diff --git a/AGENTS.md b/AGENTS.md
index c3447c8dd..c365b4ded 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -318,10 +318,16 @@ procedure.
   test or a changed-file lint run. Optionally: `pnpm exec vitest run <path>` **without**
   `--coverage`.
 - **Dependency state:** `pnpm run deps:verify` compares a content fingerprint of dependency
-  manifests, workspace package manifests, and patches. After a dependency-related branch switch,
-  run `node scripts/dependency-state.mjs reconcile` (or `pnpm run deps:reconcile` when pnpm can
-  start); never use `--no-verify` as the
-  normal recovery path.
+  manifests, workspace package manifests, and patches — checked only by `deps:verify`,
+  `ci:prepush`, and the pre-commit hook, not by arbitrary `pnpm run <script>` calls. After a
+  dependency-related branch switch, run `node scripts/dependency-state.mjs reconcile` (or
+  `pnpm run deps:reconcile` when pnpm can start); never use `--no-verify` as the normal recovery
+  path. This same reconcile command — never a bare `pnpm install` — is also the correct way to
+  bootstrap `node_modules` on a brand-new worktree: the bare form skips `--frozen-lockfile` and
+  can silently rewrite `pnpm-lock.yaml` on any drift instead of failing loudly, which is worst
+  exactly on a branch that isn't supposed to touch dependencies at all (e.g. a GitHub-Actions-only
+  Dependabot bump) — a stale fingerprint from that bare install goes undetected until one of the
+  three commands above actually runs.
 - **Low-resource policy:** Never run Biome, multiple TypeScript checkers, Vitest, Cargo, Vite,
   Storybook, or other heavyweight processes concurrently on the development workstation. Full
   repository lint/tests, E2E, coverage, Lighthouse, and mutation testing are cloud-CI work unless
diff --git a/AUDIT.md b/AUDIT.md
index a1d9dd2c7..849759863 100644
--- a/AUDIT.md
+++ b/AUDIT.md
@@ -2,7 +2,9 @@
 
