PDF domain logic now lives in NowToPrint-owned Rust crates. ntp-pdf-preflight owns preflight findings, policy, and the public orchestration contract. ntp-pdf-core owns structural PDF truth, and the WASM engine keeps browser, desktop, and sidecar APIs compatible. The unified run_preflight entrypoint now delegates into the crate-owned orchestration boundary; only legacy JSON DTO field population remains bridge debt and is not a place for new domain checks.

Depending on the workflow, reports can be produced from browser-side analysis or from a server-verified analysis pass. When available, the report UI shows which path produced the final result. Server-verified workspace reports also show a capability truth map with measured, estimated, heuristic, or unsupported signals, plus safe/guided/external-only fix counts.

The authority fields are part of the evidence, not decoration. sourceOfTruth, providerId, providerKind, fallbackApplied, fallbackReason, and evidenceStrength explain whether the result came from Rust-native ntp-pdf-preflight, internal server-ts-v1/internal-analysis, browser local-first analysis, or an external-authoritative provider. Do not read an internal fallback as Rust-native production proof.

Server-verified Studio preflight responses include a small Preflight Passport: requestId, pdfSha256, engineId, and lateBindingPolicy. The policy keeps originalPreserved: true and destructiveFixupsApplied: false, so the report can prove the uploaded PDF was checked without silently changing colour, transparency, trapping, or fonts.

A green-looking preview is not a production-ready promise. PDF Tools remains internal alpha until final gates and live smoke pass. Guarded public beta decisions require passing behavior gates, matching corpus expectations, and no unsupported capability being marketed as measured evidence.

Studio keeps customer-facing status text in production language. Technical integration labels stay in diagnostics and audit evidence, while the workspace explains what is ready, what needs review, and whether the original PDF was preserved.

Images below 200 DPI produce visible pixelation in print. The system flags these as a blocking error.

NowToPrint does not run RGB/spot to CMYK conversion, transparency flattening, trapping, or font conversion as automatic fixes. It also does not flatten annotations or forms, merge layers, rewrite overprint, widen hairlines, remap spot colours, or flatten incremental-save history as a native one-click fix. These operations can damage modern PDF printability. We detect them, explain the risk, and route the job to proof, review, reupload, or an external specialist tool when a legacy production constraint makes that unavoidable.

Not every preflight signal has the same weight. NowToPrint separates measured evidence from estimated or heuristic signals; when the server-verified path receives Rust native measurements, that provenance is preserved in the capability truth map.

preview_ready means the file can be viewed. geometry_verified means Rust geometry matched the loaded document. preflight_ready and preflight_blocked describe the analysis result. Imposition states are separate: imposition_plan_ready, adjusted_plan_pending_acceptance, accepted_plan, output_unavailable, output_ready, output_receipt_ready, proof_pending, and production_proof_ready must not be collapsed into one “ready” label.

Studio overlay targets come from canonical page geometry and finding bbox evidence. If a bbox is missing or the report/geometry hash does not match the current document, the issue stays in the panel instead of drawing a false target.

Measured render proof only appears when a real PDFium/native renderer produces page pixels, hashed artifacts, renderer identity, PDFium revision, render profile, and sidecar runtime attestation. If that renderer is unavailable, the report says unavailable instead of treating a preview or stub renderer as proof. Studio diagnostics expose artifact type and SHA-256 summaries, but not private filesystem, bucket, or signed URL references.

For packaging and label jobs, NowToPrint classifies technical spot/separation names into Processing Steps intent signals. Missing ISO Processing Steps metadata, duplicate cut contours, or white/varnish/foil dependencies route the job to proof or specialist review instead of guessing finishing intent. Barcode quiet-zone or trim-safety risks are handled the same way: the platform asks for proof or artwork revision instead of silently moving or redrawing the barcode. Contour bleed, irregular shape, or open-path risks are routed to specialist review instead of silently changing die-line geometry. Spot and finishing separations can also require a separation proof sheet; those proof artifacts show intent without merging, flattening, or rewriting separations. Supplier finishing capability mismatches are routed before production instead of hiding the mismatch by changing the PDF.

Trust Passport can carry deterministic production intelligence such as rework probability, reject probability, supplier-fit score, press-fit score, and dispute evidence codes. These are policy estimates, not black-box ML predictions, and they are meant to support routing, proof, and dispute decisions before pricing automation. API polling responses can include a public trustPassport package for completed jobs; it keeps preserve-first policy visible and does not claim render verification unless measured PDFium render evidence is actually attached.

Benchmark and case-study artifacts separate synthetic, real-world-inspired, internal real-world, and public real-world evidence. Raw or pseudonymized customer PDFs are not eligible for public benchmark claims; public claims must come from derived fixtures, signal manifests, or licensed public files.

Internal benchmark dashboards compare preflight risk decisions with labelled production outcomes: false positives, false negatives, reupload reduction, dispute usefulness, and calibration buckets. These are operating metrics, not public parity claims unless the sample is audited and disclosed.