Summing planned pixels before rendering tells on-call whether a PDF preview retry will help

The guide starts its trace when a job enters the queue, before any renderer process exists. One deadline travels through every stage, and each stage boundary emits a low-cardinality measurement ^[13]. Read at the render boundary, deadline_remaining_seconds separates a job the queue starved from one that spent its time rasterizing ^[6][13].

Pixels are the admission unit because file size misleads in both directions ^[9]. A small, highly compressed PDF can describe a large render surface. A large file may carry assets that are never painted on the requested pages ^[9]. Page dimensions and DPI are known before raster work begins, and an exact cost estimate would mean doing much of the work the check is meant to bound ^[10].

Per page, the formula is ceil(width x DPI / 72) by ceil(height x DPI / 72), with dimensions in PDF points, summed over the requested pages ^[8]. The worked example disagrees with it. The guide takes a 612 by 792 point US Letter page and says one page at 150 DPI plans roughly 1.3 million pixels, and a 40-page packet roughly 50 million ^[11]. The formula gives 1,275 by 1,650, or 2,103,750 pixels per page ^[1]. Forty pages come to 84,150,000 ^[2]. The stated figures are low by about 1.6x per page and 1.7x per packet ^[4]. The fourfold claim for 300 DPI holds: 2,550 by 3,300 is 8,415,000 pixels a page, and 336.6 million for the packet ^[3].

The author is candid about the budget's blind spots. It does not model drawing complexity, font substitution, decoder behavior or the cost of applying a redaction template, so a ceiling will reject some cheap documents and admit some expensive ones ^[10]. Fonts, transparency, clipping paths and embedded images all change real duration ^[18]. What pixels offer is a way to turn away obviously unbounded work, plus a stable denominator for observed render rates ^[18].

The telemetry rules are the most carefully engineered part of the guide. Document IDs belong in traces or in secured logs with an explicit retention policy. As metric labels they create unbounded cardinality ^[14]. The sample Go function plannedPixels refuses a DPI that is zero, negative, NaN or infinite before it sums pages into a uint64 ^[17]. Its Page values are hard-coded samples. The guide says production values must come from a real PDF parser that handles encrypted, malformed and truncated input as that parser documents ^[15].

Paging follows the same split. The guide alerts on exhaustion rate against the preview SLO, and separately when admitted pixel work nears the worker pool's capacity. It calls a warning on one slow request noisy, because a single page can be legitimately complex ^[12].