parser-host-implementation-plan.md

Parser, Research consumer, and Editorial consumer implementation plan

Status: phases 0/1, reconciled table links, bounded streaming and recovery assessments landed in PR #5, merge commit 0dd534d. Paint/clipping, bounded regional OCR and text fidelity landed in PR #6, merge commit 9cac608, with all six CI checks green for schema 0.17. Coordinate transforms and rotated OCR (schema 0.18) and bounded vector routing (schema 0.19) are locally checked and committed on codex/coordinate-vector-ocr; remote CI and merge remain separate. Host adoption remains pending, 2026-10-11. All writes are restricted to pdf-parser: planned host edits below remain adoption instructions. Based on the local reference review and host use-case review. Richer hierarchy/figures and host rollout remain planned.

Delivery order and ownership

Phase	pdf-parser owns	Research consumer owns	Editorial consumer owns	Dependency / exit gate
0: protect evidence	Remove MCID-only duplicate identity; span preservation and duplicate-provenance regressions	Translate normalized chunk matches back to raw UTF-16 source offsets; service persistence regressions	No immediate code change; current plain-text lane does not use adaptive reconciliation	Independent patches; red-to-green tests and fresh parser build
1: source locator contract	Reuse search text views and reverse maps; populate chunk span references; document text and geometry units	Preserve source text identity; carry chunk origin ranges through composition; consume parser chunk/block references	Introduce a rich extraction result behind the existing string API; preserve source text separately from truncated prompt projections	Versioned artifact contract, Unicode/rotation and overlapping-chunk fixtures
2: host adoption and work bounds	Deterministic run identity and stream lifecycle; exercise cancellation/resource-limit fixtures	Retain table geometry/continuation fields; bound process stdout and cancellation; reader links to exact evidence	Update parser revision/compiler/archive pins together; route reference/transcript consumers through rich results	Both host readers pass contract fixtures and process failure tests
3: coverage and regional recovery	Per-page/region quality states; paint/clipping evidence; bounded regional OCR via existing specialist protocol	Persist unresolved coverage; apply explicit acceptance policy before fallback/retrieval	Surface unresolved pages in source intake and quote review	Mixed scan/native controls; no success-as-completeness inference
4: richer document evidence	Explicit reconciled table/block linkage, continuation tests, section ancestry and figure/crop references	Map row/cell/figure locators into document intelligence and source reader	Add table/source inspection for civic packets and financial references	Exact values, topology, crop identity and source coverage holdouts

Implement phase 0 first. Agree on phase 1 contracts before changing either host's extraction defaults. Phase 2 output limits can proceed independently of new schema fields; coverage and richer evidence depend on the source locator contract. Model/vendor selection is a separate decision.

Phase 0: two bounded correctness fixes

Parser files: src/reconcile.zig, src/testpdf.zig, src/integration_test.zig, plus ignored CLI reduction output from benchmark/eval/reference_review_probes.py.

• An MCID groups content; it does not prove two spans are duplicates. Require the existing normalized-text equality and same-page geometry overlap for all duplicates.
• Regress distinct text with a shared MCID even at identical placement, repeated text at different placements, and genuine native/OCR duplicates with retained source masks/counts.
• Run the narrow MCID tests before and after the patch, the full Zig test/build gates, and the actual two-line tagged-PDF CLI reduction. Keep public schema 0.13.0 unchanged.

Research consumer files: src/services/researchSourceIndexService.ts and its existing test file.

• startOffset/endOffset remain half-open JavaScript UTF-16 offsets into the original persisted source text. Normalize only for matching, reverse-map boundaries through whitespace runs, and advance the cursor in raw source coordinates.
• Assert the values passed into chunk persistence using the real hybrid chunker for ordinary cases: exact text, repeated spaces, paragraph breaks, surrogate pairs, leading/trailing whitespace, tabs/CRLF/nonbreaking spaces. Controlled chunk output covers repeated occurrences and unavailable matches.
• Unmatched text retains null offsets. Preserve RLS, schema, chunk hashes/identities, embedding semantics, and forward cursor policy. Overlapping chunk origin tracking is phase 1; do not fabricate positions when that policy cannot resolve a chunk.
• Existing incorrect persisted offsets are not repaired automatically. Explicit rechunking updates matching chunk identities through the existing upsert; a separately scoped repair must validate source hashes and avoid triggering unintended embedding work.
• Run the service Jest lane and installed compiler's typecheck. Report Nx checkout collisions separately if they prevent Nx orchestration; do not modify unrelated checkouts to run this fix.

