[tannevaled]

/E was the one Table F.1 parameter the checker did not gate, and it is the one a writer is most likely to get wrong — so leaving it was precisely the "writer is its own judge" hole this work exists to close.

The partition was never the hint tables' to own

The checker bounded /E between 1 and the file's length, and said computing it properly "needs the first-page object set, which is the same partition the hint tables describe".

That is true of the hint tables and false of the first-page cross-reference section. Annex F puts that section at the front, and the file's own startxref points at it — which is the whole trick of the format: a reader fetches the front of the file and has page one. Its entries are the first page's objects. Nothing had to be decoded; the answer was one section away.

linearized.pdf front section @216:  xref / 4 6
  obj 4 @15    the linearization dictionary
  obj 5 @501   the catalog
  obj 6 @550   the hint stream          <- /H = [550 127]
  obj 7 @677 \
  obj 8 @773  } the first page
  obj 9 @871 /  len 30, + line ending => 902 == /E

So /E must equal the end of the last object that section lists.

⛔ The hint stream is excluded, and a second producer is why that is not a guess

F.3.1 permits the primary hint stream on either side of the first page:

producer	/H offset	/E	hint stream sits
qpdf	550	902	before the first page
Ghostscript -dFastWebView	829	829	after it, at /E exactly

On Ghostscript's file the naive maximum is the hint stream, ending at 967 against an /E of 829. A rule that took it would refuse every file that tool writes.

⛔⛔ And both committed qpdf fixtures place it before, so neither can tell the two rules apart. The exclusion would have been a branch no test could distinguish — the exact vacuity rounds 2 and 3 of the previous change spent eight tests removing. testdata/linearized-gs.pdf is committed for that reason and no other, and the gate is that removing the exclusion turns TestTheHintStreamIsNotTheEndOfTheFirstPage red while the qpdf tests stay green.

mutool was the obvious third producer; it answers Linearisation is no longer supported, so the reference set is qpdf and Ghostscript.

⚠ The overflow hint stream is excluded by the same reasoning and no file can reach it — it needs a four-entry /H whose second pair is both a real stream and the highest-offset object, and neither producer writes one. Inline it would be uncoverable and unkillable, so it is asked of isHintObject(), where four plain cases put it and a mutation kills it.

Two findings from the last review, applied rather than re-learned

• The old length bound is removed, not kept in front of the new one. The equality subsumes it, and a bound a later check subsumes is a bound no test is holding. Two existing cases now assert the new sentence, which names what contradicts the claim rather than only that something was wrong.
• Offsets stay int64 until known to fit. int(e.offset) is the same silent truncation addressable exists to refuse, and these come from the file.

Mutations, judged by cmd/failset on the failing test NAMES

isHintObject -> false       -> TestTheHintStreamIsNotTheEndOfTheFirstPage
                               + 2 isHintObject cases
drop HasOverflowHint guard  -> …/an_overflow_offset_that_is_not_declared, and no other
drop eolAfter in the end    -> 24 tests, including all 12 of the generated qpdf corpus

That last one is the reassuring one: the rule holds across the existing generated corpus — 1, 2, 5 and 25 pages in three shapes — not only the two committed files.

gofmt clean, go vet clean, GOARCH=386 go vet clean, 0 uncovered blocks of 1804.

Refs #40.

🤖 Generated with Claude Code