v0.4.0

v0.4.0 — native C8/HN-B pages, font fallback and tolerant outlines

v0.4.0 is the first release with native-text C8 and HN-B pages. It also
reads more real documents without failing: damaged HN-A outlines are
repaired with warnings, C8/HN-B outlines are omitted with a warning, and a
missing font role falls back to the CJK or Latin font. v0.x is unstable;
breaking changes and their migration are listed below.

Conversion scope

• HN-A: verified paired raw/compressed framing, per-page dimensions and marked
  image coordinates. The recorded corpus passes 19/19 HN-A inputs; this does
  not establish universal HN-A support or full viewer pixel parity. A
  malformed outline entry is skipped or clamped with a located warning
  instead of failing the document.
• HN-B: admitted mode-0/mode-2 native text profiles and both verified index
  layouts. Three selected documents have complete 4/4/6-page runtime checks.
  Mode-2 leading images are supported; images after text and mode-0 images
  remain explicit errors.
• C8: the admitted six-page profile and additional four/five-page profiles
  preserve native text, drawings and descriptor-ordered images. A trailing
  application-info package adds /CNKI_DOI and /CNKI_URL to the PDF
  /Info dictionary.
• CAJ: bounded interrupted-object and stream recovery admits independently
  validated complete copies. Corrupt or ambiguous content still fails.
• PDF: a %PDF- header that follows a newline, byte-order mark or junk line
  within the first 1,024 bytes is now recognized.
• TEB: still rejected, now with a message naming it a DRM-encrypted container
  and "unsupported_reason":"drm-encrypted" in inspect --json.

C8/HN-B outline layouts are unverified. Those PDFs have no outline and the CLI
prints one warning; --no-bookmarks (JS includeBookmarks: false) gives the
same PDF silently, and JS reports outlineOmitted: true. Unknown outline
metadata is not a confirmed empty table of contents (#303).

Native text pages need a caller-supplied CJK and Latin TrueType font, for
example with --fonts DIR. The CLI reference
documents a tested free recipe, Droid Sans Fallback with DejaVu Sans, that
covers all six pinned C8/HN-B corpus inputs. Fonts are not bundled.
Substitute fonts do not reproduce the original typography. Image-only pages
receive no OCR. See current support
and Node/browser usage.

Other changes

• caj2pdf inspect --pages prints a structure-only per-page report that is
  safe to share in a bug report. It contains no text, titles or pixels.
• Conversion shows input progress on a terminal; -q/--quiet hides it.
• Native HN/C8 scratch I/O uses positioned reads and writes, cutting system
  calls by almost two thirds on a 163-page HN-A input.
• New CLI archives: i586 GNU, FreeBSD RISC-V64 GC and FreeBSD PowerPC64.

Breaking changes and migration

These changes affect direct Rust users and custom WASM hosts; the bundled JS
adapters handle resource routing. CLI scripts keep working; the visible CLI
differences are the C8/HN-B warning, the font fallback and the progress line
on a terminal.

Surface	Change and migration
Rust toolchain	Minimum Rust version becomes 1.88.0. Update older toolchains before building.
C8PageFonts literals	alternate_latin becomes Option<usize>; wrap old values in Some. Add symbols, latin_state3, latin_state28, latin_state31; use None for absent roles. An absent role or unmapped glyph now falls back to the CJK or Latin font instead of failing.
Hnc8Reader::visit_bookmarks	Returns an OutlineReport (declared, written, defects, unverified) instead of the declared count. Read report.written for the old count of emitted entries.
ComposeReport	Gains outline and application_info. Construct it only through the converter, or add the fields with their defaults.
hnc8::Header literals	Include native_origin and native_mode from parsed metadata rather than inventing values. HN-B native_origin and page_size can now be Some even for zero extents; their presence is not a renderability test.
TextCoordinates literals	Include page_size. Admitted paired HN-A pages now use verified page dimensions instead of always inheriting the document header; output geometry can change.
NativeRecord::End	value becomes Option<u16>; wrap explicit old values in Some and handle None as an absent payload.
Exhaustive native-record matches	Handle added ImageReference, ExtendedControl and EncodedString events. Updated C8 drawing framing preserves following controls separately, changing visitor event counts.
Rust WASM engine	Request::Read includes resource; route document and font reads to the registered source. Engine::set_c8_fonts adds the symbols argument (u32::MAX when absent) and accepts 0xffffffff as an absent alternate role. Existing raw WASM font-setter exports remain available.
C8/HN-B bookmarks	Requesting bookmarks no longer fails; the outline is omitted with a warning. Callers that relied on the error should check outlineOmitted (JS) or OutlineReport::unverified (Rust).
Invalid HN-B input	Unknown layout markers and invalid compact-index fields are rejected explicitly; do not rely on permissive parsing.
Damaged CAJ streams	Flate Length recovery now validates the compressed stream. The recorded issue-20 input changes from a warning-producing old output to explicit rejection; no unchecked repair fallback is provided.

For exact resource registration and extended font roles, use the
I/O and ABI reference. The
changelog lists every change since v0.3.1.

Evidence and limits

The refreshed pre-tag Linux CI baseline ran all 56 fixed corpus inputs using
the v0.4.0 artifact from main 0153d22 (run 37251767647): 38 default
conversions, 13 unsupported inputs (seven TEB and six font-free HN-B/C8),
and five damaged CAJ failures. This font-free run is separate from explicit-font
HN-B/C8 validation. It does not yet verify the final tagged artifact identity. External documents, fonts,
captures and copied text stay outside Git and release assets.

Unicode evidence separates glyph transport from
independent source checks, extraction order, spacing and visual appearance.
Marker-font or adapter-hash agreement does not establish original-font pixel
parity. Missing optional evidence remains NOT_RUN.

Conformance evidence records representative native RSS,
WASM high-water capacity, bounded requests and scratch peaks. These are
measured cases, not a universal memory bound. Ranged input, sequential output,
forward-only spooling and failure cleanup remain the conversion model.

Artifacts

The release carries 53 native OS/CPU/ABI CLI archives, adding i586 GNU and
FreeBSD RISC-V64/PowerPC64 to v0.3.1's 50. Baselines are documented in
platforms. It also carries the tested JS tarball,
standalone WASM, the OCI container archive and SHA256SUMS. Nothing is
published to npm or crates.io (#293).

The release workflow builds every asset from the tagged commit, runs the full
platform matrix and attests the complete file set and the container digest.
The uploaded SHA256SUMS is authoritative. Verify downloads with the
build provenance guide. Windows and macOS binaries
are unsigned.