Release Office Tools 0.2.0

public/docs/ARCHITECTURE.md

@@ -5,14 +5,16 @@ layers:
 
 1. The Toolbox shell owns navigation, application identity, theme preferences,
    help and source links.
-2. The ingestion boundary checks extension and source size; each parser then
-   validates package identity from its contents and enforces resource limits.
+2. The ingestion boundary checks extension, source size and an eight-byte
+   signature; renamed OLE/RTF and non-ZIP inputs fail with clear diagnostics.
+   Each parser then validates package identity and enforces resource limits.
 3. Format adapters convert office packages into one application-owned,
    read-only document model.
 4. Viewer components render that model as document pages, spreadsheet sheets or
    presentation slides without trusting imported markup.
 
-The original file is immutable. Opening a new file cancels obsolete work and
+The original `File` is immutable. “Save exact copy” passes that Blob directly to
+the shared download helper, so there is no parse/rebuild round trip. Opening a new file cancels obsolete work and
 releases prior buffers and object URLs. Expensive parsing belongs in a module
 worker so the shell stays responsive and cancellation has a clear boundary.
 
@@ -27,6 +29,11 @@ normalized paths, CRC and expansion limits before namespace-aware XML parsing.
 It rejects DTDs, entities, external resources and active XML, and returns only a
 typed, serializable model plus transferable packaged image buffers.
 
+The semantic ODF adapter retains default/named style inheritance, page geometry,
+spreadsheet row/column defaults and visibility, drawing transforms, comments,
+notes and active-content notices. Derived text, CSV, outline and JSON inspection
+exports are bounded and labelled separately from the byte-exact source path.
+
 ## Deployment contract
 
 Vite emits relative URLs (`base: './'`). `toolbox-app.json` sits beside