PDF stage 3.3: embedded TrueType → @font-face + reverse map

[andiwand]

Stage 3.3 of the in-house PDF renderer (DecoderEngine::odr): the first
end-to-end PDF display win. Embedded TrueType programs are now rendered in the
actual font instead of a system fallback, and their Unicode is recovered for
selection.

What lands

• Embedded font on the PDF font. pdf::Font carries the SFNT parsed from
  /FontFile2 (a simple TrueType font, or a composite CIDFontType2) through the
  abstract::Font interface as embedded_font, plus a /CIDToGIDMap. Unsupported
  flavors (/FontFile3 CFF → 3.4, /FontFile Type1 → 3.5) leave embedded_font
  null and keep the legacy fallback path.
• Code → glyph. Font::glyph_for_code: composite Identity-H/V (CID = code)
  → GID via /CIDToGIDMap (Identity default, or explicit stream); simple
  TrueType best-effort per ISO 32000-1 9.6.6.4 (embedded cmap on the byte code,
  then on the code's Unicode, then code-as-GID).
• Embedded-font reverse map. Font::to_unicode gains a final fallback
  (code → glyph → code_point_for_glyph), closing the stage-1 extraction gap for
  fonts with neither /ToUnicode nor a usable /Encoding. Flows through
  extract_text with no page-text changes.
• HTML: dual layer. Per embedded font, one @font-face (re-encoded to the
  PUA via the 3.1 pipeline, once, after extraction so it can't disturb the
  reverse-map lookups). Each run emits a transparent selectable span carrying the
  real Unicode with a visible PUA glyph layer nested inside it (in the
  embedded font, user-select:none) — so display is glyph-exact and copy/search
  still work.

Refinements

• Font memoization. parse_font now caches Font elements by object
  reference (mirroring the XObject cache), so a font shared across pages is
  parsed once. Without it the @font-face dedup (keyed on Font*) re-inlined
  each font's base64 program per page — Core_v5.1.pdf's document.html ballooned
  to 1.4 GB / 11,873 inlined fonts; now 28 fonts, parsed once.
• HTML size. Restructured the dual layer to fit GitHub's 100 MB limit while
  keeping uncompressed, one-run-per-line output (so the committed reference stays
  diffable): nest the glyph layer (placement classes live only on the parent and
  are inherited), emit each run inline (one line, not an open/text/close triple),
  and drop the per-glyph aria-hidden attribute (an ARIA attribute can't be
  deduped into a class). The painted layer sets .gv{color:#000} explicitly
  since nesting would otherwise inherit the text layer's transparent.
  Core_v5.1.pdf's document.html: 138 MB → 88 MB.
• OTS table synthesis. OTS (the font sanitizer in Chrome/Firefox/Safari)
  rejects a web font missing post or OS/2, and PDF-embedded TrueType fonts
  routinely omit both — so every embedded glyph layer rendered as tofu.
  SfntFont::write() now synthesizes a minimal format-3.0 post and a
  version-4 OS/2 (neutral weight/width, metrics from the bounding box, ranges
  from the cmap) when absent; existing tables pass through verbatim. Verified
  end-to-end in headless Chrome — previously-boxed runs now render real glyphs.

Decision captured

Dual-layer (vs. PUA-display-now/select-later) was chosen for selectable text in
this PR; the trade-off is up to ~2× text spans, mitigated by the nesting/inline
restructuring above.

Tests

• pdf_font_program.cpp (new): glyph_for_code (Identity / CIDToGIDMap /
  simple-cmap / no-font) and reverse-map to_unicode (incl. /ToUnicode
  precedence). All assertion-based, inline SFNT.
• sfnt_transform.cpp: post- and OS/2-table synthesis (added vs. passed
  through; field/offset checks).
• Verified end-to-end in headless Chrome on style-various-1.pdf: every
  @font-face accepted by OTS, real glyphs rendered (headings, bold/italic,
  bullets, alignment), no tofu.
• Focused PDF/font/SFNT suites green (193 tests).

Deferred (follow-ups)

• Non-identity simple-TrueType glyph-selection edge cases; CFF/Type1 (3.4/3.5).
• Baseline placement (still box-top).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cb18d44320

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".