qnbs · qnbs · Jul 28, 2026 · Jul 28, 2026 · Jul 28, 2026
@@ -1,8 +1,8 @@
 # WorldScript Studio — Codebase Audit Report
 
-**Date:** 2026-04-17 (baseline); **follow-up chain:** … → 2026-05-28 (v1.19.0 — Security/Voice/RTL/Logger B-1..B-8) → **2026-05-30 (B-1 passphrase UX + CI unblock)** → **2026-05-31 (i18n audit + settings features + CI stabilization)** → **2026-05-31 (Edge-AI Perfection Cycle — Phases 0-7 complete)** → **2026-06-01 (Post-crash session: CI stabilisation + 14 CodeAnt AI fixes + E2E hardening)** → **2026-06-02 (Perf Phase 2.3 — pipeline-LRU unification + PR #69 CodeAnt fixes)** → **2026-06-03 (WorkerBus v2 Phase 3 — Rust TaskSupervisor + Tauri-build unblock)** → **2026-06-06 (Phase 3 i18n Expansion — ja/zh/pt/el + Intl APIs)** → **2026-06-09 (v1.21 Deep Audit Correction — Whisper WASM download UI + 3 CodeAnt fixes + CloudSync LWW)** → **2026-06-09 (feat/deep-audit-v1.21 — CSP hardening, zh locale ≤5% EN, coverage Batches A/B/C, VoiceActivityCoordinator B-2 bridge)** → **2026-06-11 (Ultimate Copilot v2 Phase 2+3 — markdown, sidebar, Apply-to-chapter, InlineAnnotation, ProForge chip; PR #110+#111)** → **2026-06-11 (v1.22.0 release — OpenRouter Cloud 5 provider, AI Execution Modes hybrid/cloud/local/eco, AiModeIndicator, SW cache-invalidation fix)** → **2026-06-13/14 (v1.23 perfection batch — OpenRouter + AI-Execution-Mode settings sections localized/modernized, i18n single-brace interpolation bug-class fix + `i18nPlaceholders` regression guard, bundle split + budget tightening PR #130)** → **2026-06-16 (v1.23.0 release — rebrand StoryCraft → WorldScript Studio, local-first data foundation ADR-0008, Tauri blank-screen + asset-URL fixes, AI error taxonomy + retry hardening, command-palette & local-AI settings localization, WorldScript W monogram icons)** → **2026-06-16 (post-release documentation perfection pass — corpus sync, metric reconciliation, history archival, dependabot hardening)** → **2026-06-17 (Language expansion — +6 locales fi/sv/hu/is/eu/fa (RTL); PR #174 merged; `LanguageSelector` exonym localization via `portal.language.names.*`; portal chrome 100 % for the 6 new langs; README/AUDIT/CHANGELOG docs sync)**
+**Date:** 2026-04-17 (baseline); **follow-up chain:** … → 2026-05-28 (v1.19.0 — Security/Voice/RTL/Logger B-1..B-8) → **2026-05-30 (B-1 passphrase UX + CI unblock)** → **2026-05-31 (i18n audit + settings features + CI stabilization)** → **2026-05-31 (Edge-AI Perfection Cycle — Phases 0-7 complete)** → **2026-06-01 (Post-crash session: CI stabilisation + 14 CodeAnt AI fixes + E2E hardening)** → **2026-06-02 (Perf Phase 2.3 — pipeline-LRU unification + PR #69 CodeAnt fixes)** → **2026-06-03 (WorkerBus v2 Phase 3 — Rust TaskSupervisor + Tauri-build unblock)** → **2026-06-06 (Phase 3 i18n Expansion — ja/zh/pt/el + Intl APIs)** → **2026-06-09 (v1.21 Deep Audit Correction — Whisper WASM download UI + 3 CodeAnt fixes + CloudSync LWW)** → **2026-06-09 (feat/deep-audit-v1.21 — CSP hardening, zh locale ≤5% EN, coverage Batches A/B/C, VoiceActivityCoordinator B-2 bridge)** → **2026-06-11 (Ultimate Copilot v2 Phase 2+3 — markdown, sidebar, Apply-to-chapter, InlineAnnotation, ProForge chip; PR #110+#111)** → **2026-06-11 (v1.22.0 release — OpenRouter Cloud 5 provider, AI Execution Modes hybrid/cloud/local/eco, AiModeIndicator, SW cache-invalidation fix)** → **2026-06-13/14 (v1.23 perfection batch — OpenRouter + AI-Execution-Mode settings sections localized/modernized, i18n single-brace interpolation bug-class fix + `i18nPlaceholders` regression guard, bundle split + budget tightening PR #130)** → **2026-06-16 (v1.23.0 release — rebrand StoryCraft → WorldScript Studio, local-first data foundation ADR-0008, Tauri blank-screen + asset-URL fixes, AI error taxonomy + retry hardening, command-palette & local-AI settings localization, WorldScript W monogram icons)** → **2026-06-16 (post-release documentation perfection pass — corpus sync, metric reconciliation, history archival, dependabot hardening)** → **2026-06-17 (Language expansion — +6 locales fi/sv/hu/is/eu/fa (RTL); PR #174 merged; `LanguageSelector` exonym localization via `portal.language.names.*`; portal chrome 100 % for the 6 new langs; README/AUDIT/CHANGELOG docs sync)** → **2026-07-28 (v1.24.1 — Local-AI reliability fixes #266, Dependabot backlog triage, Issue #60 audit closeout, security/build hardening)**
 **Scope:** Full application, repository configuration, CI/CD, documentation, release validation
-**Current version:** **v1.24.0** — 2026-06-21 (Critical & Immediate hardening sequence: Privacy → Analytics opt-out now gates all DuckDB writes + telemetry (SEC-6); reusable `Badge` + experimental labeling; +101 tests for collab-transport/ProForge/Copilot; voice consent clarity; device-aware Ollama recommendation + one-click pull; dependency/onboarding/docs hygiene; **2786 keys × 17 locales**)
+**Current version:** **v1.24.1** — 2026-07-28 (Local-AI reliability — desktop Ollama/LM Studio/vLLM discovery + browser status-badge fixes; AI heuristic-fallback foundation + Outline/Character/World/Plot-Board generators; real self-hosted LanguageTool integration; 20-PR Dependabot backlog triage; Issue #60 vendor-fork audit closeout; `persist-credentials`/CWE-209 security hardening; **2844 keys × 19 locales**)
 
