…resolved)

Real-world testing (Orimi test PDF, RFC 8259 PDF, "Attention Is All You
Need", calibre demo DOCX) plus an additional review pass surfaced five
follow-ups on top of the earlier singleton/semaphore/HTML fix:

1. Null-password PDFs were rejected as encrypted.
   The classic Orimi PDF, Acrobat distilled scans, and a long tail of
   PDFs in the wild carry a /Encrypt dict with an empty user password
   so the file opens without prompting. pypdf.PdfReader.is_encrypted
   and PyMuPDF's doc.is_encrypted both flag them, but the canonical
   "needs a password" signal is PyMuPDF's needs_pass. The preflight
   in routes.inference._preflight_pdf_page_count and the extractor in
   core.chat.document_extractor._extract_pdf now refuse only when
   needs_pass is True. pypdf's branch tries decrypt("") first and
   falls through to PyMuPDF on failure.

2. Worker put-result-then-die race.
   _run_extract_process_sync could observe proc.is_alive() == False
   after the worker had already queued a successful result, exit the
   loop with message=None, and surface a RuntimeError. Both the
   in-loop is_alive() branch and the post-join branch now perform a
   final result_queue.get_nowait() before declaring failure.

3. macOS multiprocessing start method.
   The ternary picked "fork" on macOS, which is unsafe with Quartz /
   PyObjC / PyMuPDF's CoreFoundation linkage. macOS now uses "spawn"
   like Windows; Linux keeps "fork" for the CoW pickling win.

4. NDJSON streaming InvalidStateError on shield-cancel race.
   The streaming NDJSON loop accepted extract_wait completion as a
   signal to call extraction_task.result(). When asyncio.shield's
   outer future was cancelled before the inner task finished, that
   raised InvalidStateError and surfaced as a generic HTTP 500.
   The branch now waits for extraction_task.done() and re-arms a
   fresh shielded future when only the outer wrapper completes.

5. PaddleOCR-VL nondeterministic inference defaults.
   Shipped temperature=1.5, min_p=0.1 -- causes hallucinated glyphs
   and reorderings on a closed-form transcription task. Aligned with
   the sibling OCR presets (DeepSeek-OCR, GLM-OCR) at temperature=0.0,
   top_p=1.0, top_k=-1, min_p=0.0.

Regression test additions:
- tests/studio/test_pseudo_encrypted_pdf.py mints a null-password PDF
  with PyMuPDF, asserts both the preflight and _extract_pdf accept it,
  and confirms a real password-required PDF still raises
  DocumentExtractionEncrypted.

Also drops importlib.reload from test_extractor_semaphore_leak.py: the
reload swapped _drain_future_exception out from under routes.inference,
breaking an existing identity assertion. The new fixture snapshots and
restores the semaphore counter instead.

Local: studio backend suite + 4 regression files: 91/91 PR-relevant
tests pass; the remaining 9 failures are the pre-existing
gpu_selection / kv_cache_estimation / help_output tests unchanged.

Mirrors the request-body hardening this PR already added to the
sibling JSON inference endpoints (/v1/chat/completions at :1674,
/v1/anthropic/messages at :2769, /v1/anthropic/messages_count at
:2850). /api/inference/cancel still used await request.json() with no
streaming cap, so an authenticated client could force the server to
buffer arbitrarily large bodies and slip past the exact overflow
hardening this PR added elsewhere.

Switched to _read_json_body_limited(request, max_bytes=64 KiB). The
real cancel payload is a small dict of identifiers (cancel_id,
completion_id, session_id, message_id); 64 KiB is generous and matches
the cap pattern used in the other authenticated route handlers.

Stream-cancel registration timing (test_stream_cancel_registration_timing
+ test_cancel_atomicity + test_cancel_id_wiring) is unchanged.

Reconcile 11 conflicted files spanning backend and frontend with 248
commits of main since the PR diverged:

backend
- studio.txt: keep PR additions (pypdf, python-multipart, onnxruntime)
  alongside main additions (cryptography, httpx)
- routes/inference.py: merge Pydantic model imports, keep cache_type_kv,
  combine trust_remote_code preflight with main's offline DNS guard,
  adopt main's _openai_messages_for_gguf_chat refactor, route through
  _normalize_openai_message_images, retain main's
  _drop_empty_assistant_sentinels and the is_vision kwarg
- tests/test_anthropic_messages.py: keep PR's test_image_count_limit
  alongside main's TestAnthropicRequestedStudioTools and
  TestAnthropicMessagesToolRouting suites

frontend
- types/api.ts: unify OpenAIMessageContentPart with reasoning,
  image_generation_call, and image_url.detail; retain OpenAIChatContentPart
  alias for prior callers
- types/runtime.ts: combine loadIn4Bit (PR) with fastMode (main)
- assistant-ui/attachment.tsx: combine PR's document chip and unique
  attachmentDomId with main's filename-in-aria-label
- assistant-ui/thread.tsx: keep PR's blocking-attachment send guard,
  thread the disabled state through main's ThreadComposerDock outside
  the viewport, drop the obsolete inline ComposerAnimated block,
  consolidate Composer to main's disabled/threadId API
- chat-settings-sheet.tsx: combine PR's DocumentExtractionSection and
  preset state-machine reset wiring with main's external connections
  flow, removing duplicated preset useState now sourced from the store
- chat/api/chat-adapter.ts: keep PR's appendContentParts/mergeAdjacentTextParts
  alongside main's reasoning normalizer, image-edit reference path,
  Anthropic refusal pruning, disabled-tool guard, and image gate
- chat/hooks/use-chat-model-runtime.ts: keep both cache_type_kv and
  storedReasoningEnabled hydration
- chat/runtime-provider.tsx: keep PR's document-extraction adapter,
  drop in-browser Text/Html/Docx adapters now handled by the backend,
  preserve main's listStoredChatMessages-based history and
  OpenDocumentAttachmentAdapter
- chat/shared-composer.tsx: combine PR's document upload + retry
  pipeline with main's image-availability gate and generalized-compare
  guard
- chat/stores/chat-runtime-store.ts: retain PR's DocExtractSettings,
  OcrPhase, and document support cache invalidation alongside main's
  preset-aware settings hydration, debounced saveSettingsPatch,
  beforeunload flush, scalar setting versions, last-external-checkpoint
  persistence, and maxTokens clamping

Adds a CPU end-to-end smoke that exercises:
  - the PR's `_extract_pdf` against an in-process synthetic PDF
  - llama-cpp-python (CPU build) loading Qwen2.5-0.5B-Instruct GGUF
  - inference on the extracted markdown with a ground-truth question

Runs on ubuntu-latest, macos-14, and windows-latest with no GPU.
Disables Metal on macOS and native autodetect on Windows/Linux so
the lanes stay strictly CPU.

Path-filtered to studio/backend/core/chat/, the test itself, and
each workflow file so unrelated commits don't re-trigger.

Two corrections after the first run:
  - Point at Qwen/Qwen2.5-0.5B-Instruct-GGUF (the canonical Qwen
    team's repo); the unsloth/* fork at that name does not exist
    and returned 401 on all three runners.
  - Pass the required `max_figures`, `use_vlm_ocr`, and
    `max_visual_payloads` kwargs to `_extract_pdf`.

Verified locally on the merge tip:
  PYTHONPATH=studio/backend python -c '...' -> extracted 97 chars
  including the expected 'RFC 8259' / 'JSON' tokens.