test: the pdf editor's failure path, and size as a dimension

The last two from the "an afternoon each" list.

An unopenable PDF goes to a different vendor app, and none of the guarding the
other three cases exercise runs inside it. It reaches the same visible outcome
-- error dialog up, load mask gone, save rejected in about a second -- but by a
different route: asc_onError alone, with no rejection escaping the frame. The
case asserts that difference rather than papering over it, so the day the pdf
app starts or stops producing one, something says so.

And size, which until now was covered only on machines that have a private
corpus, and only by whatever happened to be in it. A two-megabyte, twenty
thousand paragraph document, built in memory so nothing binary is checked in.
The saved file's own size proves little -- prose that repetitive deflates to
87 KB -- so what is asserted is the text that comes back out: over a megabyte
of it, with the first, middle and last paragraphs present. That is also what
catches a body silently truncated on the way through, which is the failure
worth having here.

One budget for open plus save rather than two: document:open-buffer resolves
when the open has been handed over, not when the document is on screen, so its
own number is not a load time and the waiting lands in the save instead.

Reverse-validated: building only the first 200 paragraphs reports 20,733
characters against the expected million.

Ledger: 13 cells left, down from 15.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MKNHFQ1kek1cHeqhbH37Pk

Author: chaxus

docs/test-matrix.md

@@ -15,16 +15,17 @@ embed-save-default.spec、`HX` = html-as-xls.spec、`FN` = filename-matrix.spec
 `RI` = resave-idempotence.spec、`FP` = format-parity.spec、`OR` = open-retry.spec、`MS` = mobile-slide.spec、
 `MT` = main-site.spec、`VR` = visual-roundtrip.spec、`XF` = xlsx-features.spec、`XP` = xlsx-panes.spec、
 `DF` = docx-features.spec、`CM` = comments.spec、`II` = image-insert.spec、`PR` = pdf-roundtrip.spec、
-`PC` = pdf-cjk-export.spec、`CE` = csv-encoding.spec、`UC` = ui-crawl.spec、`SU` = sw-silent-update.spec。
+`PC` = pdf-cjk-export.spec、`CE` = csv-encoding.spec、`UC` = ui-crawl.spec、`SU` = sw-silent-update.spec、
+`LD` = large-document.spec。
 
 ## 现在真正空着的格子
 
-按"补它需要一个决定还是一次动手"分组，而不是按表格顺序——九处 ⬜ 里只有三件事。
+按"补它需要一个决定还是一次动手"分组，而不是按表格顺序——七处 ⬜ 里只有三件事。
 
 1. **doc / xls / ppt 的非打开动作**（表 A 里十五个 ✱ 中的大部分）。要一个决定：把
    `corpus.spec.ts` 从"打开 → 编辑 → 保存"扩成也走导出 PDF / 只读 / 插图 / 幂等。
    合成夹具这条路走不通（旧二进制手拼不出来），所以这不是十五个用例，是一次扩展。
-2. **一次动手就能补的**：pdf 的打开失败路径、固定的 MB 级夹具。
+2. **一次动手就能补的**：pdf 的环境类失败自动重试、pptx 的裸 `document:save` 默认格式。
 3. **要外部条件的**：真实安卓设备、右键菜单（vendor 的上下文菜单在 canvas 里，
    没有可枚举的 DOM）、旅程本体（需要先把 `actions/` 的动作库补齐）。
 
@@ -42,7 +43,7 @@ embed-save-default.spec、`HX` = html-as-xls.spec、`FN` = filename-matrix.spec
 | 插图后保存                  | ER             | ✱   | II                     | ✱               | II         | ✱         | —      | —          |
 | 评论                        | CM             | ✱   | CM                     | ✱               | CM         | ✱         | —      | PR（注释） |
 | 再打开→再保存（幂等）       | RI             | ✱   | RI                     | ✱               | RI         | ✱         | RI     | PR         |
-| 打开失败可见 + 保存快速拒绝 | —              | —   | OF                     | —               | —          | —         | —      | ⬜         |
+| 打开失败可见 + 保存快速拒绝 | —              | —   | OF                     | —               | —          | —         | —      | OF         |
 | 环境类打开失败自动重试      | —              | —   | OR（故障注入）         | —               | —          | —         | —      | ⬜         |
 | 裸 `document:save` 默认格式 | SD             | ✱   | FN                     | HX（→xlsx）     | ⬜         | ✱         | ER     | ⬜         |
 
