The parser, Rust canonical Preflight V2, PDFium render-only, and Rust imposition foundations are isolated from compatibility presentation code. This local code state is not deployment evidence. Public Runtime V2 remains unavailable unless the release supplies a short-lived Ed25519 receipt bound to the exact upstream origin, build, current Git SHA, and evidence bundle. Real-world corpus, current-SHA execution receipts, deployed isolation, and production adapters remain release evidence. PDFium raster output is measured visual evidence, not RIP, separation, certified-proof, or print-ready authority. Late Binding remains preserved.

PDF domain logic now lives in NowToPrint-owned Rust crates. ntp-pdf-preflight owns preflight findings, policy, and the public orchestration contract. ntp-pdf-core is the curated facade for authority-safe native crates; mutable compatibility, writer, and bleed surfaces remain isolated in ntp-pdf-compat. The WASM engine keeps browser, desktop, and sidecar APIs compatible. The unified run_preflight entrypoint now delegates into the crate-owned orchestration boundary; only legacy JSON DTO field population remains bridge debt and is not a place for new domain checks.

M2 adds the Rust 'ntp-pdf-source' boundary for bounded range reads, cumulative document budgets, cancellation, and content-addressed quarantine artifacts. Customer file names, local paths, and raw PDF bytes are excluded from source diagnostics. One full retained handle pass verifies the file and builds a fixed 64 KiB chunk integrity manifest; later range reads verify only touched chunks and do not change caller output on integrity failure. Artifact size and cumulative I/O work have separate fail-closed limits. On Windows, file durability is enforced but both directory-sync and owner-only-permissions capabilities report unsupported and must be provided by deployment policy. Cancellation is checked between bounded blocking reads, not in the middle of an in-flight OS read. This foundation does not make a preview or preflight result production-ready; parser consumer cutover and authority gates remain separate milestones.

M3 adds ntp-pdf-syntax for bounded PDF grammar and ntp-pdf-parser for an indexed lazy parser. The parser indexes xref table, xref stream, hybrid revisions, and authorized ObjStm locators without materializing every object at startup; a session resolves only the requested object. Inspection and session share one document-wide budget ledger; one coordinated byte/entry-bounded LRU, large-object/xref budgets, strict final EOF, parser-correct terminators, and /Length-bound streams prevent payload bytes from being mistaken for framing. M3 supports only FlateDecode; DecodeParms, predictors, and other filters remain explicitly unsupported. Cumulative budgets, cancellation, typed errors, and deterministic materialization remain fail-closed. This is an internal foundation, not a production-ready preflight or compliance result: authority typestate and production consumer cutover are separate milestones.

M4 separates diagnostic PdfInspection from opaque AuthoritativePdf. Unsupported PDF versions, missing or unresolved Catalog/Pages semantics, unsealed custom sources, and foreign document budget ledgers cannot gain authority. Explicit promotion resolves and validates the real /Type /Catalog and /Type /Pages objects under the same cumulative ledger, cancellation, and deadline; a higher Catalog /Version becomes the effective version. The new ntp-pdf-facts analyzer emits deterministic page geometry only from an authoritative document. Page-tree inheritance is limited to MediaBox, CropBox, and Rotate; TrimBox, BleedBox, ArtBox, and UserUnit are direct Page values only. Reversed box axes normalize to canonical min/max coordinates, while zero-area boxes and malformed, empty, cyclic, or parent-inconsistent page trees fail closed. M4 completed bounded structural coverage but intentionally left security coverage as notCollected; M5 adds the separate security-facts pass described below. The automatic transform allow-list is empty. This foundation is not a production-ready preflight, compliance result, byte-output permit, or consumer cutover; targetImplementationReady=false and releaseReady=false remain in force.

