Release MIDI Tools 0.2.0

docs/ARCHITECTURE.md

@@ -2,6 +2,20 @@
 
 `core/midi.ts` turns a bounded SMF byte stream into inert tracks and absolute-tick events. Chunk boundaries, four-byte VLQs, running status, event counts, SysEx size, PPQN division and known fixed-length meta events are validated before data is exposed. Editing functions clone this model and preserve stable event ordering.
 
-`Workbench.tsx` keeps the last valid document during failed imports or operations. The SVG piano roll renders at most 5,000 notes. Playback maps ticks through the tempo map, creates fixed application-owned sine oscillators and can stop immediately by closing the active `AudioContext`; imported bytes never become code or remote references.
+`Workbench.tsx` keeps the last valid document during failed imports or
+operations. Parsing, transforms and exports execute through a disposable module
+worker; progress messages are revision-scoped, cancellation terminates the
+worker and late messages cannot replace newer state. A no-Worker fallback exists
+for test and older-browser resilience, while the shipped browser path stays
+off-main. The SVG piano roll renders at most 5,000 notes. Playback maps ticks
+through the tempo map, creates fixed application-owned sine oscillators and can
+stop immediately by closing the active `AudioContext`; imported bytes never
+become code or remote references.
+
+Paired notes can be selected in the SVG piano roll and edited through the same
+worker protocol as bulk transforms. Web MIDI access is requested only after an
+explicit click, without SysEx permission; scheduled output is bounded and Stop
+sends all-notes-off on every channel. The local SoundFont inspector validates
+RIFF `sfbk` structure and reports INFO/pdta counts but does not render the bank.
 
 All Vite assets use relative paths for nested portal mounting. Release packaging fixes ZIP ordering, timestamps and permissions.

docs/PRIVACY-SECURITY.md

@@ -2,4 +2,16 @@
 
 MIDI bytes are read into browser memory only. The application has no telemetry, account, database, remote asset or network client. CSP restricts connections and media to the application origin or local blobs.
 
-Parsing and export enforce an 8 MiB file bound, 256 tracks, 250,000 events, a 1 MiB aggregate SysEx bound, four-byte VLQs and signed-safe absolute ticks. Playback is explicitly user started, schedules at most 2,000 notes and is stopped by closing its audio context. Imported text appears only as escaped React text and is never interpreted as markup, script, URL or shader.
+Parsing and export enforce an 8 MiB file bound, 256 tracks, 250,000 events, a
+1 MiB aggregate SysEx bound, four-byte VLQs and signed-safe absolute ticks.
+Worker messages are revision-scoped, and cancellation terminates the disposable
+worker before stale results can update the document.
+
+Web Audio and Web MIDI playback are explicitly user started and schedule at most
+2,000 notes over the first 900 seconds. Web MIDI permission is requested with
+SysEx disabled; the app does not subscribe to MIDI inputs and sends only channel
+note messages to the selected output. Stop clears scheduled output and sends
+all-notes-off on every channel. Local SoundFont inspection is capped at 128 MiB,
+validates bounded RIFF structure and reports metadata only; it neither
+synthesizes the bank nor resolves remote resources. Imported text appears only
+as escaped React text and is never interpreted as markup, script, URL or shader.