Merge pull request #8 from Aurtechmx/feat/v0.4.9

Feat/v0.4.9

Author: Aurtechmx

.github/ISSUE_TEMPLATE/bug_report.md

@@ -25,9 +25,7 @@ What you thought would happen instead.
 - Approximate point count and file size:
 - Where it came from (drone LiDAR, phone scan, exported from other software):
 
-Please do not attach confidential or sensitive scan data to a public issue.
-A tiny synthetic file that still shows the bug is ideal. See
-[SECURITY.md](../../SECURITY.md).
+A tiny synthetic file that still shows the bug is ideal.
 
 **Environment**
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,4 +24,3 @@ changes, note the browser and backend (WebGPU or WebGL 2) you tested in.
 - [ ] New behavior has unit tests where the logic is pure
 - [ ] Docs updated if behavior or formats changed
 - [ ] Commits follow Conventional Commits (`type(scope): description`)
-- [ ] No secrets, personal paths, or sensitive scan data included

CHANGELOG.md

@@ -2,6 +2,64 @@
 
 The format is based on Keep a Changelog and the project follows Semantic Versioning.
 
+## [0.4.9] - 2026-06-20
+
+### Added
+
+- **Data Fitness scorecard.** The Analyse panel now leads with one plain-language
+  verdict and a six-row traffic-light scorecard — Location & height, Coverage,
+  Ground detail, Vertical accuracy, Classification, Integrity — each with a
+  metaphor icon and a shape-distinct tone glyph (check / dash / triangle, never
+  colour alone). Caveats are non-hideable, and the USGS Quality Level badge is
+  shown only when earned (georeferenced, density above floor,
+  accuracy validated).
+- **Portable security headers.** A `_headers` file ships alongside `.htaccess`
+  so the same deploy bundle is hardened on Netlify / Cloudflare Pages-style
+  static hosts, not only Apache-family ones.
+
+### Changed
+
+- **File-scale honesty across every surface.** Large clouds are strided for
+  display, so the rendered count is a subset. The Scan Report, the Engineering
+  Inspection PDF, the Provenance density, and the Layers chip now report the
+  file's true point count and areal density (back-scaled from the sample), with
+  a "Loaded" row disclosing the in-memory subset — a dense survey no longer
+  reads as several times sparser than it is.
+- **Capture-type detection.** Dense drone surveys (UAV LiDAR, ~100–1000 pts/m²
+  over an open mapping footprint) classify as drone-mounted LiDAR rather than
+  Terrestrial Laser Scan, matching the cited density literature.
+- **Honest classification + terrain wording.** A classification dimension that
+  carries no assigned classes reads "Present, unclassified" instead of a bare
+  "Yes"; the Terrain Intelligence Report labels its ground-point counts "Ground
+  points / Used in DTM" rather than the misreadable "Source points".
+- **Analyse panel de-duplicated.** Each fact now has one home — the scorecard is
+  the headline, the assessment block carries export readiness + terrain products
+  + "Why?", and the collapsed Details holds the lone composite score and the
+  unique validation detail.
+- **Portable PWA manifest.** Relative `./` paths + `scope` so the app installs
+  correctly under subpath hosting; `X-Frame-Options: SAMEORIGIN` added.
+
+### Fixed
+
+- The point cloud no longer clips to a square on browser zoom-out.
+- Contour GeoJSON exports carry 3D coordinates (elevation) and per-feature
+  evidence grades.
+- Vertical units are honoured: `VerticalUnitsGeoKey` (4099) and the WKT vertical
+  `UNIT` are parsed, and Z is scaled to metres for accuracy bucketing.
+- Honest height wording for georeferenced scans. A horizontally-georeferenced
+  scan with an undeclared vertical datum (common for drone LiDAR — absolute
+  Z, no `VerticalCRS`) now reads "elevation datum not declared" rather than
+  "heights are relative." Its heights are absolute; only the datum is unverified.
+  Truly floating scans (no CRS) still read "relative."
+
+### Under the hood
+
+- A tested orchestration seam for the full-cloud grade (plan → coverage →
+  back-scaled grade) landed ahead of its streaming surface.
+- Brand assets trimmed ~1.05 MB from the deploy: the mark and favicon are
+  re-rastered to display size, and the unused full-resolution logo master moved
+  out of the shipped bundle (kept in the repo for regenerating share cards).
+
 ## [0.4.8] - 2026-06-17
 
