From 1b8f1102b272ca3d3776a103a254aee354f7422a Mon Sep 17 00:00:00 2001
From: qnbs <155236708+qnbs@users.noreply.github.com>
Date: Thu, 13 Aug 2026 09:19:11 +0200
Subject: [PATCH 1/5] docs(security): correct false desktop encryption claims

docs/IDB-ENCRYPTION.md claimed Tauri desktop shares the web build's full
IDB encryption lifecycle. It doesn't: services/fs/*Store.ts writes project,
settings, snapshot, Codex, RAG, and binder-asset data as plaintext
(LZ-string compressed only) regardless of the enableIdbAtRestEncryption
setting. Enabling it on desktop still shows the passphrase unlock screen,
which currently gates nothing on the filesystem side.

Separately, the desktop API-key encryption "fix" credited to F-05/F-06
(2026-07-29, AUDIT.md/CHANGELOG.md) upgraded the KDF (unsalted SHA-256 ->
PBKDF2 + random salt) but never addressed the actual finding: the PBKDF2
passphrase input (`${appDataPath}|${provider}|WorldScriptStudio|v1`) is
built entirely from public/discoverable values, so anyone with read access
to the encrypted key file can reconstruct it and decrypt in one step. No
brute force needed - the added iterations defend against an attack that
isn't the real one. AUDIT.md, CHANGELOG.md, and SECURITY-THREAT-MODEL.md
all still described this as resolved.

Corrects all four docs to state the real, current status and reopens
F-05/F-06 in AUDIT.md. Real fixes for both gaps are tracked as follow-up
work (fold API keys and project data into the existing user-passphrase
protected-store scheme in services/storage/encryptionMigrationOrchestrator.ts
instead of the current derived-passphrase/plaintext state).

Docs-only change, no code/behavior modified.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 AUDIT.md                      | 2 +-
 CHANGELOG.md                  | 6 +++++-
 README.md                     | 8 +++++---
 docs/IDB-ENCRYPTION.md        | 8 +++++++-
 docs/SECURITY-THREAT-MODEL.md | 2 +-
 5 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/AUDIT.md b/AUDIT.md
index 612d1a57..c78e0c69 100644
--- a/AUDIT.md
+++ b/AUDIT.md
@@ -40,7 +40,7 @@ change landed — all 14 findings CONFIRMED, no baseline drift, base SHA `f5f9c1
 | F-02 | 🔴 P0 | Unhashed inline `<script>` in `index.html`, added in the same commit as the broken `script-src`, contradicting that commit's own CSP-strategy comment | Moved into `index.tsx` as a same-origin module |
 | F-03 | 🔴 P0 | No `frame-src`/`child-src` anywhere → `blob:` iframes (Binder PDF preview, ManuscriptResearchSplit) fall back to `default-src 'self'` and are blocked | `frame-src 'self' blob:` added to all 5 surfaces |
 | F-04 | 🔴 P0 | No gate could have caught F-01/F-02 — existing CSP tests check cross-surface consistency only; `smoke-prod-build.mjs` only listened for `pageerror`, which CSP violations never fire | New 3-layer test architecture: Layer A (consistency, existing) / Layer B (`tests/unit/cspCorrectness.test.ts`, new) / Layer C (hardened `smoke-prod-build.mjs`, real violation + WASM probes). `docs/CI.md` gate-governance table |
-| F-05/F-06 | 🟠 P1 | Desktop API-key encryption derived its key from a single unsalted SHA-256 digest of publicly-derivable material — obfuscation, not encryption | PBKDF2 600k + random 32-byte salt in `services/fs/fsCore.ts`, matching `storageEncryptionService.ts`. Legacy files discarded (not migrated), one-time re-entry notification |
+| F-05/F-06 | 🟠 P1 — **reopened 2026-08-13** | Desktop API-key encryption derived its key from a single unsalted SHA-256 digest of publicly-derivable material — obfuscation, not encryption | PBKDF2 600k + random 32-byte salt in `services/fs/fsCore.ts`, matching `storageEncryptionService.ts`. Legacy files discarded (not migrated), one-time re-entry notification. **Incomplete**: the salt/iteration upgrade only hardens against rainbow-table/multi-target reuse — the derivation *input* (`${appDataPath}\|${provider}\|WorldScriptStudio\|v1`) is still fully public, so the root finding (anyone with file-read access reconstructs the key in one PBKDF2 call, no brute force needed) was never actually closed. Real fix tracked: fold API keys into the user-passphrase-protected store scheme (`services/storage/encryptionMigrationOrchestrator.ts`), removing the derived-passphrase scheme entirely |
 | F-07 | 🟠 P1 | README/CLAUDE.md made a blanket "encrypted at rest" claim; a fabricated `tauri-plugin-stronghold` OS-keychain claim had zero trace in the codebase; `SECURITY-THREAT-MODEL.md` never mentioned `fsCore.ts`/`settingsFsStore.ts` | Doc truth-up: differentiated 4-mechanism table in README, fabricated claim removed, threat-model gained a mitigations row + attack tree |
 | F-08 | 🟠 P1 | Tauri `connect-src` missing LanguageTool's port and the Hugging Face hosts WebLLM/Transformers.js resolve models from | Fixed; scope widened during verification — the LanguageTool port was missing on **all 5** surfaces, not just Tauri; the real weight-file CDN (`us.aws.cdn.hf.co`) traced empirically via `curl`, not guessed |
 | F-09 | 🟠 P1 | DuckDB-WASM loaded from an unversioned, floating-`latest` third-party CDN — already unreachable under the (correctly-scoped) `worker-src` CSP, so this was dead code, not just a supply-chain risk | Self-hosted from the pinned npm dependency via `scripts/copy-duckdb-assets.mjs` (gitignored, ~72 MB, never committed) |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e943880c..74e1ac77 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -372,7 +372,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   single unsalted SHA-256 digest of publicly-derivable material — fixed to PBKDF2 (600,000
   iterations) + a random 32-byte salt, matching the existing `storageEncryptionService.ts`
   pattern. Pre-existing key files are discarded (not migrated) with a one-time notification
-  prompting re-entry.
+  prompting re-entry. **Correction (2026-08-13):** this hardened the KDF against rainbow-table
+  and multi-target reuse, but the derivation *input* itself — `${appDataPath}|${provider}|WorldScriptStudio|v1`
+  — remained fully public/reconstructible, so the root "obfuscation, not encryption" finding was
+  never actually closed. Tracked as an open gap — see `docs/IDB-ENCRYPTION.md` § Tauri Desktop Layer
+  and `AUDIT.md`'s F-05/F-06 row for current status.
 - **F-08 — Tauri/web `connect-src` completeness.** Added LanguageTool's default self-hosted port
   (missing on **all 5** surfaces, not just Tauri) and the Hugging Face hosts WebLLM/Transformers.js
   actually resolve models from, including the Xet CDN bridge (`us.aws.cdn.hf.co`) that real model
diff --git a/README.md b/README.md
index 66401b01..01b010c8 100644
--- a/README.md
+++ b/README.md
@@ -326,14 +326,16 @@ One-click encrypted export of your entire project library from **Settings → Da
 
