Release File Tools 0.2.0

docs/PRIVACY-SECURITY.md

@@ -2,6 +2,8 @@
 
 Selected files remain browser `File` objects and are never uploaded. There is no telemetry, analytics, account, persistence or runtime network path. A selection is limited to 500 entries. Inspection reads bounded samples, the hex view reads one window, and hashing streams the selected file only after an explicit action.
 
-Worker jobs are isolated from the UI thread and are terminated on cancellation, replacement, error, timeout or component teardown. A completed result remains visible while a later operation runs or fails. Exported manifests contain file names/relative paths, sizes, modification times, declared types and any requested hashes; those metadata can themselves be sensitive.
+Worker jobs are isolated from the UI thread, limited to three simultaneous inspections, and terminated on cancellation, replacement, error, timeout or component teardown. A completed result remains visible while a later operation runs or fails. Exported manifests expose incomplete/error/cancelled coverage instead of silently treating queued files as inspected. They also contain file names/relative paths, sizes, modification times, declared types and any requested hashes; those metadata can themselves be sensitive.
 
-Signature detection, strings, entropy, embedded markers and trailing-byte findings are heuristics. They do not validate a format or establish encryption, malware, steganography or intent. Equal SHA-256 values are strong byte-identity evidence but the app does not delete, rename, split, join or otherwise mutate files.
+Signature detection, strings, entropy, embedded markers and trailing-byte findings are heuristics. They do not validate a format or establish encryption, malware, steganography or intent. Equal SHA-256 values are strong byte-identity evidence.
+
+Rename, split and join are copy-producing downloads: browser-selected sources are never overwritten. Plans and split/join operations are capped at 500 files or parts, and join at 2 GiB. The UI exposes collision-adjusted names before a rename export. Split manifests contain filenames, byte offsets and sizes but no claim that rejoining unrelated or reordered parts is safe. Checksum manifests include original paths and hashes, which may disclose sensitive names or provide stable cross-context identifiers.