From 7b46ddee45aac6a53a99b3a25335b39df5428d0d Mon Sep 17 00:00:00 2001
From: Griffin Long <151978260+DrunkOnJava@users.noreply.github.com>
Date: Tue, 3 Nov 2026 13:36:57 -0500
Subject: [PATCH 1/9] feat(viewer): the loading card shows the decoder's own
 progress, and a model too large for the tab says so (#1195)

The wasm open binding takes an optional progress function that the decoder's
WalkerControl reports to, throttled to one call per whole percent of a stage.
The worker posts each report while the wasm call runs, the card names the
stage and fills its bar with the stage's count, and the size-derived estimate
stays as the first thing it says. A file whose size says it may need more than
a tab's 4 GiB is warned about before the decode; a wasm instance that runs out
of memory (a bare unreachable with no panic message, or a capacity overflow)
is reported as too large for the browser, with how far it got and the CLIs
that open it. Playwright covers the stages, the part-way bar on Core Interior,
the warning, and a real stop under a V8-capped wasm memory.
---
 Cargo.lock                                    |   1 +
 .../added/1195-viewer-progress-too-large.md   |  12 +
 rvt-wasm/Cargo.toml                           |   1 +
 rvt-wasm/src/lib.rs                           | 138 ++++++++-
 src/ifc/mod.rs                                |  22 +-
 viewer/index.html                             |  24 +-
 viewer/src/main.ts                            | 280 ++++++++++++++++--
 viewer/src/styles.css                         |  24 +-
 viewer/src/worker.ts                          |  75 ++++-
 viewer/tests/load-progress.spec.ts            | 184 ++++++++++++
 viewer/tests/memory-ceiling.spec.ts           | 118 ++++++++
 viewer/tests/saved-meshes-measure.spec.ts     |  66 ++++-
 viewer/tests/viewer-regression.spec.ts        |  10 +-
 13 files changed, 903 insertions(+), 52 deletions(-)
 create mode 100644 changelog.d/added/1195-viewer-progress-too-large.md
 create mode 100644 viewer/tests/load-progress.spec.ts
 create mode 100644 viewer/tests/memory-ceiling.spec.ts

diff --git a/Cargo.lock b/Cargo.lock
index ec816d9e0..673ebdd63 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -867,6 +867,7 @@ dependencies = [
 name = "rvt-wasm"
 version = "0.12.2"
 dependencies = [
+ "js-sys",
  "rvt",
  "serde",
  "serde-wasm-bindgen",
diff --git a/changelog.d/added/1195-viewer-progress-too-large.md b/changelog.d/added/1195-viewer-progress-too-large.md
new file mode 100644
index 000000000..fd99589d1
--- /dev/null
+++ b/changelog.d/added/1195-viewer-progress-too-large.md
@@ -0,0 +1,12 @@
+- **The browser viewer shows the decoder's own progress, and says when a
+  model is too large for a tab.** The loading card names the stage the
+  decoder is in (the stages `rvt-gltf --progress` prints) and fills its bar
+  with that stage's count, where it used to sweep and guess "about N s" from
+  the file's size. `openRvtBytesWithDiagnosticsModeAndOpenLimits` takes an
+  optional fourth argument, a function called with the stage, the count done
+  and the count it is out of. A file whose size says it may need more than a
+  tab's 4 GiB (about ten times its size, the figure of the largest reference
+  model) is warned about before the decode and still tried. When the wasm
+  instance runs out of memory, the viewer says the model is too large for the
+  browser, how far the decode got, and that `rvt-ifc` and `rvt-gltf` read
+  models of any size, instead of `RuntimeError: unreachable` (#1195).
diff --git a/rvt-wasm/Cargo.toml b/rvt-wasm/Cargo.toml
index 66c557270..fc415a646 100644
--- a/rvt-wasm/Cargo.toml
+++ b/rvt-wasm/Cargo.toml
@@ -22,6 +22,7 @@ workspace = true
 [dependencies]
 rvt = { path = ".." }
 wasm-bindgen = "0.2"
+js-sys = "0.3"
 serde = { version = "1", features = ["derive"] }
 serde-wasm-bindgen = "0.6"
 
diff --git a/rvt-wasm/src/lib.rs b/rvt-wasm/src/lib.rs
index fd4c77c15..0cec0bcaf 100644
--- a/rvt-wasm/src/lib.rs
+++ b/rvt-wasm/src/lib.rs
@@ -19,10 +19,12 @@
 //! compiled `.wasm` for those imports and fails the build if any
 //! appear.
 
+use std::cell::RefCell;
+
 use wasm_bindgen::prelude::*;
 
 use rvt::RevitFile;
-use rvt::control::WalkerControl;
+use rvt::control::{ProgressEvent, Stage, WalkerControl};
 use rvt::ifc::{
     ExportQualityMode, ExportResult, IfcModel, RvtDocExporter,
     gltf::model_to_glb,
@@ -78,6 +80,7 @@ pub fn open_rvt_bytes_with_diagnostics_mode(bytes: &[u8], mode: &str) -> Result<
         OpenLimits::default(),
         rvt::walker::WalkerLimits::default(),
         true,
+        None,
     )
 }
 
@@ -106,15 +109,105 @@ pub fn open_rvt_bytes_with_diagnostics_mode(bytes: &[u8], mode: &str) -> Result<
 /// skipped item and a `Not read whole:` warning per stream, #1075), and the
 /// model is missing what it holds. Unknown fields and fractional, negative
 /// or non-finite byte limits throw.
+///
+/// `progress`, when given, is a JS function `(stage, done, total)` called as
+/// the decoder works: `stage` is a [`Stage`] name as `rvt-gltf --progress`
+/// prints it (`schema-parse`, `candidate-scan`, `element-decode`,
+/// `partition-scan`, `saved-graphics`, `saved-meshes`), `done` a count and
+/// `total` the count it is out of, or `null` where the stage has no
+/// denominator yet (#1195). It is called when a stage begins, when it ends,
+/// and each time a stage with a total passes another whole percent, so a
+/// stage costs at most about a hundred calls. An exception it throws is
+/// ignored.
 #[wasm_bindgen(js_name = openRvtBytesWithDiagnosticsModeAndOpenLimits)]
 pub fn open_rvt_bytes_with_diagnostics_mode_and_open_limits(
     bytes: &[u8],
     mode: &str,
     limits: JsValue,
+    progress: Option<js_sys::Function>,
 ) -> Result<JsValue, JsValue> {
     install_panic_hook();
     let (open_limits, walker_limits, saved_meshes) = limits_from_js(limits)?;
-    export_with_limits(bytes, mode, open_limits, walker_limits, saved_meshes)
+    export_with_limits(
+        bytes,
+        mode,
+        open_limits,
+        walker_limits,
+        saved_meshes,
+        progress,
+    )
+}
+
+/// The JS function a decode reports its progress to, and the last report it
+/// forwarded. A `js_sys::Function` is not `Send + Sync`, which
+/// [`WalkerControl::with_progress`] requires, so it sits here, where one
+/// single-threaded wasm instance reads it, and the closure handed to the
+/// control captures nothing.
+struct ProgressSink {
+    callback: js_sys::Function,
+    last: Option<(Stage, Option<u64>)>,
+}
+
+thread_local! {
+    static PROGRESS: RefCell<Option<ProgressSink>> = const { RefCell::new(None) };
+}
+
+/// The control of one decode: reports to `progress` when a function is given
+/// and does nothing otherwise.
+fn progress_control(progress: Option<js_sys::Function>) -> WalkerControl {
+    match progress {
+        Some(callback) => {
+            PROGRESS.with(|slot| {
+                *slot.borrow_mut() = Some(ProgressSink {
+                    callback,
+                    last: None,
+                });
+            });
+            WalkerControl::new().with_progress(forward_progress)
+        }
+        None => WalkerControl::default(),
+    }
+}
+
+fn clear_progress() {
+    PROGRESS.with(|slot| {
+        slot.borrow_mut().take();
+    });
+}
+
+/// Hands `event` to the JS function unless it is a report within the same
+/// whole percent of the same stage as the last one handed over. The decoder
+/// reports each megabyte scanned and every 256th candidate, which the page
+/// has no use for; a stage with no total reports once, when it begins.
+fn forward_progress(event: ProgressEvent) {
+    PROGRESS.with(|slot| {
+        let Ok(mut slot) = slot.try_borrow_mut() else {
+            return;
+        };
+        let Some(sink) = slot.as_mut() else {
+            return;
+        };
+        let percent = event
+            .total
+            .filter(|total| *total > 0)
+            .map(|total| event.done.saturating_mul(100) / total);
+        let finished = event.total.is_some_and(|total| event.done >= total);
+        let same_stage = sink.last.is_some_and(|(stage, _)| stage == event.stage);
+        let same_percent = sink.last.is_some_and(|(_, last)| last == percent);
+        if same_stage && same_percent && !finished {
+            return;
+        }
+        sink.last = Some((event.stage, percent));
+        let total = event
+            .total
+            .map_or(JsValue::NULL, |total| JsValue::from_f64(total as f64));
+        let _ = sink.callback.call3(
+            &JsValue::NULL,
+            &JsValue::from_str(event.stage.as_str()),
+            &JsValue::from_f64(event.done as f64),
+            &total,
+        );
+    });
 }
 
 fn export_with_limits(
@@ -123,14 +216,41 @@ fn export_with_limits(
     open_limits: OpenLimits,
     walker_limits: rvt::walker::WalkerLimits,
     saved_meshes: bool,
+    progress: Option<js_sys::Function>,
+) -> Result<JsValue, JsValue> {
+    let control = progress_control(progress);
+    let result = export_with_control(
+        bytes,
+        mode,
+        open_limits,
+        walker_limits,
+        saved_meshes,
+        &control,
+    );
+    clear_progress();
+    result
+}
+
+fn export_with_control(
+    bytes: &[u8],
+    mode: &str,
+    open_limits: OpenLimits,
+    walker_limits: rvt::walker::WalkerLimits,
+    saved_meshes: bool,
+    control: &WalkerControl,
 ) -> Result<JsValue, JsValue> {
     let quality_mode = ExportQualityMode::parse(mode).map_err(err_str)?;
     let mut rf = RevitFile::open_bytes_with_limits(bytes.to_vec(), open_limits).map_err(err_str)?;
     let mut result = RvtDocExporter
-        .export_with_diagnostics_mode_and_limits(&mut rf, quality_mode, walker_limits)
+        .export_with_diagnostics_mode_limits_and_control(
+            &mut rf,
+            quality_mode,
+            walker_limits,
+            control,
+        )
         .map_err(err_str)?;
     if saved_meshes {
-        attach_saved_meshes(&mut rf, &mut result);
+        attach_saved_meshes(&mut rf, &mut result, control);
     }
     serde_wasm_bindgen::to_value(&result).map_err(err_str)
 }
@@ -140,16 +260,12 @@ fn export_with_limits(
 /// 2027 only), and recount its diagnostics. Saved graphics only improve
 /// bodies: when they cannot be read the model keeps its bounding boxes and the
 /// diagnostics carry a warning saying so.
-fn attach_saved_meshes(rf: &mut RevitFile, result: &mut ExportResult) {
+fn attach_saved_meshes(rf: &mut RevitFile, result: &mut ExportResult, control: &WalkerControl) {
     let Some(scope) = rvt::ifc::saved_meshes::default_scope(rf) else {
         return;
     };
-    match rvt::ifc::saved_meshes::attach_scoped_with_control(
-        rf,
-        &mut result.model,
-        scope,
-        &WalkerControl::default(),
-    ) {
+    match rvt::ifc::saved_meshes::attach_scoped_with_control(rf, &mut result.model, scope, control)
+    {
         Ok(_) => rvt::ifc::recount_exported(&mut result.diagnostics, &result.model),
         Err(e) => result.diagnostics.warnings.push(format!(
             "Saved graphics not read, door and window bodies unchanged: {e}"
diff --git a/src/ifc/mod.rs b/src/ifc/mod.rs
index 5a48f126f..94e379044 100644
--- a/src/ifc/mod.rs
+++ b/src/ifc/mod.rs
@@ -1016,7 +1016,27 @@ impl RvtDocExporter {
         quality_mode: ExportQualityMode,
         limits: crate::walker::WalkerLimits,
     ) -> Result<ExportResult> {
-        let model = self.export_with_mode_and_limits(rf, quality_mode, limits)?;
+        self.export_with_diagnostics_mode_limits_and_control(
+            rf,
+            quality_mode,
+            limits,
+            &crate::control::WalkerControl::default(),
+        )
+    }
+
+    /// Same as [`Self::export_with_diagnostics_mode_and_limits`], with the
+    /// walk's progress reported to `control` and a cancelled token stopping
+    /// the export with [`crate::Error::Cancelled`], as
+    /// [`Self::export_with_mode_limits_and_control`] does for the model alone.
+    /// The diagnostics are built after the walk and report nothing.
+    pub fn export_with_diagnostics_mode_limits_and_control(
+        &self,
+        rf: &mut crate::RevitFile,
+        quality_mode: ExportQualityMode,
+        limits: crate::walker::WalkerLimits,
+        control: &crate::control::WalkerControl,
+    ) -> Result<ExportResult> {
+        let model = self.export_with_mode_limits_and_control(rf, quality_mode, limits, control)?;
         let diagnostics = build_export_diagnostics_with_limits(
             rf,
             &model,
diff --git a/viewer/index.html b/viewer/index.html
index 291d48d97..2bacbb011 100644
--- a/viewer/index.html
+++ b/viewer/index.html
@@ -119,26 +119,36 @@ <h2>Demo gallery</h2>
           </div>
         </div>
         <!--
-          Loading treatment. Visually indeterminate (no fake percentage —
-          the decoder cannot report one), but it carries elapsed seconds
-          and a size-derived expectation so a long decode reads as work,
-          not as a hang. aria-hidden because #status already announces
-          every worker step on the same polite channel.
+          Loading treatment. The bar sweeps until the decoder reports a stage
+          with a count (rvt::control::Stage, #1195), then fills with that
+          stage's own progress and names it; the elapsed seconds and the
+          size-derived expectation stay as the fallback before the first
+          report. A file likely to need more memory than a tab has says so
+          here before the decode. aria-hidden because #status already
+          announces every stage on the same polite channel.
         -->
         <div id="load-overlay" class="hidden" aria-hidden="true">
           <div class="load-card">
             <div id="load-step">Opening file</div>
-            <div class="sweep-rail"></div>
+            <div
+              id="load-rail"
+              class="sweep-rail"
+              role="progressbar"
+              aria-label="Decoding progress"
+              aria-valuemin="0"
+              aria-valuemax="100"
+            ></div>
             <div id="load-metrics">
               <span id="load-elapsed">0 s elapsed</span>
               <span id="load-hint"></span>
             </div>
+            <div id="load-warning" class="hidden" role="note"></div>
             <div class="load-privacy">Parsed in this tab. Nothing is uploaded.</div>
           </div>
         </div>
         <div id="scaffold-note" class="hidden">
           <div class="note-card" role="note">
-            <div class="note-title">Nothing to draw</div>
+            <div class="note-title" id="scaffold-note-title">Nothing to draw</div>
             <p id="scaffold-note-body"></p>
             <div class="note-actions">
               <button class="note-btn" id="show-real-projects" type="button">
diff --git a/viewer/src/main.ts b/viewer/src/main.ts
index b3b7460f8..59bb6dbc6 100644
--- a/viewer/src/main.ts
+++ b/viewer/src/main.ts
@@ -55,7 +55,10 @@ const loadOverlayEl = $('load-overlay');
 const loadStepEl = $('load-step');
 const loadElapsedEl = $('load-elapsed');
 const loadHintEl = $('load-hint');
+const loadRailEl = $('load-rail');
+const loadWarningEl = $('load-warning');
 const scaffoldNoteEl = $('scaffold-note');
+const scaffoldNoteTitleEl = $('scaffold-note-title');
 const scaffoldNoteBodyEl = $('scaffold-note-body');
 const showRealProjectsBtn = $('show-real-projects') as HTMLButtonElement;
 const dismissScaffoldNoteBtn = $('dismiss-scaffold-note') as HTMLButtonElement;
@@ -425,12 +428,11 @@ function toast(message: string, kind: ToastKind = 'info'): void {
 
 // ---------- Viewport loading treatment ----------
 /**
- * Observed decode throughput across the staged demos: since the
- * partition streams are inflated once per file (#266) the 33.7 MB
- * project decodes in about 3 s in the browser, measured on the deployed
- * site. Only ever used to set an expectation — the decoder cannot report
- * real progress, so the bar stays indeterminate rather than faking a
- * percentage.
+ * What the loading card says before the decoder has reported anything, and
+ * all it says for a file whose stages are too quick to show: the throughput
+ * observed when the 33.7 MB project decoded in about 3 s on the deployed site
+ * (a laptop's; Deploy viewer's runner takes about 24 s for it). Once the
+ * decoder reports a stage (#1195) the card shows that stage's own counts.
  */
 const DECODE_BYTES_PER_SECOND = 11e6;
 
@@ -442,15 +444,157 @@ function loadExpectation(bytes: number): string {
   return `${size}, about ${seconds} s`;
 }
 
+/** The most memory a wasm32 instance can address, and so a tab can give the decoder. */
+const WASM32_CEILING_BYTES = 4 * 2 ** 30;
+
+/**
+ * The memory an open takes, per byte of the file, as the figure to warn with:
+ * Core Interior, the largest reference model (32 MiB), peaks at 324 MiB, 10.1
+ * times, and the smaller ones need 13 to 25 times (#1150, and the estimate
+ * columns of tests/saved-meshes-measure.spec.ts). Models of hundreds of MiB
+ * have been seen to need less per byte natively (#1075), so this is the floor
+ * of what was measured, not a promise of what a large model takes.
+ */
+const PEAK_MEMORY_PER_FILE_BYTE = 10;
+
+/** `?memoryCeilingBytes=` lowers the ceiling the warning compares with, for the browser test; a browser capped the same way (V8's `--wasm-max-mem-pages`) then really stops there. */
+const memoryCeilingBytes =
+  wholeBytesParam(new URLSearchParams(window.location.search), 'memoryCeilingBytes') ??
+  WASM32_CEILING_BYTES;
+
+function estimatePeakBytes(fileBytes: number): number {
+  return fileBytes * PEAK_MEMORY_PER_FILE_BYTE;
+}
+
+/** Memory in the binary units the 4 GiB ceiling is spoken in. */
+function formatMemory(bytes: number): string {
+  const trim = (value: number): number => Number(value.toFixed(1));
+  if (bytes >= 2 ** 30) return `${trim(bytes / 2 ** 30)} GiB`;
+  if (bytes >= 2 ** 20) return `${trim(bytes / 2 ** 20)} MiB`;
+  return `${trim(bytes / 2 ** 10)} KiB`;
+}
+
+/** The decoder's stages (`rvt::control::Stage`) as the card names them, and how it counts each. */
+const DECODE_STAGES: Record<string, { label: string; count: (done: number, total: number) => string }> = {
+  'schema-parse': { label: 'Reading the schema', count: () => '' },
+  'candidate-scan': {
+    label: 'Scanning for elements',
+    count: (done, total) => `${formatMemory(done)} of ${formatMemory(total)}`,
+  },
+  'element-decode': {
+    label: 'Decoding elements',
+    count: (done, total) =>
+      `${done.toLocaleString('en-US')} of ${total.toLocaleString('en-US')} candidates`,
+  },
+  'partition-scan': {
+    label: 'Reading partition streams',
+    count: (done, total) => `${done} of ${total} streams`,
+  },
+  'saved-graphics': { label: 'Reading saved graphics', count: () => '' },
+  'saved-meshes': {
+    label: 'Drawing doors and windows from saved meshes',
+    count: (done, total) => `${done.toLocaleString('en-US')} of ${total.toLocaleString('en-US')} elements`,
+  },
+};
+
+/**
+ * What the decoder is doing after these stages end, when it reports nothing
+ * until the next one: the walk's last stage hands over to building the
+ * model, and the saved meshes to the diagnostics and the copy out of wasm.
+ */
+const AFTER_STAGE: Record<string, string> = {
+  'partition-scan': 'Building the model',
+  'saved-meshes': 'Finishing the model',
+};
+
+/** One thing the worker told the card, with the milliseconds since the open began. */
+interface LoadEvent {
+  t: number;
+  stage?: string;
+  done?: number;
+  total?: number | null;
+  /** The wasm linear memory at that moment. */
+  memoryBytes?: number;
+  step?: string;
+}
+
 let loadStartedAt = 0;
 let loadTimer: number | null = null;
+let loadEvents: LoadEvent[] = [];
+let loadStage: string | null = null;
+let loadMemoryWarned = false;
+
+/** A determinate bar at `fraction`, or the indeterminate sweep for null. */
+function setLoadFraction(fraction: number | null): void {
+  if (fraction === null) {
+    loadRailEl.classList.remove('is-determinate');
+    loadRailEl.style.removeProperty('--load-fraction');
+    loadRailEl.removeAttribute('aria-valuenow');
+    return;
+  }
+  const clamped = Math.min(1, Math.max(0, fraction));
+  loadRailEl.classList.add('is-determinate');
+  loadRailEl.style.setProperty('--load-fraction', clamped.toFixed(3));
+  loadRailEl.setAttribute('aria-valuenow', String(Math.round(clamped * 100)));
+}
+
+/**
+ * The decoder reported `done` of `total` in `stage`. The bar is determinate
+ * while the stage has a count to be a fraction of (a stage that reports 0 and
+ * then 1 of 1 has none), and sweeps otherwise.
+ */
+function onDecodeStage(stage: string, done: number, total: number | null, memoryBytes: number): void {
+  loadEvents.push({ t: Math.round(performance.now() - loadStartedAt), stage, done, total, memoryBytes });
+  const info = DECODE_STAGES[stage];
+  const finished = total !== null && done >= total;
+  const after = finished ? AFTER_STAGE[stage] : undefined;
+  const step = after ?? info?.label ?? stage;
+  const counted = !after && total !== null && total > 1;
+  setLoadStep(step);
+  setLoadFraction(counted ? done / total : null);
+  loadHintEl.textContent =
+    counted && info
+      ? [`${Math.round((done / total) * 100)}%`, info.count(done, total)].filter(Boolean).join(' · ')
+      : '';
+  // #status is a live region: say a stage once, not each percent of it.
+  if (stage !== loadStage || after) setStatus(step);
+  loadStage = stage;
+}
+
+/** What the worker said, kept on #status for tests/load-progress.spec.ts and the measurement. */
+function saveLoadEvents(): void {
+  statusEl.dataset.loadProgress = JSON.stringify(loadEvents);
+}
+
+/**
+ * Says before the decode when the file is likely to need more memory than a
+ * tab has (#1195). It is an estimate from the file's size alone, so it
+ * warns and the open goes ahead; the worker reports the real stop.
+ */
+function showMemoryWarning(file: File): void {
+  const estimate = estimatePeakBytes(file.size);
+  loadMemoryWarned = estimate >= memoryCeilingBytes;
+  loadWarningEl.classList.toggle('hidden', !loadMemoryWarned);
+  if (!loadMemoryWarned) return;
+  loadWarningEl.textContent =
+    `This file may be too large for the browser. Opening a file takes about ${PEAK_MEMORY_PER_FILE_BYTE} times its size in memory ` +
+    `(measured on the largest reference model), so about ${formatMemory(estimate)} for ${formatMemory(file.size)}, ` +
+    `past the ${formatMemory(memoryCeilingBytes)} a browser tab can hold. It is tried anyway; ` +
+    'rvt-ifc and rvt-gltf open models of any size.';
+  toast(`${file.name} may be too large for the browser. Trying anyway.`, 'info');
+}
 
 function startLoadOverlay(file: File): void {
   loadStartedAt = performance.now();
+  loadEvents = [];
+  loadStage = null;
+  delete statusEl.dataset.loadProgress;
+  setLoadFraction(null);
   loadStepEl.textContent = `Opening ${file.name}`;
   loadHintEl.textContent = loadExpectation(file.size);
   loadElapsedEl.textContent = '0 s elapsed';
   loadOverlayEl.classList.remove('hidden');
+  showMemoryWarning(file);
   // The option applies to the read in progress; a change reopens the file.
   savedMeshesEl.disabled = true;
   setStatusBusy(true);
@@ -471,6 +615,7 @@ function stopLoadOverlay(): void {
     loadTimer = null;
   }
   loadOverlayEl.classList.add('hidden');
+  loadWarningEl.classList.add('hidden');
   savedMeshesEl.disabled = false;
   setStatusBusy(false);
 }
@@ -491,6 +636,7 @@ function maybeShowScaffoldNote(diagnostics: ExportDiagnostics): void {
     hideScaffoldNote();
     return;
   }
+  scaffoldNoteTitleEl.textContent = 'Nothing to draw';
   if (unreadStreamCount(diagnostics) > 0) {
     scaffoldNoteBodyEl.textContent = largeModelRetryOffered(diagnostics)
       ? 'Part of the file was not read, so the model is missing what those streams hold. The File status panel can retry with large-model limits.'
@@ -808,6 +954,13 @@ let currentFile: File | null = null;
 let currentOpenLimits: OpenLimitsOptions | undefined;
 
 // ---------- Load flow ----------
+/** What the worker knew when a decode stopped for want of memory (worker.ts). */
+interface TooLarge {
+  wasmMemoryBytes: number;
+  stage: string | null;
+  detail: string;
+}
+
 /** What the worker reports about one open (worker.ts). */
 interface LoadStats {
   /** Milliseconds in the wasm open call, saved meshes included. */
@@ -825,6 +978,7 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
   currentFile = file;
   currentOpenLimits = openLimits;
   delete statusEl.dataset.loadStats;
+  delete statusEl.dataset.loadFailure;
   setStatus(
     openLimits?.largeModel
       ? `Reopening ${file.name} with large-model limits…`
@@ -877,9 +1031,26 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
 
   currentDocument = null;
   const w = resetWorker();
+  // A worker the browser stopped sends nothing: say so rather than leave the
+  // loading card up.
+  const workerStopped = (detail: string): void => {
+    if (worker !== w) return;
+    failLoad(file, `The browser stopped the worker that reads the file${detail}.`);
+  };
+  w.addEventListener('error', (ev: ErrorEvent) => {
+    workerStopped(ev.message ? `: ${ev.message}` : ' (it may have run out of memory)');
+  });
+  w.addEventListener('messageerror', () => workerStopped(' while it returned the model'));
   w.addEventListener('message', (ev: MessageEvent<unknown>) => {
     const msg = ev.data as
       | { type: 'progress'; step: string }
+      | {
+          type: 'stage';
+          stage: string;
+          done: number;
+          total: number | null;
+          wasmMemoryBytes: number;
+        }
       | {
           type: 'summary';
           summary: { version: number; build?: string; guid?: string; class_name_count?: number };
@@ -896,7 +1067,7 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
           stats: LoadStats;
         }
       | { type: 'info'; index: number; panel: ElementInfoPanel | null }
-      | { type: 'error'; message: string };
+      | { type: 'error'; message: string; tooLarge?: TooLarge };
     if (msg.type === 'info') {
       // Stale reply for an element the user already clicked past.
       if (msg.index !== pendingInfoIndex) return;
@@ -904,7 +1075,15 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
       else renderScaffoldPanel(msg.index);
       return;
     }
+    if (msg.type === 'stage') {
+      onDecodeStage(msg.stage, msg.done, msg.total, msg.wasmMemoryBytes);
+      return;
+    }
     if (msg.type === 'progress') {
+      loadEvents.push({ t: Math.round(performance.now() - loadStartedAt), step: msg.step });
+      // The steps after the decode count nothing, so the bar sweeps again.
+      setLoadFraction(null);
+      loadHintEl.textContent = '';
       setStatus(msg.step);
       setLoadStep(msg.step);
       return;
@@ -927,19 +1106,18 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
       return;
     }
     if (msg.type === 'error') {
+      if (msg.tooLarge) {
+        showTooLarge(file, msg.tooLarge);
+        return;
+      }
       // The large-model limits stop at the tab's memory, not at a limit the
       // reader can lift, so say what the failure most likely is.
-      const detail = openLimits?.largeModel
-        ? `${msg.message} A browser tab can use at most 4 GiB of memory, so this file may be too large to open here.`
-        : msg.message;
-      stopLoadOverlay();
-      clearDemoCardBusy();
-      setStatus(`Error: ${detail}`);
-      renderErrorStatusPanel(detail);
-      hideScaffoldNote();
-      setDropzoneVisible(true);
-      setExportHint('Open a file to export');
-      toast(`Could not open ${file.name}. ${detail}`, 'bad');
+      failLoad(
+        file,
+        openLimits?.largeModel
+          ? `${msg.message} A browser tab can use at most 4 GiB of memory, so this file may be too large to open here.`
+          : msg.message,
+      );
       return;
     }
     model = msg.model;
@@ -972,7 +1150,10 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
     statusEl.dataset.loadStats = JSON.stringify({
       ...msg.stats,
       loadMs: Math.round(performance.now() - loadStartedAt),
+      estimatedPeakBytes: estimatePeakBytes(file.size),
+      memoryWarning: loadMemoryWarned,
     });
+    saveLoadEvents();
     setStatus(`Loaded · ${msg.types.length} categories · IFC bar ${qualityMode}`);
     stopLoadOverlay();
     clearDemoCardBusy();
@@ -986,6 +1167,53 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
   );
 }
 
