Release Log Tools v0.1.0

docs/ARCHITECTURE.md

@@ -0,0 +1,9 @@
+# Architecture
+
+Log Tools is a static React/Vite application inside the shared Toolbox shell. `src/log/model.ts` contains the streaming and bounded trust boundary. `scanLogBlob()` obtains a `ReadableStream` from the supplied `Blob`/`File`, reads byte chunks, decodes UTF-8 incrementally with `TextDecoder.decode(..., {stream:true})`, and feeds a line framer that retains at most 256 KiB for one physical line. It never calls `File.text()`, `arrayBuffer()`, or constructs a complete-file string.
+
+Automatic detection buffers only the first 30 nonblank bounded lines, chooses among JSON Lines, nginx common/combined, RFC 5424/common RFC 3164 syslog, logfmt, and plain text, then replays that small buffer through the selected parser. Explicit selection skips detection. Parsing continues up to five million lines or eight GiB. At most the first 10,000 nonblank records and 32 MiB of retained characters are kept; individual retained raw/message strings, fields, level/source maps, hourly timestamp buckets, field names, counters, and progress are independently capped. Reads yield between progress intervals so cancellation and UI updates can run.
+
+Filtering operates on the retained preview. Correlation counts describe the scanned portion. Redaction recipes transform raw text, normalized messages, sources, and extracted values using fixed, linear-oriented patterns and an optional exact literal. Expanded redaction output is capped per value and truncation is reported. Salted pseudonyms use a stable non-cryptographic hash: useful for local equality correlation, not encryption or resistance to guessing. Exports use the filtered retained preview, at most 50,000 rows and 10 MiB of text. CSV prefixes spreadsheet-formula-leading cells.
+
+React renders log values through text nodes only. ANSI escape sequences are removed and other control bytes are replaced; HTML-like content is never interpreted. Relative assets and a same-origin scoped service worker keep the build relocatable below nested portal routes. There is no telemetry, database, server API, worker, or remote dependency at runtime.