[oscar981-op]

A PDF whose first text uses a zero-point font can lose all subsequent visible text in PDF.js 6.4.299. Search, selection and Office conversion can consequently see an empty page. This backports Mozilla #22384, commit d7fd526d5e5176ccd6f066fc6b48d45ee1560af7, into the actual legacy worker shared by the editor and print queue. The existing PostScript progress patch and Chrome 91 worker transformation remain in place; dependency drift fails the build.

Office conversion now extracts through a separate strict parser using a copy of the cached source bytes. Unrecoverable extraction errors show an error and write no output. The existing empty-page/image and OCR fallback remains available for valid pages. Source replacement is detected, private parsers are destroyed, and encrypted browser PDFs request the opening password again through the existing dialog (retry/cancel supported; no password retention). Native desktop uses its existing decrypted working copy.

Closes #878.

Validation:

• The generated zero-font fixture fails with the installed unpatched worker; the patched/transformed worker preserves visible text in a page and Form XObject, with nonzero-font controls and a DOCX content check.
• Playwright exercises the app's real search/text-selection modules and actual DOCX/ODT/XLSX downloads. A malformed XObject produces an error without a download. The existing encrypted PDF fixture exports successfully after a wrong-password retry; cancellation produces no download.
• Full unit corpus: 6,207 tests, 6,188 passed, 19 skipped, zero failures. TypeScript, Vite production build and version consistency passed. The actual emitted worker passed zero-font/Form/control/DOCX/error probes and all six existing Type 4 PostScript probes.

Limitations: strict export reparses the PDF and requires an extra byte-buffer copy. Native installer/WebView and physical Office applications are not locally exercised. Re-authentication is required for encrypted PDFs in the browser. Version 2026.44.24 includes the repository-required version updates; no release will be published.

Installer status: release.yml dispatch for this exact branch returned HTTP 422: “Actions has been disabled for this repository”. No installer run was created. An unpublished draft release v2026.44.24 targets exact commit 6ff4d49c73d5f03b3cabcd0e89119be01dd9d207; it has no installer assets. No release was published.

Upstream CI on exact head 6ff4d49c73d5f03b3cabcd0e89119be01dd9d207: Ubuntu, Windows, render-regression and hosted-CSP passed. The macOS job fails the existing stored definitions stay compact for image watermarks test (imageData of undefined), addressed separately by #868; its log was verified. The zero-font regression tests pass. Refresh and retest after that fix is integrated upstream rather than duplicating it here.

Required review is outstanding and the contributor account has no upstream merge permission. Keep this PR in draft while installer validation, the baseline macOS failure and review are blocked.

[DutchSailor]

Thank you, this work is included in v2026.44.6 as 923956a and also in v2026.44.7, which replaces 44.6. It went in as one squashed commit with your authorship, together with other PRs in one integration round, so GitHub does not mark this PR as merged. Closing it for that reason.

Changes made during review:

• Strict Office extraction reads the bytes of the shown document
  (pdfDoc.getData()) instead of the byte cache. The cache is stale after
  find and replace (reloadDocumentFromBytes) and has no entry under the
  file path for documents without one, which made export use old text or
  fail with "source bytes are unavailable".
• The separate web unit build loaded the unpatched modern PDF.js worker.
  The patch plugin now takes a workerPath and patches that worker too;
  web-unit/src/viewer.js loads it through virtual:opds-pdfjs-worker-url.
• Tests cover the legacy and the modern worker (pattern, idempotence,
  drift, real extraction before/after), the dev route of the plugin for
  both builds, and the post-build check now also runs the zero-font probe
  on the emitted worker (app and web unit).
• Regression test: strict extraction parses the shown document's bytes,
  also without a file path.