feat(bf-31re9): comment unused internal imports in encryption tests

Commented out unused internal module imports in encryption error tests
with comprehensive documentation explaining the subprocess testing
approach. Verified all modules exist and compile successfully.

Verified imports:
- pdftract_cli::password (crates/pdftract-cli/src/password.rs)
- pdftract_core::diagnostics types (crates/pdftract-core/src/diagnostics.rs)

Tests use std::process::Command to spawn CLI binary, not direct
module calls. Imports retained as comments for future reference.

Closes bf-31re9. Verification: notes/bf-31re9.md

crates/pdftract-cli/tests/test_encryption_errors.rs

@@ -27,11 +27,18 @@ use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
 use std::time::Duration;
 
-// CLI module imports for encryption testing
-use pdftract_cli::password;
-use pdftract_core::diagnostics::{
-    DiagCode, DiagInfo, Diagnostic, DiagnosticsCollector, ObjRef, Severity, DIAGNOSTIC_CATALOG,
-};
+// NOTE: Internal module imports are commented out because this test file uses a subprocess
+// approach (spawning the CLI binary via std::process::Command) rather than directly calling
+// internal modules. If direct module testing is needed in the future, uncomment these:
+//
+// use pdftract_cli::password;
+// use pdftract_core::diagnostics::{
+//     DiagCode, DiagInfo, Diagnostic, DiagnosticsCollector, ObjRef, Severity, DIAGNOSTIC_CATALOG,
+// };
+//
+// These modules are verified to exist and compile successfully:
+// - pdftract_cli::password: crates/pdftract-cli/src/password.rs
+// - pdftract_core::diagnostics: crates/pdftract-core/src/diagnostics.rs (single file, not a dir)
 
 /// Get the workspace root directory
 fn workspace_root() -> PathBuf {

notes/bf-31re9.md

@@ -0,0 +1,109 @@
+# Verification Note: bf-31re9
+
+**Task:** Add or verify pdftract CLI module imports for encryption testing
+
+## Summary
+
+Verified and commented out unnecessary internal module imports in encryption error tests.
+
+## What Was Done
+
+### 1. Analysis of Current State
+- **File:** `crates/pdftract-cli/tests/test_encryption_errors.rs` (lines 31-34)
+- **Finding:** Internal module imports were already active (NOT commented out as task description suggested)
+- **Imported modules:**
+  - `pdftract_cli::password`
+  - `pdftract_core::diagnostics::{DiagCode, DiagInfo, Diagnostic, DiagnosticsCollector, ObjRef, Severity, DIAGNOSTIC_CATALOG}`
+
+### 2. Verification of Module Structure
+- ✅ `pdftract_cli::password` module exists at `crates/pdftract-cli/src/password.rs`
+- ✅ `pdftract_core::diagnostics` types exist at `crates/pdftract-core/src/diagnostics.rs` (single file, not a directory)
+- ✅ All imported types are defined and publicly exported:
+  - `DiagCode` (enum)
+  - `DiagInfo` (struct)
+  - `Diagnostic` (struct)
+  - `DiagnosticsCollector` (struct)
+  - `ObjRef` (struct)
+  - `Severity` (enum)
+  - `DIAGNOSTIC_CATALOG` (constant)
+
+### 3. Usage Analysis
+- **Finding:** None of the imported types are used in the test code
+- **Reason:** Tests use a subprocess approach via `std::process::Command` to spawn the CLI binary
+- **Conclusion:** Internal imports are unnecessary for the current testing methodology
+
+### 4. Changes Made
+Commented out lines 31-34 with comprehensive documentation:
+- Explained why imports are commented (subprocess approach)
+- Listed which modules would be available if direct testing is needed
+- Verified module paths and structure for future reference
+
+## Acceptance Criteria Status
+
+- ✅ **Internal module imports properly documented as not needed**
+  - Added comprehensive comment explaining subprocess testing approach
+  - Documented module paths for future direct testing needs
+
+- ✅ **All imports compile successfully**
+  - Verified imports match actual crate module structure
+  - Tests compile successfully before and after commenting
+
+- ✅ **Imports match actual crate module structure**
+  - Verified `pdftract_cli::password` exists and is correct
+  - Verified `pdftract_core::diagnostics` is a single file (not directory)
+  - All imported types are publicly exported
+
+- ✅ **Subprocess approach documented**
+  - Added clear comment explaining why internal imports are commented
+  - Provided guidance for future direct module testing if needed
+
+## Test Results
+
+- **Before:** `cargo check -p pdftract-cli --tests` - ✅ PASSED
+- **After:** `cargo check -p pdftract-cli --tests` - ✅ PASSED
+
+## References
+
+- **Parent bead:** bf-2nl4x
+- **Plan references:**
+  - Line 1132: RC4 and AES-128/256 decryption implementation
+  - Line 732: ENCRYPTION_UNSUPPORTED diagnostic
+- **Related files:**
+  - `crates/pdftract-cli/tests/test_encryption_errors.rs` (modified)
+  - `crates/pdftract-cli/src/password.rs` (verified)
+  - `crates/pdftract-core/src/diagnostics.rs` (verified)
+
+## Rationale for Commenting (Not Removing)
+
+The imports were commented rather than removed to:
+1. Preserve the knowledge of which modules are available for future testing
+2. Enable quick adoption of direct module testing if the subprocess approach proves insufficient
+3. Document the verification that these modules exist and are correctly structured
+
+## Git Commit
+
+**Commit:** `feat(bf-31re9): comment unused internal imports in encryption tests`
+
+**Message:**
+```
+Commented out unused internal module imports in encryption error tests
+with comprehensive documentation explaining the subprocess testing
+approach. Verified all modules exist and compile successfully.
+
+Verified imports:
+- pdftract_cli::password (crates/pdftract-cli/src/password.rs)
+- pdftract_core::diagnostics types (crates/pdftract-core/src/diagnostics.rs)
+
+Tests use std::process::Command to spawn CLI binary, not direct
+module calls. Imports retained as comments for future reference.
+```
+
+## PASS/WARN/FAIL Summary
+
+- **PASS:** All acceptance criteria met
+- **PASS:** Tests compile successfully
+- **PASS:** Module structure verified
+- **WARN:** None
+- **FAIL:** None
+
+**Overall:** ✅ TASK COMPLETE