+/** The card, the status line, the panel and a toast for a file that did not open. */
+function failLoad(file: File, detail: string): void {
+  stopLoadOverlay();
+  clearDemoCardBusy();
+  saveLoadEvents();
+  setStatus(`Error: ${detail}`);
+  renderErrorStatusPanel(detail);
+  hideScaffoldNote();
+  setDropzoneVisible(true);
+  setExportHint('Open a file to export');
+  toast(`Could not open ${file.name}. ${detail}`, 'bad');
+}
+
+/**
+ * The decode stopped for want of memory (#1195): wasm32 holds at most 4 GiB,
+ * and a failed allocation ends the instance with a bare `unreachable`. Says
+ * that plainly, with how far it got, and what opens a model of any size.
+ */
+function showTooLarge(file: File, tooLarge: TooLarge): void {
+  const reached = formatMemory(tooLarge.wasmMemoryBytes);
+  const stage = tooLarge.stage ? DECODE_STAGES[tooLarge.stage]?.label.toLowerCase() : undefined;
+  const where = stage ? `, while ${stage},` : '';
+  const summary =
+    tooLarge.wasmMemoryBytes > 0
+      ? `The browser would not give this tab more than ${reached}${where} and ${file.name} (${formatBytes(file.size)}) needs more.`
+      : `The browser did not have the memory to start the decoder for ${file.name} (${formatBytes(file.size)}).`;
+  const advice =
+    `A browser tab can hold at most ${formatMemory(memoryCeilingBytes)}, and opening a file takes about ${PEAK_MEMORY_PER_FILE_BYTE} times its size. ` +
+    'The command-line tools read models of any size: rvt-ifc with --large-model writes the IFC, rvt-gltf the glTF, and the Python package opens the same files.';
+  stopLoadOverlay();
+  clearDemoCardBusy();
+  saveLoadEvents();
+  statusEl.dataset.loadFailure = 'too-large';
+  setStatus(`Too large for the browser · stopped at ${reached}`);
+  renderErrorStatusPanel(
+    summary,
+    'Too large for the browser',
+    `Not decoded · the tab ran out of memory at ${reached}`,
+  );
+  scaffoldNoteTitleEl.textContent = 'Too large for the browser';
+  scaffoldNoteBodyEl.textContent = `${summary} ${advice}`;
+  scaffoldNoteEl.classList.remove('hidden');
+  setDropzoneVisible(true);
+  setExportHint('Open a file to export');
+  toast(`${file.name} is too large for the browser. rvt-ifc and rvt-gltf can open it.`, 'bad');
+}
+
 function renderEmptyStatusPanel(): void {
   statusPanelEl.innerHTML = '';
   resetStatusRowStagger();
@@ -1015,17 +1243,15 @@ function renderLoadingStatusPanel(filename: string): void {
   statusPanelEl.appendChild(statusRow('Warnings', 'ok', 'No export warnings'));
 }
 
-function renderErrorStatusPanel(message: string): void {
+function renderErrorStatusPanel(
+  message: string,
+  fileText = 'Could not open file',
+  modeText = 'Corrupt or unreadable file · not a readable Revit OLE/CFB container',
+): void {
   statusPanelEl.innerHTML = '';
   resetStatusRowStagger();
-  statusPanelEl.appendChild(statusRow('File', 'bad', 'Could not open file'));
-  statusPanelEl.appendChild(
-    statusRow(
-      'Mode',
-      'bad',
-      'Corrupt or unreadable file · not a readable Revit OLE/CFB container',
-    ),
-  );
+  statusPanelEl.appendChild(statusRow('File', 'bad', fileText));
+  statusPanelEl.appendChild(statusRow('Mode', 'bad', modeText));
   statusPanelEl.appendChild(statusRow('Schema', 'warn', 'Not parsed'));
   statusPanelEl.appendChild(statusRow('Elements', 'warn', 'Not decoded'));
   statusPanelEl.appendChild(statusRow('Geometry', 'warn', 'Not decoded'));
diff --git a/viewer/src/styles.css b/viewer/src/styles.css
index 32204b115..5157370f3 100644
--- a/viewer/src/styles.css
+++ b/viewer/src/styles.css
@@ -884,7 +884,9 @@ header .export-hint[hidden] {
   line-height: var(--sx-lh-sm);
   color: var(--sx-color-text);
 }
-/* An indeterminate progress bar: blue on the muted track. */
+/* A progress bar: blue on the muted track. It sweeps (indeterminate) until the
+   decoder reports a stage with a count; then `is-determinate` fills it to
+   --load-fraction (0 to 1). */
 .sweep-rail {
   position: relative;
   height: 8px;
@@ -901,9 +903,29 @@ header .export-hint[hidden] {
   border-radius: inherit;
   animation: viewer-sweep 1.4s var(--sx-ease-standard) infinite;
 }
+.sweep-rail.is-determinate::after {
+  width: calc(var(--load-fraction, 0) * 100%);
+  animation: none;
+  transition: width var(--sx-duration-base) var(--sx-ease-out);
+}
 .load-card .sweep-rail {
   margin: var(--sx-space-sm) 0 var(--sx-space-xs);
 }
+#load-warning {
+  margin-top: var(--sx-space-xs);
+  padding: var(--sx-space-2) var(--sx-space-sm);
+  font-size: var(--sx-fs-xs);
+  line-height: var(--sx-lh-xs);
+  color: var(--sx-color-text);
+  /* The alert's tone tint over an opaque surface, as the scaffold note's. */
+  background:
+    linear-gradient(var(--sx-color-warning-light), var(--sx-color-warning-light)),
+    var(--sx-color-surface);
+  border-radius: var(--sx-radius-md);
+}
+#load-warning.hidden {
+  display: none;
+}
 #load-metrics {
   display: flex;
   justify-content: space-between;
diff --git a/viewer/src/worker.ts b/viewer/src/worker.ts
index ba7ddd496..8b46e8e97 100644
--- a/viewer/src/worker.ts
+++ b/viewer/src/worker.ts
@@ -10,6 +10,14 @@
  *                  defaults (the large-model retry sends `largeModel: true`).
  *   main → worker: { type: 'info', index: number }
  *   worker → main: { type: 'progress', step: string }
+ *   worker → main: { type: 'stage', stage, done, total, wasmMemoryBytes } (#1195)
+ *                  the decoder's own progress, as `rvt-gltf --progress` prints
+ *                  it: `stage` is schema-parse, candidate-scan, element-decode,
+ *                  partition-scan, saved-graphics or saved-meshes, `done` and
+ *                  `total` are counts (`total` null while the stage has none),
+ *                  and `wasmMemoryBytes` is the wasm linear memory at that
+ *                  moment. The decoder reports a stage when it begins, when it
+ *                  ends and once per whole percent in between.
  *   worker → main: { type: 'summary', summary, document } (VW1-20 partial;
  *                   `document` is the FileMetadata or null)
  *   worker → main: { type: 'ready', model, scene, glb, types, diagnostics, stats }
@@ -19,7 +27,10 @@
  *                  which only grows, so it is the peak against the 4 GiB a tab
  *                  can hold.
  *   worker → main: { type: 'info', index, panel }
- *   worker → main: { type: 'error', message: string }
+ *   worker → main: { type: 'error', message: string, tooLarge?: TooLarge }
+ *                  `tooLarge` is set when the failure is the wasm instance
+ *                  running out of memory (see `outOfMemory`), with what the
+ *                  worker knew when it stopped.
  */
 
 import init, {
@@ -41,6 +52,16 @@ interface OpenLimitsOptions {
   savedMeshes?: boolean;
 }
 
+/** What the worker reports when a decode stops for want of memory. */
+interface TooLarge {
+  /** The wasm linear memory when it stopped: how far the decode got. */
+  wasmMemoryBytes: number;
+  /** The decoder stage it was in, or null before the first report. */
+  stage: string | null;
+  /** The raw message of the failure, for the diagnostics. */
+  detail: string;
+}
+
 type ParseMsg =
   | { type: 'parse'; bytes: Uint8Array; mode?: string; limits?: OpenLimitsOptions }
   | { type: 'info'; index: number };
@@ -49,6 +70,40 @@ type ParseMsg =
 // hosted relationships, M4-04) without shipping a panel per element.
 let parsedModel: unknown = null;
 
+// The panic hook the bindings install writes `rvt-rs wasm panic: <info>` to
+// `console.error` before the trap. A trap with none of those first is not a
+// panic: an allocation the wasm memory could not grow to hold aborts the
+// instance without running the hook, and reaches here as a bare
+// `RuntimeError: unreachable`.
+const PANIC_PREFIX = 'rvt-rs wasm panic:';
+let lastPanic: string | null = null;
+const nativeConsoleError = console.error.bind(console);
+console.error = (...args: unknown[]): void => {
+  const first = args[0];
+  if (typeof first === 'string' && first.startsWith(PANIC_PREFIX)) lastPanic = first;
+  nativeConsoleError(...args);
+};
+
+/** Panic messages and engine errors that mean an allocation could not be made. */
+const OUT_OF_MEMORY_MESSAGE =
+  /capacity overflow|memory allocation of \d+ bytes failed|out of memory|cannot allocate|array buffer allocation failed|invalid (typed )?array length|maximum memory size exceeded|invalid string length/i;
+
+/**
+ * True when `err` is the wasm instance, or the engine around it, running out
+ * of memory. wasm32 holds at most 4 GiB, a `Vec` at most 2 GiB, and a failed
+ * allocation aborts without a message, so the evidence is: a bare
+ * `unreachable` trap with no panic message before it, or a message that names
+ * an allocation. Any other panic is a bug and keeps its message.
+ */
+function outOfMemory(err: unknown, panic: string | null): boolean {
+  const message = err instanceof Error ? err.message : String(err);
+  if (panic !== null) return OUT_OF_MEMORY_MESSAGE.test(panic);
+  if (err instanceof WebAssembly.RuntimeError) {
+    return message === 'unreachable' || OUT_OF_MEMORY_MESSAGE.test(message);
+  }
+  return OUT_OF_MEMORY_MESSAGE.test(message) && !(err instanceof TypeError);
+}
+
 // DedicatedWorkerGlobalScope.postMessage has a slightly shifty
 // TS signature across lib.dom.d.ts versions — strictly-typed
 // `self` narrows it to zero-arg. Wrap once in a helper so every
@@ -77,10 +132,14 @@ self.addEventListener('message', async (ev: MessageEvent<ParseMsg>) => {
   }
   if (msg.type !== 'parse') return;
 
+  let wasmMemory: WebAssembly.Memory | null = null;
+  let currentStage: string | null = null;
   try {
     send({ type: 'progress', step: 'Initializing wasm' });
     const startedAt = performance.now();
     const wasm = await init();
+    wasmMemory = wasm.memory;
+    lastPanic = null;
 
     // VW1-20 — progressive streaming. Emit the cheap metadata
     // first (sub-second even on hundreds-of-MB files) so the UI
@@ -105,10 +164,15 @@ self.addEventListener('message', async (ev: MessageEvent<ParseMsg>) => {
       step: `Parsing container · IFC bar ${qualityMode}${limitsNote}${meshesNote}`,
     });
     const openStartedAt = performance.now();
+    const onStage = (stage: string, done: number, total: number | null): void => {
+      currentStage = stage;
+      send({ type: 'stage', stage, done, total, wasmMemoryBytes: wasm.memory.buffer.byteLength });
+    };
     const exportResult = openRvtBytesWithDiagnosticsModeAndOpenLimits(
       msg.bytes,
       qualityMode,
       msg.limits ?? null,
+      onStage,
     ) as {
       model: unknown;
       diagnostics: unknown;
@@ -152,6 +216,15 @@ self.addEventListener('message', async (ev: MessageEvent<ParseMsg>) => {
     );
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
+    if (outOfMemory(err, lastPanic)) {
+      const tooLarge: TooLarge = {
+        wasmMemoryBytes: wasmMemory?.buffer.byteLength ?? 0,
+        stage: currentStage,
+        detail: lastPanic ?? message,
+      };
+      send({ type: 'error', message, tooLarge });
+      return;
+    }
     send({ type: 'error', message });
   }
 });
diff --git a/viewer/tests/load-progress.spec.ts b/viewer/tests/load-progress.spec.ts
new file mode 100644
index 000000000..409f359d7
--- /dev/null
+++ b/viewer/tests/load-progress.spec.ts
@@ -0,0 +1,184 @@
+import { expect, test, type Page } from '@playwright/test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// #1195: while a model decodes, the loading card shows the decoder's own
+// progress (the stages `rvt-gltf --progress` prints) instead of a sweep and a
+// guess from the file size. The worker posts each report from inside the wasm
+// call, so the page sees them while the decode runs; the page keeps the whole
+// list on #status as `data-load-progress`.
+//
+//   - on the tier-1 fixture, which opens in milliseconds, the list is checked:
+//     the stages, their counts, and the steps after the decode;
+//   - on Core Interior (24 s on Deploy viewer's runner), the card itself is
+//     watched while it loads: the bar must turn determinate and fill, and the
+//     card must name the stages. A screenshot of the bar part-way and the
+//     samples go to measurements/, which Deploy viewer uploads.
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const tier1 = path.resolve(
+  __dirname,
+  '../../corpus/tier1/architectural-2024/architectural-2024.rvt',
+);
+const corpus = path.resolve(__dirname, '../../_project_corpus/Revit');
+const coreInterior = path.join(corpus, '2024_Core_Interior.rvt');
+const outDir = path.resolve(__dirname, '../measurements');
+// Deploy viewer fetches every model and sets this, so a model missing there
+// fails; elsewhere it is a skip.
+const required = process.env.RVT_VIEWER_REQUIRE_JOURNEYS === '1';
+
+const STAGES = [
+  'schema-parse',
+  'candidate-scan',
+  'element-decode',
+  'partition-scan',
+  'saved-graphics',
+  'saved-meshes',
+];
+
+interface LoadEvent {
+  t: number;
+  stage?: string;
+  done?: number;
+  total?: number | null;
+  memoryBytes?: number;
+  step?: string;
+}
+
+async function loadEvents(page: Page): Promise<LoadEvent[]> {
+  const raw = await page.locator('#status').getAttribute('data-load-progress');
+  expect(raw, 'the page keeps what the worker reported').not.toBeNull();
+  return JSON.parse(raw!) as LoadEvent[];
+}
+
+test('the decoder reports its stages to the page, and the steps after it follow', async ({
+  page,
+}) => {
+  expect(fs.existsSync(tier1), `${tier1} is committed`).toBe(true);
+  await page.goto('/');
+  await expect(page.locator('#status')).toHaveText(/Ready/);
+  await page.locator('#file-input').setInputFiles(tier1);
+  await expect(page.locator('#status')).toHaveText(/Loaded/);
+
+  const events = await loadEvents(page);
+  const stages = events.filter((event) => event.stage !== undefined);
+  expect(stages.length, 'the decoder reported').toBeGreaterThan(0);
+  // The walk begins with the schema, and every report names a stage the
+  // decoder has, with a count that is not past its total.
+  expect(stages[0].stage).toBe('schema-parse');
+  for (const event of stages) {
+    expect(STAGES, `stage ${event.stage}`).toContain(event.stage);
+    if (event.total !== null && event.total !== undefined) {
+      expect(event.done!, `${event.stage} ${event.done} of ${event.total}`).toBeLessThanOrEqual(
+        event.total,
+      );
+    }
+    expect(event.memoryBytes, 'the wasm memory at that moment').toBeGreaterThan(0);
+  }
+  // Within a stage the count only grows until the stage starts over.
+  let previous: LoadEvent | null = null;
+  for (const event of stages) {
+    if (previous && previous.stage === event.stage && event.done !== 0) {
+      expect(event.done!, `${event.stage} went back`).toBeGreaterThanOrEqual(previous.done!);
+    }
+    previous = event;
+  }
+  // The element decode reaches its end: the walk finished.
+  expect(
+    stages.some(
+      (event) =>
+        event.stage === 'element-decode' &&
+        event.total !== null &&
+        event.total !== undefined &&
+        event.done === event.total,
+    ),
+    'element-decode ended',
+  ).toBe(true);
+
+  // The steps after the decode come after every report of it, in time.
+  const steps = events.filter((event) => event.step !== undefined).map((event) => event.step);
+  expect(steps).toEqual(
+    expect.arrayContaining(['Building scene graph', 'Rendering glTF', 'Building schedule']),
+  );
+  const lastStage = Math.max(...stages.map((event) => event.t));
+  const sceneGraph = events.find((event) => event.step === 'Building scene graph')!;
+  expect(sceneGraph.t).toBeGreaterThanOrEqual(lastStage);
+});
+
+const coreInteriorTest = required || fs.existsSync(coreInterior) ? test : test.skip;
+
+coreInteriorTest('the loading card fills while Core Interior decodes', async ({ page }) => {
+  test.setTimeout(600_000);
+  expect(fs.existsSync(coreInterior), `${coreInterior} was not fetched`).toBe(true);
+  fs.mkdirSync(outDir, { recursive: true });
+
+  await page.goto('/');
+  await expect(page.locator('#status')).toHaveText(/Ready/);
+  await page.locator('#file-input').setInputFiles(coreInterior);
+
+  interface Sample {
+    t: number;
+    step: string;
+    hint: string;
+    determinate: boolean;
+    value: number | null;
+  }
+  const samples: Sample[] = [];
+  const started = Date.now();
+  let screenshot = false;
+  const deadline = started + 500_000;
+  for (;;) {
+    expect(Date.now(), 'Core Interior loads').toBeLessThan(deadline);
+    const loaded = await page.locator('#status').getAttribute('data-load-stats');
+    if (loaded !== null) break;
+    const sample = await page.evaluate(() => {
+      const rail = document.getElementById('load-rail')!;
+      const now = rail.getAttribute('aria-valuenow');
+      return {
+        step: document.getElementById('load-step')!.textContent ?? '',
+        hint: document.getElementById('load-hint')!.textContent ?? '',
+        determinate: rail.classList.contains('is-determinate'),
+        value: now === null ? null : Number(now),
+        visible: !document.getElementById('load-overlay')!.classList.contains('hidden'),
+      };
+    });
+    if (sample.visible) {
+      samples.push({ ...sample, t: Date.now() - started });
+      if (!screenshot && sample.determinate && sample.value! >= 25 && sample.value! <= 75) {
+        await page.locator('#load-overlay').screenshot({
+          path: path.join(outDir, 'load-progress-core-interior.png'),
+        });
+        screenshot = true;
+      }
+    }
+    await page.waitForTimeout(200);
+  }
+  await expect(page.locator('#status')).toHaveText(/Loaded/);
+  fs.writeFileSync(
+    path.join(outDir, 'load-progress-core-interior.json'),
+    `${JSON.stringify({ samples, events: await loadEvents(page) }, null, 2)}\n`,
+  );
+
+  // The card named the decoder's stages, not just "Opening".
+  const labels = new Set(samples.map((sample) => sample.step));
+  const stageLabels = [...labels].filter((label) =>
+    /^(Reading the schema|Scanning for elements|Decoding elements|Reading partition streams|Reading saved graphics|Drawing doors and windows from saved meshes|Building the model|Finishing the model)$/.test(
+      label,
+    ),
+  );
+  expect(stageLabels.length, `stages named on the card: ${[...labels].join(' | ')}`).toBeGreaterThanOrEqual(2);
+
+  // The bar turned determinate, at more than one fill, and a fill was
+  // somewhere between empty and full.
+  const fills = new Set(samples.filter((s) => s.determinate).map((s) => s.value));
+  expect(fills.size, `fills seen: ${[...fills].join(', ')}`).toBeGreaterThanOrEqual(3);
+  expect(
+    [...fills].some((value) => value !== null && value > 0 && value < 100),
+    'a part-way fill',
+  ).toBe(true);
+  // A determinate bar says what it counts.
+  const counted = samples.filter((s) => s.determinate && s.value! > 0 && s.value! < 100);
+  expect(counted.every((s) => /^\d+% · /.test(s.hint))).toBe(true);
+  expect(screenshot, 'a screenshot of the bar part-way').toBe(true);
+});
diff --git a/viewer/tests/memory-ceiling.spec.ts b/viewer/tests/memory-ceiling.spec.ts
new file mode 100644
index 000000000..ebb4d249c
--- /dev/null
+++ b/viewer/tests/memory-ceiling.spec.ts
@@ -0,0 +1,118 @@
+import { expect, test } from '@playwright/test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// #1195: a model too large for the browser. wasm32 addresses at most 4 GiB, an
+// open takes about ten times the file's size, and a failed allocation ends the
+// wasm instance with a bare `RuntimeError: unreachable`. The viewer warns
+// before the decode when the file's size says it may not fit, and says
+// plainly that it did not fit when the instance stops.
+//
+// No file of several hundred MiB is in CI, so the ceiling is lowered instead of
+// the model raised, and the stop is real:
+//
+//   - the warning compares the estimate with `?memoryCeilingBytes=`, which
+//     defaults to 4 GiB;
+//   - the stop runs in a browser whose V8 is capped at 16 MiB of wasm memory
+//     (`--js-flags=--wasm-max-mem-pages=256`, 64 KiB a page), where
+//     Einhoven's 23 MiB peak (tests/saved-meshes-measure.spec.ts) cannot be
+//     reached. The wasm, the allocator and the worker are the shipped ones;
+//     only the ceiling is lower.
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const tier1 = path.resolve(
+  __dirname,
+  '../../corpus/tier1/architectural-2024/architectural-2024.rvt',
+);
+const einhoven = path.resolve(__dirname, '../../_project_corpus/Revit/Revit_IFC5_Einhoven.rvt');
+const outDir = path.resolve(__dirname, '../measurements');
+// Deploy viewer fetches every model and sets this, so a model missing there
+// fails; elsewhere it is a skip.
+const required = process.env.RVT_VIEWER_REQUIRE_JOURNEYS === '1';
+
+const CAP_PAGES = 256;
+const CAP_BYTES = CAP_PAGES * 64 * 1024;
+
+test.describe('under the real ceiling', () => {
+  test('a file whose estimate passes the ceiling is warned about, and still opens', async ({
+    page,
+  }) => {
+    expect(fs.existsSync(tier1), `${tier1} is committed`).toBe(true);
+    const fileBytes = fs.statSync(tier1).size;
+    // The estimate is ten times the file; a ceiling under it warns.
+    const ceiling = fileBytes * 10 - 1;
+    await page.goto(`/?memoryCeilingBytes=${ceiling}`);
+    await expect(page.locator('#status')).toHaveText(/Ready/);
+    await page.locator('#file-input').setInputFiles(tier1);
+
+    // The card warns while it loads; the toast is what outlasts a quick open.
+    await expect(page.locator('#toast-region .toast', { hasText: 'may be too large' })).toBeVisible();
+    await expect(page.locator('#status')).toHaveText(/Loaded/);
+    const stats = JSON.parse((await page.locator('#status').getAttribute('data-load-stats')) ?? 'null');
+    expect(stats.memoryWarning).toBe(true);
+    expect(stats.estimatedPeakBytes).toBe(fileBytes * 10);
+    // A warning is not a refusal: the model opened.
+    await expect(page.locator('#status')).not.toHaveAttribute('data-load-failure', /.+/);
+    await expect(page.locator('#file-meta')).toContainText(/[1-9]\d* entities/);
+  });
+
+  test('a file whose estimate fits the ceiling is not warned about', async ({ page }) => {
+    await page.goto('/');
+    await expect(page.locator('#status')).toHaveText(/Ready/);
+    await page.locator('#file-input').setInputFiles(tier1);
+    await expect(page.locator('#status')).toHaveText(/Loaded/);
+    const stats = JSON.parse((await page.locator('#status').getAttribute('data-load-stats')) ?? 'null');
+    expect(stats.memoryWarning).toBe(false);
+    await expect(page.locator('#toast-region .toast', { hasText: 'may be too large' })).toHaveCount(0);
+  });
+});
+
+test.describe('under a ceiling of 16 MiB', () => {
+  test.use({ launchOptions: { args: [`--js-flags=--wasm-max-mem-pages=${CAP_PAGES}`] } });
+
+  const modelTest = required || fs.existsSync(einhoven) ? test : test.skip;
+
+  modelTest('a model past it is reported as too large, not as unreachable', async ({ page }) => {
+    expect(fs.existsSync(einhoven), `${einhoven} was not fetched`).toBe(true);
+    fs.mkdirSync(outDir, { recursive: true });
+    await page.goto(`/?memoryCeilingBytes=${CAP_BYTES}`);
+    await expect(page.locator('#status')).toHaveText(/Ready/);
+    await page.locator('#file-input').setInputFiles(einhoven);
+
+    // The stop is named in the status line, and the page says so in the
+    // viewport, with what to use instead.
+    await expect(page.locator('#status')).toHaveAttribute('data-load-failure', 'too-large');
+    await expect(page.locator('#status')).toHaveText(/^Too large for the browser · stopped at /);
+    const note = page.locator('#scaffold-note');
+    await expect(note).toBeVisible();
+    await expect(note.locator('#scaffold-note-title')).toHaveText('Too large for the browser');
+    const body = note.locator('#scaffold-note-body');
+    await expect(body).toContainText('Revit_IFC5_Einhoven.rvt');
+    await expect(body).toContainText('would not give this tab more than');
+    await expect(body).toContainText('16 MiB');
+    await expect(body).toContainText('rvt-ifc');
+    await expect(body).toContainText('rvt-gltf');
+    await expect(body).toContainText('--large-model');
+    await expect(page.locator('#status-panel')).toContainText('Too large for the browser');
+
+    // Nothing on the page shows the engine's message, and the loading card
+    // is gone.
+    await expect(page.locator('#load-overlay')).toBeHidden();
+    const text = await page.locator('body').innerText();
+    expect(text).not.toMatch(/unreachable|RuntimeError/);
+    await expect(page.locator('#dropzone')).toBeVisible();
+    await expect(page.locator('#export-ifc')).toBeDisabled();
+
+    // What the worker reported before it stopped is kept, with the memory at
+    // each report, which never passes the cap.
+    const events = JSON.parse(
+      (await page.locator('#status').getAttribute('data-load-progress')) ?? '[]',
+    ) as Array<{ stage?: string; memoryBytes?: number }>;
+    expect(events.length).toBeGreaterThan(0);
+    for (const event of events) {
+      if (event.memoryBytes !== undefined) expect(event.memoryBytes).toBeLessThanOrEqual(CAP_BYTES);
+    }
+    await page.locator('#viewport').screenshot({ path: path.join(outDir, 'too-large.png') });
+  });
+});
diff --git a/viewer/tests/saved-meshes-measure.spec.ts b/viewer/tests/saved-meshes-measure.spec.ts
index 12a19b7f8..0a9c9c54b 100644
--- a/viewer/tests/saved-meshes-measure.spec.ts
+++ b/viewer/tests/saved-meshes-measure.spec.ts
@@ -16,6 +16,12 @@ import { fileURLToPath } from 'node:url';
 //   wasmMemoryBytes  the wasm linear memory after the whole parse; it only
 //                    grows, so it is the peak against the 4 GiB a tab holds
 //   savedMeshBodies  doors and windows drawn from saved meshes
+//   estimatedPeakBytes  what the viewer's pre-check expects the open to take
+//                    (ten times the file, #1195) and its ratio to the peak
+//   timeline         where the open's time went, from the decoder's own
+//                    reports: seconds from each stage's first report to the
+//                    next one's, so time the decoder reports nothing in is
+//                    counted to the stage before it
 //
 // The result goes to measurements/saved-meshes.json and, as a table, to the
 // log and the job summary; Deploy viewer uploads the JSON. It runs on its own
@@ -63,6 +69,12 @@ interface Diagnostics {
   };
 }
 
+/** One stretch of an open: a decoder stage or a worker step, and the milliseconds until the next. */
+interface Span {
+  label: string;
+  ms: number;
+}
+
 interface Measurement {
   model: string;
   release: number;
@@ -73,6 +85,8 @@ interface Measurement {
   openMs: number;
   workerMs: number;
   wasmMemoryBytes: number;
+  estimatedPeakBytes: number;
+  timeline: Span[];
   mainHeapBytes: number | null;
   buildingElements: number;
   doors: number;
@@ -95,6 +109,28 @@ async function waitLoaded(page: Page, model: Model): Promise<void> {
   await expect(page.locator('#load-overlay')).toBeHidden();
 }
 
+interface LoadEvent {
+  t: number;
+  stage?: string;
+  step?: string;
+}
+
+/** The open's time by what the page was told was happening, in order. */
+function timelineOf(events: LoadEvent[], loadMs: number): Span[] {
+  const spans: Span[] = [];
+  let label = 'Before the first report';
+  let from = 0;
+  for (const event of events) {
+    const next = event.stage ?? event.step ?? '';
+    if (next === label) continue;
+    spans.push({ label, ms: event.t - from });
+    label = next;
+    from = event.t;
+  }
+  spans.push({ label, ms: Math.max(0, loadMs - from) });
+  return spans.filter((span) => span.ms > 0);
+}
+
 /** Reads what the viewer shows about the model now open. */
 async function read(
   page: Page,
@@ -109,8 +145,13 @@ async function read(
     openMs: number;
     workerMs: number;
     wasmMemoryBytes: number;
+    estimatedPeakBytes: number;
   } | null;
   expect(stats, 'the viewer reports what an open cost').not.toBeNull();
+  const events = JSON.parse(
+    (await page.locator('#status').getAttribute('data-load-progress')) ?? '[]',
+  ) as LoadEvent[];
+  expect(events.length, 'the viewer keeps what the worker reported').toBeGreaterThan(0);
   const diagnostics = JSON.parse(
     (await page.locator('#diagnostics-json').textContent()) ?? 'null',
   ) as Diagnostics;
@@ -129,6 +170,8 @@ async function read(
     openMs: stats!.openMs,
     workerMs: stats!.workerMs,
     wasmMemoryBytes: stats!.wasmMemoryBytes,
+    estimatedPeakBytes: stats!.estimatedPeakBytes,
+    timeline: timelineOf(events, stats!.loadMs),
     mainHeapBytes,
     buildingElements: exported.building_elements,
     doors: exported.by_ifc_type.IFCDOOR ?? 0,
@@ -185,6 +228,8 @@ function tableRows(report: Report): string[][] {
       seconds(m.loadMs),
       seconds(m.openMs),
       mib(m.wasmMemoryBytes),
+      mib(m.estimatedPeakBytes),
+      (m.estimatedPeakBytes / m.wasmMemoryBytes).toFixed(2),
       mib(m.mainHeapBytes),
       `${m.savedMeshBodies} of ${m.doors + m.windows}`,
       String(m.boundingBoxBodies),
@@ -198,6 +243,8 @@ function tableRows(report: Report): string[][] {
       'Load s',
       'Open s',
       'Wasm MiB',
+      'Estimate MiB',
+      'Estimate / wasm',
       'Page heap MiB',
       'Doors and windows from meshes',
       'Box bodies',
@@ -218,17 +265,34 @@ function markdownTable(rows: string[][]): string {
   return [line(rows[0]), line(rows[0].map(() => '---')), ...rows.slice(1).map(line)].join('\n');
 }
 
