@omrips/viewstl 0.0.0-stage → 2.0.0-rc.2

package/docs/v2-verification.md

@@ -0,0 +1,437 @@
+# ViewSTL v2 verification
+
+This file records dated checks. Older sections describe the alpha at the time
+of each check; release-candidate results are recorded separately below.
+
+## Quick-start documentation update 2.0.0-rc.2 — 2026-10-20
+
+The README and usage guide now begin with the minimum installation step and
+a three-line HTML example. The example was extracted unchanged from the README,
+served with the complete distribution directory and a binary STL, and verified
+in the desktop Codex Chromium browser: the model rendered, the worker and model
+requests succeeded, and keyboard rotation responded without console errors.
+
+All 112 unit tests and the legacy preservation check passed. Every runtime asset
+was compared with the installed public `2.0.0-rc.1` package; only the embedded
+version string changed. This update does not add browser/device coverage beyond
+the release-candidate verification below. Evidence is in the ignored local
+`test-results/npm-2.0.0-rc.2/` folder.
+
+## npm release candidate 2.0.0-rc.1 — 2026-10-19
+
+Prepared the first public npm package as `@omrips/viewstl`, with the release
+candidate on the `next` tag. The package version and `StlViewer.version` agree.
+The GitHub legacy paths and all archived legacy files remain unchanged.
+
+Validation against the packed tarball installed into a clean consumer:
+
+- 112 Node tests pass, with strict TypeScript source-consumer checks.
+- ESM imports and CommonJS requires work without a browser DOM. Both installed
+  package TypeScript entry points pass strict NodeNext checks.
+- All 35 installed files match the release source by SHA-256. The allowlist
+  includes the viewer, module worker, lazy chunks, CAD glue/WASM, declarations,
+  documentation and license/source notices. No credentials, test data, local
+  server scripts, node_modules or legacy runtime files are packaged.
+- Production builds succeed with Vite 8.3.4 and Webpack 5.112.0. Both follow the
+  documented complete-static-directory copy and explicit `worker_url` setup.
+- 11 browser checks pass in each of four consumers: Vite, Webpack, direct ESM
+  and classic script (44 total). These use the installed distribution and real
+  WebGL 2/module workers for local binary STL, STL/OBJ/3MF/STEP/IGES exports and
+  reimports, print checks, PNG export, VSB save/load and VSJ export.
+- Browser: desktop Codex in-app Chromium 155.0.0.0 on Windows, without device
+  emulation. The local pages use a same-origin CSP without JavaScript eval;
+  WebAssembly compilation is allowed. Parser/CAD assets are self-hosted.
+- The legacy guard verifies unchanged tracked legacy files and all 14 archived
+  snapshot hashes.
+
+Reproduction scripts, build fixtures, tarball inventory, terminal results,
+browser output and screenshots are retained locally in the ignored
+`test-results/npm-2.0.0-rc.1/` folder. Firefox, Safari, physical touch/mobile
+devices and broader real-world large-CAD workloads remain unverified; this
+release is a candidate, not a claim that those checks have passed. The optional
+bundler `worker_factory` variant was not exercised by this release check.
+
+## URL drops in the optional app controller — 2026-10-02
+
+`mountViewstlApp` routes dropped HTTP/HTTPS links through its configured relay and
+existing URL import queue. Six new unit cases bring the plugin suite to 93 passing
+tests; strict types and all 14 legacy integrity checks pass. The site's full
+96-assertion browser harness and 15 app lifecycle checks pass with this build.
+
+Desktop headless Edge 154.0.4258.48 passes 15 local and 16 live URL-drop checks:
+URI/plain-text/Firefox payloads, signed query preservation, deduplication, local
+file precedence, untouched input behavior, unsupported schemes, failure recovery,
+cancellation and an actual anchor drag. Firefox data is emulated; Firefox/Safari
+and physical devices were not tested. Live preview also fetched and parsed a
+real public STEP URL through Go. Other deterministic URL-drop response fixtures
+are explicitly mocked in the browser runner. These changes and the preceding
+export API build ship on preview in release `20261002-8f91150b7782`; export controls
+are still not wired to the site. The legacy site was not changed.
+
+## Plugin mesh exports — 2026-10-02
+
+The local v2 build adds `export_models` and `download_models` for binary STL,
+OBJ/MTL, 3MF, STEP/STP and IGES/IGS. These are plugin-only changes; the website
+and deployed preview assets have not been synchronized or changed for this work.
