Fidelity loss matrix — profile v1

Purpose. @awacloud/oconv's published fidelity claim: for every shipped conversion pair, what is preserved, degraded or dropped, which loss code records it, and which fixture measures it.

Prerequisites. The rows apply to the three facade members of the @awacloud/oconv main entry — toMd, fromMd and convert — and equally to the worker message kinds of the @awacloud/oconv/src/worker.js sub-path, which run the same readers and writers. The package runs in a browser and on the runtimes its engines field names (Bun ≥ 1.0, Node ≥ 20); every figure below was measured by the package's own test suite under Bun, on the named fixtures, and none is a promise for every document of a format.

Scope: all seven shipped to-md pairs — docx→md, odt→md, xlsx→md, ods→md, pptx→md, odp→md, pdf→md — @awacloud/oconv's frozen toMd facade, plus the three from-md pairs md→docx, md→odt and md→pdf (fromMd), plus the four cross-format pairs docx→odt, odt→docx, docx→pdf, odt→pdf (convert — see § "Cross-format pairs" below). Rows below are the measured behaviour of the frozen readers and writers (src/read/*.js, src/write/*.js), verified by the fidelity harness (tests/fidelity.integration.test.js) and, for the three from-md pairs, by src/write/ir-to-docx.test.js, src/write/ir-to-odt.test.js, src/write/ir-to-pdf.test.js, src/read/md-to-ir.test.js and tests/roundtrip.integration.test.js — against the vendored corpus. They are not a copy of the design-phase expectation table this matrix started from. That table is this matrix's origin: it froze the v1 fidelity-tier decision this page publishes, but the readers/writers built afterwards measure real divergences from it, recorded honestly below rather than re-asserted unchanged:

• docx → md keeps the design table's full Degraded list, including "nested list depth flattened to one level" (harness-confirmed on the real-world poi-numbering.docx).
• odt → md matches the design table's odt→md row again. An earlier reader had to move table out of Preserved because the then-frozen @awacloud/odf reader had no dispatch for a text-body <table:table>; @awacloud/odf has since gained that dispatch and this reader maps it, so odt-table.odt now converts with zero loss (tests/fidelity.integration.test.js, the odt-table.odt test). Run-level bold/italic/strike/monospace is likewise resolvable now, within the resolution scope stated in the odt→md row below — embedded images stay Dropped (no path to resolve draw:frame/ draw:image within this reader's frozen dependency list; a frame is recorded as image/unresolved).
• xlsx→md / ods→md / pptx→md / odp→md / pdf→md are later additions, absent from the design table (which only ever scoped docx/odt) — their rows below are measured directly against their own readers and corpus, not a divergence from an earlier design row.
• md → docx reaches tier 2: oconvIrToDocx (src/write/ ir-to-docx.js) always allocates an explicit hyperlink rId and always supplies opts.numbering when the document has a list. docx.write throws docx/hyperlink-missing-rid for a hyperlink without an explicit rId and docx/numbering-missing for numbered paragraphs without opts.numbering; this writer never reaches either throw (src/write/ir-to-docx.test.js § "oconvIrToDocx — hyperlinks" and § "oconvIrToDocx — lists and numbering"). It also always supplies opts.styles: every container carries a fixed built-in word/styles.xml (Normal, Heading1–Heading6, TableGrid) defining every referenced paragraph style, and every table is bordered and padded (TableGrid style reference plus direct single borders and 108-twip left / right cell margins) — presentation facts, not caller styling. Its bullet levels write U+2022 with no Symbol font (the glyph is plain Unicode, and pinning the symbol font rendered a missing-glyph box in viewers lacking it).
• md → odt reaches tier 2, matching the design table's original expectation. It did NOT at first: the first md→odt writer measured the then-frozen @awacloud/odf typed write model as having no semantic run-formatting flags, no text:a link node, no text-body table render case and no ordered/bullet flag, and the compose-never-reimplement rule capped the pair at tier 1 (+ lists, degraded) rather than let oconv hand-author ODF XML through the raw-passthrough layer. The cause has since been removed: @awacloud/odf gained the typed semantic write model, src/write/ir-to-odt.js consumes it, and all four *-unwritable/block/table-degraded odt-target loss codes are retired (src/write/ir-to-odt.test.js § "exhaustive absence of the four retired loss codes").
• md → odt is presentable by construction. Symmetric with md → docx: the odt writer always supplies opts.styles — a fixed built-in styles.xml of nine named paragraph styles (Standard, Text_20_body, Heading, Heading_20_1–Heading_20_6, bold, sized 16/14/13/12/11/11 pt like the docx set) defining every text:style-name a heading references — and writes every table with grid: true, so @awacloud/odf synthesises bordered cells and a margins-aligned table; list levels carry the label-alignment geometry and no bullet font. Presentation facts, not caller styling: no option, no new loss code.
• The adjacent-list round-trip falsification is RESOLVED, not relaxed. The first md→odt writer measured — and pinned — a genuine falsification: because an odt-written ordered list and an odt-written bullet list both degraded to structurally IDENTICAL generic <text:list> nodes, two such lists textually ADJACENT in the source markdown got merged into one by CommonMark's same-marker list-continuation rule on the second parse, so normal-form idempotence N1 === N2 did not hold for md-structural.md × odt (it stabilised only from N2 === N3). With a real ordered flag written and read back, the two lists keep DISTINCT markers at N1, nothing merges, and N1 === N2 now holds — measured and pinned in tests/roundtrip.integration.test.js (leg 2, with an odt falsification twin so the equality cannot be vacuous), on all three golden fixtures: the writer emits no empty paragraph (a code block's trailing newline and an image-only paragraph write none), because CommonMark collapses an empty paragraph on the next parse.
• md → pdf is a later addition, reaching tier 2 under a DIFFERENT design decision than the docx/odt pairs: a deliberately bounded typesetter, not the design table (which never scoped pdf as a from-md target at all). Its Preserved/Degraded/Dropped cells are therefore refusals BY DESIGN as often as they are gaps — see the dedicated section below.
• docx→odt / odt→docx / docx→pdf / odt→pdf are convert's four shipped cross-format pairs (the allowlisted facade member) — pure reader→IR→writer composition, reusing the SAME readers/writers the to-md/from-md rows above already measure. Their rows live in the dedicated § "Cross-format pairs" section below, not in the to-md/from-md table above, because a convert fidelity cell is the COMPOSITION of an existing reader row and an existing writer row, never a new capability.

