feat: add durable encryption migration journal

App.tsx

@@ -67,7 +67,6 @@ import { pluginRegistry } from './services/pluginRegistry';
 import { repairProjectI18nFields } from './services/projectI18nRepair';
 import { hasCompletedSpotlightTour, startSpotlightTour } from './services/spotlightTour';
 import {
-  clearIdbPassphrase,
   hasPassphraseSentinel,
   isIdbEncryptionReady,
 } from './services/storage/storageEncryptionService';
@@ -196,15 +195,6 @@ const App: FC<AppProps> = ({ isNewUser }) => {
   const isIdbUnlockOpen = useTransientUiStore((s) => s.isIdbUnlockOpen);
   const setIdbUnlockOpen = useTransientUiStore((s) => s.setIdbUnlockOpen);
 
-  // QNBS-v3: escape hatch — clears sentinel + disables flag so the app is accessible again
-  const handleForgotPassphrase = useCallback(async () => {
-    await clearIdbPassphrase();
-    dispatch(featureFlagsActions.setEnableIdbAtRestEncryption(false));
-    setIdbUnlockOpen(false);
-    // QNBS-v3: WCAG 4.1.3 — assertive announcement so screen reader users know the security state changed
-    announce(t('settings.privacy.encryptionDisabledStatus'), 'assertive');
-  }, [dispatch, setIdbUnlockOpen, announce, t]);
-
   // Collaboration Panel State
   const [isCollabPanelOpen, setIsCollabPanelOpen] = useState(false);
 
@@ -256,6 +246,14 @@ const App: FC<AppProps> = ({ isNewUser }) => {
     }
   }, [settings.appearancePreset]);
 
+  useEffect(() => {
+    // QNBS-v3: Decorative fixed layers are opt-out so long-form writers can keep a neutral canvas.
+    document.body.classList.toggle(
+      'writing-surface-plain',
+      settings.writingSurfaceStyle === 'plain',
+    );
+  }, [settings.writingSurfaceStyle]);
+
   useEffect(() => {
     document.body.classList.toggle(
       'accessibility-high-contrast',
@@ -809,10 +807,7 @@ const App: FC<AppProps> = ({ isNewUser }) => {
               )}
               {isIdbUnlockOpen && (
                 <ErrorBoundary onReset={() => setIdbUnlockOpen(false)}>
-                  <IdbUnlockModal
-                    onUnlocked={() => setIdbUnlockOpen(false)}
-                    onForgotPassphrase={() => void handleForgotPassphrase()}
-                  />
+                  <IdbUnlockModal onUnlocked={() => setIdbUnlockOpen(false)} />
                 </ErrorBoundary>
               )}
             </div>

README.md

@@ -307,20 +307,21 @@ Real-time P2P co-editing via **Yjs + collab-transport** (vendor fork of y-webrtc
 
 ### 🔒 IDB At-Rest Encryption _(B-1, v1.19.0)_
 
-All project data, snapshots, and settings stored in IndexedDB can be encrypted at rest via `services/storage/storageEncryptionService.ts`:
+The current primary project, settings, snapshot, image, Codex, RAG, and binder-asset IndexedDB paths can be encrypted at rest via `services/storage/storageEncryptionService.ts`. This is not yet a claim that every IndexedDB surface is covered:
 
 - **AES-256-GCM** with a PBKDF2-derived key (600 000 iterations, SHA-256, 32-byte random salt).
-- Gated behind `featureFlags.enableIdbAtRestEncryption` (on by default since v1.23; the passphrase unlock UX is complete — Settings → Privacy).
+- Gated behind `featureFlags.enableIdbAtRestEncryption`. When a library is configured but locked, protected reads and writes fail closed rather than falling back to plaintext.
+- Disable and passphrase rotation are temporarily unavailable until a journaled, cross-store migration protocol can prove recovery after interruption.
 - Same passphrase-entry unlock screen (`IdbUnlockModal`) on cold start, session-scoped in-memory key, on **both** the web build and the Tauri desktop build — Tauri's WebView uses the same IndexedDB-backed storage path, not an OS keychain. (No `tauri-plugin-stronghold` or equivalent OS-keychain integration ships today — see the API-key encryption note below for the desktop-specific mechanism that does exist.)
-- GDPR-compliant: encrypted blobs are unreadable without the passphrase, even from the browser profile directory.
+- At-rest protection reduces disclosure from an extracted browser profile while the library is locked; it does not protect an unlocked renderer, a compromised device, or every persistence surface.
 