@@ -57,7 +58,7 @@ embed-save-default.spec、`HX` = html-as-xls.spec、`FN` = filename-matrix.spec
 | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
 | 文件名：ASCII / CJK / 空格括号 / 全角标点 / emoji / `&%'!` / 180 字符 | FN（xlsx 全部 7 种；docx CJK+空格；pptx CJK+`&%'!`+180 字符）                                                             |
 | 体积：KB 级                                                           | 全部合成用例                                                                                                              |
-| 体积：MB～60MB                                                        | 🌙（EMP deck 6.5MB 产物）；固定用例 ⬜                                                                                    |
+| 体积：MB～60MB                                                        | `LD` = large-document.spec（2 MB / 2 万段 docx，正文长度 + 首中末三点 + 90s 预算）+ 🌙（EMP deck 6.5MB 产物）             |
 | 编码：GBK CSV / GBK HTML 表                                           | `CE`（GBK CSV 真编辑器往返）+ HX + 单测                                                                                   |
 | HTML 伪装 .xls/.xlsx                                                  | HX + 单测                                                                                                                 |
 | 垃圾字节 / 截断 / 加密                                                | OF 三种：无签名的垃圾（嗅探期就被拒）、被腰斩的真 xlsx（要到读中央目录才失败）、加密的 xlsx（根本不是 zip，是 OLE2 容器） |

test/e2e/large-document.spec.ts

@@ -0,0 +1,97 @@
+import { buildDocx, ooxmlText, toBase64, zipEntryText } from './lib/ooxml';
+import { expect, test } from './lib/l0';
+
+/**
+ * Size as its own dimension (matrix section B, "体积").
+ *
+ * Everything else in the synthetic suite is a few kilobytes, and the corpus
+ * run is the only place a multi-megabyte file is ever opened -- which means
+ * size is only covered on the machines that have a private corpus, and only
+ * for whatever happens to be in it. This builds one instead: a document large
+ * enough that opening it is a real allocation and saving it moves real bytes,
+ * pinned to a budget so a regression shows up as a timeout rather than as a
+ * slow afternoon nobody measured.
+ *
+ * The paragraphs are numbered so the middle and the two ends can be checked
+ * without holding the whole document in an expectation. Two megabytes is the
+ * low end of what the matrix calls for, and it is deliberate: the fixture is
+ * built in memory on every run, and the failures worth catching here (a body
+ * truncated on the way through, an open that has become quadratic) show up at
+ * this size as readily as at sixty.
+ */
+const PARAGRAPHS = 20_000;
+const FIRST = 'first paragraph 第一段';
+const LAST = `paragraph ${PARAGRAPHS} 最后一段`;
+
+const buildLargeDocx = (): Uint8Array => {
+  const body: string[] = [`<w:p><w:r><w:t>${FIRST}</w:t></w:r></w:p>`];
+  for (let i = 2; i < PARAGRAPHS; i++) {
+    body.push(`<w:p><w:r><w:t>paragraph ${i} line of ordinary prose to give the file some weight</w:t></w:r></w:p>`);
+  }
+  body.push(`<w:p><w:r><w:t>${LAST}</w:t></w:r></w:p>`);
+  return buildDocx('', body.join(''));
+};
+
+test.describe('a multi-megabyte document (real editor)', () => {
+  // Generous next to the measured time, because this is a budget rather than
+  // a benchmark: it should catch an order-of-magnitude regression and never
+  // fail for being on a busy runner.
+  test.describe.configure({ timeout: 240_000 });
+
+  test('opens, saves and keeps both ends inside the budget', async ({ page }) => {
+    const docx = buildLargeDocx();
+    expect(docx.byteLength, 'the fixture has to actually be large').toBeGreaterThan(1_500_000);
+
+    await page.goto('/embed-demo.html');
+    await expect(page.locator('#status')).toHaveText('ready', { timeout: 60_000 });
+
+    const result = await page.evaluate(
+      async ({ b64 }) => {
+        const bin = atob(b64);
+        const bytes = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+
+        const openedAt = Date.now();
+        await post('document:open-buffer', { fileName: 'large.docx', buffer: bytes.buffer, readonly: false });
+        const openMs = Date.now() - openedAt;
+
+        const savedAt = Date.now();
+        const saved = await post('document:save', {});
+        const saveMs = Date.now() - savedAt;
+
+        const out = new Uint8Array(await saved.file.arrayBuffer());
+        let s = '';
+        for (let i = 0; i < out.length; i += 0x8000)
+          s += String.fromCharCode.apply(null, Array.from(out.subarray(i, i + 0x8000)));
+        return { openMs, saveMs, name: saved.file.name as string, size: out.byteLength, b64: btoa(s) };
+      },
+      { b64: toBase64(docx) },
+    );
+
+    test.info().annotations.push({
+      type: 'large-doc',
+      description: `${docx.byteLength} B in, ${result.size} B out, open ${result.openMs} ms, save ${result.saveMs} ms`,
+    });
+
+    expect(result.name).toBe('large.docx');
+
+    // The saved file's own size says little -- the fixture is a stored zip and
+    // the engine deflates prose that repetitive down to a fraction of it. What
+    // has to be large is the text that comes back out, which is also what
+    // catches a middle silently dropped on the way through.
+    const bytes = new Uint8Array(Buffer.from(result.b64, 'base64'));
+    const text = ooxmlText((await zipEntryText(bytes, 'word/document.xml')) || '');
+    expect(text.length, 'the body came back whole').toBeGreaterThan(1_000_000);
+    expect(text).toContain(FIRST);
+    expect(text).toContain(LAST);
+    expect(text).toContain(`paragraph ${Math.floor(PARAGRAPHS / 2)} `);
+
+    // One budget for the pair, not two. `document:open-buffer` resolves once
+    // the open has been handed over rather than once the document is on
+    // screen, so its own number is not a load time -- the waiting it does not
+    // account for lands in the save instead.
+    expect(result.openMs + result.saveMs, 'a few megabytes through the editor must not take a minute').toBeLessThan(
+      90_000,
+    );
+  });
+});

