Release Unicode Tools 0.1.0

docs/ACCESSIBILITY.md

@@ -0,0 +1,3 @@
+# Accessibility
+
+The workbench uses semantic landmarks, headings and labelled native controls, supports keyboard operation, visible focus, reduced-width layouts, and system/light/dark themes through the Toolbox shell. Results do not rely on colour alone.

docs/ARCHITECTURE.md

@@ -0,0 +1,25 @@
+# Architecture
+
+Unicode Tools is a relocatable static React application. Pure text operations
+live in `src/unicode/model.ts`, while catalog loading, search, character detail,
+Unihan lookup, and confusable analysis run through a dedicated module worker.
+Reusable encoding, scalar, grapheme, normalization and download primitives come
+from `@add-ideas/toolbox-helpers`.
+
+The build contains compressed-by-HTTP JSON shards rather than a runtime
+database. A small manifest and dictionaries load first. The first catalog query
+loads assigned character shards, emoji and named sequences once in the worker;
+the roughly 5 MiB Unihan selection is fetched only after an explicit request.
+Results and displayed mapping lists are capped. The UI retains no database or
+persistent search history.
+
+`scripts/generate-unicode-data.mjs` converts checksum-pinned Unicode 17.0
+archives and text files into deterministic checked-in source data. It derives
+names, aliases, general categories, scripts, blocks, ages, bidi and case
+properties, emoji, named sequences, selected Unihan fields, and UTS #39
+confusable mappings. Private-use and surrogate ranges are not expanded into
+synthetic catalog records.
+
+Rendering, normalization and grapheme segmentation use the current browser and
+operating-system Unicode implementation, which can differ from the pinned
+catalog version. The interface discloses that boundary.

docs/PRIVACY-SECURITY.md

@@ -0,0 +1,21 @@
+# Privacy and security
+
+Inputs remain in browser memory. There is no account, telemetry, analytics,
+storage, or runtime network dependency. The application fetches only its own
+versioned static catalog files and never sends search terms or inspected text.
+Input is rendered as React text, not executable HTML.
+
+Text inspection is limited to 1,000,000 UTF-16 code units, scalar decoding to
+10,000 values, catalog results to 180, emoji results to 240, and displayed
+confusable mappings to 500. Large static datasets are held in a worker so the
+UI can remain responsive. Unihan data loads only on demand.
+
+UTS #39 skeleton equivalence and mixed-script detection are review signals.
+They are not proof of spoofing, maliciousness, safety, or identifier validity;
+applications still need a context-specific identifier profile and policy.
+Character glyphs come from the user's fonts, so a missing or surprising glyph
+does not alter the underlying code point.
+
+Developers can regenerate the catalog, but every upstream byte sequence must
+match a hard-coded SHA-256 before parsing. The public release performs no such
+download. Data source identities are inspectable and exportable from the app.