The indent trigger was using .abs() which fired on both increased indent
(non-indented → indented) AND decreased indent (indented → non-indented).
This caused drop-cap style paragraphs (indented first line, flush-left
continuation) to incorrectly split into two blocks.
Per plan Phase 4.4 heuristic #2, indent change should only trigger when the
current line is MORE indented (to the right, larger x0) than the block
average - i.e., a new paragraph starting after non-indented text. It should
NOT trigger for decreased indent (first line indented, rest flush-left).
Fix: Remove .abs() and only check if line_x0 - block_avg_x0 > threshold.
Tests:
- test_indented_first_line_new_block: PASS (non-indented → indented splits)
- test_indented_first_line_of_paragraph_not_split: PASS (drop cap stays together)
- All 179 line module tests: PASS
Implements tests/security/TH-01-stream-bomb.rs with 5 test cases verifying
decompression bomb protection via max_decompress_bytes cap enforcement.
Acceptance criteria PASS:
- tests/security/TH-01-stream-bomb.rs exists and passes (5/5 tests)
- Fixture tests/fixtures/malformed/bomb-10k-2g.pdf committed (10KB -> 10MB)
- Test cases cover: default cap (512MB), lowered cap (1MB), compression ratio verification
- STREAM_BOMB protection verified via truncation assertions
- Process memory bounded; no OOM-kill
- PROVENANCE.md entry added for bomb fixture
Test cases:
1. test_bomb_default_cap_allows_reasonable_decompression - verifies 10MB decompression succeeds with 512MB cap
2. test_bomb_lowered_cap_triggers_stream_bomb - verifies truncation at 1MB cap
3. test_bomb_fixture_has_high_compression_ratio - verifies 1000:1 compression ratio
4. test_bomb_limit_checked_incrementally - verifies incremental limit checking
5. test_bomb_limit_truncation_behavior - verifies decoder returns partial data on limit hit
Fixture generation:
- gen_bomb.py creates 10KB compressed -> 10MB decompressed stream
- Achieves ~1000:1 compression ratio using zlib on repeated pattern
- Safe for CI (10MB decompressed, not 2GB as originally specified)
Refs: TH-01 (line 890), Phase 1.5 (stream decoders), Diagnostic Code Catalog STREAM_BOMB
Closes: pdftract-17cnu
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The 12 synthetic malformed fixtures (generate_test_corpus.py output, tracked in
PROVENANCE.md) existed only as untracked files and were swept by a cleanup stash,
breaking the provenance pre-commit hook for all commits. Restore from stash and
commit them as tracked files so they cannot be lost again.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
