[chaxus]

Merge Verdict

[APPROVE]

Independent review findings have been fixed and re-reviewed. The changes preserve existing editable Office defaults and eager PDF completion; virtual PDF rendering is opt-in.

Summary

• Preserve unsaved Office edits across close-control and readonly updates. Serialize authenticated mode commands, negotiate delayed modern/legacy renderers, stop chunk reads/sends on cancellation or readonly changes, and support ordinary HTTP hosts.
• Make PDF canvases responsive with per-page pixel/DPR limits. Add optional viewport rendering with at most six active canvases, recycling, resize repainting and explicit worker cleanup.
• Expose typed element APIs and safe manual-constructor narrowing; remove unused ranui and its obsolete style transformer.
• Release demo-owned Blob URLs and describe the remote Office iframe privacy boundary.
• Prepare 0.3.0 with verified immutable artifacts, source-tag guards and integrity-aware idempotent publishing.

Risk Analysis

Risk	Level	Mitigation
Office mode/transport races	Medium	Real iframe regressions for delayed readiness, correlated replies, rapid toggles, source replacement, chunk ACKs and cancellation; live DOCX/PPTX integration
PDF memory and lifetime	Medium	Eager remains the default; opt-in virtual mode caps active canvases and cleans up on close, replacement, abort and worker failure
Large-page sharpness	Low	Explicit per-page pixel limits trade resolution for bounded allocation; documented
Release retries	Medium	Only the exact verified tarball is published; matching registry integrity skips a retry, mismatches and registry failures stop it

Design Decisions

• Use document:set-readonly on the current Office session so UI/mode updates preserve edits.
• Treat a legacy ACK as protocol confirmation while keeping modern readiness probes active; a timeout alone does not select the legacy protocol.
• Preserve eager load semantics. Virtual load means the initial viewport and buffer are painted; its worker remains active until the owning preview cancels.
• Keep manual imports passive and return existing foreign constructors unchanged; provide a type guard before constructing a preview.
• Preserve multiple commits as requested. Publish through the existing npm trusted publisher.

Code Concerns

No unresolved review findings. The slow-modern negotiation, readonly read/ACK boundaries and reconnect cleanup were fixed with failing-before/passing-after regressions. The original Issue #4 sample is still unavailable; this PR does not claim that exact document is fixed.

Verification

Conclusion basis: Verified.

• Frozen pnpm install, strict TypeScript, formatting and ESM/UMD/declaration build.
• 144 browser regressions across Chromium, Firefox and WebKit.
• 44 release-helper unit tests covering fake-registry failures, artifact identity, retry behavior and tagged-source validation.
• Actual installed-tarball NodeNext/Bundler/React/CJS/SSR consumer checks, publint and browser checks of manual/ESM/UMD eager and virtual PDF pixels, assets, scrolling and cleanup.
• Live remote DOCX: unsaved text survives readonly/UI changes and export; iframe and dirty state retained with one load. Live PPTX: readonly/UI changes retain the iframe and SDK restrictions. No synthetic slide edit is claimed.

See docs/verification-0.3.0.md for coverage and limits. PDF caps bound active canvas allocations, not total PDF.js/process memory.