 ### 🔑 Encryption — which mechanism protects what
 
-There is no single blanket "encrypted at rest" guarantee — four independent mechanisms protect
-different data, with different key material:
+There is no single blanket "encrypted at rest" guarantee — five independent mechanisms cover
+different data, with different key material, and two of them (marked ⚠️) currently provide no
+real protection despite being present in code:
 
 | Data | Mechanism | Where |
 |------|-----------|-------|
 | **Browser BYOK API key** | Random, non-extractable AES-256-GCM key generated via `crypto.subtle.generateKey()` — no passphrase, nothing to derive | `services/storage/idbKeyStore.ts` |
 | **Browser IDB-at-rest data** _(opt-in, B-1)_ | User passphrase → PBKDF2 (600 000 iterations, SHA-256, random 32-byte salt) → AES-256-GCM, non-extractable key | `services/storage/storageEncryptionService.ts` |
-| **Desktop (Tauri) BYOK API key** | Install-scoped secret material → PBKDF2 (600 000 iterations, SHA-256, random 32-byte salt) → AES-256-GCM, non-extractable key | `services/fs/fsCore.ts`, `services/fs/settingsFsStore.ts` |
+| **Desktop (Tauri) BYOK API key** ⚠️ | PBKDF2 (600 000 iterations, SHA-256, random 32-byte salt) → AES-256-GCM — but the passphrase input is a *public* string (`appDataPath\|provider\|WorldScriptStudio\|v1`), not a real secret; anyone with read access to the encrypted file can reconstruct it and decrypt in one step. Tracked, open gap — see `docs/IDB-ENCRYPTION.md` § Tauri Desktop Layer | `services/fs/fsCore.ts`, `services/fs/settingsFsStore.ts` |
+| **Desktop (Tauri) project/settings/snapshot/Codex/RAG/asset data** ⚠️ | **None — plaintext (LZ-string compressed only).** Enabling "Encrypt project data at rest" still shows the passphrase unlock screen on desktop, but it doesn't gate this filesystem-backed store. Tracked, open gap | `services/fs/*Store.ts` |
 | **Library backup vault** | User passphrase → PBKDF2 (600 000 iterations, SHA-256) → AES-256-GCM | `services/libraryBackupService.ts` |
 