+All writers are JavaScript worker modules; CAD export does not use the Go relay
+or download a new CAD engine. The native WebGL2 renderer and legacy APIs remain.
+
+Validation:
+
+- 87 Node tests pass, including 14 export cases. The strict TypeScript consumer
+  check passes. All 14 archived legacy files verify unchanged.
+- Open CASCADE independently reads generated STEP and IGES: open triangle
+  surfaces, multiple models, nonuniform scale, rotation, translation, millimeter
+  and inch units. Triangle counts, bounds and area match the expected mesh.
+  Checking area exposed IGES numeric tokens crossing padded parameter records;
+  writers now wrap at parameter boundaries and the regression covers this.
+- Official 3MF Core/Materials XSD appendix validation passes with lxml. The
+  validation helper uses a stricter one-million occurrence cap because libxml2
+  2.11 rejects the published `2147483647` value, and trims the leading space in
+  the Materials appendix's `type=" ST_Numbers"`. No geometry/schema rules are
+  relaxed. ZIP/XML tests also verify object separation, shared vertices, units,
+  per-vertex color gradients, safe names and material references.
+- Headless desktop Edge **154.0.4258.48** passes all 9 export browser scenarios
+  and all 15 existing browser compatibility scenarios. The export page uses a
+  same-origin CSP without JavaScript eval. Tests cover real workers, all-format
+  reimport, preserved live buffers, selected export, OBJ ZIP, a real browser
+  download, running/queued cancellation, callback exceptions, scene cleanup,
+  memory rejection and subsequent recovery. No unexpected page/WebGL errors.
+- Export/reimport requests were same-origin GETs; the actual download used a
+  local Blob. No file upload or external endpoint request occurred. Edge's
+  internal `edge://` downloads-panel resources are excluded from web traffic.
+- A **1,000,000-triangle binary STL** produced **50,000,084 bytes** in **1,277 ms**
+  with **75 animation frames** during export. This is one synthetic local desktop
+  observation, not a performance guarantee or a measured process-memory peak.
+
+Evidence: `test-results/exports/browser.json`, `browser.png`, `compatibility.txt`,
+`assembly-mm.step`, `assembly-inch.step`, `assembly-mm.iges`, `assembly-inch.iges`
+and `colored-scene.3mf`. These generated files are ignored by Git. Reproduce the
+browser checks with a local plugin server and `scripts/check-export-browser.mjs`
+(Playwright module supplied by `VIEWSTL_PLAYWRIGHT`, URL by `VIEWSTL_QA_URL`).
+
+The optional `scripts/check-export-3mf-schema.py` reads the following downloaded
+source files from `test-results/exports` and validates the generated 3MF fixture:
+
+- `3mf-core-spec.txt`: https://raw.githubusercontent.com/3MFConsortium/spec_core/master/3MF%20Core%20Specification.md
+- `3mf-materials-spec.txt`: https://raw.githubusercontent.com/3MFConsortium/spec_materials/master/3MF%20Materials%20Extension.md
+- `xml.xsd`: https://www.w3.org/2001/xml.xsd
+
+Limits: STEP/IGES contain planar mesh surfaces, not recovered analytic CAD solids
+or feature history. No F3D is implemented. 3MF performs edge/winding/volume checks,
+not full solid repair or self-intersection testing. Physical phones/tablets,
+Safari/Firefox, commercial CAD applications and large STEP/IGES export workloads
+have not been validated in this change. Export options and omissions are listed
+in [usage](v2-usage.md#local-mesh-export).
+
+## STEP/IGES addition — 2026-10-01
+
+The local build adds STEP/STP and IGES/IGS with lazy, self-hosted WASM in
+disposable workers. The 54 plugin tests and TypeScript checks pass. Six CAD
+tests also pass under Node's `--disallow-code-generation-from-strings` flag:
+format aliases, unit conversion, assembly geometry/colors, malformed input,
+recovery, index validation, input/output budgets and rejection of an allocation
+beyond a 32 MiB configured WASM heap. The 14 archived legacy files verify unchanged.
+
+The website's 16 unit tests and its complete browser harness pass in local
+headless Edge 154.0.4258.37. Additional browser checks verify no CAD downloads
+for the empty page or STL, cancellation during the reader download, subsequent
+CAD recovery and GET-only same-origin asset requests without file uploads.