+/** Where each open's time went, one row per model, saved meshes on. */
+function timelineRows(report: Report): string[][] {
+  const order = new Map(models.map((m, i) => [m.file, i]));
+  return [
+    ['Model', 'Where the open went (seconds, in order)'],
+    ...report.measurements
+      .filter((m) => m.savedMeshes)
+      .sort((a, b) => (order.get(a.model) ?? 0) - (order.get(b.model) ?? 0))
+      .map((m) => [
+        m.model,
+        m.timeline.map((span) => `${span.label} ${seconds(span.ms)}`).join(' > '),
+      ]),
+  ];
+}
+
 test.afterAll(() => {
   const report = loadReport();
   if (!report) return;
   const rows = tableRows(report);
+  const timeline = timelineRows(report);
   console.log(
     `\nSaved meshes on and off, one open each (${report.browser}, ${report.cpus} CPUs, ${mib(report.memoryBytes)} MiB)\n${plainTable(rows)}\n`,
   );
+  console.log(`Where the open went, saved meshes on\n${timeline.map((r) => r.join('  ')).join('\n')}\n`);
   if (process.env.GITHUB_STEP_SUMMARY) {
     fs.appendFileSync(
       process.env.GITHUB_STEP_SUMMARY,
-      `### Saved meshes on and off, one open each\n\n${report.browser}, ${report.cpus} CPUs, ${mib(report.memoryBytes)} MiB\n\n${markdownTable(rows)}\n`,
+      `### Saved meshes on and off, one open each\n\n${report.browser}, ${report.cpus} CPUs, ${mib(report.memoryBytes)} MiB\n\n${markdownTable(rows)}\n\n### Where the open went, saved meshes on\n\n${markdownTable(timeline)}\n`,
     );
   }
 });
diff --git a/viewer/tests/viewer-regression.spec.ts b/viewer/tests/viewer-regression.spec.ts
index 3039b9b41..ef342f548 100644
--- a/viewer/tests/viewer-regression.spec.ts
+++ b/viewer/tests/viewer-regression.spec.ts
@@ -317,10 +317,14 @@ largeProjectDemoTest(
     await card.click();
 
     // A 30 s decode with a static status line reads as a hang. The
-    // overlay has to show motion, elapsed seconds and a size-derived
-    // expectation for the whole wait.
+    // overlay has to show motion, elapsed seconds and, from the decoder's
+    // own reports (#1195), which stage it is in and how far; the size-derived
+    // "about N s" is only what it says before the first report.
     await expect(page.locator('#load-overlay')).toBeVisible();
-    await expect(page.locator('#load-hint')).toHaveText(/MB, about \d+ s/);
+    await expect(page.locator('#load-step')).toHaveText(
+      /Scanning for elements|Decoding elements|Reading partition streams|Building the model/,
+      { timeout: 120_000 },
+    );
     await expect(page.locator('#load-elapsed')).toHaveText(/^\d+ s elapsed$/);
     await expect(card).toHaveAttribute('aria-busy', 'true');
     await expect(page.locator('#status')).toHaveClass(/is-busy/);

From 4f0b4f2a115fdab7118abf53f9286f92bd91fa91 Mon Sep 17 00:00:00 2001
From: Griffin Long <151978260+DrunkOnJava@users.noreply.github.com>
Date: Tue, 3 Nov 2026 13:50:53 -0500
Subject: [PATCH 2/9] feat(viewer): the partition scan reports one step per
 stream, and the card falls back to the size estimate while a stage has no
 count (#1195)

The first run measured where an open goes: 20.3 of Core Interior's 22.0 s sat
under partition-scan, which reported 0 and then 1 of 1, so the bar swept for
nine tenths of the open. The ArcWall scan, the walk's first pass over the
partitions, inflates every Partitions stream; it now reports PartitionScan with
the stream's index and the stream count, through a control passed by the walk
(the memoised scan's other callers keep the default control). The card shows
the size-derived estimate while a stage has no count. The Playwright tests that
set launch options are split so the option is top level, which Playwright
requires, and the docs carry the measured estimate and the options for larger
models.
---
 docs/status.md                             |   7 +-
 docs/viewer-api.md                         | 128 ++++++++++++++++++++-
 docs/viewer-build-pipeline.md              |   7 +-
 src/reader.rs                              |  18 +++
 src/research/partition_arc_walls.rs        |   7 +-
 src/walker.rs                              |   2 +-
 viewer/README.md                           |  27 +++++
 viewer/src/main.ts                         |  22 +++-
 viewer/tests/memory-ceiling-capped.spec.ts |  73 ++++++++++++
 viewer/tests/memory-ceiling.spec.ts        |  69 +----------
 10 files changed, 276 insertions(+), 84 deletions(-)
 create mode 100644 viewer/tests/memory-ceiling-capped.spec.ts

diff --git a/docs/status.md b/docs/status.md
index 015b2439f..3006c4bc6 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -1052,10 +1052,11 @@ two fields are now pinned and two exports are byte-identical, as
 In the browser the same change takes the 33.7 MB Core Interior demo from
 about 28 s to **about 3 s** of decode, measured live on the deployed
 site (6.7 s including the 32 MB download). The viewer's loading card
-derives its "about N s" hint from that measurement —
+opened with an "about N s" hint from that measurement —
 `DECODE_BYTES_PER_SECOND` is 11 MB/s since #271, up from the 1.15 MB/s
-the pre-#266 figure implied — and the progress bar stays indeterminate
-because the decoder cannot report real progress.
+the pre-#266 figure implied. It is a laptop's figure, and since #1195 the
+card shows the decoder's own progress as soon as it reports (see
+[`viewer-api.md`](viewer-api.md#decode-progress)).
 
 ## Capability Matrix
 
diff --git a/docs/viewer-api.md b/docs/viewer-api.md
index 6bbf03f35..cc82006f5 100644
--- a/docs/viewer-api.md
+++ b/docs/viewer-api.md
@@ -257,9 +257,129 @@ the emitted IFC is byte-identical. In the browser the 33.7 MB demo
 decodes in **about 3 s**, measured on the deployed site — 6.7 s
 including the 32 MB download. That measurement is what
 `DECODE_BYTES_PER_SECOND` in `viewer/src/main.ts` encodes (11 MB/s
-since #271, up from 1.15 MB/s) to set the loading card's "about N s"
-hint; the progress bar stays indeterminate because the decoder
-cannot report real progress.
+since #271, up from 1.15 MB/s) for the "about N s" hint the loading card
+opens with. It is a laptop's figure: Deploy viewer's runner takes about
+24 s to open the same file (the measurement in
+[Models too large for the browser](#models-too-large-for-the-browser)), so
+since #1195 the card shows the decoder's own progress as soon as it reports,
+and the hint is only the first thing it says.
+
+## Decode progress
+
+`openRvtBytesWithDiagnosticsModeAndOpenLimits(bytes, mode, limits, progress)`
+takes an optional `progress` function, called as `progress(stage, done, total)`
+while the decoder works (#1195). They are the reports of the decoder's
+`WalkerControl` (#1072), the ones `rvt-gltf --progress` prints, passed across
+the wasm boundary:
+
+| `stage` | `done` of `total` | The card shows |
+|---|---|---|
+| `schema-parse` | 0, then 1 of 1 | Reading the schema |
+| `candidate-scan` | bytes of `Global/Latest` scanned, of its size | Scanning for elements |
+| `element-decode` | scan candidates decoded, of the candidates | Decoding elements |
+| `partition-scan` | streams read, of the streams; 0, then 1 of 1 where the walk does not know the number | Reading partition streams |
+| `saved-graphics` | 0, then 1 of 1 | Reading saved graphics |
+| `saved-meshes` | elements meshed, of the elements | Drawing doors and windows from saved meshes |
+
+`total` is `null` where a stage has none yet. The decoder reports every
+megabyte scanned and every 256th candidate; the binding calls `progress` at a
+stage's start, at its end and each time a stage with a total passes another
+whole percent, so a stage costs at most about a hundred calls and a decode a
+few hundred. The function is held in a `thread_local` and the closure handed to
+`WalkerControl::with_progress` captures nothing, because a `js_sys::Function`
+is not `Send + Sync`. The worker posts each report from inside the wasm call
+(`{ type: 'stage', stage, done, total, wasmMemoryBytes }`), and the browser
+delivers it to the page while the call runs, because posting does not wait for
+the worker's event loop.
+
+The bar fills while a stage has a total above one and sweeps otherwise. The
+decoder reports nothing between the end of the walk and the saved graphics
+(the model is built there) or after the saved meshes (the diagnostics and the
+copy out of wasm), so the card names those stretches "Building the model" and
+"Finishing the model" and sweeps; the steps after the open call (scene graph,
+glTF, schedule) are the worker's own and sweep too. Where an open's time goes
+is the second table of `tests/saved-meshes-measure.spec.ts` (below). The
+viewer does not cancel a decode: the call is synchronous in the worker, so a
+`CancelToken` has no one to set it. The "about N s" hint from the file's size
+is what the card says until the first report and while a stage has no count.
+
+## Models too large for the browser
+
+A wasm32 instance addresses at most 4 GiB, and a single `Vec` cannot pass
+2 GiB (`isize::MAX`). A `Vec` growing past that panics with `capacity overflow`,
+which the panic hook writes to `console.error`; an allocation that
+`memory.grow` cannot satisfy does not panic: Rust aborts, no hook runs, and
+JavaScript sees `RuntimeError: unreachable` and nothing else. During an open the
+file is also held twice in wasm memory: the binding copies `bytes` in, and
+`RevitFile::open_bytes_with_limits(bytes.to_vec())` copies it again.
+
+What the viewer does (#1195):
+
+- **Before the decode**, from the file's size alone: it expects the open to need
+  about ten times the file (`PEAK_MEMORY_PER_FILE_BYTE` in `viewer/src/main.ts`),
+  and when that passes 4 GiB (a file over about 410 MiB) the card says the file
+  may be too large, with the estimate and the figure it rests on, and the open
+  goes ahead. It is a warning, never a refusal.
+- **When the instance stops**, the worker decides whether it ran out of memory:
+  a `RuntimeError: unreachable` with no `rvt-rs wasm panic:` line on
+  `console.error` before it, or a panic or engine message that names an
+  allocation (`capacity overflow`, `memory allocation of N bytes failed`, `Array
+  buffer allocation failed`). Any other panic is a bug and keeps its message.
+  It reports the wasm memory the instance had reached and the stage it was in;
+  the page says the model is too large for the browser, how far it got, that
+  a tab holds at most 4 GiB and an open takes about ten times the file, and that
+  `rvt-ifc --large-model`, `rvt-gltf` and the Python package open models of any
+  size. A tab the browser kills outright sends nothing; the page shows an error
+  for a worker that stops.
+
+The pre-check's figure is measured, not assumed. Deploy viewer's
+`tests/saved-meshes-measure.spec.ts` opens each reference model in a fresh
+Chromium 156 context on GitHub's ubuntu-24.04 runner (4 CPUs, 16 GB) and
+records the wasm linear memory after the open, which only grows and so is the
+peak, beside the estimate (ten times the file) and their ratio (run
+[41695636243](https://github.com/DrunkOnJava/rvt-rs/actions/runs/41695636243),
+saved meshes on; the same peaks with them off):
+
+| Model | File MiB | Wasm peak MiB | Peak / file (about) | Estimate MiB | Estimate / peak |
+|---|---|---|---|---|---|
+| 2024_Core_Interior | 32 | 324 | 10 | 322 | 0.99 |
+| RE1-Electrical | 13 | 170 | 13 | 128 | 0.76 |
+| RE1-Architecture | 6 | 100 | 16 | 63 | 0.63 |
+| RE1-Plumbing | 3 | 60 | 18 | 33 | 0.56 |
+| RE1-Mechanical | 3 | 71 | 22 | 32 | 0.45 |
+| Revit_IFC5_Einhoven | 0.9 | 23 | 26 | 9 | 0.37 |
+
+The estimate is under the peak on every model (0.37 to 0.99), tightest on the
+largest, because fixed costs weigh more on a small file. That is the direction
+the warning needs: it says "may not fit" only where even the lowest multiple
+measured, 10, passes the ceiling. The
+multiple falls as files grow, and no model past 32 MiB is in CI. Two
+client models in #1075 are the only larger evidence, and from outside the
+browser: native peaks of 3.7 GB for a 438 MB file (8.4 times, with the stream and
+inflate limits raised) and 5.1 GB for a 1.13 GB file (4.5 times). Both are
+past 4 GiB once wasm's second copy of the file is added, and both are warned
+about (10 times 438 MB is 4.1 GiB); a model of several hundred MiB can sit near
+the line, which is why the estimate warns and the stop is the verdict. The
+size of the file is the basis because the sizes the reader knows before
+inflating add nothing to it: a partition's stored size is nearly all of the
+file (the largest stream is 96% of the 438 MB file and 98% of the 1.13 GB
+one in #1075), and the inflated size is not stored (Revit's truncated gzip has
+no `ISIZE` trailer).
+
+The options for opening a larger model, as of 2026-11-03. Only the first three
+rows are measured here; the rest are read from the code and from the release
+notes cited, and none is built:
+
+| Option | What it would do | Status |
+|---|---|---|
+| Say so, and point to the CLI | The viewer's answer today: warn from the file size, report the stop, name `rvt-ifc`, `rvt-gltf` and Python | Shipped (#1195) |
+| Skip the saved-graphics pass | Free the memory of the pass that draws door and window meshes | No gain: peak memory is identical with it on and off on every reference model (#1150), so it stayed inside the export's peak |
+| Read fewer streams | Leave `Partitions/*` streams unread | The streams are the model: `stream_not_read_resource_limit` (#1075) already leaves a model empty of what they hold |
+| One copy of the file | A binding that takes the file as an owned `Vec<u8>` saves one copy of the file (a tenth of the peak at ten times) | Not done: retyping `bytes` is a breaking change to the stable wasm API (`tools/ci/wasm-api.py`), so it needs a new binding or a `!` PR |
+| Stream partitions | Inflate, use and drop one partition at a time | A library change: `RevitFile::inflated_partition` keeps every partition for the handle's lifetime on purpose (#266 took Core Interior from 26 s to 1.7 s natively by inflating each once), and a dozen passes read them |
+| wasm64 (memory64) | Raise the ceiling past 4 GiB | Chrome 133 and Firefox 134 ship memory64; Safari has it in Technology Preview, and an iOS Safari 27 report says a 64-bit `Memory` is accepted but a memory64 module does not compile ([wllama#297](https://github.com/ngxson/wllama/issues/297)). wasm-bindgen supports the `wasm64-unknown-unknown` target since 0.2.120 ([release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases), 2026-04-28; the lock has 0.2.118). The target is tier 3 (nightly and `build-std`). It would be a second wasm build chosen by feature detection, with the 32-bit build kept for Safari |
+
+@@TIMELINE@@
 
 ## Full frontend pipeline
 
@@ -300,7 +420,7 @@ describing the error.
 | Binding | Arguments | Returns | What it does |
 |---|---|---|---|
 | `openRvtBytesWithDiagnosticsMode` | `bytes`, `mode: string` | `{ model, diagnostics }` | The same at an export quality mode: `scaffold`, `typed-no-geometry`, `geometry` or `strict`, the stronger ones failing when the file cannot meet them. Doors and windows are drawn from their saved meshes, as in the next row with the default options |
-| `openRvtBytesWithDiagnosticsModeAndOpenLimits` | `bytes`, `mode: string`, `limits: { largeModel?, maxStreamBytes?, maxInflateBytes?, savedMeshes? }` or `null` | `{ model, diagnostics }` | `openRvtBytesWithDiagnosticsMode` under the reader's resource limits: `largeModel` is `rvt-ifc --large-model` (streams up to 2 GiB, inflating up to the 4 GiB wasm32 holds, the walker's scan cap lifted to match), `maxStreamBytes` and `maxInflateBytes` are whole numbers of bytes that win over it, and a field left out keeps its default. `savedMeshes` (default `true`) draws the doors and windows of Revit 2023 to 2027 files from the meshes Revit saved for them, as `rvt-ifc` does by default; `false` keeps their bounding boxes and skips the pass over the saved graphics. A stream a limit stops is listed in the diagnostics (`stream_not_read_resource_limit`, a `Not read whole:` warning each) and the viewer offers "Retry with large-model limits"; unknown fields and fractional or negative limits throw. When the saved graphics cannot be read the model keeps its boxes and the diagnostics carry a warning |
+| `openRvtBytesWithDiagnosticsModeAndOpenLimits` | `bytes`, `mode: string`, `limits: { largeModel?, maxStreamBytes?, maxInflateBytes?, savedMeshes? }` or `null`, `progress?: (stage: string, done: number, total: number \| null) => void` | `{ model, diagnostics }` | `openRvtBytesWithDiagnosticsMode` under the reader's resource limits: `largeModel` is `rvt-ifc --large-model` (streams up to 2 GiB, inflating up to the 4 GiB wasm32 holds, the walker's scan cap lifted to match), `maxStreamBytes` and `maxInflateBytes` are whole numbers of bytes that win over it, and a field left out keeps its default. `savedMeshes` (default `true`) draws the doors and windows of Revit 2023 to 2027 files from the meshes Revit saved for them, as `rvt-ifc` does by default; `false` keeps their bounding boxes and skips the pass over the saved graphics. A stream a limit stops is listed in the diagnostics (`stream_not_read_resource_limit`, a `Not read whole:` warning each) and the viewer offers "Retry with large-model limits"; unknown fields and fractional or negative limits throw. When the saved graphics cannot be read the model keeps its boxes and the diagnostics carry a warning. `progress`, when given, is called as the decoder works with the stage name (`schema-parse`, `candidate-scan`, `element-decode`, `partition-scan`, `saved-graphics`, `saved-meshes`) and how many of how many it has done (`total` is `null` where the stage has no count yet), at a stage's start, its end and each whole percent between; see [Decode progress](#decode-progress). A function that throws is ignored |
 | `quickSummary` | `bytes` | `Summary` | Release, build, PartAtom and the stream inventory, read without decoding the model |
 | `fileMetadata` | `bytes` | `FileMetadata` | Document identity (release, worksharing, last save, GUID, save counter), from the two identity streams only |
 | `scheduleCsv` | `model`, `kind: string`, `metric: boolean`, `excel: boolean` | `string` | The element (`kind` `"elements"`) or room (`"rooms"`) schedule as CSV, the columns of the [user guide](user-guide.md#get-a-schedule-into-excel) |
diff --git a/docs/viewer-build-pipeline.md b/docs/viewer-build-pipeline.md
index 476ad8262..8cf3fd912 100644
--- a/docs/viewer-build-pipeline.md
+++ b/docs/viewer-build-pipeline.md
@@ -318,9 +318,10 @@ Natively, `rvt-ifc --mode geometry` on Core Interior went from
 Silicon, `/usr/bin/time -l`, best of three); in the browser the same
 33.7 MB file decodes in **about 3 s**, measured on the deployed
 site. Output is byte-identical. The viewer's loading-card estimate
-follows that measurement — `DECODE_BYTES_PER_SECOND` is 11 MB/s
-since #271 — and the bar stays indeterminate, because a chunked
-progress signal is still the unshipped work described above.
+opened with that measurement — `DECODE_BYTES_PER_SECOND` is 11 MB/s
+since #271 — and the bar swept, because the decoder reported no
+progress. Since #1195 it does: the card shows the decoder's own stages
+(see [`viewer-api.md`](viewer-api.md#decode-progress)).
 
 ## VW1-23 — Drag-and-drop user RVT support
 
diff --git a/src/reader.rs b/src/reader.rs
index 3abfcf413..d30642d0d 100644
--- a/src/reader.rs
+++ b/src/reader.rs
@@ -753,6 +753,23 @@ impl RevitFile {
         &mut self,
         revit_version: u32,
         limits: crate::walker::WalkerLimits,
+    ) -> Arc<crate::partition_arc_walls::PartitionArcWallScan> {
+        self.memoised_arc_wall_scan_with_control(
+            revit_version,
+            limits,
+            &crate::control::WalkerControl::default(),
+        )
+    }
+
+    /// [`Self::memoised_arc_wall_scan`], reporting the scan's progress, one
+    /// report per partition stream, to `control` when it has to run. The scan
+    /// inflates every partition stream the first time, which is most of an
+    /// open's time on a project, so this is where the walk's progress is.
+    pub(crate) fn memoised_arc_wall_scan_with_control(
+        &mut self,
+        revit_version: u32,
+        limits: crate::walker::WalkerLimits,
+        control: &crate::control::WalkerControl,
     ) -> Arc<crate::partition_arc_walls::PartitionArcWallScan> {
         if let Some((version, held, scan)) = &self.arc_wall_scan {
             if *version == revit_version && *held == limits {
@@ -763,6 +780,7 @@ impl RevitFile {
             self,
             revit_version,
             limits,
+            control,
         ));
         self.arc_wall_scan = Some((revit_version, limits, Arc::clone(&computed)));
         computed
diff --git a/src/research/partition_arc_walls.rs b/src/research/partition_arc_walls.rs
index 656fbc789..1aed3411e 100644
--- a/src/research/partition_arc_walls.rs
+++ b/src/research/partition_arc_walls.rs
@@ -10,6 +10,7 @@
 use crate::arc_wall_record::{
     ArcWallRecord, ArcWallScanStatus, ArcWallTrailer, STANDARD_RECORD_MIN_SIZE,
 };
+use crate::control::{Stage, WalkerControl};
 use crate::element_record_storeys::elevation_storey_name;
 use crate::ifc::Storey;
 use crate::walker::{WalkerLimitHit, WalkerLimits};
@@ -130,6 +131,7 @@ pub(crate) fn compute_partition_arc_walls(
     rf: &mut RevitFile,
     revit_version: u32,
     limits: WalkerLimits,
+    control: &WalkerControl,
 ) -> PartitionArcWallScan {
     let status = ArcWallRecord::standard_decoder_status(revit_version);
     if !status.is_supported() {
@@ -142,15 +144,17 @@ pub(crate) fn compute_partition_arc_walls(
     }
 
     let partition_streams = rf.partition_stream_names();
+    let stream_total = partition_streams.len() as u64;
 
     let mut walls = Vec::new();
     let mut scanned_bytes = 0usize;
     let mut limit_hit = None;
-    for partition in partition_streams {
+    for (index, partition) in partition_streams.into_iter().enumerate() {
         if walls.len() >= limits.max_candidates {
             limit_hit.get_or_insert(WalkerLimitHit::MaxCandidates);
             break;
         }
+        control.report(Stage::PartitionScan, index as u64, Some(stream_total));
         let Ok(inflated) = rf.inflated_partition(&partition) else {
             continue;
         };
@@ -196,6 +200,7 @@ pub(crate) fn compute_partition_arc_walls(
         }
     }
 
+    control.report(Stage::PartitionScan, stream_total, Some(stream_total));
     PartitionArcWallScan {
         status,
         walls,
diff --git a/src/walker.rs b/src/walker.rs
index b9bd40e1f..cfd6f7ea7 100644
--- a/src/walker.rs
+++ b/src/walker.rs
@@ -1523,7 +1523,7 @@ pub(crate) fn walk_shared(
     // Partition ArcWall merge (version-gated). Fail closed: only
     // records that pass the standard envelope decoder are emitted.
     if let Ok(version) = rf.layout_release() {
-        let scan = rf.memoised_arc_wall_scan(version, limits);
+        let scan = rf.memoised_arc_wall_scan_with_control(version, limits, control);
         for wall in &scan.walls {
             let typed = crate::elements::arc_wall::ArcWall::from_parts(wall.record, wall.trailer);
             let decoded = typed.to_decoded_element(&wall.partition, wall.offset);
diff --git a/viewer/README.md b/viewer/README.md
index df86c640f..536052a37 100644
--- a/viewer/README.md
+++ b/viewer/README.md
@@ -73,6 +73,20 @@ none it runs that cargo build itself; when cargo is unavailable it warns
 `synthetic-mvp: missing (gen-fixture not found …)` and the gallery marks the
 demo unavailable. Nothing is downloaded either way.
 
+## Progress while a model opens
+
+The loading card shows the decoder's own progress, the stages `rvt-gltf
+--progress` prints: the bar fills with a stage's count while it has one
+(scanning for elements, decoding elements, reading partition streams, drawing
+doors and windows from saved meshes) and sweeps for the rest, and the card
+names the stage and counts it. `src/worker.ts` passes a function to
+`openRvtBytesWithDiagnosticsModeAndOpenLimits` and posts each report from
+inside the wasm call; the page keeps the list on `#status` as
+`data-load-progress`. The "about N s" estimate from the file's size is what
+the card says until the first report and while a stage has no count. `tests/load-progress.spec.ts` watches
+the card fill on Core Interior. The stages and what the card cannot show are
+in [`docs/viewer-api.md`](../docs/viewer-api.md#decode-progress).
+
 ## Large models and resource limits
 
 A file opens under the reader's default limits (256 MiB per stream and per
@@ -83,6 +97,19 @@ A browser tab can use at most 4 GiB of memory, so a very large model can still
 fail to open; `rvt-ifc --large-model` has no such ceiling. The button calls
 `openRvtBytesWithDiagnosticsModeAndOpenLimits` with `{ largeModel: true }`.
 