 See [`docs/SECURITY-THREAT-MODEL.md`](docs/SECURITY-THREAT-MODEL.md) for the full threat-model mapping.
diff --git a/docs/IDB-ENCRYPTION.md b/docs/IDB-ENCRYPTION.md
index d83cda49..5f26b45c 100644
--- a/docs/IDB-ENCRYPTION.md
+++ b/docs/IDB-ENCRYPTION.md
@@ -161,7 +161,13 @@ Every protected store writer runs inside `withProtectedWriteAdmission()` (shared
 
 ## Tauri Desktop Layer
 
-Tauri uses the same WebView storage encryption lifecycle as the web build. The repository does **not** currently use `tauri-plugin-stronghold`, an OS keychain, or a transparent desktop-only passphrase store. Desktop users enter the passphrase through the same unlock flow and receive the same locked-write guarantees.
+**This section previously claimed desktop shares the full encryption lifecycle described above. That was inaccurate — corrected below.**
+
+On the Tauri desktop build, primary project, settings, snapshot, image, Codex, RAG, and binder-asset data is persisted by the filesystem-backed store (`services/fs/*Store.ts`), not IndexedDB. That store writes plaintext (LZ-string compressed only, no encryption) regardless of `enableIdbAtRestEncryption` — every writer is explicitly commented `ENCRYPTION: plaintext`. Enabling the setting on desktop still shows `IdbUnlockModal`/`PassphraseModal` (the passphrase sentinel lives in the WebView's own IndexedDB, which persists on desktop too), but that unlock flow gates nothing on the filesystem side today — only the UI, not the actual manuscript files under `$APPDATA`, is shared with the web build. See `README.md`'s "Encryption — which mechanism protects what" table for the authoritative per-mechanism breakdown. Extending real at-rest protection to the desktop filesystem store is a tracked, open gap — not yet implemented.
+
+The one thing that *is* desktop-specific and already encrypted is per-provider API keys (`services/fs/settingsFsStore.ts`, via `encryptText`/`decryptText` in `services/fs/fsCore.ts`) — but that mechanism has its own, separate weakness: its PBKDF2 passphrase is derived from a string built entirely out of public/discoverable values (the app-data path, the provider name, and hardcoded constants), not a real secret. Anyone with filesystem read access to the encrypted key file — the exact threat model at-rest encryption exists to defend against — can reconstruct the same derivation and decrypt it. This is also a tracked, open gap, independent from the project-data gap above; do not treat the presence of `encryptText`/`decryptText` as evidence that desktop API keys are meaningfully protected today.
+
+The repository does **not** currently use `tauri-plugin-stronghold`, an OS keychain, or a transparent desktop-only passphrase store.
 
