Closes the exact gap PR #564's S5-A baseline left as an explicit
blocker: the reader algorithm's snapshot-capture and retention-
reference-registration steps were not specified as one atomic
operation, so a reader descheduled between them could have its
retention reference arrive after the generation it named was already
reclaimed.

Admits AuthoritySnapshotGuard: acquire_authority_snapshot_guard()
reads the current committed-root generation handle and increments its
reference count as one operation indivisible with respect to a
concurrent root commit's replacement of that handle. Specifies the
publication ordering for the in-memory current cell relative to the
parent contract's step-F durable commit, and that it holds no state
across a restart (repopulated from the durable committed_root at
startup, before any guard can be acquired).

Extends reclamation eligibility transitively: a guard-pinned root
generation stays retained regardless of how many further commits have
occurred since acquisition, and catalog/marker/data generations
reachable from it inherit retention through the parent contract's
existing "referenced by a retained root" rule - no new per-child pin
accounting is introduced. Makes explicit that all three reclamation
conditions (durable retention, zero guard references, and any other
admitted recovery reason) must hold together, including after a
restart.

Updates the parent contract's reader-algorithm steps 2/7, S5-B2
blocker paragraph, header status flags, and section 21 to record
S5_B2_ADMITTED = YES, and the migration ledger's row 10 accordingly.
S5-B1 and S5-B3 remain open.

Closes the exact gap PR #564's S5-A baseline left as an explicit
blocker: the reader algorithm's snapshot-capture and retention-
reference-registration steps were not specified as one atomic
operation, so a reader descheduled between them could have its
retention reference arrive after the generation it named was already
reclaimed.

Admits AuthoritySnapshotGuard: acquire_authority_snapshot_guard()
reads the current committed-root generation handle and increments its
reference count as one operation indivisible with respect to a
concurrent root commit's replacement of that handle. Specifies the
publication ordering for the in-memory current cell relative to the
parent contract's step-F durable commit, and that it holds no state
across a restart (repopulated from the durable committed_root at
startup, before any guard can be acquired).

Extends reclamation eligibility transitively: a guard-pinned root
generation stays retained regardless of how many further commits have
occurred since acquisition, and catalog/marker/data generations
reachable from it inherit retention through the parent contract's
existing "referenced by a retained root" rule - no new per-child pin
accounting is introduced. Makes explicit that all three reclamation
conditions (durable retention, zero guard references, and any other
admitted recovery reason) must hold together, including after a
restart.

Updates the parent contract's reader-algorithm steps 2/7, S5-B2
blocker paragraph, header status flags, and section 21 to record
S5_B2_ADMITTED = YES, and the migration ledger's row 10 accordingly.
S5-B1 and S5-B3 remain open.

Closes the four gaps PR #564's S5-A baseline left as explicit
blockers, per issue #577:

- Canonical JSON (version 1): recursive object-key sorting by exact
  UTF-8 byte sequence. JSON.parse's own duplicate-key resolution
  (last-wins) is already deterministic across engines - no separate
  rejection step is needed or enforceable at the encoding stage.
- source_evidence_digest for the packaged-IDB-fallback representation,
  per compressData()'s two actual stored forms.
- canonical_destination_payload_bytes, classified by real current
  storage shape rather than assumed: binary-native classes use raw
  bytes; Global images require an explicit base64-decode step (stored
  as base64 text despite the .png suffix); the one mixed
  metadata+blob class (LoRA adapters) uses a length-prefixed combined
  encoding; the majority JSON-shaped classes use canonical JSON; and
  classes with no genuine cross-authority coalescing scenario (Library
  backups - a single external archive; Quarantine data - a one-off
  recovery directory tree) need no payload-bytes rule at all.
- Atomic-write-temporary reconciliation: owner derivation now resolves
  against the class path registry so a crash-before-first-promotion
  temporary (target never existed) is still a valid candidate, not an
  orphan; added the missing readable-target/corrupt-temporary branch
  as an explicit preserve-and-block outcome.
- SOURCE_IDENTITY_UNBOUND upgrade path is scoped to MIGRATE_TO_R15
  sources only. Credentials are explicitly excluded: their
  RETAIN_APPROVED_SEPARATE_PROTECTED_AUTHORITY disposition forbids
  folding them into the ordinary S9 write path even for identity
  recovery, matching the isolation rationale S5-A already established
  for that disposition.
- Legacy quarantine recovery-id: Core assigns a fresh id at inventory
  time and durably records the mapping before first use.

Updates the parent contract's four S5-B1 blocker locations, header
status flags, and section 21 to record S5_B1_ADMITTED = YES, and the
migration ledger's row 10 accordingly. S5-B3 remains the sole open
child contract before S5_TERMINAL.