Tier 1 = text + heading hierarchy. Tier 2 = + lists, tables, inline emphasis, links, image references — except on the → pdf targets (md → pdf, docx → pdf, odt → pdf): the bounded typesetter keeps a link's TEXT but never its target (a design refusal, no loss recorded), so their "2" is tier 2 minus link targets, stated in each of those rows. Tier 3 (styles/layout) is not promised by v1 in any pair.

pdf → md — measured decode coverage (not assumed)

The real-corpus figure this row's "Preserved" cell rests on: facturx-minimum-sample.pdf (FNFE-MPE Factur-X 1.09 MINIMUM reference invoice, a real, non-synthetic PDF/A-3 document) decodes at 100.00% — 4128 / 4128 character codes, 0 undecodable — entirely via the embedded fonts' own ToUnicode CMaps (the exact count is pinned at the reader by src/read/pdf-to-ir.test.js § "the decoded character-code count is EXACTLY 4128, matching the published loss-matrix figure"). The toMd facade result carries no coverage count, so the figure is not observable through the facade: the fidelity harness asserts only that this fixture's facade ledger is the single image/dropped entry (tests/fidelity.integration.test.js § "facturx-minimum-sample.pdf — real invoice corpus: ToUnicode text decode, one image/dropped loss (embedded logo raster)"), i.e. no text-decode loss record. This is a material lift from the 0.9% bound measured during the design phase, before the AGL hop existed — the lift comes from two upstream fixes this reader composes without reimplementing: pdfParser.tokenize making pdfContentStream.parseContentStream reachable through @awacloud/pdf's public graph, and the embedded fonts' ToUnicode CMaps (the AGL named-glyph hop via @awacloud/fonts' encodingAgl is the fall-back for a font that lacks one — not the coverage driver on this specific fixture). This is one measured fixture, not a universal claim: a real PDF whose fonts carry no ToUnicode and no resolvable /Encoding will undercount, honestly, via text/undecodable — never silently.