Acceptance: both defect tests demonstrably fail on the original implementation and pass after the patch; true duplicates still merge; stored ranges cover the complete normalized chunk. These are local code/CLI/service-mock checks, not a database or deployed UI acceptance claim.

Phase 1: preserve text identity and exact source locations

Parser: extend src/text_search.zig, src/schema.zig, src/reconcile.zig, src/specialist_protocol.zig, and docs/output-schema.md. Reuse the current reverse map rather than building another normalization engine. Populate rag_chunk.source_span_ids from owning blocks and spans. Specify source/input hash, decoded/view text identity, normalization flags, UTF-8 byte ranges, page indexing, and PDF-point geometry with rotation/crop transforms. Scope structural MCIDs by page/content stream or Form instance when structural identity is exposed; never restore MCID-only deduplication.

Research consumer: update researchSourceIndexService.ts, utils/chunking.ts, services/pdfParserProtocol.ts, services/pdfConversionService.ts, and services/documentIntelligenceExtractionService.ts. Carry origin ranges from structural/semantic chunk composition, including overlap, instead of rediscovering repeated passages by text search. Convert UTF-8 boundaries to UTF-16 explicitly at the host boundary; reject invalid/out-of-range identities. Prefer parser chunk/block locators for PDF attachments, retaining the text-only chunk path for other sources.

Editorial consumer: extend server/lib/pdf-extract.ts with a rich extraction API returning text, source/run identity, page/block/span locators and coverage. Keep extractPdfText as a compatibility projection. Update PDF consumers in server/claude.ts, server/routes.ts, and server/domains/quotes/ingest.ts to retain source evidence. Prompt limits and stored-document limits must be separate projections with explicit truncation; validate quote offsets against the exact retained text view. Parser evidence does not automatically verify a quotation.

Gate: a shared small public/redacted fixture set covers ligatures, repeated phrases, collapsed whitespace, Unicode beyond BMP, overlapping chunks, rotated/cropped pages, and synthetic whitespace with no glyph evidence. Each returned range round-trips to the declared text view and source geometry; wrong input/text-view identities fail explicitly. Additive public fields require the documented schema increment and reader compatibility tests before host activation.

Phase 1 delivery is documented in host adapters and the 0.14 text/source-map contract. Shared modules carry origins through overlapping composition, validate rich extraction, convert byte ranges to UTF-16 and link chunks to page/span evidence. The native contract preserves exact identity text rather than introducing another normalization engine. Span geometry is explicit; viewer transforms and structural MCID namespaces are not newly exposed. Host database/UI adoption, deployments and backfills remain pending; neither host checkout was edited in phase 1.

Phase 2: adopt existing artifacts and bound execution

Research consumer: map existing table cell bbox, role, row/column spans, source spans and logical continuation IDs in pdfConversionService.ts; retain raw values alongside parsed hints. Add output byte budgets to its subprocess runner, then incremental JSONL persistence where warranted. Cancellation/timeout/oversized stdout must terminate and clean up the process and prevent a complete-run receipt. Retain current explicit fallback behavior until coverage policy is separately qualified. Test malformed/truncated JSONL, child exit, huge stdout, late output after cancellation and idempotent retries.

Editorial consumer: change scripts/ensure-pdf-parser.mjs only with a tested parser revision + Zig 0.17 + archive identities as a pair. Preserve baseline CPU and runtime smoke checks. Expand server/test/pdf-extract.test.ts, reference intake tests and transcript/quote tests for both old string and new rich result consumers. Keep the current timeout/output bound and failure distinctions. Network archive fetching and deployment are separate authorized steps, not part of the current local patch.

