pdfcraft/docs/roadmap.md

PdfCraft roadmap: milestones and what's next

Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: minor (M13: CLI check visits each directory once through aliases and cycles; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: minor (M4: Extract and Split preserve shared Type 3 glyph resources; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: minor (M2: packed TIFF-predictor RGB rows retain their byte boundaries; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: minor (M3 #1364 candidate: consent before absolute local GoToR access; estimates unchanged); earlier: minor (M1 #1339: unchanged incremental saves of a classic cross-reference table write a zero-length subsection; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: minor (M5 #1398: stamps read upright on rotated pages; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: minor (gap 6: #1317, #1327, #1302, #1315, #1340; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: minor (M7 #1316: replacing a line keeps a neighbouring line whose glyph box overlaps; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: minor (M1 #1339: unchanged incremental saves of a classic cross-reference table write a zero-length subsection; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: minor (M3: Windows' Animation effects setting is followed, and Preferences has Animation effects; earlier: exclusive image-crop resize follow-up; M2: short same-line redraws split before placement; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: minor (M7: inline Arabic ActualText ligatures join their word; earlier: preserve Arabic ActualText typing order; M3: Windows' Animation effects setting is followed, and Preferences has Animation effects; exclusive image-crop resize follow-up; M2: short same-line redraws split before placement; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: minor (M7: local GoToR links and confined automation candidate; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: exclusive image-crop resize follow-up; minor (M2: short same-line redraws split before placement; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-12 · Last updated: 2026-10-12 · Change: exclusive image-crop resize follow-up; minor (M2: short same-line redraws split before placement; earlier: M10, printing on the web through the browser's print dialog, gap 4, rank 1 65–120 → 50–90 h) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-10 · Last updated: 2026-10-12 · Change: minor (M10, #1028: OCR reads pictures on pages that have text, on request; earlier: direct Organize overview and page actions; localized shortcut labels, #496; alpha gate added; convert-and-share re-judged with the cross-app rule → alpha) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-11 · Last updated: 2026-10-11 · Change: minor (M13/#971: bound per-page search match allocation; text cache byte budget and extraction warnings remain open) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-10 · Last updated: 2026-10-11 · Change: minor (#594 paragraph drags validated in the Linux test environment; localized shortcut labels, #496; alpha gate added; convert-and-share re-judged with the cross-app rule → alpha) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-10 · Last updated: 2026-10-11 · Change: minor (architectural paper controls from #599; M6: respect existing form-font encodings; retain source fonts on appearance fallback; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-10 · Last updated: 2026-10-11 · Change: minor (direct Organize overview and page actions; localized shortcut labels, #496; alpha gate added; convert-and-share re-judged with the cross-app rule → alpha) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-10 · Last updated: 2026-10-11 · Change: minor (closed issues synced: #774, #756, #817–#821, #809, #819, #816, #844; earlier: localized shortcut labels, #496; alpha gate added; convert-and-share re-judged with the cross-app rule → alpha) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-10 · Last updated: 2026-10-11 · Change: minor (M6: respect existing form-font encodings; retain source fonts on appearance fallback; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-10 · Last updated: 2026-10-11 · Change: minor (M6: keep accepted form values when Tab reopens the same field before Save; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-10 · Last updated: 2026-10-11 · Change: minor (M13: reject malformed CLI --root options before dispatch; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS) Last reviewed: 2026-10-10 · Last updated: 2026-10-11 · Change: minor (Traditional Chinese accessibility semantics and Taiwan form/table terminology; estimates unchanged) · Target: Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)

Forward-looking: the milestones, the current focus and what comes next. The parity numbers behind it are in target-app-parity.md, the ranked work list in gaps.md, and the one-page summary in ROADMAP.md. Detailed task lists and acceptance tests live in plan/execution-plan.md (local-only, gitignored).

Keep it current: update the milestone row and the ROADMAP.md progress log at the end of every session; re-estimate when a milestone lands.

