docs(readme): record browser E2E verification honestly

The viewer now has end-to-end evidence: SSE-driven LIVE ingestion of
pipeline GLBs into the Three.js viewport (stage-1 mid-run, stage-3 final,
frozen-canvas hash separation, byte-identical served vs CLI artifact),
failure indication, and zero console errors. Documents the new
/api/artifacts/steps route and the vendored three.js dependency.

1 files changed, 26 insertions, 5 deletions

diff --git a/README.md b/README.md
index 7059a51..ae59ca2 100644
--- a/README.md
+++ b/README.md
@@ -41,6 +41,10 @@ The server project copies `public/**` into its build output
 (`CopyToOutputDirectory=PreserveNewest`), so rerun `dotnet build` on the server
 after regenerating the bundle.
 
+Three.js r160 and GLTFLoader are vendored under `public/vendor/` (import map
+plus a `three-setup.js` shim exposing `window.THREE`/`window.GLTFLoader`).
+They are MIT-licensed third-party dependencies, not project assets.
+
 ## Server
 
 ```sh
@@ -57,9 +61,11 @@ Environment variables (all optional):
 
 Routes used by the frontend: `POST /api/runs/start`,
 `GET /api/runs/events?projectId=...&runId=...` (run-scoped SSE),
-`GET /api/artifacts/manifest`, `GET /api/artifacts/file`. The server binds to
-the ASP.NET default (add `--urls http://127.0.0.1:8099` to match the legacy
-port).
+`GET /api/artifacts/manifest`, `GET /api/artifacts/file`, and
+`GET /api/artifacts/steps?projectId=...&runId=...&path=steps/<step>.glb`
+(serve a step GLB while a run is still active; `.glb` files under `steps/`
+only, traversal-guarded). The server binds to the ASP.NET default (add
+`--urls http://127.0.0.1:8099` to match the legacy port).
 
 ## CLI
 
@@ -113,5 +119,20 @@ dotnet run --project src/SomhairlesDream.Cli -- run \
 - Full solution test suite and Release build: clean (0 warnings/errors).
 - Real CLI pipeline with `/tmp/bpyenv/bin/python`: 3 GLBs + logs + manifest,
   `verify` exit 0.
-- Browser end-to-end behavior and production fidelity are NOT yet verified;
-  the pipeline contract tests cover the generated bundle routes only.
+- Browser end-to-end (playwright + bundled chromium, `--enable-unsafe-swiftshader`),
+  server on `:8099` with the real bpy interpreter, run started through the
+  page form: pre-run page shows exactly `当前没有下一版正在开发` and status
+  `待机`; during the run the SSE snapshot drives the viewport to load
+  `steps/01-foundation.glb` (status `运行中`, note `管线几何 · …` — LIVE
+  ingestion, not replay); at completion the viewport shows
+  `steps/03-cabin.glb`, status `已完成`, manifest link exposed; the served
+  `steps/03-cabin.glb` is byte-identical (sha256) to the CLI-produced
+  reference run; a failure run (pre-existing run directory) shows status
+  `失败` with the error surfaced in `run-message`; zero console errors on
+  all pages.
+- Frozen-viewport evidence (`?freeze=1` stops rotation): canvas screenshots
+  of placeholder vs stage-1 vs stage-3 differ in pixel hashes, and the three
+  stages are visually distinct cubes/frames/house. Evidence lives in a
+  scratch directory and is not committed.
+- NOT verified: production deployment of the old site remains untouched;
+  `--render` PNG renders; replay button flow against a historical run.