Release Scan Tools v0.1.0

public/docs/ACCESSIBILITY.md

@@ -0,0 +1,15 @@
+# Accessibility
+
+Every control has a native label and every operation is available without
+precision pointer input. The four graphical corner handles are focusable sliders:
+arrow keys move by 0.2 percent and Shift+arrow moves by 1 percent. Their values
+are announced as horizontal and vertical percentages. Source and processed
+views have accessible names, while status, errors and OCR progress use live
+native semantics.
+
+Page cards are clickable and preserve document order; drag and drop is a
+convenience rather than a prerequisite because files can be added in order and
+removed individually. Controls retain visible focus. Layouts collapse into
+document order on narrow screens, large hit areas are used, colour is never the
+only status cue, and reduced-motion plus shared system/light/dark themes are
+supported.

public/docs/ARCHITECTURE.md

@@ -0,0 +1,26 @@
+# Architecture
+
+The React workbench owns an in-memory ordered list of source `File` objects and
+serializable page settings. No page content enters local storage. Each source is
+decoded with `createImageBitmap`; its dimensions and byte size are checked before
+it joins the workspace.
+
+The renderer downscales exceptionally large source rasters to a 24-megapixel
+working ceiling. A projective map sends every destination pixel through the four
+selected source corners and samples it bilinearly. A bounded pixel pass applies
+brightness, contrast, perceptual grayscale and optional Otsu/manual threshold.
+Canvas rotation handles quarter turns and the final ±5 degree deskew. Preview,
+OCR and export call the same renderer with different disclosed pixel budgets, so
+the preview semantics match the downloaded result.
+
+Deskew estimation downsamples to at most 420 pixels on the long edge, tests
+half-degree candidates from −5 to +5, and scores the horizontal projection of
+dark pixels. It declines to invent an angle when insufficient foreground exists.
+
+PDF export dynamically loads jsPDF, renders pages sequentially, JPEG-encodes
+each bounded page, and fits it into the selected physical page. OCR dynamically
+loads Tesseract.js only after user confirmation. Its worker, three LSTM-only
+runtime variants and English integer trained data are copied from pinned npm
+packages to same-origin release assets. Tesseract's persistent model cache is
+disabled, one in-memory worker is reused and can be terminated, and no fallback
+CDN path is used.

public/docs/PRIVACY-SECURITY.md

@@ -0,0 +1,25 @@
+# Privacy and security
+
+Source files, decoded rasters, page settings and OCR text remain in browser
+memory. There is no upload, telemetry, analytics, account, remote model, remote
+font or external resource lookup. Production policy restricts connections to the
+same origin, permits only same-origin/blob workers, and allows WebAssembly while
+disabling object embedding. Browser tests reject unexpected HTTP requests.
+
+Images are treated as untrusted. Compressed byte size, decoded pixel count, page
+count, working-raster size and all output sizes are bounded. Active SVG is not an
+advertised input and only the browser's raster decoders are accepted. The
+projective transform rejects non-convex, tiny and degenerate corner selections.
+Page rendering is sequential for PDF export to reduce peak memory.
+
+OCR is isolated in the upstream Tesseract.js worker and is not initialized until
+the user acknowledges its memory cost. Worker, core and language URLs are
+constructed relative to the application base; the application never silently
+falls back to the upstream CDN. Tesseract's IndexedDB model cache is disabled;
+the ordinary PWA response cache may retain the same-origin public model file.
+Cancellation terminates the worker. OCR text is untrusted text and is displayed
+only through a text area, never as HTML.
+
+PDFs are image-only. No claim is made that visible metadata, faces, signatures
+or other sensitive page content has been removed. Export is always an explicit
+user action.