Parser: extend stream lifecycle and resource fixtures in src/stream.zig, native limit owners, src/main.zig and integration tests only where a missing limit is demonstrated. Distinguish decoded-stream, retained-memory and serialized-output budgets. Record parser build identity, options, specialist versions and terminal state in a deterministic receipt.

Gate: no unbounded host accumulation; no partial/canceled run accepted as complete; both hosts retain stable input/artifact identity and can reproduce a locator. Run actual host tests and neutral parser JSONL fixtures before switching defaults. Roll back host adoption through the compatibility projection/accepted reader family; retain evidence from unsuccessful runs as incomplete.

Phase 3: coverage and regional recovery

Parser: propagate text rendering mode, clipping/paint evidence and page completeness through native spans, layout, adaptive routing and schema. Distinguish verified blank, no selectable text, OCR unavailable/failed, low recognition quality, and unresolved region. Route bounded crops through existing OCR/specialist adapters outside the Zig kernel. Do not interpret outlined lettering as a verified blank page.

Hosts: persist those states in Research consumer's parser ledger/reader and Editorial consumer's extraction result/intake review. Decide when to accept partial text, withhold retrieval, request review or invoke existing fallback. Keep native text, OCR and generated interpretations separately attributable.

Gate: deterministic fixtures for blank pages, outlined glyphs, invisible OCR, clipping, scans mixed with native text, rotation, unavailable rasterizer/OCR, and partial specialist failure. Assert exact page enumeration and unresolved-region visibility. Use separate new held-out documents; do not retune the earlier failed reading-order holdout or promote its diagnostic graph.

Phase 4: tables, hierarchy and figures

Parser: explicit post-reconciliation block/table relationships; tested cross-page continuation and section ancestry; source crop/figure records with hash, owner, bbox and transform. Extend existing table grid/debug tooling with broken-rule and borderless reductions informed by local pdfplumber patterns. Keep raw financial strings authoritative over numeric hints.

Research consumer: expose cell/header/page relationships through document intelligence and web/src/uix/sourceReaderBlock.tsx; retain row labels, periods, units and footnotes. Show figures even when native text conversion succeeds.

Editorial consumer: add source/table inspection within edition-scoped reference workflows, carrying existing quote-safety and publishing gates through richer evidence.

Gate: exact assertions for parentheses negatives, blank versus zero, scale/units, footnotes, merged cells and repeated headers; inspect crop identity and geometry round-trips. Measure topology and source coverage separately from readable Markdown. Evaluate interpretation models only after these deterministic controls.

Validation and rollout discipline

• Parser: selected Zig 0.17; narrow regressions, zig fmt --check, zig build test --summary all, zig build --summary all; adaptive corpus eval when behavior touches routing/layout/schema. Fast-build benchmark lanes qualify any later performance claim.
• Research consumer: installed package Jest lanes plus authoritative TypeScript 7 compiler; Nx targets where its project graph resolves. Protocol/process tests before any changed fallback or ingestion default; reader tests before locator UI claims.
• Editorial consumer: existing Vitest PDF/reference/quote/transcript lanes plus typecheck; paired toolchain bootstrap and deployed runtime/browser checks are later gates.
• Track each phase's source tests, runtime artifacts, deployed revision and product acceptance separately. Preserve unrelated dirty files; no raw private/large PDFs in Git. No deployment, paid inference, archive fetch or bulk backfill is included in phase 0.

