oficina / slides Public

Slice 3 of Slides, export, is built and reviewed task by task, with an independent Codex review of the whole design on top of it. Branch slice-3-export contains slices 1 and 2, so merging it merges everything.

What is live

• PDF export. POST /d/{sqid}/export starts a rastrillo job; the status page polls itself and works with scripts off; the file comes back from GET /d/{sqid}/export/{job}.pdf. One page per slide, optionally the speaker notes as pages of their own. Text is embedded subset glyphs, so it is selectable and searchable, not a picture of words. API twins exist for an agent.
• The layout engine. Every slide is measured into a paint list with the twelve embedded Liberation faces the browser now sets it in, so the screen and the PDF agree on everything but where a line breaks. That paint list is the only input to both the pictures and the PDF; nothing downstream reads a deck.
• SVG thumbnails at {surface}/slides/{id}.svg on all four capabilities. The editor strip, the presenter's next slide and the remote are that picture.
• core/pdf, a second Rust crate beside the CRDT core: svg2pdf under wazero, 3.5 MiB, zero host imports, reproducible, 200 pages in 140 ms.

The Codex review, and why it matters more than the feature

GPT-6 via Codex read the design cold at 6c757a4 — the review §12 deferred until a reviewer could have a running instance rather than a document. It returned six P1 and nine P2 findings (CODEX-FINDINGS-SPEC.md, committed unedited beside the brief). Four were reproduced with real experiments before they were reported. Three slices of my own reviews had passed all of it.

Ten are fixed on this branch, each citation verified before the fix:

1. A presigned PUT could overwrite an already-verified asset, silently changing pictures in other decks. Uploads now go to an app-minted staging key, are re-hashed at registration and promoted to an immutable object; no PUT is ever signed for a verified address.
2. Registering a known ref granted cross-deck read. Registration now requires an unspent receipt matching this deck and this actor.
3. An unknown text mark passed the write gate and then made the editor delete the text. The gate now validates the document itself, not the JSON projection of it (slides_core_check, ABI 2), and the browser sanitises rather than deletes.
4. Layout conversion cloned blocks, so a conversion concurrent with somebody's typing destroyed their words. Order is data now, at block and slide level, and nothing rebuilds the array.
5. Following a presentation outlived share-link revocation. Followers stay behind the capability they arrived with.
6. Removing an address left its sessions and agent tokens working. Admission is rechecked where a session and an agent operator resolve, and offboarding is written into the spec.
7. Cycles in columns.children made content vanish silently. Refused in both implementations; anything unreached is appended rather than dropped.
8. Phone reading order was CSS only, so assistive technology got the desktop order. The document now carries the effective order.
9. Out-of-order slide fetches could leave a projector permanently behind. Requested and displayed state are tracked apart.
10. Remote commands were logged as the session creator. They now name remote:<session> with the issuer beside it.

Five P2s are deferred with spec amendments and are the honest first candidates for slice 4: conversion geometry (8), one viewport policy shared by HTML and CSS (9), the cross-renderer vocabulary — a WebP that uploads but cannot be inlined, font stacks that reach HTML while the exporter substitutes (11), export working memory beyond the guest caps (12), and what editing a deck during a presentation means (14).

A bug another session found, ported here

fix/bounded-log-replay (discussion 5) found that a deck whose snapshot is missing or unreadable and whose log has passed 4096 updates cannot be opened at all — not by the viewer, editor, API, a thumbnail or an export, because every one goes through openDeck. I verified it in my own tree, ported both commits and their tests, and then proved the fix load-bearing: reverting the two source files reproduces replay deck update 4097: update log exceeds the retained limit. Replay is now 256-row batches with a transient checkpoint every 2048 updates. Credit is theirs.

What you owe

Unchanged from slice 1, plus one: the CNAME for slides.oficina.works and then the origin flip; carlos store grant once the platform has a store backend, so uploads stop answering 503; a copy pass over 340 catalog keys and docs/api.md, none of it through copy-review; and the merges.

Known, recorded, not fixed

svg2pdf was archived upstream on 2026-07-10 and points at krilla as its successor (verified today; krilla is at 0.8.2). What ships is pinned with a committed lockfile, so it is reproducible and works, but it is unmaintained. Swapping it is one module behind the same ABI because nothing above internal/slides/pdfcore knows what renders the SVG. That is a slice 4 item, and discussion 6 is where it was first raised.