…#581)

Closes the four gaps PR #564's S5-A baseline left as explicit
blockers, per issue #577:

- Canonical JSON (version 1): recursive object-key sorting by exact
  UTF-8 byte sequence. JSON.parse's own duplicate-key resolution
  (last-wins) is already deterministic across engines - no separate
  rejection step is needed or enforceable at the encoding stage.
- source_evidence_digest for the packaged-IDB-fallback representation,
  per compressData()'s two actual stored forms.
- canonical_destination_payload_bytes, classified by real current
  storage shape rather than assumed: binary-native classes use raw
  bytes; Global images require an explicit base64-decode step (stored
  as base64 text despite the .png suffix); the one mixed
  metadata+blob class (LoRA adapters) uses a length-prefixed combined
  encoding; the majority JSON-shaped classes use canonical JSON; and
  classes with no genuine cross-authority coalescing scenario (Library
  backups - a single external archive; Quarantine data - a one-off
  recovery directory tree) need no payload-bytes rule at all.
- Atomic-write-temporary reconciliation: owner derivation now resolves
  against the class path registry so a crash-before-first-promotion
  temporary (target never existed) is still a valid candidate, not an
  orphan; added the missing readable-target/corrupt-temporary branch
  as an explicit preserve-and-block outcome.
- SOURCE_IDENTITY_UNBOUND upgrade path is scoped to MIGRATE_TO_R15
  sources only. Credentials are explicitly excluded: their
  RETAIN_APPROVED_SEPARATE_PROTECTED_AUTHORITY disposition forbids
  folding them into the ordinary S9 write path even for identity
  recovery, matching the isolation rationale S5-A already established
  for that disposition.
- Legacy quarantine recovery-id: Core assigns a fresh id at inventory
  time and durably records the mapping before first use.

Updates the parent contract's four S5-B1 blocker locations, header
status flags, and section 21 to record S5_B1_ADMITTED = YES, and the
migration ledger's row 10 accordingly. S5-B3 remains the sole open
child contract before S5_TERMINAL.

Closes the fail-closed blocker PR #564's S5-A baseline left for
records above the 64 MiB whole-record ciphertext_len limit, per
issue #579. Verified real source first: importBinderFileThunk accepts
binder attachments of any size with no client-side cap, so this is a
reachable gap for a writing-research tool, not a theoretical one.

Admits the format S6.3 already anticipated: fixed 16 MiB plaintext
chunks (final chunk may be shorter), each its own complete WSR1
envelope reusing the existing version marker (chunk-vs-whole-record
dispatch always comes from the marker's is_chunked flag, never from
inspecting envelope bytes alone), with mandatory independent CSPRNG
nonces and identity-plus-chunk-index-bound AAD. Chunk-set integrity
reuses the exact catalog_set_digest/journal_page_set_digest pattern
already proven twice in this contract family.

Updates the parent contract's actual S5.4 ACTIVE/PENDING marker body
field lists directly (not just prose) to append is_chunked/chunk_count
as trailing fields after every existing field, so no prior field's
byte offset shifts - closing a real inconsistency where the child
document's marker assumptions diverged from the parent's own
un-updated canonical definition. Corrects the write path to make no
false atomic-multi-file-promotion claim: exactly one thing is atomic
(the existing marker commit, S9 step 9); chunks are merely durably
staged before it, with recovery re-deriving partial-set state per
chunk rather than assuming any cross-file transaction, and an orphaned
staged chunk from a discarded attempt reconciled via S5-B1's existing
atomic-write-temporary mechanism. Makes the chunk AAD/header
composition and per-chunk content_digest formula explicit rather than
implicit, and corrects the parent's S6.3 nonce wording to remove the
implication that domain separation could come from nonce derivation.

Updates the parent's S6.1.2/S6.3/S13 blocker language, header status
flags, and section 21 to record S5_B3_ADMITTED = YES, and the
migration ledger's row 10 accordingly. All three S5 child contracts
are now admitted; S5_TERMINAL still requires the final cross-contract
consistency audit before it may be declared.

Closes the fail-closed blocker PR #564's S5-A baseline left for
records above the 64 MiB whole-record ciphertext_len limit, per
issue #579. Verified real source first: importBinderFileThunk accepts
binder attachments of any size with no client-side cap, so this is a
reachable gap for a writing-research tool, not a theoretical one.