Phase 0 execution evidence

• Red: the original reconciler failed both preservation tests (expected two spans, got one), while the true duplicate control passed. The original host service failed six of the first seven added cases; its exact-text control passed.
• Green: all three focused MCID unit tests passed. A generated PDF integration test now verifies both lines, MCID preservation, Markdown order, artifact JSONL/provenance and retrieval chunk coverage.
• Parser gates: Zig 0.17.0; tracked Zig files pass formatting; zig build test --summary all passes all 62 steps after the final integration regression (2,101 tests executed in that run, other test steps cached). zig build --summary all passes all 12 steps.
• Host gates: research indexing, structural chunking and hybrid chunking Jest lanes pass all 33 tests across three suites; package typecheck passes with the authoritative TypeScript 7.0.2 compiler. Whitespace variants select source occurrences in order; an unavailable match retains null offsets without rewinding the raw cursor.
• Actual CLI evidence: MCID reduction retains FIRST and SECOND in native text, adaptive spans and chunks, with zero false duplicates. Host function probe now covers the full source slice in all four original cases. These local evidence files are ignored.
• Nx orchestration was attempted but its graph failed on pre-existing duplicate project definitions in .context checkouts. Used the installed package Jest/typecheck scripts; no workspace cleanup or install was needed.
• Public schema and host database schema are unchanged. Existing persisted locators are untouched. Editorial consumer is planned only; no production host runtime/database/UI test, deployment, backfill, paid inference or performance qualification was performed.

Phase 1 execution evidence

• All phase 1 writes are in pdf-parser. Host code was read to define adoption requirements; neither Editorial consumer nor Research consumer was edited.
• Schema 0.14.0 adds exact-text view hashes and half-open UTF-8 source maps. Construction records span byte origins, including repeated Unicode text. Chunk source-span ids and streaming map ids resolve to the emitted document-global records; synthetic separators have no span geometry.
• New neutral Node modules expose overlap-aware origins, validated rich extraction, separate prompt projection and hash-bound source-range lookup. Typed declarations pass the installed TypeScript 7 strict no-emit check; no dependency installation was needed.
• Node checks pass 9 chunk-origin tests, 57 extraction/protocol/process tests, and 2 actual CLI integration tests. Both real integration tests executed rather than skipped: generated repeated same-MCID lines across two pages, and checked-in complex financial artifacts.
• Zig formatting and zig build test --summary all pass all 62 steps (2,183 tests executed in the last full run, remaining steps cached). The final build passes all 12 steps, including shared-library artifacts.
• The adaptive corpus evaluation completed with local Tesseract/Poppler and the checked-in manifest. This is extraction evidence, not a comparative performance claim or a new page-coverage qualification.
• Actual CLI probes also consumed forms, rotated native text and a mixed native/scan fixture with OCR disabled. Their rich results keep page coverage unverified. Financial fixtures retain legacy specialist labels and report unresolved table/block provenance separately; those legacy references do not contribute to source locators.
• No host ingestion, database migration, corpus backfill, runtime switch, deployment or publishing occurred. Host wiring and explicit 0.14 reader acceptance remain adoption work outside this authorized write scope.

Review and remediation

Observed on the current working tree: independent review reproduced weak source identity validation and unbounded waits for wrapper descendants. Both now have passing regressions; POSIX termination owns the process group and closes pipes, and extraction validates the exact source id it supplied. A native allocation failure regression also exposed detached block/chunk buffers; error cleanup now passes all injected allocation failures. Explicit consumer names and repository paths were removed from the added code and documentation.

Observed checks: 73 JavaScript tests passed, both real CLI integrations executed, strict declaration typecheck passed, Zig formatting passed, and the full Zig test/build targets passed (62/62 and 12/12 steps). A source/binary-hash-bound verification receipt retains the final public adapter/CLI readback. Windows process-tree cleanup and consumer runtime adoption remain unverified.

Parser capability continuation

Schema 0.15.0 implements three parser-side units from the later phases:

• Authoritative reconciled span/table/cell owners use source-span membership, including document-global streaming ids. Numeric layout compatibility fields remain available; the reader validates exact ownership and same-page scope.
• Native streaming caps aggregate output and adaptive page allocations. A new incremental page adapter applies page/record/count limits and serial callback backpressure. Budget, cancellation, process and callback failures cannot produce an accepted complete receipt.
• Page/region assessments report retained text and unresolved recovery. Selected OCR/formula output must intersect the assessed region; failed or disabled recovery remains visible alongside native text. Completeness stays unverified.

