chore: WS-2/WS-7 verification + comprehensive README + critical-docs audit

.cursorrules

@@ -46,7 +46,7 @@ Inhalt des Kommentars: **warum** die Änderung, **was** sie verbessert, optional
 
 Bei jeder offenen PR **alle** Inline-Review-Kommentare (CodeAnt AI + jeder Bot/Mensch) **proaktiv, ungefragt** abarbeiten. Pro Finding: gegen den **aktuellen** Code validieren (Anker oft veraltet), dann **Root-Cause-Fix** vollständig umsetzen (Code **+ Tests + i18n + Doku**) oder mit Begründung als False-Positive ablehnen. Jeden Thread mit Commit-Referenz beantworten, **resolven**, **0 unresolved** hinterlassen, committen + pushen.
 
-**Iron Rule — Loop bis Ruhe:** Nach jedem Push **Review erneut triggern** (`gh pr comment <N> --body "@codeant-ai review"`); eine frische Review bringt regelmäßig **neue** Findings (eine „Welle"). Zyklus wiederholen, bis **BEIDES** gilt: frische Review = **0 neue Kommentare** UND **0 offene Threads**. Niemals aufhören, solange noch Kommentare kommen. **Niemals ein neues `biome-ignore`/Suppression** einbauen, um ein Finding stummzuschalten — der Suppression-Ratchet-Gate lässt die CI scheitern; stattdessen sauber refaktorieren. Vollständige Prozedur: **`docs/CODEANT-REVIEW-LOOP.md`**.
+**Iron Rule — Loop bis Ruhe:** Nach jedem Push **Review erneut triggern** (`gh pr comment <N> --body "@codeant-ai review"`); eine frische Review bringt regelmäßig **neue** Findings (eine „Welle"). Zyklus wiederholen, bis **BEIDES** gilt: frische Review = **0 neue Kommentare** UND **0 offene Threads**. Niemals aufhören, solange noch Kommentare kommen. **Niemals ein neues `biome-ignore`/Suppression** einbauen, um ein Finding stummzuschalten — der Suppression-Ratchet-Gate lässt die CI scheitern; stattdessen sauber refaktorieren. **In der Praxis postet CodeRabbit die Inline-Kommentare** — auch dieses erneut triggern (`@coderabbitai review`) und die komplette Review-Historie prüfen, nicht nur den letzten Status (ein „rate limited"-Status kann eine frühere echte Review verdecken). CodeAnt AI erscheint nur als 5 CI-Status-Checks, kein Kommentar-Thread. Vollständige Prozedur: **`docs/CODEANT-REVIEW-LOOP.md`**.
 
 ---
 

.github/SECURITY.md

@@ -4,8 +4,8 @@
 
 | Version | Supported |
 | --- | --- |
-| `main` (v1.19.0) | ✅ Full support |
-| `1.3.x – 1.18.x` | ⚠️ Best effort (upgrade strongly recommended) |
+| `main` (v1.24.3) | ✅ Full support |
+| `1.3.x – 1.23.x` | ⚠️ Best effort (upgrade strongly recommended) |
 | `< 1.3.0` | ❌ Not supported |
 
 Maintainer-facing documentation (CI, contributing, architecture) is indexed in [`README.md`](README.md#-documentation-hub) and enumerated in [`AUDIT.md`](AUDIT.md).

.github/copilot-instructions.md

@@ -126,6 +126,10 @@ types.ts          → Core shared interfaces and types
   - **Iron rule — loop until quiescent:** a push triggers a fresh review that often raises NEW
     findings (a "wave"). Repeat until **BOTH** a fresh review yields **0 new comments** AND **0 threads
     unresolved**. Never stop while comments still arrive.
+  - **In practice, CodeRabbit posts the inline comments** — re-trigger it too (`@coderabbitai review`)
+    and check its full review history, not just the latest status (a rate-limited latest status can
+    hide an earlier real review). CodeAnt AI shows up as 5 CI status checks to verify green, not an
+    inline-comment thread.
 