A real third-party document: font resolution

Measured 2026-09-23 on anssi-guide-selection_crypto-1.0.pdf (ANSSI, 58 pages, xref stream + 6 object streams; opt-in, never committed — the references/ANSSI/ leg of tests/pdf-text-quality.integration.test.js):

The cause was not the fonts: all 24 are reachable (12 Type0 Identity-H fonts, all with a ToUnicode CMap, plus 12 Type1), and their dicts live in object streams the reader already resolved. It was the page resources: 56 of 58 pages carry /ExtGState as an indirect reference, which pdfResources used to reject, dropping the whole resource map — fonts included. The same change also takes the two other measured ANSSI guides from 1 649 / 1 649 and 5 934 / 5 934 to 0 / 0.

The 60 remaining text/undecodable records are honest losses: codes drawn with six embedded Computer Modern Type1 math fonts (CMSY10, CMMI10, CMR10, CMSY8, CMSY5, CMMI8) that neither the font's ToUnicode nor its /Encoding maps to Unicode. A Type0 font with no ToUnicode whose /Encoding is Identity-H/-V or a legacy predefined CMap stays text/undecodable in the same way. These are three documents, not a universal claim.

Remaining limit — truncated content streams. Measured 2026-10-06 on the three AFNOR XP Z12-012 / 013 / 014 PDFs through toMd (third-party documents, never committed; no test pins these figures): no content stream records pdf/flate/inflate-failed any more — the streams now decode. What remains is 15 / 54 / 51 content/undecodable records, every one with the same cause, unknown content-stream operator "E": the recovered tail of that content stream ends inside its final ET, so the parser meets a lone E. That is a limit of the decompression layer, outside oconv; the stream is skipped and recorded, never silently. The Markdown bodies run to about 291 k / 79 k / 117 k characters. Three documents, not a universal claim.

Word spacing (measured)

Separately drawn text pieces of one line used to be concatenated with no separator, gluing words (Ilconstitueuneproductionoriginale). The reader now places each piece's end from the font's glyph widths (ISO 32000-2 §9.4.4, with Tc, Tw, Tz and TJ adjustments) and inserts one space where the gap to the next piece exceeds 0.15 em. Two glue signals, measured with the same counting function before and after, on the three ANSSI guides of the opt-in references/ANSSI/ leg of tests/pdf-text-spacing-forms.integration.test.js (measured 2026-09-23):

The residue at that date was mostly words glued INSIDE one TJ array: those documents draw a whole justified line as one TJ whose inter-word kerns shrink below the reader's then −200 threshold (to about −166 on tight lines). Three documents, not a universal claim.

In-TJ threshold, duplicate and overlapping pieces (measured 2026-10-02). A TJ adjustment n now reads as a word space iff −n / 1000 > 0.15 em — the line pass's own wordGap default, one value in both places (pinned by a drift test). A piece that exactly repeats the previous piece of its line (same text, |Δx| ≤ 0.5 pt, |Δy| ≤ 0.5 pt) is dropped instead of glued to its copy. Any other piece that starts left of the previous piece's end gets one space iff the overlap exceeds the same 0.15 em. Same counting function, whole Markdown, with (c) the count of a phrase of ten characters or more immediately repeated on its own line (with or without one space between); "before" is measured after the WinAnsi apostrophe change, on the same three guides:

The mechanisms guide's 25 remaining long runs are its rule labels, drawn as one word each (RecoCourbeElliptiqueGFp). The duplicate rule also drops 476 dots the selection guide draws twice at one place. Of the 779 other same-line overlaps on these guides, 778 are below 0.05 em (a kerned apostrophe, a syllable split across two shows, rounding) and stay joined with no space, where a space would split a word; the one overlap above 0.15 em (0.255 em, entité .Une taille) now reads entité . Une taille. Three documents, not a universal claim.

Form XObjects (measured)

A Form XObject drawn by Do used to be recorded as xobject/form-dropped and skipped, so any text it carried (diagram labels, chart axes, reused page furniture) was lost. The reader now executes the form in place (ISO 32000-2 §8.10.1): it saves the graphics state, concatenates the form's /Matrix onto the current transformation matrix, resolves fonts and XObjects from the form's own /Resources (the page's when the form has none), walks the form's content stream with the same text and advance model, and restores the state on return. Measured 2026-09-23 on the three ANSSI guides of the opt-in references/ANSSI/ leg of tests/pdf-text-spacing-forms.integration.test.js:

The zero-trust guide gains its diagram labels, and the mechanisms guide gains its chart axis labels. The selection guide's forms carry no text, so its Markdown body is unchanged. On the two glue signals of § "Word spacing", the mechanisms and selection guides are unchanged (124 / 394 and 94 / 44). The zero-trust guide gains one of each (61 → 62 and 21 → 22): none of its previously extracted text changed, but one new diagram label is drawn twice at the same place, and the two copies joined with no space (the copy is now dropped — § "Word spacing"). Three documents, not a universal claim.

