fix(labs): read a lab report page by page and keep a cut-off read's rows

A scan sent the whole report to one call under an 8000-token ceiling and
validated the reply against a 100-row envelope. A long multi-panel report
lost everything either way: the reply stopped mid-row and failed to parse,
which the person saw as "try a clearer photo", or it held more than 100
rows and the schema refused all of them. One malformed row refused the lot
as well. Reasoning models made it worse, because the call sent no
reasoning setting and OpenAI, Codex and Claude's 5 generation reason by
default against the same output allowance.

A PDF of more than one page is now rendered and read a page per call on
every provider (up to 20 pages), as many reads as the run's deadline
allows, and the pages are merged in order with a reading printed twice
listed once. A photo, a one-page PDF on a provider that reads PDFs, and
OCR'd text up to 4000 characters stay one read; longer text is split at
line boundaries. Each read carries an explicit reasoning off, so a model
that can stop reasoning does and one that cannot gets its minimum budget
on top of the answer's. A reply cut at the output limit is detected from
the finish reason (Codex's incomplete stream included), keeps the rows
that closed before the cut and is named in the result instead of retried;
when no read produced a row the run fails as labs.ocr.outputLimit. A
provider failure after the first page keeps the pages already read.
Rows are validated one by one, the row cap is 400 for the scan and the
commit, and a report past it keeps its first 400 and says how many it
had. The run settles what the provider reported it spent rather than the
fixed reservation, so a page-by-page read still counts against the day's
budget in full.

docs/api/openapi.yaml

@@ -31776,7 +31776,7 @@ components:
       properties:
         rows:
           minItems: 1
-          maxItems: 100
+          maxItems: 400
           type: array
           items:
             type: object
@@ -31838,10 +31838,10 @@ components:
       description: The rows a human confirmed on the Lab-OCR review screen. Each row is EITHER numeric (`value` + `unit`,
         optional reference bounds) OR qualitative (`valueText`) — exactly one. `analyte` drives a resolve-or-mint of the
         user-scoped biomarker; `takenAt` is a backdatable ISO instant. No `userId` field — it is narrowed from the
-        session. 1..100 rows. The route skips a row that duplicates a live reading (same analyte + day + value). The
-        optional `encounterId` files the panel against a visit the caller owns — ONE link per written result row, so a
-        marker re-run on a different day belongs to its own visit; always optional, and a link that could not be made
-        never fails the commit.
+        session. 1..400 rows (`analyte` and `valueText` up to 120 characters, `unit` up to 40). The route skips a row
+        that duplicates a live reading (same analyte + day + value). The optional `encounterId` files the panel against
+        a visit the caller owns — ONE link per written result row, so a marker re-run on a different day belongs to its
+        own visit; always optional, and a link that could not be made never fails the commit.
     CreateBiomarkerRequest:
       type: object
       properties:
@@ -36231,9 +36231,9 @@ components:
                 labs.biomarker.merge.invalid, labs.biomarker.merge.unitMismatch, labs.biomarker.notFound,
                 labs.biomarker.update.invalid, labs.biomarker.update.referenceRangeInvalid, labs.create.invalid,
                 labs.link.invalid, labs.ocr.budgetExceeded, labs.ocr.extractFailed, labs.ocr.fileTooLarge,
-                labs.ocr.fileType, labs.ocr.localOcrDisabled, labs.ocr.pdfNeedsAnthropic, labs.ocr.providerUnsupported,
-                labs.ocr.rateLimited, labs.restore.invalid, labs.result.notFound, labs.unit.mismatch,
-                labs.update.invalid, labs.update.linkedFieldsImmutable, labs.update.numericExpected,
+                labs.ocr.fileType, labs.ocr.localOcrDisabled, labs.ocr.outputLimit, labs.ocr.pdfNeedsAnthropic,
+                labs.ocr.providerUnsupported, labs.ocr.rateLimited, labs.restore.invalid, labs.result.notFound,
+                labs.unit.mismatch, labs.update.invalid, labs.update.linkedFieldsImmutable, labs.update.numericExpected,
                 labs.update.qualitativeExpected, labs.update.referenceRangeInvalid,
                 labs.update.sourceReferenceRangeInvalid; life_event — life_event.invalid, life_event.not_found;
                 managed_profile — managed_profile.guardian.duplicate, managed_profile.guardian.managed_invitee,
@@ -71279,8 +71279,8 @@ components:
           items:
             $ref: "#/components/schemas/OcrExtractedRow"
         pageCoverage:
-          description: "Present only when a PDF ran past the pages a scan reads: the rows come from the first `read` of `total`
-            pages. Absent when the whole document was read."
+          description: "Present only when a PDF ran past the pages a scan reads (20): the rows come from the first `read` of
+            `total` pages. Absent when the whole document was read."
           type: object
           properties:
             read:
@@ -71295,13 +71295,57 @@ components:
             - read
             - total
           additionalProperties: false
+        truncated:
+          description: Present only when a read stopped at the provider's output limit. The rows that read produced before the cut
+            are kept; readings after the cut may be missing. `pages` names the pages whose read was cut, or is empty
+            when the report went to the provider as one read (a photo, a one-page PDF, OCR'd text).
+          type: object
+          properties:
+            pages:
+              type: array
+              items:
+                type: integer
+                exclusiveMinimum: 0
+                maximum: 9007199254740991
+          required:
+            - pages
+          additionalProperties: false
+        unreadPages:
+          description: "Present only when part of a multi-part read produced nothing: the provider failed partway through, or a
+            part's reply could not be read. The rows of the other parts are kept; these pages are not in `rows`. Empty
+            when the parts were not pages (OCR'd text)."
+          type: array
+          items:
+            type: integer
+            exclusiveMinimum: 0
+            maximum: 9007199254740991
+        rowsCapped:
+          description: "Present only when the report held more readings than one scan carries (400): `rows` holds the first `kept`
+            of the `found` readings."
+          type: object
+          properties:
+            kept:
+              type: integer
+              exclusiveMinimum: 0
+              maximum: 9007199254740991
+            found:
+              type: integer
+              exclusiveMinimum: 0
+              maximum: 9007199254740991
+          required:
+            - kept
+            - found
+          additionalProperties: false
       required:
         - reportDate
         - providerType
         - rows
       additionalProperties: false
       description: The proposed rows for the human review screen, served by `GET /api/ai-runs/{id}` for a `LABS_OCR_EXTRACT`
-        run. Never written to the person's record; the commit route is the only write.
+        run. A PDF of more than one page is read a page at a time and the pages merged in order, a reading printed on
+        two pages listed once. Never written to the person's record; the commit route is the only write. A run in which
+        no read produced a single complete row fails with 422 `labs.ocr.outputLimit` when the reads stopped at the
+        provider's output limit, else `labs.ocr.extractFailed`.
     OcrExtractedRow:
       type: object
       properties: