docs: post-release v1.28.6 truth sync

AUDIT.md

@@ -2,7 +2,11 @@
 
 **Date:** 2026-04-17 (baseline); **follow-up chain:** … → 2026-05-28 (v1.19.0 — Security/Voice/RTL/Logger B-1..B-8) → **2026-05-30 (B-1 passphrase UX + CI unblock)** → **2026-05-31 (i18n audit + settings features + CI stabilization)** → **2026-05-31 (Edge-AI Perfection Cycle — Phases 0-7 complete)** → **2026-06-01 (Post-crash session: CI stabilisation + 14 CodeAnt AI fixes + E2E hardening)** → **2026-06-02 (Perf Phase 2.3 — pipeline-LRU unification + PR #69 CodeAnt fixes)** → **2026-06-03 (WorkerBus v2 Phase 3 — Rust TaskSupervisor + Tauri-build unblock)** → **2026-06-06 (Phase 3 i18n Expansion — ja/zh/pt/el + Intl APIs)** → **2026-06-09 (v1.21 Deep Audit Correction — Whisper WASM download UI + 3 CodeAnt fixes + CloudSync LWW)** → **2026-06-09 (feat/deep-audit-v1.21 — CSP hardening, zh locale ≤5% EN, coverage Batches A/B/C, VoiceActivityCoordinator B-2 bridge)** → **2026-06-11 (Ultimate Copilot v2 Phase 2+3 — markdown, sidebar, Apply-to-chapter, InlineAnnotation, ProForge chip; PR #110+#111)** → **2026-06-11 (v1.22.0 release — OpenRouter Cloud 5 provider, AI Execution Modes hybrid/cloud/local/eco, AiModeIndicator, SW cache-invalidation fix)** → **2026-06-13/14 (v1.23 perfection batch — OpenRouter + AI-Execution-Mode settings sections localized/modernized, i18n single-brace interpolation bug-class fix + `i18nPlaceholders` regression guard, bundle split + budget tightening PR #130)** → **2026-06-16 (v1.23.0 release — rebrand StoryCraft → WorldScript Studio, local-first data foundation ADR-0008, Tauri blank-screen + asset-URL fixes, AI error taxonomy + retry hardening, command-palette & local-AI settings localization, WorldScript W monogram icons)** → **2026-06-16 (post-release documentation perfection pass — corpus sync, metric reconciliation, history archival, dependabot hardening)** → **2026-06-17 (Language expansion — +6 locales fi/sv/hu/is/eu/fa (RTL); PR #174 merged; `LanguageSelector` exonym localization via `portal.language.names.*`; portal chrome 100 % for the 6 new langs; README/AUDIT/CHANGELOG docs sync)** → **2026-07-28 (v1.24.1 — Local-AI reliability fixes #266, Dependabot backlog triage, Issue #60 audit closeout, security/build hardening)** → **2026-07-29 (v1.24.2, PR #284 — CSP functional-truth, desktop crypto, and doc-truth hardening; the local-inference stack had been silently non-functional in production for two months; merged and tagged)** → **2026-07-30 (v1.24.3, WorkerBus v2 worker-generation consolidation — 5 stacked PRs #286–288/#290–291 + independent #289 recovered after an interrupted merge queue; ADR-0015; merged and tagged)** → **2026-08-12 (encryption lifecycle + desktop reliability + recovery journal — stacked PRs #335/#336/#337 merged into `main`; fail-closed IDB encryption lifecycle, desktop AI/Python provider hardening for #332/#333, durable resumable migration journal with secondary-store adapters; PR #339 closes the write-vs-migration TOCTOU race CodeRabbit and Qodo independently found on #337; PR #310 closed as superseded; Phase-4 production wiring for disable/rotate tracked as issue #338)** → **2026-08-13 (v1.27.0 — Phase 4 encryption disable/rotate production wiring + i18n (#342/#343 close issue #338), Tauri desktop boot-hydration + flush-on-quit + Settings re-render perf fixes (#332, PR #345), AI Writing Studio unreadable-text fix (#341, PR #344), download-progress bytes/speed for voice + WebLLM models (#333 item 1, PR #346); all 5 PRs' correction loops ran to full quiescence — codebase-wide QNBS-v3/i18n fixes, a real data-integrity bug found and fixed in the rekey-recovery try/catch scoping, and sequential main-reconciliation merges across the whole 5-PR stack)** → **2026-08-14 (v1.27.1 — desktop persistence/security stabilization; #363: atomic writes across every Tauri fs-backed store, unified fail-closed desktop API-key routing, factory-reset UI/logic consolidated into `useFactoryReset` + `FactoryResetDangerZone`, packaged-build factory-reset capability-scope fix, `#[cfg(desktop)]`-gated menu-event handler + re-wired native menu-action bridge, `rust-tauri`/`e2e`/`vrt` promoted to required CI gates; plus the nanoid security-advisory patch, PR #362)**
 **Scope:** Full application, repository configuration, CI/CD, documentation, release validation
-**Current version:** **v1.28.4 released** — tag `v1.28.4` and the GitHub Release were published on 2026-09-05 from the validated `main` commit `21221d43`, a patch release reconciling release-truth documentation with 62 commits merged since `v1.28.3`: PWA first-install unprompted-reload fix (#585, PR #613), shared-origin service-worker cache-read isolation fix (#514, PR #612), a Factory Reset data-integrity fix where `deleteDatabase()` previously reported success on a genuine failure or block (PR #596), a Factory Reset navigation fix (PR #592), preserve-first desktop corruption recovery (PR #542) and a distinct filesystem-I/O recovery action (PR #545), WCAG AA contrast and `prefers-reduced-motion` cascade fixes (#565, PR #609), an `fflate` ZIP64-parsing DoS override (PR #595), the R-15 secure desktop storage design contract admitted (design only — implementation stays gated behind the still-open Wave 2 project state-shape compatibility adapter prerequisite, per `docs/native/DESKTOP-MIGRATION-ROADMAP-REV3.md` and `CORE-MIGRATION-LEDGER.md` row 10's `S5_IMPLEMENTATION_READY=NO`), and a repaired visual-regression testing baseline (PR #610). **7456+ Vitest source-declared tests across 598 test files · 2940 keys × 19 locales**. Historical release sections below remain historical.