 ---
 
diff --git a/docs/SECURITY-THREAT-MODEL.md b/docs/SECURITY-THREAT-MODEL.md
index 96e8b829..996e82ae 100644
--- a/docs/SECURITY-THREAT-MODEL.md
+++ b/docs/SECURITY-THREAT-MODEL.md
@@ -39,7 +39,7 @@ This document provides a formal STRIDE threat analysis for WorldScript Studio, m
 | Threat | Mitigation | Code Location |
 |--------|------------|-------------|
 | API key leakage via logs | StructuredLogger sanitization; never log keys | `services/logger.ts:sanitizeLogContext()` |
-| Desktop API key exposure via local file-read access | AES-256-GCM with a PBKDF2-derived key (600 000 iterations, SHA-256, random 32-byte salt per encryption) — fixed 2026-07-29; the prior scheme derived the key from a single unsalted SHA-256 digest of publicly-derivable material (own file's parent path + provider name from the filename + a hardcoded literal), so anyone with read access to `config/<provider>_key.enc.json` could reconstruct the key in one hash operation (F-05/F-06). No migration path for pre-fix files by design — a legacy (unsalted) payload is discarded and the user is prompted to re-enter the key. | `services/fs/fsCore.ts:deriveFileSystemCryptoKey()`, `services/fs/settingsFsStore.ts:getApiKey()` |
+| Desktop API key exposure via local file-read access | **Not resolved — corrected 2026-08-13.** The 2026-07-29 change (F-05/F-06) replaced a single unsalted SHA-256 digest with PBKDF2 (600 000 iterations, SHA-256, random 32-byte salt), which stops rainbow-table and multi-target reuse attacks — but the derivation *input* passed to PBKDF2 is still `${appDataPath}\|${provider}\|WorldScriptStudio\|v1`, built entirely from a standard OS app-data path, a public provider-name enum, and hardcoded literals. Anyone with read access to `config/<provider>_key.enc.json` — the exact threat this row exists to cover — can reconstruct that exact string and derive the same key in one PBKDF2 call; no brute force or precomputed table is needed, so the added iteration count provides no real defense here. The underlying "obfuscation, not encryption" finding was never actually closed. Real fix tracked: fold API keys into the same user-passphrase-protected store scheme `storageEncryptionService.ts`/`encryptionMigrationOrchestrator.ts` already provide, keyed by an actual user secret instead of a derived public string; honest plaintext fallback when no passphrase is set. | `services/fs/fsCore.ts:deriveFileSystemCryptoKey()`, `services/fs/settingsFsStore.ts:getApiKey()` |
 | Manuscript data in IndexedDB | AES-256-GCM at-rest encryption | `services/storage/storageEncryptionService.ts` |
 | Voice audio to cloud | Web Speech API consent gate | `components/voice/VoicePrivacyConsentModal.tsx` |
 | DuckDB analytics unencrypted (SEC-6) | **Bounded by design, with one prose column now encrypted:** most persisted fields are local metadata only (titles, loglines, character names, word counts, embeddings) and **nothing leaves the device**. The one column that genuinely holds literal manuscript prose, `codex_mentions.excerpt`, is now cell-level encrypted (AES-256-GCM via `services/duckdb/duckdbEncryption.ts`, reusing the IDB at-rest encryption key) whenever `enableIdbAtRestEncryption` is active: `duckdbCodexWrite()` writes ciphertext into `excerpt_enc BLOB` and nulls the plaintext `excerpt` column; `services/duckdb/codexExcerptEncryptionMigration.ts` backfills any pre-existing plaintext rows once encryption is unlocked. Gated by `enableDuckDbAnalytics` **and** the Settings → Privacy "Analytics" opt-out (`isAnalyticsPersistenceAllowed` in `app/listenerMiddleware.ts`); turning the toggle off stops all DuckDB writes + inference telemetry. Full OPFS file-level encryption remains **infeasible** — DuckDB-WASM owns the OPFS file handle directly, so there is no app-level interception point; the other metadata columns stay intentionally plaintext (bounded-exposure design). | `app/listenerMiddleware.ts:isAnalyticsPersistenceAllowed`, `services/duckdb/duckdbAnalytics.ts:duckdbCodexWrite()`, `services/duckdb/duckdbEncryption.ts`, `services/duckdb/codexExcerptEncryptionMigration.ts` |