 **Date:** 2026-04-17 (baseline); **follow-up chain:** … → 2026-05-28 (v1.19.0 — Security/Voice/RTL/Logger B-1..B-8) → **2026-05-30 (B-1 passphrase UX + CI unblock)** → **2026-05-31 (i18n audit + settings features + CI stabilization)** → **2026-05-31 (Edge-AI Perfection Cycle — Phases 0-7 complete)** → **2026-06-01 (Post-crash session: CI stabilisation + 14 CodeAnt AI fixes + E2E hardening)** → **2026-06-02 (Perf Phase 2.3 — pipeline-LRU unification + PR #69 CodeAnt fixes)** → **2026-06-03 (WorkerBus v2 Phase 3 — Rust TaskSupervisor + Tauri-build unblock)** → **2026-06-06 (Phase 3 i18n Expansion — ja/zh/pt/el + Intl APIs)** → **2026-06-09 (v1.21 Deep Audit Correction — Whisper WASM download UI + 3 CodeAnt fixes + CloudSync LWW)** → **2026-06-09 (feat/deep-audit-v1.21 — CSP hardening, zh locale ≤5% EN, coverage Batches A/B/C, VoiceActivityCoordinator B-2 bridge)** → **2026-06-11 (Ultimate Copilot v2 Phase 2+3 — markdown, sidebar, Apply-to-chapter, InlineAnnotation, ProForge chip; PR #110+#111)** → **2026-06-11 (v1.22.0 release — OpenRouter Cloud 5 provider, AI Execution Modes hybrid/cloud/local/eco, AiModeIndicator, SW cache-invalidation fix)** → **2026-06-13/14 (v1.23 perfection batch — OpenRouter + AI-Execution-Mode settings sections localized/modernized, i18n single-brace interpolation bug-class fix + `i18nPlaceholders` regression guard, bundle split + budget tightening PR #130)** → **2026-06-16 (v1.23.0 release — rebrand StoryCraft → WorldScript Studio, local-first data foundation ADR-0008, Tauri blank-screen + asset-URL fixes, AI error taxonomy + retry hardening, command-palette & local-AI settings localization, WorldScript W monogram icons)** → **2026-06-16 (post-release documentation perfection pass — corpus sync, metric reconciliation, history archival, dependabot hardening)** → **2026-06-17 (Language expansion — +6 locales fi/sv/hu/is/eu/fa (RTL); PR #174 merged; `LanguageSelector` exonym localization via `portal.language.names.*`; portal chrome 100 % for the 6 new langs; README/AUDIT/CHANGELOG docs sync)** → **2026-07-28 (v1.24.1 — Local-AI reliability fixes #266, Dependabot backlog triage, Issue #60 audit closeout, security/build hardening)** → **2026-07-29 (v1.24.2, PR #284 — CSP functional-truth, desktop crypto, and doc-truth hardening; the local-inference stack had been silently non-functional in production for two months; merged and tagged)** → **2026-07-30 (v1.24.3, WorkerBus v2 worker-generation consolidation — 5 stacked PRs #286–288/#290–291 + independent #289 recovered after an interrupted merge queue; ADR-0015; merged and tagged)** → **2026-08-12 (encryption lifecycle + desktop reliability + recovery journal — stacked PRs #335/#336/#337 merged into `main`; fail-closed IDB encryption lifecycle, desktop AI/Python provider hardening for #332/#333, durable resumable migration journal with secondary-store adapters; PR #339 closes the write-vs-migration TOCTOU race CodeRabbit and Qodo independently found on #337; PR #310 closed as superseded; Phase-4 production wiring for disable/rotate tracked as issue #338)** → **2026-08-13 (v1.27.0 — Phase 4 encryption disable/rotate production wiring + i18n (#342/#343 close issue #338), Tauri desktop boot-hydration + flush-on-quit + Settings re-render perf fixes (#332, PR #345), AI Writing Studio unreadable-text fix (#341, PR #344), download-progress bytes/speed for voice + WebLLM models (#333 item 1, PR #346); all 5 PRs' correction loops ran to full quiescence — codebase-wide QNBS-v3/i18n fixes, a real data-integrity bug found and fixed in the rekey-recovery try/catch scoping, and sequential main-reconciliation merges across the whole 5-PR stack)** → **2026-08-14 (v1.27.1 — desktop persistence/security stabilization; #363: atomic writes across every Tauri fs-backed store, unified fail-closed desktop API-key routing, factory-reset UI/logic consolidated into `useFactoryReset` + `FactoryResetDangerZone`, packaged-build factory-reset capability-scope fix, `#[cfg(desktop)]`-gated menu-event handler + re-wired native menu-action bridge, `rust-tauri`/`e2e`/`vrt` promoted to required CI gates; plus the nanoid security-advisory patch, PR #362)**
 **Scope:** Full application, repository configuration, CI/CD, documentation, release validation
-**Current version:** **v1.28.0 released** — tag `v1.28.0` and the GitHub Release were published on 2026-08-21 from the validated `main` commit; includes the post-v1.27.1 diagnostics, Core-boundary, CI/Stryker-plumbing, CSP/runtime-policy, and release-truth work. **6888 Vitest source-declared tests across 565 files · 2924 keys × 19 locales**. Historical release sections below remain historical.
+**Current version:** **v1.28.1 released** — tag `v1.28.1` and the GitHub Release were published on 2026-08-23 from the validated `main` commit; adds the Scenario/Screenplay canonical projection workspace and a Core project-validation shadow caller (observation-only, does not switch authority from TypeScript), fixes writing-overlay render-cycle immediacy and serializes persistence writes against a save-vs-save race, and hardens the release-source trust boundary (signing doctor, exact-range verification, annotated-tag enforcement, GitHub Verified checks) plus daily OSV supply-chain monitoring. **7114+ Vitest source-declared tests across 580 test files · 2925 keys × 19 locales**. Historical release sections below remain historical.
+
+**Release gate (2026-08-23 — v1.28.1):** Main CI/CD run `32616003387` passed all required and advisory jobs. The tag-triggered Tauri workflow `32616003394` passed Ubuntu, Windows, and macOS bundle jobs plus GitHub Release generation and `latest.json`. The release publishes Linux x86_64 (rpm/deb/AppImage), Windows x86_64 (msi/exe), and macOS arm64 (dmg/app.tar.gz) artifacts; platform code-signing and notarization remain separate claims. No macOS x86_64 artifact was available and it is omitted from the updater manifest, matching v1.28.0's pattern.
 
 **Release gate (2026-08-21 — v1.28.0):** Main CI/CD run `32533780768` passed all required and advisory jobs, including Node 22/24 quality, Rust gates, build/budget/provenance, E2E, Storybook, Lighthouse, VRT, CodeQL, and Pages deployment. The tag-triggered Tauri workflow `32535622282` passed Ubuntu, Windows, and macOS bundle jobs plus GitHub Release generation and `latest.json`. The release intentionally publishes signed Linux x86_64, Windows x86_64, and macOS arm64 artifacts; no signed macOS x86_64 artifact was available and it is omitted from the updater manifest.
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 2ca8ec16d..8a0dffb9e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -43,6 +43,8 @@ pnpm run token:audit        # audit-tokens.mjs — design-token usage gate (CI b
 
