pdfcraft/ROADMAP.md

PdfCraft roadmap

Stage: alpha · next: beta, ~26% (ready for real work 49% → 75%) and ~400–700 h away

Last reviewed: 2026-10-10 · Last updated: 2026-10-11 · Change: minor (closed issues synced: #774, #756 and the #799–#821 batch; earlier: localized shortcut labels, #496; readiness table with hours per audience; full number as weighted sum 49%; earlier: second look: ready 40% → 47%, mainstream 55% added; core-workflow gate applied → alpha) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)

PdfCraft's one-page summary: how close it is to Adobe Acrobat Pro's offline feature set, and what comes next. Adobe's cloud services (Document Cloud, Acrobat Sign requests, shared review, the AI Assistant) are out of scope; PdfCraft's alternatives are local-first plus opt-in providers.

Document	Holds
docs/target-app-parity.md	The authoritative assessment: method, weights, every dimension and area, stage, calibration
docs/gaps.md	Every known shortfall, ranked: the work list
docs/roadmap.md	Milestones M0–M14, current focus, upcoming milestones, risks
docs/pdf-spec-parity.md	ISO 32000-2 coverage, annotations, actions, signatures, PDF/A/X/UA
docs/file-format-parity.md	Every format Acrobat reads or writes, create/export conversions, OCR
docs/ui-parity.md	Tools, handles, shortcuts, panels, preferences
docs/hardware-parity.md	GPU, printers, scanners, smart cards, pen, platforms
docs/localization-parity.md	Per-language status
docs/architecture.md	How PdfCraft is built
parity/acrobat-features.toml	The machine-checked checklist (cargo xtask parity)

Keep it current: every session, update the milestone row in docs/roadmap.md and add a line to the progress log; when a gap closes, remove it from docs/gaps.md; re-measure fully when a major arc lands, at least monthly.

Headline numbers

	Value	Kind
Feature breadth	≈ 67% tier-weighted (56.9% unweighted: 423 shipped + 74 partial of 808; P0 94.2%)	measured, parity/acrobat-features.toml
Feature breadth, mainstream practitioner	≈ 70% tier-weighted (63.2% unweighted; P0 95.3%)	measured (split)
Ready for real work, full Acrobat Pro	≈ 49% (45–53%)	estimated, weighted sum over dimensions
Ready for real work, mainstream practitioner	≈ 55% (50–60%)	estimated (split)
Ready for real work, essentials user	≈ 66% (60–70%)	estimated (method)
Remaining to beta	≈ 400–700 Opus 5.5 agent-hours	estimated
Remaining to full parity	≈ 780–1,400 Opus 5.5 agent-hours (≈ 300–550 h wall clock with 3–5 agents)	estimated, calibrated on this repo's history

Why alpha: all six of Acrobat Pro's everyday workflows can be completed end to end on macOS (the alpha gate), and users praise them (7.6k stars, ≈ 217k downloads of 0.4–0.5, switching reports such as #179). Two are only partial: editing (no CJK/RTL) and convert and share (no in-app Office→PDF; Word export loses layout, #773; password-protected files open in Acrobat since #836, #774). Those, unmeasured quality against Acrobat, the borrowed hayro renderer, no printing on the web and 245 open issues keep it far from beta.

Readiness by audience

Audience	Ready	Opus 5.5 agent-hours to ≈ 95%	Work that dominates
Full Acrobat Pro (ready for real work)	≈ 49%	≈ 780–1,400 h (≈ 300–550 h wall clock with 3–5 agents; 60–70% parallelizes)	Own renderer and fidelity harness, editing existing content, OCR and Office conversion, Preflight and PDF/A/X/UA, accessibility tagging, signatures for institutions
Mainstream practitioner	≈ 55%	≈ 500–900 h (≈ 200–400 h wall clock; ≈ 60% parallelizes)	Rendering fidelity, editing existing text (CJK, RTL, subsets), conversion (Word layout, Excel, PowerPoint, Office→PDF), OCR languages, the bug backlog
Essentials user	≈ 66%	≈ 180–330 h (≈ 90–180 h wall clock; ≈ 50% parallelizes)	Rendering fidelity on everyday files, launch and GPU stability, simple text fixes, Word export layout, Chinese UI glyphs

Hours are calibrated as in Effort and calibration (≈ 1k kept lines per agent-hour for new features, 3–10× slower for hardening and fidelity). The audiences are nested subsets, so essentials ≤ mainstream ≤ full.

By dimension

Dimension	Ready	Weight	Remaining (h)	Doc
Features (14 areas)	≈ 49% depth · 67% breadth	40%	610–1,100	target-app-parity.md
UI/UX fidelity	≈ 55%	10%	30–60	ui-parity.md
File formats and conversion	≈ 40%	12%	120–220 (within features)	file-format-parity.md
PDF specification and standards	≈ 60%	8%	150–260 (within features)	pdf-spec-parity.md
Hardware	≈ 35%	4%	25–50	hardware-parity.md
Localization	≈ 59%	5%	35–60	localization-parity.md
Performance	≈ 40%	6%	25–45	gaps.md gap 13
Stability	≈ 50%	8%	45–80	gaps.md gap 6
Platforms	≈ 70%	5%	15–30	hardware-parity.md
Ecosystem and plug-ins	≈ 30%	1%	10–20 (within features)	gaps.md
AI features	≈ 0% (in scope: local providers)	1%	20–40 (within features)	gaps.md gap 23
Total (weighted sum)	≈ 49%	100%	≈ 780–1,400

Features

Area	Breadth (measured)	Ready (estimated)	Remaining (h)
A Core model and fidelity	76.8%	70%	25–45
B View and navigation	62.5%	55%	110–190
C Content editing	53.3%	30%	100–180
D Organize pages	61.2%	70%	12–25
E Comments and review	77.7%	70%	12–25
F Forms and JavaScript	78.5%	65%	40–75
G Protect, redact, sanitize	58.5%	55%	15–30
H Digital signatures	62.2%	45%	40–70
I Scan and OCR	23.1%	15%	40–75
J Create and export	39.7%	25%	55–100
K Optimize and standards	34.5%	20%	65–115
L Print	39.7%	35%	30–55
M Accessibility	63.1%	30%	40–70
N Automation, preferences, misc	30.0%	35%	25–45

What's strong and missing in each: target-app-parity.md.

Languages

Measured from crates/ui-egui/src/i18n/*.tsv (2,143 keys). Detail and script notes: localization-parity.md.

Language	Code	Strings	Status
English	en	100%	full
Simplified Chinese	zh-hans	97.4%	partial (no Hans UI face in releases, #826)
Spanish	es	95.5%	partial
Hindi	hi	0%	none
Arabic	ar	100%	partial (layout not mirrored)
French	fr	99.3%	partial
Portuguese (Brazil)	pt-br	99.4%	partial
Indonesian	id	0%	none
Japanese	ja	99.1%	partial
German	de	99.3%	partial
Korean	ko	0%	none
Vietnamese	vi	0%	none

Also shipped: Traditional Chinese, Russian, Bulgarian, Telugu, Hungarian, Ukrainian, Italian (94–100%) and Czech (menus only): 8 more languages.

Upcoming

Ranked; detail and the full milestone table in docs/roadmap.md.

Rank	Milestone	Estimate (h)
0	Convert and share: Create PDF from Office, Word export that keeps layout (#773)	32–55
1	Backlog and platform: crash and wrong-result reports, web printing, Chinese UI face (#826)	65–120
2	Fidelity harness against Acrobat and the renderer decision (M2; owner decision on #841)	110–190
3	Editing existing content (M7)	100–180
4	OCR languages and Office export/import (M10)	95–175
5	Preflight and PDF/A/X/UA (M11)	65–115
6	Signatures for institutions: PKCS #11, timestamp servers, online LTV (M9)	40–70
7	Accessibility tagging (M12)	40–70
8	1.0 polish: performance, right-to-left, missing languages, keyboard-only (M14)	55–95

Progress log

Newest first: the date, what moved, and the new overall estimate.

• 2026-10-11 (M4, Organize overview): Opening Organize pages from All tools, Home, the tool palette or ui.set tool=organize opens the thumbnail grid directly. Checkboxes toggle individual pages without modifier keys; page controls rotate either way or delete one page, while the toolbar acts on the selection. Portrait and landscape previews retain their aspect ratio. UI and control regressions cover entry, selection, single-page versus batch actions, undo, permissions and retaining the last page. Milestone and effort estimates unchanged.

• 2026-10-10 (M9, signature graphics): A visible digital signature can show a graphic where the signer's name is large, as Acrobat's Configure Signature Appearance does: the saved Fill & Sign signature (drawn strokes smoothed as ink, typed outlines in the script font, or an image) or an imported PNG/JPEG. Sign as previews it and remembers the choice for the next signing; sign_document takes graphic (image, text or strokes). Graphics are checked and capped before drawing (non-finite or unbounded points, mismatched pixel buffers, oversized images are refused with an error the caller can act on); images keep their alpha as a soft mask. sign.signature-appearance stays partial (no named saved appearances or PDF-page graphics). Overall estimates unchanged.

• 2026-10-11 (M14, absolute interface sizes): A chosen Interface size is now absolute, as PhotoCraft's UI Scale is: "100%" is one screen pixel per point whatever scale the display reports, so on a 1080p screen whose system reports 200 % it draws at a true 100 % (#456, reported after the first change). Auto still keeps the display's scale and adds GNOME's text scaling, and its menu entry shows the size it draws at. The menu offers PhotoCraft's sizes (75–300 %).

• 2026-10-11 (automation, #971): text_find reads pages in growing batches (8, doubling to 128) and stops once limit is reached, so a bounded search on a long document no longer extracts and caches every page first. Results say complete, and a capped one gives next (start_page, skip) to continue. Still open from #971: a byte budget for the automation text cache and per-page warnings for pages whose text can't be extracted.

• 2026-10-11 (docs, closed issues): The progress docs caught up with issues closed on 2026-10-10: encrypted output opens in Acrobat (#774, #836; gap 1 closed, rank 0 is 32–55 h), Windows prints (#756, #847), column select (#740), 1:1 touchpad scrolling (#759), same-page multi-object move (#844), and the #799–#821 batch of wrong-result fixes including the #816 panic. Scores and readiness not re-judged; overall estimate unchanged.

• 2026-10-11 (M7, watermark placement): A watermark can be moved from the page centre by a horizontal and a vertical offset in points: Add/Update Watermark has an "Offset from centre" row (the preview follows it, for text and for pictures) and doc_watermark takes offset_x and offset_y. A non-finite offset is refused instead of written into the page. edit.watermark-appearance stays partial: no offset from the page edge or in page units, no print/screen-only variants, no repeat. Image and PDF watermarks, already shipped, no longer appear as missing. The overall estimate is unchanged.