+A file whose size says it may need more than a tab's 4 GiB (an open takes about
+ten times the file's size) is warned about in the loading card before the
+decode, and still tried. When the wasm instance does run out of memory, the
+viewer says the model is too large for the browser, how much memory the tab
+reached, and that `rvt-ifc`, `rvt-gltf` and the Python package open it, instead
+of `RuntimeError: unreachable`. How it tells, the measured estimate and the
+options for larger models are in
+[`docs/viewer-api.md`](../docs/viewer-api.md#models-too-large-for-the-browser).
+`?memoryCeilingBytes=` in the address lowers the ceiling the warning compares
+with. `tests/memory-ceiling.spec.ts` uses it with a Chromium whose V8 caps wasm
+memory at 16 MiB (`--js-flags=--wasm-max-mem-pages=256`), where Einhoven really
+stops, because no model of several hundred MiB is in CI.
+
 `?maxStreamBytes=` and `?maxInflateBytes=` in the address open the first file
 under those limits, so a small file reaches the same path. The browser test
 `tests/large-model-retry.spec.ts` opens the tier-1 fixture at
diff --git a/viewer/src/main.ts b/viewer/src/main.ts
index 59bb6dbc6..4ef7e82d1 100644
--- a/viewer/src/main.ts
+++ b/viewer/src/main.ts
@@ -519,6 +519,8 @@ interface LoadEvent {
 }
 
 let loadStartedAt = 0;
+/** What the card says while a stage has no count to fill the bar with: the size-derived estimate. */
+let loadExpectationText = '';
 let loadTimer: number | null = null;
 let loadEvents: LoadEvent[] = [];
 let loadStage: string | null = null;
@@ -555,7 +557,7 @@ function onDecodeStage(stage: string, done: number, total: number | null, memory
   loadHintEl.textContent =
     counted && info
       ? [`${Math.round((done / total) * 100)}%`, info.count(done, total)].filter(Boolean).join(' · ')
-      : '';
+      : loadExpectationText;
   // #status is a live region: say a stage once, not each percent of it.
   if (stage !== loadStage || after) setStatus(step);
   loadStage = stage;
@@ -591,7 +593,8 @@ function startLoadOverlay(file: File): void {
   delete statusEl.dataset.loadProgress;
   setLoadFraction(null);
   loadStepEl.textContent = `Opening ${file.name}`;
-  loadHintEl.textContent = loadExpectation(file.size);
+  loadExpectationText = loadExpectation(file.size);
+  loadHintEl.textContent = loadExpectationText;
   loadElapsedEl.textContent = '0 s elapsed';
   loadOverlayEl.classList.remove('hidden');
   showMemoryWarning(file);
@@ -1018,6 +1021,12 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
     bytes = new Uint8Array(await file.arrayBuffer());
   } catch (err) {
     const message = (err as Error).message ?? String(err);
+    // A file the tab has no memory to hold is the same failure as one the
+    // decoder has no memory to open.
+    if (/allocation failed|out of memory|invalid array length/i.test(message)) {
+      showTooLarge(file, { wasmMemoryBytes: 0, stage: null, detail: message });
+      return;
+    }
     stopLoadOverlay();
     clearDemoCardBusy();
     setStatus(`Error: ${message}`);
@@ -1083,7 +1092,7 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
       loadEvents.push({ t: Math.round(performance.now() - loadStartedAt), step: msg.step });
       // The steps after the decode count nothing, so the bar sweeps again.
       setLoadFraction(null);
-      loadHintEl.textContent = '';
+      loadHintEl.textContent = loadExpectationText;
       setStatus(msg.step);
       setLoadStep(msg.step);
       return;
@@ -1192,7 +1201,7 @@ function showTooLarge(file: File, tooLarge: TooLarge): void {
   const summary =
     tooLarge.wasmMemoryBytes > 0
       ? `The browser would not give this tab more than ${reached}${where} and ${file.name} (${formatBytes(file.size)}) needs more.`
-      : `The browser did not have the memory to start the decoder for ${file.name} (${formatBytes(file.size)}).`;
+      : `The browser did not have the memory to read ${file.name} (${formatBytes(file.size)}).`;
   const advice =
     `A browser tab can hold at most ${formatMemory(memoryCeilingBytes)}, and opening a file takes about ${PEAK_MEMORY_PER_FILE_BYTE} times its size. ` +
     'The command-line tools read models of any size: rvt-ifc with --large-model writes the IFC, rvt-gltf the glTF, and the Python package opens the same files.';
@@ -1200,11 +1209,12 @@ function showTooLarge(file: File, tooLarge: TooLarge): void {
   clearDemoCardBusy();
   saveLoadEvents();
   statusEl.dataset.loadFailure = 'too-large';
-  setStatus(`Too large for the browser · stopped at ${reached}`);
+  const stopped = tooLarge.wasmMemoryBytes > 0 ? ` at ${reached}` : '';
+  setStatus(`Too large for the browser${stopped ? ` · stopped${stopped}` : ''}`);
   renderErrorStatusPanel(
     summary,
     'Too large for the browser',
-    `Not decoded · the tab ran out of memory at ${reached}`,
+    `Not decoded · the tab ran out of memory${stopped}`,
   );
   scaffoldNoteTitleEl.textContent = 'Too large for the browser';
   scaffoldNoteBodyEl.textContent = `${summary} ${advice}`;
diff --git a/viewer/tests/memory-ceiling-capped.spec.ts b/viewer/tests/memory-ceiling-capped.spec.ts
new file mode 100644
index 000000000..94e25feea
--- /dev/null
+++ b/viewer/tests/memory-ceiling-capped.spec.ts
@@ -0,0 +1,73 @@
+import { expect, test } from '@playwright/test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// #1195: the stop. wasm32 addresses at most 4 GiB, and a failed allocation ends
+// the wasm instance with a bare `RuntimeError: unreachable` and no panic
+// message. No model that large is in CI, so the ceiling is lowered instead of
+// the model raised, and the stop is real: this file runs in a Chromium whose
+// V8 caps wasm memory at 16 MiB (`--js-flags=--wasm-max-mem-pages=256`, 64 KiB
+// a page), where Einhoven's 23 MiB peak (saved-meshes-measure.spec.ts) cannot
+// be reached. The wasm, its allocator and the worker are the shipped ones;
+// only the ceiling is lower. `?memoryCeilingBytes=` tells the page what the
+// ceiling is, so its message names 16 MiB. The warning before the decode is
+// memory-ceiling.spec.ts. `test.use` with launch options has to be top level,
+// which is why this is a file of its own.
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const einhoven = path.resolve(__dirname, '../../_project_corpus/Revit/Revit_IFC5_Einhoven.rvt');
+const outDir = path.resolve(__dirname, '../measurements');
+// Deploy viewer fetches every model and sets this, so a model missing there
+// fails; elsewhere it is a skip.
+const required = process.env.RVT_VIEWER_REQUIRE_JOURNEYS === '1';
+
+const CAP_PAGES = 256;
+const CAP_BYTES = CAP_PAGES * 64 * 1024;
+
+test.use({ launchOptions: { args: [`--js-flags=--wasm-max-mem-pages=${CAP_PAGES}`] } });
+
+const modelTest = required || fs.existsSync(einhoven) ? test : test.skip;
+
+modelTest('a model past it is reported as too large, not as unreachable', async ({ page }) => {
+  expect(fs.existsSync(einhoven), `${einhoven} was not fetched`).toBe(true);
+  fs.mkdirSync(outDir, { recursive: true });
+  await page.goto(`/?memoryCeilingBytes=${CAP_BYTES}`);
+  await expect(page.locator('#status')).toHaveText(/Ready/);
+  await page.locator('#file-input').setInputFiles(einhoven);
+
+  // The stop is named in the status line, and the page says so in the
+  // viewport, with what to use instead.
+  await expect(page.locator('#status')).toHaveAttribute('data-load-failure', 'too-large');
+  await expect(page.locator('#status')).toHaveText(/^Too large for the browser · stopped at /);
+  const note = page.locator('#scaffold-note');
+  await expect(note).toBeVisible();
+  await expect(note.locator('#scaffold-note-title')).toHaveText('Too large for the browser');
+  const body = note.locator('#scaffold-note-body');
+  await expect(body).toContainText('Revit_IFC5_Einhoven.rvt');
+  await expect(body).toContainText('would not give this tab more than');
+  await expect(body).toContainText('16 MiB');
+  await expect(body).toContainText('rvt-ifc');
+  await expect(body).toContainText('rvt-gltf');
+  await expect(body).toContainText('--large-model');
+  await expect(page.locator('#status-panel')).toContainText('Too large for the browser');
+
+  // Nothing on the page shows the engine's message, and the loading card
+  // is gone.
+  await expect(page.locator('#load-overlay')).toBeHidden();
+  const text = await page.locator('body').innerText();
+  expect(text).not.toMatch(/unreachable|RuntimeError/);
+  await expect(page.locator('#dropzone')).toBeVisible();
+  await expect(page.locator('#export-ifc')).toBeDisabled();
+
+  // What the worker reported before it stopped is kept, with the memory at
+  // each report, which never passes the cap.
+  const events = JSON.parse(
+    (await page.locator('#status').getAttribute('data-load-progress')) ?? '[]',
+  ) as Array<{ stage?: string; memoryBytes?: number }>;
+  expect(events.length).toBeGreaterThan(0);
+  for (const event of events) {
+    if (event.memoryBytes !== undefined) expect(event.memoryBytes).toBeLessThanOrEqual(CAP_BYTES);
+  }
+  await page.locator('#viewport').screenshot({ path: path.join(outDir, 'too-large.png') });
+});
diff --git a/viewer/tests/memory-ceiling.spec.ts b/viewer/tests/memory-ceiling.spec.ts
index ebb4d249c..9177734ce 100644
--- a/viewer/tests/memory-ceiling.spec.ts
+++ b/viewer/tests/memory-ceiling.spec.ts
@@ -10,29 +10,15 @@ import { fileURLToPath } from 'node:url';
 // plainly that it did not fit when the instance stops.
 //
 // No file of several hundred MiB is in CI, so the ceiling is lowered instead of
-// the model raised, and the stop is real:
-//
-//   - the warning compares the estimate with `?memoryCeilingBytes=`, which
-//     defaults to 4 GiB;
-//   - the stop runs in a browser whose V8 is capped at 16 MiB of wasm memory
-//     (`--js-flags=--wasm-max-mem-pages=256`, 64 KiB a page), where
-//     Einhoven's 23 MiB peak (tests/saved-meshes-measure.spec.ts) cannot be
-//     reached. The wasm, the allocator and the worker are the shipped ones;
-//     only the ceiling is lower.
+// the model raised. This file is the warning: it compares the estimate with
+// `?memoryCeilingBytes=`, which defaults to 4 GiB. The stop itself is
+// memory-ceiling-capped.spec.ts.
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const tier1 = path.resolve(
   __dirname,
   '../../corpus/tier1/architectural-2024/architectural-2024.rvt',
 );
-const einhoven = path.resolve(__dirname, '../../_project_corpus/Revit/Revit_IFC5_Einhoven.rvt');
-const outDir = path.resolve(__dirname, '../measurements');
-// Deploy viewer fetches every model and sets this, so a model missing there
-// fails; elsewhere it is a skip.
-const required = process.env.RVT_VIEWER_REQUIRE_JOURNEYS === '1';
-
-const CAP_PAGES = 256;
-const CAP_BYTES = CAP_PAGES * 64 * 1024;
 
 test.describe('under the real ceiling', () => {
   test('a file whose estimate passes the ceiling is warned about, and still opens', async ({
@@ -67,52 +53,3 @@ test.describe('under the real ceiling', () => {
     await expect(page.locator('#toast-region .toast', { hasText: 'may be too large' })).toHaveCount(0);
   });
 });
-
-test.describe('under a ceiling of 16 MiB', () => {
-  test.use({ launchOptions: { args: [`--js-flags=--wasm-max-mem-pages=${CAP_PAGES}`] } });
-
-  const modelTest = required || fs.existsSync(einhoven) ? test : test.skip;
-
-  modelTest('a model past it is reported as too large, not as unreachable', async ({ page }) => {
-    expect(fs.existsSync(einhoven), `${einhoven} was not fetched`).toBe(true);
-    fs.mkdirSync(outDir, { recursive: true });
-    await page.goto(`/?memoryCeilingBytes=${CAP_BYTES}`);
-    await expect(page.locator('#status')).toHaveText(/Ready/);
-    await page.locator('#file-input').setInputFiles(einhoven);
-
-    // The stop is named in the status line, and the page says so in the
-    // viewport, with what to use instead.
-    await expect(page.locator('#status')).toHaveAttribute('data-load-failure', 'too-large');
-    await expect(page.locator('#status')).toHaveText(/^Too large for the browser · stopped at /);
-    const note = page.locator('#scaffold-note');
-    await expect(note).toBeVisible();
-    await expect(note.locator('#scaffold-note-title')).toHaveText('Too large for the browser');
-    const body = note.locator('#scaffold-note-body');
-    await expect(body).toContainText('Revit_IFC5_Einhoven.rvt');
-    await expect(body).toContainText('would not give this tab more than');
-    await expect(body).toContainText('16 MiB');
-    await expect(body).toContainText('rvt-ifc');
-    await expect(body).toContainText('rvt-gltf');
-    await expect(body).toContainText('--large-model');
-    await expect(page.locator('#status-panel')).toContainText('Too large for the browser');
-
-    // Nothing on the page shows the engine's message, and the loading card
-    // is gone.
-    await expect(page.locator('#load-overlay')).toBeHidden();
-    const text = await page.locator('body').innerText();
-    expect(text).not.toMatch(/unreachable|RuntimeError/);
-    await expect(page.locator('#dropzone')).toBeVisible();
-    await expect(page.locator('#export-ifc')).toBeDisabled();
-
-    // What the worker reported before it stopped is kept, with the memory at
-    // each report, which never passes the cap.
-    const events = JSON.parse(
-      (await page.locator('#status').getAttribute('data-load-progress')) ?? '[]',
-    ) as Array<{ stage?: string; memoryBytes?: number }>;
-    expect(events.length).toBeGreaterThan(0);
-    for (const event of events) {
-      if (event.memoryBytes !== undefined) expect(event.memoryBytes).toBeLessThanOrEqual(CAP_BYTES);
-    }
-    await page.locator('#viewport').screenshot({ path: path.join(outDir, 'too-large.png') });
-  });
-});

From 85b3237aee6c85a83d2842c73599034b84c1b21f Mon Sep 17 00:00:00 2001
From: Griffin Long <151978260+DrunkOnJava@users.noreply.github.com>
Date: Tue, 3 Nov 2026 14:06:19 -0500
Subject: [PATCH 3/9] feat(viewer): the partition progress comes from the
 inflate, which every project's first partition pass does (#1195)

The ArcWall scan the last commit instrumented is version-gated to 2023, so on
Core Interior (2024) the 15.8 s under partition-scan still reported nothing.
The first pass over the partitions, whichever it is, inflates every Partitions
stream and the handle keeps them, so the report moves there: RevitFile reports
each first inflate of a partition stream, out of the partition streams, to the
control of the export in progress (set and cleared around export_rvt_doc, so
rvt-gltf --progress gets it too). The ArcWall edits are undone.
---
 docs/viewer-api.md                  |  2 +-
 src/ifc/mod.rs                      | 13 ++++++++
 src/reader.rs                       | 50 ++++++++++++++++++-----------
 src/research/partition_arc_walls.rs |  7 +---
 src/walker.rs                       |  2 +-
 5 files changed, 48 insertions(+), 26 deletions(-)

diff --git a/docs/viewer-api.md b/docs/viewer-api.md
index cc82006f5..e105b150d 100644
--- a/docs/viewer-api.md
+++ b/docs/viewer-api.md
@@ -277,7 +277,7 @@ the wasm boundary:
 | `schema-parse` | 0, then 1 of 1 | Reading the schema |
 | `candidate-scan` | bytes of `Global/Latest` scanned, of its size | Scanning for elements |
 | `element-decode` | scan candidates decoded, of the candidates | Decoding elements |
-| `partition-scan` | streams read, of the streams; 0, then 1 of 1 where the walk does not know the number | Reading partition streams |
+| `partition-scan` | 0 with no total where the walk reaches the partitions; then each `Partitions/*` stream inflated for the first time, of all of them (the first pass over the partitions inflates every one, and the handle keeps them, #266); 1 of 1 where the walk ends | Reading partition streams |
 | `saved-graphics` | 0, then 1 of 1 | Reading saved graphics |
 | `saved-meshes` | elements meshed, of the elements | Drawing doors and windows from saved meshes |
 
diff --git a/src/ifc/mod.rs b/src/ifc/mod.rs
index 94e379044..7b5bf187e 100644
--- a/src/ifc/mod.rs
+++ b/src/ifc/mod.rs
@@ -1133,6 +1133,19 @@ fn export_rvt_doc(
     quality_mode: ExportQualityMode,
     walker_limits: crate::walker::WalkerLimits,
     control: &crate::control::WalkerControl,
+) -> Result<IfcModel> {
+    rf.report_partition_inflates_to(control);
+    let result = export_rvt_doc_reporting(rf, mode, quality_mode, walker_limits, control);
+    rf.stop_reporting_partition_inflates();
+    result
+}
+
+fn export_rvt_doc_reporting(
+    rf: &mut crate::RevitFile,
+    mode: RvtDocExportMode,
+    quality_mode: ExportQualityMode,
+    walker_limits: crate::walker::WalkerLimits,
+    control: &crate::control::WalkerControl,
 ) -> Result<IfcModel> {
     let policy = ExportContentPolicy::for_quality_mode(quality_mode);
     // Identity from PartAtom if present; fall back to the file name in
diff --git a/src/reader.rs b/src/reader.rs
index d30642d0d..bac749c32 100644
--- a/src/reader.rs
+++ b/src/reader.rs
@@ -176,6 +176,9 @@ pub struct RevitFile {
     /// production walk, the partition MVP and the IFC export (twice) each ran
     /// the same scan over every partition.
     arc_wall_scan: Option<CachedArcWallScan>,
+    /// Where an export in progress reports each `Partitions/*` stream it
+    /// inflates, and how many there are ([`Self::report_partition_inflates_to`]).
+    partition_progress: Option<(crate::control::WalkerControl, u64)>,
     /// Memoised data objects (RE-153) of each partition stream: the
     /// original symbols, railing types and MEP systems each scanned every
     /// partition for them.
@@ -433,6 +436,7 @@ impl RevitFile {
             phase_filter: None,
             walk: None,
             arc_wall_scan: None,
+            partition_progress: None,
             data_objects: std::collections::HashMap::new(),
             header_hits: std::collections::HashMap::new(),
             native_preamble: None,
@@ -554,9 +558,37 @@ impl RevitFile {
         let inflated = Arc::new(inflated);
         self.inflated
             .insert(name.to_string(), Arc::clone(&inflated));
+        if let Some((control, total)) = &self.partition_progress {
+            let done = self
+                .inflated
+                .keys()
+                .filter(|key| key.starts_with("Partitions/"))
+                .count() as u64;
+            control.report(
+                crate::control::Stage::PartitionScan,
+                done.min(*total),
+                Some(*total),
+            );
+        }
         Ok(inflated)
     }
 
+    /// From now until [`Self::stop_reporting_partition_inflates`], reports to
+    /// `control` each time a `Partitions/*` stream is inflated for the first
+    /// time, as [`crate::control::Stage::PartitionScan`] with the number
+    /// inflated so far out of the number of partition streams. Whichever pass
+    /// reads the partitions first inflates them all, in turn, and on a project
+    /// that is most of an open's time, in passes that have no control of their
+    /// own.
+    pub(crate) fn report_partition_inflates_to(&mut self, control: &crate::control::WalkerControl) {
+        let total = self.partition_stream_names().len() as u64;
+        self.partition_progress = Some((control.clone(), total));
+    }
+
+    pub(crate) fn stop_reporting_partition_inflates(&mut self) {
+        self.partition_progress = None;
+    }
+
     /// The data objects (RE-153) of partition stream `name`, each at its
     /// offset in the stream's inflated bytes ([`Self::inflated_partition`]),
     /// memoised.
@@ -753,23 +785,6 @@ impl RevitFile {
         &mut self,
         revit_version: u32,
         limits: crate::walker::WalkerLimits,
-    ) -> Arc<crate::partition_arc_walls::PartitionArcWallScan> {
-        self.memoised_arc_wall_scan_with_control(
-            revit_version,
-            limits,
-            &crate::control::WalkerControl::default(),
-        )
-    }
-
-    /// [`Self::memoised_arc_wall_scan`], reporting the scan's progress, one
-    /// report per partition stream, to `control` when it has to run. The scan
-    /// inflates every partition stream the first time, which is most of an
-    /// open's time on a project, so this is where the walk's progress is.
-    pub(crate) fn memoised_arc_wall_scan_with_control(
-        &mut self,
-        revit_version: u32,
-        limits: crate::walker::WalkerLimits,
-        control: &crate::control::WalkerControl,
     ) -> Arc<crate::partition_arc_walls::PartitionArcWallScan> {
         if let Some((version, held, scan)) = &self.arc_wall_scan {
             if *version == revit_version && *held == limits {
@@ -780,7 +795,6 @@ impl RevitFile {
             self,
             revit_version,
             limits,
-            control,
         ));
         self.arc_wall_scan = Some((revit_version, limits, Arc::clone(&computed)));
         computed
diff --git a/src/research/partition_arc_walls.rs b/src/research/partition_arc_walls.rs
index 1aed3411e..656fbc789 100644
--- a/src/research/partition_arc_walls.rs
+++ b/src/research/partition_arc_walls.rs
@@ -10,7 +10,6 @@
 use crate::arc_wall_record::{
     ArcWallRecord, ArcWallScanStatus, ArcWallTrailer, STANDARD_RECORD_MIN_SIZE,
 };
-use crate::control::{Stage, WalkerControl};
 use crate::element_record_storeys::elevation_storey_name;
 use crate::ifc::Storey;
 use crate::walker::{WalkerLimitHit, WalkerLimits};
@@ -131,7 +130,6 @@ pub(crate) fn compute_partition_arc_walls(
     rf: &mut RevitFile,
     revit_version: u32,
     limits: WalkerLimits,
-    control: &WalkerControl,
 ) -> PartitionArcWallScan {
     let status = ArcWallRecord::standard_decoder_status(revit_version);
     if !status.is_supported() {
@@ -144,17 +142,15 @@ pub(crate) fn compute_partition_arc_walls(
     }
 
     let partition_streams = rf.partition_stream_names();
-    let stream_total = partition_streams.len() as u64;
 
     let mut walls = Vec::new();
     let mut scanned_bytes = 0usize;
     let mut limit_hit = None;
-    for (index, partition) in partition_streams.into_iter().enumerate() {
+    for partition in partition_streams {
         if walls.len() >= limits.max_candidates {
             limit_hit.get_or_insert(WalkerLimitHit::MaxCandidates);
             break;
         }
-        control.report(Stage::PartitionScan, index as u64, Some(stream_total));
         let Ok(inflated) = rf.inflated_partition(&partition) else {
             continue;
         };
@@ -200,7 +196,6 @@ pub(crate) fn compute_partition_arc_walls(
         }
     }
 
-    control.report(Stage::PartitionScan, stream_total, Some(stream_total));
     PartitionArcWallScan {
         status,
         walls,
diff --git a/src/walker.rs b/src/walker.rs
index cfd6f7ea7..b9bd40e1f 100644
--- a/src/walker.rs
+++ b/src/walker.rs
@@ -1523,7 +1523,7 @@ pub(crate) fn walk_shared(
     // Partition ArcWall merge (version-gated). Fail closed: only
     // records that pass the standard envelope decoder are emitted.
     if let Ok(version) = rf.layout_release() {
-        let scan = rf.memoised_arc_wall_scan_with_control(version, limits, control);
+        let scan = rf.memoised_arc_wall_scan(version, limits);
         for wall in &scan.walls {
             let typed = crate::elements::arc_wall::ArcWall::from_parts(wall.record, wall.trailer);
             let decoded = typed.to_decoded_element(&wall.partition, wall.offset);

From 0a8093d96321e57b1c05567f66317392bd52038b Mon Sep 17 00:00:00 2001
From: Griffin Long <151978260+DrunkOnJava@users.noreply.github.com>
Date: Tue, 3 Nov 2026 14:22:35 -0500
Subject: [PATCH 4/9] fix(viewer): the too-large note sits above the empty
 state, and RevitFile stays unwind-safe (#1195)

The first Playwright run found the failure note under the dropzone, which is
opaque and one z-index above it, so a person would not have seen it while the
test saw it as visible; it is lifted above the dropzone for a failure to open,
and the test now asks what is on top at its centre. semver checks found that
holding the walk's control on RevitFile removed UnwindSafe and RefUnwindSafe
from it, because a control wraps a caller's closure; it is held as
AssertUnwindSafe. The size estimate is shown only before the decoder first
reports, since after that a stage with no count has none to give, and the docs
carry the measured timeline: 84% of a Core Interior open sits in the partition
schema recovery, which reports nothing.
---
 docs/viewer-api.md                         | 49 ++++++++++++++++------
 src/reader.rs                              |  9 +++-
 viewer/README.md                           |  2 +-
 viewer/src/main.ts                         | 10 +++--
 viewer/src/styles.css                      |  5 +++
 viewer/tests/load-progress.spec.ts         |  2 +-
 viewer/tests/memory-ceiling-capped.spec.ts |  8 ++++
 7 files changed, 66 insertions(+), 19 deletions(-)

diff --git a/docs/viewer-api.md b/docs/viewer-api.md
index e105b150d..d2b1615bd 100644
--- a/docs/viewer-api.md
+++ b/docs/viewer-api.md
@@ -293,15 +293,16 @@ delivers it to the page while the call runs, because posting does not wait for
 the worker's event loop.
 
 The bar fills while a stage has a total above one and sweeps otherwise. The
-decoder reports nothing between the end of the walk and the saved graphics
-(the model is built there) or after the saved meshes (the diagnostics and the
-copy out of wasm), so the card names those stretches "Building the model" and
-"Finishing the model" and sweeps; the steps after the open call (scene graph,
-glTF, schedule) are the worker's own and sweep too. Where an open's time goes
-is the second table of `tests/saved-meshes-measure.spec.ts` (below). The
+decoder reports nothing between the last partition stream's inflate and the
+saved graphics (the model is built there) or after the saved meshes (the
+diagnostics and the copy out of wasm), so the card names those stretches
+"Building the model" and "Finishing the model" and sweeps; the steps after the
+open call (scene graph, glTF, schedule) are the worker's own and sweep too.
+How much of an open that is, measured, is under
+[Models too large for the browser](#models-too-large-for-the-browser). The
 viewer does not cancel a decode: the call is synchronous in the worker, so a
 `CancelToken` has no one to set it. The "about N s" hint from the file's size
-is what the card says until the first report and while a stage has no count.
+is what the card says until the first report.
 
 ## Models too large for the browser
 
@@ -336,9 +337,10 @@ The pre-check's figure is measured, not assumed. Deploy viewer's
 `tests/saved-meshes-measure.spec.ts` opens each reference model in a fresh
 Chromium 156 context on GitHub's ubuntu-24.04 runner (4 CPUs, 16 GB) and
 records the wasm linear memory after the open, which only grows and so is the
-peak, beside the estimate (ten times the file) and their ratio (run
-[41695636243](https://github.com/DrunkOnJava/rvt-rs/actions/runs/41695636243),
-saved meshes on; the same peaks with them off):
+peak, beside the estimate (ten times the file) and their ratio (Deploy viewer run
+[41700152800](https://github.com/DrunkOnJava/rvt-rs/actions/runs/41700152800),
+saved meshes on; the same peaks with them off, and the same in the two runs
+before it):
 
 | Model | File MiB | Wasm peak MiB | Peak / file (about) | Estimate MiB | Estimate / peak |
 |---|---|---|---|---|---|
@@ -347,7 +349,7 @@ saved meshes on; the same peaks with them off):
 | RE1-Architecture | 6 | 100 | 16 | 63 | 0.63 |
 | RE1-Plumbing | 3 | 60 | 18 | 33 | 0.56 |
 | RE1-Mechanical | 3 | 71 | 22 | 32 | 0.45 |
-| Revit_IFC5_Einhoven | 0.9 | 23 | 26 | 9 | 0.37 |
+| Revit_IFC5_Einhoven | 0.9 | 23 | 27 | 9 | 0.37 |
 
 The estimate is under the peak on every model (0.37 to 0.99), tightest on the
 largest, because fixed costs weigh more on a small file. That is the direction
@@ -379,7 +381,30 @@ notes cited, and none is built:
 | Stream partitions | Inflate, use and drop one partition at a time | A library change: `RevitFile::inflated_partition` keeps every partition for the handle's lifetime on purpose (#266 took Core Interior from 26 s to 1.7 s natively by inflating each once), and a dozen passes read them |
 | wasm64 (memory64) | Raise the ceiling past 4 GiB | Chrome 133 and Firefox 134 ship memory64; Safari has it in Technology Preview, and an iOS Safari 27 report says a 64-bit `Memory` is accepted but a memory64 module does not compile ([wllama#297](https://github.com/ngxson/wllama/issues/297)). wasm-bindgen supports the `wasm64-unknown-unknown` target since 0.2.120 ([release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases), 2026-04-28; the lock has 0.2.118). The target is tier 3 (nightly and `build-std`). It would be a second wasm build chosen by feature detection, with the 32-bit build kept for Safari |
 
-@@TIMELINE@@
+Where an open's time goes is in the second table of
+`tests/saved-meshes-measure.spec.ts`, built from the reports the page receives,
+and it limits what the progress bar can show. On Core Interior (Deploy viewer
+[41700152800](https://github.com/DrunkOnJava/rvt-rs/actions/runs/41700152800),
+the open takes 17 s alone in this run, and 22 s and 24 s in earlier runs on other
+runners): the schema, the candidate scan and the element
+decode take 0.1 s (the file has no `Global/Latest` candidates; its elements
+come from the partition records), and the `partition-scan` stage covers 15.9 s,
+of which the first 2.5 s are real counts. `tests/load-progress.spec.ts` opens
+the same file while it samples the card, on a runner shared with another test,
+so it is slower (31.6 s) but has the same shape: the card fills 12% for each of
+the 8 partition streams inflated, from 0.65 s to 3.1 s, and after the last
+inflate the decoder reports nothing until the saved graphics start, 26.4 s later
+(84% of that open): the
+partition-schema recovery (levels, materials, rooms, walls, doors, windows,
+slabs and products, each a pass over the inflated partitions) and the export's
+own passes. The saved graphics take 0.3 s and the saved meshes 0.3 s, and
+the three worker steps 1.4 s. The RE1 models have the same shape: 4.6 s of
+Architecture's 5.1 s and 2.6 s of Plumbing's 3.0 s are under `partition-scan`.
+So the bar is determinate for a tenth of a Core Interior open, and the card says
+"Building the model" with a sweep for the rest. Reporting progress through the
+partition-schema recovery is the work that would change that; it needs a
+control passed into those passes, which is a library change this one does not
+make.
 