From 8b367b6b45462496c3982b95bf088dd37f8055e1 Mon Sep 17 00:00:00 2001
From: qnbs <155236708+qnbs@users.noreply.github.com>
Date: Thu, 13 Aug 2026 12:41:43 +0200
Subject: [PATCH 2/5] docs(security): reconcile threat-model contradiction,
 document Gemini desktop key split
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review-loop follow-up on PR #352:
- docs/SECURITY-THREAT-MODEL.md's attack tree and header still called
  F-05/F-06 "fixed" despite the corrected Mitigation Mapping row above
  it saying "not resolved" — reconciled to be internally consistent.
- Documented that components/ApiKeySection.tsx never adopted the
  storageService/FsSettingsStore path: it saves the Gemini key via
  dbService (IndexedDB) even on desktop, while geminiService.ts reads
  it via storageService (filesystem on desktop) — so a Gemini key
  saved through Settings on desktop is invisible to the code that
  uses it. Functional bug, not security; tracked in #358, not fixed
  by this docs-only PR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 CHANGELOG.md                  | 12 +++++++++++-
 README.md                     |  2 +-
 docs/IDB-ENCRYPTION.md        |  2 +-
 docs/SECURITY-THREAT-MODEL.md | 10 ++++++----
 4 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 74e1ac77..3b0485e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -376,7 +376,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   and multi-target reuse, but the derivation *input* itself — `${appDataPath}|${provider}|WorldScriptStudio|v1`
   — remained fully public/reconstructible, so the root "obfuscation, not encryption" finding was
   never actually closed. Tracked as an open gap — see `docs/IDB-ENCRYPTION.md` § Tauri Desktop Layer
-  and `AUDIT.md`'s F-05/F-06 row for current status.
+  and `AUDIT.md`'s F-05/F-06 row for current status. **Review-loop follow-up (2026-08-13):**
+  `docs/SECURITY-THREAT-MODEL.md`'s Desktop Local File-Read Attack Tree and document header still
+  called this "fixed" and said reading the ciphertext no longer reveals the key material, directly
+  contradicting the corrected Mitigation Mapping row above it — reconciled to say "not resolved"
+  consistently throughout. Also documented a separate, unrelated functional bug surfaced while
+  fact-checking this row: `components/ApiKeySection.tsx` never adopted the `storageService`/
+  `FsSettingsStore` path this desktop API-key row describes — it still reads/writes the Gemini key
+  through `dbService` (IndexedDB) even on desktop, while `services/geminiService.ts` reads through
+  `storageService` (filesystem on desktop), so a Gemini key saved via Settings → AI on desktop is
+  invisible to the code that actually uses it. Tracked in
+  [#358](https://github.com/qnbs/WorldScript-Studio/issues/358); not fixed by this entry.
 - **F-08 — Tauri/web `connect-src` completeness.** Added LanguageTool's default self-hosted port
   (missing on **all 5** surfaces, not just Tauri) and the Hugging Face hosts WebLLM/Transformers.js
   actually resolve models from, including the Xet CDN bridge (`us.aws.cdn.hf.co`) that real model
diff --git a/README.md b/README.md
index 01b010c8..7232a0da 100644
--- a/README.md
+++ b/README.md
@@ -334,7 +334,7 @@ real protection despite being present in code:
 |------|-----------|-------|
 | **Browser BYOK API key** | Random, non-extractable AES-256-GCM key generated via `crypto.subtle.generateKey()` — no passphrase, nothing to derive | `services/storage/idbKeyStore.ts` |
 | **Browser IDB-at-rest data** _(opt-in, B-1)_ | User passphrase → PBKDF2 (600 000 iterations, SHA-256, random 32-byte salt) → AES-256-GCM, non-extractable key | `services/storage/storageEncryptionService.ts` |
-| **Desktop (Tauri) BYOK API key** ⚠️ | PBKDF2 (600 000 iterations, SHA-256, random 32-byte salt) → AES-256-GCM — but the passphrase input is a *public* string (`appDataPath\|provider\|WorldScriptStudio\|v1`), not a real secret; anyone with read access to the encrypted file can reconstruct it and decrypt in one step. Tracked, open gap — see `docs/IDB-ENCRYPTION.md` § Tauri Desktop Layer | `services/fs/fsCore.ts`, `services/fs/settingsFsStore.ts` |
+| **Desktop (Tauri) BYOK API key** ⚠️ | PBKDF2 (600 000 iterations, SHA-256, random 32-byte salt) → AES-256-GCM — but the passphrase input is a *public* string (`appDataPath\|provider\|WorldScriptStudio\|v1`), not a real secret; anyone with read access to the encrypted file can reconstruct it and decrypt in one step. Tracked, open gap — see `docs/IDB-ENCRYPTION.md` § Tauri Desktop Layer. **Does not apply to Gemini**: `components/ApiKeySection.tsx` still saves/reads the Gemini key through `dbService` (the browser IndexedDB row above) even on desktop, never through this filesystem path — a separate, functional bug tracked in [#358](https://github.com/qnbs/WorldScript-Studio/issues/358) | `services/fs/fsCore.ts`, `services/fs/settingsFsStore.ts` |
 | **Desktop (Tauri) project/settings/snapshot/Codex/RAG/asset data** ⚠️ | **None — plaintext (LZ-string compressed only).** Enabling "Encrypt project data at rest" still shows the passphrase unlock screen on desktop, but it doesn't gate this filesystem-backed store. Tracked, open gap | `services/fs/*Store.ts` |
 | **Library backup vault** | User passphrase → PBKDF2 (600 000 iterations, SHA-256) → AES-256-GCM | `services/libraryBackupService.ts` |
 
diff --git a/docs/IDB-ENCRYPTION.md b/docs/IDB-ENCRYPTION.md
index 5f26b45c..39f1686a 100644
--- a/docs/IDB-ENCRYPTION.md
+++ b/docs/IDB-ENCRYPTION.md
@@ -165,7 +165,7 @@ Every protected store writer runs inside `withProtectedWriteAdmission()` (shared
 
 On the Tauri desktop build, primary project, settings, snapshot, image, Codex, RAG, and binder-asset data is persisted by the filesystem-backed store (`services/fs/*Store.ts`), not IndexedDB. That store writes plaintext (LZ-string compressed only, no encryption) regardless of `enableIdbAtRestEncryption` — every writer is explicitly commented `ENCRYPTION: plaintext`. Enabling the setting on desktop still shows `IdbUnlockModal`/`PassphraseModal` (the passphrase sentinel lives in the WebView's own IndexedDB, which persists on desktop too), but that unlock flow gates nothing on the filesystem side today — only the UI, not the actual manuscript files under `$APPDATA`, is shared with the web build. See `README.md`'s "Encryption — which mechanism protects what" table for the authoritative per-mechanism breakdown. Extending real at-rest protection to the desktop filesystem store is a tracked, open gap — not yet implemented.
 