Alpha gate

The stage standard's gate: Acrobat Pro's everyday core workflows must each work end to end on the main platform (macOS), with the work saved and reopened. Any no, or a partial that blocks the workflow, keeps PdfCraft pre-alpha; those rows are the alpha checklist. Assessed 2026-10-10 with the rule applied across the Crafting Apps: a row blocks only when a typical user cannot complete the workflow at all with the app on its main platform for typical inputs; degraded fidelity, lossy exchange with Acrobat users or a missing sub-case is partial, not blocking (a beta item).

Core workflow	Works end to end?	Evidence	Hours to pass
View, search and print	yes	Render, find, select, panels, tiles; 500-page scrolling test; Print with CUPS on macOS/Linux, the Windows spooler and, on the web, the browser's print dialog. Rendering borrowed from hayro	0
Organize, combine and split pages	yes	organize.* P0s shipped with tests; links, fields, layers and bookmarks carried over; page deletion drops dangling destinations and the opening action (#817, #821)	0
Comment and review	yes	Every markup type with appearances, replies, status, XFDF/FDF; comments saved in the PDF reopen in other readers; XFDF keeps polygon vertices and callouts (#809, #819)	0
Fill and sign forms	yes	All AcroForm field types, Acrobat's AF functions, Fill & Sign, PAdES signatures validated with pdfsig/OpenSSL	0
Edit text and images	partial, not blocking	Editing a paragraph of Latin text works (embedded font reused, else Helvetica substituted, rewrapped); added text and images stay editable. Several objects on one page move together (#844), not across pages. Fails for CJK/RTL (#766); a beta item (gap 3)	0 (beta: 100–180)
Convert and share (Office ↔ PDF, password protection)	partial, not blocking	PDFs we save open in Acrobat and other readers (958-file corpus round trip, qpdf --check), password-protected ones too since #836 (#774: Acrobat DC opens AES-256 and RC4-128 output); export to Word, RTF, HTML, text and images works, lossily (#773: an invoice's layout lost in Word); Create PDF works from images, text, the clipboard and many files at once. Missing sub-cases: an in-app Create PDF from Office (Office on macOS saves PDF itself), Excel/PowerPoint export. Beta items (gap 8)	0 (beta: 32–55 for Office→PDF and a layout-keeping Word export)

Result: alpha. Every core workflow can be completed on macOS; two are lossy or missing sub-cases (editing CJK/RTL text; Office→PDF, Word layout), which are the first beta items. Ready for real work, ≈ 49%, is inside the alpha band. (A first application of the gate the same day judged convert and share as blocking and put PdfCraft at pre-alpha; re-judged with the shared rule, encryption and Office→PDF are sub-cases and Word export is lossy, not absent.)

Current focus

In order. Each item names its entry in gaps.md.

1. Convert and share: Create PDF from Office and a Word export that keeps layout (gap 8, #773). Encrypted output that Acrobat opens shipped with #836 (#774).
2. Fix the crash and wrong-result reports filed against shipped features (gap 6). The first batch (#799–#821, including the panic in #816) is fixed.
3. A Chinese UI face in releases (gap 5, #826).
4. A fidelity harness against Acrobat, then the renderer decision (gaps 12 and 2). Owner decision needed: our own M2 devices, or #841's proposal as the bridge.
5. Editing existing content (gap 3, M7): fonts, subsets, reflow, CJK and RTL.
6. Pro workflows: OCR languages (gap 7), Office export/import (gap 8), Preflight and PDF/A/X/UA (gap 9), signatures with tokens, timestamp servers and online LTV (gap 10), accessibility tagging (gap 11).
7. 1.0 polish (M14): performance budgets and lazy loading (gap 13), right-to-left layout and the missing languages (gap 14), keyboard-only operation, a screen-reader audit.

Decided against for now (owner, 2026-10-05): self-installing updates and an update check at start. Help ▸ Check for updates is manual only.