• 2026-10-11 (M12, XFA script time limits): An XFA script's time limit (1 s for scripts that run unasked, on open and on every change) counted the engine's start-up too: the script's thread, a new context and, for the first script in a process, the engine's own set-up (≈ 60–170 ms when idle). On a busy machine a trivial initialize script could pass the limit, be abandoned and turn the form's scripts off; that made xfa_buttons_run_their_scripts_in_the_app and messages_from_scripts_run_on_open_show_right_away flaky (under full CPU load 25 of 40 runs of the test binary failed, with "ran longer than 1.0 s and was abandoned" in the console). The limit now runs from when the engine is ready; start-up has its own 10 s cap, so nothing waits forever, and a trivial warm-up script takes the first-in-process set-up. Under the same load none of 40 runs fails, and runaway scripts are abandoned as before. The two UI tests print the script console when they fail. Overall unchanged.

• 2026-10-11 (M4, #569): Combine files takes images and text files as well as PDFs. PNG, JPEG, TIFF, GIF, BMP, JPEG 2000 and .txt files become PDFs as they are added (Add files…, drops, folder scans), so each is an ordinary row with its pages, thumbnails and page range; a file that can't be read (a damaged image or PDF, a type that can't be converted) stays in the list with why in its Warnings, and Combine asks before leaving such files out (Cancel changes nothing); password-protected files still have to be unlocked first. doc_combine accepts the same types, and a converted file's bookmark drops its extension. A PNG whose header claims more than 2 GiB of pixels is now refused before its buffer is allocated (the png crate's limits don't cover it), as TIFF already was. Office documents and HTML are still not converted. Overall estimate unchanged.

• 2026-10-11 (M3, Windows renderer startup): Renderer-creation GPU errors return through the existing scoped handler so Auto startup can use the existing OpenGL fallback. A real-device invalid/valid pipeline regression covers error propagation and device reuse; the independent Windows hostile-argument fixture reports unavailable symbolic-link privileges. The underlying x86 DX12 compiler error remains unresolved; see docs/windows-renderer-startup.md. Milestone and effort estimates unchanged.

• 2026-10-11 (M6): Existing simple field-font encodings and Differences are respected when generating appearances; an unencodable value uses a separate Helvetica appearance font without changing the source font. Synthetic reopen regressions cover punctuation, subset fallback and multiline text. Exact font metrics/layout and broader Unicode fallback remain incomplete. Estimates unchanged.

• 2026-10-11 (M6): Tab and Shift-Tab wrapping to the same field or another widget of that field refresh the newly opened editor from the accepted value before Save. Synthetic UI regressions cover both directions, same-frame Save, validation refusal and undo/redo. Estimates unchanged.

• 2026-10-11 (M13): CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. Estimates unchanged.

• 2026-10-11 (M14, #307, Plan 2): Forms now return terminal fields and the page-widget adoption count from one enumeration, and engine open reuses that result while retaining XFA script-button marking. The 12,000-page/no-form PDF (1,442,052 bytes) and 2,500-orphan-widget PDF (673,432 bytes) produce byte-identical doc_open/doc_info outputs against upstream 33c14e07cfd742a82bf03baa6b103c01008fa68c, including the orphan repair note. After one warm-up per binary and three interleaved base/candidate rounds, median open times were 0.16/0.15 s and 0.08/0.07 s, with median peak RSS 62.69/59.98 MiB and 33.28/32.20 MiB. Workspace tests, Clippy, formatting, focused forms/engine/organize tests, and the WASM check pass. A behavior-preserving local binding in organize also lets the workspace Clippy gate pass. No estimate change.

• 2026-10-11 (M14, Traditional Chinese semantics): Corrected accessibility pass/fail labels, the inverted script-accessibility rule, Taiwan row/column terminology and form choice/read-only labels; added the missing table-row explanation. Catalog regressions cover the rule metadata and preserve field names. Milestone and effort estimates unchanged.

• 2026-10-10 (M14, interface size): Preferences ▸ Interface size scales the whole interface (50–250 %, setting ui_scale, control option ui-scale); 50 % brings an interface the system draws at 200 % back to 100 % (#456). Auto, the default, follows the desktop's text scaling: on Linux and the BSDs the desktop app reads GNOME's text-scaling-factor once at launch, so with Large Text (1.25) on a 1× display the interface no longer draws 13 px labels that show their pixels next to the system's text. The size is egui's zoom factor, so pixels_per_point grows with it and page rasters stay one texel per screen pixel; egui's own ⌘+/⌘− interface zoom is turned off so those keys stay page zoom. Still missing: KDE's font DPI and Windows' "Make text bigger" aren't read (both scale only text there), and egui's text is still greyscale-antialiased without the system's gamma, so small text looks rougher than GTK's at 100 %.

• 2026-10-10 (M14, #496): Shortcut displays share a UI formatter across toolbar search, registry menus, command palette, Help and tooltips. Modifier and key names use a dedicated catalog context in every bundled translation; missing entries keep the English key name rather than a command translation. German shows Strg/Umschalt/Entf, macOS retains its symbols, and runtime language changes refresh the display. Regression coverage checks localized layout widths, English/German switching, platform conventions and unchanged command execution. Milestone and effort estimates unchanged.

• 2026-10-10 (M5, shape fill colour, #686): Rectangles, ovals, polygons and clouds can be filled. The comment quick bar has a Fill colour control for those tools ("No fill" or a swatch; it persists with the other per-tool styles), Comment Properties ▸ Appearance has a Fill colour row (one undo step with the other changes, carried over by Make Current Properties Default), and comment_edit takes fill ("none" removes it). pdfcraft-annot::set_fill writes or removes /IC and redraws the appearance; lines, ink and locked comments refuse it. Still missing: a custom colour picker (only the comment palette), and a separate fill for line endings.

• 2026-10-10 (M10, #645): Export all images and Save image as keep transparency. A JPEG with a soft mask (the usual cut-out photo) was written as the bare JPEG, and soft masks of another size than the image, JPEG-compressed soft masks, stencil /Mask images and colour-key /Mask arrays were dropped, so cut-outs came out on solid white or black. These images are now PNG with the mask as alpha (soft masks scaled to the image, /Matte un-blended); JPEGs without transparency are still written byte for byte. A negative image size no longer overflows in Save image as. JPX/JBIG2/CCITT masks are still left out. Overall estimate unchanged (about 30–35%).

• 2026-10-10 (M12, XFA rows and areas): Dynamic XFA forms lay out a repeating subform inside a top-to-bottom container in positioned content (a table in an area) with all its instances, drawn and measured, instead of one; and areas no longer appear in data paths (pdfcraft_xfa::data_path), since they are not data scopes. Before, a form whose fields sit in an area read none of the values Adobe's viewers saved, wrote what was filled here under a new element named after the area, which Adobe's viewers would most likely not read, and a FormCalc total looping over the table's rows failed on the rows that were missing. Layout, the script tree, reading and writing the data and the engine's value and row operations share the one path rule. Synthetic tests cover the layout, the path rule and the whole round trip (rows, Adobe-written values, a FormCalc total over all rows, the written data, reopening). Still open for such forms: XFA script objects (<variables><script>), which aren't supported. Overall estimate unchanged (about 30–35%).

• 2026-10-11 (M10, Windows printing follow-up to #847): Windows print jobs print each sheet at 100% on the driver's paper closest to the sheet's size, landscape for wide sheets; they had been shrunk into .NET's default 1-inch margins (about 76% on Letter) and not rotated. Sheets are capped at about 64 megapixels so a poster-sized sheet can't exhaust memory. PowerShell runs without a console window, and the Print dialog lists printers and spools jobs off the UI thread (the desktop app's printer_source), so neither Ctrl+P nor a long job freezes the app. Kittest regression for the background printer list; the Windows rendering path is still checked only by the Windows CI job. Estimates unchanged.

• 2026-10-10 (M9, #179 follow-up): A Windows store certificate that can't sign is no longer left out of the Sign dialog silently: windows::list names it with the reason and Windows error code (no private key, a P-521/Brainpool/Ed25519 key, a key CNG can't open), the picker shows it greyed and unselectable, and sign_windows_ids returns it under unusable. A key that needs a permission prompt to open is listed instead of skipped. Reported by a user whose CA-issued identity showed in Acrobat but not here; a plain .p12 import into the CNG and legacy Microsoft providers was verified to list, so the next report will carry the reason. Store test adds a key-less certificate; overall estimate unchanged (about 30–35%).

• 2026-10-10 (M10.2, JPEG scanning follow-up to #729): Skip marker fill bytes and keep reading JFIF, APP14 and ICC metadata after the frame header, stopping before scan data or at EOI. Invalid segment lengths return errors; damaged or mismatched ICC profiles retain #729's device-space fallback. Synthetic regression cases added but not run at the contributor's request. Estimates unchanged.

• 2026-10-10 (M13, desktop action outputs): Desktop Action Wizard keeps every result when input basenames repeat, or when the destination already has a result from an earlier run. It preserves the original filename and extension for a free name and adds numbered suffixes for occupied names; the bounded search returns an error rather than reusing an occupied path. A real-shell regression drives Start twice and reopens the three-page and one-page results, checking that the original inputs and earlier output remain intact. This covers the desktop writer separately from the CLI/MCP action_run repair in #877. Milestone and effort estimates unchanged.

• 2026-10-10 (L Print, #756): Windows prints. The Print dialog lists the system's printers and its default from Win32_Printer (through PowerShell's CIM; wmic is gone from Windows 11), and Print spools the print-ready PDF: the in-box Windows.Data.Pdf renders each sheet at the printer's own resolution and System.Drawing.Printing carries copies, collation, duplex and colour as the job's settings — both reached through powershell, so the Rust code touches no Win32 API and the machine needs no PDF reader. This closes #756 and the "printer not showing" duplicates #160, #244, #293, #465 and #644, using the CIM approach community-tested in #452; the tests render the job's sheets through the whole WinRT path on CI (dry run, no printer needed) and, where a printer can be added, catch a real job in its paused queue. Web printing is still missing; milestone and effort estimates are unchanged.

• 2026-10-10 (M3, #740): Column select, as in Acrobat: holding Alt (Option on macOS) when a drag starts selects only the text inside the rectangle, with the Select tool, the text markup tools and Redact; Edit ▸ Column select does it with a plain drag, for Linux desktops whose window manager takes Alt-drag (Xfce, Cinnamon, MATE, KDE Plasma 5 by default). Copy gives rows top to bottom with tab-separated cells (right to left in right-to-left rows, reading order for vertical text); text_extract takes the same rectangle as rect. The new label is in all 15 catalogs. Also repaired parity/acrobat-features.toml, which #650 had left unparseable (duplicate keys on form.field-list). Still missing: column selection across pages and ⇧-click extension. Estimates unchanged.