+The browser harness exercises all four aliases, mm dimensions, colors, malformed
+CAD recovery and multiple CAD files, alongside existing STL/OBJ/3MF and view tests.
+
+These are desktop automated checks, with a 390px emulated viewport for layout.
+Physical mobile devices, Safari/Firefox and large real-world CAD assemblies have
+not been validated. No new browser-memory or large-CAD performance claim is made.
+After explicit deployment authorization, the synchronized site and viewer were
+deployed as preview release `20261001-f40c6b922ea5`. All 22 public file hashes
+matched. Live headless Edge verified all four CAD aliases, correct mm dimensions,
+assembly positions/colors, malformed-file recovery and existing STL/OBJ/3MF
+loading. Observed network requests were same-origin GETs with no uploaded file
+data. The WASM response used `application/wasm` and gzip; no CSP/page errors were
+reported. Deployment evidence is in the website workspace's
+`results/deploy-20261001-f40c6b922ea5/`. DNS and the legacy site were unchanged.
+
+Checked on 2026-09-30, version `2.0.0-alpha.1`, on Windows in the
+Codex in-app Chromium browser. These results describe this development
+release, not a claim of complete compatibility with every legacy integration.
+
+## Completed checks
+
+Update 2026-10-01, additional views: the Node suite now has 43 passing cases.
+All 15 existing browser compatibility checks passed, plus 11 new appearance
+checks in `tests/v2/appearance-browser.html`. Those validate actual PNG pixels
+for mesh lines, studio shading, X-ray transparency, feature edges, wireframe,
+front/back orientation colors, half-model clipping and reversed clipping;
+all section axes/endpoints; independent smooth shading; VSJ/VSB persistence;
+graphics context restoration; and repeated switching/resource cleanup.
+Node cases cover section-aware picking, edge angles, budget rejection, worker
+failure and stale view completion. Strict consumer types and all 14 archived
+legacy hashes passed. The site passed 31 browser checks and 2 policy checks.
+Responsive controls were inspected at 320 × 740 and 390 × 844, with no
+horizontal overflow; these are desktop viewport simulations, not real touch
+hardware tests. Live preview loading, smooth/edge derivation, Studio and
+section controls passed with no browser warnings/errors. The new appearance
+tests use small fixtures; no additional large-model stress test was run.
+
+Update 2026-10-01: chunked local binary STL parsing, optional memory-budget checks,
+OBJ line iteration and GPU-allocation failure cleanup were added. The 36-test
+Node suite passed, followed by the additional GPU fault-injection test (37 total
+cases). TypeScript and legacy preservation checks passed. All 15 browser cases
+below passed again; the separate preview site passed 22 browser and 2 policy
+checks. A 300,758,484-byte binary STL with 6,015,168 triangles rendered locally
+and on preview.viewstl.com, exceeding the old byte and triangle limits. Its
+wireframe request was rejected by the configured memory budget before map
+allocation. The file stayed on the client. This is one desktop test, not a
+guarantee for every model/device; large OBJ/3MF and low-memory mobile stress
+tests remain outstanding. Existing package-tarball checks below are from the
+September verification; no new npm publication occurred.
+
+| Check | Result |
+| --- | --- |
+| Node automated tests | 30 passed, 0 failed |
+| Real browser integration checks | 15 passed, 0 failed; no unexpected callback errors |
+| TypeScript strict consumer checks | ESM and CommonJS package declarations checked |
+| Local npm tarball installation | ESM/CJS constructors, worker/browser exports and types resolve |
+| Legacy preservation | Original tracked source/build/dependencies unchanged; 14 local snapshot hashes match |
+| Responsive demo | Single-column layout at 390 × 844; no horizontal document overflow |
+| Local file picker | Keyboard-accessible picker loads a real cube STL; dimensions 2 × 2 × 2, 12 triangles |
+| Direct manipulation | Mouse drag visibly rotates the loaded model; grid keyboard control and wireframe/smooth selection checked |
+
+Automated coverage includes ASCII/binary STL, three color conventions,
+invalid/truncated/non-finite data, OBJ indices, bounds/area/volume,
+nonuniform scaling, matrix/picking calculations, transfer detachment,
+worker limits/cancellation/timeouts, ZIP integrity/expansion limits,
+real saved VSB archives, 3MF transforms/colors/relationships and invalid
+XML/component cycles.