Milestones

"Plan size" is the original single-agent sizing. "Done" is the estimated share of that milestone's acceptance criteria that are met, not lines of code. "Remaining" is re-measured on 2026-10-10 at the measured rate (see target-app-parity.md); the total matches the parity estimate.

M	Milestone	Plan size (h)	Done	Remaining (h, 2026-10-10)	Notes
M0	Skeleton: workspace, xtask gates, CI	15–30	98%	1–2	GitHub workflow, deny.toml (licence audit of every dependency), parity checklist (826 features, xtask parity) done. Missing: remaining crate stubs, testkit/oracle crates
M1	COS: filters, crypt, parser, xref, writer	120–200	80%	20–40	Done: - filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption; - cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing. Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open. Full saves now pack objects into compressed object streams. An unchanged incremental save of a classic table writes a zero-length cross-reference subsection instead of a section with no subsections (#1339). Fuzzing runs nightly (xtask fuzz). Missing: ≥ 250 tests, own image codecs
M2	Model, render, text	200–350	15%	130–230	hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering.
M2	Model, render, text	200–350	15%	130–230	hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings
M3	Viewer app (native + web)	80–150	90%	10–20	Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in.
M2	Model, render, text	200–350	15%	130–230	hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. A custom text match that ends on a reconstructed separator stops before the next glyph (#1315). Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings
M2	Model, render, text	200–350	15%	130–230	hayro bootstrap renderer (vendored patches); Lab Bradford adaptation uses LMS white-point ratios, covered by independent neutral/chromatic and direct/Indexed render oracles; inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings
M3	Viewer app (native + web)	80–150	90%	10–20	Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171).
M4	Engine, history, save, organize	100–180	95%	8–15	Done: - command registry (menus, shortcuts and palette all use it); - undo/redo; incremental, atomic and encrypted saves; - autosave and crash recovery; - organize, combine, extract, split and insert-from-file, with identical fonts and images stored once; - CLI edit/combine/extract/split. Done since: Organize opens directly into the page overview, with checkbox selection, an editable page-range selection (#1092), and per-page rotate/delete controls; Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI run, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Extract and Split preserve shared Type 3 glyph resource graphs, retaining conservative pruning limits. Missing: page transitions, recovery on the web
M3	Viewer app (native + web)	80–150	90%	10–20	Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Renderer-creation errors return to the existing OpenGL startup fallback; a real-GPU regression covers errors and device reuse. The underlying x86 DX12 shader compiler failure remains unresolved; see windows-renderer-startup.md. With Windows' Animation effects turned off, the wheel scrolls and zooms without easing and egui's animations take no time (motion.rs; macOS, Linux and the browser aren't asked yet); Preferences ▸ Animation effects (Use system setting, On, Off) decides it on every platform.
M4	Engine, history, save, organize	100–180	95%	8–15	Done: - command registry (menus, shortcuts and palette all use it); - undo/redo; incremental, atomic and encrypted saves; - autosave and crash recovery; - organize, combine, extract, split and insert-from-file, with identical fonts and images stored once; - CLI edit/combine/extract/split. Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI run, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web
M5	Comments (all annotation types, XFDF)	120–200	88%	12–25	Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools. Done since: stamps placed on a rotated page read upright (#1398); polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page
M5	Comments (all annotation types, XFDF)	120–200	88%	12–25	Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export (partial imports preserve existing reply and review-status links); flatten; Fill & Sign with adjustable text/date size; agent tools. Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. A refused restyle or resize of a text box another program drew leaves that comment unchanged (#1327). Make Current Properties Default on an arrow updates arrows, not plain lines (#1302). Flattening keeps a visible comment it cannot draw (#1317). Missing: custom stamps, replace-text proposals, summary layouts with the page
M6	Forms + JavaScript	160–320	50%	40–75	Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done. Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA
M7	Content editing (text, images, header/footer, watermark)	250–500	20%	100–180	Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Done since: Edit text preserves Arabic/Hebrew /ActualText typing order, with font-independent regressions; single-glyph RTL ligature spans (including lam-alef) join their surrounding word. Done since (#1116): editable text regions grouped across compatible words and subset fonts, one rich-text editor over a background with the source text removed, embedded sfnt faces reused as editor faces, and visible (clipped) bounds for cropped-image selection and resize. Exclusive crops now resize across nested states and content streams, with shared clips fixed. Done since: #594 ordinary paragraph drags preserve overlapping source text; UI/engine regressions, native save/reopen, independent-reader checks and full CI passed in the Linux test environment. #1200 candidate: local GoToR links open in desktop tabs and through root-confined automation; appearance-only edits preserve existing actions. Named destinations remain unapplied and /NewWindow is a tab hint. Missing: editing existing text and images in place (the longest pole), image/PDF watermarks
M7	Content editing (text, images, header/footer, watermark)	250–500	20%	100–180	Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Done since: Edit text preserves Arabic/Hebrew /ActualText typing order, with font-independent regressions. Done since (#1116): editable text regions grouped across compatible words and subset fonts, one rich-text editor over a background with the source text removed, embedded sfnt faces reused as editor faces, and visible (clipped) bounds for cropped-image selection and resize. Exclusive crops now resize across nested states and content streams, with shared clips fixed. Done since: #594 ordinary paragraph drags preserve overlapping source text; UI/engine regressions, native save/reopen, independent-reader checks and full CI passed in the Linux test environment. #1200 candidate: local GoToR links open in desktop tabs and through root-confined automation; appearance-only edits preserve existing actions. Named destinations remain unapplied and /NewWindow is a tab hint. #1316: replacing a line or paragraph keeps a neighbouring line whose glyph box overlaps when the baselines differ; a second copy on the same baseline is still replaced. Missing: editing existing text and images in place (the longest pole), image/PDF watermarks
M7	Content editing (text, images, header/footer, watermark)	250–500	20%	100–180	Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), watermark print/screen visibility and repeat
M6	Forms + JavaScript	160–320	50%	40–75	Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done. Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA Done since: Existing simple field-font encodings and Differences are respected when generating appearances; an unencodable value uses a separate Helvetica appearance font without changing the source font. Synthetic reopen regressions cover punctuation, subset fallback and multiline text. Exact font metrics/layout and broader Unicode fallback remain incomplete.
M6	Forms + JavaScript	160–320	50%	40–75	Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done. Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA Done since: Tab and Shift-Tab wrapping to the same field or another widget of that field refresh the newly opened editor from the accepted value before Save. Synthetic UI regressions cover both directions, same-frame Save, validation refusal and undo/redo.
M7	Content editing (text, images, header/footer, watermark)	250–500	20%	100–180	Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), image/PDF watermarks
M8	Security + redaction	100–180	68%	15–30	Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize. Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and redact_mark). Redaction cleans indirect and form structure references, preserving surviving form tags. Vertical-writing text is still refused, and the error no longer claims the text was under the mark (#1340). Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding
M8	Security + redaction	100–180	68%	15–30	Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize. Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and redact_mark). Redaction cleans indirect and form structure references, preserving surviving form tags. Redaction retires inherited resource dictionaries, so a parent /Pages can't keep a removed XObject reachable; unredacted pages are left untouched. Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding
M9	Signatures (PAdES, validation)	160–280	60%	40–70	Done: new sign crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL. Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites. Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11
M10	OCR, create, export, print	200–350	33%	120–215	Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, the CUPS and Windows spoolers, print-ready PDF). Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; architectural/ANSI/large ISO sheet presets, Match page at 100% and PDF-scale preview (#599 follow-up); Create PDF from multiple files (PDFs, images and text, edited as pages in the grid); OCR can also read pictures on pages that have text, without adding that text twice (#1028). Done since: Word invoice export uses borderless inferred tables, floating positioned text/artwork only where text overlaps an image or is rotated, and per-page sizes, covered by synthetic invoice automation regressions (#773); printing on the web through the browser's print dialog, sheets drawn by PdfCraft (gap 4). Missing: OCR languages beyond Latin, editable-text OCR output, full Office layout fidelity/import
M11	Optimize, preflight, PDF/A/X/UA, print production	200–350	18%	80–140	Done: new optimize crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA
M12	Accessibility, compare, measure, search, XFA	200–380	30%	90–160	Done: new a11y crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded, text-only auto-tag proposal tool for one page. Missing: writing proposed tags and parent tree, field autotag, visual Tags/Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA
M13	Automation (MCP, Action Wizard, CLI) + AI providers	60–120	45%	25–45	Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI run/tools (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. text_find also caps the per-page match ranges it materializes at the remaining result limit plus one continuation match. CLI robustness scans visit each directory once through overlapping roots and symlink aliases.
M12	Accessibility, compare, measure, search, XFA	200–380	30%	90–160	Done: new a11y crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools). Locatable figure, annotation and form findings highlight their page bounds. Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export; a bounded text-only auto-tag proposal tool; text-only Apply writes marked content, paragraph tags and a parent tree, then opens the Tags panel for review. Missing: mixed-content and field autotag, heading/list/table/figure classification, Order/Content panels, Reading Order tool, compare, geospatial/3D measurement, search index, XFA
M13	Automation (MCP, Action Wizard, CLI) + AI providers	60–120	45%	25–45	Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI run/tools (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. text_find also caps the per-page match ranges it materializes at the remaining result limit plus one continuation match.
M14	1.0 polish: performance, localization, installers	120–250	15%	80–150	Done: PhotoCraft's translation system (i18n/: TSV catalogs, tl!, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through tl!. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese and Arabic (logical-order catalog put into display order; layout not yet mirrored); Czech covers the menus. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Edits let go of the previous working file before writing the next (a 1 GiB file peaks at two copies while editing, not three; gap 13). Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Lithuanian adds a 2,578-entry catalog and date names, reviewed by a native-speaking contributor. Validated candidate (macOS raster probe; Windows runtime unverified): the Windows policy changes only embedded JetBrains Mono; horizontal alpha-edge energy per ink improves 2.78%, 3.87% and 1.59% at 100%, 125% and 150%, and is down 0.79% at 200%. Inter is pixel-identical; layout hashes, glyph coverage and the 8 MiB atlas are unchanged. Timing and RSS ranges overlap, with no improvement claimed. Estimates unchanged. Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation
M13	Automation (MCP, Action Wizard, CLI) + AI providers	60–120	45%	25–45	Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI run/tools (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers
M14	1.0 polish: performance, localization, installers	120–250	15%	80–150	Done: PhotoCraft's translation system (i18n/: TSV catalogs, tl!, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through tl!. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese and Arabic (logical-order catalog put into display order; layout not yet mirrored); Czech covers the menus. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Edits let go of the previous working file before writing the next (a 1 GiB file peaks at two copies while editing, not three; gap 13). Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Traditional Chinese accessibility statuses, rule semantics and Taiwan form/table terms have catalog regressions. Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation
	Total	2,085–3,840	≈ 49% ready	≈ 770–1,400	Area view of the same work: target-app-parity.md