• 2026-10-10 (progress docs, hours per audience): Each readiness number gets its own hours to ≈ 95%: full ≈ 49% / 780–1,400 h, mainstream ≈ 55% / 500–900 h, essentials ≈ 66% / 180–330 h. The full number is now the standard's additive weighted sum over the dimensions (written weights), 47% → 49%: method aligned with the standard, no new evidence. Beta ≈ 26 points, ≈ 400–700 h.

• 2026-10-10 (progress docs, gate consistency check): Re-judged the convert-and-share row with the rule applied across all Crafting Apps (a workflow blocks only when it can't be completed at all; lossy exchange and missing sub-cases are beta items, as for FilmCraft's .prproj or VectorCraft's .ai). Unencrypted sharing works, encryption interop (#774) and Office→PDF are sub-cases, Word export is lossy rather than absent: partial, not blocking. Stage pre-alpha → alpha; numbers unchanged (47%, mainstream 55%; beta ≈ 400–700 h). Added an essentials-user score: ≈ 66% for someone who only opens, reads, comments, fills, signs, prints and rearranges pages.

• 2026-10-10 (progress docs, second look and alpha gate): At the owner's request, after practitioners praised PdfCraft, re-examined the numbers. User sentiment: 7,595 stars, 177k + 39k downloads of 0.4.0/0.5.0, 23 user issues with explicit praise and switching reports (#179, #232, #273), issue themes concentrated in core paths (launch/GPU, rendering, editing, CJK, signing, printing). The checklist is not niche-dominated (497 mainstream vs 311 specialist rows; P0 95% / 91%). The first pass's 9-point cross-cutting deduction double-counted Windows printing, interop and glyphs: ready for real work 40% → 47%, and ≈ 55% for the mainstream practitioner (new). The new core-workflow gate (craftrules progress-docs) fails on convert and share (#774, no Office import, #773): stage alpha → pre-alpha, ≈ 40–70 h from alpha; beta still ≈ 400–700 h.

• 2026-10-10 (progress docs, full re-measure): Re-measured against Acrobat Pro 26.002.21931 (installed bundle inspected: document types, localizations, plug-in and framework names). Checklist: 423 shipped + 74 partial of 808 (56.9%; P0 94.2%), ≈ 67% tier-weighted. Ready for real work ≈ 40%; stage alpha; ≈ 400–700 h to beta, ≈ 780–1,400 h to full parity (up from 600–1,100 h: the first public releases surfaced Acrobat interop of encrypted output, Windows printing, Chinese UI glyphs, Word-export layout and a 245-issue backlog). This file restructured to the craftrules progress-docs standard; the honest assessment moved to docs/target-app-parity.md, the gap list to docs/gaps.md, the milestones (duplicated rows merged) to docs/roadmap.md; new docs/architecture.md, docs/localization-parity.md, docs/file-format-parity.md, docs/pdf-spec-parity.md, docs/ui-parity.md, docs/hardware-parity.md.

• 2026-10-10 (M8, redact word lists): Find text and redact gains "Multiple words or phrases": a list with one word or phrase per line, typed or imported from a .txt file, whose every match is marked in one undo step. Lists are trimmed, deduplicated and bounded (1,000 entries of 256 characters, files up to 1 MB). redact_mark takes words and reports how many marks each made, so an agent sees which found nothing. Tests cover the list parsing, the tool end to end (mark, undo, apply, invalid lists) and the dialog with an imported list; the new labels are translated in all 13 UI catalogs. protect.redact-word-lists is shipped; whole-word and case-sensitive matching and exporting the list are still missing. Estimates unchanged (about 30–35%).

• 2026-10-10 (M4, bookmarks from structure): Bookmark options ▸ New bookmarks from structure (command bookmark.from_structure, tool bookmark_from_structure) turns a tagged document's headings into bookmarks: H1–H6 through the role map, a plain H by its section nesting, nested by level under a new first "Untitled" bookmark as in Acrobat, each linked to its structure element (/SE). Titles come from /ActualText, the marked text on the page (decoded through the font's ToUnicode or encoding), /Alt or /T. The walk is bounded (depth, visits, heading and title caps, cycle-safe), an untagged document gets a clear error, and the edit is one undo step. Tests cover role maps, nesting, ToUnicode text, a self-referencing heading, the tool, undo and the panel. Still missing: Acrobat's element-type choice and destinations at the heading's position. The M4 row no longer lists Replace pages as missing (it shipped earlier). Overall estimate unchanged (about 30–35%).

• 2026-10-10 (M9, signing encrypted documents): Digital signatures, certification and document timestamps work on password-protected PDFs instead of failing with "not supported: signing encrypted documents". pdfcraft-cos no longer encrypts or decrypts a signature dictionary's /Contents (§7.6.2; by /Type /Sig|/DocTimeStamp or /Contents + /ByteRange), so the placeholder is patched after hashing as in a plain file and existing signatures in encrypted files read their real CMS (which also fixes their DSS /VRI keys and keeps them intact in a full rewrite). Opened with the user password, the signer applies the document's permissions (fill-forms for existing fields and timestamps, annotate + modify for new fields, modify for certifying) and names the permissions password when it refuses. Synthetic tests cover all four algorithms, counter-signing, tampering, permissions and the automation tools. Overall estimate unchanged (about 30–35%).

• 2026-10-10 (M9, signer certificate usage): A trusted signer's certificate must also allow signing documents (RFC 5280 §4.2.1.3, §4.2.1.12, §4.2). A key usage without digitalSignature or nonRepudiation, an extended key usage with no document-signing purpose (any, emailProtection, codeSigning, RFC 9336 documentSigning, Adobe Authentic Documents, Microsoft document signing), or a critical extension PdfCraft doesn't process makes the verdict Unknown instead of Valid, and the details say which. Certificate policies are accepted as any policy. In-process certificates test each refusal and the accepted cases; a signed PDF from a trusted TLS-server certificate was Valid before and is Unknown now. Still missing: name constraints, and unknown critical extensions on issuer certificates. Overall estimate unchanged (about 30–35%).

• 2026-10-10 (M14, side panel width): The side panel keeps the width it is dragged to. The Bookmarks search row was 2 px wider than the panel, and a resizable egui panel keeps the width its content used, so every repaint (any pointer move) widened it up to 520 px. The Comments reply row did the same in languages with a longer "Post" (Russian, Spanish, …); Post now sits under a full-width reply field. Tests hold both panels' widths steady across 30 repaints. Overall estimate unchanged (about 30–35%).

• 2026-10-10 (M8): Redaction codes. Redaction properties offers "Custom text" or "Redaction code" under "Use overlay text": pick the U.S. FOIA (5 U.S.C. 552(b)) or U.S. Privacy Act (552a) set and tick codes, and new marks carry them as overlay text in the set's order ("(b)(6), (b)(7)(C)"). redact_mark takes code_set and codes, rejecting unknown sets and codes with the allowed list. Tests cover the code sets, the tool end to end (mark, apply, text) and the dialog; the new label is translated in all 13 UI catalogs. protect.redaction-codes is partial: Edit Codes, custom sets and their import/export are still missing. Estimates unchanged.

• 2026-10-10 (M14, platform shortcut labels): View ▸ Zoom and Page navigation, the rail, find-bar, toolbar and bookmark tooltips, and Help ▸ Keyboard shortcuts write shortcuts for the platform (Ctrl+1, Ctrl+Shift++ off macOS) instead of hard-coded ⌘. Labels follow egui's detected OS, so the web build in a Linux or Windows browser shows Ctrl too. Fit visible is listed once in View. Translated tooltips take a {key} placeholder. Overall estimate unchanged (about 30–35%).

• 2026-10-10 (M14): Arabic interface language: a 2,137-entry catalog (ar.tsv, six CLDR plural forms, Arabic month and weekday names for dates), selected by ar and every ar-* locale. egui joins Arabic letters but places words left to right, so the catalog is put into display order when it loads (bidi::display_rtl: placeholders, keyboard shortcuts, edge spaces and caption colons are kept in place), and the command search matches a multi-word Arabic query word by word. Arabic glyphs come from the craft-fonts Arab face (kept in the web build); the CI and release pin of craft-fonts moves to the revision that has it, and crates/fonts/build.rs now refuses to embed the Noto Sans CJK SC that revision also carries (AGENTS.md §1.1). Not done: the layout is not mirrored, a wrapped Arabic paragraph breaks at the wrong end, and text typed into fields is not reordered; these need bidi support in the text layout itself.

• 2026-10-10 (M6, #95): Prepare a form edits shared General, Appearance and applicable Options properties in one atomic undo step. Explicit opt-in controls keep mixed values unchanged; partial appearance patches preserve custom font resources, each widget's style, indirect dictionary contents and unknown keys. Ctrl/Command+A selects the current page; rectangle selection and the Fields panel support multi-selection, with panel double-click opening properties. CLI/MCP form_set_props accepts a bounded, unique fields list. Regression tests cover save/reopen, undo/redo, locked-field rollback, stale dialogs, invalid arguments and selection. Names, positions, choices/defaults and script tabs remain individual GUI edits. Integrated upstream 0.5.0 and completed Portuguese/Italian catalogs without losing translator credit; shared-property labels now cover all 14 bundled translations. Kept the new Italian interface and Fill & Sign date-language registries aligned, including accented date output; the About-dialog regression waits for the larger contributor list to settle before clicking. Milestone and overall effort estimates unchanged (about 30–35%).

• 2026-10-09 (M5, line-ending labels): Comment properties names each line ending in words ("Reverse open arrow", "Butt", …) and those labels are translated. The PDF /LE token is unchanged. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M3, #171): A browser startup ?file= download opens in a background tab once the user has started working, so it cannot switch the active document or the next Save. Deliberate opens still activate their tab; Home, Combine files, workspace choices and another file's password prompt are preserved. Initial-view geometry is applied to the background document, and its script notices wait until its tab is selected. Synthetic shell tests cover the race, saving the local edit, tab switching, encrypted arrivals, errors and converted text. Milestone and overall effort estimates unchanged (about 30–35%).

• 2026-10-09 (never-crash, #378): On Windows the window is drawn on the GPU that drives the primary display, as on Linux: EnumDisplayDevices (through the safe winsafe crate) says which adapter shows each desktop display, and pick_adapter matches it to the wgpu adapters by PCI ids. Before, the low-power preference chose a Ryzen integrated GPU with no monitor on a desktop whose monitors hang off an NVIDIA card, and presenting across adapters took the AMD display driver down for two minutes. The log now names the GPU chosen. Synthetic tests for the Windows device-id parser and the primary-display rule; a live test on the running machine. Overall unchanged.