+
+Browser coverage exercises classic-script and module entry points, actual
+module workers, callback order, IDs including zero, idle rendering,
+appearance/transforms/units, picking, disabled controls, animation,
+VSJ relative URLs, multiple models, VSB round trips, 3MF/OBJ loading,
+PNG capture, legacy API comparisons, the optional real Three.js mesh
+bridge, cancellation with ID reuse, clean/dispose, context restoration,
+and a visible initialization failure when WebGL2 is unavailable.
+
+The legacy comparison deliberately records one corrected bug: model
+dimensions now change after scaling. The legacy plugin returned stale
+dimensions while already reporting scaled area and volume.
+
+## Performance observation
+
+A generated **1,000,000-triangle binary STL (50.0 MB)** loaded through the
+worker and reached the first rendered frames in **273 ms** in one desktop
+run. WebGL reported no error. It used two tracked geometry buffers; after
+`clean()`, there were **zero tracked GPU buffers and zero active workers**.
+
+The input was an in-memory File generated before timing. This does not
+measure network download, physical disk latency, peak memory, cold-browser
+startup, or mobile performance. It is a reproducible smoke benchmark, not
+a cross-device promise. Run it from `/tests/v2/browser.html`.
+
+## Build sizes
+
+Sizes measured with Node gzip defaults; servers must enable compression
+to achieve compressed transfer sizes. Decimal kB below.
+
+| Asset | Raw | Gzip |
+| --- | ---: | ---: |
+| Classic minified viewer | 43.3 kB | 14.9 kB |
+| Module worker | 4.6 kB | 2.1 kB |
+| Shared worker geometry chunk | 3.8 kB | 1.9 kB |
+| Lazy archive/XML chunk | 47.2 kB | 16.4 kB |
+| Readable ESM viewer, alternative to classic | 69.0 kB | 18.5 kB |
+
+The classic viewer plus initial STL worker code totals 51.6 kB raw /
+18.9 kB gzip. Archive/XML support loads only for archive operations.
+The rendering/STL core includes no third-party runtime library.
+
+## Reproduction and remaining validation
+
+```sh
+pnpm install --frozen-lockfile
+pnpm build
+pnpm test
+pnpm check:types
+pnpm check:legacy
+pnpm start
+pnpm pack
+```
+
+The local tarball was installed into an isolated consumer directory with
+scripts disabled, then its ESM import, CommonJS require, asset exports and
+strict TypeScript consumers were checked. No npm package was published.
+The package remains `private: true`; `@omrips/viewstl` is a provisional name.
+
+Before a stable release or production replacement, test Firefox, Safari,
+real touch/mobile hardware, high-DPI devices, representative large customer
+models, peak memory, Vite/Webpack integration, and production-site callers.
+The legacy site's direct Three.js internals need migration. The supported
+3MF/OBJ subsets and transparency limits are described in [usage](v2-usage.md).
+
+Raw local browser results and the test tarball are in the ignored
+`test-results/` directory. No production files, DNS, server configuration,
+GitHub branch or npm registry entry were changed by this implementation.
+
+## Scene/grid verification — 2026-10-01
+
+47 Node tests passed, including aggregate scene memory accounting, serialized
+budgeted parsing, reservation cleanup on allocation/dispatch failures and
+multi-model derived-work guards. Strict TypeScript and 14-file legacy checks passed.
+The Chromium browser passed 15 compatibility, 11 appearance and 8 new scene cases.
+The scene cases exercise original coordinates, tint/restore without GPU buffer
+reallocation, grid coverage beyond model bounds after pan/zoom, opaque depth
+occlusion, PNG background color, finite-grid compatibility, infinite-grid VSB
+round trip, context restoration/cleanup, aggregate budget rejection/recovery and
+cancellation of derived work on model removal. Real mobile GPUs, Safari and Firefox
+remain untested for these additions. The preview site was updated separately;
+legacy files and npm publishing remain unchanged.
+
+## Editing frame and picking — 2026-10-01
+
+48 Node tests, strict TypeScript checking and the 14-file legacy integrity check
+passed. Chromium passed 15 compatibility, 11 appearance and 11 scene browser
+cases. Additional scene coverage verifies editing-frame pixels, clean PNG exports,
+frame-buffer reuse during transforms, selection switching and cleanup, recovery
+after graphics-context loss, and nearest visible surface picking after transforms.
+Real mobile GPU, Safari and Firefox coverage remains outstanding.
