feat: add durable encryption migration journal

.github/copilot-instructions.md

@@ -167,7 +167,7 @@ On any non-trivial code change add a single-line comment explaining **why**, not
 ### Git & CI
 
 - Conventional Commits format: `feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`
-- Pre-commit: `simple-git-hooks` runs Biome check on staged files
+- Pre-commit: after explicit `pnpm run hooks:install`, `simple-git-hooks` runs Biome on staged files; CI is mandatory regardless
 - **⚠️ Constrained local hardware — do NOT run heavy suites locally.** This machine has ~3–4 GB RAM. **Never** run the full Vitest **coverage** suite, **Playwright E2E**, **Stryker mutation**, **Lighthouse CI**, or the **Storybook test-runner** locally — they are **CI-only by design**. Run **one heavy command at a time** (no parallel `vitest`/`biome`/`tsc`/`vite`).
 - Local preflight (sequential, minimal): `pnpm run lint` → `pnpm run typecheck` → `pnpm run i18n:check` (only when locale JSON changed) → **targeted** `pnpm exec vitest run <path>` (no `--coverage`). Run `pnpm run build && pnpm run smoke:prod` only when you touched `vite.config.ts`, `packages/ai-core`, or `workers/`. Coverage, E2E, Lighthouse, Stryker, and Storybook are **CI gate jobs** — let GitHub Actions run them.
 - CI pipeline (see [`docs/CI.md`](../docs/CI.md)): **`security` → `quality`** (Biome + `tsc` + Vitest matrix) **→ `build` / `e2e` / `storybook` in parallel** → **`lighthouse`** after build → **`deploy`** on `main` after build+e2e

AGENTS.md

@@ -139,7 +139,7 @@ WorldScript-Studio/
 - `vitest.config.ts` — coverage thresholds (lines 74, branches 60, functions 67, statements 72), `maxWorkers: 1`
 - `playwright.config.ts` — E2E projects: Chromium desktop + Pixel 5 mobile in CI; Firefox + optional mobile locally
 - `turbo.json` — task graph for `build`, `dev`, `lint`, `typecheck`, `test`, `mutation`
-- `pnpm-workspace.yaml` — workspace packages + `onlyBuiltDependencies` allowlist
+- `pnpm-workspace.yaml` — workspace packages + pnpm v11 `allowBuilds` default-deny map
 - `stryker.conf.json` — ~20 mutation targets (services + features), `break: 75`
 - `.lighthouserc.cjs` — accessibility `error` ≥ 0.95, CLS `error` ≤ 0.1, performance/SEO `warn`
 - `src-tauri/tauri.conf.json` / `Cargo.toml` — desktop window config, CSP, updater endpoints, rust-compute feature
@@ -258,7 +258,8 @@ On any non-trivial change, add a single-line comment explaining **why**, not wha
 ### Commit Messages
 
 Conventional Commits: `feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`.
-Pre-commit hook runs `biome check --write` on staged files via `simple-git-hooks` + `lint-staged`.
+After an explicit `pnpm run hooks:install`, the pre-commit hook runs `biome check --write` on staged
+files via `simple-git-hooks` + `lint-staged`; CI remains mandatory when hooks are not installed.
 