M5 moves JavaScript, actions, Launch, URI, GoToR, SubmitForm, RichMedia, XFA, AcroForm, embedded files, encryption, and suspicious revision signals into the native Rust security-facts registry. A completed scan, a partial scan, an unsupported capability, and a check that was not collected are different states; a limit, resolve, cancellation, or deadline error never becomes a clean zero-finding result, and traversal stops at the first terminal error instead of accumulating one diagnostic per remaining object. Facts are cryptographically bound to the authoritative source; unbound facts or facts from another PDF are rejected. Ordinary incremental saves, outline /Next, catalog URI base dictionaries, and tagged-PDF StructElem /A structure attributes are not treated as suspicious actions by themselves. Action facts require /Type /Action or a supported /S action subtype. These are structural facts, not malware certification, compliance, or an automatic removal decision. At M6, the browser/WASM consumer uses one generated FoundationFactsV1 inspection and no longer reparses the PDF through the legacy mutable-document preflight path. The browser result is diagnostic structural/security evidence only: it is not production preflight, compliance, native production authority, or PDFium/RIP proof. M7 has established the native-only provider policy and canonical report binding. M10 establishes the independently signed supervisor receipt contract and exact environment allowlist, but deployed Linux/Windows isolation receipts and concrete PDFium vendor provenance remain external-evidence blockers. Production claims therefore remain closed. Neither this analysis nor raster evidence permits an automatic PDF mutation.

IsolationReceiptV3 is accepted only with an independent supervisor Ed25519 signature, exact request/build binding, enforced filesystem/network/process boundaries, and verified resource high-water values. A worker or provider cannot issue its own production receipt. The contract's presence in source is not deployed Linux seccomp/cgroup or Windows Job Object/restricted token evidence; without those receipts, the system is not production-ready.

Depending on the workflow, reports can be produced from browser-side analysis or from a server-analyzed pass. When available, the report UI shows which path produced the final result. Server-analyzed workspace reports also show a capability truth map with measured, estimated, heuristic, or unsupported signals, plus safe/guided/external-only fix counts. server-verified is reserved for secret-backed signed evidence.

The authority fields are part of the evidence, not decoration. sourceOfTruth, providerId, providerKind, fallbackApplied, fallbackReason, and evidenceStrength explain whether the result came from Rust-native ntp-pdf-preflight, internal server-ts-v1/internal-analysis, browser local-first analysis, or an external-authoritative provider. In production and conformance policy, only the Rust native provider can be authoritative; missing or invalid native output blocks the request and never falls back to TypeScript. External responses may carry HMAC-verified diagnostic provenance, but they do not replace native production authority or unlock compliance.

internalPrintRiskScreeningV1 is structural risk screening, not compliance or certification. signatureStructureInventory inventories declared signature structure; it does not perform cryptographic signature or certificate validation. PDF/A, PDF/UA, and WTPDF require an exact-bound veraPDF receipt. PDF/X and GWG 2022 remain conformanceCandidate without an approved independent oracle.

Server-analyzed Studio preflight responses include a small Preflight Passport: requestId, pdfSha256, engineId, and lateBindingPolicy. The policy keeps originalPreserved: true and destructiveFixupsApplied: false, so the report can prove the uploaded PDF was checked without silently changing colour, transparency, trapping, or fonts.

Public report sharing is disabled until a production client can redeem the URL-fragment capability into an Authorization: Bearer request. The protected endpoint remains private and no-store; raw PDF bytes, vendor reports, private artifact references, and personal data stay out of report records.

RFQ upload and prepress states are translated UI messages. Network, parser, and prepress failures map to stable user-facing copy, so raw API error or message strings are not shown in the wizard. Retry the upload from the same step after checking the file and connection.

A green-looking preview is not a production-ready promise. PDF Tools remains internal alpha until final gates and live smoke pass. Guarded public beta decisions require passing behavior gates, matching corpus expectations, and no unsupported capability being marketed as measured evidence. Rust-native gate artifacts are internal evidence for the Rust PDF core/native bridge scope only; they do not evaluate guarded public beta or GA readiness. Public GA readiness is decided by the current-SHA enterprise evidence bundle plus the strict public GA decision artifact. That decision also requires exact package-health gates, private executed fuzz/render/oracle receipts, durable measured render storage, OS runtime isolation evidence, and claim-boundary checks. The current M11 inventory contains 60 synthetic fixtures, with no human-approved or open-licensed real-world entry yet. The evidence gate therefore reports externalEvidenceBlocked; a configured or not-executed oracle lane never counts as production or conformance evidence.

Studio keeps customer-facing status text in production language. Technical integration labels stay in diagnostics and audit evidence, while the workspace explains what is ready, what needs review, and whether the original PDF was preserved.

Images below 200 DPI produce visible pixelation in print. The system flags these as a blocking error.

