[wybaby168]

Summary

• Keep zoom buttons in fixed positions at the minimum and maximum scale, disabling unavailable operations. This prevents repeated clicks from moving onto the reset control in the Web and Vue 3 toolbars.
• Honor the existing toolbar.items['zoom-reset'] visibility option while retaining API reset behavior and explicit zoom permissions. Share visibility policy through an additive core helper without changing the public toolbar-state interface.
• Add pdf.zoomToolbar: false to hide only the PDF renderer's zoom group while retaining page navigation and rotation. Existing pdf.toolbar: false behavior remains supported.
• Retain the three focused unit suites in the public source and derive test:toolbar-zoom-github-398 into the main CI command. Run the real interaction regression in Chromium and WebKit and upload its evidence.
• Use the official runner's existing Ubuntu HTTPS archive alternatives for browser dependencies and Noto CJK. Bound installation steps to ten minutes, with two APT retries and a 30-second idle timeout; retain signed metadata, package hashes, font matching and every browser gate.
• Source: c3590741e7b173a7dee25560b58c65cc9cd73e75.

Related issue

Closes #398. Package release is pending; this PR changes source on main.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Check	Result
Baseline regression	Failed as expected: the initial toolbar lacked the reserved reset position; existing limit behavior removed controls
pnpm test:toolbar-zoom-github-398	Pass in private and public trees: 36 targeted checks
Public complete build and component-demo build	Pass through the official build commands
Public root vitest run and pnpm type-check	Pass: 57 files / 494 tests / one existing skip; all type checks passed
pnpm verify:vue3-toolbar-browser	Pass: existing Vue toolbar contracts plus 14 actual UI cases, seven each in Chromium 156.0.8078.4 and WebKit 27.2
Browser interruption and layout evidence	Pass at desktop 1280×800: Web/Vue repeated clicks at both limits, reset, hidden reset policy and permissions; dynamic configuration, cancellation and late-source completion are covered for Web. PDF page 2/13 and 90-degree rotation passed; no external requests or page errors
Public governance and source licenses	Pass: 152 governance tests / one existing skip, formatting and exact 96-package DICOM SDK closure
Complete public source-index verification	Pass: 5533 exact source blobs and 244 transformed outputs, zero missing/mismatched/forbidden paths
CI installation regression	Pass: eight new cases cover the official mirror configuration, unchanged trust inputs, idempotence, rejected unknown/insecure configurations and symlinks, plus browser/font gate wiring. Full final-source private acceptance passed all eight stages
Current official npm audits of actual public/private graphs	Pass: zero blocking findings; documented low Vue 2 exception retained. The separate legacy CLI 3 example retains its separately reported open advisories
Final-head GitHub CI and independent review	Pass for 183e93c474b98706596c8119b8e71a5ad81c8804: complete Public CI, focused, cold consumers, security and governance passed; independent runtime and CI-delta reviews found no blockers. Chromium/WebKit are desktop engines, not an iOS device claim

Sample / fixture evidence

• Existing input fixtures served locally by verify-vue3-toolbar-browser.mjs: image and 13-page PDF.
• apps/component-demo/scripts/verify-zoom-toolbar-browser.mjs performs actual source cancellation, delayed old-response completion, repeated pointer clicks, navigation and rotation.
• The focused unit fixtures are synthetic; no customer document was added.

Visual evidence

Captured from the validated implementation at 1280×800. Final-head Chromium/WebKit reports and screenshots record seven passing cases per engine, zero external requests and zero page errors; current artifact screenshots were visually checked.

Risk and compatibility

• Affected packages/formats: core toolbar policy, Web and Vue 3 controls, PDF internal toolbar and option documentation. All framework component builds and type checks passed.
• Compatibility or migration risk: controls intentionally remain present but disabled at scale boundaries. Existing hard permissions continue to restrict operations. Reset visibility is a UI policy and does not remove the programmatic reset API. PDF zoom-only visibility defaults to enabled.
• Offline/deployment assumptions: existing local Worker/font assets are unchanged; browser tests reject external requests. This does not address the separate sample-dependent PDF Chinese-text report or add image panning.
• CI installation assumptions: only the ephemeral runner's known Ubuntu mirror list and download options change. Source suites and signing keys remain intact. A preinstalled Noto package still has to satisfy the font-cohort and real-browser geometry checks.
• Rollback: revert the policy, UI, option and documentation together; retain the regression fixtures and CI evidence contract.

Checklist

• I added or updated focused automated coverage, or explained why it is not needed.
• I updated user-facing documentation or release notes when behavior or API changed, or marked them not applicable.
• I verified offline/private-deployment paths when changing Worker, WASM, fonts, vendor assets, or URLs.
• I did not commit secrets, customer files, private samples, generated caches, or unrelated changes.