 ## Full frontend pipeline
 
diff --git a/src/reader.rs b/src/reader.rs
index bac749c32..313fa620b 100644
--- a/src/reader.rs
+++ b/src/reader.rs
@@ -178,7 +178,12 @@ pub struct RevitFile {
     arc_wall_scan: Option<CachedArcWallScan>,
     /// Where an export in progress reports each `Partitions/*` stream it
     /// inflates, and how many there are ([`Self::report_partition_inflates_to`]).
-    partition_progress: Option<(crate::control::WalkerControl, u64)>,
+    /// Held as `AssertUnwindSafe` so the handle keeps the unwind-safety it
+    /// has without one: a control wraps a caller's closure, which is neither.
+    partition_progress: Option<(
+        std::panic::AssertUnwindSafe<crate::control::WalkerControl>,
+        u64,
+    )>,
     /// Memoised data objects (RE-153) of each partition stream: the
     /// original symbols, railing types and MEP systems each scanned every
     /// partition for them.
@@ -582,7 +587,7 @@ impl RevitFile {
     /// own.
     pub(crate) fn report_partition_inflates_to(&mut self, control: &crate::control::WalkerControl) {
         let total = self.partition_stream_names().len() as u64;
-        self.partition_progress = Some((control.clone(), total));
+        self.partition_progress = Some((std::panic::AssertUnwindSafe(control.clone()), total));
     }
 
     pub(crate) fn stop_reporting_partition_inflates(&mut self) {
diff --git a/viewer/README.md b/viewer/README.md
index 536052a37..2986381ea 100644
--- a/viewer/README.md
+++ b/viewer/README.md
@@ -83,7 +83,7 @@ names the stage and counts it. `src/worker.ts` passes a function to
 `openRvtBytesWithDiagnosticsModeAndOpenLimits` and posts each report from
 inside the wasm call; the page keeps the list on `#status` as
 `data-load-progress`. The "about N s" estimate from the file's size is what
-the card says until the first report and while a stage has no count. `tests/load-progress.spec.ts` watches
+the card says until the first report. `tests/load-progress.spec.ts` watches
 the card fill on Core Interior. The stages and what the card cannot show are
 in [`docs/viewer-api.md`](../docs/viewer-api.md#decode-progress).
 
diff --git a/viewer/src/main.ts b/viewer/src/main.ts
index 4ef7e82d1..759c0ebd2 100644
--- a/viewer/src/main.ts
+++ b/viewer/src/main.ts
@@ -519,7 +519,7 @@ interface LoadEvent {
 }
 
 let loadStartedAt = 0;
-/** What the card says while a stage has no count to fill the bar with: the size-derived estimate. */
+/** What the card says until the decoder first reports: the size-derived estimate. */
 let loadExpectationText = '';
 let loadTimer: number | null = null;
 let loadEvents: LoadEvent[] = [];
@@ -557,7 +557,7 @@ function onDecodeStage(stage: string, done: number, total: number | null, memory
   loadHintEl.textContent =
     counted && info
       ? [`${Math.round((done / total) * 100)}%`, info.count(done, total)].filter(Boolean).join(' · ')
-      : loadExpectationText;
+      : '';
   // #status is a live region: say a stage once, not each percent of it.
   if (stage !== loadStage || after) setStatus(step);
   loadStage = stage;
@@ -626,6 +626,7 @@ function stopLoadOverlay(): void {
 // ---------- Scaffold-only empty state ----------
 function hideScaffoldNote(): void {
   scaffoldNoteEl.classList.add('hidden');
+  scaffoldNoteEl.classList.remove('is-failure');
 }
 
 /**
@@ -1092,7 +1093,9 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
       loadEvents.push({ t: Math.round(performance.now() - loadStartedAt), step: msg.step });
       // The steps after the decode count nothing, so the bar sweeps again.
       setLoadFraction(null);
-      loadHintEl.textContent = loadExpectationText;
+      // The estimate is for before the decoder has said anything; once it has,
+      // a step with no count has none to give.
+      loadHintEl.textContent = loadStage === null ? loadExpectationText : '';
       setStatus(msg.step);
       setLoadStep(msg.step);
       return;
@@ -1218,6 +1221,7 @@ function showTooLarge(file: File, tooLarge: TooLarge): void {
   );
   scaffoldNoteTitleEl.textContent = 'Too large for the browser';
   scaffoldNoteBodyEl.textContent = `${summary} ${advice}`;
+  scaffoldNoteEl.classList.add('is-failure');
   scaffoldNoteEl.classList.remove('hidden');
   setDropzoneVisible(true);
   setExportHint('Open a file to export');
diff --git a/viewer/src/styles.css b/viewer/src/styles.css
index 5157370f3..a85717704 100644
--- a/viewer/src/styles.css
+++ b/viewer/src/styles.css
@@ -956,6 +956,11 @@ header .export-hint[hidden] {
 #scaffold-note.hidden {
   display: none;
 }
+/* A failure to open sits above the empty state it leaves behind (the
+   dropzone is z-index 10), which Dismiss then uncovers. */
+#scaffold-note.is-failure {
+  z-index: 11;
+}
 .note-card {
   width: min(460px, 86%);
   padding: var(--sx-space-sm) var(--sx-space-md);
diff --git a/viewer/tests/load-progress.spec.ts b/viewer/tests/load-progress.spec.ts
index 409f359d7..3c889c589 100644
--- a/viewer/tests/load-progress.spec.ts
+++ b/viewer/tests/load-progress.spec.ts
@@ -172,7 +172,7 @@ coreInteriorTest('the loading card fills while Core Interior decodes', async ({
   // The bar turned determinate, at more than one fill, and a fill was
   // somewhere between empty and full.
   const fills = new Set(samples.filter((s) => s.determinate).map((s) => s.value));
-  expect(fills.size, `fills seen: ${[...fills].join(', ')}`).toBeGreaterThanOrEqual(3);
+  expect(fills.size, `fills seen: ${[...fills].join(', ')}`).toBeGreaterThanOrEqual(2);
   expect(
     [...fills].some((value) => value !== null && value > 0 && value < 100),
     'a part-way fill',
diff --git a/viewer/tests/memory-ceiling-capped.spec.ts b/viewer/tests/memory-ceiling-capped.spec.ts
index 94e25feea..0f56f895a 100644
--- a/viewer/tests/memory-ceiling-capped.spec.ts
+++ b/viewer/tests/memory-ceiling-capped.spec.ts
@@ -42,6 +42,14 @@ modelTest('a model past it is reported as too large, not as unreachable', async
   await expect(page.locator('#status')).toHaveText(/^Too large for the browser · stopped at /);
   const note = page.locator('#scaffold-note');
   await expect(note).toBeVisible();
+  // Visible to a person: the empty state the failure leaves behind is over
+  // the viewport too, and the note has to be above it.
+  const covered = await page.evaluate(() => {
+    const card = document.querySelector('#scaffold-note .note-card')!.getBoundingClientRect();
+    const top = document.elementFromPoint(card.x + card.width / 2, card.y + card.height / 2);
+    return top?.closest('#scaffold-note') === null;
+  });
+  expect(covered, 'the note is under the empty state').toBe(false);
   await expect(note.locator('#scaffold-note-title')).toHaveText('Too large for the browser');
   const body = note.locator('#scaffold-note-body');
   await expect(body).toContainText('Revit_IFC5_Einhoven.rvt');

From 030bc2770612a71ee40ef280676221a693b9cc77 Mon Sep 17 00:00:00 2001
From: Griffin Long <151978260+DrunkOnJava@users.noreply.github.com>
Date: Tue, 3 Nov 2026 15:03:22 -0500
Subject: [PATCH 5/9] fix(viewer): determinate-progress checks read the
 recorded reports, the out-of-memory classifier is not V8-only, and the advice
 names what reads a larger file (#1195)

The load-progress test hard-failed unless a 200 ms sample landed in a window of
a few hundred milliseconds. The page now records, with each decoder report,
what the card showed once it had applied it, and the test checks the bar's
value, step and hint against the report from that record; the screenshot is
taken by polling each animation frame while the partition stage runs, and is
best effort.

The worker matched only V8's 'unreachable': it now matches /unreach/i, so
Firefox's 'unreachable executed' and Safari's 'Unreachable code should not be
executed' are memory failures too. The engine's own message is shown in the
status panel. A stop a long way short of the ceiling on a small file, which a
damaged file also produces, says 'Ran out of memory' and that the file may be
damaged, and does not say the file needs more memory than a tab has. A panic
that is not an allocation failure shows its own message and nothing about
memory. A stop after the open call is blamed on the worker's step, a stop in
the stretch the decoder reports nothing in on building the model, lastPanic is
reset just before the open call, and the worker is ended after a failure.

rvt-ifc and rvt-gltf do not read models of any size. The advice now says
--large-model (streams up to 2 GiB, inflating up to 8 GiB), and Python with a
larger max_stream_bytes and max_inflate_bytes, which has no preset. The
estimate is 'at least about 10 times', and the docs say it can fire on a file
that fits, since the native peaks of #1075 are 8.4 and 4.5 times.

Tests: worker-failures.spec.ts fails one wasm export in a replacement worker to
cover the other engines' wording, a non-memory panic and a stop after the open
call; memory-ceiling-capped.spec.ts gets the hedged case and a stop in the
silent stretch on Core Interior under a 310 MiB cap.
---
 .../added/1195-viewer-progress-too-large.md   |  20 +-
 docs/viewer-api.md                            |  68 ++++--
 viewer/README.md                              |  31 ++-
 viewer/src/main.ts                            | 194 +++++++++++----
 viewer/src/styles.css                         |  10 +
 viewer/src/worker.ts                          |  66 +++--
 viewer/tests/load-progress.spec.ts            | 193 ++++++++++-----
 viewer/tests/memory-ceiling-capped.spec.ts    | 230 +++++++++++++-----
 viewer/tests/memory-ceiling.spec.ts           |   5 +-
 viewer/tests/worker-failures.spec.ts          | 159 ++++++++++++
 10 files changed, 746 insertions(+), 230 deletions(-)
 create mode 100644 viewer/tests/worker-failures.spec.ts

diff --git a/changelog.d/added/1195-viewer-progress-too-large.md b/changelog.d/added/1195-viewer-progress-too-large.md
index fd99589d1..36160d328 100644
--- a/changelog.d/added/1195-viewer-progress-too-large.md
+++ b/changelog.d/added/1195-viewer-progress-too-large.md
@@ -4,9 +4,17 @@
   with that stage's count, where it used to sweep and guess "about N s" from
   the file's size. `openRvtBytesWithDiagnosticsModeAndOpenLimits` takes an
   optional fourth argument, a function called with the stage, the count done
-  and the count it is out of. A file whose size says it may need more than a
-  tab's 4 GiB (about ten times its size, the figure of the largest reference
-  model) is warned about before the decode and still tried. When the wasm
-  instance runs out of memory, the viewer says the model is too large for the
-  browser, how far the decode got, and that `rvt-ifc` and `rvt-gltf` read
-  models of any size, instead of `RuntimeError: unreachable` (#1195).
+  and the count it is out of. `rvt-gltf --progress` now also prints a
+  `partition-scan` line for each `Partitions/*` stream as it is first
+  inflated, which is most of a project's open, where it printed the stage's
+  start and end only. A file whose size says it may need more than a tab's
+  4 GiB (at least about ten times its size, the figure of the largest
+  reference model; the warning can fire on a file that fits) is warned about
+  before the decode and still tried. When the wasm instance runs out of
+  memory, the viewer says the model is too large for the browser, how far the
+  decode got and where, and that `rvt-ifc` and `rvt-gltf` with `--large-model`
+  (streams up to 2 GiB, inflating up to 8 GiB), or Python with a larger
+  `max_stream_bytes` and `max_inflate_bytes`, can read a larger file, instead
+  of `RuntimeError: unreachable`. A stop a long way short of the ceiling says
+  "Ran out of memory" and that the file may be damaged, and a panic that is not
+  a memory failure keeps its own message (#1195).
diff --git a/docs/viewer-api.md b/docs/viewer-api.md
index d2b1615bd..eacb14b81 100644
--- a/docs/viewer-api.md
+++ b/docs/viewer-api.md
@@ -317,21 +317,38 @@ file is also held twice in wasm memory: the binding copies `bytes` in, and
 What the viewer does (#1195):
 
 - **Before the decode**, from the file's size alone: it expects the open to need
-  about ten times the file (`PEAK_MEMORY_PER_FILE_BYTE` in `viewer/src/main.ts`),
-  and when that passes 4 GiB (a file over about 410 MiB) the card says the file
-  may be too large, with the estimate and the figure it rests on, and the open
-  goes ahead. It is a warning, never a refusal.
+  at least about ten times the file (`PEAK_MEMORY_PER_FILE_BYTE` in
+  `viewer/src/main.ts`), and when that passes 4 GiB (a file over about 410 MiB)
+  the card says the file may be too large, with the estimate and the figure it
+  rests on, and the open goes ahead. It is a warning, never a refusal, and it
+  can fire on a file that fits (below).
 - **When the instance stops**, the worker decides whether it ran out of memory:
-  a `RuntimeError: unreachable` with no `rvt-rs wasm panic:` line on
-  `console.error` before it, or a panic or engine message that names an
-  allocation (`capacity overflow`, `memory allocation of N bytes failed`, `Array
-  buffer allocation failed`). Any other panic is a bug and keeps its message.
-  It reports the wasm memory the instance had reached and the stage it was in;
-  the page says the model is too large for the browser, how far it got, that
-  a tab holds at most 4 GiB and an open takes about ten times the file, and that
-  `rvt-ifc --large-model`, `rvt-gltf` and the Python package open models of any
-  size. A tab the browser kills outright sends nothing; the page shows an error
-  for a worker that stops.
+  a `RuntimeError` of the trap with no `rvt-rs wasm panic:` line on
+  `console.error` before it (`unreachable` in V8, `unreachable executed` in
+  Firefox, `Unreachable code should not be executed` in Safari, matched as
+  `/unreach/i`), or a panic or engine message that names an allocation
+  (`capacity overflow`, `memory allocation of N bytes failed`, `Array buffer
+  allocation failed`). Any other panic is a bug, and the page shows the panic's
+  own message and nothing about memory. The worker reports the wasm memory the
+  instance had reached, the decoder's last report (so a stop in the stretch it
+  reports nothing in says "building the model") or, once the open call has
+  returned, the worker step it was in, and the engine's own message, which the
+  status panel shows as "Engine message". The worker is ended afterwards.
+- **What the page says of a memory stop** depends on how far the instance got.
+  When it reached half the ceiling, or the file's estimate passes the ceiling,
+  the page says "Too large for the browser": how far it got, that a tab holds at
+  most 4 GiB and an open has taken at least about ten times the file, and what
+  reads a larger file as the code takes it: `rvt-ifc` and `rvt-gltf` with
+  `--large-model` (streams up to 2 GiB, inflating up to 8 GiB, on a machine with
+  the memory), and the Python `RevitFile` with a larger `max_stream_bytes` and
+  `max_inflate_bytes`, which has no `--large-model` preset. When the instance
+  stopped a long way short of the ceiling on a file whose estimate fits, such as
+  a damaged file tripping `capacity overflow` at 60 MiB, a claim that the file
+  needs more memory would be one nothing measured, so the page says "Ran out of
+  memory", that the file may be damaged or may have hit a limit other than the
+  browser's memory, and that running the CLI on it tells which. A tab the
+  browser kills outright sends nothing; the page shows an error for a worker
+  that stops.
 
 The pre-check's figure is measured, not assumed. Deploy viewer's
 `tests/saved-meshes-measure.spec.ts` opens each reference model in a fresh
@@ -352,17 +369,18 @@ before it):
 | Revit_IFC5_Einhoven | 0.9 | 23 | 27 | 9 | 0.37 |
 
 The estimate is under the peak on every model (0.37 to 0.99), tightest on the
-largest, because fixed costs weigh more on a small file. That is the direction
-the warning needs: it says "may not fit" only where even the lowest multiple
-measured, 10, passes the ceiling. The
-multiple falls as files grow, and no model past 32 MiB is in CI. Two
-client models in #1075 are the only larger evidence, and from outside the
-browser: native peaks of 3.7 GB for a 438 MB file (8.4 times, with the stream and
-inflate limits raised) and 5.1 GB for a 1.13 GB file (4.5 times). Both are
-past 4 GiB once wasm's second copy of the file is added, and both are warned
-about (10 times 438 MB is 4.1 GiB); a model of several hundred MiB can sit near
-the line, which is why the estimate warns and the stop is the verdict. The
-size of the file is the basis because the sizes the reader knows before
+largest, because fixed costs weigh more on a small file; "at least about ten
+times" is the lowest multiple measured, and it is the largest model's. The
+multiple falls as files grow (27 times down to 10 across these six), no model
+past 32 MiB is in CI, and the only larger evidence goes the other way: native
+peaks of 3.7 GB for a 438 MB file (8.4 times, with the stream and inflate limits
+raised) and 5.1 GB for a 1.13 GB file (4.5 times), both from #1075 and from
+outside the browser. So the estimate under-counts every small model and may
+over-count a large one: a 438 MB file is warned about (10 times is 4.1 GiB)
+though 8.4 times is 3.4 GiB, and may fit once wasm's second copy of the file is
+added (0.4 GiB more). The warning can therefore fire on a file that fits, which
+is why it is a warning, and the stop is the verdict. The size of the file is the
+basis because the sizes the reader knows before
 inflating add nothing to it: a partition's stored size is nearly all of the
 file (the largest stream is 96% of the 438 MB file and 98% of the 1.13 GB
 one in #1075), and the inflated size is not stored (Revit's truncated gzip has
diff --git a/viewer/README.md b/viewer/README.md
index 2986381ea..368eac4c2 100644
--- a/viewer/README.md
+++ b/viewer/README.md
@@ -94,21 +94,30 @@ inflated member). When a stream is over them, File status reports "Part of the
 file not read" and offers "Retry with large-model limits", which reads the same
 file again with the limits `rvt-ifc --large-model` uses (streams up to 2 GiB).
 A browser tab can use at most 4 GiB of memory, so a very large model can still
-fail to open; `rvt-ifc --large-model` has no such ceiling. The button calls
+fail to open; `rvt-ifc --large-model` is not held to a tab's 4 GiB (its caps are
+a 2 GiB stream and 8 GiB inflated, on a machine with the memory). The button calls
 `openRvtBytesWithDiagnosticsModeAndOpenLimits` with `{ largeModel: true }`.
 
-A file whose size says it may need more than a tab's 4 GiB (an open takes about
-ten times the file's size) is warned about in the loading card before the
-decode, and still tried. When the wasm instance does run out of memory, the
-viewer says the model is too large for the browser, how much memory the tab
-reached, and that `rvt-ifc`, `rvt-gltf` and the Python package open it, instead
-of `RuntimeError: unreachable`. How it tells, the measured estimate and the
-options for larger models are in
+A file whose size says it may need more than a tab's 4 GiB (an open has taken
+at least about ten times the file's size, and the warning can fire on a file
+that fits) is warned about in the loading card before the decode, and still
+tried. When the wasm instance does run out of memory, the viewer says the model
+is too large for the browser, how much memory the tab reached, and what reads a
+larger file (`rvt-ifc` and `rvt-gltf` with `--large-model`; the Python
+`RevitFile` with a larger `max_stream_bytes` and `max_inflate_bytes`), instead of
+`RuntimeError: unreachable`; the engine's own message is in the status panel.
+A stop a long way short of the ceiling on a small file says "Ran out of memory"
+and that the file may be damaged, since nothing measured says it needs more. How
+it tells, the measured estimate and the options for larger models are in
 [`docs/viewer-api.md`](../docs/viewer-api.md#models-too-large-for-the-browser).
 `?memoryCeilingBytes=` in the address lowers the ceiling the warning compares
-with. `tests/memory-ceiling.spec.ts` uses it with a Chromium whose V8 caps wasm
-memory at 16 MiB (`--js-flags=--wasm-max-mem-pages=256`), where Einhoven really
-stops, because no model of several hundred MiB is in CI.
+with. `tests/memory-ceiling.spec.ts` uses it for the warning, and
+`tests/memory-ceiling-capped.spec.ts` for the stop, in a Chromium whose V8 caps
+wasm memory (`--js-flags=--wasm-max-mem-pages=256` is 16 MiB), where Einhoven
+really stops, because no model of several hundred MiB is in CI.
+`tests/worker-failures.spec.ts` covers the other engines' wording of the trap, a
+panic that is not memory, and a stop after the open call, by failing one wasm
+export in a replacement worker; nothing in it ships.
 
 `?maxStreamBytes=` and `?maxInflateBytes=` in the address open the first file
 under those limits, so a small file reaches the same path. The browser test
diff --git a/viewer/src/main.ts b/viewer/src/main.ts
index 759c0ebd2..f2813652b 100644
--- a/viewer/src/main.ts
+++ b/viewer/src/main.ts
@@ -448,12 +448,13 @@ function loadExpectation(bytes: number): string {
 const WASM32_CEILING_BYTES = 4 * 2 ** 30;
 
 /**
- * The memory an open takes, per byte of the file, as the figure to warn with:
+ * The multiple of its file's size an open has been measured to take at least:
  * Core Interior, the largest reference model (32 MiB), peaks at 324 MiB, 10.1
- * times, and the smaller ones need 13 to 25 times (#1150, and the estimate
- * columns of tests/saved-meshes-measure.spec.ts). Models of hundreds of MiB
- * have been seen to need less per byte natively (#1075), so this is the floor
- * of what was measured, not a promise of what a large model takes.
+ * times, and the smaller ones 13 to 27 times (#1150, and the estimate columns
+ * of tests/saved-meshes-measure.spec.ts). The multiple falls as files grow,
+ * and the only larger evidence, native runs on two client models (#1075), is
+ * 8.4 and 4.5 times, so for a file of hundreds of MiB 10 times can be too
+ * much: the warning can fire on a file that fits, and the stop is the verdict.
  */
 const PEAK_MEMORY_PER_FILE_BYTE = 10;
 
@@ -466,7 +467,7 @@ function estimatePeakBytes(fileBytes: number): number {
   return fileBytes * PEAK_MEMORY_PER_FILE_BYTE;
 }
 
-/** Memory in the binary units the 4 GiB ceiling is spoken in. */
+/** Memory and file sizes in the binary units the 4 GiB ceiling is spoken in. */
 function formatMemory(bytes: number): string {
   const trim = (value: number): number => Number(value.toFixed(1));
   if (bytes >= 2 ** 30) return `${trim(bytes / 2 ** 30)} GiB`;
@@ -474,6 +475,18 @@ function formatMemory(bytes: number): string {
   return `${trim(bytes / 2 ** 10)} KiB`;
 }
 
+/**
+ * What reads a file the browser cannot, as the command line and the Python
+ * package really take it: `--large-model` on rvt-ifc and rvt-gltf reads streams
+ * up to 2 GiB and inflates up to 8 GiB (`rvt::cli::open_limits`), and Python's
+ * `RevitFile` has no such preset, only `max_stream_bytes` and
+ * `max_inflate_bytes` to raise. Neither is unlimited, and both need a machine
+ * with the memory.
+ */
+const LARGER_FILE_ADVICE =
+  'rvt-ifc and rvt-gltf with --large-model read streams up to 2 GiB and inflate up to 8 GiB, on a machine with the memory, ' +
+  'and the Python package opens a file with a larger max_stream_bytes and max_inflate_bytes.';
+
 /** The decoder's stages (`rvt::control::Stage`) as the card names them, and how it counts each. */
 const DECODE_STAGES: Record<string, { label: string; count: (done: number, total: number) => string }> = {
   'schema-parse': { label: 'Reading the schema', count: () => '' },
@@ -507,6 +520,25 @@ const AFTER_STAGE: Record<string, string> = {
   'saved-meshes': 'Finishing the model',
 };
 
+/**
+ * What the card says for a decoder report, and whether it has a count to fill
+ * the bar with. A stage that has ended and has something after it names that
+ * instead, and sweeps. The failure message names the same thing, so a stop in
+ * the silent stretch says it was building the model.
+ */
+function stageStep(
+  stage: string,
+  done: number,
+  total: number | null,
+): { label: string; counted: boolean } {
+  const finished = total !== null && done >= total;
+  const after = finished ? AFTER_STAGE[stage] : undefined;
+  return {
+    label: after ?? DECODE_STAGES[stage]?.label ?? stage,
+    counted: !after && total !== null && total > 1,
+  };
+}
+
 /** One thing the worker told the card, with the milliseconds since the open began. */
 interface LoadEvent {
   t: number;
@@ -516,6 +548,8 @@ interface LoadEvent {
   /** The wasm linear memory at that moment. */
   memoryBytes?: number;
   step?: string;
+  /** What the card showed once it had applied this report: tests read it instead of sampling the page. */
+  card?: { step: string; value: number | null; hint: string };
 }
 
 let loadStartedAt = 0;
@@ -524,8 +558,17 @@ let loadExpectationText = '';
 let loadTimer: number | null = null;
 let loadEvents: LoadEvent[] = [];
 let loadStage: string | null = null;
+/** The last thing said on #status, a live region, so each is said once. */
+let loadAnnounced = '';
 let loadMemoryWarned = false;
 
+/** Says `text` on #status unless it was the last thing said. */
+function announceLoad(text: string): void {
+  if (text === loadAnnounced) return;
+  loadAnnounced = text;
+  setStatus(text);
+}
+
 /** A determinate bar at `fraction`, or the indeterminate sweep for null. */
 function setLoadFraction(fraction: number | null): void {
   if (fraction === null) {
@@ -546,20 +589,28 @@ function setLoadFraction(fraction: number | null): void {
  * then 1 of 1 has none), and sweeps otherwise.
  */
 function onDecodeStage(stage: string, done: number, total: number | null, memoryBytes: number): void {
-  loadEvents.push({ t: Math.round(performance.now() - loadStartedAt), stage, done, total, memoryBytes });
+  const { label, counted } = stageStep(stage, done, total);
   const info = DECODE_STAGES[stage];
-  const finished = total !== null && done >= total;
-  const after = finished ? AFTER_STAGE[stage] : undefined;
-  const step = after ?? info?.label ?? stage;
-  const counted = !after && total !== null && total > 1;
-  setLoadStep(step);
-  setLoadFraction(counted ? done / total : null);
+  setLoadStep(label);
+  setLoadFraction(counted && total !== null ? done / total : null);
   loadHintEl.textContent =
-    counted && info
+    counted && info && total !== null
       ? [`${Math.round((done / total) * 100)}%`, info.count(done, total)].filter(Boolean).join(' · ')
       : '';
-  // #status is a live region: say a stage once, not each percent of it.
-  if (stage !== loadStage || after) setStatus(step);
+  const value = loadRailEl.getAttribute('aria-valuenow');
+  loadEvents.push({
+    t: Math.round(performance.now() - loadStartedAt),
+    stage,
+    done,
+    total,
+    memoryBytes,
+    card: {
+      step: loadStepEl.textContent ?? '',
+      value: value === null ? null : Number(value),
+      hint: loadHintEl.textContent ?? '',
+    },
+  });
+  announceLoad(label);
   loadStage = stage;
 }
 
@@ -579,10 +630,10 @@ function showMemoryWarning(file: File): void {
   loadWarningEl.classList.toggle('hidden', !loadMemoryWarned);
   if (!loadMemoryWarned) return;
   loadWarningEl.textContent =
-    `This file may be too large for the browser. Opening a file takes about ${PEAK_MEMORY_PER_FILE_BYTE} times its size in memory ` +
-    `(measured on the largest reference model), so about ${formatMemory(estimate)} for ${formatMemory(file.size)}, ` +
-    `past the ${formatMemory(memoryCeilingBytes)} a browser tab can hold. It is tried anyway; ` +
-    'rvt-ifc and rvt-gltf open models of any size.';
+    `This file may be too large for the browser. An open has taken at least about ${PEAK_MEMORY_PER_FILE_BYTE} times its file's size in memory ` +
+    `(the largest reference model took 10 times, smaller ones up to 27), so about ${formatMemory(estimate)} for ${formatMemory(file.size)}, ` +
+    `past the ${formatMemory(memoryCeilingBytes)} a browser tab can hold. Larger files may take less per byte, so it is tried anyway. ` +
+    'rvt-ifc and rvt-gltf with --large-model can read a larger one.';
   toast(`${file.name} may be too large for the browser. Trying anyway.`, 'info');
 }
 
@@ -590,6 +641,7 @@ function startLoadOverlay(file: File): void {
   loadStartedAt = performance.now();
   loadEvents = [];
   loadStage = null;
+  loadAnnounced = '';
   delete statusEl.dataset.loadProgress;
   setLoadFraction(null);
   loadStepEl.textContent = `Opening ${file.name}`;
@@ -692,8 +744,13 @@ type Worker_ = Worker & {
   postMessage: (data: unknown, transfer?: Transferable[]) => void;
 };
 let worker: Worker_ | null = null;
-function resetWorker(): Worker_ {
+/** Ends the worker, and with it the wasm instance and the memory it held. */
+function stopWorker(): void {
   if (worker) worker.terminate();
+  worker = null;
+}
+function resetWorker(): Worker_ {
+  stopWorker();
   const w = new Worker(new URL('./worker.ts', import.meta.url), {
     type: 'module',
   }) as Worker_;
@@ -961,7 +1018,11 @@ let currentOpenLimits: OpenLimitsOptions | undefined;
 /** What the worker knew when a decode stopped for want of memory (worker.ts). */
 interface TooLarge {
   wasmMemoryBytes: number;
-  stage: string | null;
+  /** The decoder's last report inside the open call, or null outside it. */
+  report: { stage: string; done: number; total: number | null } | null;
+  /** The worker step it was in, or null inside the open call. */
+  step: string | null;
+  /** The engine's own message, or the panic's. */
   detail: string;
 }
 
@@ -1025,9 +1086,10 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
     // A file the tab has no memory to hold is the same failure as one the
     // decoder has no memory to open.
     if (/allocation failed|out of memory|invalid array length/i.test(message)) {
-      showTooLarge(file, { wasmMemoryBytes: 0, stage: null, detail: message });
+      showTooLarge(file, { wasmMemoryBytes: 0, report: null, step: null, detail: message });
       return;
     }
+    stopWorker();
     stopLoadOverlay();
     clearDemoCardBusy();
     setStatus(`Error: ${message}`);
@@ -1090,14 +1152,18 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
       return;
     }
     if (msg.type === 'progress') {
-      loadEvents.push({ t: Math.round(performance.now() - loadStartedAt), step: msg.step });
       // The steps after the decode count nothing, so the bar sweeps again.
       setLoadFraction(null);
       // The estimate is for before the decoder has said anything; once it has,
       // a step with no count has none to give.
       loadHintEl.textContent = loadStage === null ? loadExpectationText : '';
-      setStatus(msg.step);
       setLoadStep(msg.step);
+      loadEvents.push({
+        t: Math.round(performance.now() - loadStartedAt),
+        step: msg.step,
+        card: { step: msg.step, value: null, hint: loadHintEl.textContent },
+      });
+      announceLoad(msg.step);
       return;
     }
     if (msg.type === 'summary') {
@@ -1181,6 +1247,7 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
 