-The one thing that *is* desktop-specific and already encrypted is per-provider API keys (`services/fs/settingsFsStore.ts`, via `encryptText`/`decryptText` in `services/fs/fsCore.ts`) — but that mechanism has its own, separate weakness: its PBKDF2 passphrase is derived from a string built entirely out of public/discoverable values (the app-data path, the provider name, and hardcoded constants), not a real secret. Anyone with filesystem read access to the encrypted key file — the exact threat model at-rest encryption exists to defend against — can reconstruct the same derivation and decrypt it. This is also a tracked, open gap, independent from the project-data gap above; do not treat the presence of `encryptText`/`decryptText` as evidence that desktop API keys are meaningfully protected today.
+The one thing that *is* desktop-specific and already encrypted is per-provider API keys (`services/fs/settingsFsStore.ts`, via `encryptText`/`decryptText` in `services/fs/fsCore.ts`) — but that mechanism has its own, separate weakness: its PBKDF2 passphrase is derived from a string built entirely out of public/discoverable values (the app-data path, the provider name, and hardcoded constants), not a real secret. Anyone with filesystem read access to the encrypted key file — the exact threat model at-rest encryption exists to defend against — can reconstruct the same derivation and decrypt it. This is also a tracked, open gap, independent from the project-data gap above; do not treat the presence of `encryptText`/`decryptText` as evidence that desktop API keys are meaningfully protected today. **"Per-provider" excludes Gemini**: `components/ApiKeySection.tsx` never adopted the `storageService`/`FsSettingsStore` path at all — it still reads/writes the Gemini key directly through `dbService` (the browser IndexedDB store), even when running on desktop. `services/geminiService.ts` reads the key through `storageService`, which resolves to the filesystem backend on desktop — so a Gemini key saved via Settings → AI on desktop is written to a location `geminiService.ts` never looks in. This is a functional bug, not a security one; tracked in [#358](https://github.com/qnbs/WorldScript-Studio/issues/358), independent of the two gaps above.
 
 The repository does **not** currently use `tauri-plugin-stronghold`, an OS keychain, or a transparent desktop-only passphrase store.
 
diff --git a/docs/SECURITY-THREAT-MODEL.md b/docs/SECURITY-THREAT-MODEL.md
index 996e82ae..91458f32 100644
--- a/docs/SECURITY-THREAT-MODEL.md
+++ b/docs/SECURITY-THREAT-MODEL.md
@@ -1,7 +1,7 @@
 # Security Threat Model
 
 **Version:** 1.0.0  
-**Date:** 2026-06-05 (baseline); desktop-crypto mitigation row updated 2026-07-29 (v1.24.2, F-05/F-06)  
+**Date:** 2026-06-05 (baseline); desktop-crypto mitigation row updated 2026-08-13 (F-05/F-06 reopened — not resolved by the 2026-07-29 change, see Mitigation Mapping below)  
 **Status:** v1.24.2 baseline
 
