In a PDF extraction pipeline, what property makes a container field eligible to carry an unseen directive span?

## Why a rule beats a list here Asked *where can text hide in a document*, most people answer with an inventory: form fields, annotations, alternative text, off-canvas positioning, notice-sized type, metadata containers. The inventory is not wrong, and it is close to worthless. Every entry in it was derivable from a single property, and the property keeps producing new entries without anybody inventing a new trick. ## The property Two pipeline behaviours point in opposite directions, and both are correct: | Stage | Goal | Consequence | | --- | --- | --- | | Rendering | Selective — put the right things under an eye, legibly, in reading order | Content the layout does not place is simply not painted | | Extraction | Thorough — recover every machine-readable value so downstream stages miss nothing | Containers the page never shows are read and emitted anyway | **A field is eligible when extraction emits it and the reviewer's rendering does not display it.** That is the whole rule. It says nothing about the file format, so it transfers to office documents, spreadsheets, markup, archives and message formats without modification. ## Why the set is unstable, and moves in the attacker's favour Three independent variables move it: - **The extractor.** Every improvement in recovery — reading a container it previously skipped, reconstructing structure it previously flattened — adds carriers. Extraction improving is *good engineering* and *more surface*, at the same time. - **The viewer.** The same file renders differently in two applications: one collapses annotation bodies, another paints them in a margin. Visibility is a property of the rendering, not of the file, so the eligible set is defined relative to whichever viewer the person reviewing actually uses. - **The format.** New container kinds appear in specifications and in the wild, and the extractor eventually learns them. This is why a blocklist of known hiding places gives false confidence. It describes the state of three moving parts at one moment, and it is stale the next time any of them changes. ## What it costs the party authoring the document Less than it looks. In an accounts-payable flow the counterparty submitting an invoice is a legitimate sender with an ordinary reason to upload files, and the container they use is one that legitimately holds data in normal documents — which is exactly why the extractor reads it and why its presence is not itself anomalous. The costs that do exist are real but small: they must bet on how the recipient's viewer renders, they get no feedback about whether the span was emitted, and a pipeline change on the other side can silently make the span visible or drop it entirely. This is a *cheap, low-signal, low-feedback* construction, not a precise one. ## Where the rule stops producing carriers At the point the two behaviours converge. If the model consumes only a rasterised page image, nothing outside the painted canvas reaches it and the rule yields an empty set — a different family of construction applies to that pipeline. If the text an approver reads *is* the extracted text, every emitted field is displayed and there is no wrong side of the line to sit on. Both are pipeline-shape facts, and noticing which shape you are looking at is more useful than any enumeration. ## The interview signal A candidate who answers with an inventory has memorised. A candidate who states the asymmetry, then *derives* two or three examples from it and points out that the set grows as extraction improves, has understood the mechanism — and can reason about a file format nobody asked them about.