Route invisible PDF text layers to visual verification

[silverstein]

Summary

Detect explicitly invisible PDF text layers and guide readers to verify them against the visible page. Preserve the original extracted text and keep visibility evidence separate from Unicode integrity or OCR accuracy. A clean searchable scan can legitimately use hidden text.

• Add bounded PDF.js mode-3 text-show measurements to page analysis and plain reading.
• Report unavailable state instead of guessing through annotations, transparency groups or optional-content layers.
• Replace the generic content-success banner with an accurate text-layer-read message.
• Keep source and share copies aligned and update the advertised schema fingerprint.

Verification

• Stonebook macOS/x64 (Intel MacBookPro15,1), Node 26.5.0: 259/259 focused and adjoining tests across 10 files.
• Native partition: 62 passed, nine intentional skips. Reproducible share contract passed with native rendering and 57 tools/14 prompts.
• 23 dedicated cases cover multilingual text, native text, searchable-image PDFs, hidden/mixed text, saved state, forms, clipping-only mode, unsupported state, unavailable operators and later page failures.
• Actual source and share MCP replay on the known Apollo flight-plan regression identifies all 356 hidden text-show operations, preserves the text and routes page 1 for visual verification.
• Independent review of PDF.js state semantics led to explicit group and optional-content abstention.
• Reproducible MCPB build and packed darwin/x64 smoke passed. Two clean builds were byte-identical.
• Actual source/share rendering returns identical source-bound images of the flagged scan; visual inspection confirms readable printed labels. This is not an OCR score.
• Initial full CI correctly rejected stale layout-oracle source fingerprints. Existing generator refresh changes only output-schema size/hash and validator-source-set digest; independent review confirms all eight cases and other fields unchanged.
• The corrected run passed Node 22, but Node 20 exposed an existing concurrent-workspace test schedule assumption. Reviewed test-only 6f6cd36b makes completed-winner, held-genesis and early-loser schedules deterministic. All 43 workspace checks pass; no runtime guards changed. Final CI runs on that exact head.
• A separate fresh two-column page, with expectations independently frozen before output, passed eight reading-order checks and three fact associations on its first run. Overall conversion remains partial; no full-page or competitive claim.
• Affected Mac suites: 19/20 on the first rerun, with one 60-second scorer timeout on a speed-limited host. Unchanged isolated scorer then passed 9/9. Full CI remains the integration gate.

Limits

This improves truthful routing, not OCR accuracy. The Apollo diagnostic still does not recover its eight visible text samples. No model, provider or OCR calls; no public-release or desktop-host qualification claim. Markdown's existing image/OCR gaps and extraction IR are unchanged.

Internal work item: pdf-toolkit-mcp-nv3z.