#20–24

- @playwright/test: 1.59.1 → 1.60.0
- @storybook/{addon-a11y,react,react-vite}: 10.3.5 → 10.3.6
- storybook: 10.3.5 → 10.3.6
- vitest: 4.1.4 → 4.1.6
- @vitest/coverage-v8: 4.1.4 → 4.1.6
- vite: 8.0.8 → 8.0.12
- @tailwindcss/vite: 4.2.2 → 4.3.0
- @types/node: 25.6.0 → 25.7.0
- turbo: 2.9.9 → 2.9.12
- onnxruntime-web: 1.25.1 → 1.26.0
- ai: 6.0.177 → 6.0.178
- @tauri-apps/api: 2.10.1 → 2.11.0
- @tauri-apps/plugin-dialog: 2.7.0 → 2.7.1
- @tauri-apps/plugin-fs: 2.5.0 → 2.5.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- #5 MCP memory re-seed duplicates: cache capability per payload (sha1 of
  payload) in capability.ts + deterministic seed ids (projectId:category:key)
  in nodeProForgeCapability so rebuilds overwrite instead of minting fresh ids.
- #7 Copilot stuck 'streaming' on close: useGlobalCopilot.close() now resets
  finishLastAssistant + setStatus('idle') when streaming, so future sends work.
- #4 import-time crash on bad --project: read the file lazily inside
  resolveCapability, wrapped in an actionable ProForgeError(VALIDATION).
- #6 empty-string runId: runId -> z.string().min(1).optional() in both
  getSupervisorStatus + getHistory schemas (now a VALIDATION error).
- #8 disabling enableGlobalCopilot: useSettingsView clears + closes the copilot
  session on toggle-off so re-enabling never restores a stale panel.
- #1-3 raw err in MCP responses: fail() returns a generic 'Internal error' for
  unexpected errors and writes detail to stderr only; our own ProForgeError
  messages still pass through (actionable).

Tests: capabilityLayer empty-runId VALIDATION, idempotent node seeding,
useGlobalCopilot.close reset, useSettingsView copilot clear-on-disable; MCP
smoke extended with idempotent-seed + missing-project VALIDATION assertions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

)

Closes 8 review findings: 7 mechanical completions of the prior batch's
control-plane graph, plus a new foreign-protected migration-source
subsystem (finding #8, maintainer-designed).

- Bootstrap (§10.2) now uses the exact same prepare_root_anchor/
  commit_root_anchor two-phase sequence as every later root commit,
  with the initial key-epoch control record created before the first
  root claims active_key_epoch. Closes the crash window where a
  NOT_COMMITTED bootstrap slot had no anchor-bound trusted key
  reference to authenticate against.
- Catalog descriptors (§5.5) now use explicit presence encoding
  (has_active_record_generation/has_active_epoch/has_content_digest)
  so a brand-new PENDING(none->1) descriptor never has to invent a
  committed generation/epoch/digest that doesn't exist yet;
  enumerable-but-not-yet-readable is now an explicit, distinct state
  from readable.
- Removed a leftover sentence describing catalog pages as "covered by
  the marker set," which contradicted the catalog self-exclusion rule.
- inventory_digest now has a normative sort tuple (record-class token,
  tagged identity, tagged project scope, source-authority kind,
  source-scheme id) instead of an undefined "sorted."
- marker_set_digest's outer entry is now consistently described as
  five fields (including marker_generation) everywhere it's
  paraphrased, not just in the normative table.
- §6.2 now has a deterministic direct-vs-hashed AAD selection rule for
  the case where two individually-in-bound identity fields would
  jointly exceed the 32 KiB AAD limit.
- New: a three-way source_authority_kind (LEGACY_PLAINTEXT/
  R15_PROTECTED/FOREIGN_PROTECTED), a versioned source_scheme_id
  registry (WEBVIEW_IDB_AT_REST_V1, CREDENTIAL_IDB_KEYSTORE_V1), a
  MigrationSourceAdapter boundary distinct from KeyProvider (§15.3), a
  preserve-first foreign-migration flow with no-transitive-trust
  validation (§10.6), an explicit per-class migration-disposition
  model including credentials' RETAIN_APPROVED_SEPARATE_PROTECTED_
  AUTHORITY (§10.4.1), and 13 new foreign-source fault-injection
  requirements (§16 assertion 19).

