[Slavov88]

The compiler reported successful cache hits for corrupted or truncated PDF files, and publication failures left per-job temporary files in compile-cache. Validate both cached and generated artifacts with bounded header/terminal EOF reads, recompile invalid or vanished cached output from the frozen source snapshot, and drain cleanup of every owned temporary artifact before releasing admission.

The PDF check reads five header bytes plus at most 1 KiB from the tail. It detects incomplete envelopes; it is not semantic PDF parsing. Current I/O errors remain visible. Final artifacts and other jobs' temporary files are preserved. Source snapshots, admission limits, Docker isolation and TeX passes are unchanged.

Regressions reproduce corrupt cache hits, header-preserving truncation, stat/open deletion races, permission failures, short reads and file-handle closure, partial copy/write/rename failures, temp cleanup and queue recovery. Original failing cases were observed before their fixes.

Validation: 63 server tests, ESLint, TypeScript, production server build and whitespace checks passed locally. Both real Tectonic and fake fixture PDFs passed the envelope check. Real Docker compilation is covered by required CI; the local daemon is stopped. Production QA separately verified an intentional TeX failure, last-good PDF download/reload, recovery, cache reuse and exact restoration of all four test-project sources. Corrupt cache and filesystem faults were tested only in isolated local fixtures.

[DebelToni]

Reviewed the entire five-file diff and surrounding cache publication/admission flow. The envelope check uses bounded header/tail reads, handles short reads and closes the descriptor on all exits; it is correctly scoped as a completeness check, not semantic PDF parsing. Invalid/missing cache entries recompile the already-frozen snapshot, while current validation I/O errors other than ENOENT propagate. Per-job temporary artifact paths are registered before writes, and cleanup drains all owned operations without deleting shared final cache artifacts or other jobs’ temporaries. Snapshot/admission limits and Docker isolation are unchanged. Regression tests cover corrupt/header-preserving truncated caches, the stat/open deletion race, visible I/O failure and admission release, bounded reads/handle closure, partial publication failures, cleanup ownership and queue recovery. Required test/analyze checks and CodeQL passed for this exact head. No remaining blocking findings; no PR code/tests or production mutations were executed on DGX during review. Exact head/base/main and unchanged protections/merge settings verified.