 ### Test Stability Guidelines (QNBS-v3)
 

AGENTS.md

@@ -44,19 +44,19 @@ The app supports a multi-provider AI stack (Gemini, OpenAI, Claude, Grok, OpenRo
 | Layer | Technology |
 |-------|------------|
 | Runtime | Node.js `>=22.0.0` (`.nvmrc` → `22`), pnpm `>=11.0.0` (`packageManager: pnpm@11.5.2`) |
-| Framework | React `^19.2.7`, TypeScript `~6.0.3` (strict) |
+| Framework | React `^19.2.7`, TypeScript 7 via `@typescript/native-preview` (tsgo, strict) — no pinned classic `typescript` package |
 | Build tool | Vite `^8.0.16` (`vite.config.ts`) |
 | Type checker | `tsgo` (TypeScript Go port) via `tsconfig.tsgo.json` with 4 checkers (`pnpm run typecheck`) |
-| Styling | Tailwind CSS `^4.3.0` via `@tailwindcss/vite` + semantic CSS custom properties (`index.css`) |
-| State | Redux Toolkit `^2.12.0` + `redux-undo` (project slice only); Zustand `^5.0.8` for transient UI (`app/transientUiStore.ts`) |
-| Testing | Vitest `^4.1.8` (jsdom, `maxWorkers: 1`), Playwright `^1.60.0` (E2E, CI-only), Stryker `^9.2.0` (mutation, manual workflow only) |
-| Lint/Format | Biome `^2.4.16` (`biome.json`) — single toolchain for JS/TS/CSS |
+| Styling | Tailwind CSS `^4.3.1` via `@tailwindcss/vite` + semantic CSS custom properties (`index.css`) |
+| State | Redux Toolkit `^2.12.0` + `redux-undo` (project slice only); Zustand `^5.0.14` for transient UI (`app/transientUiStore.ts`) |
+| Testing | Vitest `^4.1.10` (jsdom, `maxWorkers: 1`), Playwright `^1.61.1` (E2E, CI-only), Stryker `^9.2.0` (mutation, manual workflow only) |
+| Lint/Format | Biome `^2.5.4` (`biome.json`) — single toolchain for JS/TS/CSS |
 | AI | Multi-provider: Google Gemini (`@google/genai`), OpenAI, Anthropic Claude, Grok, OpenRouter, Ollama, WebLLM, ONNX Runtime Web, Transformers.js |
 | Voice | Web Speech API (fallback); WASM engines: Whisper.cpp (STT), Kokoro (TTS), Silero VAD; gated by `featureFlags.enableVoiceWasm` |
 | Storage | IndexedDB v8 (`dbService.ts` / `storageService.ts`) / Tauri filesystem (`fileSystemService.ts`); LZ-String compression; AES-256-GCM encryption for API keys and optional IDB at-rest encryption |
 | PWA | `vite-plugin-pwa` with `injectManifest` strategy (`public/sw.js`) |
 | Desktop | Tauri 2 (`src-tauri/`) — Rust toolchain required |
-| Storybook | Storybook `^10.4.2` with `@storybook/react-vite` and `@storybook/addon-a11y` |
+| Storybook | Storybook `^10.5.3` with `@storybook/react-vite` and `@storybook/addon-a11y` |
 | Orchestration | Turborepo (`turbo.json`) for parallel task caching; pnpm workspaces (`packages/*`) |
 | Collaboration | Yjs + `packages/collab-transport` (vendor fork of y-webrtc 10.3.0) with RTCDataChannel AES-256-GCM E2E encryption |
 