+**Current version:** **v1.28.6 released** — tag `v1.28.6` and the GitHub Release were published on 2026-09-09 from the validated `main` commit `b5d0eedf`, a recovery release fixing `v1.28.5`'s tag-triggered Tauri desktop build, which failed on every platform with a Rust/npm plugin version mismatch (`tauri-plugin-http`, `tauri-plugin-notification` drifted ahead of their npm counterparts after #661's Rust-only Dependabot bump). PR #678 aligned the npm versions and added `check-tauri-plugin-versions.mjs`, a permanent CI guard against this class of mismatch; PR #679 fixed a CHANGELOG completeness-gate PR-number reference gap that resulting-`main` surfaced right after #678 merged; PR #680 completed the version bump and release-truth reconciliation, converged through 3 correction batches for reviewer/accuracy findings. **7643+ Vitest source-declared tests across 604 test files · 2942 keys × 19 locales**. The `v1.28.5` tag itself is untouched and permanently bound to its original commit as the historical failed/incomplete desktop-release cut (its separate Docker/GHCR publish did succeed — see the release-gate entry below). Historical release sections below remain historical.
+
+**Release gate (2026-09-09 — v1.28.6):** Main CI/CD run `34408072174` (the push-triggered run for the release-prep merge commit) passed all applicable required and advisory jobs (Quality Gate Node 22+24, Tauri Rust Gate, Security Audit, Verified Signatures, Build, E2E Tests, E2E Deep Coverage, Storybook, Browser Quality (VRT + Lighthouse), `CI Success`); Core Rust Gate legitimately skipped (the release-prep commit touches `src-tauri/`, not `crates/`). Main-push CodeQL SAST run `34408072137` passed; 0 open code-scanning alerts. Before tagging, a dedicated exact-SHA `workflow_dispatch` Tauri qualification (run `34410474256`) on this exact commit passed Windows/Ubuntu/macOS — this recovery's own release discipline, on top of the standard tag-triggered qualification below. The tag-triggered `Tauri desktop build` workflow `34411937761` passed all 5 jobs (`Verify release tag`, `Bundle` for windows-latest/ubuntu-22.04/macos-latest, `GitHub Release`); the tag-triggered `CI / CD` run `34411937709` independently passed all applicable jobs including `E2E Tests (Playwright)`. A parallel `Docker` workflow (`34411937646`) built and pushed `ghcr.io/qnbs/worldscript-studio:1.28.6` (digest `sha256:8fbaed94388c2bcce7b0caf182497f711748e490fdc467b0941c8cadcc77f312`). The release publishes the same asset shape as v1.28.4/v1.28.3: Linux x86_64 (rpm/deb/AppImage) and Windows x86_64 (msi/exe) artifacts with corresponding Minisign `.sig` files; macOS arm64 ships an unsigned `.dmg` installer plus a signed `.app.tar.gz` updater bundle (`.sig`) — no separate `.dmg.sig`; `latest.json` present; all 14 release assets uploaded successfully. Platform code-signing and notarization remain separate claims. No macOS x86_64 artifact, matching prior releases — Intel-macOS remains a gated qualification lane (ADR-0021). Landed via PR #678 (Tauri plugin Rust/npm version-parity fix + permanent CI guard), PR #679 (CHANGELOG completeness-gate PR-number reference fix), and PR #680 (version bump + CHANGELOG/TODO/README release truth).
+
+**Release gate (2026-09-09 — v1.28.5, desktop release failed):** Tag `v1.28.5` was created on commit `590481189c0f9980f71b4081f4a6f8fccef7388d` via PR #676's release-prep merge; the tag itself is permanently kept as-is (never deleted, moved, or re-tagged) as the historical record of this failure. Main-push CI/CD run `34353928731` and CodeQL SAST run `34353928691` both passed on the release-prep commit. The tag-triggered `Tauri desktop build` workflow `34357232967` ran `Verify release tag` successfully, then **failed on every platform's `Bundle` job individually** (`windows-latest`, `ubuntu-22.04`, `macos-latest` each failed): `tauri-plugin-http` resolved to Rust 2.6.0 vs npm 2.5.9 and `tauri-plugin-notification` resolved to Rust 2.4.0 vs npm 2.3.3, both drifted after #661's Rust-only Dependabot bump, and `tauri build` hard-rejects a Rust/npm major.minor mismatch; the `GitHub Release` job was correctly skipped since no bundle job produced assets — no GitHub Release, installer, or updater artifact was ever published for `v1.28.5`. The tag-triggered `CI / CD` run `34357232902` passed independently (it does not depend on the Tauri bundle jobs). A parallel `Docker` workflow (`34357233022`) succeeded and pushed `ghcr.io/qnbs/worldscript-studio:1.28.5` (digest `sha256:3e5ac677979de21fb45ecb2899fb824302047c114829e54265d090928862f940`) — the desktop-build failure did not affect the separately-triggered container publish. Root-caused and fixed in `v1.28.6` above via PR #678.
 