 /** The card, the status line, the panel and a toast for a file that did not open. */
 function failLoad(file: File, detail: string): void {
+  stopWorker();
   stopLoadOverlay();
   clearDemoCardBusy();
   saveLoadEvents();
@@ -1192,40 +1259,81 @@ function failLoad(file: File, detail: string): void {
   toast(`Could not open ${file.name}. ${detail}`, 'bad');
 }
 
+/** The worker's own steps, as a stop is blamed on them. */
+const WORKER_STEP_PHRASES: Record<string, string> = {
+  'Building scene graph': 'building the scene graph',
+  'Rendering glTF': 'rendering the glTF',
+  'Building schedule': 'building the schedule',
+};
+
+/** Where a stop was, as "reading partition streams" or "building the model", or null when unknown. */
+function stopPhrase(tooLarge: TooLarge): string | null {
+  if (tooLarge.report) {
+    const { stage, done, total } = tooLarge.report;
+    const label = stageStep(stage, done, total).label;
+    return `${label.charAt(0).toLowerCase()}${label.slice(1)}`;
+  }
+  return tooLarge.step ? (WORKER_STEP_PHRASES[tooLarge.step] ?? null) : null;
+}
+
 /**
  * The decode stopped for want of memory (#1195): wasm32 holds at most 4 GiB,
- * and a failed allocation ends the instance with a bare `unreachable`. Says
- * that plainly, with how far it got, and what opens a model of any size.
+ * and a failed allocation ends the instance with a bare `unreachable`. When
+ * the stop was near what a tab can hold, or the file is big enough that the
+ * pre-check would have warned, this says plainly that the model is too large
+ * for the browser. Otherwise a stop a long way short of the ceiling on a small
+ * file may be a damaged file rather than a large one, and says so, since
+ * "needs more memory" would be a claim nothing measured.
  */
 function showTooLarge(file: File, tooLarge: TooLarge): void {
   const reached = formatMemory(tooLarge.wasmMemoryBytes);
-  const stage = tooLarge.stage ? DECODE_STAGES[tooLarge.stage]?.label.toLowerCase() : undefined;
-  const where = stage ? `, while ${stage},` : '';
-  const summary =
-    tooLarge.wasmMemoryBytes > 0
-      ? `The browser would not give this tab more than ${reached}${where} and ${file.name} (${formatBytes(file.size)}) needs more.`
-      : `The browser did not have the memory to read ${file.name} (${formatBytes(file.size)}).`;
-  const advice =
-    `A browser tab can hold at most ${formatMemory(memoryCeilingBytes)}, and opening a file takes about ${PEAK_MEMORY_PER_FILE_BYTE} times its size. ` +
-    'The command-line tools read models of any size: rvt-ifc with --large-model writes the IFC, rvt-gltf the glTF, and the Python package opens the same files.';
+  const size = formatMemory(file.size);
+  const ceiling = formatMemory(memoryCeilingBytes);
+  const where = stopPhrase(tooLarge);
+  const readFailed = tooLarge.wasmMemoryBytes === 0;
+  const firm =
+    readFailed ||
+    tooLarge.wasmMemoryBytes >= memoryCeilingBytes / 2 ||
+    estimatePeakBytes(file.size) >= memoryCeilingBytes;
+  const title = firm ? 'Too large for the browser' : 'Ran out of memory';
+  const stopped = readFailed ? '' : ` at ${reached}`;
+  let summary: string;
+  let advice: string;
+  if (readFailed) {
+    summary = `The browser did not have the memory to read ${file.name} (${size}).`;
+    advice = LARGER_FILE_ADVICE;
+  } else if (firm) {
+    summary = `The browser would not give this tab more than ${reached}${where ? `, while ${where},` : ''} and ${file.name} (${size}) needs more.`;
+    advice = `A browser tab can hold at most ${ceiling}, and an open has taken at least about ${PEAK_MEMORY_PER_FILE_BYTE} times its file's size. ${LARGER_FILE_ADVICE}`;
+  } else {
+    summary = `The decoder ran out of memory at ${reached}${where ? `, while ${where},` : ''}, a long way short of the ${ceiling} a tab can hold, on a ${size} file. The file may be damaged, or may have hit a limit other than the browser's memory, so this is not reported as too large.`;
+    advice =
+      'Running rvt-ifc or rvt-gltf on the same file (with --large-model if it is large) shows whether it is damaged or only large.';
+  }
+  stopWorker();
   stopLoadOverlay();
   clearDemoCardBusy();
   saveLoadEvents();
-  statusEl.dataset.loadFailure = 'too-large';
-  const stopped = tooLarge.wasmMemoryBytes > 0 ? ` at ${reached}` : '';
-  setStatus(`Too large for the browser${stopped ? ` · stopped${stopped}` : ''}`);
+  statusEl.dataset.loadFailure = firm ? 'too-large' : 'out-of-memory';
+  setStatus(`${title}${stopped ? ` · stopped${stopped}` : ''}`);
   renderErrorStatusPanel(
     summary,
-    'Too large for the browser',
+    title,
     `Not decoded · the tab ran out of memory${stopped}`,
+    tooLarge.detail,
   );
-  scaffoldNoteTitleEl.textContent = 'Too large for the browser';
+  scaffoldNoteTitleEl.textContent = title;
   scaffoldNoteBodyEl.textContent = `${summary} ${advice}`;
   scaffoldNoteEl.classList.add('is-failure');
   scaffoldNoteEl.classList.remove('hidden');
   setDropzoneVisible(true);
   setExportHint('Open a file to export');
-  toast(`${file.name} is too large for the browser. rvt-ifc and rvt-gltf can open it.`, 'bad');
+  toast(
+    firm
+      ? `${file.name} is too large for the browser. rvt-ifc and rvt-gltf with --large-model can read a larger one.`
+      : `${file.name}: the decoder ran out of memory, a long way short of the browser's limit.`,
+    'bad',
+  );
 }
 
 function renderEmptyStatusPanel(): void {
@@ -1261,6 +1369,7 @@ function renderErrorStatusPanel(
   message: string,
   fileText = 'Could not open file',
   modeText = 'Corrupt or unreadable file · not a readable Revit OLE/CFB container',
+  engineMessage?: string,
 ): void {
   statusPanelEl.innerHTML = '';
   resetStatusRowStagger();
@@ -1273,6 +1382,7 @@ function renderErrorStatusPanel(
   statusPanelEl.appendChild(statusRow('Export', 'bad', 'Export confidence unavailable'));
   statusPanelEl.appendChild(statusRow('IFC bar', 'warn', `Selected · ${selectedExportMode()}`));
   statusPanelEl.appendChild(statusRow('Warnings', 'bad', message));
+  if (engineMessage) statusPanelEl.appendChild(statusRow('Engine message', 'bad', engineMessage));
   diagnosticsJsonEl.textContent = '';
 }
 
diff --git a/viewer/src/styles.css b/viewer/src/styles.css
index a85717704..ea7103f11 100644
--- a/viewer/src/styles.css
+++ b/viewer/src/styles.css
@@ -961,6 +961,16 @@ header .export-hint[hidden] {
 #scaffold-note.is-failure {
   z-index: 11;
 }
+/* A failure is red, as its toast is; the note's amber is for a file that opened
+   with nothing to draw. */
+#scaffold-note.is-failure .note-card {
+  background:
+    linear-gradient(var(--sx-color-danger-light), var(--sx-color-danger-light)),
+    var(--sx-color-surface);
+}
+#scaffold-note.is-failure .note-title {
+  color: var(--sx-color-danger);
+}
 .note-card {
   width: min(460px, 86%);
   padding: var(--sx-space-sm) var(--sx-space-md);
diff --git a/viewer/src/worker.ts b/viewer/src/worker.ts
index 8b46e8e97..fc5f7df70 100644
--- a/viewer/src/worker.ts
+++ b/viewer/src/worker.ts
@@ -30,7 +30,9 @@
  *   worker → main: { type: 'error', message: string, tooLarge?: TooLarge }
  *                  `tooLarge` is set when the failure is the wasm instance
  *                  running out of memory (see `outOfMemory`), with what the
- *                  worker knew when it stopped.
+ *                  worker knew when it stopped: the wasm memory reached, the
+ *                  last decoder report (or null once the open call returned),
+ *                  the worker step it was in, and the engine's own message.
  */
 
 import init, {
@@ -52,13 +54,22 @@ interface OpenLimitsOptions {
   savedMeshes?: boolean;
 }
 
+/** The decoder's last report before a stop. */
+interface StageReport {
+  stage: string;
+  done: number;
+  total: number | null;
+}
+
 /** What the worker reports when a decode stops for want of memory. */
 interface TooLarge {
   /** The wasm linear memory when it stopped: how far the decode got. */
   wasmMemoryBytes: number;
-  /** The decoder stage it was in, or null before the first report. */
-  stage: string | null;
-  /** The raw message of the failure, for the diagnostics. */
+  /** The decoder's last report inside the open call, or null outside it. */
+  report: StageReport | null;
+  /** The worker step it was in when it stopped, or null inside the open call. */
+  step: string | null;
+  /** The engine's own message (the panic's, when there was one), shown in the status panel. */
   detail: string;
 }
 
@@ -74,7 +85,8 @@ let parsedModel: unknown = null;
 // `console.error` before the trap. A trap with none of those first is not a
 // panic: an allocation the wasm memory could not grow to hold aborts the
 // instance without running the hook, and reaches here as a bare
-// `RuntimeError: unreachable`.
+// `RuntimeError: unreachable` (V8), `unreachable executed` (Firefox) or
+// `Unreachable code should not be executed` (Safari).
 const PANIC_PREFIX = 'rvt-rs wasm panic:';
 let lastPanic: string | null = null;
 const nativeConsoleError = console.error.bind(console);
@@ -99,7 +111,7 @@ function outOfMemory(err: unknown, panic: string | null): boolean {
   const message = err instanceof Error ? err.message : String(err);
   if (panic !== null) return OUT_OF_MEMORY_MESSAGE.test(panic);
   if (err instanceof WebAssembly.RuntimeError) {
-    return message === 'unreachable' || OUT_OF_MEMORY_MESSAGE.test(message);
+    return /unreach/i.test(message) || OUT_OF_MEMORY_MESSAGE.test(message);
   }
   return OUT_OF_MEMORY_MESSAGE.test(message) && !(err instanceof TypeError);
 }
@@ -133,19 +145,24 @@ self.addEventListener('message', async (ev: MessageEvent<ParseMsg>) => {
   if (msg.type !== 'parse') return;
 
   let wasmMemory: WebAssembly.Memory | null = null;
-  let currentStage: string | null = null;
+  let report: StageReport | null = null;
+  let currentStep: string | null = null;
+  // A step the page is told about, and the one a stop is then blamed on.
+  const step = (text: string): void => {
+    currentStep = text;
+    send({ type: 'progress', step: text });
+  };
   try {
-    send({ type: 'progress', step: 'Initializing wasm' });
+    step('Initializing wasm');
     const startedAt = performance.now();
     const wasm = await init();
     wasmMemory = wasm.memory;
-    lastPanic = null;
 
     // VW1-20 — progressive streaming. Emit the cheap metadata
     // first (sub-second even on hundreds-of-MB files) so the UI
     // can populate the top bar while the expensive full-model
     // parse continues.
-    send({ type: 'progress', step: 'Reading file metadata' });
+    step('Reading file metadata');
     // Worksharing / last-saved identity is a nicety: a file whose
     // BasicFileInfo text block is unreadable still parses.
     let document: unknown = null;
@@ -153,21 +170,23 @@ self.addEventListener('message', async (ev: MessageEvent<ParseMsg>) => {
       document = fileMetadata(msg.bytes);
     } catch {
       document = null;
+      // A panic this swallowed is not the one a later stop is judged by.
+      lastPanic = null;
     }
     send({ type: 'summary', summary: quickSummary(msg.bytes), document });
 
     const qualityMode = (msg.mode ?? 'scaffold').trim() || 'scaffold';
     const limitsNote = msg.limits?.largeModel ? ' · large-model limits' : '';
     const meshesNote = msg.limits?.savedMeshes === false ? ' · door and window boxes' : '';
-    send({
-      type: 'progress',
-      step: `Parsing container · IFC bar ${qualityMode}${limitsNote}${meshesNote}`,
-    });
+    step(`Parsing container · IFC bar ${qualityMode}${limitsNote}${meshesNote}`);
     const openStartedAt = performance.now();
     const onStage = (stage: string, done: number, total: number | null): void => {
-      currentStage = stage;
+      report = { stage, done, total };
+      currentStep = null;
       send({ type: 'stage', stage, done, total, wasmMemoryBytes: wasm.memory.buffer.byteLength });
     };
+    // Only a panic from the open call itself bears on how it stopped.
+    lastPanic = null;
     const exportResult = openRvtBytesWithDiagnosticsModeAndOpenLimits(
       msg.bytes,
       qualityMode,
@@ -178,17 +197,19 @@ self.addEventListener('message', async (ev: MessageEvent<ParseMsg>) => {
       diagnostics: unknown;
     };
     const openMs = performance.now() - openStartedAt;
+    // The open call is over: a stop after it is in the worker's own steps.
+    report = null;
     const model = exportResult.model;
     parsedModel = model;
 
-    send({ type: 'progress', step: 'Building scene graph' });
+    step('Building scene graph');
     const scene = buildSceneGraph(model);
     const types = distinctIfcTypes(scene);
 
-    send({ type: 'progress', step: 'Rendering glTF' });
+    step('Rendering glTF');
     const glb = modelToGlb(model);
 
-    send({ type: 'progress', step: 'Building schedule' });
+    step('Building schedule');
     const schedule = buildSchedule(model);
 
     // Read last, so the memory is what the whole pipeline needed.
@@ -219,12 +240,15 @@ self.addEventListener('message', async (ev: MessageEvent<ParseMsg>) => {
     if (outOfMemory(err, lastPanic)) {
       const tooLarge: TooLarge = {
         wasmMemoryBytes: wasmMemory?.buffer.byteLength ?? 0,
-        stage: currentStage,
-        detail: lastPanic ?? message,
+        report,
+        step: report ? null : currentStep,
+        detail: lastPanic ?? (err instanceof Error ? `${err.name}: ${err.message}` : message),
       };
       send({ type: 'error', message, tooLarge });
       return;
     }
-    send({ type: 'error', message });
+    // A panic's text is on console.error, and the trap carries only
+    // `unreachable`: say the panic's, which is the failure's own message.
+    send({ type: 'error', message: lastPanic ?? message });
   }
 });
diff --git a/viewer/tests/load-progress.spec.ts b/viewer/tests/load-progress.spec.ts
index 3c889c589..754dbae72 100644
--- a/viewer/tests/load-progress.spec.ts
+++ b/viewer/tests/load-progress.spec.ts
@@ -6,15 +6,20 @@ import { fileURLToPath } from 'node:url';
 // #1195: while a model decodes, the loading card shows the decoder's own
 // progress (the stages `rvt-gltf --progress` prints) instead of a sweep and a
 // guess from the file size. The worker posts each report from inside the wasm
-// call, so the page sees them while the decode runs; the page keeps the whole
-// list on #status as `data-load-progress`.
+// call, so the page sees them while the decode runs. The page keeps every
+// report on #status as `data-load-progress`, with what the card showed once it
+// had applied that report (its step, the bar's value, its hint), so these
+// tests read the card's behaviour from that record rather than sampling the
+// page, which a decode 3 s into its partition stage would make a coin flip:
 //
-//   - on the tier-1 fixture, which opens in milliseconds, the list is checked:
-//     the stages, their counts, and the steps after the decode;
-//   - on Core Interior (24 s on Deploy viewer's runner), the card itself is
-//     watched while it loads: the bar must turn determinate and fill, and the
-//     card must name the stages. A screenshot of the bar part-way and the
-//     samples go to measurements/, which Deploy viewer uploads.
+//   - on the tier-1 fixture, which opens in milliseconds: the stages, their
+//     counts and the steps after the decode;
+//   - on Core Interior (17 to 24 s on Deploy viewer's runner): the bar is
+//     determinate for the counted stage at the percent of each report, sweeps
+//     for the stretch the decoder reports nothing in, and says "Building the
+//     model" once. A screenshot is taken while the partition stage runs, and it
+//     is the only thing that depends on timing, so it is best effort: what it
+//     shows is written beside it.
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const tier1 = path.resolve(
@@ -44,6 +49,7 @@ interface LoadEvent {
   total?: number | null;
   memoryBytes?: number;
   step?: string;
+  card?: { step: string; value: number | null; hint: string };
 }
 
 async function loadEvents(page: Page): Promise<LoadEvent[]> {
@@ -52,6 +58,35 @@ async function loadEvents(page: Page): Promise<LoadEvent[]> {
   return JSON.parse(raw!) as LoadEvent[];
 }
 
+/** Records every text #status takes, so what a live region was told can be counted. */
+async function logStatusText(page: Page): Promise<void> {
+  await page.evaluate(() => {
+    const status = document.getElementById('status')!;
+    const log: string[] = [];
+    (window as unknown as { __statusLog: string[] }).__statusLog = log;
+    new MutationObserver(() => log.push(status.textContent ?? '')).observe(status, {
+      childList: true,
+      characterData: true,
+      subtree: true,
+    });
+  });
+}
+
+async function statusLog(page: Page): Promise<string[]> {
+  return page.evaluate(() => (window as unknown as { __statusLog: string[] }).__statusLog);
+}
+
+/** A report with a count the bar is a fraction of: a total above one, not yet reached. */
+function isCounted(event: LoadEvent): boolean {
+  return (
+    event.stage !== undefined &&
+    event.total !== null &&
+    event.total !== undefined &&
+    event.total > 1 &&
+    event.done! < event.total
+  );
+}
+
 test('the decoder reports its stages to the page, and the steps after it follow', async ({
   page,
 }) => {
@@ -75,6 +110,7 @@ test('the decoder reports its stages to the page, and the steps after it follow'
       );
     }
     expect(event.memoryBytes, 'the wasm memory at that moment').toBeGreaterThan(0);
+    expect(event.card, 'the card applied it').toBeDefined();
   }
   // Within a stage the count only grows until the stage starts over.
   let previous: LoadEvent | null = null;
@@ -115,70 +151,99 @@ coreInteriorTest('the loading card fills while Core Interior decodes', async ({
 
   await page.goto('/');
   await expect(page.locator('#status')).toHaveText(/Ready/);
+  await logStatusText(page);
   await page.locator('#file-input').setInputFiles(coreInterior);
 
-  interface Sample {
-    t: number;
-    step: string;
-    hint: string;
-    determinate: boolean;
-    value: number | null;
-  }
-  const samples: Sample[] = [];
-  const started = Date.now();
-  let screenshot = false;
-  const deadline = started + 500_000;
-  for (;;) {
-    expect(Date.now(), 'Core Interior loads').toBeLessThan(deadline);
-    const loaded = await page.locator('#status').getAttribute('data-load-stats');
-    if (loaded !== null) break;
-    const sample = await page.evaluate(() => {
-      const rail = document.getElementById('load-rail')!;
-      const now = rail.getAttribute('aria-valuenow');
-      return {
-        step: document.getElementById('load-step')!.textContent ?? '',
-        hint: document.getElementById('load-hint')!.textContent ?? '',
-        determinate: rail.classList.contains('is-determinate'),
-        value: now === null ? null : Number(now),
-        visible: !document.getElementById('load-overlay')!.classList.contains('hidden'),
-      };
+  // The screenshot is the only thing here that depends on timing. Wait, polling
+  // every animation frame, for the bar to be a quarter full or more while the
+  // partition stage runs, and take it at once; a decode that is past that by
+  // the time the page looks, or a screenshot that lands after it, only means
+  // no picture, which is written down rather than failed on.
+  const screenshot: { taken: boolean; cardAtCapture: unknown; note: string } = {
+    taken: false,
+    cardAtCapture: null,
+    note: '',
+  };
+  try {
+    await page.waitForFunction(
+      () => Number(document.getElementById('load-rail')?.getAttribute('aria-valuenow')) >= 25,
+      null,
+      { polling: 'raf', timeout: 120_000 },
+    );
+    screenshot.cardAtCapture = await page.evaluate(() => ({
+      step: document.getElementById('load-step')?.textContent,
+      value: document.getElementById('load-rail')?.getAttribute('aria-valuenow'),
+      hint: document.getElementById('load-hint')?.textContent,
+    }));
+    await page.locator('#load-overlay').screenshot({
+      path: path.join(outDir, 'load-progress-core-interior.png'),
+      timeout: 10_000,
     });
-    if (sample.visible) {
-      samples.push({ ...sample, t: Date.now() - started });
-      if (!screenshot && sample.determinate && sample.value! >= 25 && sample.value! <= 75) {
-        await page.locator('#load-overlay').screenshot({
-          path: path.join(outDir, 'load-progress-core-interior.png'),
-        });
-        screenshot = true;
-      }
-    }
-    await page.waitForTimeout(200);
+    screenshot.taken = true;
+    screenshot.note =
+      'taken when the bar first read 25% or more; the card may have moved on while the picture was taken, so cardAtCapture is what the page said just before';
+  } catch (err) {
+    screenshot.note = `no screenshot: ${(err as Error).message.split('\n')[0]}`;
   }
-  await expect(page.locator('#status')).toHaveText(/Loaded/);
+
+  await expect(page.locator('#status')).toHaveText(/Loaded/, { timeout: 500_000 });
+  const events = await loadEvents(page);
   fs.writeFileSync(
     path.join(outDir, 'load-progress-core-interior.json'),
-    `${JSON.stringify({ samples, events: await loadEvents(page) }, null, 2)}\n`,
+    `${JSON.stringify({ screenshot, events }, null, 2)}\n`,
   );
 
-  // The card named the decoder's stages, not just "Opening".
-  const labels = new Set(samples.map((sample) => sample.step));
-  const stageLabels = [...labels].filter((label) =>
-    /^(Reading the schema|Scanning for elements|Decoding elements|Reading partition streams|Reading saved graphics|Drawing doors and windows from saved meshes|Building the model|Finishing the model)$/.test(
-      label,
-    ),
-  );
-  expect(stageLabels.length, `stages named on the card: ${[...labels].join(' | ')}`).toBeGreaterThanOrEqual(2);
+  // Every report the decoder made was applied by the card, and the bar says
+  // what the report said: the percent of its count where it has one, and a
+  // sweep where it has none or the stage has ended.
+  const reports = events.filter((event) => event.stage !== undefined);
+  expect(reports.length).toBeGreaterThan(0);
+  for (const event of reports) {
+    expect(event.card, `${event.stage} ${event.done}/${event.total} was applied`).toBeDefined();
+    if (isCounted(event)) {
+      expect(event.card!.value, `${event.stage} ${event.done}/${event.total}`).toBe(
+        Math.round((event.done! / event.total!) * 100),
+      );
+      expect(event.card!.hint).toMatch(/^\d+% · /);
+    } else {
+      expect(event.card!.value, `${event.stage} ${event.done}/${event.total} sweeps`).toBeNull();
+      expect(event.card!.hint).toBe('');
+    }
+  }
 
-  // The bar turned determinate, at more than one fill, and a fill was
-  // somewhere between empty and full.
-  const fills = new Set(samples.filter((s) => s.determinate).map((s) => s.value));
-  expect(fills.size, `fills seen: ${[...fills].join(', ')}`).toBeGreaterThanOrEqual(2);
+  // The partition stage is counted on this project: the bar was determinate at
+  // more than one value, rising within the stage, and the card named the stage
+  // and what it counted.
+  const counted = reports.filter(isCounted);
+  expect(counted.length, 'reports with a count').toBeGreaterThanOrEqual(2);
+  const values = counted.map((event) => event.card!.value!);
+  expect(new Set(values).size, `fills: ${values.join(', ')}`).toBeGreaterThanOrEqual(2);
+  for (const value of values) {
+    expect(value).toBeGreaterThanOrEqual(0);
+    expect(value).toBeLessThanOrEqual(100);
+  }
+  const partition = counted.filter((event) => event.stage === 'partition-scan');
+  expect(partition.length, 'the partition streams are counted').toBeGreaterThanOrEqual(2);
+  const rising = partition.map((event) => event.card!.value!);
+  expect([...rising].sort((a, b) => a - b), 'the partition bar rises').toEqual(rising);
   expect(
-    [...fills].some((value) => value !== null && value > 0 && value < 100),
-    'a part-way fill',
-  ).toBe(true);
-  // A determinate bar says what it counts.
-  const counted = samples.filter((s) => s.determinate && s.value! > 0 && s.value! < 100);
-  expect(counted.every((s) => /^\d+% · /.test(s.hint))).toBe(true);
-  expect(screenshot, 'a screenshot of the bar part-way').toBe(true);
+    new Set(rising).size,
+    `partition fills: ${rising.join(', ')}`,
+  ).toBeGreaterThanOrEqual(2);
+  for (const event of partition) {
+    expect(event.card!.step).toBe('Reading partition streams');
+    expect(event.card!.hint).toMatch(new RegExp(`^\\d+% · ${event.done} of ${event.total} streams$`));
+  }
+
+  // The stretch after the last stream is inflated reports nothing until the
+  // saved graphics. The card names it, and says so once: #status is a live
+  // region, and it was told "Building the model" a single time.
+  const building = reports.filter((event) => event.card!.step === 'Building the model');
+  expect(building.length, 'reports that left the card on Building the model').toBeGreaterThan(0);
+  for (const event of building) expect(event.card!.value).toBeNull();
+  const log = await statusLog(page);
+  expect(
+    log.filter((text) => text === 'Building the model'),
+    `status text: ${log.join(' | ')}`,
+  ).toHaveLength(1);
 });
diff --git a/viewer/tests/memory-ceiling-capped.spec.ts b/viewer/tests/memory-ceiling-capped.spec.ts
index 0f56f895a..2684f4f28 100644
--- a/viewer/tests/memory-ceiling-capped.spec.ts
+++ b/viewer/tests/memory-ceiling-capped.spec.ts
@@ -1,4 +1,4 @@
-import { expect, test } from '@playwright/test';
+import { chromium, expect, test, type Page } from '@playwright/test';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -6,76 +6,188 @@ import { fileURLToPath } from 'node:url';
 // #1195: the stop. wasm32 addresses at most 4 GiB, and a failed allocation ends
 // the wasm instance with a bare `RuntimeError: unreachable` and no panic
 // message. No model that large is in CI, so the ceiling is lowered instead of
-// the model raised, and the stop is real: this file runs in a Chromium whose
-// V8 caps wasm memory at 16 MiB (`--js-flags=--wasm-max-mem-pages=256`, 64 KiB
-// a page), where Einhoven's 23 MiB peak (saved-meshes-measure.spec.ts) cannot
-// be reached. The wasm, its allocator and the worker are the shipped ones;
-// only the ceiling is lower. `?memoryCeilingBytes=` tells the page what the
-// ceiling is, so its message names 16 MiB. The warning before the decode is
-// memory-ceiling.spec.ts. `test.use` with launch options has to be top level,
-// which is why this is a file of its own.
+// the model raised, and the stop is real: each test launches a Chromium whose
+// V8 caps wasm memory (`--js-flags=--wasm-max-mem-pages=N`, 64 KiB a page),
+// below what the model's open needs (saved-meshes-measure.spec.ts has the
+// peaks). The wasm, its allocator and the worker are the shipped ones; only the
+// ceiling is lower. `?memoryCeilingBytes=` tells the page what that ceiling is,
+// so its message names it; leaving it out tells the page the real 4 GiB, which
+// a stop at a few MiB is a long way short of. The warning before the decode is
+// memory-ceiling.spec.ts, and what the page does with failures the engine words
+// differently, or that are not memory, is worker-failures.spec.ts. Each test has
+// a browser of its own because the cap is a launch option.
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const einhoven = path.resolve(__dirname, '../../_project_corpus/Revit/Revit_IFC5_Einhoven.rvt');
+const corpus = path.resolve(__dirname, '../../_project_corpus/Revit');
+const einhoven = path.join(corpus, 'Revit_IFC5_Einhoven.rvt');
+const coreInterior = path.join(corpus, '2024_Core_Interior.rvt');
 const outDir = path.resolve(__dirname, '../measurements');
 // Deploy viewer fetches every model and sets this, so a model missing there
 // fails; elsewhere it is a skip.
 const required = process.env.RVT_VIEWER_REQUIRE_JOURNEYS === '1';
 
-const CAP_PAGES = 256;
-const CAP_BYTES = CAP_PAGES * 64 * 1024;
+const PAGE_BYTES = 64 * 1024;
+const MIB = 2 ** 20;
 
-test.use({ launchOptions: { args: [`--js-flags=--wasm-max-mem-pages=${CAP_PAGES}`] } });
-
-const modelTest = required || fs.existsSync(einhoven) ? test : test.skip;
-
-modelTest('a model past it is reported as too large, not as unreachable', async ({ page }) => {
-  expect(fs.existsSync(einhoven), `${einhoven} was not fetched`).toBe(true);
+/** Opens `file` in a Chromium capped at `pages` wasm pages, on the preview server, and runs `check`. */
+async function underCap(
+  baseURL: string | undefined,
+  pages: number,
+  query: string,
+  file: string,
+  check: (page: Page) => Promise<void>,
+): Promise<void> {
+  expect(fs.existsSync(file), `${file} was not fetched`).toBe(true);
   fs.mkdirSync(outDir, { recursive: true });
-  await page.goto(`/?memoryCeilingBytes=${CAP_BYTES}`);
-  await expect(page.locator('#status')).toHaveText(/Ready/);
-  await page.locator('#file-input').setInputFiles(einhoven);
+  const browser = await chromium.launch({
+    args: [`--js-flags=--wasm-max-mem-pages=${pages}`],
+  });
+  try {
+    const context = await browser.newContext({ baseURL });
+    const page = await context.newPage();
+    await page.goto(`/${query}`);
+    await expect(page.locator('#status')).toHaveText(/Ready/);
+    await page.locator('#file-input').setInputFiles(file);
+    await check(page);
+  } finally {
+    await browser.close();
+  }
+}
 
