v0.4.0

Changed

• Breaking: plans require version: 3 and source objects such as {"source":"chapter.pdf"} instead of source strings. Results and full reports use format_version: 4, adding original-page counts, selection spans, sections, divider/contents/padding parts and packet numbering settings. Update saved plans and JSON consumers using the current plan and result contracts.
• Breaking: failure reports can be refused as report_identity_unverified when separation from a known missing plan, source or consumed external font cannot be established; choose a different existing report directory. Only effective consumed fonts reserve input paths, including fonts selected for empty text; unused defaults do not. Native identity failures retain the queried operation/path and never authorize replacement.
• Breaking: generated fonts require complete consumed post and OS/2 headers with supported versions; missing, short or unsupported metadata is font_invalid. Choose a compatible static TrueType font; see font requirements.
• Breaking: generated text refuses a font whose sanitized PostScript name contains a literal # followed by two hexadecimal digits (font_invalid), because the backend cannot preserve that name. Choose a font with an unambiguous PostScript name; other literal hashes remain supported.
• Breaking: fitting refuses retained internal page destinations with numeric position coordinates as fit_destination_unsupported. Use original page sizes for those sources; whole-page and valid null-position or zoom-only destinations remain supported.
• Breaking: when individually valid sources combine into PDF 2.0 output with a missing required retained annotation appearance, check and build refuse the known conflict before assembly as source_output_incompatible. Supply complete appearances or assemble the affected source separately; other merge/write failures can still occur.
• Breaking: the viewer-regeneration warning form_appearances_regenerated is renamed to form_appearance_regeneration_requested; update diagnostic-code consumers. PDFConcat retains the request and does not generate field appearances.
• Independent contributor PDF checks require qpdf 12.4.2 or newer for corrected linearization checking. Upgrade older distribution packages; Linux CI uses a checksum-pinned official binary. qpdf remains a test tool and is not required to run PDFConcat.

Added

• Packet plans select ascending disjoint source-page ranges and use separate occurrences to repeat or reorder excerpts. Local navigation to omitted pages is pruned within its own occurrence with source_navigation_removed. Whole-source validation, version and hash checks still apply, and genuinely partial sources with fields/widgets are refused as source_selection_form_unsupported. Selection composes visible pages; it is not redaction.
• Nested titled sections create authored bookmarks, optional title dividers and odd physical starts with automatic blank padding. Imported source bookmarks remain beneath the nearest authored section. See sections and page positions.
• Linked contents pages and optional physical Arabic footer numbers use final packet page positions. Automatic padding counts but stays unpainted and unnumbered. Footers can cover existing source content; no overlap detector or content shifting is provided. See contents and numbering.

Fixed

• Breaking fix: required CLI values no longer consume recognized option tokens as separate arguments, avoiding unintended source/report I/O. Use equals syntax or a ./ prefix for option-like filenames. Usage errors honor a single valid --format regardless of option order; invalid or repeated format requests use JSON.
• Glyph-pruned fonts use consistent deterministic subset names across their PDF font dictionaries and descriptors, avoiding imported subset prefixes and tag-like names of generated full fonts. Full-font embedding preserves supported original names and programs.
• Generated font descriptors preserve original italic/oblique style, signed fractional angle and fixed-pitch traits across full and pruned resources.
• Human-readable diagnostics include source files, plan locations and consuming items, with omission counts. Paths and message controls are escaped while printable Unicode remains readable.
• Release automation honors supplied --release-notes files instead of publishing empty GitHub release notes.

Internal

• A transport-neutral application core owns declaration admission, checking, composition, publication and complete results; the CLI adapts arguments, process input and presentation.
• Contributor checks enforce the complete physical-source import/ownership graph through the pinned depguard analyzer, including inactive, hidden and ignored Go source, with rejection controls in the existing Lint job.
• Source distributions include a permanent fictional producer corpus, authored inputs and font notices, with ordinary Go interaction/workflow tests and independent PDF checks. Authoritative CI runs are uncached; stock Go artifacts and explicit native/scale scenarios preserve replay evidence without adding producer/runtime dependencies.