Release File Tools 0.2.0

docs/ARCHITECTURE.md

@@ -1,7 +1,9 @@
 # Architecture
 
-File Tools is a static React/Vite application wrapped in the shared Toolbox shell. Browser `File` handles and small metadata records remain on the main thread; one fresh module worker performs each inspection or streaming hash and is terminated on completion, cancellation, timeout, replacement or unmount.
+File Tools is a static React/Vite application wrapped in the shared Toolbox shell. Browser `File` handles and small metadata records remain on the main thread. Selection starts an inspection queue with at most three fresh module workers; each worker is terminated on completion, cancellation, timeout, replacement or unmount. Explicit streaming-hash jobs use the same isolated-worker lifecycle.
 
 The worker reads at most 1 MiB from each end for signature, entropy, text and string heuristics. SHA-256 and SHA-512 are updated together in 1 MiB chunks, so hashing does not buffer the complete file. The hex view independently reads one 512-byte window. `file/signatures.ts` contains project-owned evidence heuristics; `file-type` provides broader signature hints; `@noble/hashes` provides incremental hashes.
 
-`file/manifest.ts` sorts by path and emits JSON or spreadsheet-neutralised CSV. Duplicate groups start as same-size candidates and become stronger same-hash candidates after explicit hashing; no deletion or mutation follows. Relative worker and asset URLs keep the build relocatable below a nested portal path.
+`file/manifest.ts` sorts by path and emits JSON or spreadsheet-neutralised CSV. Each row carries its own inspection state/error, while JSON also records aggregate inspected, failed, cancelled and pending coverage so an interrupted batch cannot look complete. Duplicate groups start as same-size candidates and become stronger same-hash candidates after explicit hashing; no deletion or mutation follows. Relative worker and asset URLs keep the build relocatable below a nested portal path.
+
+`file/operations.ts` owns the bounded export operations. Rename templates are expanded into a deterministic download plan and passed through the shared collision-safe filename planner before any download. Split uses immutable `Blob.slice` windows and emits a JSON byte-offset manifest; join verifies part count and aggregate size before constructing an ordered Blob. Checksum manifests sort paths and use the conventional escaped GNU sum-file representation. These operations deliberately do not guess which part order, rename semantics, or checksum scope a user intended.

docs/PRIVACY-SECURITY.md

@@ -2,6 +2,8 @@
 
 Selected files remain browser `File` objects and are never uploaded. There is no telemetry, analytics, account, persistence or runtime network path. A selection is limited to 500 entries. Inspection reads bounded samples, the hex view reads one window, and hashing streams the selected file only after an explicit action.
 
-Worker jobs are isolated from the UI thread and are terminated on cancellation, replacement, error, timeout or component teardown. A completed result remains visible while a later operation runs or fails. Exported manifests contain file names/relative paths, sizes, modification times, declared types and any requested hashes; those metadata can themselves be sensitive.
+Worker jobs are isolated from the UI thread, limited to three simultaneous inspections, and terminated on cancellation, replacement, error, timeout or component teardown. A completed result remains visible while a later operation runs or fails. Exported manifests expose incomplete/error/cancelled coverage instead of silently treating queued files as inspected. They also contain file names/relative paths, sizes, modification times, declared types and any requested hashes; those metadata can themselves be sensitive.
 
-Signature detection, strings, entropy, embedded markers and trailing-byte findings are heuristics. They do not validate a format or establish encryption, malware, steganography or intent. Equal SHA-256 values are strong byte-identity evidence but the app does not delete, rename, split, join or otherwise mutate files.
+Signature detection, strings, entropy, embedded markers and trailing-byte findings are heuristics. They do not validate a format or establish encryption, malware, steganography or intent. Equal SHA-256 values are strong byte-identity evidence.
+
+Rename, split and join are copy-producing downloads: browser-selected sources are never overwritten. Plans and split/join operations are capped at 500 files or parts, and join at 2 GiB. The UI exposes collision-adjusted names before a rename export. Split manifests contain filenames, byte offsets and sizes but no claim that rejoining unrelated or reordered parts is safe. Checksum manifests include original paths and hashes, which may disclose sensitive names or provide stable cross-context identifiers.