No implementation, no status-line or refusal-list change, no other
files touched. Verified: KeyProvider / MigrationSourceAdapter /
source_scheme registry / Core remain four distinct, non-collapsing
layers.

)

Closes 8 review findings: 7 mechanical completions of the prior batch's
control-plane graph, plus a new foreign-protected migration-source
subsystem (finding #8, maintainer-designed).

- Bootstrap (§10.2) now uses the exact same prepare_root_anchor/
  commit_root_anchor two-phase sequence as every later root commit,
  with the initial key-epoch control record created before the first
  root claims active_key_epoch. Closes the crash window where a
  NOT_COMMITTED bootstrap slot had no anchor-bound trusted key
  reference to authenticate against.
- Catalog descriptors (§5.5) now use explicit presence encoding
  (has_active_record_generation/has_active_epoch/has_content_digest)
  so a brand-new PENDING(none->1) descriptor never has to invent a
  committed generation/epoch/digest that doesn't exist yet;
  enumerable-but-not-yet-readable is now an explicit, distinct state
  from readable.
- Removed a leftover sentence describing catalog pages as "covered by
  the marker set," which contradicted the catalog self-exclusion rule.
- inventory_digest now has a normative sort tuple (record-class token,
  tagged identity, tagged project scope, source-authority kind,
  source-scheme id) instead of an undefined "sorted."
- marker_set_digest's outer entry is now consistently described as
  five fields (including marker_generation) everywhere it's
  paraphrased, not just in the normative table.
- §6.2 now has a deterministic direct-vs-hashed AAD selection rule for
  the case where two individually-in-bound identity fields would
  jointly exceed the 32 KiB AAD limit.
- New: a three-way source_authority_kind (LEGACY_PLAINTEXT/
  R15_PROTECTED/FOREIGN_PROTECTED), a versioned source_scheme_id
  registry (WEBVIEW_IDB_AT_REST_V1, CREDENTIAL_IDB_KEYSTORE_V1), a
  MigrationSourceAdapter boundary distinct from KeyProvider (§15.3), a
  preserve-first foreign-migration flow with no-transitive-trust
  validation (§10.6), an explicit per-class migration-disposition
  model including credentials' RETAIN_APPROVED_SEPARATE_PROTECTED_
  AUTHORITY (§10.4.1), and 13 new foreign-source fault-injection
  requirements (§16 assertion 19).

No implementation, no status-line or refusal-list change, no other
files touched. Verified: KeyProvider / MigrationSourceAdapter /
source_scheme registry / Core remain four distinct, non-collapsing
layers.

* docs(core): define R-15 secure storage contract

* docs(core): tighten R-15 recovery contract

* docs(core): close R-15 authority review gaps

* docs(core): close R-15 inventory and recovery gaps

* docs(core): close R-15 authority review gaps

* docs(core): define R-15 commit authority

* docs(core): close R-15 contract clusters

* docs(core): close R-15 contract review findings

Disposition of all 15 unresolved chatgpt-codex-connector threads plus
4 CodeRabbit outside-diff findings on the R-15 contract, per exhaustive
three-channel review-comment verification:

- 5 codex findings were already addressed by existing text (root
  checkpoint timing, digest-free pending intent, project-ID AAD bound,
  lock/unlock admission) and needed no change.
- 10 codex findings were genuine gaps, fixed: asset-pair marker
  encoding, StorageBackend enumeration handoff, two missing inventory
  rows (local-first sync doc, DuckDB/OPFS analytics), catalog binding
  into the authority root, the asset-pair registry token, numeric
  marker-state codes, rollback-floor advancement on write, root
  checkpoint CAS under concurrent writes, delete-intent crash recovery,
  migration-journal self-reference exclusion, and split ciphertext vs.
  whole-envelope size limits.
- 2 CodeRabbit findings overlapped the above (asset-pair token,
  root-commit-evidence encoding) and are covered by the same fixes.
- 2 CodeRabbit findings were distinct and are fixed here: a typed
  PROTECTED_READ_AUTHORITY_PENDING outcome in §7, and correcting the
  crash-recovery rule to restore ABSENT (not ACTIVE(old)) after a
  failed first write.