AUDIT.md

@@ -1,8 +1,8 @@
 # WorldScript Studio — Codebase Audit Report
 
-**Date:** 2026-04-17 (baseline); **follow-up chain:** … → 2026-05-28 (v1.19.0 — Security/Voice/RTL/Logger B-1..B-8) → **2026-05-30 (B-1 passphrase UX + CI unblock)** → **2026-05-31 (i18n audit + settings features + CI stabilization)** → **2026-05-31 (Edge-AI Perfection Cycle — Phases 0-7 complete)** → **2026-06-01 (Post-crash session: CI stabilisation + 14 CodeAnt AI fixes + E2E hardening)** → **2026-06-02 (Perf Phase 2.3 — pipeline-LRU unification + PR #69 CodeAnt fixes)** → **2026-06-03 (WorkerBus v2 Phase 3 — Rust TaskSupervisor + Tauri-build unblock)** → **2026-06-06 (Phase 3 i18n Expansion — ja/zh/pt/el + Intl APIs)** → **2026-06-09 (v1.21 Deep Audit Correction — Whisper WASM download UI + 3 CodeAnt fixes + CloudSync LWW)** → **2026-06-09 (feat/deep-audit-v1.21 — CSP hardening, zh locale ≤5% EN, coverage Batches A/B/C, VoiceActivityCoordinator B-2 bridge)** → **2026-06-11 (Ultimate Copilot v2 Phase 2+3 — markdown, sidebar, Apply-to-chapter, InlineAnnotation, ProForge chip; PR #110+#111)** → **2026-06-11 (v1.22.0 release — OpenRouter Cloud 5 provider, AI Execution Modes hybrid/cloud/local/eco, AiModeIndicator, SW cache-invalidation fix)** → **2026-06-13/14 (v1.23 perfection batch — OpenRouter + AI-Execution-Mode settings sections localized/modernized, i18n single-brace interpolation bug-class fix + `i18nPlaceholders` regression guard, bundle split + budget tightening PR #130)** → **2026-06-16 (v1.23.0 release — rebrand StoryCraft → WorldScript Studio, local-first data foundation ADR-0008, Tauri blank-screen + asset-URL fixes, AI error taxonomy + retry hardening, command-palette & local-AI settings localization, WorldScript W monogram icons)** → **2026-06-16 (post-release documentation perfection pass — corpus sync, metric reconciliation, history archival, dependabot hardening)** → **2026-06-17 (Language expansion — +6 locales fi/sv/hu/is/eu/fa (RTL); PR #174 merged; `LanguageSelector` exonym localization via `portal.language.names.*`; portal chrome 100 % for the 6 new langs; README/AUDIT/CHANGELOG docs sync)** → **2026-07-28 (v1.24.1 — Local-AI reliability fixes #266, Dependabot backlog triage, Issue #60 audit closeout, security/build hardening)** → **2026-07-29 (v1.24.2, PR #284 — CSP functional-truth, desktop crypto, and doc-truth hardening; the local-inference stack had been silently non-functional in production for two months; merged and tagged)**
+**Date:** 2026-04-17 (baseline); **follow-up chain:** … → 2026-05-28 (v1.19.0 — Security/Voice/RTL/Logger B-1..B-8) → **2026-05-30 (B-1 passphrase UX + CI unblock)** → **2026-05-31 (i18n audit + settings features + CI stabilization)** → **2026-05-31 (Edge-AI Perfection Cycle — Phases 0-7 complete)** → **2026-06-01 (Post-crash session: CI stabilisation + 14 CodeAnt AI fixes + E2E hardening)** → **2026-06-02 (Perf Phase 2.3 — pipeline-LRU unification + PR #69 CodeAnt fixes)** → **2026-06-03 (WorkerBus v2 Phase 3 — Rust TaskSupervisor + Tauri-build unblock)** → **2026-06-06 (Phase 3 i18n Expansion — ja/zh/pt/el + Intl APIs)** → **2026-06-09 (v1.21 Deep Audit Correction — Whisper WASM download UI + 3 CodeAnt fixes + CloudSync LWW)** → **2026-06-09 (feat/deep-audit-v1.21 — CSP hardening, zh locale ≤5% EN, coverage Batches A/B/C, VoiceActivityCoordinator B-2 bridge)** → **2026-06-11 (Ultimate Copilot v2 Phase 2+3 — markdown, sidebar, Apply-to-chapter, InlineAnnotation, ProForge chip; PR #110+#111)** → **2026-06-11 (v1.22.0 release — OpenRouter Cloud 5 provider, AI Execution Modes hybrid/cloud/local/eco, AiModeIndicator, SW cache-invalidation fix)** → **2026-06-13/14 (v1.23 perfection batch — OpenRouter + AI-Execution-Mode settings sections localized/modernized, i18n single-brace interpolation bug-class fix + `i18nPlaceholders` regression guard, bundle split + budget tightening PR #130)** → **2026-06-16 (v1.23.0 release — rebrand StoryCraft → WorldScript Studio, local-first data foundation ADR-0008, Tauri blank-screen + asset-URL fixes, AI error taxonomy + retry hardening, command-palette & local-AI settings localization, WorldScript W monogram icons)** → **2026-06-16 (post-release documentation perfection pass — corpus sync, metric reconciliation, history archival, dependabot hardening)** → **2026-06-17 (Language expansion — +6 locales fi/sv/hu/is/eu/fa (RTL); PR #174 merged; `LanguageSelector` exonym localization via `portal.language.names.*`; portal chrome 100 % for the 6 new langs; README/AUDIT/CHANGELOG docs sync)** → **2026-07-28 (v1.24.1 — Local-AI reliability fixes #266, Dependabot backlog triage, Issue #60 audit closeout, security/build hardening)** → **2026-07-29 (v1.24.2, PR #284 — CSP functional-truth, desktop crypto, and doc-truth hardening; the local-inference stack had been silently non-functional in production for two months; merged and tagged)** → **2026-07-30 (v1.24.3, WorkerBus v2 worker-generation consolidation — 5 stacked PRs #286–288/#290–291 + independent #289 recovered after an interrupted merge queue; ADR-0015; merged and tagged)**
 **Scope:** Full application, repository configuration, CI/CD, documentation, release validation
-**Current version:** **v1.24.2** — released 2026-07-29 (PR #284 merged, tagged `v1.24.2`) — CSP/crypto/doc-truth hardening: `'wasm-unsafe-eval'` restored on all 5 deployment surfaces after a 2-month functional-truth gap; desktop API-key encryption moved from unsalted SHA-256 to PBKDF2 600k + salt; DuckDB-WASM self-hosted; canonical Vercel URL unified; CI Storybook dedup + a genuinely broken test-runner invocation fixed; coverage ratchet raised to CI-measured values; **2849 keys × 19 locales**.
+**Current version:** **v1.24.3** — released 2026-07-30 (PRs #286–291 merged, tagged `v1.24.3`) — DuckDB analytics, local embeddings, and local NLP migrated onto the shared WorkerBus v2 pool (ADR-0015), closing the v1/v2 worker-generation duplication; recovered a merge queue interrupted mid-session by a local editor crash. **2849 keys × 19 locales**; **6477 tests × 529 files** (2026-07-30, CI-reported).
 
