[DrunkOnJava]

Summary

The viewer's info panel lists a selected element's saved parameters (RE-207): instance, then type, named ones first, nameless ones behind a fold grouped by why they have no name (#255), each row saying where its parameter is defined. They are read for that element only, on selection, by a new savedParameters binding in a worker of its own; the open and every export are unchanged. File Status's Parameters row no longer says the rest are "still to be decoded".

Nothing is requested once the first file is open (Griffin, 2026-11-05, "Keep the claim, no request"): selecting an element, exporting IFC, plan or glTF, and opening the file again fetch nothing, and a page taken offline after it loaded does all of them.

Motivation

The last open acceptance item of #35 that is not blocked: "Viewer info panel displays them in readable form". The CLI, Python and IFC (--revit-property-sets) expose the saved parameters; the viewer showed a count and a sentence that RE-207 had already made wrong.

Changes

• rvt-wasm/src/lib.rs, rvt-wasm/Cargo.toml, Cargo.lock: savedParameters(bytes, ids, limits) returns JSON text: each entry is serde_json::to_value of the parameter native_element_parameters::read gives, the call rvt-elements makes, with the release and how far it is read. rvt gets unstable-research here, which "adds paths and changes nothing else" (src/research.rs); no file under src/ changes, so no export can move, and arm.sh's src/ gate path does not match rvt-wasm/src/. The result's keys are a 1.0-stable surface (RELEASE.md): release, release_read, release_experimental, releases_read, releases_measured, elements, unresolved_family_slots, instance_parameters_without_value. I chose them to say what they mean (not the research module's "native"): the read range, the measured range (Revit 2015 to 2022 are read experimentally, RE-281), and what could not be listed. ids is a Float64Array.
• viewer/src/parameters-worker.ts, viewer/src/saved-parameters.ts, viewer/src/wasm-failure.ts (new; the out-of-memory test both workers use), viewer/src/worker.ts, viewer/src/main.ts, viewer/src/styles.css, viewer/index.html, viewer/src/env.d.ts: the panel group and its states (loading, ready, empty, release not read, experimental release, no ElementId, error with Try again, read-when-asked), the page's map of answers, focus and a live region, the status row text, and the no-request mechanics below. The "Not recovered" note for an element with no IFC property set now says "IFC property sets".
• viewer/tests/parameters-row.spec.ts, viewer/tests/no-network.spec.ts, viewer/tests/worker-failures.spec.ts (now patches the inline worker's blob where it routed a worker URL), viewer/tests/folded-pieces.spec.ts (prints what a read does and what the page keeps on the BIM4LCA office, and fails if the read errors).
• .github/workflows/viewer-test.yml, .github/workflows/deploy-viewer.yml: after ci(viewer): build the WASM once per run, and test the file Deploy viewer publishes (#1457) #1458, --bin rvt-elements is built beside gen-fixture in the build job, copied into the artifact and checked to run in each leg; Deploy viewer builds and uploads its own artifact for tests and measure, so it carries the binary the same way. A local pnpm test:browser needs rvt-elements on PATH (viewer/README.md); the parameters-row specs skip without it locally and fail in CI.
• Docs: docs/viewer-api.md, docs/viewer-privacy-posture.md (the CSP change, below), README.md (13 bindings), docs/status.md, docs/support-matrix.json (it also drops the "wall's or floor's type parameters are not joined" caveat RE-256 made stale), docs/evidence.md, docs/export-diagnostics.md, docs/user-guide.md, docs/viewer-build-pipeline.md, docs/maintaining.md, viewer/README.md, and changelog.d/added/35-viewer-saved-parameters.md.

Design

A worker of its own, nothing resident. extract is a pass over the file, so the read is lazy, per selected element. The open's worker keeps no RevitFile and no bytes: a held handle would keep the file's bytes and every partition it inflates for the session, and its reads would hold up the panel (Core Interior's take seconds). Instead the page opens a worker for one element, which reads the File the page already holds, calls the binding, answers and is terminated, or is terminated at once when another element, a storey or a scaffold panel replaces the group. wasm linear memory only grows, so ending the worker gives a read's memory back. A worker the browser ends with no word (no event) is found by a Web Lock it holds, so "Reading" cannot show for ever.