 ### 🔐 Encrypted Library Backup
 
 One-click encrypted export of your entire project library from **Settings → Data**:
 
 - Archives all projects as a **ZIP** containing `META.json` + `vault.bin`.
 - `vault.bin` is encrypted with **AES-256-GCM** — the decryption key is derived from your chosen passphrase using PBKDF2.
-- No plaintext project data ever leaves your device unencrypted.
+- The encrypted vault holds its project payload in `vault.bin`; users must still protect the downloaded archive and should not confuse it with ordinary plaintext JSON export.
 - Import on any device using the same passphrase to restore your full library.
 
 ### 🔑 Encryption — which mechanism protects what

TODO.md

@@ -281,7 +281,7 @@ are all version-bumped and synced for this release.
 - ✅ **Production blank screen — zod/rolldown DCE** (2026-06-02) — `init_locales is not defined`: rolldown's prod DCE dropped zod's `__esm` init wrappers (zod `sideEffects:false`). Fixed via `patches/zod@4.4.3.patch` (`sideEffects:true`). Added `smoke:prod` (headless mount check on built `dist/`) to CI build job + `unhandledrejection` startup handler — closes the dev-mode-E2E blind spot
 - 🔄 **C-6** — ar/he UI translation **complete** (2026-06-03): 18 modules translated in `locales/{ar,he}/` (help.json English fallback), Noto fonts + RTL shell layout shipped as Beta. Remaining: native-speaker review + help-article prose — community task. See `docs/I18N-GLOSSARY-RTL.md`
 - 🔄 **C-7 remainder** — Coverage → L85%/B75%/F80%; Stryker break 75→80 (current thresholds: L73/F65/B58). **Phase 3 started (2026-06-02):** +33 LoRA tests (useLoraView, training wizard, sub-panels — were 0%)
-- ✅ IDB at-rest encryption UX (2026-06-02 reconciliation) — `IdbUnlockModal` (startup unlock + 2-step forgot-passphrase escape hatch, `App.tsx:182-188,638-643`), `PassphraseModal` (set/change/disable), real read/write gating `idbProjectStore.ts:209-265`, session lock + key rotation (Phase 1). `enableIdbAtRestEncryption` flag in Settings › Privacy with ⚠ warning
+- 🟡 IDB at-rest encryption lifecycle (2026-08-11 reconciliation) — startup unlock, session lock, fail-closed protected writes, and a versioned single-owner migration journal are implemented. Disable, forgot-passphrase deletion, and passphrase rotation are intentionally blocked until per-store conversion, verification, cross-tab recovery, and recovery UX exist; do not describe them as completed.
 - ✅ **P0-2** — Plugin worker isolation (`workers/plugin.worker.ts`) — routes plugin execution to isolated worker context with timeout and sandboxed API
 - 🟡 **P0-4** — DuckDB OPFS at-rest encryption (`services/duckdb/duckdbEncryption.ts`) — cell-level encryption is now wired for the one column holding literal manuscript prose, `codex_mentions.excerpt` (v1.25.0): `duckdbCodexWrite()` encrypts it into `excerpt_enc BLOB` when `enableIdbAtRestEncryption` is active, with `services/duckdb/codexExcerptEncryptionMigration.ts` backfilling pre-existing plaintext rows. Full OPFS **file-level** encryption remains infeasible (DuckDB-WASM owns the OPFS file handle directly) and is an accepted, permanent limitation, not a remaining task — see `.github/SECURITY.md` SEC-6.
 - ✅ **P0-5** — Voice WASM model download UI (`components/voice/VoiceModelDownloadModal.tsx`) — progress modal for Whisper/Kokoro model downloads with cancel/retry

components/ApiKeySection.tsx

@@ -8,6 +8,16 @@ import { Button } from './ui/Button';
 import { Input } from './ui/Input';
 import { Spinner } from './ui/Spinner';
 
+// QNBS-v3: Reject non-printing control input without binding Gemini acceptance to a historical key prefix.
+const containsAsciiControlCharacter = (value: string): boolean =>
+  Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return code < 0x20 || code === 0x7f;
+  });
+
+export const isSyntacticallySafeGeminiApiKey = (value: string): boolean =>
+  value.length <= 4096 && !containsAsciiControlCharacter(value);
+
 export const ApiKeySection: FC = () => {
   const { t } = useTranslation();
   const [apiKey, setApiKey] = useState('');
@@ -45,18 +55,20 @@ export const ApiKeySection: FC = () => {
   }, [checkKeyStatus]);
 