Regressions exercise forged ownership, contradictory coverage, later-page source locators, actual native allocation exhaustion, mixed native/scan extraction and stream failure paths. The previous phase receipts describe historical hashes; the continuation receipt records the source/binary and gate results for that phase.

Observed checks: all 128 JavaScript tests pass without skips, strict declaration typechecking and Zig formatting pass, and native test/build targets pass all 62/62 and 12/12 steps. All 36 checked-in corpus documents pass both public batch and streaming readers with OCR disabled. The adaptive evaluation also completes all 36 cases with local OCR enabled. A mixed native/scan readback changes from recovery_required to recovered when OCR is enabled, while keeping visual completeness unverified. These runs qualify the exercised contracts, not universal extraction accuracy or performance.

Independent read-only review found forged span ownership, cross-page cells and out-of-scope/contradictory coverage acceptance. All are rejected after remediation and covered by permanent regressions. The hash-bound continuation receipt retains the gates, corpus results, actual OCR outcome and limitations.

Paint provenance and bounded crops continuation (0.16)

Observed: PR #5 merged after all six CI checks passed on its final head. The post-merge continuation adds operator paint evidence to native spans and specialist context, with rendering modes, rectangular clipping and affine graphics-state restoration. It retains hidden/clipped text, and reports unknown evidence for unqualified paths rather than claiming visual completeness.

Good native pages now OCR image placements individually, using pixel-aligned PDF-space crops with accepted PNG SHA-256 and byte length. Native-quality failure retains whole-page recovery. Pixel/byte limits and per-page region/attempt quotas are public controls, and refusal leaves native text and unresolved targets. Selected attempts bind to the exact page/region. Stream specialist references now use the same global span/block IDs as public maps. Both neutral JavaScript adapters expose crop budgets and an explicit partial-result policy.

Independent review reproduced four issues: image transforms leaked across q/Q, later-page specialist context named local IDs, readers accepted inconsistent selected OCR attempts, and duplicate-route suppression erased independent hidden-text needs. Each has a failing control and a remediation regression. Allocation sweeps also exposed lexer string/array OOM text loss; those operations now propagate failure and release partial buffers.

The continuation receipt binds the final source/binary identity to native gates, reader tests, actual two-image/two-page OCR, quota skips, corpus results and remaining limits. This continuation is locally checked; remote CI and a second merge are not established.

Observed final checks: 169 JavaScript tests pass without skips; formatting, strict declaration checks, native tests (62/62 steps), build (12/12), shared (6/6) and WASM (5/5) gates pass. All 36 corpus PDFs pass batch and streaming readers with OCR disabled; adaptive evaluation completes all 36 with local OCR. Scanned-form, JBIG2 and JPX quality gates pass using the installed local tool versions. The unchanged JBIG2 route-count gate exposed fractional whole-page mapping drift, which was fixed without relaxing expectations. These are local contract/fixture checks, not universal accuracy or production qualification.

The next priority inferred at the end of that continuation was rotated raster mapping and Form/opacity evidence, then add unexplained vector-region routing with held-out outlined-text controls. Paint evidence describes operators and bboxes, not final pixels; regional budgets do not cap child RSS or temporary disk during rasterization. Host activation needs its own reader/persistence tests. Table topology, cross-page continuation, hierarchy and figures need separate holdouts.

Adaptive text fidelity continuation (0.17)

Fresh assessment moved semantic text fidelity ahead of additional recovery: the checked-in ActualText fixture retained the wrong glyph text in adaptive output, Form text depended on an external page-sized fallback, and horizontal and rotated controls lost word boundaries in final chunks.

ActualText now supplies a separate semantic glyph projection while raw glyph evidence remains available. Replacement text is emitted once across operators, fonts and paint changes; empty replacements suppress raw text. Unicode and PDFDocEncoding controls cover non-BMP characters, punctuation and ligatures. Named properties resolve through the active resources. Conflicting nested replacements use the documented outer-owner policy. Replacement geometry is a union bbox, and search does not invent per-character raw glyph indices.