 **Quality gate (2026-06-17 — language expansion +6 locales):** lint ✅ · typecheck ✅ · i18n:check ✅ (**2716 keys × 17 locales** — fi/sv/hu/is/eu + fa RTL) · placeholder guard ✅ (17 bundles) · targeted unit tests ✅ (LanguageSelector 9 · I18nContext 59 · i18nPlaceholders 33). `LanguageSelector` exonym labels localized via `portal.language.names.*` (native endonym stays hardcoded by design). **Bulk translation completed** for all 10 Beta locales (glossary v2.0, ~44 anchor terms/locale; placeholder-masked, checkpointed): post-run coverage fi 91 % · sv 90 % · hu 91 % · is 92 % · eu 92 % · fa 93 % · ja 99 % · zh 100 % · pt 98 % · el 97 % (Beta MT; human native review tracked). Two bulk-script bugs fixed: (1) `glossaryTranslate` partial-match left ~1,300 strings partially English → now exact-match only; (2) `--all` mangled `help.json` rich HTML → `help.json` excluded from `--all` (`ALL_SKIP`) and kept English fallback for the 6 new langs (tag-dense markup isn't MT-safe; human-review task). New `docs/TRANSLATION-GUIDE.md` + `I18N-GLOSSARY.md` v2.0.
 