 **Release gate (2026-09-05 — v1.28.4):** Main CI/CD run `33973305518` (the push-triggered run for the release-prep merge commit) passed all applicable required and advisory jobs (Quality Gate Node 22+24, Tauri Rust Gate, Security Audit, Verified Signatures, Build, E2E Tests, E2E Deep Coverage, Storybook, Browser Quality (VRT + Lighthouse), `CI Success`, `Deploy to GitHub Pages` — the last verified with a real `github-pages` Deployments API record for this exact commit, deployment id `6282574436`, `state: success`); Core Rust Gate legitimately skipped (the release-prep commit touches `src-tauri/`, not `crates/`). Main-push CodeQL SAST run `33973305597` passed; 0 open code-scanning alerts (`.github/workflows/codeql.yml` triggers only on `push: branches: [main]` — it has no tag trigger, so this main-push run is the only applicable CodeQL evidence for this release; it does not re-run on the tag). The tag-triggered `Tauri desktop build` workflow `33974750122` passed; the tag-triggered `CI / CD` run `33974750136` independently passed all applicable jobs including `E2E Tests (Playwright)`. A parallel `Docker` workflow (`33974750117`) built and pushed `ghcr.io/qnbs/worldscript-studio` (digest `sha256:f605598fd0dda9156d65768dd98a141b833e0fbd35cfd053ebf7e1882ab49e15`). The release publishes the same asset shape as v1.28.3: Linux x86_64 (rpm/deb/AppImage) and Windows x86_64 (msi/exe) artifacts with corresponding Minisign `.sig` files; macOS arm64 ships an unsigned `.dmg` installer plus a signed `.app.tar.gz` updater bundle (`.sig`) — no separate `.dmg.sig`; `latest.json` present; all 14 release assets uploaded successfully. Platform code-signing and notarization remain separate claims. No macOS x86_64 artifact, matching prior releases — Intel-macOS remains a gated qualification lane (ADR-0021). Landed via PR #613 (#585 fix — the full first-install classification state machine, audited across the complete state-transition matrix), PR #612 (#514 fix — positive cache-ownership scoping), and PR #615 (version bump + CHANGELOG/TODO/README release truth, itself corrected twice during review: R-15 gate language brought into agreement with the binding roadmap/ledger, and PR #596's Factory Reset data-integrity fix moved from a generic Tests bullet to its own Fixed entry).
 