No implementation, no status-line or §1.2 refusal-list change, no
other files touched.

* docs(core): close second-wave R-15 contract review findings

The push in efee8ce triggered a fresh incremental bot review, which
raised 5 more findings on the exact gaps that push's own fixes created
or left incomplete:

- Two more unclassified content-bearing WebView stores: the
  cross-project search index (services/crossProjectIndexService.ts),
  same pattern as the local-first-doc/analytics-db rows added
  previously. New PROTECTED inventory row plus identity/token entries.
- The rollback-floor advancement added in efee8ce had no adapter API
  to actually perform it. Added KeyProvider.read_floor()/
  advance_floor() with an explicit crash-ordering rule, mirrored into
  the platform-adapter section.
- root_commit_evidence was still only named in prose, not encoded,
  despite efee8ce claiming this was covered by the catalog-digest fix
  (it wasn't — two distinct gaps in the same digest row). Now fully
  byte-encoded, with an explicit has_journal discriminant so an
  ordinary write's absent journal is never conflated with a real
  revision 0.
- LoRA dataset/run child records had no defined identity domains
  despite being required migration targets. Added lora-dataset/
  lora-run tokens following the adapter row's existing scope pattern.
- The bootstrap sequence never anchored its journal's operation_id
  before creating the journal, so a crash between journal-write and
  root-commit left an orphan no restart path could authenticate. Fixed
  by having the bootstrap write a NOT_COMMITTED root slot naming the
  operation_id first, reusing the root_commit_evidence encoding above.

No implementation, no status-line or refusal-list change, no other
files touched.

* docs(core): close three third-wave R-15 inventory/encoding findings

The push in bcde8fa triggered another incremental review with 9 new
findings; per maintainer decision, closing the three narrow ones now
and deferring the six that are actual protocol-design questions
(marker replay-safety, floor/root atomicity, staging-vs-final-record
AAD, gate-sequencing, paged-journal identity) to a separate discussion.

- Two more unclassified localStorage stores, same pattern as the
  three already in the inventory: the LoRA Redux mirror
  (features/lora/loraSlice.ts, worldscript-lora) and the AI benchmark
  history (services/ai/benchmarkService.ts, worldscript-benchmarks).
  New PROTECTED rows plus identity/token entries; inventory count now
  35 PROTECTED / 42 classes total.
- Extended §6.2's tagged direct-or-hashed identity binding (already
  used for envelope AAD) to every other control-plane occurrence of a
  logical identity or project ID: marker_set_digest entries (including
  the asset-pair shape), catalog descriptors, and inventory_digest
  descriptors. An identity over the 16,384-byte direct bound no longer
  has an undefined encoding once it needs a commit marker, catalog
  entry, or migration descriptor.

No implementation, no status-line or refusal-list change, no other
files touched.

* docs(core): reconcile final R-15 review invariants (#445)

Implements the maintainer's authorized protocol-design decisions for
the six remaining review threads (five underlying topics), closing
the real contract contradictions the last review wave surfaced:

- Rollback floor + root commit (graphite + codex, same gap): replaced
  the contradictory "before or atomically with" floor-advance wording
  with an explicit two-phase secure-anchor protocol (new §5.3.1) —
  prepare/commit state machine, a 5-row crash table where only an
  exact operation_id/target_root_generation/target_root_digest match
  permits completing a commit forward, and a fail-closed requirement
  for adapters that can't provide the ordering. KeyProvider's
  read_floor()/advance_floor() replaced with
  read_root_anchor_state()/prepare_root_anchor()/commit_root_anchor()/
  abort_or_recover_root_anchor().

- Marker replay: marker_set_digest now binds a per-identity
  marker_entry_digest over a full state-tagged canonical marker body
  (operation_id, fencing_generation, and every other authority field
  per ACTIVE/PENDING/DELETE_PENDING/TOMBSTONED/RECOVERY_REQUIRED
  state, including the asset-pair pair shape), closing the gap where
  an older valid PENDING/DELETE_PENDING marker with different
  operation authority could still match the current root.

- Staging AAD: staging and migration-stage are no longer AAD
  record-class tokens. A candidate envelope is encrypted under its
  final record's own identity from creation (§9 steps 3/7); staging
  is a physical locator only, and promotion never re-encrypts.