 ---
 

AUDIT.md

@@ -113,7 +113,7 @@ the same root cause in one sprint is itself the finding: **the failure mode is n
 - **Rebrand residue:** ADR-0008 present-tense "StoryCraft is offline-first" → "WorldScript Studio". Remaining `storycraft*` hits are intentional historical records (CHANGELOG version entries, archived sprints) or technical identifiers that were genuine at their version — left intact.
 - **GitHub releases:** 6 historical release titles renamed StoryCraft → WorldScript (v1.3.0, v1.5.0, v1.7.0, v1.17.0, v1.20.0, v1.21.0); v1.23.0 release/tag verified correct (latest, full changelog, tag → `fbaa33c3`).
 - **GitHub Packages:** orphaned `storycraft-studio` GHCR container image to be deleted so only `worldscript-studio` remains (requires `delete:packages` token scope — pending maintainer auth refresh).
-- **Dependabot hardening:** added `cooldown: default-days: 7` to all three `.github/dependabot.yml` ecosystems so newly released versions age 7 days before a PR is opened — matched to the `.npmrc` `minimum-release-age=10080` (7-day) supply-chain quarantine already enforced at pnpm install-time, so a version is never PR'd before `pnpm install --frozen-lockfile` would accept it (`.github/dependabot.yml` is the source of truth for the cooldown value). Open queue handled per the CodeAnt Correction Loop: #150 candle-nn merged; #151 candle-core rebased + re-running; #152 dev-tooling fixed at root (dual `playwright-core` deduped to 1.61.0 via `pnpm-workspace.yaml` override); #154/#155 are blocked solely by the `minimum-release-age` quarantine (packages too fresh — working as designed) and clear once aged.
+- **Dependabot hardening:** added `cooldown: default-days: 7` to all three `.github/dependabot.yml` ecosystems so newly released versions age 7 days before a PR is opened — matched to the `pnpm-workspace.yaml` `minimumReleaseAge: 10080` (7-day) supply-chain quarantine enforced at pnpm install-time, so a version is never PR'd before `pnpm install --frozen-lockfile` would accept it (`.github/dependabot.yml` is the source of truth for the cooldown value). Open queue handled per the CodeAnt Correction Loop: #150 candle-nn merged; #151 candle-core rebased + re-running; #152 dev-tooling fixed at root (dual `playwright-core` deduped to 1.61.0 via `pnpm-workspace.yaml` override); #154/#155 are blocked solely by the `minimumReleaseAge` quarantine (packages too fresh — working as designed) and clear once aged.
 
 ## v1.23 i18n Interpolation Bug-Class Fix + Regression Guard (2026-06-14)
 
@@ -260,7 +260,7 @@ the same root cause in one sprint is itself the finding: **the failure mode is n
 | `package.json` | Added `@typescript/native-preview@beta` and `@typescript/typescript6` alias |
 | `tsconfig.tsgo.json` | New tsgo-specific config (excludes `vite/client` types) |
 | `.github/workflows/ci.yml` | Updated typecheck step to use tsgo |
-| `.npmrc` | Disabled `strict-peer-dependencies` for tsgo compatibility |
+| `pnpm-workspace.yaml` | Disabled `strictPeerDependencies` for tsgo compatibility |
 | `pnpm-workspace.yaml` | Added `strictPeerDependencies: false` |
 | `docs/TS7-MIGRATION.md` | Migration guide created |
 
@@ -1744,9 +1744,9 @@ WorldScript Studio was assessed as a strong, modern React/TypeScript application
 
 | Status | Item |
 |--------|------|
-| ✅ | Added `strict-dep-builds=true` to `.npmrc` |
-| ✅ | Added `block-exotic-subdeps=true` to `.npmrc` |
-| ✅ | Added `minimum-release-age=10080` (7 days) to `.npmrc` |
+| ✅ | Added `strictDepBuilds: true` to `pnpm-workspace.yaml` |
+| ✅ | Added `blockExoticSubdeps: true` to `pnpm-workspace.yaml` |
+| ✅ | Added `minimumReleaseAge: 10080` (7 days) to `pnpm-workspace.yaml` |
 | ✅ | Added security justification comments to `pnpm-workspace.yaml` overrides |
 
 ### OpenRouter Provider Hardening (P1)
@@ -1834,7 +1834,7 @@ several apply only to dev/test transitive deps and are never shipped to users.
 **Dependency hygiene status (2026-06-13):**
 - `pnpm audit --audit-level=high` → 0 vulnerabilities.
 - `pnpm audit --audit-level=moderate` → 0 vulnerabilities.
-- `.npmrc` hardening active: `strict-dep-builds=true`, `block-exotic-subdeps=true`, `minimum-release-age=10080`.
+- `pnpm-workspace.yaml` hardening active: `strictDepBuilds: true`, `blockExoticSubdeps: true`, `minimumReleaseAge: 10080`.
 - `pnpm outdated` (re-run 2026-06-13): only non-critical patch/minor drift — `@ai-sdk/google|openai|react`, `ai`, `@storybook/*` + `storybook` (10.4.2→10.4.4), `@types/node`, `docx`, `dompurify`, `lint-staged`, `turbo`, `yjs`, `zustand`, `wrangler`. No major versions. `@duckdb/duckdb-wasm` (1.32.0) and `@typescript/native-preview` are dev/pre-release tracks and intentionally pinned.
 