test/e2e/open-failure.spec.ts

@@ -15,15 +15,18 @@ import { expect, test } from './lib/l0';
  * asc_onError and frame rejections (a silently broken hook would make every
  * other suite look cleaner than it is).
  *
- * Three shapes of unusable input, because they fail in different places.
+ * Four shapes of unusable input, because they fail in different places.
  * Garbage bytes are rejected before anything is unpacked. A truncated file --
  * an upload that was interrupted, a file copied off a full disk -- gets
  * further: the local header says a real workbook, and only the central
  * directory at the end turns out not to be there. An encrypted workbook is not
  * a zip at all: Office wraps the whole package in the pre-2007 OLE2 container,
- * and nothing outside the file says so. All three are files a user will
- * genuinely hand us, and whichever way each fails, the user must be told and
- * the editor must stay usable.
+ * and nothing outside the file says so. The fourth is handed to a different
+ * vendor app altogether: the pdf editor reaches the same visible outcome by a
+ * different route, reporting through asc_onError alone without the frame
+ * rejection the other three produce. All four are files a user will genuinely
+ * hand us, and whichever way each fails, the user must be told and the editor
+ * must stay usable.
  */
 test.describe('open failure surfacing (real editor)', () => {
   test.describe.configure({ timeout: 120_000 });
@@ -58,15 +61,23 @@ test.describe('open failure surfacing (real editor)', () => {
       // same visible way rather than stall.
       bytes: () => buildEncryptedOoxml(),
     },
+    {
+      label: 'a PDF that is only a header',
+      name: 'junk.pdf',
+      // Routed to the pdf editor instead, which is a separate vendor app with
+      // its own load mask and its own error path -- worth its own case
+      // because none of the guarding above runs in it.
+      bytes: () => new TextEncoder().encode('%PDF-1.4 and then nothing that parses at all'),
+      // It reports through asc_onError only; no rejection escapes the frame.
+      frameRejection: false,
+    },
   ] as const;
 
-  for (const { label, name, bytes } of UNUSABLE) {
-    test(`${label} named .xlsx raises asc_onError -82, ends the load mask and fails saves fast`, async ({
-      page,
-      l0,
-    }) => {
+  for (const { label, name, bytes, ...rest } of UNUSABLE) {
+    const frameRejection = (rest as { frameRejection?: boolean }).frameRejection !== false;
+    test(`${label} raises asc_onError -82, ends the load mask and fails saves fast`, async ({ page, l0 }) => {
       l0.expectAscError(-82);
-      l0.allowFrameError(/Document conversion failed/);
+      if (frameRejection) l0.allowFrameError(/Document conversion failed/);
       // Firefox additionally prints the bare rejected Error object as "Error".
       l0.allowConsole(
         /Document conversion failed|Conversion failed with code|open conversion failed|changesError|^Error$/,
@@ -107,9 +118,10 @@ test.describe('open failure surfacing (real editor)', () => {
       expect(save.error).toMatch(/failed to open/i);
       expect(save.ms).toBeLessThan(10_000);
 
-      // The fixture saw the SDK error and the frame rejection.
+      // The fixture saw the SDK error, and the frame rejection where the app
+      // produces one.
       expect((await l0.ascErrors()).map((e) => e.id)).toContain('-82');
-      expect((await l0.frameErrors()).some((e) => /Document conversion failed/.test(e.message))).toBe(true);
+      expect((await l0.frameErrors()).some((e) => /Document conversion failed/.test(e.message))).toBe(frameRejection);
     });
   }
 });