@@ -14,12 +14,14 @@
 
 ## v1.24.1 Local-AI reliability + Dependabot batch (2026-07-28)
 
-**Quality gate (2026-07-28):** lint ✅ · typecheck ✅ · i18n:check ✅ (**2834 keys × 19 locales** — `ru`/`ko` added since the v1.24.0 count above; `settings.ai.providerStatusUnavailableBrowser` new key) · targeted unit tests ✅ (PR #272: 40 · PR #273: 64, incl. new badge-reconciliation + scan-endpoint-order coverage).
+**Quality gate (2026-07-28):** lint ✅ · typecheck ✅ · i18n:check ✅ (**2844 keys × 19 locales** — `ru`/`ko` added since the v1.24.0 count above; `settings.ai.providerStatusUnavailableBrowser` + `settings.ai.testError.*` new keys) · targeted unit tests ✅ (127 across the 7 merged PRs, incl. badge-reconciliation, scan-endpoint-order, CWE-209 stale-request-guard, and binder-pin-reconciliation coverage) · **5807+ tests / 525 files** · CI Quality Gate (Node 22 + 24) green on every merged PR.
 
-- **#266 (Ollama/LM Studio/vLLM), two remaining halves fixed**, both root-caused with a real build+runtime repro rather than guessed: (1) desktop discovery was still broken after #269 because `vite.config.ts` externalized `@tauri-apps/*` even for the Tauri build itself, leaving `services/localServerHttp.ts`'s plugin-http import unresolvable in the packaged app — fixed via a shared `isTauriBuild()` check (PR #272); (2) the browser status badge and the desktop-only banner were driven by two unreconciled state signals, so the badge always read "Ready" next to a banner saying otherwise — fixed with a distinct "Not available in browser" label (PR #273).
-- **Dependabot backlog triaged:** 13 of 18 open PRs merged directly; the remaining 5 (AI-SDK v4 family, biome 2.5.x, dev-tooling/Babel 8) each had a real breaking-change blocker, root-caused and fixed with real code (AI-SDK family combined into PR #275; biome and dev-tooling fixes pushed directly onto their Dependabot branches) rather than force-merged or suppressed. See `TODO.md` § v1.24.1 for the full breakdown.
+- **#266 (Ollama/LM Studio/vLLM), two remaining halves fixed**, both root-caused with a real build+runtime repro rather than guessed: (1) desktop discovery was still broken after #269 because `vite.config.ts` externalized `@tauri-apps/*` even for the Tauri build itself, leaving `services/localServerHttp.ts`'s plugin-http import unresolvable in the packaged app — fixed via a shared `isTauriBuild()` check (PR #272); (2) the browser status badge and the desktop-only banner were driven by two unreconciled state signals, so the badge always read "Ready" next to a banner saying otherwise — fixed with a distinct "Not available in browser" label (PR #273). Issue closed with a full root-cause explanation.
+- **Dependabot backlog triaged — 20 PRs resolved (16 merged, 4 closed as superseded):** 14 were straightforward bumps (Actions, small JS/dev-tooling patches, Tauri/Rust crates, the tauri-deps group, a stray `log` crate bump); the other 6 each had a real breaking-change blocker, root-caused and fixed with real code rather than force-merged or suppressed — biome 2.5.x and dev-tooling/Babel 8 were fixed directly on their own Dependabot branch and merged, while the 4-PR AI-SDK v4 family (`@ai-sdk/google`/`@ai-sdk/openai`/`@ai-sdk/react`/`ai`) was combined into one coordinated PR #275 and the 4 originals closed as superseded. See `TODO.md` § v1.24.1 for the full breakdown.
 - **Issue #60 (vendor-fork audit):** confirmed done (fork `10.3.0-sc2`, `verify:vendor` CI guard); status comment posted, issue stays open per its own standing-reminder policy.
 - **CLAUDE.md doc-drift correction:** locale roster count (17→19) and per-locale module count (20→21) were stale relative to `i18n/locales.ts` (the actual SSOT).
+- **`pnpm run build` warnings eliminated:** an invalid `[dir:ltr]`/`[dir:rtl]` Tailwind arbitrary variant (compiled to the invalid CSS pseudo-class `:is(dir:ltr)`) replaced with Tailwind's built-in `ltr:`/`rtl:` direction variants; 3 dynamic `import()` calls Rolldown flagged as ineffective (already statically imported elsewhere) converted to static imports.
+- **CodeRabbit review-body findings that failed to post inline** (GitHub API error on a rate-limited re-review of PR #274) verified against current code and fixed: `AiProviderCard` a11y (`role="status" aria-live="polite"`) and a genuine CWE-209 stale-request race in `handleTest` (monotonic request-id guard); `ollamaService.ts`'s `plugin_unavailable` branch no longer forwards `LocalServerError.message` directly.
 