 ### Added

CODE_OF_CONDUCT.md

@@ -28,7 +28,7 @@ project in public spaces.
 ## Enforcement
 
 Report unacceptable behavior to **info@aurtech.mx**. Reports are reviewed
-confidentially. Maintainers may remove, edit, or reject contributions, or take
+in private. Maintainers may remove, edit, or reject contributions, or take
 other appropriate action.
 
 This Code of Conduct is adapted from the

CONTRIBUTING.md

@@ -21,8 +21,8 @@ Open a GitHub issue and include:
 - your browser, OS, and GPU if it is relevant
 - the file format involved
 
-Please do not attach confidential scan data. Use a small, non-sensitive sample
-instead, or describe the file's structure. See [SECURITY.md](SECURITY.md).
+A small sample file that reproduces the issue, or a description of the file's
+structure, is ideal.
 
 ## Suggesting features
 

README.md

@@ -41,7 +41,7 @@ It opens georeferenced drone LiDAR surveys in LAS and LAZ, terrestrial laser-sca
 ## Key Advantages
 
 - Inspect point-cloud datasets directly in a modern web interface, with nothing to install.
-- Local-first by design: files are read and rendered in your browser, with no upload, which suits sensitive survey data.
+- Local-first by design: files are read and rendered in your browser, with no upload.
 - Opens compatible iPhone and mobile scan exports when saved as PLY, OBJ, GLB/GLTF, XYZ, or CSV.
 - Opens georeferenced drone LiDAR surveys in LAS and LAZ, and terrestrial laser-scanner data in E57, PTX, and PTS, with a coordinate bridge that keeps large survey coordinates precise.
 - Reads Point Cloud Library (PCD) files — ASCII, binary, and binary-compressed.
@@ -320,7 +320,7 @@ Full detail is in [`docs/mobile-browser-support.md`](docs/mobile-browser-support
 
 ## Research & Development Focus
 
-OpenLiDARViewer started as an experiment: how far can modern browser technology go in making LiDAR and point-cloud data easy to reach? It looks at browser-native point-cloud rendering, lightweight WebGL/WebGPU pipelines, human-centered interaction with 3D data, game-inspired navigation for technical inspection, local-first workflows for sensitive data, and simpler interfaces for complex datasets.
+OpenLiDARViewer started as an experiment: how far can modern browser technology go in making LiDAR and point-cloud data easy to reach? It looks at browser-native point-cloud rendering, lightweight WebGL/WebGPU pipelines, human-centered interaction with 3D data, game-inspired navigation for technical inspection, local-first workflows, and simpler interfaces for complex datasets.
 
 The aim is not to replace full GIS or survey-grade processing. It is to give people a fast, approachable way to open, inspect, navigate, measure, and present point clouds. See [`docs/research-notes.md`](docs/research-notes.md).
 
@@ -405,10 +405,20 @@ COPC streaming — local and remote — ships in v0.3.0 and is hardened across v
 
 ## What's in this release
 
-The current release is **v0.4.7**. The full, dated history is in
+The current release is **v0.4.9**. The full, dated history is in
 [CHANGELOG.md](CHANGELOG.md); the highlights below are a reverse-chronological
 summary.
 
