# Architecture

The React shell lazy-loads one workbench. `core/mime.ts` turns bounded source
text into immutable-looking header and MIME-part records; parsing never creates
DOM. Transfer decoding consumes a global byte budget. Diagnostics, comparison,
canonicalization and redaction are separate pure modules.

Only the selected HTML text is passed through DOMPurify. It is then embedded in
an iframe without sandbox capabilities and with an inner policy that denies all
connections and active content. Attachment downloads are explicit Blob URLs
with sanitized filenames. The service worker caches only same-origin app files.