 **Quality gate (2026-06-17 — language expansion +6 locales):** lint ✅ · typecheck ✅ · i18n:check ✅ (**2716 keys × 17 locales** — fi/sv/hu/is/eu + fa RTL) · placeholder guard ✅ (17 bundles) · targeted unit tests ✅ (LanguageSelector 9 · I18nContext 59 · i18nPlaceholders 33). `LanguageSelector` exonym labels localized via `portal.language.names.*` (native endonym stays hardcoded by design). **Bulk translation completed** for all 10 Beta locales (glossary v2.0, ~44 anchor terms/locale; placeholder-masked, checkpointed): post-run coverage fi 91 % · sv 90 % · hu 91 % · is 92 % · eu 92 % · fa 93 % · ja 99 % · zh 100 % · pt 98 % · el 97 % (Beta MT; human native review tracked). Two bulk-script bugs fixed: (1) `glossaryTranslate` partial-match left ~1,300 strings partially English → now exact-match only; (2) `--all` mangled `help.json` rich HTML → `help.json` excluded from `--all` (`ALL_SKIP`) and kept English fallback for the 6 new langs (tag-dense markup isn't MT-safe; human-review task). New `docs/TRANSLATION-GUIDE.md` + `I18N-GLOSSARY.md` v2.0.
 

CLAUDE.md

@@ -51,7 +51,7 @@ pnpm run token:audit        # audit-tokens.mjs — design-token usage gate (CI b
 - **OSV vulnerabilities**: Run `pnpm audit` or check the security CI job. Add `pnpm.overrides` with pinned exact versions.
 - Correction loop: fix → commit → verify CI → fix until all jobs green.
 