NowToPrint does not run RGB/spot to CMYK conversion, transparency flattening, trapping, or font conversion as automatic fixes. It also does not flatten annotations or forms, merge layers, rewrite overprint, widen hairlines, remap spot colours, or flatten incremental-save history as a native one-click fix. These operations can damage modern PDF printability. We detect them, explain the risk, and route the job to proof, review, reupload, or an external specialist tool when a legacy production constraint makes that unavoidable.

Not every preflight signal has the same weight. NowToPrint separates measured evidence from estimated or heuristic signals; when the server-analyzed path receives Rust native measurements, that provenance is preserved in the capability truth map. Signed server-verified evidence requires a separate secret-backed verification chain.

preview_ready means the file can be viewed. geometry_verified means Rust geometry matched the loaded document. preflight_ready and preflight_blocked describe the analysis result. Imposition states are separate: imposition_plan_ready, adjusted_plan_pending_acceptance, accepted_plan, output_unavailable, output_ready, output_receipt_ready, proof_pending, and production_proof_ready must not be collapsed into one “ready” label.

Studio overlay targets come from canonical page geometry and finding bbox evidence. If a bbox is missing or the report/geometry hash does not match the current document, the issue stays in the panel instead of drawing a false target.

Measured render evidence only appears when a real PDFium/native renderer produces page pixels, hashed artifacts, renderer identity, PDFium revision, render profile, and sidecar runtime attestation. If that renderer is unavailable, the report says unavailable instead of treating a preview or stub renderer as measured raster evidence. Studio diagnostics expose artifact type and SHA-256 summaries, but not private filesystem, bucket, or signed URL references. PDFium release evidence must also bind every raw render_raster SHA-256 to the matching page pixelSha256; a hash mismatch is not measured render evidence. Studio evidence bar also separates open-source oracle baseline readiness from proprietary oracle parity: the baseline can be shown as configured or missing, while proprietary parity remains a GA-blocked signal during public beta and never exposes private artifact references. When Studio has no explicit release/oracle evidence state, it defaults to missing plus GA-blocked instead of silently implying a configured baseline. A configured baseline label can only come from the redacted readiness fields of a pdf-tools-external-oracle-framework-gate.v1 artifact that is release-ready, public-claim disabled, and backed by an open-source configured baseline; Studio does not expose the raw oracle artifact reference or logs.

For packaging and label jobs, NowToPrint classifies technical spot/separation names into Processing Steps intent signals. Missing ISO Processing Steps metadata, duplicate cut contours, or white/varnish/foil dependencies route the job to proof or specialist review instead of guessing finishing intent. Barcode quiet-zone or trim-safety risks are handled the same way: the platform asks for proof or artwork revision instead of silently moving or redrawing the barcode. Contour bleed, irregular shape, or open-path risks are routed to specialist review instead of silently changing die-line geometry. Spot and finishing separations can also require a separation proof sheet; those proof artifacts show intent without merging, flattening, or rewriting separations. Supplier finishing capability mismatches are routed before production instead of hiding the mismatch by changing the PDF.

Trust Passport can carry deterministic production intelligence such as rework probability, reject probability, supplier-fit score, press-fit score, and dispute evidence codes. These are policy estimates, not black-box ML predictions, and they are meant to support routing, proof, and dispute decisions before pricing automation. API polling responses can include a public trustPassport package for completed jobs; it keeps preserve-first policy visible and does not claim render verification unless measured PDFium render evidence is actually attached.

Benchmark and case-study artifacts separate synthetic, real-world-inspired, internal real-world, and public real-world evidence. Raw or pseudonymized customer PDFs are not eligible for public benchmark claims; public claims must come from derived fixtures, signal manifests, or licensed public files.

Internal benchmark dashboards compare preflight risk decisions with labelled production outcomes: false positives, false negatives, reupload reduction, dispute usefulness, and calibration buckets. These are operating metrics, not public parity claims unless the sample is audited and disclosed.

Tenant-bound jobs, artifact retention and deletion receipts, dependency readiness, and distinct internal/public API contracts are implemented and tested as a foundation. They are not activated in production, published as a public API, or deployed. Tenant identity comes from a trusted server principal issued only after server-side verifier success; raw claim JSON and request tenant fields are rejected. Jobs use a transactional outbox plus lease/fencing, artifacts use tenant-bound provider receipts and a reconcilable lifecycle, and readiness requires all six mandatory probes. The internal contract requires service mTLS. Production and conformance claims remain closed until durable deployment adapters, receipts, and the outstanding M11 external evidence are complete.