Scanned/OCR PDFs are permanently out of scope, at every tier — no OCR engine is composed or planned; a scanned page's content stream carries no extractable text at all, so this reader's tier-1 text-first design has no signal to work from.

md → pdf — the bounded typesetter

md → pdf (oconv.fromMd({ markdown, target: 'pdf' })) is a bounded typesetter, not a general-purpose layout engine, by design: one page size, one text column, greedy space-based line breaking, hard page breaks only. Line breaking is Latin-only: lines break at whitespace and nowhere else (src/write/pdf/linebreak.js). There is no bidirectional reordering, so right-to-left text is drawn left to right in stored order, with no loss recorded: on a two-word Hebrew line, the first word is drawn at the left margin (measured on the registered default-face route; no test pins it). There is no CJK line breaking either: a CJK run written without spaces is one unbreakable token, so a run wider than the column overflows it on a line of its own and records layout/line-overflow (src/write/pdf/linebreak.test.js § "one oversized token → one overflowing line"). Every item in this row's Dropped-by-refusal list is a deliberate design boundary, not a missing feature: hyphenation, justification, widow/orphan control, floats/text wrap, multi-column layout, table page-splitting, a table of contents, vertical justification, and any running header/footer beyond the page number are never planned. The full options / loss-code / font-route reference lives in docs/pdf-writer.md — this section is the published summary.

Geometry defaults: A4 (595.276 × 841.89 pt), 56.693 pt margins (20 mm) on all sides, giving a 481.89 pt text column. Body text 11 pt at 1.32× leading. Headings 22 / 18 / 15 / 13 / 12 / 11 pt for levels 1–6. Monospace (fenced + inline code) 9.5 pt. Every value is an opts.pdf override (docs/pdf-writer.md's option table).

The three font tiers, resolved PER STYLE CLASS (verbatim, frozen):

explicit opts.pdf.fonts[class] > registered oconvDefaultFaces[class] > Standard 14

The Standard 14 fallback (Helvetica family + Courier) encodes as WinAnsi (CP1252) literal strings and names /Encoding /WinAnsiEncoding on every font dictionary, so bytes 0x80–0xFF (accented letters, the em dash, the bullet markers) decode back to the characters drawn on pdf → md — @awacloud/oconv vendors no font file of its own, on any of the three tiers. The explicit tier takes caller-supplied whole font programs per style class (opts.pdf.fonts); the default-face tier is an OPTIONAL registered pack reached by the module NAME oconvDefaultFaces only (@awacloud/oconv never imports the companion package — main.js registers a name-only 0.0.0 stand-in that any real pack displaces in either registration order). Both non-Standard-14 tiers subset to the document's own code points and encode as WinAnsiEncoding or Identity-H hex strings depending on whether every code point the style uses is WinAnsi-representable.

Text beyond WinAnsi is a companion-package concern (by design), opt-in via registration, and limited to the covered ranges stated below: @awacloud/oconv-fonts (Liberation Sans/Serif/Mono, SIL OFL 1.1) supplies the default-face tier — an OPTIONAL package a host registers on the SAME ModuleRuntime (registerDefaultFaces(runtime) before the first resolve('oconv'), or runtime.invalidate ('oconvDefaultFaces', { cascade: true }) afterwards — see docs/pdf-writer.md § "The default-face tier"). An application that never registers it keeps the Standard 14 route exactly as before. Whichever route resolves a style class, a code point that route cannot draw is recorded honestly, never silently: on Standard 14, a non-WinAnsi code point degrades to ?; on the explicit or default-face route, a code point with no glyph in the resolved face's own cmap draws .notdef — both collapse into the SAME text/unencodable record, ONE per document. Text that IS WinAnsi-representable on the Standard 14 route measures on its real advance: the Standard 14 width tables cover the full WinAnsi byte map — the 95 printable-ASCII slots plus the 123 filled high slots (0x80–0xFF), so accented and CP1252 punctuation no longer fall back to the '?' width.

