feat(carmenta): close the commercial gaps: forms, scanned filings, PDFs (0.11)

[Ttimmahlax]

Closes the production gaps a real caller hit running Carmenta on scanned financial-disclosure filings. The gap list and measured results are in docs/plans/commercial-gaps.md.

What ships

Carmenta 0.11

• Offline weights: manifests ship in the crate, with offline() and preload().
• Charset-constrained decoding.
• Quarter-turn orientation: 144/144 correct on turned pages, at 48% of the cost of a read.
• Opt-in form-rule removal.
• Full-width to ASCII fold on non-CJK lines.
• Lexicon matching.
• Checkbox detection: 100% recall and state on the corpus.
• Label-to-value pairing: 220/221 correctly-read values paired.

ffai-media 0.6.8

• decode_image(&[u8]).
• Opt-in pdf feature. Pages are composited as a viewer shows them, so redactions are painted in rather than read through.
• Text layers carry a redaction_risk flag.
• Every allocation driven by untrusted PDF values is bounded.

CLI 0.7

• ffai ocr reads PDFs.
• New flags: --charset, --remove-rules, --auto-orient, --checkboxes.
• ffai models --verify.

Bench

• Digit error rate in OCR notes.

Disclosure corrections

• The public 0.041 Text^Edit figure was Unlimited-OCR's number, not ours. Carmenta's is 0.108 on the same subset.
• The top-level README now uses official-evaluator numbers throughout, replacing those from the withdrawn biased scorer.

Versions

Every changed crate is one step past its crates.io version. The table is in CHANGELOG.md.

• ffai-core 0.8.0 is breaking: OcrOptions gained public fields.
• Merging this publishes through release-plz.

Checks run locally

All pass:

• the three blocking clippy gates;
• fmt;
• lint_invariants;
• the hardening-table check;
• workspace cargo check --all-targets;
• lib and integration tests for the changed crates (244 tests).

🤖 Generated with Claude Code