Form traversal now shares resource frames across recall, geometry, structured extraction and image inventory. Local, indirect and inherited fonts, composed matrices, conservative BBox clips and repeated placements retain their evidence. Cycles, depth beyond ten Forms and more than 10,000 invocations per page fail explicitly. Schema 0.17 adds page/stream/invocation scope to native spans and specialist context; readers validate those identities. Earlier reader families remain supported. Scoped MCIDs never substitute for duplicate-text checks.

Word grouping uses local writing coordinates and font-space advances, preserves explicit boundaries across reconstructed spans, and retains semantic replacement text verbatim. Both native and adaptive born-digital/hard-font benchmark lanes now block regressions at the same existing floors. Public CLI regressions cover batch, stream, source text, chunks and locators, including Form extraction with external tools absent. No evaluation threshold was lowered.

Cross-module review found cold font-cache initialization and pending Form span metadata lifetime defects. Both were fixed with regression tests and allocation sweeps. Review used independent contexts on the inherited session model; it does not establish model diversity. The text-fidelity receipt binds the source and binary used for the final local checks. This continuation subsequently landed in PR #6 at 9cac608, with all six CI checks green. Host adoption and deployment remain outside that result.

Observed final local checks: 183 JavaScript tests pass without skips; native tests pass all 62 steps, shared builds 6/6 and WASM 5/5. The combined benchmark gate passes all 18 steps. All twelve hard-font documents pass exact text floors in both native and adaptive lanes, and both born-digital controls pass in each lane. All 36 corpus PDFs pass both public readers with OCR disabled; adaptive evaluation completes all 36 with local OCR enabled. These results qualify the exercised corpus and contracts, not universal extraction accuracy.

Linux/aarch64 Memcheck passes checker qualification, 16 parser/ABI/counter checks and six additional ActualText/Form controls, without suppressions. Expected injected faults remain detected. This qualifies the diagnostic native lane; Python and OCR memory lifetimes were excluded, and logical suballocation boundaries inside live arenas remain outside its proof.

Coordinate transforms and rotated OCR (0.18, local)

The shared page model retains raw PDF user-space bboxes and adds a forward/inverse display contract. Page routes carry nullable page_geometry: MediaBox, effective CropBox, normalized quarter-turn rotation, leaf-page UserUnit and physical-point display dimensions/matrices. MediaBox, CropBox and Rotate retain page-tree inheritance. Legacy PageInfo dimensions and manifest display_transform:null remain compatible. Invalid geometry or non-quarter rotations withhold the new mapping; no identity transform is fabricated.

OCR and formula raster callers use MediaBox. Regional crops round outward on the backend pixel grid; whole-page OCR maps accepted bitmap dimensions to exact page extents. The selected Poppler backend ignores UserUnit, so rasterizer DPI is the requested physical DPI multiplied by UserUnit. Padding is divided by UserUnit before applying it to raw coordinates. Accepted OCR attempts expose nullable raster_transform; formula attempts expose nullable config.crop_transform and their child requests receive crop_geometry. Each context retains pixel-to-PDF matrix, effective rasterizer DPI and dimensions. Formula's legacy requested bbox is preserved separately.

OCR word boxes map all four corners back to raw PDF coordinates. Recognizer word/line/block metadata retains readable boundaries through quarter turns. This follows declared page rotation; it does not detect the orientation of scans. Rotated OCR preserves the recognizer's word order instead of promoting tables inferred from raw PDF axes. Rotated table reconstruction remains unqualified. Pixel, byte, region and attempt caps remain in place. Neutral adapters expose page geometry and explicit-scale bbox mapping without inventing character boxes.

Local verification passed for this unit: 82 combined native/build/shared/WASM/ benchmark steps, 241 JavaScript tests without skips, strict declarations, 36 corpus documents through both readers, and three OCR quality gates plus their SDK readbacks. Numeric and actual raster controls cover quarter turns, inverse mappings, negative/nonzero origins, distinct CropBox, leaf-only UserUnit, fractional seams, transformed Forms applied once, invalid/overflow refusal, text/chunks/locators and retained budget failures. Linux passed 19 scoped memory checks and eight actual OCR quarter-turn CLI controls. Whole-Python-process shutdown remains unqualified. Ten native tests were skipped; the C-enabled recognition/teardown memory lane was exercised separately. Evidence is retained under ignored benchmark/eval/outputs/coordinate-transforms-2026-10-10/. No remote CI or merge is claimed for schema 0.18.