Covered ranges, the only Unicode statement this page makes (measured from @awacloud/oconv-fonts' vendored faces' own cmap, tests/default-faces.integration.test.js): Latin — Basic Latin, Latin-1 Supplement, Latin Extended-A in full; Cyrillic in full; Greek and Coptic 88.2 %; Hebrew 77.7 %. Not CJK, not Arabic, not Indic. Coverage is a cmap fact, not a shaping claim — the typesetter refuses shaping by design (no kerning, no GPOS), so a script needing shaping to render correctly renders wrong even where the glyphs exist. The full block table and its test citation live in docs/pdf-writer.md § "Covered Unicode ranges".

opts.pdf DOES reach the worker; the registered face pack itself does not. src/worker.js's handleFromMd/handleConvert forward opts verbatim over the message envelope, only when the caller supplies the key — geometry, font routes, pageNumbers, all of it, structured-cloned like the rest of the message. What does NOT cross the boundary is the oconvDefaultFaces descriptor: it closes over its bytes inside factory(), so ModuleRuntime#serialize cannot ship it. The HOST resolves runtime.resolve('oconvDefaultFaces').defaultFaces() on its own thread and posts the resulting byte map as a separate defaultFaces envelope field, forwarded the same way, only when present. See docs/pdf-writer.md § "opts.pdf reaches the worker" for the full reasoning.

Images: fromMd takes an optional assets map — { '<markdown image destination>': Uint8Array }, keyed EXACTLY as the markdown wrote it, no normalisation and no fetching. All three writers resolve an image the same way (caller assets first, then reader-carried escapes.docx.bytes), and then diverge:

Image support also closed a genuinely SILENT drop on md → pdf: CommonMark's ![alt](src) is always INLINE inside a paragraph, and oconvPdfLinebreak.tokenize skips every non-run inline, so an inline image used to leave no mark and no loss. oconvPdfStack now partitions a text block's inlines and delegates each image, so it is either drawn or recorded.

md → pdf places JPEG only, and not every JPEG: a CMYK (4-component) JPEG is refused with reason: 'unsupported-encoding' (it needs a /Decode array and an Adobe transform the writer does not model). That is a measured boundary, not an omission: JPEG bytes are directly embeddable behind /DCTDecode, while a PNG needs a zlib-to-Flate re-wrap (plus /SMask or /Indexed for the alpha and palette colour types) that this writer does not build — see docs/pdf-writer.md § Images. PNG placement in md → pdf is not supported.

keepTogether is inert for delegated blocks. render/table.js returns keepTogether: true, but stack.js's delegated-block builder never copies it onto the FlowBlock it constructs (unlike the heading path, which does copy its own keepTogether) — pinned by src/write/pdf/stack.test.js § "a delegated renderer returning keepTogether: true has it dropped — the flag never reaches the flow block". A table is still never split across pages: the stacker's hard page-break rule moves any block that does not fit the remaining space to a new page whole, and clips a block taller than one page at the page bottom with layout/block-clipped (src/write/pdf/stack.test.js § "a block is never split across pages — every item of a block shares one page"; measured on a real table by tests/crossformat-to-pdf.integration.test.js § "docx-bulk.docx → pdf: MULTI-PAGE (24), one overflow + one block-clipped", 108 units clipped). What the dropped flag loses is only the stacker's keep-with-next check (a flagged block also requires the first line of the NEXT block to fit), which today applies to headings alone. Measured, not fixed.

Round-trip note (measured, tests/roundtrip.integration.test.js): with the default pageNumbers: true, the decoded page-number text is literal body content on read-back (pdf → md has no way to distinguish a footer number from prose), so feeding a toMd(fromMd(...)) result back through fromMd again is not idempotent — each round appends one more trailing page-number line. Normal-form idempotence (N1 === N2) holds with pageNumbers: false, measured on all three golden md fixtures.

Cross-format pairs

oconv.convert({ bytes, target }) is pure reader→IR→writer composition — read <format> → oconv-ir/v1 → write <target>, the same two pipelines toMd/fromMd already implement, wired back to back for exactly four allowlisted pairs. It adds no dependency to the oconv module descriptor and no new office-package wiring: every reader and writer it calls was already reachable from toMd/fromMd, and a convert fidelity cell is the composition of that reader's → IR row and that writer's IR → row published above. This section states no new Preserved/Degraded/Dropped fact for a construct the reader/writer rows don't already describe. The allowlist is enforced by a single frozen check (oconv: unsupported pair); see docs/convert.md for the full signature, error order and worker message.

