Complete V1 RC deployment capability gates

docs/web/DEPLOYMENT.md

@@ -0,0 +1,36 @@
+# Web Blender Modeler V1 Deployment Contract
+
+The normative machine-readable contract is `deployment-contract.json`. A server is compatible only
+when every response, including errors and SPA fallbacks, preserves these headers:
+
+| Header | Required value |
+| --- | --- |
+| `Cross-Origin-Opener-Policy` | `same-origin` |
+| `Cross-Origin-Embedder-Policy` | `require-corp` |
+| `Cross-Origin-Resource-Policy` | `same-origin` |
+
+Production uses HTTPS. Loopback development may use `http://127.0.0.1`; `file://` is unsupported.
+Runtime assets are same-origin. A reverse proxy must not strip the isolation, range, cache, MIME or
+ETag headers.
+
+## Cache policy
+
+- `/` and `/index.html`: `Cache-Control: no-cache` so a deployment is revalidated.
+- `/engine-manifest.json`: `Cache-Control: no-cache` so engine identity is revalidated.
+- `/assets/*`: `Cache-Control: public, max-age=31536000, immutable`; Vite content hashes these names.
+- `/vendor/blender/*`: `Cache-Control: no-cache`; these stable URLs are verified by the engine manifest.
+- Other paths: `Cache-Control: no-cache` until a more specific content-addressed rule exists.
+
+The server must use the MIME map in the JSON contract. In particular, WebAssembly is
+`application/wasm`, JavaScript is `text/javascript; charset=utf-8`, and NanoVDB is
+`application/x-nanovdb`.
+
+## Range and validators
+
+`.wasm`, `.blend` and `.nvdb` accept a single `bytes` range. A valid range returns `206` with
+`Accept-Ranges`, `Content-Range`, `Content-Length` and a strong content SHA-256 ETag. An invalid or
+unsatisfied range returns `416`. An `If-Range` mismatch ignores the range and returns the complete
+resource with status `200`; partial bytes from a different revision must never be combined.
+
+Run `node tools/web/check-deployment-contract.mjs` for the static contract gate. Production HTTP
+behavior is a separate M6 acceptance gate and must exercise an actual server before release.