ElyOffice/tasks/reviews/R7.4-r1.md

FAIL

1. crates/ely-pdf-engine/shim/ely_mupdf.c:253 — Tile rendering discards content errors while building the display list. The opening scan decodes streams but does not interpret their drawing commands. With a sound cross-reference table and content BT 72 700 Td (Missing text) Tj ET, MuPDF warns that it cannot draw the text, yet this change returns an entirely white tile with damaged = false, no repair report, and check_pictures = false. HEAD reports damage for the same file. Thus unreadable content loses its warning and protection against overwriting the original, contrary to R7.4 and PDF-14. BT ] ET also reproduces this regression; the new assertion in agents.md:314 that syntax errors only reach the error callback is false. Preserve content failures during display-list construction while excluding the harmless font notices specifically, add regressions for these cases, and correct that assertion. Windows comparison evidence: .work/R7.4-r1-compare.log.

2. crates/ely-pdf-engine/shim/ely_mupdf.c:250; crates/ely-pdf-engine/shim/ely_output.c:60 — The unmonitored export pass caches images as well as fonts, so a second pass cannot reliably detect damage. Reproduction: a 4×4 RGB image with /Filter [/FlateDecode /ASCIIHexDecode], containing zlib-compressed ff0000 repeated 16 times followed by >, with its four checksum bytes replaced by zeros. MuPDF reports ignoring zlib error: incorrect data check during the first pass and caches the image; both PNG and text exports then return success without a repair report. Both exports reject this same fixture on HEAD. This silently accepts a failed stream read, contrary to R7.4 and the retained C11.8 export requirement; the new content-stream checksum test does not cover cached image streams. Retain and classify failures from the first pass instead of assuming every warning there is font substitution, and add a regression using this image filter chain. Windows comparison evidence: .work/R7.4-r1-compare.log.