[chaxus]

Merge Verdict

[APPROVE] Local verification and independent code review passed; merge after the new GitHub checks pass. Preserve the individual commits and use rebase merge.

Summary

Prepare @ranui/preview 0.2.0 while preserving automatic r-preview registration and existing URL attributes. Reconcile this PR's keyboard/mobile improvements with the current loading UI, add passive manual registration and enforced opt-in Office read-only mode, isolate concurrent loads/dialogs, and replace the old PDF renderer with a complete local PDF.js distribution.

Fixes #1
Fixes #3
Fixes #6

PR #8 already resolved the public event issue (#7). Issue #4 stays open because its original Word file has not been supplied.

Risk Analysis

Risk	Level	Mitigation
PDF engine/toolchain upgrade	Medium	Three-engine regressions, actual installed ESM/manual/UMD PDF pixels and packaged-font requests; document evergreen support and Node 24+ tooling
Self-hosted Office compatibility	Medium	Preserve legacy editable chunk transport; require a modern embed API for read-only rather than silently allowing editing; test current deployed DOCX/PPTX SDK permissions
Stale work and concurrent dialogs	Medium	Per-operation abort/connection ownership, source replacement and disconnect tests, modal paint/keyboard ordering regressions
Word export report #4	Unresolved source-specific report	Synthetic CJK/Latin + 4000×2000-image export retains text/image; request the original file before claiming a fix

Design Decisions

• Keep root/preview automatic registration, namespace and UMD compatibility. /manual registers only when called and allows a custom tag.
• Use the renderer's correlated document:* API with exact iframe source/origin checks, transferring a browser File without base64 for modern hosts.
• Keep read-only opt-in; legacy renderers retain editing and receive a clear upgrade error if read-only is requested.
• Load Office only when needed. Bundle PDF worker and local fonts/cMaps/WASM; preserve relative asset paths.
• Publish the exact verified tarball from a separate OIDC job scoped to the npm environment.

Code Concerns

Independent review found one modal stacking/Escape defect; both reproductions and the fix are included in 650727e. No remaining P1/P2 findings. Prior global declaration packaging issues are replaced by strict installed-consumer checks. No new credentials are included.

Verification

Conclusion basis: Verified.

• Frozen install, TypeScript, full Prettier and diff whitespace checks passed.
• 42 regressions passed across Chromium, Firefox and WebKit.
• ESM/UMD builds and installed-tarball checks passed: strict NodeNext/Bundler/CJS, optional React, passive SSR, public exports, actual PDF pixels and local fonts through all three browser entries.
• Five live Office cases passed: DOCX/PPTX read-only and editable defaults; large-image DOCX exported to DOCX/PDF with CJK/Latin text and image retained.
• Added GitHub browser/package CI and provenance-enabled trusted publishing.

Coverage details and reproducible live commands: verification report. Not covered: the unavailable original Issue #4 document, older browsers, and direct CJK-cMap/JPX fixture rendering.