No request once the file is open; the CSP change. The page's worker-src was 'self'; it is now 'self' blob:, and nothing else in the policy moves (docs/viewer-privacy-posture.md says so and why). Both workers (the open's and the reader) are bundled into the page (?worker&inline) and start from blob URLs; the decoder's glue is a static import (the main thread's exports used to import() it, and fetch the wasm, at the first export click). The first open's worker fetches the wasm once, compiles it and hands the module to the page, which keeps it: the next open (another phase, the saved-mesh toggle, the large-model retry), the readers (initSync({ module })) and the main thread's exports (default({ module_or_path }); the main thread does not allow initSync of a large module) start from it. The lazy loads in viewer/src that could run after the open were: import('../pkg/rvt.js') (static now), new Worker(new URL('./worker.ts', ...)) (inline now), the worker's fetch(new URL('../pkg/rvt_bg.wasm', ...)) (the page resolves the URL once, and fetches only at the first open). Opening a gallery demo still fetches the demo, which is an open.

First page load. The page's one script is 999.56 kB (271.47 kB gzipped) against 959.29 kB (262.82 kB) in the build of d1de8adf: 40.27 kB, 8.65 kB gzipped, more, mostly the glue and the two workers it used to fetch later; the built site holds one script, one stylesheet and the wasm.

When a selection is read on its own. A read has taken 0.74 to 1.04 times the open's wasm memory, and the ratio rises with the file (Einhoven 23 MiB, Core Interior 326, the office 910). Nothing above the office has been measured, so a selection is read on its own only while the wasm memory the page holds (the open's, plus the main thread's instance if an export made one) is at most 1 GiB (a quarter of ?memoryCeilingBytes= where that lowers the 4 GiB ceiling), and above that the panel asks first with a button whose copy says clicking may close the tab: a renderer out of memory takes the tab and the model with it, with no error. After a read that ran out of memory, or a worker that went without a word, that file is read only when asked. This replaces the rule that two instances stay inside the ceiling, which extrapolated past what is measured.

What the page keeps. Each element's answer, in a map on the page: at most 64 (?parametersRemembered= lowers it for the test), the least recently selected going first, emptied when a file is opened. Selecting an element again starts no worker. On the office after the test's selections it held 2 answers, 4,654 characters of JSON (the entries are small; the answers there have 8 entries).

Testing

Unit tests are banned in this repository: none added. Measured in Viewer tests run 42125048710, dispatched on head 3146f14e6fcf221adc4f632ac1a5cfa31a3b885d (the merge of main with #1457's changes included), release_wasm=false, on a CI runner: success in all three legs, check-wasm-in-site.sh finding the one wasm sha256 in the site in each. Deploy viewer run 42125109395, dispatched on the same head, on the release (LTO) wasm: success. Its tests job passed all 61 tests of the suite (the whole of it, on the wasm the site publishes), its measure job 6, and check-wasm-in-site.sh found the artifact's one sha256 (d2b60a7e…) in the built site in each of the three jobs that build it; the page's one script is the same size as in the viewer tests' build (999.56 kB, 271.47 kB gzipped). On the office with that wasm a read took 3.3 s in 942 MiB beside the open's 910 MiB, on selection, and the page kept 3 answers, 4,929 characters; the real capped read ran out of memory as in the other run. (deploy is skipped on a branch, by design.) This PR's head is 3146f14e plus documentation (the figures, in the changelog, docs/status.md and docs/viewer-api.md) plus a merge of main as it stood at #1470, whose export changes (#1456, #1470, src/ifc) were not part of either run; the full CI of the ready PR runs the viewer tests on this head. Earlier runs on earlier code are not counted; Deploy viewer 42122627698 and viewer tests 42122623374, on 7663a4f3, each failed once, in the test of a worker ended with no word, which ended a worker that had already answered (a read of Einhoven takes a fraction of a second); the test now holds the file back first.

viewer/tests/parameters-row.spec.ts, in the viewer's leg 1/3 (no new spec file). The oracle is the command line: the test runs rvt-elements on the same file.