+
+## Plugin-owned app controller — 2026-10-02
+
+The website's application logic and four policy/transform helper modules now
+compile into `viewstl.js`. The ESM, CommonJS and classic-script builds expose
+`mountViewstlApp`; low-level `StlViewer` behavior is preserved. The suite now
+contains 70 Node tests, including the 16 tests moved from the site. All pass,
+along with strict TypeScript and the 14-file legacy integrity check.
+
+Automated Edge 154.0.4258.48 passed the site's 96 browser assertions and 15
+additional controller checks: lazy mounting, optional samples, duplicate-mount
+rejection, public file loading, detached state, cancellation, disposal during
+an active parser job, worker/canvas/listener cleanup, idempotent disposal,
+refusing calls after disposal, late-read isolation during remounting, separate
+embedded roots, radio groups and drop targets. CAD lazy loading, cancellation,
+recovery and a 390px viewport were also rechecked. No new real-mobile, Safari
+or Firefox coverage is claimed.
+
+Preview release `20261002-79c817751172` passed all 18 asset hashes and live
+HTTPS checks for STL, OBJ, 3MF and all four CAD aliases, malformed CAD recovery,
+millimetre dimensions and assembly colors. Observed requests were same-origin
+GETs without bodies; no CSP/page errors occurred. Evidence is in the sibling
+website workspace under `results/plugin-app-refactor/` and
+`results/deploy-20261002-79c817751172/`. No npm publication or GitHub push.
+
+## Optional Save dialog — 2026-10-08
+
+The app controller binds an optional complete save-* control group. All behavior
+is packaged in viewstl.js and delegates to the existing download_models API;
+low-level writers are unchanged. The host supplies explanatory markup/styles.
+
+93 Node tests, strict types and all 14 legacy integrity hashes pass. Desktop
+headless Edge 154.0.4258.62 passed 42 local and 42 deployed HTTPS Save checks:
+actual STL/OBJ/3MF/STEP/IGES downloads and reimports, OBJ ZIP materials, translated
+selected/all geometry, cancellation with actual stalled export workers, resource
+cleanup, validation-error recovery, PNG regression and keyboard focus. 320/390px
+layout and touch taps are emulation, not physical mobile tests. Twenty-four app
+lifecycle checks cover export cancellation on clear/remove/dispose, independent
+prefixed dialogs, optional-control omission and fail-fast incomplete groups.
+Fifteen URL-drop regression checks also passed. No large-file performance claim
+or Safari/Firefox coverage is added by these UI tests.
+
+Preview release 20261008-580a812896b6 passed all 24 public file hashes. Observed
+Save-test requests were same-origin GETs without uploads. Evidence and the
+reproducible browser runners are in the sibling website workspace under
+results/save-local, results/save-lifecycle, results/save-url-regression and
+results/deploy-20261008-580a812896b6. No npm publication or GitHub push.
+
+## Scene saving — 2026-10-08
+
+Release 20261008-625337233d51 exposes VSB/VSJ whole-scene saving in the preview.
+The five regular mesh formats save only the selected model, per the owner's
+clarification. New export_scene/download_scene Promise APIs use get_vsj manifests
+and the existing VSB/STL archive layout, with worker-based VSB encoding,
+cancellation, progress, memory admission and output limits. Legacy scene getters
+and download methods retain their contracts.
+
+96 Node tests, strict types and all 14 legacy integrity hashes pass. Edge
+154.0.4258.62 passed 26 scene checks locally and live, including downloaded VSB
+round trips, VSJ round trips with explicitly supplied referenced fixture files,
+scene settings, source names, cancellation, memory/output/count limits and
+callback errors. 42 mesh/PNG/UI regression checks passed locally and live;
+24 app lifecycle checks include cancellation of VSB workers on clear/remove/
+dispose. Same-origin GET-only network evidence shows no export uploads. Narrow
+and touch checks use emulation, not physical devices. Site scene reopening is
+not implemented; round trips explicitly use the plugin's public scene loaders.
+Evidence: sibling website results/scene-save-local, scene-save-mesh-regression,
+scene-save-lifecycle and deploy-20261008-625337233d51. All 26 public hashes match.
+
+## Scene opening — 2026-10-08
+
+Preview release `20261008-2bc0de3fc7ab` opens VSB/VSJ through the plugin-owned file,
+drop and URL flows. The new `import_scene` API validates manifests/archives, stages
+models until success, remaps IDs, resolves local companions or relayed public URL
+references, and restores scene settings and editable model placement. Errors and
+cancellation preserve the existing scene. Legacy scene loaders are unchanged.
