Release Query Tools 0.2.0

public/docs/ARCHITECTURE.md

@@ -1,3 +1,21 @@
 # Architecture
 
-`core/data.ts` performs bounded static parsing into JSON-compatible values. `core/query.ts` tokenizes a fixed grammar, interprets field paths and returns an explain plan; it never compiles or evaluates code. React retains the last valid dataset/result after errors. Relative assets and a same-origin service worker support nested offline deployment.
+`core/data.ts` performs bounded static parsing into JSON-compatible values while
+retaining raw numeric and cell-inference evidence. `core/query.ts` tokenizes the
+fixed SQL-like and path grammars, exposes their bounded syntax trees, interprets
+field paths and returns an explain plan; it never compiles or evaluates code.
+
+`core/duckdb.ts` is a separately selected adapter for the locally bundled
+single-threaded DuckDB-WASM MVP build. A lexical security gate accepts exactly
+one `SELECT` statement and rejects semicolons plus mutation, attachment,
+extension, file and configuration keywords before DuckDB performs its complete
+SQL parse. The adapter serializes at most 10,000 bounded rows into an in-memory
+table, disables external access and extension auto-install/auto-load, caps
+database memory at 128 MiB, limits results to 1,000 rows and terminates the
+disposable worker after completion, cancellation or a hard deadline.
+
+React retains the last valid dataset/result after errors and suppresses stale
+asynchronous results. Relative assets and a same-origin service worker support
+nested offline deployment. The static host serves hashed WASM as
+`application/wasm` with immutable caching and grants only the CSP allowances
+needed for same-origin WASM and workers.

public/docs/PRIVACY-SECURITY.md

@@ -1,3 +1,13 @@
 # Privacy and security
 
-Data stays in browser memory. Saved query text uses localStorage only. There is no telemetry, remote schema resolution, query execution endpoint, URL fetch, eval or dynamic function construction. Exports require an explicit action. Limits are documented in README.
+Data stays in browser memory. Saved query text uses localStorage only. There is
+no telemetry, remote schema resolution, query execution endpoint, URL fetch,
+`eval` or dynamic function construction. Exports require an explicit action.
+
+DuckDB mode loads the bounded dataset into an in-memory table inside a
+disposable worker using same-origin bundled JavaScript and WASM. External access,
+extension installation and extension auto-loading are disabled. The app exposes
+no database connection or file/network query surface; completion, cancellation
+and hard deadlines terminate the worker. The host CSP retains
+`connect-src 'self'`, and browser tests fail on third-party requests. Input,
+result, memory and time limits are documented in README.