Assumptions: this server had no application repository, Docker, PostgreSQL, or Caddy. Local development uses SQLite and Vite because Node 18 is installed; the Docker deployment uses PostgreSQL and a built React frontend. Prices and machine speeds in the seed list are illustrative demo values and must be replaced before quoting customers. Currency is deliberately not fixed.

• [x] M1: independent repository, relational schema, migration, REST API, React shell.
• [x] M2: normalized polygon model, rectangle/circle creation, SVG preview.
• [x] M3: PDF vector paths including Beziers and holes; SVG and DXF import; dimensions and scale.
• [x] M4: contour collision nesting, sheet SVG, manual placement, split workflow.
• [x] M5: materials, operations, data-driven product types, editable costing table.
• [x] M6: saved URLs, revisions, restore, read-only share token.
• [x] M7: scoped Copilot action API and deterministic natural-language adapter.
• [x] Iteration 2: persisted asynchronous nesting jobs with real progress and cancellation; project-scoped Copilot history; all sheets in a vertically scrollable vector workspace; A4 vector print preview; nested-revision restore regression fixed.
• [x] Iteration 3: server-side sessions, two roles, profile, supplier catalog/import, confirmed mappings, frozen quote prices, machines/technology, rules, provider gateway, voice bridge/mock, structured request and audit logs.
• [x] Security reconciliation: numeric and body bounds, isolated parsers, nesting deadline, rate limits, Host allowlist, session revocation, adversarial tests and A/B finding ledger.
• [x] Nesting performance: reproduced the 32-circle timeout, replaced Cartesian anchor grids and repeated geometry parsing, added broad-phase bounds, cached orientations, solver timings, and performance regressions; retained the killable worker and raised its safety ceiling to 180 seconds.
• [x] Configurable product / Channel Letters prototype: technology versions, data-driven estimate fields/rules, independent BACK/FACE nesting caches, operation/material cost breakdowns, frozen rate snapshots, and revision configuration snapshots. Added 12 isolated acceptance tests; full API suite/browser acceptance/deployment remain gated on the restricted environment dependencies and host access.
• [x] Geometry interpretation foundation: preserve source contours, record topology suggestions, add revision-snapshotted production elements/roles, block ambiguous nesting pending review, derive BODY-minus-CUTOUT manufacturing geometry, and add vector Geometry Review grouping/role controls. Open stroke extraction and graphic-layer costing remain future work.
• [x] Production cutover preparation: verified SQLite/storage backup, Caddy site, systemd service/health timer, private production environment, and deployment verification instructions.
• [ ] Activate calc.sign-expert.eu on the host: DNS, Caddy/TLS, systemd, firewall, login, print/voice browser checks, and GitHub push. The restricted build shell cannot access host systemd/network sockets.
• [ ] M8: full real-world signage PDF validation, advanced optimizer, organization boundaries, production monitoring and HTTPS deployment.

Current follow-up work:

• Validate letter outlines and multi-page PDFs from actual customer artwork; refine contour grouping where exporters use compound clipping or open strokes.
• Improve irregular nesting with no-fit polygons or a proven optimizer and benchmark against diverse parts.
• Replace the single-process nesting worker with a durable queue before deploying multiple API replicas. Add iteration/best-solution reporting when a real iterative optimizer is introduced.
• Refine A4 header/footer formatting and test printer margins across browsers; consider server-side vector PDF generation for controlled production output.
• Add interactive drag movement and DXF nesting export.
• Replace demo rates and add organization-scoped calculation access. Current Admin and Estimator roles share all calculations by design.
• Add production TLS, SESSION_COOKIE_SECURE=true, external login rate limiting, backup restore drill, and monitoring before external use.
• Add idle session timeout, distributed rate limits, dependency hash lock and advisory audit, and a hostile-file fuzz corpus; verify CSP/Nginx and secure cookies on staging HTTPS.
• Freeze material sales coefficient in quote snapshots; material/operation master edits no longer eagerly recalculate all quotes.
• Exercise Gemini text tool calling and Gemini Live with real credentials; validate browser PCM capture and audio playback on deployed HTTPS origin.
• Add supplier-specific PDF parsers and normalization for units, currencies, availability and sheet dimensions; generic PDF rows remain review-only.
• Add archival and explicit price-refresh history UI; rule authoring should gain a guided editor and scenario test harness.
• Support different sheet dimensions for mixed-material calculations.
• Expand product-type rules into full multi-component BOM and operation formulas for channel letters and lightboxes.