   const handleSaveKey = async () => {
-    if (!apiKey.trim()) {
+    const normalizedKey = apiKey.trim();
+    if (!normalizedKey) {
       setMessage({ type: 'error', text: t('settings.apiKey.errorEmpty') });
       return;
     }
-    if (!apiKey.trim().startsWith('AIza')) {
+    if (!isSyntacticallySafeGeminiApiKey(normalizedKey)) {
       setMessage({ type: 'error', text: t('settings.apiKey.errorInvalid') });
       return;
     }
     setIsSaving(true);
     setMessage(null);
     try {
-      await dbService.saveGeminiApiKey(apiKey.trim());
+      // QNBS-v3: Provider validation, not an historical prefix, determines credential validity.
+      await dbService.saveGeminiApiKey(normalizedKey);
       invalidateAiClientCache();
       setApiKey('');
       setHasKey(true);
@@ -296,7 +308,7 @@ export const ApiKeySection: FC = () => {
                   value={apiKey}
                   onChange={(e) => setApiKey(e.target.value)}
                   onKeyDown={(e) => e.key === 'Enter' && handleSaveKey()}
-                  placeholder="AIza..."
+                  placeholder={t<string>('settings.apiKey.inputLabel')}
                   autoComplete="off"
                   className="pr-10"
                 />

components/lora/LoraOnboarding.tsx

@@ -13,17 +13,24 @@ interface EnvStatus {
   unslothAvailable: boolean;
   cudaAvailable: boolean;
   vramGb: number;
+  pythonVersion: string;
+  pythonPath?: string;
+  lastError?: string;
   message?: string;
 }
 
 // QNBS-v3: Dynamic import to enable code-splitting — loraTrainingService is also dynamically imported in thunks.
 const useLoraTrainingService = () => {
   const [api, setApi] = useState<{
     checkTrainingEnvironment: () => Promise<Omit<EnvStatus, 'loaded'>>;
+    selectPythonExecutable: () => Promise<Omit<EnvStatus, 'loaded'> | null>;
   } | null>(null);
   useEffect(() => {
     void import('../../services/lora/loraTrainingService').then((m) => {
-      setApi({ checkTrainingEnvironment: m.checkTrainingEnvironment });
+      setApi({
+        checkTrainingEnvironment: m.checkTrainingEnvironment,
+        selectPythonExecutable: m.selectPythonExecutable,
+      });
     });
   }, []);
   return api;
@@ -52,8 +59,10 @@ export default React.memo(function LoraOnboarding({ onDismiss }: { onDismiss: ()
     unslothAvailable: false,
     cudaAvailable: false,
     vramGb: 0,
+    pythonVersion: '',
   });
   const api = useLoraTrainingService();
+  const [isSelectingPython, setIsSelectingPython] = useState(false);
 
   useEffect(() => {
     if (!api) return;
@@ -62,6 +71,24 @@ export default React.memo(function LoraOnboarding({ onDismiss }: { onDismiss: ()
     });
   }, [api]);
 
+  const handleSelectPython = async () => {
+    if (!api) return;
+    setIsSelectingPython(true);
+    try {
+      const result = await api.selectPythonExecutable();
+      if (result) setEnv({ loaded: true, ...result });
+    } catch (error) {
+      // QNBS-v3: Keep the failed manual selection visible instead of falsely reporting Python as absent.
+      setEnv((current) => ({
+        ...current,
+        loaded: true,
+        lastError: error instanceof Error ? error.message : 'python_selection_failed',
+      }));
+    } finally {
+      setIsSelectingPython(false);
+    }
+  };
+
   return (
     <div className="flex flex-col gap-6 rounded-sc-xl border border-[var(--sc-border-default)] bg-[var(--sc-surface-base)] p-6 shadow-sm">
       <div className="space-y-2">
@@ -96,7 +123,9 @@ export default React.memo(function LoraOnboarding({ onDismiss }: { onDismiss: ()
               label="Python 3.10+"
               ok={env.pythonAvailable}
               detail={
-                env.pythonAvailable ? t('lora.onboarding.installed') : t('lora.onboarding.notFound')
+                env.pythonAvailable
+                  ? [env.pythonVersion, env.pythonPath].filter(Boolean).join(' · ')
+                  : (env.lastError ?? t('lora.onboarding.notFound'))
               }
             />
             <StatusRow
@@ -118,6 +147,14 @@ export default React.memo(function LoraOnboarding({ onDismiss }: { onDismiss: ()
         {env.message && (
           <p className="text-xs text-[var(--sc-danger-fg)]">{t('lora.onboarding.envError')}</p>
         )}
+        <button
+          type="button"
+          onClick={() => void handleSelectPython()}
+          disabled={!api || isSelectingPython}
+          className="text-sm text-[var(--sc-interactive-primary)] underline underline-offset-2 disabled:cursor-not-allowed disabled:opacity-60 focus-visible:ring-2 focus-visible:ring-[var(--sc-border-focus)]"
+        >
+          {isSelectingPython ? t('lora.onboarding.checking') : t('lora.onboarding.selectPython')}
+        </button>
       </div>
 
       <button