 **Mandatory pre-push gate:** Run `pnpm run ci:prepush` before every push and again after every local correction before re-pushing. It always resolves a change-aware classification (`scripts/ci-prepush-classifier.mjs`) from the outgoing evidence first, then runs docs/release-truth, CSP, desktop-import-boundary, native-readiness, and dependency-state checks unconditionally — it does **not** run Biome lint; that stays the pre-commit hook's job on staged files only (`lint-staged`), and full-repository lint is CI-owned. The single-checker (`--checkers 1`) local typecheck and the i18n/content-guard checks run only when the classification requires them — `DOCS_ONLY`, `WORKFLOW_ONLY`, `NON_CODE_ONLY`, `RUST_TAURI`, `TOOLING`, and non-TypeScript `TEST_ONLY` changes report typecheck as `DEFERRED_TO_REQUIRED_CI` instead of running it locally, and i18n/content-guard checks run only for changes matching their own governed paths or implementation files (see `scripts/ci-prepush-check-registry.mjs`). It is the same `tsgo --noEmit` check as CI, not literally identical to it — CI uses `--checkers 4`. Whenever outgoing path evidence is incomplete, unresolved, or the manual committed-range diff fails, the gate fails closed into full local admission (every conditional check runs) rather than deferring anything. A targeted test or changed-file lint run alone is insufficient. If pnpm reports a dependency verification failure after a branch or lockfile change, run `node scripts/dependency-state.mjs reconcile` (or `pnpm run deps:reconcile`) first, then rerun the gate. The pre-commit hook does not replace this gate. Required GitHub CI remains the unconditional authority for the complete lint, TypeScript, and i18n validation regardless of what the local gate deferred.
 
+**New-worktree / first-time dependency bootstrap — never a bare `pnpm install`:** When materializing `node_modules` for the first time on a new git worktree (or any branch checkout that hasn't been installed yet), always run `node scripts/dependency-state.mjs reconcile` (or `pnpm run deps:reconcile`) — never a bare `pnpm install`. The bare form omits `--frozen-lockfile`, so on any manifest/lockfile drift it silently *rewrites* `pnpm-lock.yaml` instead of failing loudly, and it never writes the repo's own dependency fingerprint (`node_modules/.worldscript-deps-fingerprint`) — that fingerprint is checked only by `pnpm run deps:verify`, `ci:prepush`, and the pre-commit hook, not by arbitrary `pnpm run <script>` calls, so a stale one from a bare install can go undetected until one of those three actually runs. Separately, pnpm's own built-in `verifyDepsBeforeRun` check (unrelated to this repo's fingerprint file; it compares `node_modules` against the lockfile) can independently surface a broader `node_modules`/lockfile mismatch on other `pnpm run` calls as `ERR_PNPM_VERIFY_DEPS_BEFORE_RUN`. This matters most exactly where it looks safest: on a branch that deliberately touches *nothing* dependency-related — a Dependabot GitHub-Actions-only bump, a docs-only PR, a workflow-policy fix — a stray unverified bare install is the one action that could introduce an out-of-scope `pnpm-lock.yaml`/`package.json` change nobody asked for, or run install/postinstall scripts against an unverified graph. `deps:reconcile`'s `--frozen-lockfile` failing loudly is the primary safeguard; after it succeeds, `git status --porcelain` / `git diff --stat -- pnpm-lock.yaml package.json` showing no diff is corroborating evidence, not a substitute for using the right command in the first place — a clean lockfile diff after a bare install proves the graph happened to already be in sync, not that the bare install was the correct or safe choice to make.
+
 **Quality gate (local pre-push subset):** `pnpm run ci:prepush` runs dependency-state/docs/CSP/native-readiness checks unconditionally (never full-repository lint — see the pre-push gate note above for what runs lint locally), and the single-checker local typecheck and i18n/content-guard checks only for changes the classifier marks as potentially impacting them (fail-closed to "run everything conditional" when evidence is incomplete); CI additionally runs full-repository lint, the 4-checker typecheck, full-suite coverage, and heavy jobs regardless of what the local gate ran. Locally use only the targeted form `pnpm exec vitest run <path> --coverage` when debugging coverage. Full pipeline graph: [`docs/CI.md`](docs/CI.md). Coverage thresholds: lines 74, branches 60, functions 67, statements 72 (see `vitest.config.ts`).
 
