fix: whole-codebase correctness and conciseness review

[andiwand]

🤖 Generated with Claude Code

A whole-codebase review for correctness and conciseness, run as twelve parallel
per-area reviews (public API, common/util/detection, odf, ooxml, oldms, pdf,
html renderer, font/zip/cfb/crypto, python+cli, jni+android, apple, tests) with
every finding verified against a build and the full suite.

172 files, +2651 / −3442. Net −799 comment lines.

Verification

Baseline at main	759 tests, 750 passed, 0 failed
Build (lib + tests + CLI + JNI)	clean, 0 warnings
Full suite	767 tests, 758 passed, 9 skipped, 0 failed
JNI JUnit (ctest)	passed
Python bindings	build clean, 49/49 pytest
Apple bindings (ODR_APPLE=ON)	build clean, 0 compiler warnings
clang-format	clean

The bugs that matter most

CID-keyed CFF fonts had wrong glyph metrics in every PDF. The parser never
read /FDArray or /FDSelect, so nominalWidthX stayed 0 and every
charstring width resolved against it. Real subset fonts came out with negative
advances that wrapped into an advanceWidthMax of 65431 — 65 em. All 152
glyphs of two corpus PDFs now agree with fontTools' own CFF interpreter, with
zero mismatches.

TablePosition::to_column_string produced wrong column names. The borrow
was column /= 27 where bijective base 26 needs column / 26 - 1; they agree
only while the quotient is ≤ 27. 792 of the first 20 000 columns were wrong,
the first at 727 (ZZ instead of AAZ). Reaches spreadsheet headers and the
Python and JNI bindings.

Document content was written into HTML attributes unescaped — link href,
bookmark id, image src, font name, font shadow, the four cell border
strings, archive entry paths. A quote in document content broke out of the
attribute.

Two unbounded recursions and an iterator invalidation in ODF and OOXML
style resolution: a cyclic w:basedOn / style:parent-style-name recursed
until the stack ran out, and resolving an unknown parent id through
operator[] rehashed the map that generate_styles_ was iterating.

JNI wrappers could be collected mid-call. Html.translate and
HtmlService.bringOffline passed a bare handle into a static native, so
nothing in the Java frame referred to the wrapper. Plus local-reference leaks
that overflow ART's table on a chatty translate.

Python reported failed typed casts as valid. Only Element::operator bool
was bound, so bool(paragraph.as_slide()) was True for a cast that failed
and callers silently read defaults. Iterator-yielded elements also did not keep
their document alive.

Beyond those: bounds and overflow hardening across the hand-rolled binary
parsers (PDF, CFB, ZIP, fonts, oldms) — unchecked substr, wrapping lengths,
allocation bombs from file-supplied counts, empty-stack pops, unbounded
nesting — and Path::descendant_of was simply backwards, with its only caller
written against the inverted answer so the two bugs cancelled.

⚠️ Reference output changes — 72 of 1141 files

Every diff is traced and each is a correction. The output repos need
regenerating before this merges.

• 65 files — repeated ODS cells lose contenteditable.
  element_is_editable recursed to the parent before testing sheet_cell, and
  a sheet cell always has a sheet parent, so the branch was dead and everything
  reported editable. Confirmed against the source XML that these are
  table:number-columns-repeated cells sharing one node, where editing one
  would silently rewrite all of them.
• 2 files — & now escaped in href. The current reference output is
  invalid HTML.
• 5 files — the PDF font-metrics fix above.

Conciseness

Comments were cut to the AGENTS.md bar — a couple of terse lines stating the
key point, citing the spec rather than paraphrasing it. Worst offenders:
html/pdf_file.cpp 534 → 344 comment lines, pdf_page_element.hpp 125 → 51,
pdf_document_element.hpp 197 → 111. Several were also factually wrong
(sfnt_transform.hpp still documented a BMP-only limitation the code had
outgrown). Structural dedup where it was clearly safe: three near-identical
HTML fragment classes behind one template, 23 pybind11 class bindings behind a
helper, the override_if_set collapse in style.cpp, link_child in the ODF
registry.

A stacked follow-up carries the findings this PR deliberately left alone.