• 2026-10-09 (page preview resolution): The page view draws whole pages at twice the screen density when that bitmap still fits, then filters it down, so type and fine lines keep more detail. Print preview, page thumbnails, alternate-text figures and the page behind a moving signature are rendered at the size they are shown instead of being stretched up from a small image. Milestone and effort estimates unchanged.

• 2026-10-09 (M5, line endings): Lines, connected lines and callouts draw all ten standard line-ending styles. comment_add accepts endings, and Comment properties can change them in one undo step. An unknown name is left undrawn, and a non-finite direction is rejected. Cloudy borders remain polygon-only, so comment.line-endings stays partial. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M6, field rotation): Regenerated form appearances honour /MK /R (0, 90, 180, 270). Filling or restyling a rotated field keeps the text, check mark and button caption turned, and Field Properties ▸ Position and form_set_props rotation set it, swapping width and height around the field's center when the axis changes. form.appearance-regeneration stays partial (Helvetica metrics are still approximate). Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M2, JPX sample normalization): JPEG 2000 rescaling uses bounded integer arithmetic for supported 1–32-bit samples, including the 32-bit boundary that previously shifted past the integer width. Zero-sized rows are refused before scaling. Small contributor-original codestreams exercise decoding and rendering; endpoint and standard-depth regressions cover the same helper. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M14, #577): The desktop GPU setup enables the selected adapter's supported 2D texture extent instead of egui-wgpu's fixed 8192-pixel extent. This removes the artificial surface ceiling behind a mixed-DPI Windows startup crash when opening Outlook PDF attachments. Synthetic regressions cover the observed 8600 × 3423 surface, downlevel adapters and preservation of other device limits. Hardware resolution limits still apply; milestone and overall effort estimates are unchanged.

• 2026-10-09 (M14, #577 follow-up): A window larger than the GPU's texture limit no longer closes PdfCraft. Vendored egui-wgpu 0.36.2 fits the window's surface within max_texture_dimension_2d and draws egui at the matching scale, on every path that sizes a surface (start-up restore, resize, maximise, DPI change, a recreated surface); upstream is emilk/egui#8361. Root cause of the Outlook-only trigger: winit creates the window on the launching app's monitor and converts the restored size at that monitor's scale. Unit tests cover the 8600 × 3423 case and edge sizes; a Windows Sandbox (WARP) run of a window one pixel over the limit panicked before and kept drawing after. Estimates unchanged.

• 2026-10-09 (M14, #519): A GPU that can't configure the window's surface at launch no longer panics, so PdfCraft's OpenGL retry runs. Vendored egui-wgpu configures a new window's surface inside wgpu error scopes (winit::catch_errors) and returns a failure as an error, so eframe returns Error::Wgpu and the existing OpenGL retry (#530) runs (a device lost during that configure still panics, on the first frame). Before, wgpu's default handler panicked: on a 2015 Intel GPU with no D3D12 driver wgpu picked the GL adapter over WARP and timed out in Surface::configure (GpuWaitTimeout). A real-device regression test (a wgpu validation error inside catch_errors) panicked with the scopes removed; in Windows Sandbox a forced configure failure panicked unpatched and retried with OpenGL patched (Sandbox has no OpenGL 2.0, so the OpenGL window itself was not shown there). Defaulting Windows to DX12 only (WARP instead of wgpu's GL backend) is left to the maintainers. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M5, Fill & Sign flatten on save): Preferences and doc_save can bake Fill & Sign text, marks and signatures into the page when saving. The option defaults off. Other comments and form fields stay, a second flatten does not reuse an XObject name already on the page, and a document that cannot be changed is left unwritten. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M3.9, native control lifecycle): The opt-in UI control channel can request bounded window sizes, report observed dimensions, focus accessible widgets and inspect actual keyboard focus. Graceful quit uses the existing unsaved-work prompt, including uncommitted typing; force/discard parameters are rejected. Tests cover resize validation, Tab/Shift-Tab traversal, keyboard activation, invalid focus targets and quit cancellation with retained edits. Focused buttons preserve document undo/redo shortcuts, while text editors keep their own undo history. No milestone percentage change.

• 2026-10-09 (UI.5, shared tab interaction): Document and Combine tabs use revision-pinned craft-ui interaction, with accessible tab roles, selected state, keyboard activation and a theme-colored focus outline. Document IDs keep tab identity stable through dirty-label changes and earlier-tab removal. Existing labels, painting, horizontal scrolling and close requests stay in the frontend. No milestone percentage change.

• 2026-10-09 (UI.2, shared icon buttons): The frontend uses revision-pinned craft-ui for its SVG catalog and square icon buttons. Existing assets, fallback cache keys, dark/light colors, tool labels and commands remain app-owned. Buttons gain a visible keyboard-focus outline; the layer checker keeps the shared dependency at L7. No milestone percentage change.

• 2026-10-09 (M5.7, #434 partial): Natural-size image stamps placed at a click or through stamp_custom remain upright on rotated pages, with a displayed-space-sized rectangle and a counterrotated standard appearance matrix. Move, resize, restyle and undo/redo preserve that orientation. Native and external Poppler save/reopen rendering cover all four quarter-turns; UI tests verify the displayed bounds. Explicit rectangle placement, image signatures, PDF-page stamps and image-file orientation metadata remain outside this repair. #434 stays open; milestone table and effort estimates remain unchanged.

• 2026-10-09 (M1, raw-stream decoding limits): COS checks unfiltered decoded data against the caller and per-stream limits before copying it, including empty filter arrays and streams whose Crypt filter was applied on load. Strict decoding uses the same raw-data guard. Tiny synthetic regressions cover exceeded, exact and zero-byte limits while retaining the filtered decoder behavior. Milestone and overall effort estimates unchanged (about 30–35%).

• 2026-10-09 (M2, bounded page labels): Inspector number trees have shared work, depth, and cycle limits; prefixes are bounded before decoding and complete custom labels have per-label and aggregate UTF-8 byte caps. A refused tree leaves physical page numbers intact and records one warning, with custom labels applied only after every range succeeds. Pure COS Roman and repeated-letter formatters are shared with Organize; label queries and edits return errors for unsupported output before changing the stored tree, while ordinary labels and prefix-only ranges remain supported. Synthetic tests cover safe just-over-limit cases, large first numbers, aliases, cycles, wide/deep trees, UTF-16/UTF-8 boundaries, aggregate output, and unchanged refused edits. Milestone and overall effort estimates unchanged (about 30–35%).

• 2026-10-09 (M4, page grid zoom): The Organize page grid zooms from 50% to 300%: toolbar buttons with a percentage that resets, trackpad pinch or Ctrl/⌘ + wheel about the page under the pointer, and ⌘+ / ⌘− / ⌘0. Pages drawn larger than their thumbnails are rendered at the size drawn while in view, so text stays sharp in documents of any length. Not yet: a slider, remembering the size, a size control for the Pages panel. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M7, grouped artwork): Edit text/images selects page-drawn Form XObjects as whole figures, including nested raster/vector/text content. Their BBox and optional Matrix determine the selection; move/resize/rotate/flip/delete rewrite only the selected page placement, preserving shared Forms and other placements. Engine, automation and UI core regressions cover geometry, rendered movement, save/reopen, undo and selection/drag/Delete. Bitmap replacement/extraction remain raster-only; inline images and individual elements inside a Form are not editable through this tool. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M9, review of #144): Chain building checks what an issuer may do. x509::build_chain linked certificates by name and signature only, so an ordinary subscriber certificate embedded in a PDF, or one in the trusted list, could "issue" a certificate for any identity and chain to a trusted root. An issuer now needs basicConstraints CA:TRUE (an old v1 self-signed root without constraints still anchors), keyCertSign when it has a key usage, a pathLenConstraint that allows the CAs below it, and validity at the signing time (or the trusted timestamp/token time) when known; the signature's details say why an issuer was refused. Negative tests issue certificates in-process and cover each refusal, plus a signed PDF whose signer chains through an end-entity certificate (Unknown, not Valid). Still missing: key usage and extended key usage of the signer, name constraints and unknown critical extensions. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M9): A document timestamp stored as a signature field (Documenso writes Timestamp_1 that way, its /V a /Type /DocTimeStamp dictionary) was read as a CMS signature and reported "altered or corrupted since the signature was applied" on an untouched file. A field value with /SubFilter /ETSI.RFC3161 is validated as a timestamp now, and standalone timestamps are found by /DocTimeStamp (ISO 32000-2 §12.8.5) as well as the /Type /Sig older writers used; timestamp_document writes /DocTimeStamp. Regression tests build the same structure with a test TSA. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M9, signatures as DocuSign and Documenso write them, #144): A real DocuSign + Telekom qualified-signature PDF showed "DER signature wrong" although Acrobat validates it: both CMS blobs use BER indefinite lengths. The CMS is read with the BER reader that #453 added (Tlv::parse_ber: indefinite lengths, segmented OCTET STRINGs, depth-bounded) while certificates and signed attributes are still verified over their own exact bytes, and the details say the signature was BER; tests build the nesting bombs a crafted /Contents could hold. Behind that, later revisions that add DSS data (indirect /Certs, /VRI) or rewrite the catalog's XMP were classified as disallowed changes; they are permitted now, narrowly (review by echelon on #144): only objects reached through /DSS /Certs|CRLs|OCSPs|VRI with the shape of their role, and new or only grown since signing, count as the store, and only the catalog's /Metadata is the document's XMP. A /DSS entry naming a page's contents, or a /Type /DSS or /Type /Metadata label on an existing dictionary or stream, makes nothing permitted. Six of the new tests fail on the previous code, among them a Form XObject labelled /Type /Metadata before signing that could be rewritten under a Valid signature. Negative tests at every DocMDP level. Cross-checked with pdfsig (both signatures valid). Still missing: AATL/EUTL trust lists (a separate change: they need CA-constraint checks in chain building first). Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M9, signature algorithms, #386): Validation reads what real signers write. Digests SHA-224, SHA-512/224, SHA-512/256, SHA3-224/256/384/512 and RIPEMD-160 (beside SHA-1/2); RSA PKCS#1 with or without the DigestInfo's NULL (checked by building the one expected encoding and comparing it byte for byte, in rsa_pad, for every digest; a bare digest without any DigestInfo is refused, it doesn't say which hash it uses); RSA-PSS with the hash, MGF1 hash and salt length the signature declares; ECDSA as DER, non-minimal DER or raw r‖s on P-256, P-384, P-521 and brainpoolP256r1/P384r1/P512r1 (the last hand-written on crypto-bigint, no RustCrypto crate exists); Ed25519 (RFC 8419); the legacy adbe.x509.rsa_sha1 format. Algorithms PdfCraft can't check give Unknown instead of Invalid. Review of #386 (echelon): an RSA signature value must be below the modulus (RFC 8017 §5.2.2; s and s + n both verified before), and SHA-1 and RIPEMD-160 signatures still validate but the signature's details now say the algorithm is weak (wording pinned by tests). Found on the way, each with a regression test that failed first: a brainpoolP512r1 key with a coordinate not reduced modulo p panicked inside the bigint arithmetic (the certificate comes from the PDF), now refused, and the point at infinity is an invalid signature rather than an error. Tolerated encodings are listed in the signature's details. Vectors made with OpenSSL; cross-checked with pdfsig. Still missing: Ed448/DSA, signing with the new digests. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M14, German interface follow-up): Follow the merged German catalog with shorter search/action labels, corrected callout/accessibility wording and a distinct certificate Subject context. Localized tool names retain their capitalization and comment composer titles go through the catalog. Search hints reserve shortcut space and Home cards bound text with full hover text; layout, context and German Preferences/search control regression tests cover these changes. Overall effort estimate remains about 30–35%.