-**PR review-comment policy — the CodeAnt Correction Loop (proactive, automatic, every PR):** Fix ALL inline comments (CodeAnt AI + any bot/human) on every PR, **without being asked** — this explicitly includes CodeRabbit's collapsed **nitpick** sections and **outside-diff-range** findings (both easy to miss since they're collapsed by default in the review UI), not just its top-level actionable comments. Validate findings against the *current* code (anchors may be stale); implement real **root-cause** fixes (code **+ tests + i18n + docs** in lockstep) or reply with evidence if a false positive. **Never add a new `biome-ignore`** — the suppression ratchet (`scripts/check-suppressions.mjs`) fails the quality gate; refactor so the rule passes honestly. Reply to each thread citing the resolving commit (`POST .../comments/<id>/replies`), resolve it (GraphQL `resolveReviewThread`), leave **0 unresolved**. Then commit, push, and **re-trigger** (`gh pr comment <N> --body "@codeant-ai review"`). **Iron rule — loop until quiescent:** a push triggers a fresh review that often raises NEW findings (a "wave"); repeat the full cycle until **BOTH** a fresh review yields **0 new comments** AND **0 threads unresolved**. Only then merge (auto-squash; admin-squash only after CI is green + loop quiescent). Full canonical procedure: [`docs/CODEANT-REVIEW-LOOP.md`](docs/CODEANT-REVIEW-LOOP.md).
+**PR review-comment policy — the CodeAnt Correction Loop (proactive, automatic, every PR):** Fix ALL inline comments (CodeAnt AI + any bot/human) on every PR, **without being asked** — this explicitly includes CodeRabbit's collapsed **nitpick** sections and **outside-diff-range** findings (both easy to miss since they're collapsed by default in the review UI), not just its top-level actionable comments. Validate findings against the *current* code (anchors may be stale); implement real **root-cause** fixes (code **+ tests + i18n + docs** in lockstep) or reply with evidence if a false positive. **Never add a new `biome-ignore`** — the suppression ratchet (`scripts/check-suppressions.mjs`) fails the quality gate; refactor so the rule passes honestly. Reply to each thread citing the resolving commit (`POST .../comments/<id>/replies`), resolve it (GraphQL `resolveReviewThread`), leave **0 unresolved**. Then commit, push, and **re-trigger** (`gh pr comment <N> --body "@codeant-ai review"`). **Iron rule — loop until quiescent:** a push triggers a fresh review that often raises NEW findings (a "wave"); repeat the full cycle until **BOTH** a fresh review yields **0 new comments** AND **0 threads unresolved**. Only then merge (auto-squash; admin-squash only after CI is green + loop quiescent). **In practice, CodeRabbit is the bot that actually posts inline comments** — re-trigger it too (`@coderabbitai review`) and check its **full review history**, not just the latest status (a "rate limited" latest status can hide an earlier real review). CodeAnt shows up as 5 CI status checks to verify green, not an inline-comment thread. Full canonical procedure: [`docs/CODEANT-REVIEW-LOOP.md`](docs/CODEANT-REVIEW-LOOP.md).
 
 **PR-size limit — keep every PR under ~100 changed files so CodeAnt actually reviews it.** CodeAnt does **not** post inline review comments on PRs that exceed ~100 changed files (the >100-file check hangs/skips). Since any i18n-touching change fans out across 19 locale source files + 19 rebuilt `bundle.json` per module, a multi-feature branch crosses 100 fast. **Before pushing, run `git diff --name-only <base>...HEAD | wc -l`.** If it is over ~100, split the work into the **fewest** stacked PRs that each stay clearly under the limit — group by which locale module-files they touch so the per-PR fan-out stays small (e.g. P0 batch touching `writer.json`; P1/P2 batch touching `common.json`/`dashboard.json`). Stack them (PR2 base = PR1's branch) so each PR's incremental diff — what CodeAnt sees — is small; when PR1 merges, PR2 auto-retargets to `main`. **Do not** make more PRs than needed: if everything fits under ~100 in one (or two) PRs, use that. Keep commits atomic per concern regardless of how they are bundled into PRs.
 

KIMI-INSTRUCT.md

@@ -40,6 +40,13 @@ Dieses Projekt läuft auf Low-End-Hardware. Beachte strikt:
 
 Dieser Workflow ist die Standardvorgehensweise, wenn der Nutzer um Behebung von CodeAnt-Kommentaren bittet.
 
+> **In der Praxis (Beobachtung 2026-07-30):** Der Bot, der tatsächlich Inline-Kommentare postet, ist
+> **CodeRabbit** (`@coderabbitai review` zum erneuten Triggern) — nicht CodeAnt AI. CodeAnt AI
+> erscheint als 5 CI-Status-Checks (`CodeAnt - Quality Gates/SAST/SCA/SCR/Test Coverage`), die auf
+> Grün geprüft werden, aber kein Kommentar-Thread zum Beantworten/Resolven sind. Wende den Loop
+> unten auf den Bot an, der tatsächlich Kommentare postet — prüfe dabei die komplette Review-Historie,
+> nicht nur den letzten Status (ein „rate limited"-Status kann eine frühere echte Review verdecken).
+
 ### 3.1 Threads abrufen
 
 Nutze **GitHub GraphQL** über `gh api graphql`, um den Status aller Review-Threads zu sehen: