FDF Differences transport

FDF Differences apply is a cumulative transport: a Differences stream from an explicitly selected complete PDF base revision is appended exactly once per apply

The FDF container itself is not an incremental PDF history; prior revisions of the base are preserved as cumulative prefix bytes and never reinterpreted

What the operation never does

The operation never fetches the FDF file specification and never executes JavaScript or actions; unknown actions are not claimed as implemented

External file fetching is disabled; every input byte arrives through the explicit base bytes, Differences bytes and caller-supplied certificates

Native API

THPDFFDFPackage.DecodeDifferences returns the decoded Differences stream and THPDFHeadlessDocument.SaveFDFDifferencesToFile publishes one bounded append with base bytes and SHA-256 binding

The result is the THPDFHeadlessFDFDifferencesResult record; an equivalent repeated apply is an exact no-op

Windows JSON operation

The C ABI JSON operation fdf.differences.apply applies the same transport through V1 callbacks; base binds the loaded revision with its byte length and SHA-256 and format is fdf

{
  "schemaVersion": 1,
  "type": "fdf.differences.apply",
  "format": "fdf",
  "base": {"bytes": 673, "sha256": "…"},
  "signaturePolicy": {"trustedCAPEM": "…"}
}

THPDFWindowsFormDataTransaction.ApplyFDFDifferences is the public Windows transaction method with the same byte accounting, rollback, cancellation and same-handle retry behavior as the other form-data operations

An optional signaturePolicy with trusted CA material is held through native verification and reload; native and OpenSSL validation agree on the CMS decision

Acceptance scope

The public gates cover Linux FPC 3.3.1, Windows Delphi 32-bit and 64-bit and Windows FPC 32-bit and 64-bit: 60 native checks, 48 callback commands and 7 independent output graphs per plain target, and 21 security cases, 1,244 native checks, 382 callback commands, 213 snapshots, 61 expected failures and 57 same-handle retries per security target

Restricted-permission and typed annotation controls, authenticated copy ownership profiles, C++Builder Win32 and Win64 header consumers and the registered package compile are separately gated

Embedded FDF import transports · Authenticated security copies · Native Linux C ABI