• 2026-10-09 (M2, PDF-function hardening): Vendored function construction has a shared 64-level/10,000-node limit and path cycle detection; calculator parsing and evaluation have shared depth/work budgets. Calculator integer division, logical shifts, rotations and indices avoid input-driven panics, and fixed-size stack errors propagate. Synthetic tests exercise exact/over limits, shared children and cyclic references, with invalid shading calculations preserving later page content. Limits return the existing optional failure and log their reason when logging is enabled. Milestone/overall effort estimates remain unchanged (about 30–35%).

• 2026-10-09 (community, destinations): Bookmarks and links go to their destination's position, not just its page (ISO 32000-2 §12.3.2.2): /XYZ puts (left, top) at the window's top-left and applies a non-zero zoom; /Fit, /FitH and /FitV switch to fit page, width and height with top or left at the window's edge; /FitR zooms to fit the rectangle, centred. Named destinations resolve the same way; crop-box origin, /Rotate and view rotation are accounted for; malformed or non-finite operands fall back to the top of the page. Not yet: the /FitB* content box (read as the page). Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M2, image resampling bounds): Image resampling checks source buffers, finite transforms, target RGBA sizes, intermediate scratch dimensions and estimated filter work before planning or allocating; wide valid sources may shrink before backend side limits. Oversized or failed resampling retains the original pixels and placement when the source fits the backend; invalid sources, unrepresentable fallbacks and failed staging/output reserves are skipped with a logged warning. Small synthetic metadata regressions and an anisotropically transformed image cover the guards and fallback. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (community, M14, Hungarian): Magyar (hu) is a complete interface catalog (2,036 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for hu and hu_HU, and from Preferences. Informal "te"; commands are nouns (Mentés, Megnyitás). After a numeral the noun stays singular, so both plural forms match. Coverage tests check commands, All tools labels and every tl! literal; history labels keep captured names; the bundled Latin faces cover Hungarian diacritics including ő and ű. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M14, Windows Auto): Neutral launcher locales (C, C.UTF-8, POSIX) no longer select English ahead of the Windows preferred display-language list. Explicit supported locale overrides retain their priority. Regression tests use existing catalogs and cover neutral/mixed overrides, unsupported first display tags and multiple preferred Windows languages. Catalogs and other platforms are unchanged; overall effort estimate remains about 30–35%.

• 2026-10-09 (community, M14, German): Deutsch (de) is a complete interface catalog (2,035 entries) covering every command, All tools entry, dialog, panel and notice, selected automatically for de, de_DE, de_AT, de_CH and other German locales, and from Preferences. Informal "du", infinitive for commands. Coverage tests check commands, All tools labels and every tl! literal; history labels keep captured names; the bundled Latin faces cover umlauts, ß and German quotes. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (community, M7, Arabic added text): Add text writes Arabic into the PDF instead of ?. The text is shaped with the craft-fonts Arab face through harfrust (already in the tree via egui): joining forms, ligatures and mark positions. Each line is laid out in display order by the Unicode bidirectional algorithm, so Arabic mixed with Latin words, European or Arabic-Indic digits and brackets reads correctly; justified right-to-left paragraphs end at the right edge. Each cluster (a letter with its dots or marks) becomes one glyph of a Type 3 font built from the face's outlines, with a ToUnicode entry, so text_extract, copy and search get every letter once and no font file is embedded. Wrapping measures shaped words. Each item has its own fonts under names free on the page (a full save renumbers objects but not resource names); updating or deleting the item removes them. Without the face, adding Arabic text returns a clear error and changes nothing, while an existing item holding Arabic still moves and retypes, drawn as ? as before. Tests cover shaping, display order, ToUnicode, font names and clean-up on one page, and odd input (empty lines, direction controls, lone marks, 18,000 characters). Not yet: bold/italic Arabic, Hebrew, right-to-left typing in the box (misc.rtl-ui), editing existing Arabic text (edit.rtl-cjk-editing). The craft-fonts revision pinned for releases predates its Arabic face, so release builds report the missing font until the pin moves. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M2, predictor hardening): Empty PNG predictor frames return without row buffers. Packed TIFF Predictor 2 rows reject overflowing dimensions and size per-component scratch to the samples present in the input, aligned with upstream lopdf#589. Synthetic regressions cover malformed dimensions, partial rows, 1/2/4-bit decoding and padding. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (community, document inspection): Annotation dates preserve non-date Unicode text instead of panicking while opening; failed auxiliary structure inspection keeps renderer page geometry and reports a warning. Synthetic UTF16BE annotation, UTF8-boundary and independent panic regressions cover the fix. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (community, M14, #503): Ukrainian (Українська, uk) adds 2,047 original catalog entries covering commands, tools, dialogs, panels, notices, history and contributor controls. Auto resolves uk/uk_UA; the manual preference persists. Integer plurals distinguish one/few/many, including 11–14 and large counts; fixed-count templates use count-neutral wording. Calendar dates use genitive month names; Home cards fit wrapped text and the search hint keeps clear of its shortcut. Coverage checks scan UI literals, and font checks use bundled Inter and JetBrains Mono, including ґ/є/і/ї. Control tests check translated Preferences, command search, error framing and language switching with unsaved documents. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (community, M5, #158): Fill & Sign date format. Preferences ▸ Date format sets the pattern Fill & Sign dates use: 12 presets or any pattern in Acrobat date letters (with \ escapes), checked and previewed as typed, remembered, and settable through fill_sign_date_format, fill_sign_add format/language and ui set date-format/date-language. Month and weekday names come in the interface languages (Czech in the genitive after a day), following the interface language unless one is picked. Fill & Sign text is still Helvetica/WinAnsi, so a date with other letters (Czech ř, Japanese, Chinese) is refused with a warning rather than saved as "?". This goes past Acrobat, whose Fill & Sign has no format setting. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M14, #503 follow-up): Reviewed the complete Ukrainian catalog with VESUM 6.8.6 and manually checked the labels added when #509 landed. Certificate Subject now names the certificate holder separately from the document topic; certificate types and fingerprints, equal field sizes, keyboard/assistive-technology guidance and table sections use clearer contextual wording. Reviewed technical compounds and abbreviations remain unchanged. Overall effort estimate remains about 30–35%.

• 2026-10-09 (community, Home pinned folders): Home gets a Folders section: File ▸ Pin folder to Home… (or "Pin a folder…" on Home) pins up to 8 folders, and each lists its newest PDFs (name, how long ago, size; 8 at first, up to 100 with Show more), one click to open, Unpin to remove. Folders are read on a worker thread and listed again every few seconds while Home shows, so new scans appear without reopening anything; a folder that can't be read (moved, offline synced drive) stays pinned and says so. Each folder is described by where it is ("iCloud Drive", "OneDrive · Contoso", "Documents › Work") rather than its full path, so two folders called "Scans" can be told apart. Cloud drives work through their local synced folder; nothing is read through a provider's API. Settings keep only absolute paths, without duplicates. Command label translated in every catalog; Home strings in French, Spanish, Japanese and both Chinese catalogs. Not yet: subfolders, search inside a pinned folder, the web build. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (community, M14, Telugu): Telugu (తెలుగు, te) as a complete catalog of 1,984 entries covering every command, All tools entry, dialog, panel and notice; te and te_IN locales follow it. Telugu text is drawn with a craft-fonts Telu face (Noto Sans Telugu, storytold/craft-fonts#10), kept in the web build too, after the CJK and Arabic faces; egui shapes its conjuncts. Commands use the plain imperative and sentences the polite form. The craft-fonts revision pinned for releases has no Telugu face yet, so release builds show Telugu as replacement boxes until the pin moves. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M14, Simplified Chinese About): The About tabs, contributor controls and statistics, and model table now have Simplified Chinese translations, along with multiline link-privacy and cut-and-stack guidance. Coverage checks include direct i18n::t calls, multiline literals and dynamic credit labels; UI control checks exercise the translated About tabs and tables. Chinese font delivery remains incomplete; overall ≈ 30–35% (unchanged).

• 2026-10-09 (M14, #305): Windows MSI rejects per-user installation overrides while allowing removal of legacy per-user installs and keeps its progress message visible. README documents unattended deployment without a desktop shortcut. Compiled x64 MSI checks pass; ARM64 install regressions added for CI. Overall estimate unchanged (about 30–35%).

• 2026-10-09 (M13, MCP #451): common command, batch, inspection and bounded preview tools share the existing confined automation path. MCP tools carry complete hints and reject unknown top-level keys as invalid parameters.

• 2026-10-08 (M14, #307, upstream integration): Rebased the local candidate onto main a6bc63a, preserving render-request deduplication, pixel-aligned rasters, signature editing and organizer insertion controls. Regressions cover inactive signature-preview cleanup, insertion gaps under virtualization, and canceled/reintroduced render requests. All 1,336 workspace tests pass (6 ignored), 193 parser tests pass (2 missing-fixture tests filtered), strict workspace/all-target Clippy passes without allowances, and 30 WASM crate checks pass. All 1,010 navigation frames, 12 workflow artifacts and eight 100-page external PDF checks match; 1×/2× desktop protocols pass again. Inspection is 497.7 MiB / 1.78 s, full-save 1.06 GiB / 29.64 s, and fresh desktop navigation/close/reopen 877 MiB. The desktop result is higher than the pre-rebase 832 MiB, while remaining 21.9% below the earlier bounded-writer stage. Windows, cold-start latency and global memory budgets remain open; no milestone percentage increase.

• 2026-10-08 (M5.7, signature resize proportions): Image signature corner handles preserve the embedded image's original aspect ratio and anchor the opposite corner; edge midpoint handles stretch width or height independently. The live preview and committed edit share the constrained geometry, including page/view rotation and reopened PDFs whose rectangles were stretched previously. Synthetic UI tests cover all corners, edge resizing, undo and redo. Milestone and effort estimates unchanged.

