor Homebrew's libetpan 1.10.1 has them. Point 2 blames the gap only on the prebuilt libetpan-osx-21. Scenario: I built and installed 6dc099a with -std=gnu17. inst/include/libetpan has no mailgmail.h and no mailactivesync.h. The conclusion's plan ("用 cc 构建、固定源文件清单，对 ICU 头文件打补丁") would fail on MCGmailSession.cpp and MCActiveSyncSession.cpp in C12.1, just as the CMake attempt did. "锁定的 libetpan 可构建" (line 9) proves only that the wrong version of the dependency builds. That does not meet the C00.4 requirement "MailCore 2 依赖可构建". Fix: state that the pinned submodule is too old for the pinned MailCore 2. Upstream libetpan master has src/low-level/gmail/mailgmail.h and src/low-level/activesync/mailactivesync.h. Pin a libetpan commit that has these APIs and show that it builds, or record the gap as a blocker and update the status row and the conclusion.

docs/engineering-risks.md:21, :31 — The evidence for R-01 facts 3–5 and all of R-02 is spike programs and a sample .docx. They exist only in another session's /private/tmp/.../scratchpad/spikes. The repo does not contain them, and the doc names no source or command except the nm check in fact 1. agents.md's 2026-10-01 decision says "证据见 R-01", and PRD §23 asks for submitted evidence. Scenario: once the temp directory is purged, no one can re-run the threaded crash, the unipoll/GCD dispatch, the zero tile or the MuPDF render. Also, the spikes pre-zero the tile buffer with calloc, so "返回全零缓冲" cannot tell "wrote zeros" apart from "never wrote". Fix: commit the spike sources and the sample document with their run commands, for example under tests/scripts with a check that skips when engines/ is absent and says so. Fill the tile buffer with a sentinel before paintTile.