Admits the format S6.3 already anticipated: fixed 16 MiB plaintext
chunks (final chunk may be shorter), each its own complete WSR1
envelope reusing the existing version marker (chunk-vs-whole-record
dispatch always comes from the marker's is_chunked flag, never from
inspecting envelope bytes alone), with mandatory independent CSPRNG
nonces and identity-plus-chunk-index-bound AAD. Chunk-set integrity
reuses the exact catalog_set_digest/journal_page_set_digest pattern
already proven twice in this contract family.

Updates the parent contract's actual S5.4 ACTIVE/PENDING marker body
field lists directly (not just prose) to append is_chunked/chunk_count
as trailing fields after every existing field, so no prior field's
byte offset shifts - closing a real inconsistency where the child
document's marker assumptions diverged from the parent's own
un-updated canonical definition. Corrects the write path to make no
false atomic-multi-file-promotion claim: exactly one thing is atomic
(the existing marker commit, S9 step 9); chunks are merely durably
staged before it, with recovery re-deriving partial-set state per
chunk rather than assuming any cross-file transaction, and an orphaned
staged chunk from a discarded attempt reconciled via S5-B1's existing
atomic-write-temporary mechanism. Makes the chunk AAD/header
composition and per-chunk content_digest formula explicit rather than
implicit, and corrects the parent's S6.3 nonce wording to remove the
implication that domain separation could come from nonce derivation.

Updates the parent's S6.1.2/S6.3/S13 blocker language, header status
flags, and section 21 to record S5_B3_ADMITTED = YES, and the
migration ledger's row 10 accordingly. All three S5 child contracts
are now admitted; S5_TERMINAL still requires the final cross-contract
consistency audit before it may be declared.

… check-pr-size.mjs exception-ceiling bug

Recomputed entirely from a genuine rebase of #583 onto current main
(which now carries #562, #592, and #594) rather than trusting the
historical 70 files / 1753 lines / 21 commits figures the earlier
commits on this branch carried forward.

The rebase itself revealed two things the prior estimate could not
have known:

1. #583 and #592 (the independent factory-reset persistence-admission
   fix, issues #591/#593) touch overlapping files -- app/listenerMiddleware.ts,
   services/factoryResetService.ts, services/crossProjectIndexService.ts,
   and their tests. Reconciled by layering both mechanisms inside
   wipeAllAppData(): #592's isFactoryResetInProgress()/coordinator-draining
   gate runs first (blocks new Redux-listener writes, drains in-flight
   ones), then #583's beginIdbReset() force-closes every other long-lived
   IDB connection the coordinators do not track.
2. PR #590 (merged earlier, unrelated) had already independently shipped
   the same locale-independent Settings/mobile-"More"-button navigation
   fix #583 originally introduced across five files (components/SettingsView.tsx,
   components/settings/SettingsModals.tsx, components/settings/DataSection.tsx,
   components/Sidebar.tsx, tests/e2e/helpers.ts). Parallel convergent
   evolution left #583's own changes to those files fully superseded --
   zero net diff against current main -- so they are correctly absent
   from allowedPaths.

Final measured diff: 65 governed files (84 incl. generated locale
bundles), 1611 meaningful lines, 14 commits -- exact ceilings, no
speculative headroom, computed directly via check-pr-size.mjs itself
against the real rebased branch.

That direct measurement also surfaced a latent bug in check-pr-size.mjs:
when an exception's own ceiling legitimately exceeds TIERS.absolute
(30 files/3000 lines/15 commits) -- the entire point of granting one --
evaluatePrSize() fell through to selectSeverity() against that fixed
tier instead of treating the exception's own ceiling as authoritative,
so a fully-satisfied wide exception still reported blocking:true.
Neither #539 (maxFiles:30, at the absolute tier's own boundary) nor
#564 (maxFiles:3, well under it) had ever exercised this path -- #583
is the first exception whose own scope is wide enough to expose it.
Fixed to short-circuit on exception.entry directly, verified against
a synthetic base commit carrying this fix plus the recomputed entry,
diffed against the actual rebased #583 branch (exit 0, PR_SIZE_EXCEPTION=APPLIED).
Added a regression test covering a wide exception ceiling that exceeds
the fixed absolute tier.

Squashes the prior five commits on this branch (four incremental
"recompute" attempts plus a stray temp commit), none of which had been
verified against a real rebase or the actual gate behavior.

… check-pr-size.mjs exception-ceiling bug

Recomputed entirely from a genuine rebase of #583 onto current main
(which now carries #562, #592, and #594) rather than trusting the
historical 70 files / 1753 lines / 21 commits figures the earlier
commits on this branch carried forward.