• 2026-10-08 (M5.7, live signature adjustment): Embedded image signatures resize and move with every pointer frame. Movement hides the frame and handles, which return on release; Escape cancels without committing. A cached background preserves the page beneath the image, and only the completed gesture enters undo history. The read-only engine preview and comment_image_preview tool share bounded image decoding and render layers. Synthetic pixel tests cover live geometry, alpha, coloured page content, rotation, cancellation and encrypted save/reopen. Milestone and effort estimates unchanged.

• 2026-10-08 (M10/M4, create from multiple files): Create a PDF ▸ Multiple files is live. The picked PDFs, images and .txt files open as one unsaved document in the Organize page grid, where pages are removed and reordered and Save pages writes what is shown. The grid gained a "+" at every gap that inserts files right there, and on desktop files dropped on the grid go to the gap under the pointer; Insert from file now takes several files in order, converts images and text, and selects what it inserted. File-type detection moved from the shell into pdfcraft-create (source_kind), with one engine entry point (Session::convert_to_pdf) shared by Open, Insert, Create and the new doc_create_multiple tool (which can also write one PDF per file). Not yet: Office/HTML/Markdown inputs, PDF Portfolios, progress for big batches, dropping onto the grid in the web build. Overall estimate unchanged (about 30–35%).

• 2026-10-08 (M5.7, signature placement): Image signatures and initials preview at the pointer at their actual page size, including zoom and document/view rotation. A successful placement switches to Select with the new annotation selected; stamp resize handles use the existing engine edit, automation tool and undo history while preserving the appearance. Synthetic rendered UI and automation tests verify positioning, one placement per selection, resizing, undo/redo and save/reopen. Milestone and overall effort estimates unchanged.

• 2026-10-08 (M5.7, image signatures): Fill & Sign imports local PNG/JPEG signatures and initials through the Image tab, with previews, local persistence and undoable placement. The shared engine validates bounded images and preserves transparency and orientation; fill_sign_add accepts an image path. Synthetic UI and automation tests cover cancellation, invalid input, settings, undo/redo and save/reopen rendering. Overall effort estimate unchanged (about 30–35%).

• 2026-10-08 (M14, #307, confirmed baseline OOM): Removed the benchmark RSS guard and ran the frozen original and optimized CLI binaries in separate containers with a verified 15 GiB kernel memory limit, no swap and four CPUs. The unmodified baseline was kernel OOM-killed after 20.06 s with 14.97 GiB observed RSS; Docker recorded OOMKilled=true, exit 137 and an oom event. The optimized build completed the same 9,156-page inspection at 497.5 MiB in 1.75 s with unchanged metadata and no warnings. The original RSS remains a lower bound and elapsed time is time to failure. The kernel limit still constrains this experiment; no remote run was needed. No product changes or milestone percentage increase.

• 2026-10-08 (M14, #307, original-baseline cutoff): Repeated original unmodified CLI inspection with a 14 GiB RSS guard, up from 10 GiB, on the unchanged 9,156-page PDF. It reached 14,682,080 KiB and was stopped after 48.21 s before completion; no cgroup OOM kill occurred. The optimized build completed the same inspection at 495.7 MiB in 1.70 s. The original measurement is a lower bound, not a completed peak or timing. This guarded run failed before completion without an OS OOM kill. The user closed the larger-host follow-up; the prepared benchmark is retained as evidence. The later local guard-free experiment is recorded above. No product changes or milestone percentage increase.

• 2026-10-08 (M14, #307, shared parsing and raster budgets): Native render workers share a lazily initialized parser after cold-load/repair concurrency and watchdog recovery fixes, while retaining private render caches. Pages, organizer and Print request current visible thumbnails; retained active-view textures are limited to 24/128/128 MiB for thumbnails/pages/tiles and completed raster storage to 32 MiB/32 results, allowing one oversized result alone. Signature discovery uses a bounded source/edit-aware cache; the writer borrows unchanged objects and reuses xref rows. Engine navigation drops from 997 to 807 MiB with all 1,010 frame hashes unchanged. Three-trial full/incremental-save workflow times improve to 29.92/16.35 s at unchanged 1.06/1.08 GiB peaks; full serialization remains slower than before bounded saving, and the single mixed workflow takes 67.99 s versus 65.52 s. All 1,158 workspace tests pass (6 ignored in the regular run), 193 vendor tests pass (2 missing-fixture tests filtered), eight outputs pass 100-page external checks, and 29 WASM crate checks pass. Existing strict workspace Clippy warnings remain; UI lint validation explicitly allows the existing collapsible-match category. Fresh desktop navigation/close/reopen falls from 1,123 to 832 MiB; 1x/2x GUI runs pass visible-demand and texture-budget checks on original 10,000-page fixtures and the real file. Output-capacity and LRU experiments did not justify production changes. These are local Linux results and specific storage budgets, not global RAM limits or Windows validation. No parity or milestone percentage increase.

• 2026-10-08 (M14, #307, bounded saving): Full rewriting now uses private temporary caches and packs objects in batches limited by count and serialized bytes, preserving unknown objects, reference identity and encryption behavior without populating undo snapshots. Native render workers initialize only on a live request, avoiding unused parser copies during refresh/rebase. Three same-file Linux trials reduce rotate/full-save/close/reopen peak RSS from 3.69 to 1.06 GiB (35.53 to 32.51 s); incremental workflow RSS falls from 1.56 to 1.08 GiB. All 1,114 workspace tests pass (4 ignored); eight saved outputs pass external text/raster checks on 100 sampled pages each, and 1,010 navigation frames match. First use of each worker now pays parser initialization; steady-state viewing remains about 1 GiB. Single oversized objects, whole source/output buffers, and Windows behavior remain outside a global budget claim. No parity or milestone percentage increase.

• 2026-10-08 (M14, #307, research/comparison): Added a local external-reference suite outside the repository, using the same 9,156-page PDF with MuPDF, PDFium, Poppler and qpdf. Three Linux trials put the candidate's single-renderer 102-frame peak at 392 MiB, versus 348/347 MiB for MuPDF/PDFium with whole-file bytes (164/163 MiB with file input). The rotate/full-save/close/reopen workflow peaks at 3.69 GiB during serialization; incremental saving peaks at 1.56 GiB during rebasing. Different UI features, input/cache policies and writer compression settings prevent treating these as app rankings. Next targets are bounded object-stream packing, parsed-object lifetimes, snapshot overlap and file-backed input. No further runtime optimization or milestone percentage increase in this research step.

• 2026-10-08 (M14, #307, local candidate): Validated the 192.9 MB, 9,156-page VMware document in Linux. The original CLI exceeded a 10 GiB measurement cutoff before finishing inspection; the candidate inspects in about 1.8 s at 496 MiB and a 1,000-page navigation/close/reopen probe peaks at 990 MiB. It shares validated large resource indexes within each parser, reads panel structure on demand through COS with the previous inspector as a compatibility fallback, and scans standalone timestamps with temporary caches instead of retaining every object in the editor. Inspection output and 104 common sampled page renders match the handoff candidate. This is a different PDF revision from the original Windows issue; Windows GUI private memory and responsiveness remain unverified. No parity or milestone percentage increase.

• 2026-10-08 (M9, #179): Windows Current User Personal certificate store identities join file-based digital IDs, signing through CNG without exporting keys. RSA-2048 and ECDSA P-256 round trips use temporary certificates with cleanup guards; enumeration, missing identities, automation errors and the password-free UI have regression coverage. Smart cards and PKCS #11 remain planned; overall effort estimate unchanged.

• 2026-10-08 (M4, Combine files): Combine files is now its own tab instead of a dialog: a table of the files (name, pages, size, modified, warnings) whose columns sort, resize and move, with the layout kept in the settings. Files, folders (optionally with subfolders) and open documents can be added, or dropped on the tab; rows select like a file manager (Ctrl/Shift), move as a block by toolbar, Alt+arrows or drag, and every change undoes with ⌘Z. Problems show before Combine: password-protected files, security settings that withhold page assembly, bad page ranges (checked as typed), duplicates; protected files unlock with their open or permissions password, also headlessly (doc_combine passwords). The result is never encrypted, and the list says so. organize.combine-sort shipped; organize.combine-options partial (open files). Still missing: protecting the result in the same step, file-size and PDF/A options. Overall estimate unchanged (about 30–35%).

• 2026-10-08 (M14, French): Français (fr) is a complete interface catalog (about 1,880 entries), selected automatically for fr, fr_FR, fr_CA and other French locales, and from Preferences. Coverage tests check commands, All tools labels and every tl! literal; history labels keep captured names. Latin UI faces cover the catalog. Localization remains partial for Czech and Brazilian Portuguese; overall ≈ 30–35% (unchanged).

• 2026-10-08 (M14, right-to-left file names): A tab with an Arabic or Hebrew file name showed replacement boxes. The interface now takes an Arab face from craft-fonts when the build input has one, and on desktop falls back to one font installed on the machine for characters no embedded face has (PDFCRAFT_SYSTEM_FONTS=0 turns that off; README screenshots do). File names and paths in the tab strip, the recent-files list and Properties are put in display order, since egui joins the letters but does not reorder runs. Still missing: multi-line text (bookmarks, comments, search results), text input and a mirrored layout, so misc.rtl-ui stays planned; the craft-fonts revision pinned for releases predates its Arabic face, so release builds rely on the installed font until the pin moves. Overall estimate unchanged (about 30–35%).

• 2026-10-08 (community, M3, #214): In single-page view, when the whole page fits, the wheel turns pages: one per wheel notch, one per trackpad swipe including its momentum. The rail gets a Page display button between rotate and zoom with Acrobat's view choices (Fit to width scrolling, Fit one full page, Actual size, Zoom to page level, Fit visible, Read mode, Full screen) and the page layouts. Preferences gets Default page display and Default zoom, which every new tab uses. In continuous view, Fit page and Fit height fit the largest page, so mixed page sizes no longer jump while scrolling. Overall estimate unchanged (about 30–35%).

• 2026-10-08 (M14, Windows Chinese Auto): Auto now reads the Windows display language after locale environment overrides, selecting Simplified or Traditional Chinese through the existing locale mapping. Added Chinese region/script and Windows query regressions. Chinese font delivery remains incomplete. Localization remains partial; overall ≈ 30–35% (unchanged).

• 2026-10-08 (M3, themes): Toolbar and Display theme now share System, Light and Dark preferences, one command path and persistent settings; the duplicate View toggle is removed. Effective colours track the OS only in System mode, with egui popup styles kept in sync. Overall estimate unchanged (about 30–35%).