- Gate sequencing: Gate 5 is now a migration admission-readiness gate
  — every current writer of a packaged-desktop PROTECTED class must
  be admitted into the Core fence, quiesced, or refused before that
  class's final inventory is captured, closing the window where Gate
  5 could migrate a class while its WebView writer kept producing
  untracked plaintext until Gate 7. Gate 7 remains the separate
  authority switch.

- Paged journal: new §10.1.1 defines migration-page:<operation-id>:
  <page-index> as an authenticated protected envelope, a
  journal_page_set_digest analogous to catalog_set_digest, and a
  7-case crash-recovery table, reconciled with the existing
  journal-excludes-itself-from-inventory rule.

Four new §16 fault-injection assertions (replay vectors, staging/
promotion identity stability, concurrent-writer admission, paged-
journal recovery). No implementation, no status-line or
refusal-list change, no other files touched.

* docs(core): close R-15 control-plane authority gaps (#445)

Restructures the control-plane authority model around one unified,
non-recursive graph (secure anchor -> authority root -> {marker_set,
catalog_set, key_epoch_set} digests -> immutable generation-addressed
control records), closing 12 review findings that were different
manifestations of the same underlying gap plus several independent
completions:

- Trusted cold-start root-key routing: the secure anchor now also
  carries a committed_root binding (generation/digest/slot/key-ref).
  Cold start resolves the root key exclusively from this anchor-bound
  reference, never from the unauthenticated root-envelope header and
  never by trying every KeyProvider.list_epochs() entry.
- Prepared-vs-final root digest: target_final_root_digest is now
  defined as the digest of the post-commit COMMITTED representation,
  computed canonically before PREPARE, so the two-phase protocol's
  exact-match recovery rule is actually satisfiable (root_commit_state_
  code legitimately differs between the NOT_COMMITTED candidate and
  the COMMITTED final digest, and no step conflates them).
- key_epoch_set_digest binds the key-epoch registry into root_digest,
  closing its replay gap the same way catalog_set_digest already
  closes the catalog's.
- Marker generations are now immutable and generation-addressed
  (marker_generation, distinct from record_generation), with a
  retention rule so startup has actual recoverable bytes after a
  crash, not just a digest.
- Catalog pages are explicitly excluded from their own descriptor set
  (same non-recursion principle already used for the root and the
  journal), and ordinary writes now update the catalog in the same
  serialized commit as the marker/root, closing the staleness gap
  from the first autosave after authority switch.
- root_commit_mutex is a new serialized lock below operation-level
  admission, closing the shared-to-exclusive upgrade deadlock between
  concurrent ordinary writers.
- Structured RecordIdentity replaces colon-delimited logical-string
  parsing for project scope in the public read/write/delete surface.
- Two more inventory/encoding completions: the existing IDB KDF salt
  (migration-critical, non-secret) and canonical legacy
  source-authority-kind/generation encoding for inventory_digest.
- asset-pair markers now support TOMBSTONED (was missing) with
  complete DELETE_PENDING semantics.
- READ_AUTHORITY_PENDING (code 6) is explicitly valid for both
  single-record and asset-pair bodies, removing a pair-only
  description that contradicted the already-existing single-record
  body.

Re-derived the full control graph and verified it contains no cycle.
No implementation, no status-line or refusal-list change, no other
files touched.

* docs(core): close R-15 bootstrap, catalog, and foreign-source gaps (#445)

Closes 8 review findings: 7 mechanical completions of the prior batch's
control-plane graph, plus a new foreign-protected migration-source
subsystem (finding #8, maintainer-designed).