 ## v1.24.0 Dependency Hygiene + Onboarding + Docs Truth-up (2026-06-21, PR F)
 

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.24.1] — 2026-07-28
+
+> Local-AI reliability (desktop Ollama/LM Studio/vLLM discovery, misleading browser status badge),
+> the AI heuristic-fallback foundation + Outline/Character/World/Plot-Board generators, real
+> self-hosted LanguageTool integration, a 20-PR Dependabot backlog triage (16 merged directly,
+> 4 closed as superseded after the AI SDK v4 family/biome 2.5.x/dev-tooling-Babel-8 blockers were
+> root-caused and fixed), the Issue #60 vendor-fork audit
+> closeout, and security/build hardening (`persist-credentials` CWE-522, `ltr`/`rtl` Tailwind fix,
+> 3 ineffective dynamic imports, 2 CWE-209 fixes).
+
 ### Added
 
 - **Heuristic fallback for Plot-Board "suggest next beat".** Completes offline coverage of the

@@ -9,11 +9,11 @@
   <img src="https://img.shields.io/badge/TypeScript-7.x_(tsgo)-3178C6?logo=typescript&logoColor=white" alt="TypeScript 7 (tsgo)">
   <img src="https://img.shields.io/badge/AI-Gemini_%7C_OpenAI_%7C_OpenRouter_%7C_Ollama_%7C_WebLLM-4285F4?logo=google" alt="Gemini · OpenAI · OpenRouter · Ollama · WebLLM">
   <img src="https://img.shields.io/badge/Local_AI-WebGPU_%7C_ONNX_%7C_Transformers.js-8B5CF6" alt="WebGPU · ONNX · Transformers.js">
-  <img src="https://img.shields.io/badge/Version-v1.24.0-6366F1" alt="v1.24.0">
+  <img src="https://img.shields.io/badge/Version-v1.24.1-6366F1" alt="v1.24.1">
   <img src="https://img.shields.io/badge/Storage-IndexedDB_v8-F59E0B" alt="IndexedDB v8">
   <img src="https://img.shields.io/badge/PWA-v3.0-5BB974?logo=pwa" alt="PWA v3.0">
-  <img src="https://img.shields.io/badge/i18n-19_locales-2806_keys-0EA5E9" alt="i18n 19 locales — 2806 keys">
-  <img src="https://img.shields.io/badge/Tests-5807%2B_%2F_509_files-22C55E" alt="5807+ tests / 509 files">
+  <img src="https://img.shields.io/badge/i18n-19_locales-2844_keys-0EA5E9" alt="i18n 19 locales — 2844 keys">
+  <img src="https://img.shields.io/badge/Tests-5807%2B_%2F_525_files-22C55E" alt="5807+ tests / 525 files">
   <img src="https://img.shields.io/codecov/c/github/qnbs/WorldScript-Studio?logo=codecov&label=Coverage" alt="Codecov Coverage">
   <img src="https://img.shields.io/badge/License-MIT-22C55E" alt="License MIT">
   <img src="https://img.shields.io/github/actions/workflow/status/qnbs/WorldScript-Studio/.github/workflows/ci.yml?branch=main&logo=github" alt="CI Status">
@@ -351,7 +351,7 @@ One-click encrypted export of your entire project library from **Settings → Da
 