-  // The stop is named in the status line, and the page says so in the
-  // viewport, with what to use instead.
-  await expect(page.locator('#status')).toHaveAttribute('data-load-failure', 'too-large');
-  await expect(page.locator('#status')).toHaveText(/^Too large for the browser · stopped at /);
-  const note = page.locator('#scaffold-note');
-  await expect(note).toBeVisible();
-  // Visible to a person: the empty state the failure leaves behind is over
-  // the viewport too, and the note has to be above it.
-  const covered = await page.evaluate(() => {
+/** The note is what a person sees: the empty state under it is over the viewport too. */
+async function noteIsOnTop(page: Page): Promise<boolean> {
+  return page.evaluate(() => {
     const card = document.querySelector('#scaffold-note .note-card')!.getBoundingClientRect();
     const top = document.elementFromPoint(card.x + card.width / 2, card.y + card.height / 2);
-    return top?.closest('#scaffold-note') === null;
+    return top?.closest('#scaffold-note') !== null;
   });
-  expect(covered, 'the note is under the empty state').toBe(false);
-  await expect(note.locator('#scaffold-note-title')).toHaveText('Too large for the browser');
-  const body = note.locator('#scaffold-note-body');
-  await expect(body).toContainText('Revit_IFC5_Einhoven.rvt');
-  await expect(body).toContainText('would not give this tab more than');
-  await expect(body).toContainText('16 MiB');
-  await expect(body).toContainText('rvt-ifc');
-  await expect(body).toContainText('rvt-gltf');
-  await expect(body).toContainText('--large-model');
-  await expect(page.locator('#status-panel')).toContainText('Too large for the browser');
+}
 
-  // Nothing on the page shows the engine's message, and the loading card
-  // is gone.
-  await expect(page.locator('#load-overlay')).toBeHidden();
-  const text = await page.locator('body').innerText();
-  expect(text).not.toMatch(/unreachable|RuntimeError/);
-  await expect(page.locator('#dropzone')).toBeVisible();
-  await expect(page.locator('#export-ifc')).toBeDisabled();
+const einhovenTest = required || fs.existsSync(einhoven) ? test : test.skip;
 
-  // What the worker reported before it stopped is kept, with the memory at
-  // each report, which never passes the cap.
-  const events = JSON.parse(
-    (await page.locator('#status').getAttribute('data-load-progress')) ?? '[]',
-  ) as Array<{ stage?: string; memoryBytes?: number }>;
-  expect(events.length).toBeGreaterThan(0);
-  for (const event of events) {
-    if (event.memoryBytes !== undefined) expect(event.memoryBytes).toBeLessThanOrEqual(CAP_BYTES);
-  }
-  await page.locator('#viewport').screenshot({ path: path.join(outDir, 'too-large.png') });
-});
+einhovenTest(
+  'a model past the ceiling is reported as too large, not as unreachable',
+  async ({ baseURL }) => {
+    const capPages = 256;
+    const capBytes = capPages * PAGE_BYTES;
+    await underCap(
+      baseURL,
+      capPages,
+      `?memoryCeilingBytes=${capBytes}`,
+      einhoven,
+      async (page) => {
+        // The stop is named in the status line, and the page says so in the
+        // viewport, with what to use instead.
+        await expect(page.locator('#status')).toHaveAttribute('data-load-failure', 'too-large');
+        await expect(page.locator('#status')).toHaveText(/^Too large for the browser · stopped at /);
+        const note = page.locator('#scaffold-note');
+        await expect(note).toBeVisible();
+        expect(await noteIsOnTop(page), 'the note is under the empty state').toBe(true);
+        await expect(note.locator('#scaffold-note-title')).toHaveText('Too large for the browser');
+        const body = note.locator('#scaffold-note-body');
+        await expect(body).toContainText(/Revit_IFC5_Einhoven\.rvt \(\d+(\.\d)? KiB\)/);
+        await expect(body).toContainText('would not give this tab more than');
+        await expect(body).toContainText(/, while (reading partition streams|building the model),/);
+        await expect(body).toContainText('needs more');
+        await expect(body).toContainText('16 MiB');
+        // What reads a larger file, as the code takes it: --large-model on the
+        // two CLIs, and the two limits to raise in Python; not "any size".
+        await expect(body).toContainText('rvt-ifc and rvt-gltf with --large-model');
+        await expect(body).toContainText('max_stream_bytes and max_inflate_bytes');
+        await expect(body).not.toContainText(/any size/i);
+        await expect(page.locator('#status-panel')).toContainText('Too large for the browser');
+
+        // The engine's own message is in the status panel, where it can be
+        // read and reported, and nowhere a person reads first.
+        await expect(
+          page.locator('#status-panel .status-row', {
+            has: page.locator('.status-label', { hasText: /^Engine message$/ }),
+          }),
+        ).toContainText(/RuntimeError: unreachable/);
+        for (const where of ['#status', '#scaffold-note', '#toast-region']) {
+          expect(await page.locator(where).innerText(), where).not.toMatch(/unreachable|RuntimeError/);
+        }
+        await expect(page.locator('#toast-region .toast.bad')).toContainText('too large');
+
+        // The loading card is gone, nothing is left to export, and the worker
+        // that held the memory is ended.
+        await expect(page.locator('#load-overlay')).toBeHidden();
+        await expect(page.locator('#dropzone')).toBeVisible();
+        await expect(page.locator('#export-ifc')).toBeDisabled();
+        await expect.poll(() => page.workers().length, 'the worker is ended').toBe(0);
+
+        // What the worker reported before it stopped is kept, with the memory
+        // at each report, which never passes the cap.
+        const events = JSON.parse(
+          (await page.locator('#status').getAttribute('data-load-progress')) ?? '[]',
+        ) as Array<{ stage?: string; memoryBytes?: number }>;
+        expect(events.length).toBeGreaterThan(0);
+        for (const event of events) {
+          if (event.memoryBytes !== undefined) expect(event.memoryBytes).toBeLessThanOrEqual(capBytes);
+        }
+        await page.locator('#viewport').screenshot({ path: path.join(outDir, 'too-large.png') });
+      },
+    );
+  },
+);
+
+einhovenTest(
+  'a stop far short of the ceiling is not called too large',
+  async ({ baseURL }) => {
+    // The same stop at 16 MiB, in a page that believes the real 4 GiB: the
+    // decoder ran out of memory with 99.6% of a tab's to spare, on a file under
+    // 1 MiB. That is what a damaged file looks like too, so the page says what
+    // happened and does not say the file needs more memory than a tab has.
+    await underCap(
+      baseURL,
+      256,
+      '',
+      einhoven,
+      async (page) => {
+        await expect(page.locator('#status')).toHaveAttribute('data-load-failure', 'out-of-memory');
+        await expect(page.locator('#status')).toHaveText(/^Ran out of memory · stopped at /);
+        const note = page.locator('#scaffold-note');
+        await expect(note).toBeVisible();
+        expect(await noteIsOnTop(page)).toBe(true);
+        await expect(note.locator('#scaffold-note-title')).toHaveText('Ran out of memory');
+        const body = note.locator('#scaffold-note-body');
+        await expect(body).toContainText('a long way short of the 4 GiB a tab can hold');
+        await expect(body).toContainText('may be damaged');
+        await expect(body).not.toContainText(/needs more|too large/i);
+        await expect(page.locator('#toast-region .toast.bad')).toContainText('ran out of memory');
+        await expect(page.locator('#toast-region')).not.toContainText(/too large/i);
+        await expect.poll(() => page.workers().length, 'the worker is ended').toBe(0);
+      },
+    );
+  },
+);
+
+const coreInteriorTest = required || fs.existsSync(coreInterior) ? test : test.skip;
+
+coreInteriorTest(
+  'a stop in the stretch the decoder reports nothing in says it was building the model',
+  async ({ baseURL }) => {
+    test.setTimeout(300_000);
+    // Core Interior takes 291.6 MiB for its partition streams, all of it by the
+    // first inflate, and 324 MiB by the end of its open (saved-meshes-measure
+    // and the reports of load-progress.spec.ts). A cap between them stops it
+    // after the last stream and before the saved graphics, where the decoder
+    // reports nothing and the card says "Building the model".
+    const capMiB = 310;
+    await underCap(
+      baseURL,
+      (capMiB * MIB) / PAGE_BYTES,
+      `?memoryCeilingBytes=${capMiB * MIB}`,
+      coreInterior,
+      async (page) => {
+        await expect(page.locator('#status')).toHaveAttribute('data-load-failure', 'too-large', {
+          timeout: 240_000,
+        });
+        await expect(page.locator('#scaffold-note-body')).toContainText(
+          ', while building the model,',
+        );
+        await expect.poll(() => page.workers().length, 'the worker is ended').toBe(0);
+      },
+    );
+  },
+);
diff --git a/viewer/tests/memory-ceiling.spec.ts b/viewer/tests/memory-ceiling.spec.ts
index 9177734ce..25fe11e5c 100644
--- a/viewer/tests/memory-ceiling.spec.ts
+++ b/viewer/tests/memory-ceiling.spec.ts
@@ -20,13 +20,14 @@ const tier1 = path.resolve(
   '../../corpus/tier1/architectural-2024/architectural-2024.rvt',
 );
 
-test.describe('under the real ceiling', () => {
+test.describe('the warning before the decode', () => {
   test('a file whose estimate passes the ceiling is warned about, and still opens', async ({
     page,
   }) => {
     expect(fs.existsSync(tier1), `${tier1} is committed`).toBe(true);
     const fileBytes = fs.statSync(tier1).size;
-    // The estimate is ten times the file; a ceiling under it warns.
+    // The estimate is ten times the file; a ceiling under it warns. The real
+    // one is 4 GiB, which a file of this size does not reach.
     const ceiling = fileBytes * 10 - 1;
     await page.goto(`/?memoryCeilingBytes=${ceiling}`);
     await expect(page.locator('#status')).toHaveText(/Ready/);
diff --git a/viewer/tests/worker-failures.spec.ts b/viewer/tests/worker-failures.spec.ts
new file mode 100644
index 000000000..38efeedce
--- /dev/null
+++ b/viewer/tests/worker-failures.spec.ts
@@ -0,0 +1,159 @@
+import { expect, test, type Page } from '@playwright/test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// #1195: what the page says when the wasm call fails in ways a lowered memory
+// ceiling cannot produce in Chromium: another engine's wording of the same trap,
+// a panic that is not a memory failure, and a stop after the open call. The
+// page's worker is the shipped one and the wasm is the shipped one; the test
+// replaces `window.Worker` with a worker that first patches
+// `WebAssembly.instantiateStreaming` and `instantiate` so that one export of the
+// instance, the one named, fails the way the case says. Nothing is added to
+// what ships.
+//
+//   - "unreachable executed" (Firefox) and "Unreachable code should not be
+//     executed" (Safari), with no panic message before them, are the same
+//     failed allocation V8 calls `unreachable`;
+//   - a panic message on console.error before the trap is a panic, which is a
+//     bug, not memory, and keeps its own message;
+//   - an allocation that fails after the open call returned is blamed on the
+//     worker's step, not on the decoder.
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const tier1 = path.resolve(
+  __dirname,
+  '../../corpus/tier1/architectural-2024/architectural-2024.rvt',
+);
+
+interface Fault {
+  /** The wasm export that fails. */
+  fn: string;
+  /** What the panic hook would have written to console.error first, if anything. */
+  panic: string | null;
+  /** The message of the `WebAssembly.RuntimeError` the engine throws. */
+  error: string;
+}
+
+async function failWasm(page: Page, fault: Fault): Promise<void> {
+  await page.addInitScript((f) => {
+    const patch = `
+      const fault = ${JSON.stringify(f)};
+      const failing = () => {
+        if (fault.panic !== null) console.error(fault.panic);
+        throw new WebAssembly.RuntimeError(fault.error);
+      };
+      const wrapInstance = (instance) => {
+        const exports = { ...instance.exports, [fault.fn]: failing };
+        return new Proxy(instance, {
+          get(target, key) {
+            if (key === 'exports') return exports;
+            const value = Reflect.get(target, key, target);
+            return typeof value === 'function' ? value.bind(target) : value;
+          },
+        });
+      };
+      const wrap = (result) =>
+        result instanceof WebAssembly.Instance
+          ? wrapInstance(result)
+          : { ...result, instance: wrapInstance(result.instance) };
+      for (const name of ['instantiateStreaming', 'instantiate']) {
+        const real = WebAssembly[name];
+        WebAssembly[name] = async (...args) => wrap(await real.apply(WebAssembly, args));
+      }
+    `;
+    const NativeWorker = window.Worker;
+    window.Worker = class extends NativeWorker {
+      constructor(url: string | URL, options?: WorkerOptions) {
+        const absolute = new URL(String(url), window.location.href).href;
+        const source = `${patch}\nawait import(${JSON.stringify(absolute)});`;
+        super(URL.createObjectURL(new Blob([source], { type: 'text/javascript' })), options);
+      }
+    };
+  }, fault);
+}
+
+async function open(page: Page, query = ''): Promise<void> {
+  expect(fs.existsSync(tier1), `${tier1} is committed`).toBe(true);
+  await page.goto(`/${query}`);
+  await expect(page.locator('#status')).toHaveText(/Ready/);
+  await page.locator('#file-input').setInputFiles(tier1);
+}
+
+function engineRow(page: Page) {
+  return page.locator('#status-panel .status-row', {
+    has: page.locator('.status-label', { hasText: /^Engine message$/ }),
+  });
+}
+
+const OPEN = 'openRvtBytesWithDiagnosticsModeAndOpenLimits';
+
+test('a panic that is not a memory failure keeps its own message', async ({ page }) => {
+  const panic =
+    'rvt-rs wasm panic: panicked at src/walker.rs:1440:9:\nindex out of bounds: the len is 3 but the index is 7';
+  await failWasm(page, { fn: OPEN, panic, error: 'unreachable' });
+  await open(page);
+
+  // An error, in the panic's own words; not a claim about memory.
+  await expect(page.locator('#status')).toHaveText(/^Error: rvt-rs wasm panic: .*index out of bounds/s);
+  await expect(page.locator('#status-panel')).toContainText('index out of bounds: the len is 3');
+  await expect(page.locator('#toast-region .toast.bad')).toContainText('index out of bounds');
+  await expect(page.locator('#status')).not.toHaveAttribute('data-load-failure', /.+/);
+  await expect(page.locator('#scaffold-note')).toBeHidden();
+  for (const where of ['#status', '#status-panel', '#toast-region']) {
+    expect(await page.locator(where).innerText(), where).not.toMatch(
+      /too large|ran out of memory|needs more/i,
+    );
+  }
+  await expect(page.locator('#load-overlay')).toBeHidden();
+  await expect.poll(() => page.workers().length, 'the worker is ended').toBe(0);
+});
+
+test('a bare unreachable in Firefox wording is a memory failure', async ({ page }) => {
+  await failWasm(page, { fn: OPEN, panic: null, error: 'unreachable executed' });
+  // A ceiling the page's memory is within reach of, so the stop reads as near it.
+  await open(page, '?memoryCeilingBytes=1048576');
+
+  await expect(page.locator('#status')).toHaveAttribute('data-load-failure', 'too-large');
+  await expect(page.locator('#status')).toHaveText(/^Too large for the browser · stopped at /);
+  await expect(engineRow(page)).toContainText('RuntimeError: unreachable executed');
+  await expect(page.locator('#scaffold-note-title')).toHaveText('Too large for the browser');
+  await expect(page.locator('#scaffold-note-body')).not.toContainText(/unreachable/i);
+});
+
+test('a bare unreachable in Safari wording is a memory failure, hedged far from the ceiling', async ({
+  page,
+}) => {
+  await failWasm(page, {
+    fn: OPEN,
+    panic: null,
+    error: 'Unreachable code should not be executed (evaluating ...)',
+  });
+  await open(page);
+
+  // The real 4 GiB, and a stop at a few MiB on a 20 KiB file: not claimed to
+  // be too large, and the page says so.
+  await expect(page.locator('#status')).toHaveAttribute('data-load-failure', 'out-of-memory');
+  await expect(page.locator('#scaffold-note-title')).toHaveText('Ran out of memory');
+  await expect(page.locator('#scaffold-note-body')).toContainText('may be damaged');
+  await expect(page.locator('#scaffold-note-body')).not.toContainText('needs more');
+  await expect(engineRow(page)).toContainText('Unreachable code should not be executed');
+});
+
+test('an allocation that fails after the open call is blamed on the step it was in', async ({
+  page,
+}) => {
+  await failWasm(page, { fn: 'buildSceneGraph', panic: null, error: 'unreachable' });
+  await open(page, '?memoryCeilingBytes=1048576');
+
+  await expect(page.locator('#status')).toHaveAttribute('data-load-failure', 'too-large');
+  await expect(page.locator('#scaffold-note-body')).toContainText(', while building the scene graph,');
+  await expect(page.locator('#scaffold-note-body')).not.toContainText('partition');
+  // The decoder finished: its reports are all there, and none is the blame.
+  const events = JSON.parse(
+    (await page.locator('#status').getAttribute('data-load-progress')) ?? '[]',
+  ) as Array<{ stage?: string; step?: string }>;
+  expect(events.some((event) => event.stage !== undefined)).toBe(true);
+  expect(events.some((event) => event.step === 'Building scene graph')).toBe(true);
+  await expect.poll(() => page.workers().length, 'the worker is ended').toBe(0);
+});

From 83100ab45506f1eebf7aa0ad4fc1c4f92da635db Mon Sep 17 00:00:00 2001
From: Griffin Long <151978260+DrunkOnJava@users.noreply.github.com>
Date: Tue, 3 Nov 2026 15:09:48 -0500
Subject: [PATCH 6/9] fix(viewer): the load-progress test counts a report as
 the card does, the end of a stage with nothing after it included (#1195)

The card gives a determinate bar to any report with a total above one that is
not the end of a stage it hands over from (partition-scan, saved-meshes), so the
candidate scan's last report reads 100%. The test required done below total and
expected a sweep there.
---
 viewer/tests/load-progress.spec.ts | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/viewer/tests/load-progress.spec.ts b/viewer/tests/load-progress.spec.ts
index 754dbae72..2fd4f5152 100644
--- a/viewer/tests/load-progress.spec.ts
+++ b/viewer/tests/load-progress.spec.ts
@@ -76,14 +76,24 @@ async function statusLog(page: Page): Promise<string[]> {
   return page.evaluate(() => (window as unknown as { __statusLog: string[] }).__statusLog);
 }
 
-/** A report with a count the bar is a fraction of: a total above one, not yet reached. */
+/**
+ * The stages whose last report hands over to something the decoder reports
+ * nothing in, so the card names that and sweeps (AFTER_STAGE in main.ts).
+ */
+const HAS_AFTER = ['partition-scan', 'saved-meshes'];
+
+/**
+ * A report the card gives a determinate bar: a total above one, and not the end
+ * of a stage with something after it. The end of a stage with nothing after it
+ * (the candidate scan's 100%) is still a count, and the bar is full.
+ */
 function isCounted(event: LoadEvent): boolean {
   return (
     event.stage !== undefined &&
     event.total !== null &&
     event.total !== undefined &&
     event.total > 1 &&
-    event.done! < event.total
+    !(event.done! >= event.total && HAS_AFTER.includes(event.stage))
   );
 }
 

From 2773ab6fe02344faba04c7c511136b58c426d070 Mon Sep 17 00:00:00 2001
From: Griffin Long <151978260+DrunkOnJava@users.noreply.github.com>
Date: Tue, 3 Nov 2026 15:24:28 -0500
Subject: [PATCH 7/9] fix(viewer): the failure tests serve the patched worker
 by route, since the CSP allows no blob workers, and the hedged note drops a
 sentence its own test read as a claim (#1195)

index.html allows workers from 'self' only, so the replacement worker built
from a blob never started. The test now serves the worker's own script with the
patch in front of it, and checks it was served. The hedged note had a doubled
comma and said it was 'not reported as too large'; it now says what happened
and that the file may be damaged.
---
 viewer/src/main.ts                         |  2 +-
 viewer/tests/memory-ceiling-capped.spec.ts |  2 +-
 viewer/tests/worker-failures.spec.ts       | 90 ++++++++++++----------
 3 files changed, 51 insertions(+), 43 deletions(-)

diff --git a/viewer/src/main.ts b/viewer/src/main.ts
index f2813652b..9281c55af 100644
--- a/viewer/src/main.ts
+++ b/viewer/src/main.ts
@@ -1306,7 +1306,7 @@ function showTooLarge(file: File, tooLarge: TooLarge): void {
     summary = `The browser would not give this tab more than ${reached}${where ? `, while ${where},` : ''} and ${file.name} (${size}) needs more.`;
     advice = `A browser tab can hold at most ${ceiling}, and an open has taken at least about ${PEAK_MEMORY_PER_FILE_BYTE} times its file's size. ${LARGER_FILE_ADVICE}`;
   } else {
-    summary = `The decoder ran out of memory at ${reached}${where ? `, while ${where},` : ''}, a long way short of the ${ceiling} a tab can hold, on a ${size} file. The file may be damaged, or may have hit a limit other than the browser's memory, so this is not reported as too large.`;
+    summary = `The decoder ran out of memory at ${reached}${where ? `, while ${where}` : ''}, a long way short of the ${ceiling} a tab can hold, on a ${size} file. The file may be damaged, or may have hit a limit other than the browser's memory.`;
     advice =
       'Running rvt-ifc or rvt-gltf on the same file (with --large-model if it is large) shows whether it is damaged or only large.';
   }
diff --git a/viewer/tests/memory-ceiling-capped.spec.ts b/viewer/tests/memory-ceiling-capped.spec.ts
index 2684f4f28..c76fab08a 100644
--- a/viewer/tests/memory-ceiling-capped.spec.ts
+++ b/viewer/tests/memory-ceiling-capped.spec.ts
@@ -153,7 +153,7 @@ einhovenTest(
         const body = note.locator('#scaffold-note-body');
         await expect(body).toContainText('a long way short of the 4 GiB a tab can hold');
         await expect(body).toContainText('may be damaged');
-        await expect(body).not.toContainText(/needs more|too large/i);
+        await expect(body).not.toContainText('needs more');
         await expect(page.locator('#toast-region .toast.bad')).toContainText('ran out of memory');
         await expect(page.locator('#toast-region')).not.toContainText(/too large/i);
         await expect.poll(() => page.workers().length, 'the worker is ended').toBe(0);
diff --git a/viewer/tests/worker-failures.spec.ts b/viewer/tests/worker-failures.spec.ts
index 38efeedce..8ee2066fc 100644
--- a/viewer/tests/worker-failures.spec.ts
+++ b/viewer/tests/worker-failures.spec.ts
@@ -7,9 +7,11 @@ import { fileURLToPath } from 'node:url';
 // ceiling cannot produce in Chromium: another engine's wording of the same trap,
 // a panic that is not a memory failure, and a stop after the open call. The
 // page's worker is the shipped one and the wasm is the shipped one; the test
-// replaces `window.Worker` with a worker that first patches
+// serves the worker's script with a few lines in front of it that patch
 // `WebAssembly.instantiateStreaming` and `instantiate` so that one export of the
-// instance, the one named, fails the way the case says. Nothing is added to
+// instance, the one named, fails the way the case says. The page's
+// Content-Security-Policy allows workers from 'self' only, so the script is
+// served from its own address, by a route, not from a blob. Nothing is added to
 // what ships.
 //
 //   - "unreachable executed" (Firefox) and "Unreachable code should not be
@@ -35,42 +37,40 @@ interface Fault {
   error: string;
 }
 
-async function failWasm(page: Page, fault: Fault): Promise<void> {
-  await page.addInitScript((f) => {
-    const patch = `
-      const fault = ${JSON.stringify(f)};
-      const failing = () => {
-        if (fault.panic !== null) console.error(fault.panic);
-        throw new WebAssembly.RuntimeError(fault.error);
-      };
-      const wrapInstance = (instance) => {
-        const exports = { ...instance.exports, [fault.fn]: failing };
-        return new Proxy(instance, {
-          get(target, key) {
-            if (key === 'exports') return exports;
-            const value = Reflect.get(target, key, target);
-            return typeof value === 'function' ? value.bind(target) : value;
-          },
-        });
-      };
-      const wrap = (result) =>
-        result instanceof WebAssembly.Instance
-          ? wrapInstance(result)
-          : { ...result, instance: wrapInstance(result.instance) };
-      for (const name of ['instantiateStreaming', 'instantiate']) {
-        const real = WebAssembly[name];
-        WebAssembly[name] = async (...args) => wrap(await real.apply(WebAssembly, args));
-      }
-    `;
-    const NativeWorker = window.Worker;
-    window.Worker = class extends NativeWorker {
-      constructor(url: string | URL, options?: WorkerOptions) {
-        const absolute = new URL(String(url), window.location.href).href;
-        const source = `${patch}\nawait import(${JSON.stringify(absolute)});`;
-        super(URL.createObjectURL(new Blob([source], { type: 'text/javascript' })), options);
-      }
+/** Fails one export of the worker's wasm instance; returns how many times the patched worker script was served. */
+async function failWasm(page: Page, fault: Fault): Promise<() => number> {
+  const prelude = `(() => {
+    const fault = ${JSON.stringify(fault)};
+    const failing = () => {
+      if (fault.panic !== null) console.error(fault.panic);
+      throw new WebAssembly.RuntimeError(fault.error);
     };
-  }, fault);
+    const wrapInstance = (instance) => {
+      const exports = { ...instance.exports, [fault.fn]: failing };
+      return new Proxy(instance, {
+        get(target, key) {
+          if (key === 'exports') return exports;
+          const value = Reflect.get(target, key, target);
+          return typeof value === 'function' ? value.bind(target) : value;
+        },
+      });
+    };
+    const wrap = (result) =>
+      result instanceof WebAssembly.Instance
+        ? wrapInstance(result)
+        : { ...result, instance: wrapInstance(result.instance) };
+    for (const name of ['instantiateStreaming', 'instantiate']) {
+      const real = WebAssembly[name];
+      WebAssembly[name] = async (...args) => wrap(await real.apply(WebAssembly, args));
+    }
+  })();`;
+  let served = 0;
+  await page.context().route(/\/assets\/worker-[^/?]+\.js(\?.*)?$/, async (route) => {
+    const response = await route.fetch();
+    served += 1;
+    await route.fulfill({ response, body: `${prelude}\n${await response.text()}` });
+  });
+  return () => served;
 }
 
 async function open(page: Page, query = ''): Promise<void> {
@@ -91,8 +91,10 @@ const OPEN = 'openRvtBytesWithDiagnosticsModeAndOpenLimits';
 test('a panic that is not a memory failure keeps its own message', async ({ page }) => {
   const panic =
     'rvt-rs wasm panic: panicked at src/walker.rs:1440:9:\nindex out of bounds: the len is 3 but the index is 7';
-  await failWasm(page, { fn: OPEN, panic, error: 'unreachable' });
+  const served = await failWasm(page, { fn: OPEN, panic, error: 'unreachable' });
   await open(page);
+  // A route that never saw the worker would leave the page unbroken.
+  await expect.poll(served, 'the patched worker script was served').toBeGreaterThan(0);
 
   // An error, in the panic's own words; not a claim about memory.
   await expect(page.locator('#status')).toHaveText(/^Error: rvt-rs wasm panic: .*index out of bounds/s);
@@ -110,9 +112,11 @@ test('a panic that is not a memory failure keeps its own message', async ({ page
 });
 
 test('a bare unreachable in Firefox wording is a memory failure', async ({ page }) => {
-  await failWasm(page, { fn: OPEN, panic: null, error: 'unreachable executed' });
+  const served = await failWasm(page, { fn: OPEN, panic: null, error: 'unreachable executed' });
   // A ceiling the page's memory is within reach of, so the stop reads as near it.
   await open(page, '?memoryCeilingBytes=1048576');
+  // A route that never saw the worker would leave the page unbroken.
+  await expect.poll(served, 'the patched worker script was served').toBeGreaterThan(0);
 
   await expect(page.locator('#status')).toHaveAttribute('data-load-failure', 'too-large');
   await expect(page.locator('#status')).toHaveText(/^Too large for the browser · stopped at /);
@@ -124,12 +128,14 @@ test('a bare unreachable in Firefox wording is a memory failure', async ({ page
 test('a bare unreachable in Safari wording is a memory failure, hedged far from the ceiling', async ({
   page,
 }) => {
-  await failWasm(page, {
+  const served = await failWasm(page, {
     fn: OPEN,
     panic: null,
     error: 'Unreachable code should not be executed (evaluating ...)',
   });
   await open(page);
+  // A route that never saw the worker would leave the page unbroken.
+  await expect.poll(served, 'the patched worker script was served').toBeGreaterThan(0);
 
   // The real 4 GiB, and a stop at a few MiB on a 20 KiB file: not claimed to
   // be too large, and the page says so.
@@ -143,8 +149,10 @@ test('a bare unreachable in Safari wording is a memory failure, hedged far from
 test('an allocation that fails after the open call is blamed on the step it was in', async ({
   page,
 }) => {
-  await failWasm(page, { fn: 'buildSceneGraph', panic: null, error: 'unreachable' });
+  const served = await failWasm(page, { fn: 'buildSceneGraph', panic: null, error: 'unreachable' });
   await open(page, '?memoryCeilingBytes=1048576');
+  // A route that never saw the worker would leave the page unbroken.
+  await expect.poll(served, 'the patched worker script was served').toBeGreaterThan(0);
 
   await expect(page.locator('#status')).toHaveAttribute('data-load-failure', 'too-large');
   await expect(page.locator('#scaffold-note-body')).toContainText(', while building the scene graph,');

