fix: close independent verification findings on document parsing

Zip construction and member reads now share one narrow boundary so corrupt BZIP2, LZMA and version fields cannot leak native exceptions. Non-success statuses are read before classification, text-bearing blocks require lines, the size cap and reasoning contract are pinned by tests that fail under mutation, and the per-page timing claim is corrected to the observed range.
2026-10-22 01:12:27 -04:00
parent d80feafb93
commit bb621cad4d
9 changed files with 314 additions and 68 deletions
@@ -197,7 +197,7 @@ PGW_TELEMETRY_BACKEND=none               # sqlite | postgres | none(必填)
 # OCR_DOC__MONKEY__1__BASE_URL=http://10.77.0.20:7866
 # OCR_DOC__MONKEY__1__API_KEY=none
 # OCR_DOC__MONKEY__1__MODEL=monkey-ocr
-# OCR_DOC__MONKEY__1__TIMEOUT_S=600       # ≥ 最大页数 × 1.5s × 余量(共用 GPU 争用取 5 倍以上);不是总耗时上界
+# OCR_DOC__MONKEY__1__TIMEOUT_S=600       # ≥ 最大页数 × 4s × 余量(实测 1.5–4 s/页,共用 GPU 争用再乘 3–5 倍);不是总耗时上界
 # OCR_DOC__MONKEY__1__MAX_CONCURRENCY=2   # 服务为 sync-only 后端时取 1(每实例 /parse 全局串行)
 # OCR_DOC__MONKEY__1__TRUST_ENV=false
 # OCR_DOC__RETRY__MAX_ATTEMPTS=2          # 超时/GET 失败的重试会重新 POST 整份文档重算,压低