- Bootstrap (§10.2) now uses the exact same prepare_root_anchor/
  commit_root_anchor two-phase sequence as every later root commit,
  with the initial key-epoch control record created before the first
  root claims active_key_epoch. Closes the crash window where a
  NOT_COMMITTED bootstrap slot had no anchor-bound trusted key
  reference to authenticate against.
- Catalog descriptors (§5.5) now use explicit presence encoding
  (has_active_record_generation/has_active_epoch/has_content_digest)
  so a brand-new PENDING(none->1) descriptor never has to invent a
  committed generation/epoch/digest that doesn't exist yet;
  enumerable-but-not-yet-readable is now an explicit, distinct state
  from readable.
- Removed a leftover sentence describing catalog pages as "covered by
  the marker set," which contradicted the catalog self-exclusion rule.
- inventory_digest now has a normative sort tuple (record-class token,
  tagged identity, tagged project scope, source-authority kind,
  source-scheme id) instead of an undefined "sorted."
- marker_set_digest's outer entry is now consistently described as
  five fields (including marker_generation) everywhere it's
  paraphrased, not just in the normative table.
- §6.2 now has a deterministic direct-vs-hashed AAD selection rule for
  the case where two individually-in-bound identity fields would
  jointly exceed the 32 KiB AAD limit.
- New: a three-way source_authority_kind (LEGACY_PLAINTEXT/
  R15_PROTECTED/FOREIGN_PROTECTED), a versioned source_scheme_id
  registry (WEBVIEW_IDB_AT_REST_V1, CREDENTIAL_IDB_KEYSTORE_V1), a
  MigrationSourceAdapter boundary distinct from KeyProvider (§15.3), a
  preserve-first foreign-migration flow with no-transitive-trust
  validation (§10.6), an explicit per-class migration-disposition
  model including credentials' RETAIN_APPROVED_SEPARATE_PROTECTED_
  AUTHORITY (§10.4.1), and 13 new foreign-source fault-injection
  requirements (§16 assertion 19).

No implementation, no status-line or refusal-list change, no other
files touched. Verified: KeyProvider / MigrationSourceAdapter /
source_scheme registry / Core remain four distinct, non-collapsing
layers.

* docs(core): close R-15 digest, disposition, and control-plane gaps

Reconciles 7 chatgpt-codex-connector findings: adds a mutation-detection
source_evidence_digest for LEGACY_PLAINTEXT inventory descriptors (not
only FOREIGN_PROTECTED); defines the canonical shard_id wire encoding
and duplicate-rejection rule; adds an exhaustive migration-disposition
registry covering all 37 PROTECTED classes; fixes the bootstrap
marker_set_digest empty/single-entry contradiction; makes the journal
manifest generation-addressed and retained like its pages; reconciles
S11.1's root_commit_mutex acquisition sequence with S9's already-correct
two-acquisition text; and inventories the IDB passphrase sentinel
alongside its adjacent KDF salt row. The packaged-desktop IndexedDB
fallback finding is deferred pending a maintainer authority-precedence
decision (no reconciliation exists today between filesystem and
IndexedDB-fallback copies of a diverging singleton identity).

* docs(core): resolve wave-9 findings, closing counter-exhaustion class

Fixes 8 findings, several caused by wave-8's own fixes (candidate
locator canonicalization, tagged-binding context-dependence) - closing
the whole regression class rather than patching each in isolation:

- Bind the manifest envelope's own content_digest in the root's
  live-migration tuple, not merely its journal_page_set_digest
  sub-field, so two manifests sharing operation/fence/revision/page-set
  but differing in phase/cursor/finalization are now distinguishable.
- Eliminate the candidate_descriptor field entirely: the staging
  locator is fully determined by operation_id/target_generation, both
  already-present marker fields, so no renderer-neutral path-encoding
  format is needed at all.
- Replace the context-dependent tagged-binding-reuse check (wave 8)
  with a fixed, entry-type-independent 256-byte direct-form cap.
- Introduce ONE consolidated generation/epoch/revision counter
  lifecycle rule covering record/marker/catalog/pair generation,
  root_generation, active_key_epoch, and registry_generation, closing
  the key-epoch and marker-generation exhaustion gaps in the same pass
  that already covered root_generation.
- Narrow the InstallationScopeId golden-vector requirement to scope-
  embedding record classes only, matching AAD's actual field list.
- Canonicalize snapshot's legacy numeric identity via the existing
  canonical-decimal rule; assign RAG's missing index-version=1
  constant; make AI benchmark history one singleton record instead of
  a non-existent per-entry ID.
- Correct LoRA dataset/run identities to their real persisted
  projectId ownership (already fixed in wave 8 for the same root
  cause found again in adjacent code).

Widens S5-B1 to also own identity-upgrade/recovery for unbound
AAD-less legacy sources and unidentified legacy quarantine data,
rather than leaving S5_TERMINAL unreachable for those classes.