From 55150a23c7b50419cd1cfea929f998c24d888ca9 Mon Sep 17 00:00:00 2001
From: Griffin Long <151978260+DrunkOnJava@users.noreply.github.com>
Date: Tue, 3 Nov 2026 15:36:31 -0500
Subject: [PATCH 8/9] test(viewer): the Core Interior screenshot is taken with
 the worker's messages held, so it shows the partition stage (#1195)

The last run's picture showed 'Building the model', because the partition stage
runs about a second and a screenshot takes longer. The test now holds back the
worker's messages, in order, in the frame the bar first reads 25% or more, takes
the picture and lets them through, and writes down what the card said.
---
 viewer/tests/load-progress.spec.ts | 64 ++++++++++++++++++++++++++----
 1 file changed, 56 insertions(+), 8 deletions(-)

diff --git a/viewer/tests/load-progress.spec.ts b/viewer/tests/load-progress.spec.ts
index 2fd4f5152..d3969e35b 100644
--- a/viewer/tests/load-progress.spec.ts
+++ b/viewer/tests/load-progress.spec.ts
@@ -17,9 +17,12 @@ import { fileURLToPath } from 'node:url';
 //   - on Core Interior (17 to 24 s on Deploy viewer's runner): the bar is
 //     determinate for the counted stage at the percent of each report, sweeps
 //     for the stretch the decoder reports nothing in, and says "Building the
-//     model" once. A screenshot is taken while the partition stage runs, and it
-//     is the only thing that depends on timing, so it is best effort: what it
-//     shows is written beside it.
+//     model" once. A screenshot is taken while the partition stage runs: the
+//     page holds back the worker's messages the moment the bar first reads 25%
+//     or more (the stage's whole run is about a second, and a picture takes
+//     longer), takes it, and lets them through. It is the one thing here that
+//     depends on timing, so it is best effort, and what it shows is written
+//     beside it.
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const tier1 = path.resolve(
@@ -58,6 +61,41 @@ async function loadEvents(page: Page): Promise<LoadEvent[]> {
   return JSON.parse(raw!) as LoadEvent[];
 }
 
+/**
+ * Lets the test stop the card where it is: while `__holdMessages` is set, the
+ * worker's messages are queued, in order, and `__release` hands them to the page.
+ * Only the page's own listeners are wrapped; nothing is lost or reordered.
+ */
+async function canHoldWorkerMessages(page: Page): Promise<void> {
+  await page.addInitScript(() => {
+    const w = window as unknown as {
+      __holdMessages: boolean;
+      __held: Array<[(ev: MessageEvent) => void, MessageEvent]>;
+      __release: () => void;
+    };
+    w.__holdMessages = false;
+    w.__held = [];
+    w.__release = () => {
+      w.__holdMessages = false;
+      for (const [listener, event] of w.__held.splice(0)) listener(event);
+    };
+    const NativeWorker = window.Worker;
+    window.Worker = class extends NativeWorker {
+      addEventListener(type: string, listener: unknown, options?: unknown): void {
+        if (type !== 'message' || typeof listener !== 'function') {
+          super.addEventListener(type, listener as EventListener, options as boolean);
+          return;
+        }
+        const held = (event: Event): void => {
+          if (w.__holdMessages) w.__held.push([listener as (ev: MessageEvent) => void, event as MessageEvent]);
+          else (listener as (ev: Event) => void)(event);
+        };
+        super.addEventListener(type, held, options as boolean);
+      }
+    };
+  });
+}
+
 /** Records every text #status takes, so what a live region was told can be counted. */
 async function logStatusText(page: Page): Promise<void> {
   await page.evaluate(() => {
@@ -159,6 +197,7 @@ coreInteriorTest('the loading card fills while Core Interior decodes', async ({
   expect(fs.existsSync(coreInterior), `${coreInterior} was not fetched`).toBe(true);
   fs.mkdirSync(outDir, { recursive: true });
 
+  await canHoldWorkerMessages(page);
   await page.goto('/');
   await expect(page.locator('#status')).toHaveText(/Ready/);
   await logStatusText(page);
@@ -166,9 +205,11 @@ coreInteriorTest('the loading card fills while Core Interior decodes', async ({
 
   // The screenshot is the only thing here that depends on timing. Wait, polling
   // every animation frame, for the bar to be a quarter full or more while the
-  // partition stage runs, and take it at once; a decode that is past that by
-  // the time the page looks, or a screenshot that lands after it, only means
-  // no picture, which is written down rather than failed on.
+  // partition stage runs, and in the same frame stop the card where it is, so
+  // that the picture, which takes longer than the stage's last second, shows
+  // it. Whatever happens, the worker's messages are let through again. A decode
+  // that is past that by the time the page looks, or a screenshot that fails,
+  // only means no picture, which is written down rather than failed on.
   const screenshot: { taken: boolean; cardAtCapture: unknown; note: string } = {
     taken: false,
     cardAtCapture: null,
@@ -176,7 +217,12 @@ coreInteriorTest('the loading card fills while Core Interior decodes', async ({
   };
   try {
     await page.waitForFunction(
-      () => Number(document.getElementById('load-rail')?.getAttribute('aria-valuenow')) >= 25,
+      () => {
+        const value = Number(document.getElementById('load-rail')?.getAttribute('aria-valuenow'));
+        if (!(value >= 25)) return false;
+        (window as unknown as { __holdMessages: boolean }).__holdMessages = true;
+        return true;
+      },
       null,
       { polling: 'raf', timeout: 120_000 },
     );
@@ -191,9 +237,11 @@ coreInteriorTest('the loading card fills while Core Interior decodes', async ({
     });
     screenshot.taken = true;
     screenshot.note =
-      'taken when the bar first read 25% or more; the card may have moved on while the picture was taken, so cardAtCapture is what the page said just before';
+      'taken when the bar first read 25% or more, with the worker\'s messages held, so the picture is the card as cardAtCapture says';
   } catch (err) {
     screenshot.note = `no screenshot: ${(err as Error).message.split('\n')[0]}`;
+  } finally {
+    await page.evaluate(() => (window as unknown as { __release: () => void }).__release());
   }
 
   await expect(page.locator('#status')).toHaveText(/Loaded/, { timeout: 500_000 });

From 46720a1dda96a7f853e1e774d1b0ea6ce78d44d9 Mon Sep 17 00:00:00 2001
From: Griffin Long <151978260+DrunkOnJava@users.noreply.github.com>
Date: Tue, 3 Nov 2026 16:04:32 -0500
Subject: [PATCH 9/9] fix(viewer): a failure after the large-model retry says
 nothing about memory unless it is memory, and the advice states the 2 GiB
 file cap (#1195)

After 'Retry with large-model limits' every error not routed to the memory path
was given 'A browser tab can use at most 4 GiB of memory, so this file may be
too large', a panic included. Memory stops already go to showTooLarge, so the
suffix is dropped, and worker-failures.spec.ts retries under a stream limit
into a worker that panics and checks nothing on the page mentions memory.

The previous file's worker is ended before the next file is read, so a large
read does not have to fit beside its wasm memory. The advice says that
rvt-ifc and rvt-gltf with --large-model inflate up to 8 GiB on a 64-bit machine
only, that they have no flag for the 2 GiB cap on the whole file (max_file_bytes,
which Python can raise), and viewer-api.md says why the firm threshold is half
the ceiling (one wasm32 allocation cannot pass 2 GiB) and that a browser with
less than 4 GiB gets the hedged wording. user-guide.md no longer says rvt-ifc
--large-model has no ceiling.

load-progress.spec.ts holds the screenshot only when the card reads 'Reading
partition streams' at 25% or more, says how long that stage runs, and asserts
the once-only announcement from a record the page keeps of what it told #status
instead of a MutationObserver, which batches a replay of held messages.
---
 .../added/1195-viewer-progress-too-large.md   |  7 +-
 docs/user-guide.md                            |  5 +-
 docs/viewer-api.md                            | 14 +++-
 viewer/README.md                              |  8 +-
 viewer/src/main.ts                            | 38 +++++----
 viewer/tests/load-progress.spec.ts            | 84 ++++++++++---------
 viewer/tests/worker-failures.spec.ts          | 43 +++++++++-
 7 files changed, 132 insertions(+), 67 deletions(-)

diff --git a/changelog.d/added/1195-viewer-progress-too-large.md b/changelog.d/added/1195-viewer-progress-too-large.md
index 36160d328..99f515ab2 100644
--- a/changelog.d/added/1195-viewer-progress-too-large.md
+++ b/changelog.d/added/1195-viewer-progress-too-large.md
@@ -13,8 +13,9 @@
   before the decode and still tried. When the wasm instance runs out of
   memory, the viewer says the model is too large for the browser, how far the
   decode got and where, and that `rvt-ifc` and `rvt-gltf` with `--large-model`
-  (streams up to 2 GiB, inflating up to 8 GiB), or Python with a larger
-  `max_stream_bytes` and `max_inflate_bytes`, can read a larger file, instead
-  of `RuntimeError: unreachable`. A stop a long way short of the ceiling says
+  (streams up to 2 GiB and, on a 64-bit machine, inflating up to 8 GiB, for a
+  file of up to 2 GiB), or Python with a larger `max_stream_bytes` and
+  `max_inflate_bytes`, can read a larger file, instead of
+  `RuntimeError: unreachable`. A stop a long way short of the ceiling says
   "Ran out of memory" and that the file may be damaged, and a panic that is not
   a memory failure keeps its own message (#1195).
diff --git a/docs/user-guide.md b/docs/user-guide.md
index 53ff106f3..4f3a6f14f 100644
--- a/docs/user-guide.md
+++ b/docs/user-guide.md
@@ -350,8 +350,9 @@ at the default limits and, when a stream is not read, shows "Part of the file
 not read" in the File status panel with a "Retry with large-model limits"
 button, which reopens the same file with `--large-model`'s limits (streams up
 to 2 GiB). A browser tab can use at most 4 GiB of memory, so a very large
-model can still fail to open there; `rvt-ifc --large-model` has no such
-ceiling.
+model can still fail to open there; `rvt-ifc --large-model` is not held to a
+tab's 4 GiB (its caps are a 2 GiB stream and, on a 64-bit machine, 8 GiB
+inflated, and a file over 2 GiB is rejected whatever the flags).
 
 Two exports of the same file are the same bytes except for the export time,
 which the IFC header and owner history record. Set `SOURCE_DATE_EPOCH` (Unix
diff --git a/docs/viewer-api.md b/docs/viewer-api.md
index eacb14b81..844d5b1b2 100644
--- a/docs/viewer-api.md
+++ b/docs/viewer-api.md
@@ -339,9 +339,17 @@ What the viewer does (#1195):
   the page says "Too large for the browser": how far it got, that a tab holds at
   most 4 GiB and an open has taken at least about ten times the file, and what
   reads a larger file as the code takes it: `rvt-ifc` and `rvt-gltf` with
-  `--large-model` (streams up to 2 GiB, inflating up to 8 GiB, on a machine with
-  the memory), and the Python `RevitFile` with a larger `max_stream_bytes` and
-  `max_inflate_bytes`, which has no `--large-model` preset. When the instance
+  `--large-model` (streams up to 2 GiB and, on a 64-bit machine with the memory,
+  inflating up to 8 GiB; they have no flag for `max_file_bytes`, the 2 GiB cap on
+  the whole file, so a larger file is rejected whatever the flags), and the
+  Python `RevitFile` with a larger `max_stream_bytes` and `max_inflate_bytes`,
+  and `max_file_bytes` for a file over 2 GiB; it has no `--large-model` preset.
+  The threshold is half the ceiling because one wasm32 allocation cannot pass
+  2 GiB (`isize::MAX`): an allocation that failed with under 2 GiB already held
+  was not stopped by the 4 GiB ceiling alone, while one that failed with 2 GiB
+  or more held can have been. A browser that gives a tab less than 4 GiB (a
+  phone, say) stops below half of the 4 GiB the page assumes, and gets the
+  hedged wording for a model that is truly too large for it. When the instance
   stopped a long way short of the ceiling on a file whose estimate fits, such as
   a damaged file tripping `capacity overflow` at 60 MiB, a claim that the file
   needs more memory would be one nothing measured, so the page says "Ran out of
diff --git a/viewer/README.md b/viewer/README.md
index 368eac4c2..1f8c6ef3f 100644
--- a/viewer/README.md
+++ b/viewer/README.md
@@ -95,7 +95,8 @@ file not read" and offers "Retry with large-model limits", which reads the same
 file again with the limits `rvt-ifc --large-model` uses (streams up to 2 GiB).
 A browser tab can use at most 4 GiB of memory, so a very large model can still
 fail to open; `rvt-ifc --large-model` is not held to a tab's 4 GiB (its caps are
-a 2 GiB stream and 8 GiB inflated, on a machine with the memory). The button calls
+a 2 GiB stream and, on a 64-bit machine with the memory, 8 GiB inflated, and a
+file over 2 GiB is rejected whatever the flags). The button calls
 `openRvtBytesWithDiagnosticsModeAndOpenLimits` with `{ largeModel: true }`.
 
 A file whose size says it may need more than a tab's 4 GiB (an open has taken
@@ -103,8 +104,9 @@ at least about ten times the file's size, and the warning can fire on a file
 that fits) is warned about in the loading card before the decode, and still
 tried. When the wasm instance does run out of memory, the viewer says the model
 is too large for the browser, how much memory the tab reached, and what reads a
-larger file (`rvt-ifc` and `rvt-gltf` with `--large-model`; the Python
-`RevitFile` with a larger `max_stream_bytes` and `max_inflate_bytes`), instead of
+larger file (`rvt-ifc` and `rvt-gltf` with `--large-model`, up to a 2 GiB file;
+the Python `RevitFile` with a larger `max_stream_bytes`, `max_inflate_bytes` and,
+over 2 GiB, `max_file_bytes`), instead of
 `RuntimeError: unreachable`; the engine's own message is in the status panel.
 A stop a long way short of the ceiling on a small file says "Ran out of memory"
 and that the file may be damaged, since nothing measured says it needs more. How
diff --git a/viewer/src/main.ts b/viewer/src/main.ts
index 9281c55af..df89fe968 100644
--- a/viewer/src/main.ts
+++ b/viewer/src/main.ts
@@ -477,15 +477,18 @@ function formatMemory(bytes: number): string {
 
 /**
  * What reads a file the browser cannot, as the command line and the Python
- * package really take it: `--large-model` on rvt-ifc and rvt-gltf reads streams
- * up to 2 GiB and inflates up to 8 GiB (`rvt::cli::open_limits`), and Python's
- * `RevitFile` has no such preset, only `max_stream_bytes` and
- * `max_inflate_bytes` to raise. Neither is unlimited, and both need a machine
- * with the memory.
+ * package really take it (`rvt::cli::open_limits`, `rvt::reader::OpenLimits`,
+ * `rvt-py`): `--large-model` on rvt-ifc and rvt-gltf reads streams up to 2 GiB
+ * and, on a 64-bit machine, inflates up to 8 GiB. Neither has a flag for
+ * `max_file_bytes`, the 2 GiB cap on the whole file, so a larger file is
+ * rejected whatever the flags. Python's `RevitFile` has no preset, only
+ * `max_stream_bytes`, `max_inflate_bytes` and `max_file_bytes` to raise. All of
+ * it needs a machine with the memory.
  */
 const LARGER_FILE_ADVICE =
-  'rvt-ifc and rvt-gltf with --large-model read streams up to 2 GiB and inflate up to 8 GiB, on a machine with the memory, ' +
-  'and the Python package opens a file with a larger max_stream_bytes and max_inflate_bytes.';
+  'rvt-ifc and rvt-gltf with --large-model read streams up to 2 GiB and, on a 64-bit machine with the memory, inflate up to 8 GiB; ' +
+  'they have no flag for the 2 GiB cap on the whole file, so a larger file is rejected whatever the flags. ' +
+  'The Python package opens a file with a larger max_stream_bytes and max_inflate_bytes, and max_file_bytes for one over 2 GiB.';
 
 /** The decoder's stages (`rvt::control::Stage`) as the card names them, and how it counts each. */
 const DECODE_STAGES: Record<string, { label: string; count: (done: number, total: number) => string }> = {
@@ -560,12 +563,15 @@ let loadEvents: LoadEvent[] = [];
 let loadStage: string | null = null;
 /** The last thing said on #status, a live region, so each is said once. */
 let loadAnnounced = '';
+/** Everything `announceLoad` has said on #status this open, in order, kept for the tests. */
+let loadAnnouncements: string[] = [];
 let loadMemoryWarned = false;
 
 /** Says `text` on #status unless it was the last thing said. */
 function announceLoad(text: string): void {
   if (text === loadAnnounced) return;
   loadAnnounced = text;
+  loadAnnouncements.push(text);
   setStatus(text);
 }
 
@@ -617,6 +623,7 @@ function onDecodeStage(stage: string, done: number, total: number | null, memory
 /** What the worker said, kept on #status for tests/load-progress.spec.ts and the measurement. */
 function saveLoadEvents(): void {
   statusEl.dataset.loadProgress = JSON.stringify(loadEvents);
+  statusEl.dataset.loadAnnounced = JSON.stringify(loadAnnouncements);
 }
 
 /**
@@ -642,7 +649,9 @@ function startLoadOverlay(file: File): void {
   loadEvents = [];
   loadStage = null;
   loadAnnounced = '';
+  loadAnnouncements = [];
   delete statusEl.dataset.loadProgress;
+  delete statusEl.dataset.loadAnnounced;
   setLoadFraction(null);
   loadStepEl.textContent = `Opening ${file.name}`;
   loadExpectationText = loadExpectation(file.size);
@@ -1058,6 +1067,9 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
   lastGlb = null;
   lastSchedule = null;
   currentDiagnostics = null;
+  // The last file's worker holds its wasm memory, and a large file's read, which
+  // is next, must not have to fit beside it.
+  stopWorker();
   exportGlbBtn.disabled = true;
   exportIfcBtn.disabled = true;
   exportSvgBtn.disabled = true;
@@ -1188,14 +1200,10 @@ async function loadBytes(file: File, limits?: OpenLimitsOptions): Promise<void>
         showTooLarge(file, msg.tooLarge);
         return;
       }
-      // The large-model limits stop at the tab's memory, not at a limit the
-      // reader can lift, so say what the failure most likely is.
-      failLoad(
-        file,
-        openLimits?.largeModel
-          ? `${msg.message} A browser tab can use at most 4 GiB of memory, so this file may be too large to open here.`
-          : msg.message,
-      );
+      // A memory stop is `msg.tooLarge` and went above, whatever limits the
+      // open ran under; any other failure, a panic included, says only what it
+      // is, since nothing says it is memory.
+      failLoad(file, msg.message);
       return;
     }
     model = msg.model;
diff --git a/viewer/tests/load-progress.spec.ts b/viewer/tests/load-progress.spec.ts
index d3969e35b..830809e6b 100644
--- a/viewer/tests/load-progress.spec.ts
+++ b/viewer/tests/load-progress.spec.ts
@@ -8,21 +8,25 @@ import { fileURLToPath } from 'node:url';
 // guess from the file size. The worker posts each report from inside the wasm
 // call, so the page sees them while the decode runs. The page keeps every
 // report on #status as `data-load-progress`, with what the card showed once it
-// had applied that report (its step, the bar's value, its hint), so these
-// tests read the card's behaviour from that record rather than sampling the
-// page, which a decode 3 s into its partition stage would make a coin flip:
+// had applied that report (its step, the bar's value, its hint), and every
+// text `announceLoad` told #status (`data-load-announced`), so these tests read
+// the card's behaviour from those records rather than sampling the page, whose
+// counted stages last a second or less each on Deploy viewer's runner:
 //
 //   - on the tier-1 fixture, which opens in milliseconds: the stages, their
 //     counts and the steps after the decode;
 //   - on Core Interior (17 to 24 s on Deploy viewer's runner): the bar is
 //     determinate for the counted stage at the percent of each report, sweeps
 //     for the stretch the decoder reports nothing in, and says "Building the
-//     model" once. A screenshot is taken while the partition stage runs: the
-//     page holds back the worker's messages the moment the bar first reads 25%
-//     or more (the stage's whole run is about a second, and a picture takes
-//     longer), takes it, and lets them through. It is the one thing here that
-//     depends on timing, so it is best effort, and what it shows is written
-//     beside it.
+//     model" once. A screenshot is taken while the partition stage runs. That
+//     stage's eight streams are inflated in about a second (1.1 s to 2.1 s into
+//     the open in the runs so far), and the bar is at 25% or more for the last
+//     0.4 s of it, which a picture takes longer than. So the page holds back
+//     the worker's messages in the frame the card first reads "Reading
+//     partition streams" at 25% or more (not another stage's 25%: the candidate
+//     scan ends at 100%), takes the picture, and lets them through. That is the
+//     one thing here that depends on timing, so it is best effort, and what it
+//     shows is written beside it.
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const tier1 = path.resolve(
@@ -96,22 +100,16 @@ async function canHoldWorkerMessages(page: Page): Promise<void> {
   });
 }
 
-/** Records every text #status takes, so what a live region was told can be counted. */
-async function logStatusText(page: Page): Promise<void> {
-  await page.evaluate(() => {
-    const status = document.getElementById('status')!;
-    const log: string[] = [];
-    (window as unknown as { __statusLog: string[] }).__statusLog = log;
-    new MutationObserver(() => log.push(status.textContent ?? '')).observe(status, {
-      childList: true,
-      characterData: true,
-      subtree: true,
-    });
-  });
-}
-
-async function statusLog(page: Page): Promise<string[]> {
-  return page.evaluate(() => (window as unknown as { __statusLog: string[] }).__statusLog);
+/**
+ * Every text the page told #status, a live region, while the file opened, in
+ * order, as the page recorded them when it said them. A MutationObserver would
+ * not do: it batches the mutations of one task, and a replay of held messages
+ * is one task.
+ */
+async function announced(page: Page): Promise<string[]> {
+  const raw = await page.locator('#status').getAttribute('data-load-announced');
+  expect(raw, 'the page keeps what it announced').not.toBeNull();
+  return JSON.parse(raw!) as string[];
 }
 
 /**
@@ -200,16 +198,15 @@ coreInteriorTest('the loading card fills while Core Interior decodes', async ({
   await canHoldWorkerMessages(page);
   await page.goto('/');
   await expect(page.locator('#status')).toHaveText(/Ready/);
-  await logStatusText(page);
   await page.locator('#file-input').setInputFiles(coreInterior);
 
   // The screenshot is the only thing here that depends on timing. Wait, polling
-  // every animation frame, for the bar to be a quarter full or more while the
-  // partition stage runs, and in the same frame stop the card where it is, so
-  // that the picture, which takes longer than the stage's last second, shows
-  // it. Whatever happens, the worker's messages are let through again. A decode
-  // that is past that by the time the page looks, or a screenshot that fails,
-  // only means no picture, which is written down rather than failed on.
+  // every animation frame, for the card to read "Reading partition streams"
+  // with the bar a quarter full or more, and in the same frame stop it where it
+  // is, so that the picture, which takes longer than what is left of the stage,
+  // shows it. Whatever happens, the worker's messages are let through again. A
+  // decode that is past that by the time the page looks, or a screenshot that
+  // fails, only means no picture, which is written down rather than failed on.
   const screenshot: { taken: boolean; cardAtCapture: unknown; note: string } = {
     taken: false,
     cardAtCapture: null,
@@ -219,7 +216,8 @@ coreInteriorTest('the loading card fills while Core Interior decodes', async ({
     await page.waitForFunction(
       () => {
         const value = Number(document.getElementById('load-rail')?.getAttribute('aria-valuenow'));
-        if (!(value >= 25)) return false;
+        const step = document.getElementById('load-step')?.textContent;
+        if (step !== 'Reading partition streams' || !(value >= 25)) return false;
         (window as unknown as { __holdMessages: boolean }).__holdMessages = true;
         return true;
       },
@@ -237,7 +235,7 @@ coreInteriorTest('the loading card fills while Core Interior decodes', async ({
     });
     screenshot.taken = true;
     screenshot.note =
-      'taken when the bar first read 25% or more, with the worker\'s messages held, so the picture is the card as cardAtCapture says';
+      'taken when the card first read Reading partition streams at 25% or more, with the worker\'s messages held, so the picture is the card as cardAtCapture says';
   } catch (err) {
     screenshot.note = `no screenshot: ${(err as Error).message.split('\n')[0]}`;
   } finally {
@@ -295,13 +293,21 @@ coreInteriorTest('the loading card fills while Core Interior decodes', async ({
 
   // The stretch after the last stream is inflated reports nothing until the
   // saved graphics. The card names it, and says so once: #status is a live
-  // region, and it was told "Building the model" a single time.
+  // region, and the page told it "Building the model" a single time, though two
+  // reports left the card there (the last stream, and the end of the walk).
   const building = reports.filter((event) => event.card!.step === 'Building the model');
-  expect(building.length, 'reports that left the card on Building the model').toBeGreaterThan(0);
+  expect(building.length, 'reports that left the card on Building the model').toBeGreaterThanOrEqual(2);
   for (const event of building) expect(event.card!.value).toBeNull();
-  const log = await statusLog(page);
+  const said = await announced(page);
   expect(
-    log.filter((text) => text === 'Building the model'),
-    `status text: ${log.join(' | ')}`,
+    said.filter((text) => text === 'Building the model'),
+    `announced: ${said.join(' | ')}`,
   ).toHaveLength(1);
+  said.forEach((text, i) => {
+    if (i > 0) expect(text, `announced twice in a row: ${text}`).not.toBe(said[i - 1]);
+  });
+  expect(said, 'the stages in the order they ran').toEqual(
+    expect.arrayContaining(['Reading partition streams', 'Building the model']),
+  );
+  expect(said.indexOf('Reading partition streams')).toBeLessThan(said.indexOf('Building the model'));
 });
diff --git a/viewer/tests/worker-failures.spec.ts b/viewer/tests/worker-failures.spec.ts
index 8ee2066fc..39bbf278e 100644
--- a/viewer/tests/worker-failures.spec.ts
+++ b/viewer/tests/worker-failures.spec.ts
@@ -37,8 +37,12 @@ interface Fault {
   error: string;
 }
 
-/** Fails one export of the worker's wasm instance; returns how many times the patched worker script was served. */
-async function failWasm(page: Page, fault: Fault): Promise<() => number> {
+/**
+ * Fails one export of the worker's wasm instance, in every worker after the
+ * first `healthy` ones, which run as shipped. Returns how many patched worker
+ * scripts have been served.
+ */
+async function failWasm(page: Page, fault: Fault, healthy = 0): Promise<() => number> {
   const prelude = `(() => {
     const fault = ${JSON.stringify(fault)};
     const failing = () => {
@@ -64,8 +68,14 @@ async function failWasm(page: Page, fault: Fault): Promise<() => number> {
       WebAssembly[name] = async (...args) => wrap(await real.apply(WebAssembly, args));
     }
   })();`;
+  let requests = 0;
   let served = 0;
   await page.context().route(/\/assets\/worker-[^/?]+\.js(\?.*)?$/, async (route) => {
+    requests += 1;
+    if (requests <= healthy) {
+      await route.continue();
+      return;
+    }
     const response = await route.fetch();
     served += 1;
     await route.fulfill({ response, body: `${prelude}\n${await response.text()}` });
@@ -165,3 +175,32 @@ test('an allocation that fails after the open call is blamed on the step it was
   expect(events.some((event) => event.step === 'Building scene graph')).toBe(true);
   await expect.poll(() => page.workers().length, 'the worker is ended').toBe(0);
 });
+
+test('a panic after "Retry with large-model limits" says nothing about memory', async ({ page }) => {
+  // The first open runs as shipped, under a stream limit the tier-1 fixture's
+  // BasicFileInfo exceeds, so the retry is offered; the retry's worker is the
+  // one that panics, with a message that is not an allocation's.
+  const panic =
+    'rvt-rs wasm panic: panicked at src/walker.rs:1440:9:\nindex out of bounds: the len is 3 but the index is 7';
+  const served = await failWasm(page, { fn: OPEN, panic, error: 'unreachable' }, 1);
+  await open(page, '?maxStreamBytes=200');
+  await expect(page.locator('#status')).toHaveText(/Loaded/);
+  const retry = page.getByRole('button', { name: 'Retry with large-model limits' });
+  await expect(retry).toBeVisible();
+
+  await retry.click();
+  await expect.poll(served, 'the retry ran in the patched worker').toBeGreaterThan(0);
+
+  await expect(page.locator('#status')).toHaveText(/^Error: rvt-rs wasm panic: .*index out of bounds/s);
+  await expect(page.locator('#status')).not.toHaveAttribute('data-load-failure', /.+/);
+  await expect(page.locator('#scaffold-note')).toBeHidden();
+  // Nothing on the page says the file is large or the tab short of memory: the
+  // panic is not an allocation, and the retry changes nothing about that.
+  for (const where of ['#status', '#status-panel', '#toast-region']) {
+    expect(await page.locator(where).innerText(), where).not.toMatch(
+      /memory|4 GiB|too large|needs more/i,
+    );
+  }
+  await expect(page.locator('#toast-region .toast.bad')).toContainText('index out of bounds');
+  await expect.poll(() => page.workers().length, 'the worker is ended').toBe(0);
+});