The rebase itself revealed two things the prior estimate could not
have known:

1. #583 and #592 (the independent factory-reset persistence-admission
   fix, issues #591/#593) touch overlapping files -- app/listenerMiddleware.ts,
   services/factoryResetService.ts, services/crossProjectIndexService.ts,
   and their tests. Reconciled by layering both mechanisms inside
   wipeAllAppData(): #592's isFactoryResetInProgress()/coordinator-draining
   gate runs first (blocks new Redux-listener writes, drains in-flight
   ones), then #583's beginIdbReset() force-closes every other long-lived
   IDB connection the coordinators do not track.
2. PR #590 (merged earlier, unrelated) had already independently shipped
   the same locale-independent Settings/mobile-"More"-button navigation
   fix #583 originally introduced across five files (components/SettingsView.tsx,
   components/settings/SettingsModals.tsx, components/settings/DataSection.tsx,
   components/Sidebar.tsx, tests/e2e/helpers.ts). Parallel convergent
   evolution left #583's own changes to those files fully superseded --
   zero net diff against current main -- so they are correctly absent
   from allowedPaths.

Final measured diff: 65 governed files (84 incl. generated locale
bundles), 1611 meaningful lines, 14 commits -- exact ceilings, no
speculative headroom, computed directly via check-pr-size.mjs itself
against the real rebased branch.

That direct measurement also surfaced a latent bug in check-pr-size.mjs:
when an exception's own ceiling legitimately exceeds TIERS.absolute
(30 files/3000 lines/15 commits) -- the entire point of granting one --
evaluatePrSize() fell through to selectSeverity() against that fixed
tier instead of treating the exception's own ceiling as authoritative,
so a fully-satisfied wide exception still reported blocking:true.
Neither #539 (maxFiles:30, at the absolute tier's own boundary) nor
#564 (maxFiles:3, well under it) had ever exercised this path -- #583
is the first exception whose own scope is wide enough to expose it.
Fixed to short-circuit on exception.entry directly, verified against
a synthetic base commit carrying this fix plus the recomputed entry,
diffed against the actual rebased #583 branch (exit 0, PR_SIZE_EXCEPTION=APPLIED).
Added a regression test covering a wide exception ceiling that exceeds
the fixed absolute tier.

Squashes the prior five commits on this branch (four incremental
"recompute" attempts plus a stray temp commit), none of which had been
verified against a real rebase or the actual gate behavior.

… check-pr-size.mjs exception-ceiling bug (#586)

Recomputed entirely from a genuine rebase of #583 onto current main
(which now carries #562, #592, and #594) rather than trusting the
historical 70 files / 1753 lines / 21 commits figures the earlier
commits on this branch carried forward.

The rebase itself revealed two things the prior estimate could not
have known:

1. #583 and #592 (the independent factory-reset persistence-admission
   fix, issues #591/#593) touch overlapping files -- app/listenerMiddleware.ts,
   services/factoryResetService.ts, services/crossProjectIndexService.ts,
   and their tests. Reconciled by layering both mechanisms inside
   wipeAllAppData(): #592's isFactoryResetInProgress()/coordinator-draining
   gate runs first (blocks new Redux-listener writes, drains in-flight
   ones), then #583's beginIdbReset() force-closes every other long-lived
   IDB connection the coordinators do not track.
2. PR #590 (merged earlier, unrelated) had already independently shipped
   the same locale-independent Settings/mobile-"More"-button navigation
   fix #583 originally introduced across five files (components/SettingsView.tsx,
   components/settings/SettingsModals.tsx, components/settings/DataSection.tsx,
   components/Sidebar.tsx, tests/e2e/helpers.ts). Parallel convergent
   evolution left #583's own changes to those files fully superseded --
   zero net diff against current main -- so they are correctly absent
   from allowedPaths.

Final measured diff: 65 governed files (84 incl. generated locale
bundles), 1611 meaningful lines, 14 commits -- exact ceilings, no
speculative headroom, computed directly via check-pr-size.mjs itself
against the real rebased branch.

That direct measurement also surfaced a latent bug in check-pr-size.mjs:
when an exception's own ceiling legitimately exceeds TIERS.absolute
(30 files/3000 lines/15 commits) -- the entire point of granting one --
evaluatePrSize() fell through to selectSeverity() against that fixed
tier instead of treating the exception's own ceiling as authoritative,
so a fully-satisfied wide exception still reported blocking:true.
Neither #539 (maxFiles:30, at the absolute tier's own boundary) nor
#564 (maxFiles:3, well under it) had ever exercised this path -- #583
is the first exception whose own scope is wide enough to expose it.
Fixed to short-circuit on exception.entry directly, verified against
a synthetic base commit carrying this fix plus the recomputed entry,
diffed against the actual rebased #583 branch (exit 0, PR_SIZE_EXCEPTION=APPLIED).
Added a regression test covering a wide exception ceiling that exceeds
the fixed absolute tier.