Reader-carried image bytes (docx source). convert takes no assets input of its own — unlike fromMd, there is no markdown image destination to key a manifest by. A docx → * pair resolves an image only through the bytes the docx reader already carried in escapes.docx.bytes (the asset-bytes rule all three writers share; src/write/asset-bytes-drift.test.js pins it byte-identical across them).

Images on the odt side. docx → odt places every image whose bytes the docx reader carried: on poi-with-gif.docx the convert ledger is exactly [{ code: 'image/size-defaulted', detail: 'Grafik 1' }], and the written odt carries one Pictures/image1.gif part, byte-equal to the IR's 6554-byte escapes.docx.bytes (tests/crossformat-ooxml-odf.integration.test.js § "poi-with-gif.docx — the IR carries escapes.docx.bytes and the written odt carries them as its Pictures/image1.gif part"). The image reference survives docx → md but not docx → odt → md: the odt reader records the written frame as image/unresolved (detail draw:frame) and emits no IR image node (§ "poi-with-gif.docx — the image reference survives docx->md but not docx->odt->md: the odt reader leaves the written frame unresolved"). The same reader limit applies when an odt is the convert SOURCE: an image frame in it records image/unresolved and never reaches the docx or pdf writer.

One remaining wall.

• The md → pdf PNG / non-JPEG encoding boundary. docx → pdf and odt → pdf reuse the SAME → pdf writer md → pdf uses, so a carried image that is not a placeable JPEG refuses with layout/image-dropped / reason: 'unsupported-encoding' — measured on this pair's own corpus with a GIF (poi-with-gif.docx; the format detail key is absent on this fixture, because the header reader recognises only PNG and JPEG) and pinned generically (PNG, CMYK JPEG, malformed bytes) by src/write/pdf/render/image.test.js (tripwire already cited in "Measured, not assumed" below).

Inherited design refusals for → pdf. docx → pdf and odt → pdf are the SAME bounded typesetter md → pdf uses (src/write/ir-to-pdf.js + src/write/pdf/**) — every design refusal in the "md → pdf — the bounded typesetter" section above applies unchanged: no hyphenation, no justification, no widow/orphan control, no floats/text wrap, no multi-column layout, no table page-splitting, no table of contents, no running header/footer beyond the page number, no line breaking beyond Latin script. Two further writer behaviours are measured and not fixed: keepTogether is inert for a delegated block (the flag is dropped, so only the keep-with-next check is lost — a table is still never split across pages: it moves to a new page whole, or is clipped with layout/block-clipped when taller than one page, as docx-bulk.docx shows below), and run.strike is unrendered — struck-through text is typeset plain, with no strikethrough rule drawn; the drop is recorded as inline/strike-dropped, not rendered.

Byte-reproducibility follows the same rule as fromMd (§ "From-md reproducibility" below). The docx target is byte-reproducible: @awacloud/ooxml stamps every zip entry with a fixed 1980-01-01 00:00 timestamp, so two odt → docx runs on the same source give byte-identical containers (tests/crossformat-ooxml-odf.integration.test.js "odt -> docx: two convert runs are BYTE-identical"). The odt target is not: the ODF package writer stamps the current time into every zip entry, so two docx → odt runs give equal document models but may give different bytes. The pdf target is byte-reproducible (no zip container, no date, no /ID — see docs/pdf-writer.md's determinism note). No round-trip stability claim is made for any pair — converting, say, docx → odt and back is not asserted to reproduce the original bytes, model, or IR. Two runs of the SAME pair on the SAME source are MODEL-equal for every fixture measured (bodyOf(toMd(convert(X))) identical, ledgers identical too — tests/crossformat-ooxml-odf.integration.test.js § "two convert runs are MODEL-equal", tests/crossformat-to-pdf.integration.test.js § "leg 4: two runs are byte-identical" / § "leg 5: embedded font route"); the odt → docx pair and the → pdf pairs are stronger: BYTE-identical, not merely model-equal, because neither the docx nor the pdf write path stamps the current time.

Owner acceptance. The pdfBuilder.addImage seam is effective end to end through convert, independently of fromMd: oconv.fromMd({markdown, target:'docx', assets}) then oconv.convert({format:'docx', target:'pdf'}) places the SAME image — same /XObject dict, same raw stream bytes, same Do operator — as oconv.fromMd({markdown, target:'pdf', assets}) does directly, with losses: [] on the convert leg and byte-identical output across two runs (tests/crossformat-to-pdf.integration.test.js § "leg 7: OWNER ACCEPTANCE of the pdfBuilder.addImage seam").