	Einhoven (2023)	Core Interior (2024)	BIM4LCA office as built
Compared with rvt-elements, whole entries	37 of 37 tree elements: 28 with parameters (369 entries: 332 instance, 37 type, 8 named) equal, 7 with none show the empty state, 2 have no ElementId in the export (shown as such)	4 elements, IFCSLAB 22756 (4 entries), IFCWALL 22771 (11), IFCCOLUMN 22798 (17), IFCDOOR 80750 (21), equal	not compared
A read, time (a CI runner's)	median 153 ms, most 210 ms	1.5 to 1.9 s	3.9 s (8 entries, IFCCOVERING 2097832)
That read's wasm memory	17 MiB	275 MiB	943 MiB
The open's worker	23 MiB, 0.7 s in the open call	326 MiB, 17.3 s	910 MiB, 66.6 s
Read over open (memory)	0.74	0.84	1.04
How it was read	on selection	on selection	on selection (no button)
Kept by the page			2 answers, 4,654 characters of JSON

Also in the spec (each passed in 42125048710):

• A real out-of-memory read. A Chromium whose V8 caps wasm memory at 927 MiB (--wasm-max-mem-pages, the pattern of memory-ceiling-capped.spec.ts) opens the office (910 MiB) and the read (943 MiB) really runs out: the page says "The tab ran out of memory reading the file a second time (unreachable)... read only when asked from now on", and the next element asks. A read of Einhoven cannot fail after its open succeeds (17 MiB against 23), so the office is the only file in CI where a cap separates the two.
• No request, offline. After the load the page is taken offline and every request is recorded (workers included): three elements are read and equal rvt-elements', an IFC, a plan and a glTF export are made, the file is opened again (the saved-mesh toggle), an element is read again, and no http(s) request was made. no-network.spec.ts runs the same exports and re-open, and a selection, in phases that allow nothing, and fails if the sample has no element to select, if the wasm is fetched to boot the page or more than once.
• The gate at its edge (a limit 8 MiB over and 8 MiB under Einhoven's measured open memory: read on selection, then asked); the bare-unreachable branch and its copy, and the file read only when asked afterwards; a worker ended with no word, with the file held back four seconds so it is still reading; a read for an element no longer shown ended (another element, a storey), and the shown element's read not started over by selecting it again; an element selected again starting no worker; a copy of the file opened under another name emptying the map; the bound; a read that fails with a panic, with Try again, and focus on the result; the empty state; the Parameters row text; Revit 2013 (the worker's answer replaced) and Revit 2019 experimental (replaced).

Not verified:

• The release-not-read and experimental-release states. No file of a release outside Revit 2015 to 2027, or of 2015 to 2022, is in the viewer's job, so those two tests replace the worker's answer to the page with the binding's shape for one (release_read false; release_experimental true). They test the page's rendering only. The Rust branches (NATIVE_RELEASES.contains, the measured range) are not exercised by any file.
• tools/check-local.sh, clippy and tools/ci/check-workflows.py (no local compute; PyYAML is not installed here); CI's fast jobs on this PR are the check. The wasm network-import audit passed in the viewer legs.
• An ElementId above u32::MAX: the binding reads it, the command line lists such elements as id: null, so nothing compares them.
• The office is not compared with rvt-elements; only that its read does not error. The gate is held at its edge on Einhoven's open memory; no file between 910 MiB and the 4 GiB ceiling is in the viewer's job, which is why the limit is the measured 1 GiB.
• The CDP session of no-network.spec.ts may not see worker requests; the offline test, which records every request and fails any, is what covers them.
• Screen-reader announcements were not heard: the live region's text and the focus move are asserted, not a screen reader's output.

Breaking changes

None. A binding is added (tools/ci/wasm-api.py compat has nothing to flag); no existing binding or output changes. The worker-src of the page's Content-Security-Policy gains blob:.

Related issues

Refs #35 (#255 and the family built-in slots stay open).