 This document provides a formal STRIDE threat analysis for WorldScript Studio, mapping threats to mitigations and code locations.
@@ -124,9 +124,11 @@ Goal: Intercept/decrypt collaboration traffic
 ```
 Goal: Recover a user's cloud-provider API key from the Tauri desktop install
 ├─ OR: Read config/<provider>_key.enc.json directly (local process / malware with user-level FS access)
-│  └─ Mitigation: AES-256-GCM with PBKDF2-derived key (600k iter, random 32-byte salt per file) —
-│     reading the ciphertext no longer reveals the key material; the pre-2026-07-29 scheme derived
-│     the key from data an attacker with file-read access already had (F-05/F-06, fixed)
+│  └─ Mitigation: NOT RESOLVED as of 2026-08-13 — see the Mitigation Mapping row below. The
+│     2026-07-29 change (F-05/F-06) added PBKDF2 (600k iter, random 32-byte salt), but the
+│     derivation *input* is still `${appDataPath}|${provider}|WorldScriptStudio|v1` — entirely
+│     public/reconstructible by anyone with the file-read access this row assumes. Reading the
+│     ciphertext still reveals the key material in one PBKDF2 call; real fix tracked separately
 ├─ OR: Read the IDB-at-rest passphrase sentinel (enableIdbAtRestEncryption)
 │  └─ Mitigation: same PBKDF2 + non-extractable-key pattern; session-scoped in-memory key, never
 │     persisted to disk (`services/storage/storageEncryptionService.ts`)

From b8ae4178355201c719a2cc2b23c36abab31103df Mon Sep 17 00:00:00 2001
From: qnbs <155236708+qnbs@users.noreply.github.com>
Date: Thu, 13 Aug 2026 14:33:00 +0200
Subject: [PATCH 3/5] docs(security): tighten wording, add Gemini exception and
 desktop-data row to threat model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Third review-loop wave on PR #352:
- Tightened attacker-capability wording in both the Mitigation
  Mapping row and the attack tree: recovering the key needs the
  ciphertext AND the public derivation inputs, not the ciphertext
  alone.
- Added the Gemini-exception note (already in README.md/
  IDB-ENCRYPTION.md) to the threat model's own API-key row and attack
  tree, so all three documents agree.
- Added a new Mitigation Mapping row for desktop project/settings/
  snapshot/Codex/RAG/image data — the authoritative threat model
  previously didn't mention this exposure at all, so a reader could
  conclude manuscript disclosure/tampering was mitigated on desktop
  when it wasn't. Points at PR #356 for the real fix.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 CHANGELOG.md                  |  7 +++++++
 docs/SECURITY-THREAT-MODEL.md | 14 ++++++++------
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3b0485e8..a34379ba 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -387,6 +387,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `storageService` (filesystem on desktop), so a Gemini key saved via Settings → AI on desktop is
   invisible to the code that actually uses it. Tracked in
   [#358](https://github.com/qnbs/WorldScript-Studio/issues/358); not fixed by this entry.
+  **Second review-loop follow-up (2026-08-13):** tightened the attacker-capability wording (needs
+  both the ciphertext *and* the public derivation inputs, not the ciphertext alone) in both the
+  Mitigation Mapping row and the attack tree; added the same Gemini-exception note to the attack
+  tree (previously only in the table row); and added a new Mitigation Mapping row for desktop
+  project/settings/snapshot/Codex/RAG/image data, which this threat model previously didn't
+  mention at all despite it having neither confidentiality nor authentication on disk — real fix
+  in progress on [PR #356](https://github.com/qnbs/WorldScript-Studio/pull/356).
 - **F-08 — Tauri/web `connect-src` completeness.** Added LanguageTool's default self-hosted port
   (missing on **all 5** surfaces, not just Tauri) and the Hugging Face hosts WebLLM/Transformers.js
   actually resolve models from, including the Xet CDN bridge (`us.aws.cdn.hf.co`) that real model
diff --git a/docs/SECURITY-THREAT-MODEL.md b/docs/SECURITY-THREAT-MODEL.md
index 91458f32..151a1fc2 100644
--- a/docs/SECURITY-THREAT-MODEL.md
+++ b/docs/SECURITY-THREAT-MODEL.md
@@ -39,7 +39,8 @@ This document provides a formal STRIDE threat analysis for WorldScript Studio, m
 | Threat | Mitigation | Code Location |
 |--------|------------|-------------|
 | API key leakage via logs | StructuredLogger sanitization; never log keys | `services/logger.ts:sanitizeLogContext()` |
-| Desktop API key exposure via local file-read access | **Not resolved — corrected 2026-08-13.** The 2026-07-29 change (F-05/F-06) replaced a single unsalted SHA-256 digest with PBKDF2 (600 000 iterations, SHA-256, random 32-byte salt), which stops rainbow-table and multi-target reuse attacks — but the derivation *input* passed to PBKDF2 is still `${appDataPath}\|${provider}\|WorldScriptStudio\|v1`, built entirely from a standard OS app-data path, a public provider-name enum, and hardcoded literals. Anyone with read access to `config/<provider>_key.enc.json` — the exact threat this row exists to cover — can reconstruct that exact string and derive the same key in one PBKDF2 call; no brute force or precomputed table is needed, so the added iteration count provides no real defense here. The underlying "obfuscation, not encryption" finding was never actually closed. Real fix tracked: fold API keys into the same user-passphrase-protected store scheme `storageEncryptionService.ts`/`encryptionMigrationOrchestrator.ts` already provide, keyed by an actual user secret instead of a derived public string; honest plaintext fallback when no passphrase is set. | `services/fs/fsCore.ts:deriveFileSystemCryptoKey()`, `services/fs/settingsFsStore.ts:getApiKey()` |