 **Plugin sandbox post-fix validation (2026-06-13):** The v1.22 plugin-isolation hardening

README.md

@@ -12,7 +12,7 @@
   <img src="https://img.shields.io/badge/Version-v1.26.0-6366F1" alt="v1.26.0">
   <img src="https://img.shields.io/badge/Storage-IndexedDB_v8-F59E0B" alt="IndexedDB v8">
   <img src="https://img.shields.io/badge/PWA-v3.0-5BB974?logo=pwa" alt="PWA v3.0">
-  <img src="https://img.shields.io/badge/i18n-19_locales-2897_keys-0EA5E9" alt="i18n 19 locales — 2897 keys">
+  <img src="https://img.shields.io/badge/i18n-19_locales-2904_keys-0EA5E9" alt="i18n 19 locales — 2904 keys">
   <img src="https://img.shields.io/badge/Tests-6477%2B_%2F_532_files-22C55E" alt="6477+ tests / 532 files">
   <img src="https://img.shields.io/codecov/c/github/qnbs/WorldScript-Studio?logo=codecov&label=Coverage" alt="Codecov Coverage">
   <img src="https://img.shields.io/badge/License-MIT-22C55E" alt="License MIT">
@@ -397,7 +397,7 @@ Infrastructure-level features that keep the app fast and extensible as projects
 
 ### 🌐 Full Multi-Language Support
 
-Shipped UI locales with **2897 i18n keys** across all 19 languages — zero hardcoded user-facing strings:
+Shipped UI locales with **2904 i18n keys** across all 19 languages — zero hardcoded user-facing strings:
 
 - 🇩🇪 **German** (Deutsch)
 - 🇬🇧 **English**
@@ -506,7 +506,7 @@ The Settings → AI panel shows a live GPU status badge with adapter details and
 | **PDF Export**       | jsPDF                                                     | Client-side, configurable PDF document generation                    |
 | **Document Export**  | docx + jszip                                              | Word-compatible `.docx` generation (lazy-loaded)                     |
 | **PWA**              | Service Worker + Web App Manifest v3                     | Offline support, installability, Workbox chunking                    |
-| **i18n**             | Custom React Context (`I18nContext.tsx`)                  | 2897 keys × 19 locales (de/en/es/fr/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu/ru/ko Beta); EN fallback; `localStorage` persistence |
+| **i18n**             | Custom React Context (`I18nContext.tsx`)                  | 2904 keys × 19 locales (de/en/es/fr/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu/ru/ko Beta); EN fallback; `localStorage` persistence |
 | **Testing**          | Vitest 4.x (6477+ tests / 532 files) + Playwright E2E     | Unit/integration + cross-browser E2E; Stryker mutation (manual workflow)          |
 | **Code Quality**     | Biome (lint + format) + TypeScript 7 (tsgo) strict       | `--error-on-warnings` in CI; zero `any` policy                      |
 | **Visualization**    | Force-directed graph                                      | Interactive character relationship network                           |
@@ -708,7 +708,7 @@ The main pipeline is [`.github/workflows/ci.yml`](.github/workflows/ci.yml). Opt
 **Current test metrics (2026-07-30, CI-reported):**
 - **6477+ unit tests** across **532 test files** — all passing
 - Coverage thresholds: lines ≥ 74 · branches ≥ 60 · functions ≥ 67 · statements ≥ 72 — enforced in CI (see Codecov badge for live metrics)
-- i18n: **2897 keys × 19 locales** (en/de/fr/es/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu Beta)
+- i18n: **2904 keys × 19 locales** (en/de/fr/es/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu/ru/ko Beta)
 
 **CI-cloud-first workflow (recommended):** On constrained hardware run **`pnpm run lint && pnpm run i18n:check && pnpm run typecheck`** locally, then push and let CI handle coverage, E2E, Lighthouse, and Stryker. Authoritative numbers come from CI artifacts (Codecov, JUnit). After CI goes green, update the README badges and `AUDIT.md` quality-gate line from the reported metrics. See **[`docs/CI.md`](docs/CI.md) § Cloud CI-first vs local development** for the full post-merge doc-update checklist.
 