+
+100 Node tests, strict types and all 14 legacy integrity hashes pass. Desktop
+headless Edge 154.0.4258.62 passed 25 local and 27 live scene-opening checks,
+including saved and legacy VSB files, local VSJ companions, editing/reset/re-saving,
+missing files, malformed second-model rollback, cancellation during reading and
+between models, recovery, URL routing and redirected VSJ base directories.
+Live checks include real public VSJ/STL and VSB downloads through the deployed
+Go relay; other remote fixtures are explicitly intercepted. Captured browser
+traffic remains same-origin; local scene files and companions are not uploaded.
+42 mesh/PNG/save, 24 lifecycle and 15 URL-drop regression checks pass locally.
+Narrow layout is emulated; physical mobile hardware, Safari and Firefox remain
+unverified. These fixture tests do not establish large-scene peak memory or speed.
+
+The relay's 12 top-level Go tests pass, including both scene formats and final
+redirect-base metadata without query secrets. All 27 public asset hashes match.
+Nginx and relay service configuration hashes remain unchanged. Evidence is in the
+sibling website's `results/scene-open-local`, `scene-open-save-regression`,
+`scene-open-lifecycle`, `scene-open-url-regression` and
+`deploy-20261008-2bc0de3fc7ab/live-open`. No npm publication or GitHub push.
+
+## Print checks — 2026-10-17
+
+112 Node tests, strict TypeScript and 14 legacy integrity hashes pass. The new
+fixtures cover open meshes, duplicates, degeneracy, winding, vertex-only contacts,
+disconnected solids, nested cavities, intersecting shells, coplanar overlap,
+near-coplanar neighbors, small gaps, large translations, nonuniform scale, units,
+FDM estimates, time limits, memory rejection and bounded diagnostic samples.
+A 100,000-triangle curved fixture exposed a false coplanar-neighbor intersection;
+the shared-edge predicate was corrected and the case retained as a regression.
+
+Desktop headless Edge 155.0.4283.45 passes 27 print integration checks locally:
+lazy loading, basic/detailed coverage, cache isolation, native highlights,
+unchanged geometry/colors/PNG, stale reports, 390px layout, keyboard closing/focus,
+selected/all scope, cancellation/recovery, callback errors, memory accounting,
+removal/disposal, optional host controls and touch-emulated interaction. Additional
+regressions pass: 42 save/PNG, 25 scene-opening and 24 app-lifecycle checks. No
+physical mobile devices, Firefox or Safari were tested. Browser traffic captured
+by the print runner is same-origin GET; no analysis uploads occur.
+
+The browser's 100,000-triangle closed torus completed detailed checks in about
+4.6 seconds with 279 animation frames and a maximum observed frame gap of 16.8 ms
+in the initial recorded run. Results vary by run/device. The Node benchmark
+`scripts/check-print-performance.mjs` measured about 0.6 s for 10,240 triangles
+and 5.4 s for 100,000 triangles. Sampled JS heap reached about 164 MB on the larger
+run; this is not a measurement of total/peak browser or GPU memory. Memory/time
+limits deliberately reject or mark incomplete larger/ambiguous workloads.
+
+Evidence: plugin `test-results/print-node.txt`, `print-performance.json`; sibling
+website `results/print-local`, `print-save-regression`, `print-scene-regression`
+and `print-lifecycle`. Reproduce browser checks with `site/qa/run-print-browser.mjs`.
+
+Preview release `20261017-b0d9d98b838b` also passed all 27 print checks over
+public HTTPS and all 29 public file hashes. Live evidence is in the sibling
+website's `results/deploy-20261017-b0d9d98b838b/live-print`. The relay binary and
+service/Nginx configuration hashes are unchanged; no npm publication or GitHub push.
+
+The persistent-panel follow-up release `20261017-5b21747c4c8f` passes 39 browser
+checks locally and over public HTTPS. Added coverage includes canvas focus,
+appearance controls, other dialogs, repeat launch, narrow-screen toolbar access,
+selection changes, loading/cancellation, adding/removing/clearing models and
+explicit close from an empty scene. The panel remains open throughout unrelated
+activity while stale reports and active jobs are handled safely. All 112 Node
+tests, strict types and 14 legacy hashes pass again. Evidence: sibling website
+`results/print-persistent/` and `results/deploy-20261017-5b21747c4c8f/`.