CHANGELOG.md

@@ -7,7 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-<!-- release-candidate: v1.28.6 -->
+### Documentation
+
+- **Post-release v1.28.6 truth sync:** removed the now-stale release-candidate markers from
+  README.md and CHANGELOG.md now that the `v1.28.6` tag and GitHub Release are published, and
+  recorded real release-gate evidence in AUDIT.md for both `v1.28.6` (main CI/CD run, CodeQL,
+  the pre-tag exact-SHA Tauri qualification, tag-triggered Tauri/CI/Docker runs, published
+  release assets) and `v1.28.5` (the desktop-build failure and its independently-successful
+  Docker/GHCR publish). PR #681.
+
 ## [1.28.6] — 2026-09-09
 
 ### Fixed

README.md

@@ -9,7 +9,6 @@
   <img src="https://img.shields.io/badge/TypeScript-7.x_(tsgo)-3178C6?logo=typescript&logoColor=white" alt="TypeScript 7 (tsgo)">
   <img src="https://img.shields.io/badge/AI-Gemini_%7C_OpenAI_%7C_OpenRouter_%7C_Ollama_%7C_WebLLM-4285F4?logo=google" alt="Gemini · OpenAI · OpenRouter · Ollama · WebLLM">
   <img src="https://img.shields.io/badge/Local_AI-WebGPU_%7C_ONNX_%7C_Transformers.js-8B5CF6" alt="WebGPU · ONNX · Transformers.js">
-  <!-- release-candidate: v1.28.6 -->
   <img src="https://img.shields.io/badge/Release-v1.28.6-6366F1" alt="Release v1.28.6">
   <img src="https://img.shields.io/badge/Storage-IndexedDB_v8-F59E0B" alt="IndexedDB v8">
   <img src="https://img.shields.io/badge/PWA-v3.0-5BB974?logo=pwa" alt="PWA v3.0">

TODO.md

@@ -39,11 +39,12 @@ Status: 🔄 in progress | ⬜ open | ✅ done
   missing reference; a one-line CHANGELOG fix restored it to green. (A possible future pre-merge
   hardening of this check is recorded as deferred, memory-only follow-up — not part of this
   release cut.)
-- 🔄 `v1.28.6` release cut in progress (this sprint's active PR): version/`CHANGELOG.md`/
-  `TODO.md`/`README.md` reconciliation for the Tauri plugin-parity recovery. Tag, GitHub Release,
-  release artifacts, and the post-release `AUDIT.md` evidence entry all remain pending until
-  after this PR merges, post-merge main CI/CodeQL are green, and an exact-SHA
-  Windows/Ubuntu/macOS `tauri-build.yml` qualification passes on the intended tag commit.
+- ✅ `v1.28.6` released (PR #680, 2026-09-09): version/`CHANGELOG.md`/`TODO.md`/`README.md`
+  reconciliation for the Tauri plugin-parity recovery, merged after an exact-SHA
+  Windows/Ubuntu/macOS `tauri-build.yml` qualification passed on the intended tag commit. Tag
+  `v1.28.6` and its GitHub Release (full desktop installer/updater asset set, all platforms) are
+  published; the tag-triggered Tauri/CI/Docker workflows and the post-release `AUDIT.md` evidence
+  entry (PR #681) are complete.
 - ✅ PR #674 merged (2026-09-09): the CHANGELOG completeness gate upgraded from accepting any
   non-empty `[Unreleased]` section forever to requiring every governed commit to be individually
   referenced by PR number or subject slug; backfilled 13 previously-undocumented entries. The