• 2026-10-08 (M14, Simplified Chinese): Added 208 translations, bringing the catalog from 1,625 to 1,833 entries. PhotoCraft-style coverage checks protect registered commands, All tools labels and UI tl! literals; generated history and diagnostic regressions preserve user values. Chinese font delivery remains incomplete: the release-pinned craft-fonts input has no Hans face and the web build only embeds the Japanese UI face (see #112 and #140). Localization remains partial; overall ≈ 30–35% (unchanged).

• 2026-10-08 (community, #135): CLI output exits cleanly when a pipe reader closes early. Other stdout errors return a failure instead of panicking, and command/file errors keep their diagnostics. Synthetic subprocess regressions cover closed pipes and a reader stopping after one line. Parity counts and effort estimate unchanged (≈ 30–35%).

• 2026-10-08 (community): Cut and stack in Print > Multiple: single-sided n-up sheets can be cut into cell piles and restacked in selected page order, with aligned gutter marks and blanks kept in their cells. Available through doc_print; duplex is refused. Grid-size overflow returns an error. No change to the parity count or the overall estimate (about 30–35%).

• 2026-10-07 (community, #208): Measure: distance, perimeter and area annotations (standard LineDimension/PolyLineDimension/PolygonDimension with rectilinear /Measure), persistent viewport scales with two-point calibration, vector snapping (endpoints, midpoints, intersections, paths) through nested forms, live readings, CSV export, and eight measure_* agent tools. Hardened on landing: snap extraction caps segments and snap targets page-wide and skips undecodable streams and over-deep q instead of failing; unsupported imported measurements (compound ft-in, fractional, invalid geometry) are listed as unsupported rather than failing the list; non-ASCII units ("m²") are allowed and rendered in WinAnsi; a closing duplicate polygon vertex counts as closed. Distance and scale are partial (single-unit decimal formats only; Acrobat interop untested). 51.0% shipped; ≈ 30–35% effort.

• 2026-10-07 (community, #190): Create PDF from Images offers embedded resolution, 72 DPI, or custom DPI (1–1200) without resampling. The engine and doc_create share the choice; Windows image context menus open the chooser through --create-images. Overall estimate unchanged (about 30–35%).

• 2026-10-07 (community, #161): The "Save changes?" prompt keeps a long file name inside the modal: the title wraps to the dialog width, so the centered panel no longer stretches past the viewport, clips its message and pushes Save/Cancel off-screen (Windows report). The password prompt's file-name line wraps the same way, and a regression test pins the title and all three buttons inside a 1365×719 screen. Parity counts unchanged; ≈ 30–35%.

• 2026-10-07 (community, #143): Windows MSI gets a full-UI welcome dialog with a "Create a desktop shortcut" checkbox (on by default; INSTALLDESKTOPSHORTCUT=0 for unattended installs), progress, files in use, repair/remove, and a "Setup completed successfully" screen with Finish (plus distinct failed/cancelled screens). Start Menu and desktop shortcuts are now plain links to pdfcraft.exe instead of advertised MSI shortcuts. Packaging checks the compiled MSI's shortcut, checkbox and dialog tables; the ARM64 smoke test checks both links' targets, their removal on uninstall, and the opt-out. Installer polish only; feature counts unchanged. ≈ 30–35%.

• 2026-10-07 (localization): The interface translates through the same system as PhotoCraft: one TSV catalog per language (crates/ui-egui/src/i18n/ja.tsv), the tl! macro, entries keyed by command id or with plural forms, and catalog tests (format, duplicates, placeholders, command ids). Catalogs are validated strictly (unknown escapes, reserved contexts, placeholders, ellipses, plural forms), a bad line is skipped and logged at run time, fmt substitutes in one pass, the drawing language is per thread, and each .tsv is an attributed asset (kind = "translation", checked by cargo xtask assets); validation, attribution and the language-switch control test folded in from #175. The 49 existing Japanese strings moved over unchanged, plus Auto. The language preference now defaults to auto (follow the system language; English when it has no catalog); en/ja still persist, and unknown values are rejected. Not covered: dialogs and panels, Windows system-language detection. ≈ 30–35% (unchanged).

• 2026-10-07 (session 16): PrintCraft is renamed PdfCraft: repo storytold/pdfcraft, crates and binaries pdfcraft*, bundle id ai.storyteller.pdfcraft. On first launch the app moves the old PrintCraft settings and crash-recovery folders to the new name, so upgrades keep recent files, preferences and unsaved work. No feature change. ≈ 30–35%.

• 2026-10-07 (community, #163): Fill & Sign shows saved signature/initials previews with add, change and remove controls in the quick picker and left panel. The editor loads the saved typed text or drawn strokes; Apply replaces future placements and Cancel preserves the saved value. Existing annotations stay unchanged. Long typed names shrink to the placement width and include glyph overhangs in preview/PDF bounds. Regression coverage includes persistence, removal/recreation, long names and the opt-in UI control channel. Parity counts and effort estimate unchanged (50.2% shipped, ≈ 30–35% effort).

• 2026-10-07 (fork, default-workspace-mode): Preferences ▸ Documents and view remembers the workspace used for newly opened PDFs. All Tools remains the default; explicit CLI/control mode overrides last for the session and PDF Initial View metadata stays independent. Overall estimate unchanged (≈ 30–35%).

• 2026-10-07 (community, M14, #112): Simplified Chinese (简体中文, zh-hans) as a catalog of about 1,600 entries; zh, zh_CN and zh-Hans locales follow it. In Simplified Chinese the craft-fonts Hans faces come before the Japanese ones, so Simplified-only characters don't sit on a different baseline.

• 2026-10-07 (community, M14, #140): Traditional Chinese (繁體中文, zh-hant, Taiwan vocabulary) as a catalog of about 1,800 entries; zh_TW, zh_HK, zh_MO and zh-Hant locales follow it. Drawn with the craft-fonts CJK faces (missing characters show replacement boxes).

• 2026-10-07 (community, M14, #141): Every dialog, panel, notice, shortcut list and native-picker title goes through the catalog (tl!, i18n::fmt), and Japanese grows from 49 to about 1,800 entries (ja.tsv); worker threads (export, OCR, actions) write their summaries in the UI language; history labels keep captured file and field names; the command palette searches translated and English labels and ids. Engine and OS error text is no longer matched against English templates: it is shown as is, inside a translated frame. Localization remains partial for other languages.

• 2026-10-07 (session 15): Five community issues, each with a regression test: in two-page view, Next page moves a whole spread (#77, #70); Export to Word opens in Word again, with control characters dropped and receipt-length pages kept within Word's 22 in, checked in Microsoft Word (#78, #72); macOS opens PDFs from Finder, Open With and the Dock (Apple events through the audited fmv-macos-events, PDF declared in the Info.plist), and the packaging no longer describes the image editor it was copied from (#82, #73); Add text keeps the box being typed when you click elsewhere, with Done and Discard beside it, reproduced and checked with real OS input (#86, #74); sharper, higher-contrast text, most visible on Windows, with every text colour at WCAG AA in both themes (#84, #76; the console window was already gone in 0.2.1). Still open: #79 (layered "not verified" signature appearances), #80 (native macOS menu bar), #81 (Homebrew and Scoop). P0 88%, P1 53%; 805 features 50.2% shipped (53.7% weighted). ≈ 30–35%.

• 2026-10-06 (community navigation): Linux-only middle-button vertical scrolling in the document and Organize grid, toggled by clicking the wheel, with cancellation that protects page tools and selection. Scrolling stays on after releasing the wheel, even if the pointer moved before release. Manual feedback led to a Chromium-style distance^2.2 speed curve, a 15-screen-point dead zone, and continuous redraws that use elapsed frame time; the former linear speed cap is removed. Headless UI/control regressions cover fractional movement, consistent travel at 30/60/120/144 fps, pause/resume and cancellation. Other platforms retain their existing middle-button input behavior, with a regression that checks the custom scroller neither blocks input nor changes the cursor or consumes Escape. No new dependency. Automatic scrolling remains partial because keyboard-started timed scrolling is absent. Overall effort estimate remains ≈ 30–35%.

• 2026-10-06 (session 14): Issues: move and resize existing text boxes in Edit text (#59, closes #40); Windows release builds open no console window and the Start Menu shortcut has its icon (#58, #57; rolled out to every Craft app); native Windows ARM64 installers, installed and run on an ARM64 runner in CI (#66, #71; the intermittent ARM64 test crash was a WARP shader-JIT race between parallel GPU-rendering tests, not our code); XFA forms are detected and explained instead of failing silently (#65, #60 stays open for real XFA). Also: squiggly underline tool, comment opacity, Preferences ▸ Identity, drag-and-drop/hover tests; community table export to Word/HTML/RTF (#62, with linear-time detection and a column cap). #63 (timestamps/LTV with outbound network) held for review fixes and an owner decision on network access. ≈ 30–35% (unchanged).

• 2026-10-06 (community, #68): Interface language: Czech (Čeština, ui.set language=cs) joins English and Japanese. It translates every registered File/Edit/Pages/View/Help command and every label routed through the translation table, with tests that fail when a menu label lacks Czech; the interface fonts are tested to cover Czech diacritics. Dialogs and panels remain English (misc.prefs-language: partial).

• 2026-10-06: M1: invalid object-number ranges in xref tables and streams take the existing reconstruction path, with the reason recorded, instead of overflowing or aliasing another object. Synthetic open/repair regression added. Overall estimate unchanged (≈ 30–35%).

• 2026-10-05 (session 13, later): FreeBSD: CI builds and tests the workspace in a FreeBSD 14.3 VM (#45) and the release ships a FreeBSD x86_64 tarball, checked in CI (#42); README lists FreeBSD. Fuzzing: the nightly job's 11 hangs fixed (#41: our parser's exponential retries, inline images, Type 3 fan-out), plus a JBIG2 hang (#43, vendored hayro-jbig2) and a Type 1 font stack overflow (#46, skrifa 0.47); a full run now finds 0 crashes. Landed community PRs #36 (text editing, Japanese replacements), #47 (English/Japanese interface) and #48 (XFDF colour crash). Windows launch crash with Intel's Vulkan driver fixed by using Direct3D 12 (#49, issue #37); one copy of the Japanese font instead of two (#51, −8.3 MB); full screen and About get real tests (#50). P0 88%, P1 52%. ≈ 30–35%.

• 2026-10-05 (community, #47): Interface language: Preferences ▸ Interface language switches English/Japanese and persists (ui.set language=ja|en, reported by ui.state). Core menu labels are translated; dialogs, panels and more languages remain open (misc.prefs-language: partial).