+### v0.4.9 — Data Fitness scorecard, file-scale honesty & a leaner deploy
+- The **Data Fitness scorecard** leads the Analyse panel — one plain verdict plus a six-row traffic-light scorecard (Location & height, Coverage, Ground detail, Vertical accuracy, Classification, Integrity) with shape-distinct glyphs and a USGS Quality Level badge shown only when earned; the panel is de-duplicated so each fact has a single home
+- **File-scale honesty** across the Scan Report, the inspection PDF, the provenance density, and the Layers chip — the file's true point count and back-scaled density, not the strided display sample (with a "Loaded" row disclosing it); dense drone surveys identify as UAV LiDAR; georeferenced scans with an undeclared datum read "elevation datum not declared," not "relative"
+- A **leaner deploy** (~1.05 MB of brand assets trimmed), a portable `_headers` file and relative PWA manifest for any static host, and fixes for the zoom-out square-clip, contour-GeoJSON elevation, and vertical-unit handling
+
+### v0.4.8 — Derived classification & trust you can act on
+- **Derive a classification** for scans that ship functionally unclassified (every point ASPRS 0/1), with **RGB-assisted vegetation**, per-run **confidence**, and **void-honest heights** that leave hole-filled points unclassified rather than guessed
+- **Dataset Story** and **Export Health check** actions synthesise what a scan is, its biggest limiter, and a ready / caution / blocked hand-off verdict; shared `.olvsession` files remember the class-visibility filter
+- A new **Credits** page attributing the sample-data providers and the open-source dependencies; a producer's existing classification is never overwritten
+
 ### v0.4.7 — Accessibility, workflow & honesty fixes
 - A **colourblind-safe (Okabe-Ito) classification palette** toggle, an **annotation grouping** summary (totals, per-category counts, areas) in the panel and the PDF report, and a quiet **signal-tier cue** on the Dataset Intelligence card
 - The **workflow recorder** returns — record and replay `.olvworkflow` camera/tool sequences with a settings popup (file format, save destination, start/stop shortcut, replay speed, pre-record countdown, capture scope, loop)

RELEASE_NOTES_v0.4.8.md

@@ -58,6 +58,24 @@ uploaded.
   "validate before relying on it" caveat, and the provenance line now records
   when the RGB cue was used.
 
+## Credits
+
+- **Data sources & credits.** A new credits page — reachable from a **Credits**
+  link in the header, with a mirror at `docs/credits.md` — names the providers
+  behind the public sample datasets (USGS 3DEP and the swisstopo / GURS / AHN
+  national programmes) and thanks the open-source projects the viewer is built on:
+  three.js, loaders.gl, proj4, pdf-lib, laz-perf, and the COPC / EPT formats. The
+  README gained an Acknowledgements section, and `THIRD_PARTY_NOTICES.md` is now
+  complete.
+
+## Fixes
+
+- **Export units.** The Studio raster exports (contour, depth, height) and the
+  shared Width / Depth / Height / Density rows now label values in the scan's real
+  linear unit — feet for foot-based CRSs, metres otherwise — instead of a
+  hardcoded "m". Coordinates are stored in native units, so this corrects feet
+  shown as metres on US-survey-foot scans.
+
 ## Under the hood
 