Squashes the prior five commits on this branch (four incremental
"recompute" attempts plus a stray temp commit), none of which had been
verified against a real rebase or the actual gate behavior.

* chore(release): bump version to v1.28.4

Patch release reconciling release-truth documentation with everything
merged to main since v1.28.3 (62 commits / ~40 PRs, audited against
live GitHub state, not assumed from commit subjects):

- fix: PWA first-install unprompted reload (#585, PR #613)
- fix: shared-origin service-worker cache-read isolation (#514, PR #612)
- fix: Factory Reset could reboot into Settings instead of Welcome
  Portal (PR #592)
- fix: preserve-first desktop corruption recovery (PR #542) and a
  distinct filesystem-I/O recovery action (PR #545)
- fix: intentionally cleared project metadata no longer reappears
  (PR #546)
- a11y: Welcome/Home dashboard WCAG AA contrast + reduced-motion
  cascade fix + default appearance preset change (#565, PR #609);
  ManuscriptEditor contrast (PR #560)
- security: fflate ZIP64-parsing DoS override (PR #595); routine
  dependency floor bumps (PR #587, #561, #562, #594)
- docs: R-15 secure desktop storage design contract admitted (PRs
  #564, #580, #581, #582, #584) — design only, no implementation yet
- tests: visual regression testing repaired — baselines were directory
  listings, not the application (PR #610); IDB reset-quiescence
  hardening (PR #596); WelcomePortal E2E navigation made
  locale-independent (PR #590)

Everything classified as pure internal/CI-governance churn (PR-size
exception plumbing, dual-graph tooling, toolchain pins) is omitted from
CHANGELOG.md as non-user-facing.

Version bumped via the existing sync scripts (sync-tauri-version.mjs,
sync-sw-version.mjs) across package.json, src-tauri/Cargo.toml,
src-tauri/tauri.conf.json, src-tauri/Cargo.lock, AGENTS.md, and
public/sw.js's APP_VERSION.

CHANGELOG.md and README.md use the established release-candidate
marker convention (<!-- release-candidate: v1.28.4 -->) so the dated
entry and version badge are truthful before the v1.28.4 tag exists;
both markers are removed in a follow-up post-release truth-sync once
the tag and GitHub Release are published, matching the v1.28.2/v1.28.3
precedent.

TODO.md's Current Sprint section was archived (its final "release cut
remains open" bullet is now resolved — v1.28.2 and v1.28.3 both
shipped) and replaced with the actual current sprint: this release cut
followed by the R-15 desktop at-rest encryption priority program.

AUDIT.md is intentionally not touched here — its release-gate entry
requires real post-merge CI/CodeQL run evidence that doesn't exist
until after this PR merges and the tag is cut, matching how every
prior release's AUDIT.md entry was written (a follow-up commit, not
part of the release-prep PR itself).

* docs(release): correct premature done-marker on the v1.28.4 TODO item

TODO.md's Current Sprint marked the release cut as done (checked
'v1.28.4' release cut, reconciling ... AUDIT.md truth ...) while this
same PR's own Non-goals section correctly states AUDIT.md is not
touched here, and while no tag, GitHub Release, or release artifacts
exist yet. Corrected to in-progress language naming PR #615 directly
and listing what actually remains pending (tag, release, artifacts,
post-release AUDIT.md evidence).

* docs(release): correct R-15 gate language and credit PR #596's real fix

Two corrections from review, verified against live evidence before
fixing:

1. TODO.md's Current Sprint claimed R-15 desktop at-rest encryption
   implementation was being prioritized now. docs/native/DESKTOP-
   MIGRATION-ROADMAP-REV3.md explicitly forbids pulling Wave 3/4 R-15
   implementation ahead of unresolved Wave 2 authority prerequisites,
   and CORE-MIGRATION-LEDGER.md row 10 records
   S5_IMPLEMENTATION_READY=NO. Corrected to state R-15 design is
   complete but implementation stays gated behind the still-open Wave
   2 prerequisite (ledger row 9: the project state-shape compatibility
   adapter), which is what this sprint's desktop-storage work actually
   is.

2. CHANGELOG.md listed PR #596 only as generic IDB test hardening
   under Tests. Verified against its actual diff: deleteDatabase()
   previously resolved on a genuine onerror or an onblocked event as
   if deletion succeeded, so wipeAllAppData() could report Factory
   Reset complete while a database was never actually deleted. onerror
   now rejects; onblocked waits for the connection to close before
   giving up. This is a real production data-integrity fix, not test
   hardening, and now has its own Fixed entry.