initial commit v 0.2.0

docs/ROADMAP.md

@@ -0,0 +1,72 @@
+# Next implementation slices
+
+The source release is an MVP implementation baseline, not a declaration that every runtime gate
+has passed. Complete A before treating it as an installable/public release. Version 0.2.0 adds the requested
+lightweight browser and picker in source; this does not waive the uncompleted Android runtime gate.
+
+## A — Build and Android runtime gate
+
+Resolve the pinned dependencies, run unit tests/lint, build debug and instrumented APKs, and execute
+`ViewerSmokeTest` and `BrowserIntegrationTest` on an emulator/device. Test real picker and incoming VIEW/SEND flows from at least
+a file manager, a browser and a mail app. Cover current Android and API 26. Fix compilation/API
+mismatches before adding features. Record exact SDK/device/build results in `VALIDATION.md`.
+
+Also execute `BROWSER_ACCEPTANCE.md`: folder grants/revocation, picker MIME/multi-selection, distinct-UID
+copy/read-only grants, local-only requests, injected restore keys, and return-to-browser lifecycle.
+
+Acceptance: a real APK opens PDF, image, text, CSV and each supported Office/ODF preview; search,
+page changes, rotation, two successive incoming documents, back, save/share and cache clearing work.
+
+## B — Lifecycle, storage and security hardening
+
+Extend the new debug provider fixtures with doubles for non-seekable streams, unknown or dishonest sizes, revoked grants,
+slow/blocked reads and inaccessible virtual documents. Test process death, cancelled requests,
+renderer crash/hang, rapid opens, exports interrupted by a new open, memory pressure and cleanup.
+Use dedicated jobs/budgets for export/share operations and robust cancellation/worker recycling.
+Fuzz the bounded XML/ZIP/Office core and compare accepted structures with mature implementations.
+
+Acceptance: no original is modified, no wrong document is exported, leaked grant/cache growth is
+bounded, malformed files fail clearly, and no failed render leaves the UI permanently busy.
+
+## C — Better everyday reading
+
+Apply EXIF orientation, add richer Markdown parsing without web execution, improve CSV dialect
+selection and syntax/source presentation, table navigation, reader font/spacing controls, accessibility,
+localization, and preserved reader positions. Consider safe ZIP-entry preview without extraction.
+Add PDF text extraction/search with version-aware capability detection and careful engine evaluation.
+
+Acceptance: capabilities are visible per format; unsupported actions are not presented as available;
+real users can read/search without confusing raw source, cached values and graphical layout.
+
+## D — Full-fidelity Office engine integration
+
+Do not enlarge the hand-written preview parser into a full Office renderer. Evaluate/build a real
+LibreOfficeKit-based Android engine (or a suitable maintained alternative) against the current
+Android SDK/NDK, ABI, packaging, security and licence requirements. Pin source revisions, establish
+reproducible native builds and collect a representative Office/ODF fidelity corpus. Use native engine
+thread ownership and bounded tile/page delivery; preserve the phone UI and the shared core models.
+
+Acceptance: genuine native rendering from real DOCX/XLSX/PPTX/ODF files on arm64 hardware; measured
+startup, memory, installation size and known fidelity differences; no host networking/macros/external
+resource access. Legacy DOC/XLS/PPT are enabled only when actually rendered and tested. Maintain the
+reading-preview mode as a separate labelled choice. Never ship a placeholder JNI/empty engine as support.
+
+See `ENGINE_INTEGRATION.md` for the decision record.
+
+## E — iOS shell
+
+Build the actual common framework on compatible Mac/Xcode tooling. Add SwiftUI file UI, scoped URL
+access/bookmarks, an equivalent bounded ZIP adapter, native PDF/image handling, search, shares and
+cache cleanup. Reuse common readers instead of rewriting them in Swift.
+
+Acceptance: equivalent first-file-open and expired-grant recovery; common fixture parity; framework
+and native host tests. An Android isolated service is not an available iOS feature and needs a separate
+platform security design.
+
+## Later, optional
+
+Annotations with a clear original/sidecar/export distinction; PDF forms; EPUB; EML; structured ICS/VCF;
+certificates/fonts; media and more archive formats; printing and conversion; simple text editing;
+then focused Office editing only when a tested engine and deliberate mobile UX exist. Storage
+connectors or broader file management must remain separate from document rendering. Collaboration/accounts
+are not necessary to achieve the original goal and are not MVP prerequisites.