 ### 🌐 Full Multi-Language Support
 
-Shipped UI locales with **2806 i18n keys** across all 17 languages — zero hardcoded user-facing strings:
+Shipped UI locales with **2844 i18n keys** across all 19 languages — zero hardcoded user-facing strings:
 
 - 🇩🇪 **German** (Deutsch)
 - 🇬🇧 **English**
@@ -460,8 +460,8 @@ The Settings → AI panel shows a live GPU status badge with adapter details and
 | **PDF Export**       | jsPDF                                                     | Client-side, configurable PDF document generation                    |
 | **Document Export**  | docx + jszip                                              | Word-compatible `.docx` generation (lazy-loaded)                     |
 | **PWA**              | Service Worker + Web App Manifest v3                     | Offline support, installability, Workbox chunking                    |
-| **i18n**             | Custom React Context (`I18nContext.tsx`)                  | 2806 keys × 19 locales (de/en/es/fr/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu Beta); EN fallback; `localStorage` persistence |
-| **Testing**          | Vitest 4.x (5807+ tests / 509 files) + Playwright E2E    | Unit/integration + cross-browser E2E; Stryker mutation (manual workflow)          |
+| **i18n**             | Custom React Context (`I18nContext.tsx`)                  | 2844 keys × 19 locales (de/en/es/fr/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu Beta); EN fallback; `localStorage` persistence |
+| **Testing**          | Vitest 4.x (5807+ tests / 525 files) + Playwright E2E    | Unit/integration + cross-browser E2E; Stryker mutation (manual workflow)          |
 | **Code Quality**     | Biome (lint + format) + TypeScript 7 (tsgo) strict       | `--error-on-warnings` in CI; zero `any` policy                      |
 | **Visualization**    | Force-directed graph                                      | Interactive character relationship network                           |
 | **Desktop**          | Tauri v2                                                  | Cross-platform installer; auto-updater via `latest.json`             |
@@ -498,7 +498,7 @@ WorldScript-Studio/
 │   ├── sw.js             # PWA Service Worker
 │   └── manifest.json     # PWA Web App Manifest v3
 ├── tests/
-│   ├── unit/             # Vitest unit tests (5807+ tests, 509 files)
+│   ├── unit/             # Vitest unit tests (5807+ tests, 525 files)
 │   │   ├── ai/           # aiSmallModules, aiCoreFallbackPaths
 │   │   └── settings/     # WebLlmPanel, AiSections
 │   └── e2e/              # Playwright specs + helpers.ts
@@ -656,10 +656,10 @@ The main pipeline is [`.github/workflows/ci.yml`](.github/workflows/ci.yml). Opt
 | `deploy`     | `main` only          | GitHub Pages after **`build` + `e2e`** succeed |
 | `scorecard`  | weekly + `main` push | OpenSSF Scorecard — SARIF uploaded to GitHub Code Scanning |
 
-**Current test metrics (2026-06-16):**
-- **5807+ unit tests** across **509 test files** — all passing
+**Current test metrics (2026-07-28):**
+- **5807+ unit tests** across **525 test files** — all passing
 - Coverage thresholds: lines ≥ 74 · branches ≥ 60 · functions ≥ 67 · statements ≥ 72 — enforced in CI (see Codecov badge for live metrics)
-- i18n: **2806 keys × 19 locales** (en/de/fr/es/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu Beta)
+- i18n: **2844 keys × 19 locales** (en/de/fr/es/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu Beta)
 
 **CI-cloud-first workflow (recommended):** On constrained hardware run **`pnpm run lint && pnpm run i18n:check && pnpm run typecheck`** locally, then push and let CI handle coverage, E2E, Lighthouse, and Stryker. Authoritative numbers come from CI artifacts (Codecov, JUnit). After CI goes green, update the README badges and `AUDIT.md` quality-gate line from the reported metrics. See **[`docs/CI.md`](docs/CI.md) § Cloud CI-first vs local development** for the full post-merge doc-update checklist.