 - The classifier gained a "classify the gaps" capability — derive only the

RELEASE_NOTES_v0.4.9.md

@@ -0,0 +1,80 @@
+# OpenLiDARViewer v0.4.9
+
+An honesty-and-polish release. The Analyse panel now leads with one plain
+verdict, every surface reports the file's true scale instead of the display
+sample, and the deploy is ~1 MB leaner. Still browser-native, local-first,
+nothing uploaded.
+
+## Highlights
+
+- **Data Fitness scorecard** — the Analyse panel opens with one plain-language
+  verdict and a six-row traffic-light scorecard: Location & height, Coverage,
+  Ground detail, Vertical accuracy, Classification, Integrity. Each row pairs a
+  metaphor icon with a shape-distinct tone glyph (check / dash / triangle, never
+  colour alone), the caveats can't be hidden, and the USGS Quality Level badge
+  appears only when earned — georeferenced, density above the
+  floor, and accuracy validated.
+- **Panel de-duplication** — each fact now has exactly one home. The scorecard is
+  the headline; the assessment block carries export readiness, terrain products,
+  and "Why?"; and the collapsed Details holds the single composite score plus the
+  validation detail nothing else shows.
+
+## File-scale honesty
+
+- **The numbers describe the file, not the display sample.** Large clouds are
+  strided down for rendering, so the in-memory count is a subset. The Scan Report,
+  the Engineering Inspection PDF, the Provenance density, and the Layers chip now
+  report the file's true point count and areal density (back-scaled from the
+  sample), with a "Loaded" row disclosing the subset — a dense survey no longer
+  reads as several times sparser than it is.
+- **Capture type** — dense drone surveys (UAV LiDAR, ~100–1000 pts/m² over an open
+  mapping footprint) are identified as drone-mounted LiDAR rather than Terrestrial
+  Laser Scan, matching the cited density literature.
+- **Honest height wording** — a horizontally-georeferenced scan with an undeclared
+  vertical datum (common for drone LiDAR: absolute Z, no VerticalCRS) reads
+  "elevation datum not declared" rather than "heights are relative." Its heights
+  are absolute; only the datum is unverified. Truly floating scans still read
+  "relative."
+- **Honest classification + terrain wording** — a classification dimension
+  carrying no assigned classes reads "Present, unclassified" instead of a bare
+  "Yes," and the Terrain Intelligence Report labels its ground-point counts
+  "Ground points / Used in DTM" rather than the misreadable "Source points."
+
+## Fixes
+
+- The point cloud no longer clips to a square on browser zoom-out.
+- Contour GeoJSON exports carry 3D coordinates (elevation) and per-feature
+  evidence grades.
+- Vertical units are honoured — `VerticalUnitsGeoKey` (4099) and the WKT vertical
+  `UNIT` are parsed, and Z is scaled to metres for accuracy bucketing.
+
+## Deploy & hardening
+
+- **~1.05 MB lighter.** The brand mark and favicon are re-rastered to display size
+  (the 530 KB master moves out of the shipped bundle into `design/`, kept for
+  regenerating share cards), so first paint carries a fraction of the previous
+  brand weight.
+- **Portable hardening** — a `_headers` file ships alongside `.htaccess` so the
+  same deploy is hardened on Netlify / Cloudflare Pages-style hosts, the PWA
+  manifest uses relative paths + scope for subpath hosting, and
+  `X-Frame-Options: SAMEORIGIN` is set.
+
+## Under the hood
+
+- A tested orchestration seam for the full-cloud grade (plan → coverage →
+  back-scaled grade) landed ahead of its streaming surface — consistent with the
+  project's "tested core first, UI follows" pattern.
+
+These confidence figures and quality grades describe the delivered data; they are
+not a survey-grade certification. Treat terrain products and exports as
+deliverable-ready only when the assessment reads **Good**, and validate against
+ground control where survey-grade accuracy is required.
+
+See [CHANGELOG.md](./CHANGELOG.md) for the full list.
+
+## Deploy
+
+Static files — host anywhere (GitHub Pages, Netlify, any CDN). The deploy zip
+extracts with web-safe permissions (644 files / 755 directories) and carries
+`index.html` plus `assets/` at the archive root, along with `.htaccess` and
+`_headers` for host-side security headers.

SECURITY.md

@@ -17,15 +17,9 @@ plan.
 
 OpenLiDARViewer is designed around local-first inspection. Scan files are read,
 parsed, and rendered entirely in the browser — there is no server to upload
-them to. This makes it suitable for confidential survey data. The security of
+them to. The security of
 your data also depends on how and where you choose to deploy and run the app.
 
-## Do not post sensitive data publicly
-
-When reporting a bug, **do not attach confidential or proprietary scan data**
-to public GitHub issues. Provide a minimal, non-sensitive sample, or describe
-the file structure instead.
-
 ## Supported versions
 
 OpenLiDARViewer is an R&D-stage project. Security fixes are applied to the