• 2026-10-05 (session 13): Landed community PRs #3–#7 and the never-crash rollout (#11–#25); CI green on every job for the first time in 30+ runs (clippy 1.99, Windows line endings, perf-test noise); nightly fuzz job made to finish (child memory cap) and its findings fixed: 7 out-of-memory crashes (#27, #29, #30) and 11 hangs (in review); issue #8 (integrated GPU, keyboard save prompt); Help ▸ Check for updates (manual only). Added the honest assessment and gap list above. P0 88%, P1 52%; 804 features 49.5% shipped (53.3% weighted). ≈ 30–35%.

• 2026-10-03 (session 12, later): Forms (merge data into a spreadsheet, Actions tab, automatic field detection and naming), Compare files (new compare crate: text and visual differences, panel, report, comments), Action Wizard (built-in and custom actions over files), PDF/A verify and Save as PDF/A (new preflight crate), Export to Word/HTML/RTF (new export crate). P0 88%, P1 52%; 803 features 49.6% shipped (53.3% weighted). ≈ 39%.

• 2026-10-03 (session 12): Edit text and images in place (lines, paragraphs, formatting, existing images), Scan & OCR (new ocr crate on ocrs with CC-BY-SA models fetched by cargo xtask models: searchable image, page ranges, multiple files), Acrobat JavaScript (new js crate on boa: custom field scripts in Acrobat's event order, button scripts, document JavaScripts, console, Enable JavaScript preference, sandbox limits). 110+ tools; P0 88%, P1 48%; 803 features 47.9% shipped (51.1% weighted). ≈ 37%.

• 2026-10-02 (session 11, later): Sign with macOS Keychain identities, Add alternate text, Advanced Search panel, space audit and link clean-up in the Optimizer, hybrid-reference files, signed documents protected from rewrites, redaction cleans the tags, custom stamps, image fields, Combine files with page choice. 97 tools; P0 82%, P1 45%. ≈ 30%.

• 2026-10-02 (session 11): Accessibility Checker (new a11y crate: all 32 rules, report, fixes, options dialog and results panel), MCP resources for page images and text, revisions (list, open an earlier one), export all images, fit visible, form Preview and locked fields, document title in the window; plus attachment comments, eraser, date picker, duplicate/align/distribute fields. 91 tools; P0 80%, P1 43%. ≈ 29%.

• 2026-10-02 (session 10, last): Manual tab order, backgrounds/watermarks from files (PDF pages as forms, images), Initial View and reading options (honoured on open), bookmarks expand/collapse, make-default comment properties, required-field borders, cut/copy/paste pages, marquee zoom, snapshot. 85 tools; P0 80%, P1 ≈ 27%.

• 2026-10-02 (session 10, latest): PDF Optimizer and real Reduce File Size (new optimize crate: effective-resolution image downsampling, recompression, discards), Field Properties ▸ Options for every field type, Redaction Properties overlay styling, drag-to-reorder pages, repair notice and log; signature revalidation made incremental (comment edit on a 120 MB signed file 84 → 6 ms). 84 tools; P0 parity ≈ 80%. ≈ 27%.

• 2026-10-02 (session 10, later): Digital signatures (new sign crate: PKCS #12, X.509, CMS; PAdES B-B signing incl. certification; validation with trust store and DocMDP-aware change detection; Signatures panel, message bar, sign and digital ID dialogs; signed documents keep incremental saves), polygon/cloud/connected-lines/callout/caret comments, Create PDF from clipboard, comment filters by colour and checkmark. Verified against pdfsig and OpenSSL. 83 tools; P0 parity 78%, P1 22.5%. ≈ 26%.

• 2026-10-02 (session 10): Viewer conveniences (fit height, view history, cover page, close all, revert, system theme, find options), XFDF/FDF and form data exchange (new xfdf crate), stamps, organize extras (split by bookmarks/size, Extract and Rotate Pages dialogs), links (Link tool and properties, create from URLs), comment review (checkmarks, locking, copy text, hide all, summaries). Fixed the Comments panel's "…" menu, which chased the pointer. 79 tools; P0 parity ≈ 73%, P1 ≈ 19%. ≈ 23%.

• 2026-10-02 (session 9, later): Print (n-up, booklet, poster, preview, CUPS), export JPEG/TIFF and create from TIFF/GIF/BMP, add text and images that stay editable, form formats/validation/calculation run natively (Acrobat's AF functions), field appearance, tab order, push buttons, 500-page frame budget. 67 tools; P0 parity ≈ 73%. ≈ 21%.

• 2026-10-02 (session 9): Prepare a form (field authoring, Field Properties), Redaction (new content and redact crates: glyph/image/vector/XObject removal with verification, Search & Redact patterns, full-rewrite saves), Remove hidden information and Sanitize. 59 agent tools; P0 parity ≈ 63%. ≈ 18%.

• 2026-10-01 (session 8):

  • Commenting: sticky notes, highlights, underline, strikethrough, text boxes, freehand, lines, arrows, rectangles and ovals, with replies, status, colours, moving and resizing; Acrobat-style quick bar and Comments panel; six agent tools (an agent can highlight a phrase by naming it).
  • Protect Using Password, with Acrobat's permission levels and compatibility options; Remove security.
  • Filling in forms: text, check boxes, radio buttons, combo and list boxes, Tab between fields, Clear form; three agent tools.
  • Performance: opening a 190 MB manual went from 172 s to under 2 s; comment and form edits on it are 6× faster.
  • Fixed: saving a password-protected document failed; encrypted documents were not reported as encrypted.
  • Set Page Boxes, a Crop tool and Duplicate pages.
  • Header & footer (page numbers, dates, Bates numbers), watermarks and backgrounds, with Update and Remove.
  • Export to PNG and text; create PDFs from images, text or nothing; Reduce file size.
  • Fill & Sign: typed text, marks, the date and a drawn signature.
  • Comment properties, filtering and sorting; flattening comments and form fields.
  • Fixed: the Hand tool did not pan.
  • 50 agent tools.
  • Overall ≈ 16%.

• 2026-10-01 (session 7):

  • Bookmark editing and page numbering (Number pages), with undo, agent tools and UI.
  • A render watchdog: pathological pages are skipped after 20 s instead of spinning forever.
  • The agent control channel no longer reports success when the window is hidden.
  • Community links: Discord button in the title bar, plus Home, About, Help menu, CLI and README.
  • Overall ≈ 10%.

• 2026-10-01 (session 6):

  • UI control channel: agents can inspect the widget tree, click, type, press keys, run commands and take screenshots of the running app. Off unless the app is started with --control; loopback only, token-authenticated.
  • Combine and insert store identical fonts, images and other resources once. 40 copies of the showcase: 130 MB → 3.9 MB, 3× faster, pixel-identical.
  • Full saves use compressed object streams (showcase 3.4 → 2.8 MB; the 40× combine is now 2.3 MB). Fixed opening encrypted files whose catalog is compressed, and a crash on looped page trees.
  • Fuzzing (cargo xtask fuzz, nightly in CI): about 150,000 mutated files tried. Seven crash and hang bugs found and fixed, each with a regression test: two in our code, five in the temporary renderer.
  • Parity checklist: 826 Acrobat Pro features tracked in parity/acrobat-features.toml; cargo xtask parity checks every claim against code and tests. 11.8% shipped overall, 31.6% of P0.
  • Overall ≈ 9.5%.

• 2026-09-30 (session 5, after a machine crash; no work lost):

  • Agent control: new pdfcraft-automation crate with 20 JSON-Schema tools, an opt-in MCP server (pdfcraft-cli mcp, stdio only, can be compiled out), and pdfcraft-cli run/tools.
  • Text on rotated pages now reads along its lines; the pdf.js oracle is unchanged at median 0.980.
  • Finding text in 520 pages: 17.9 s → 3.7 s (parallel), about 20 ms when repeated (cached).
  • CI: dependency licence audit (deny.toml, xtask deny) and a GitHub workflow for macOS, Windows, Linux and wasm.
  • Overall ≈ 8%.

• 2026-09-30 (session 4):

  • Combine, extract and split, with links, named destinations, fields, layers, attachments and nested bookmarks all carried over. Combined pages render pixel-identical to their sources.
  • Fixed a precision bug in how reals were written.
  • Encryption: a new crypt crate covering R2–R6. Encrypted documents can be opened, edited and saved; permissions are honoured; the Security tab is real. Checked against hayro and qpdf.
  • Autosave and crash recovery.
  • Command registry.
  • Asset policy (AGENTS.md, ATTRIBUTION.toml, xtask assets) and a README with 13 reproducible screenshots (xtask screenshots).
  • Overall ≈ 7%.

• 2026-09-30 (session 3):

  • New crates: filters (every non-image filter, 57 tests) and cos (object parser, xref reader, repair, incremental and full writer).
  • New organize crate: page operations and info edits.
  • Engine: editing with undo/redo and save. CLI: edit.
  • UI: organize toolbar with multi-select, ⌘Z/⇧⌘Z/⌘S/⇧⌘S, Edit menu, editable Description properties, a dot on tabs with unsaved changes, and a save prompt on close and quit. 13 new kittest tests.
  • Corpus: open, edit and save round-trip on 946 of 951 files. 182 of 182 sampled saved outputs pass qpdf --check.
  • Overall ≈ 5%.

• 2026-09-30 (session 2):

  • Robustness sweep (963 of 983 files open, 0 crashes), text layer, find and select, tiles, web build, polish.
  • Overall ≈ 3–4%.

• 2026-09-30 (session 1): planning complete; viewer vertical slice.

• M13: common command, batch, inspection and bounded preview tools share the existing confined automation path. MCP tools carry complete hints and reject unknown top-level keys as invalid parameters.

• 2026-10-10 (UI docking): Tools and Inspector can be regrouped, split beside the PDF, or floated inside the app window. Existing toggles reopen panels at their saved locations; UI commands arrange/reset panels, and preferences retain their layout. Read/full-screen modes preserve the focused document view. No milestone percentage change.

Revision history

Date	Change	Summary
2026-10-10	minor	Readiness table with hours per audience; full number restated as the additive weighted sum over dimensions (47% → 49%; method aligned with the standard, no new evidence)
2026-10-10	minor	Essentials-user score added (≈ 66%)
2026-10-10	minor	Gate consistency check: convert and share re-judged partial, not blocking; stage pre-alpha → alpha
2026-10-10	minor	Second look: ready 40% → 47% (cross-cutting double count removed), mainstream-practitioner numbers and user sentiment added; core-workflow alpha gate applied, stage alpha → pre-alpha
2026-10-10	major	Restructured to the progress-docs standard (stage, two numbers, dimensions, features, languages, upcoming, log); full re-measure; assessment, gaps and milestones moved to docs/; log sorted newest first and a stray merged entry dated
2026-10-07	minor	806 tracked features, 51.0% shipped, effort-weighted ≈ 30–35%, 600–1,100 h
2026-10-05	major	Honest assessment and "Where we're lacking" added