 **CI pipeline order:** `security` → `quality` (Biome + tsgo + Vitest matrix) → `build` / `e2e` / `storybook` (parallel) → `lighthouse` (after build) → `deploy` on `main`. `ci-success` is a required-status aggregator (`needs: [security, quality, build]`) so branch protection can require one context instead of three/four individual ones — see `docs/CI.md`. Two additional jobs run in parallel with `quality`, both path-scoped via the `changes` job (legitimately `skipping` on PRs that don't touch their directory, which `ci-success` treats as a pass for that job only): `rust-tauri` (`src-tauri/**` — fmt/check/clippy/test, needs the GTK/WebKit apt-get steps) and `core-rust` (`crates/**` — same fmt/check/clippy/test for the renderer-neutral Rust Core, no GUI deps so no apt-get steps needed).
diff --git a/TODO.md b/TODO.md
index f8b7132bb..2f4312c91 100644
--- a/TODO.md
+++ b/TODO.md
@@ -8,25 +8,44 @@ Status: 🔄 in progress | ⬜ open | ✅ done
 
 ---
 
-## Current Sprint — Native desktop consolidation and Wave 2 G1 (2026-08-20)
+## Current Sprint — Post-#477 reconstruction reconciliation, Dependabot, and documentation truth (2026-08-26)
 
-> **Status: 🔄 in progress.** The authoritative native sequence is maintained in
+> **Status: 🔄 in progress.** The authoritative native sequence remains
 > [`docs/native/ROADMAP-QT-GPUI-DESKTOP.md`](docs/native/ROADMAP-QT-GPUI-DESKTOP.md), with the
-> next Rust-Core capability choice recorded in [`docs/native/CORE-MIGRATION-LEDGER.md`](docs/native/CORE-MIGRATION-LEDGER.md).
-
-- ✅ P0 CI/deployment authority stabilization merged in PR #427 at `0309a255`.
-- ✅ Cross-workspace Tauri path-dependency coverage and aggregate deployment gating are now
-  regression-tested in the quality job.
-- 🔄 G1 remains partial: task supervision, diagnostics, contract versioning, and future R-15
-  architecture remain open; no Qt or GPUI implementation is admitted yet.
-- ⏭️ Next capability slice, after this consolidation pass: choose the smallest evidence-producing
-  logger/diagnostics or task-orchestration increment from the migration ledger.
+> next Rust-Core capability choice recorded in [`docs/native/CORE-MIGRATION-LEDGER.md`](docs/native/CORE-MIGRATION-LEDGER.md);
+> no Qt or GPUI implementation work is part of this sprint.
+
+- ✅ PR #477 (Qt/PWA architecture-governance roadmap) merged; `v1.28.1` released 2026-08-23.
+- ✅ Reconstruction reconciliation: the frozen PR #491 bundle's three genuinely-still-required
+  residual pieces were rebuilt fresh against current `main` and merged — structural
+  workflow-policy YAML authority (#505, S4), Intel macOS qualification-only build lane (#508,
+  S5), and tiered PR-size governance (#509, plus an incidental lint-info cleanup #511). #491 and
+  #493 were closed with terminal reconciliation ledgers; every other frozen cluster was either
+  already shipped via #494/#498–#502, or is a deliberately deferred architecture question with
+  durable tracking (isolated-worktree hermetic-sandbox verification, issue #504).
+- ✅ Dependabot backlog cleared: #495 (`osv-scanner-action` 2.5.0→2.5.1 — plus a real pre-existing
+  test-oracle fix for the hardcoded SHA it changed) and #496 (`docker/setup-buildx-action`
+  4.2.0→4.3.0) merged.
+- ✅ Documentation truth pass (`AUDIT.md`/`TODO.md`, this update).
+- 🔄 A new release cut for this sprint's accumulated work (reconstruction reconciliation,
+  Dependabot integration, this documentation pass) remains open — a new version, not a repeat of
+  the already-published `v1.28.1` above.
 
 ## Archived sprint history
 
 The completed release and infrastructure sections below are retained for provenance. They are not
 the current sprint plan; long-term native sequencing belongs in the linked roadmap and ledger.
 
+## Archived — Native desktop consolidation and Wave 2 G1 (2026-08-20)
+
+> **Status: ✅ Superseded by the current sprint above.**
+
+- ✅ P0 CI/deployment authority stabilization merged in PR #427 at `0309a255`.
+- ✅ Cross-workspace Tauri path-dependency coverage and aggregate deployment gating are now
+  regression-tested in the quality job.
+- ✅ G1 partial-completion items (task supervision, diagnostics, contract versioning) were carried
+  forward into PR #477's architecture-governance roadmap, now merged.
+
 ## Archived — Release v1.25.0 published (2026-08-01)
 
 > **Status: ✅ Done.** Tagged, released, and live — see the GitHub Release link below.