Release Diff Tools 0.2.0

docs/ACCESSIBILITY.md

@@ -1,6 +1,6 @@
 # Accessibility
 
-The workbench uses labelled native text areas, selects, checkboxes, file inputs and buttons. Comparison modes and result views are exposed as tab lists, status and diagnostic changes use live regions, and structured results use list or table semantics.
+The workbench uses labelled native text areas, selects, checkboxes, file inputs and buttons. Comparison modes and result views are exposed as labelled pressed-state button groups, status and diagnostic changes use live regions, and structured results use list or table semantics.
 
 Change kinds are written in text and indicated by `+`/`−` markers, not colour alone. Exact CR, LF and tab characters have visible glyphs. Focus indicators remain visible in light, dark and system themes, and controls meet a minimum 2.55 rem target height.
 

docs/ARCHITECTURE.md

@@ -3,7 +3,10 @@
 Diff Tools is a static React application with a relocatable `./` build. Its comparison pipeline is deliberately separated from the view:
 
 1. The workbench captures strings or decodes a selected file as strict UTF-8 after a byte-size check.
-2. A fresh module worker receives a plain comparison request. Changing input cancels and terminates the preceding worker; the last successful result remains on screen until a replacement succeeds.
+2. A fresh module worker receives a typed shared worker-job request. Changing
+   input cancels and terminates the preceding worker; job IDs exclude stale
+   messages, and a 15-second hard deadline bounds the whole worker. The last
+   successful result remains on screen until a replacement succeeds.
 3. A mode-specific pure comparator produces display rows and diagnostics. Normalized rows are first-class output, not discarded state.
 4. The orchestrator adds exact input metadata, a bounded unified patch and a schema-labelled portable report.
 5. React renders values as text. The app never consumes or inserts HTML produced by a diff or parser library.
@@ -16,7 +19,11 @@ When `Worker` is unavailable, such as in unit tests, the same pure comparator ru
 - JSON uses `lossless-json`, rejects duplicate and prototype-affecting keys, and compares numbers without converting to IEEE-754. Object member order is semantically ignored but reported.
 - XML rejects active declaration/include syntax and preflights structure before `@xmldom/xmldom` builds an inert DOM. Elements and attributes compare by expanded name when selected.
 - CSV/TSV uses Papa Parse in string mode. Unique composite keys align rows; no spreadsheet type inference is performed.
+- Directory manifests strip the one common browser-selected root, validate every relative path and conservative case/Unicode collision key, then hash file bytes with SHA-256 under count, per-file, aggregate and concurrency ceilings. The sorted, versioned JSON artifact can be compared later without the files.
+- Three-way merge independently derives bounded token edits from base to ours and base to theirs. Non-overlapping regions compose; overlapping regions are compared against each other and the base before conflict markers are emitted. It does not claim semantic structured-data merging.
 
-All report and patch formats are generated locally. `de.add-ideas.diff-tools.report.v1` is the portable report schema identifier.
+All report and patch formats are generated locally. `de.add-ideas.diff-tools.report.v1`, `de.add-ideas.diff-tools.directory-manifest.v1` and `de.add-ideas.diff-tools.merge-report.v1` identify the portable artifacts.
 
-The planned shared `@add-ideas/toolbox-helpers` package is not yet published at a compatible version, so v0.1 keeps its bounded domain functions inside `src/core`. They can be extracted without changing the worker protocol or report schema.
+Diff algorithms, semantic models and reports remain bounded domain functions in
+`src/core`. Generic byte-size display, safe Blob downloads and cancellable
+worker lifecycle come from `@add-ideas/toolbox-helpers` 0.2.0.

docs/PRIVACY-SECURITY.md

@@ -13,6 +13,9 @@ The production CSP permits same-origin scripts and workers and blocks objects, f
 - XML containing DOCTYPE, entity declaration or XInclude syntax is rejected before DOM parsing. A lexical preflight rejects excessive element count or nesting before DOM construction.
 - JSON rejects duplicate keys and the prototype-affecting keys `__proto__`, `prototype` and `constructor`.
 - CSV/TSV fields remain strings; formulas are displayed as text and are not evaluated.
+- Directory hashing rejects traversal, absolute/control-laden and case/Unicode-colliding relative paths. SHA-256 reads use bounded concurrency, file/count/aggregate ceilings and an abort signal.
+- Imported manifests are schema-, path-, digest-, order- and total-validated before comparison. Directory names and digests are sensitive metadata and should be reviewed before sharing.
+- Three-way inputs use the same text ceilings plus an explicit conflict cap; conflict labels have CR/LF removed before entering marker lines.
 - Imported strings are rendered through React text nodes and form controls. No library-generated HTML, imported markup or script is inserted into the document.
 
 These controls bound this tool's work; they are not a general-purpose sanitizer and do not make imported data safe for another application.