Upcoming milestones, ranked

Rank	Next milestone	Closes	Estimate (h)
0	Convert and share: Create PDF from Office, Word export keeps layout	part of gap 8	32–55
1	Backlog and platform: crash and wrong-result reports fixed, Chinese UI face (web printing done)	gaps 5, 6	50–90
2	Fidelity harness and renderer decision (M2)	gaps 2, 12	110–190
3	Editing existing content (M7)	gap 3	100–180
4	Pro conversion: OCR languages and clean-up, Office export/import (M10)	gaps 7, 8	95–175
5	Standards: Preflight, PDF/A all parts, PDF/UA, PDF/X (M11)	gap 9	65–115
6	Signatures for institutions: PKCS #11, timestamp servers, online LTV (M9)	gap 10	40–70
7	Accessibility tagging (M12)	gap 11	40–70
8	1.0 polish: performance, RTL, languages, keyboard-only (M14)	gaps 13, 14	55–95

Beta needs ranks 1–7 in substance (≈ 400–700 h; see target-app-parity.md).

Critical path

M0 → M1 → M2 → M3 → M4 had to happen in order, and did, except that M2's own renderer was deferred behind the hayro bootstrap. After M4, M5–M13 run in parallel across crates. The long poles are M2 (renderer), M7 (content editing), M10 (OCR and Office), M11 (Preflight and standards) and M12 (tagging and XFA).

Risks most likely to push estimates up

• Fidelity of text editing: fonts, subsets, reflow, CJK and RTL.
• XFA dynamic layout on real government and bank forms.
• Real-world signature chains, revocation and tokens.
• The rendering long tail: Type 3 fonts, broken fonts, shadings, blend modes.
• Correctness of PDF/A, PDF/X and PDF/UA conversion.
• Interoperability: files other readers (above all Acrobat) reject, as in #774 (fixed by #836; no automated interop suite yet).
• OCR and AI quality limited by what openly licensed models exist.
• CPU rendering performance on the web.
• Hostile input: every fuzz run so far has found new crashes or hangs.
• Unmeasured fidelity: without an Acrobat comparison harness, quality gaps surface as user reports.