TODO.md

@@ -155,7 +155,7 @@ are all version-bumped and synced for this release.
 
 ## Dependency-Hygiene Backlog (carried forward)
 
-> `.npmrc` Hardening (`strict-dep-builds=true`, `block-exotic-subdeps=true`, `minimum-release-age=10080`) ist bereits aktiv.
+> `pnpm-workspace.yaml` hardening (`strictDepBuilds: true`, `blockExoticSubdeps: true`, `minimumReleaseAge: 10080`) is active.
 > `pnpm audit --audit-level=high` → 0 vulnerabilities; `pnpm audit --audit-level=moderate` → 0 vulnerabilities.
 > Aktueller Status in `AUDIT.md` § *Known Overrides Table*.
 
@@ -281,7 +281,7 @@ are all version-bumped and synced for this release.
 - ✅ **Production blank screen — zod/rolldown DCE** (2026-06-02) — `init_locales is not defined`: rolldown's prod DCE dropped zod's `__esm` init wrappers (zod `sideEffects:false`). Fixed via `patches/zod@4.4.3.patch` (`sideEffects:true`). Added `smoke:prod` (headless mount check on built `dist/`) to CI build job + `unhandledrejection` startup handler — closes the dev-mode-E2E blind spot
 - 🔄 **C-6** — ar/he UI translation **complete** (2026-06-03): 18 modules translated in `locales/{ar,he}/` (help.json English fallback), Noto fonts + RTL shell layout shipped as Beta. Remaining: native-speaker review + help-article prose — community task. See `docs/I18N-GLOSSARY-RTL.md`
 - 🔄 **C-7 remainder** — Coverage → L85%/B75%/F80%; Stryker break 75→80 (current thresholds: L73/F65/B58). **Phase 3 started (2026-06-02):** +33 LoRA tests (useLoraView, training wizard, sub-panels — were 0%)
-- 🟡 IDB at-rest encryption lifecycle (2026-08-11 reconciliation) — startup unlock, session lock, and fail-closed protected writes are implemented. Disable, forgot-passphrase deletion, and passphrase rotation are intentionally blocked until a durable cross-database migration journal and recovery protocol exist; do not describe them as completed.
+- 🟡 IDB at-rest encryption lifecycle (2026-08-11 reconciliation) — startup unlock, session lock, fail-closed protected writes, and a versioned single-owner migration journal are implemented. Disable, forgot-passphrase deletion, and passphrase rotation are intentionally blocked until per-store conversion, verification, cross-tab recovery, and recovery UX exist; do not describe them as completed.
 - ✅ **P0-2** — Plugin worker isolation (`workers/plugin.worker.ts`) — routes plugin execution to isolated worker context with timeout and sandboxed API
 - 🟡 **P0-4** — DuckDB OPFS at-rest encryption (`services/duckdb/duckdbEncryption.ts`) — cell-level encryption is now wired for the one column holding literal manuscript prose, `codex_mentions.excerpt` (v1.25.0): `duckdbCodexWrite()` encrypts it into `excerpt_enc BLOB` when `enableIdbAtRestEncryption` is active, with `services/duckdb/codexExcerptEncryptionMigration.ts` backfilling pre-existing plaintext rows. Full OPFS **file-level** encryption remains infeasible (DuckDB-WASM owns the OPFS file handle directly) and is an accepted, permanent limitation, not a remaining task — see `.github/SECURITY.md` SEC-6.
 - ✅ **P0-5** — Voice WASM model download UI (`components/voice/VoiceModelDownloadModal.tsx`) — progress modal for Whisper/Kokoro model downloads with cancel/retry