Bounded vector routing (0.19, locally checked)

Collect painted-path hulls with limits of 512 retained shapes, 512 segments per path and 100,000 operators. Cap cumulative vector-lexer input across page and Forms at 8 MiB, graphics stack depth at 32 and Form invocations at 256. These bounds exclude initial PDF decompression and do not establish whole-process memory limits. Group unexplained contours into at most 64 regional OCR candidates. Page summaries retain collection status, classification counts and operator/byte counters; candidate records retain exact PDF-space bbox, shape/segment/subpath counts and native coverage. Required nullable vector_evidence appears only on page and region route traces. Known candidates link their unexplained_vector reason to an actual same-scope OCR request. Missing evidence remains null. When an existing image OCR route covers a vector candidate, retain the exact candidate bbox inside the larger route and reuse its request. Require nonblank retained fresh OCR text to intersect the exact candidate bbox with positive area before reporting recovery. Text elsewhere in the shared bitmap crop leaves the vector candidate unresolved. Recovery is text availability; merged route bounds and completeness remain unverified.

Use known display axes for grouping, while public candidate boxes remain raw, unrotated PDF coordinates. Withhold rules, simple boxes, native-accounted shapes and isolated symbols. Unsupported evidence is partial; exhausted work bounds are limited. Geometric suspicion does not establish glyph identity, final visibility or completeness. Recovery uses the existing OCR engine and bounded crop quotas. Rotated OCR table promotion remains deferred. Native accounting unions clipped painted span rectangles, capped at 64 intersections per shape/candidate coverage query and 1,000,000 native-span checks during page classification. Candidate-merge coverage uses its own bounded check budget. Exhaustion produces partial evidence and candidate abstention; it must not establish zero coverage.

Acceptance passed on 23 generated fixtures with real curved glyph outlines, mixed native/vector content, transformed Forms, quarter turns, clipping, thin rules, highlights, borders, isolated logos, ambiguous dense graphics and reached shape/segment limits. All 47 generated files reproduce byte-for-byte; the PDFs total 156,147 bytes. Sheared Form clipping remains an explicit abstention.

Independent review reproduced and remediation fixed three defects: a narrow native clip could suppress visible outlines, exhausted native accounting could publish fabricated zero coverage, and disjoint OCR text in a reused bitmap crop could mark its vector candidate recovered. Each has a persistent regression; saved before/after CLI probes cover both JSONL formats. The final scoped readback found no remaining material issue. Review used a separate context with the inherited session model; this does not establish model diversity.

Current local gates pass 82/82 Zig build steps and 3,774/3,784 tests, with ten documented skips; native, shared-library and WASM builds pass. All 339 JavaScript tests pass with no skips in a serial run, including 13 vector CLI/SDK tests. Both SDK readers accept all 36 corpus documents and three OCR-enabled controls. The 36-document adaptive evaluation, both born-digital/hard-font lanes and three OCR quality gates pass. An earlier parallel JS run missed a process-test startup deadline; the retained serial run passes that test without a product change. No speed or universal outlined-text accuracy claim follows from these checks.

Linux/aarch64 passes 19 scoped parser/ABI/counter and C OCR teardown memory checks with no skips, plus 16 vector CLI controls across both JSONL formats. The latter exercise actual OCR children without instrumenting their memory. Whole-Python-process shutdown remains unqualified, and memcheck_proven remains false. These checks do not establish a whole-process memory bound.

Evidence and checked binaries are retained under ignored benchmark/eval/outputs/vector-routing-2026-10-11/. This unit is committed on codex/coordinate-vector-ocr; no remote CI or merge is claimed here.

Table topology and reading order need new held-out suites; the earlier reading-order holdout must not be retuned or promoted. Host adoption remains a separate change after parser contract verification.