Revision history

Date	Change	Summary
2026-10-12	minor	M13: CLI check directory identity, with overlap and symlink regressions; estimates unchanged
2026-10-12	minor	M4: shared Type 3 glyph resources survive extraction, with save/reopen and independent raster regressions; estimates unchanged
2026-10-12	minor	M2: packed TIFF-predictor RGB row boundaries, with decoding and page-render regressions; estimates unchanged
2026-10-12	minor	M3/#1364 candidate: absolute local GoToR links require desktop consent or headless allow_absolute; existing relative navigation and validation retained. Estimates unchanged.
2026-10-12	minor	M7: single-glyph RTL ActualText ligatures join their word in Edit text. Regressions cover marks, two-byte codes, replacement and save/reopen; multi-glyph logical spans retain their order. Estimates unchanged.
2026-10-12	minor	M5 #1398: rubber stamps, explicit image rectangles and PDF-page stamps read upright on rotated pages. Estimates unchanged.
2026-10-12	minor	M12: text-only auto-tag Apply writes real structure and parent-tree links, with undo and Tags-panel review; mixed content remains unsupported. Estimates unchanged.
2026-10-12	minor	M7 #1316: replacing a line or paragraph keeps a neighbouring line whose glyph box overlaps; same-baseline copies are still replaced. Estimates unchanged.
2026-10-12	minor	M1 #1339: unchanged incremental saves of a classic cross-reference table write a zero-length subsection. Estimates unchanged.
2026-10-12	minor	M12: bounded text-only auto-tag preview through the engine and automation; actual PDF structure writing and visual review remain open. Estimates unchanged.
2026-10-12	minor	M7: keep added Arabic copy/search in typing order with per-line ActualText; preserve that order in the editor and keep visual runs separate. Font-independent regressions and tool save/reopen coverage; font fallback and bidi typing remain partial. Estimates unchanged.
2026-10-12	minor	M3: case-insensitive Find matches normal, final and capital Greek sigma; exact search, word boundaries, glyph ranges and match limits have regression coverage. The tab-menu test uses Finder on macOS. Estimates unchanged.
2026-10-12	minor	M14: Windows low-DPI JetBrains Mono hinting candidate; raster and layout evidence recorded without a Windows runtime claim. Estimates unchanged.
2026-10-12	minor	M7/#1200 candidate: bounded local GoToR opening, root-confined automation, and action-preserving appearance edits; named destinations and window behavior remain partial; estimates unchanged.
2026-10-12	minor	Exclusive image crops resize with their pixels across nested states, intervening operators and content streams; shared clips remain fixed. Synthetic engine/tool regressions and private image save/reopen checks; estimates unchanged.
2026-10-11	minor	M4: editable Organize page-range selection (#1092), synchronized with thumbnails and available through UI control. Estimates unchanged.
2026-10-11	minor	M10: Word invoice export regressions (#773); estimates unchanged.
2026-10-12	minor	M2: short same-line redraws split before placement; estimates unchanged.
2026-10-11	minor	M3: Windows' Animation effects setting is followed: wheel scrolling and zooming without easing, no other animations. Preferences ▸ Animation effects (Use system setting, On, Off) overrides it. macOS, Linux and the browser aren't asked yet. Estimates unchanged.
2026-10-11	minor	M10: printing on the web through the browser's print dialog (gap 4 closed); rank 1 drops web printing, 65–120 → 50–90 h
2026-10-11	minor	M13/#971: cap materialized text-search matches to the requested limit plus one continuation match.
2026-10-11	minor	M7: #594 ordinary paragraph drags validated in the Linux test environment with source-loss baseline failures, UI/engine regressions, native save/reopen and all eight CI gates. Estimates unchanged.
2026-10-11	minor	M4: direct Organize overview, checkbox selection and individual page actions. Estimates unchanged.
2026-10-11	minor	Contributor fork: document-font selection and subset completion, CFF, style ranges, contextual/bidi save/reopen and all-page Chinese keyboard acceptance; curve/hole hit testing (shared clips stay fixed, as on main). Scope remains bounded; percentages unchanged
2026-10-11	minor	Contributor fork: compatible word/subset-space grouping, source-font space reuse and a read-only textless editor background. Mixed-style regions now covered by engine/tool/UI regressions and private real-file checks; embedded sfnt faces, stable baselines and live draft extents now covered; installed-font selection and unsupported source programs remain open; estimates unchanged
2026-10-11	minor	Synced with closed issues: encrypted output opens in Acrobat (#774, #836), so gap 1 left rank 0 and convert and share (32–55 h, the gap's 8–15 h removed); organize, XFDF and multi-object move fixes (#817, #821, #809, #819, #844); the #816 panic and the #799–#821 batch fixed; rank 1 names web printing (Windows shipped, #756). Stage and readiness numbers not re-measured
2026-10-11	minor	M6: respect existing form-font encodings; retain source fonts on appearance fallback. Estimates unchanged.
2026-10-11	minor	M5: partial XFDF/FDF imports preserve existing replies and review statuses through save and export. Estimates unchanged.
2026-10-11	minor	M6: keep accepted form values when Tab reopens the same field before Save. Estimates unchanged.
2026-10-11	minor	M13: reject malformed CLI --root options before dispatch. Estimates unchanged.
2026-10-11	minor	M14: Traditional Chinese accessibility statuses, script-rule meaning and Taiwan form/table terminology; added a missing table-row explanation and catalog regressions. Estimates unchanged.
2026-10-10	minor	M14: localized shortcut key names (#496), including runtime switching and native layout checks. Estimates unchanged.
2026-10-10	minor	M3 records the System appearance completion after #881; estimates unchanged
2026-10-10	minor	Re-judged convert and share with the cross-app gate rule (only a workflow that can't be completed at all blocks): partial, not blocking → stage alpha
2026-10-10	minor	Added the alpha gate (six core workflows; convert and share fails → pre-alpha, 40–70 h to alpha) and rank 0 in the upcoming milestones
2026-10-10	major	Created from ROADMAP.md §Milestones, §Critical path, §Risks and §Where we're lacking. Merged the duplicated M1, M2, M3 and M14 rows, re-measured Done and Remaining, added Current focus and the ranked upcoming milestones