Follow-up to #3309, merged as 21003c6d5 and now sitting in a pending publish. Four items, all reproduced against the merged tree. Item 4 is the only one that is time-sensitive.
1. "Keep georeferencing" emits an invalid STEP file, silently
With removeGeoreferencing: false — the viewer's "kept as authored" state — the export emits
#2=IFCSITE(...,'LAND-4471',#111)
with no #111= line, because the address entity is unconditionally dropped by IDENTIFYING_TYPES (subset-roots.ts:68-76). warnings comes back []. The dangling-ref repair only runs on IFCREL* lines (step-omission-predicates.ts:248-262), so it never sees this.
Either blank the slots unconditionally or keep the entity when the option is off, and add a dangling-ref assertion for the option-off case. removeGeoreferencing appears in zero shipped test files in packages/export.
2. "Property sets → Anonymize" does not drop psets
Psets that reached includedIds survive. Output contains IFCLABEL('ACME-CC-99871 / CEO office / Jane Architect') and IFCTEXT('... bauherr@acme.ch'), with warnings: [], while the UI says they were dropped.
The same false claim is in three places: the viewer label, docs/guide/exporting.md:534, and the pending changeset. Couple the two toggles the way the CLI does, or fix all three. This is the one that matters most — it is a privacy feature telling the user it did something it did not.
3. Two leaks on DEFAULT settings
IfcElementType.ElementType (slot 8) survives verbatim — populated in 612 of 3203 *Type entities across 121 in-tree fixtures. It is the type-side twin of the ObjectType slot the scrubber already cleans.IfcMaterial.Category and IfcMaterialLayer.Category likewise.
ElementType must go in ROOT_ALL_NAMES_ATTRIBUTES (anonymize-scrub.ts:54), not NON_ROOT_NAME_ATTRIBUTES (:59) — :317 short-circuits on IFC_ROOT_TYPES and IFCWALLTYPE is an IfcRoot, so the :59 placement is inert. Both placements were tried; only the first works.
4. The changeset names five CLI flags that do not exist
.changeset/anonymized-isolated-export.md documents --no-hosts, --no-openings, --no-types, --no-materials, --no-aggregates. The real names are --no-rel-*. It is pending on main, so it publishes verbatim into the CHANGELOG on the next release. Cheapest item here and the only one with a deadline.
Why CI does not catch any of it
The "contains none of the source model's identifying strings" fixture has $ in both leaking slots (anonymize-export.test.ts:146) and a one-argument IFCMATERIAL (:151). It cannot fail on any of the three gaps. The only dangling-ref test runs on defaults, which is the path that works.
Lower priority
FILE_DESCRIPTION is inherited verbatim (anonymize-export.ts:148-165 never passes description). Property and quantity values are unscrubbed by design, but they are the larger half of the residual leak surface, and the sentence describing it currently names only names.
None of this argues the merge was wrong: the feature is sound, well-tested for its default path, and the gaps are fixable off main. But it is a tool whose entire value is a promise about what it removed, so the gap between the label and the behaviour is the part worth closing before it ships.
Follow-up to #3309, merged as
21003c6d5and now sitting in a pending publish. Four items, all reproduced against the merged tree. Item 4 is the only one that is time-sensitive.1. "Keep georeferencing" emits an invalid STEP file, silently
With
removeGeoreferencing: false— the viewer's "kept as authored" state — the export emitswith no
#111=line, because the address entity is unconditionally dropped byIDENTIFYING_TYPES(subset-roots.ts:68-76).warningscomes back[]. The dangling-ref repair only runs onIFCREL*lines (step-omission-predicates.ts:248-262), so it never sees this.Either blank the slots unconditionally or keep the entity when the option is off, and add a dangling-ref assertion for the option-off case.
removeGeoreferencingappears in zero shipped test files inpackages/export.2. "Property sets → Anonymize" does not drop psets
Psets that reached
includedIdssurvive. Output containsIFCLABEL('ACME-CC-99871 / CEO office / Jane Architect')andIFCTEXT('... bauherr@acme.ch'), withwarnings: [], while the UI says they were dropped.The same false claim is in three places: the viewer label,
docs/guide/exporting.md:534, and the pending changeset. Couple the two toggles the way the CLI does, or fix all three. This is the one that matters most — it is a privacy feature telling the user it did something it did not.3. Two leaks on DEFAULT settings
IfcElementType.ElementType(slot 8) survives verbatim — populated in 612 of 3203*Typeentities across 121 in-tree fixtures. It is the type-side twin of theObjectTypeslot the scrubber already cleans.IfcMaterial.CategoryandIfcMaterialLayer.Categorylikewise.ElementTypemust go inROOT_ALL_NAMES_ATTRIBUTES(anonymize-scrub.ts:54), notNON_ROOT_NAME_ATTRIBUTES(:59) —:317short-circuits onIFC_ROOT_TYPESandIFCWALLTYPEis anIfcRoot, so the:59placement is inert. Both placements were tried; only the first works.4. The changeset names five CLI flags that do not exist
.changeset/anonymized-isolated-export.mddocuments--no-hosts,--no-openings,--no-types,--no-materials,--no-aggregates. The real names are--no-rel-*. It is pending onmain, so it publishes verbatim into the CHANGELOG on the next release. Cheapest item here and the only one with a deadline.Why CI does not catch any of it
The "contains none of the source model's identifying strings" fixture has
$in both leaking slots (anonymize-export.test.ts:146) and a one-argumentIFCMATERIAL(:151). It cannot fail on any of the three gaps. The only dangling-ref test runs on defaults, which is the path that works.Lower priority
FILE_DESCRIPTIONis inherited verbatim (anonymize-export.ts:148-165never passesdescription). Property and quantity values are unscrubbed by design, but they are the larger half of the residual leak surface, and the sentence describing it currently names only names.None of this argues the merge was wrong: the feature is sound, well-tested for its default path, and the gaps are fixable off
main. But it is a tool whose entire value is a promise about what it removed, so the gap between the label and the behaviour is the part worth closing before it ships.