package/legacy/README.md

@@ -0,0 +1,43 @@
+# Preserved legacy versions
+
+The existing `src/`, top-level `build/` files, and `dependencies/` remain
+the GitHub legacy implementation. Keep their existing download paths.
+New v2 output belongs under `build/v2/`.
+
+## GitHub baseline
+
+- Repository: https://github.com/omrips/viewstl
+- Original default branch: `master`
+- Baseline commit: `fbb7f5c3894862778c3a6c5d2630573e2496d01f`
+- Local preservation tag: `legacy-before-v2-2026-09-30`
+- Latest published release when inspected: `v1.13`
+
+The baseline commit includes changes after the `v1.13` tag. Do not treat the
+release tag and the current legacy branch as identical. The preservation
+tag and development branch are local until explicitly pushed to GitHub.
+
+## Local website snapshot
+
+[`local-1.14-2026-09-30/`](local-1.14-2026-09-30/) contains 14 files copied
+without modification from the legacy website checkout. Its unminified
+`plugin/stl_viewer.js` identifies itself as version 1.14. The
+[`manifest.json`](local-1.14-2026-09-30/manifest.json) records every copied
+file's original relative path, byte length and SHA-256 digest.
+
+This is an archival snapshot, not a newly built or certified v1.14 release.
+The source and minified files have not been verified as corresponding
+builds. `TrackballControls.js` was absent from that checkout's `plugin/`
+directory and has not been substituted from another version. The GitHub
+legacy build separately contains its own TrackballControls dependency.
+
+The local source differs from GitHub in click coordinate handling, updating
+disabled controls, its material choice and loading unminified worker files.
+These differences must be assessed when defining compatibility tests; they
+must not be lost through an automatic overwrite from GitHub.
+
+The `general/` files are the original JSZip and JSZipUtils copies, preserved
+for historical reference. They are not dependencies of the new STL core.
+Keep the original license notices in all archived files.
+
+This snapshot does not establish which exact files the production server
+currently serves. No server or production files were changed to create it.

package/package.json

@@ -1,6 +1,75 @@
 {
   "name": "@omrips/viewstl",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "2.0.0-rc.2",
+  "description": "Local-first STL, OBJ, 3MF, STEP and IGES viewer with native WebGL2 and transferable worker geometry",
+  "type": "module",
+  "license": "MIT",
+  "homepage": "https://www.viewstl.com/plugin/",
+  "bugs": "https://github.com/omrips/viewstl/issues",
+  "keywords": [
+    "viewstl",
+    "webgl2",
+    "3d-viewer",
+    "stl",
+    "obj",
+    "3mf",
+    "step",
+    "iges"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "next",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/omrips/viewstl.git"
+  },
+  "main": "./build/v2/viewstl.cjs",
+  "module": "./build/v2/viewstl.js",
+  "types": "./build/v2/viewstl.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./build/v2/viewstl.d.ts",
+        "default": "./build/v2/viewstl.js"
+      },
+      "require": {
+        "types": "./build/v2/viewstl.d.cts",
+        "default": "./build/v2/viewstl.cjs"
+      }
+    },
+    "./worker": "./build/v2/viewstl.worker.js",
+    "./browser": "./build/v2/stl_viewer.min.js",
+    "./assets/*": "./build/v2/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "build/v2",
+    "LICENSE",
+    "docs/v2-usage.md",
+    "docs/v2-compatibility.md",
+    "docs/v2-verification.md",
+    "legacy/README.md",
+    "THIRD-PARTY-NOTICES.txt"
+  ],
+  "scripts": {
+    "build": "node scripts/build-v2.mjs",
+    "test": "node --test tests/v2/*.test.mjs",
+    "check:legacy": "node scripts/check-legacy.mjs",
+    "check:types": "tsc --noEmit --strict --module NodeNext --moduleResolution NodeNext --target ES2022 --lib ES2022,DOM tests/v2/types.ts",
+    "prepack": "node scripts/build-v2.mjs && node scripts/check-legacy.mjs",
+    "start": "node scripts/serve-v2.mjs"
+  },
+  "devDependencies": {
+    "esbuild": "0.28.2",
+    "fflate": "0.8.3",
+    "occt-import-js": "0.0.23",
+    "prettier": "3.9.9",
+    "saxes": "6.0.0",
+    "typescript": "5.9.3"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}