Not shipped

Adding a pair beyond the four above is a later, measured decision — never inferred from this table.

From-md reproducibility

The docx target is byte-reproducible: @awacloud/ooxml stamps every zip entry with a fixed 1980-01-01 00:00 timestamp, so two identical fromMd(..., 'docx') calls produce byte-identical containers. The test checks the bytes AND the stamp itself: every local file header and every central directory header carries time 0x0000 / date 0x0021, so the equality does not depend on both calls landing in the same second (tests/roundtrip.integration.test.js § "reproducibility — md -> docx is byte-reproducible").

The odt target is not byte-reproducible: the ODF package writer stamps the current time into every zip entry, so two identical fromMd(..., 'odt') calls produce equal document MODELS and may produce different bytes. The to-md direction's byte-reproducibility statement is unchanged.

The pdf target is byte-reproducible: two fromMd(..., 'pdf') calls on the same markdown and the same opts.pdf produce byte-identical output (measured, src/write/ir-to-pdf.test.js "determinism", and at the facade by tests/roundtrip.integration.test.js § "reproducibility — md -> pdf is byte-reproducible") — irToPdf never calls pdfBuilder.setId, and @awacloud/pdf's plain write path reads no clock and no randomness. This holds only because md → pdf never enters @awacloud/pdf's encrypted write path, which does use Math.random().

Explicit out-of-scope statements

• Scanned/OCR is permanently out of scope, for any pair, at any tier — most concretely for pdf → md (see above), but the statement holds package-wide: no OCR engine is composed or planned anywhere in @awacloud/oconv.
• Tier 3 (styles/layout) is not promised by any pair in v1 — no font, colour, page-layout, header/footer, or list-style-name fidelity is ever claimed, regardless of format.
• The from-md docx and odt writers each emit a fixed built-in style set — not caller styling. docx: Normal, Heading1-6, Table Grid; odt: Standard, Text body, Heading, Heading 1-6, with every table bordered and margins-aligned. It exists so the container is presentable by construction; no option supplies or alters it, and no source style is carried through it.
• convert is shipped. oconv.convert({bytes, target}) is a third, additive facade member composing the EXISTING readers/writers for exactly four allowlisted pairs — docx → odt, odt → docx, docx → pdf, odt → pdf — see § "Cross-format pairs" above and docs/convert.md. No other pair is shipped; § "Not shipped" above lists every excluded family and its reason. md→pdf is shipped — fromMd targets .docx / .odt / .pdf. md→pdf is bounded (tier 2 minus link targets, refusals listed above); it PLACES 1- or 3-component JPEG images supplied through assets and records an explicit loss for a CMYK JPEG and every other encoding.

Measured, not assumed

Every degraded/dropped cell above that names a code is asserted by the fidelity harness against a real fixture (either a vendored real-world document or an in-repo generated fixture; tests/_fixtures/corpus/ carries a root PROVENANCE.md plus one in most format directories — docx/, odt/ and real/ carry none of their own and are covered by the root file):

Fixtures converted with zero loss (regression guard — a change to any of these is a real regression): docx-smoke.docx / docx-bulk.docx (first-party) and poi-table-alignment.docx / poi-with-gif.docx (real-world) for docx; poi-simple-multicell.xlsx for xlsx; poi-sampleshow.pptx for pptx; odp-structured.odp WITH includeNotes:true for odp; odt-table.odt for odt (zero loss since the odt reader maps text-body tables). None of this is a claim that every document in a given format converts losslessly — it is a claim that the SPECIFIC vendored fixtures do, and a regression on any of them is real.

See also

• docs/profile-v1.md — the wire format this matrix applies to.
• ../README.md — package overview.
• docs/pdf-writer.md — the md → pdf options / loss- code / font-route reference.
• docs/convert.md — the convert facade member's signature, error order and worker message.
• tests/crossformat-ooxml-odf.integration.test.js / tests/crossformat-to-pdf.integration.test.js — the harnesses the § "Cross-format pairs" rows above are measured against.
• tests/default-faces.integration.test.js — the harness the default-face-tier evidence rows above are measured against, driven at the public oconv.fromMd facade with the real @awacloud/oconv-fonts pack.