+| Desktop API key exposure via local file-read access _(does not apply to Gemini — see note below)_ | **Not resolved — corrected 2026-08-13.** The 2026-07-29 change (F-05/F-06) replaced a single unsalted SHA-256 digest with PBKDF2 (600 000 iterations, SHA-256, random 32-byte salt), which stops rainbow-table and multi-target reuse attacks — but the derivation *input* passed to PBKDF2 is still `${appDataPath}\|${provider}\|WorldScriptStudio\|v1`, built entirely from a standard OS app-data path, a public provider-name enum, and hardcoded literals. An attacker with the ciphertext (`config/<provider>_key.enc.json` — the exact threat this row exists to cover) and those public/reconstructible derivation inputs can derive the key in one PBKDF2 call and decrypt the file; no brute force or precomputed table is needed, so the added iteration count provides no real defense here. The underlying "obfuscation, not encryption" finding was never actually closed. Real fix tracked: fold API keys into the same user-passphrase-protected store scheme `storageEncryptionService.ts`/`encryptionMigrationOrchestrator.ts` already provide, keyed by an actual user secret instead of a derived public string; honest plaintext fallback when no passphrase is set. **Gemini exception:** `components/ApiKeySection.tsx` never adopted this filesystem path at all — it reads/writes the Gemini key through `dbService` (browser IndexedDB) even on desktop, while `services/geminiService.ts` reads it through `storageService` (filesystem on desktop); this row's file-read analysis doesn't apply to Gemini, whose actual failure mode is a functional split-persistence bug (a key saved on desktop is invisible to the code that uses it), tracked in [#358](https://github.com/qnbs/WorldScript-Studio/issues/358). | `services/fs/fsCore.ts:deriveFileSystemCryptoKey()`, `services/fs/settingsFsStore.ts:getApiKey()` |
+| Desktop project/settings/snapshot/Codex/RAG/image data exposure and tampering via local file-read access | **Not resolved as of 2026-08-13.** `services/fs/*Store.ts` writes this data as plaintext (LZ-string compressed only) regardless of the `enableIdbAtRestEncryption` setting — there is neither confidentiality (no encryption) nor authentication (no AEAD tag, so silent tampering is possible) for any of it on disk today, unlike the IndexedDB manuscript rows above. Enabling "Encrypt project data at rest" in Settings → Privacy shows the same unlock screen as the browser/PWA build but does not protect these files. Real fix in progress: [PR #356](https://github.com/qnbs/WorldScript-Studio/pull/356) reuses `storageEncryptionService.ts`'s real passphrase-derived key for this filesystem path; update this row to "Resolved" once that PR merges and is verified. | `services/fs/*Store.ts` |
 | Manuscript data in IndexedDB | AES-256-GCM at-rest encryption | `services/storage/storageEncryptionService.ts` |
 | Voice audio to cloud | Web Speech API consent gate | `components/voice/VoicePrivacyConsentModal.tsx` |
 | DuckDB analytics unencrypted (SEC-6) | **Bounded by design, with one prose column now encrypted:** most persisted fields are local metadata only (titles, loglines, character names, word counts, embeddings) and **nothing leaves the device**. The one column that genuinely holds literal manuscript prose, `codex_mentions.excerpt`, is now cell-level encrypted (AES-256-GCM via `services/duckdb/duckdbEncryption.ts`, reusing the IDB at-rest encryption key) whenever `enableIdbAtRestEncryption` is active: `duckdbCodexWrite()` writes ciphertext into `excerpt_enc BLOB` and nulls the plaintext `excerpt` column; `services/duckdb/codexExcerptEncryptionMigration.ts` backfills any pre-existing plaintext rows once encryption is unlocked. Gated by `enableDuckDbAnalytics` **and** the Settings → Privacy "Analytics" opt-out (`isAnalyticsPersistenceAllowed` in `app/listenerMiddleware.ts`); turning the toggle off stops all DuckDB writes + inference telemetry. Full OPFS file-level encryption remains **infeasible** — DuckDB-WASM owns the OPFS file handle directly, so there is no app-level interception point; the other metadata columns stay intentionally plaintext (bounded-exposure design). | `app/listenerMiddleware.ts:isAnalyticsPersistenceAllowed`, `services/duckdb/duckdbAnalytics.ts:duckdbCodexWrite()`, `services/duckdb/duckdbEncryption.ts`, `services/duckdb/codexExcerptEncryptionMigration.ts` |
@@ -124,11 +125,12 @@ Goal: Intercept/decrypt collaboration traffic
 ```
 Goal: Recover a user's cloud-provider API key from the Tauri desktop install
 ├─ OR: Read config/<provider>_key.enc.json directly (local process / malware with user-level FS access)
-│  └─ Mitigation: NOT RESOLVED as of 2026-08-13 — see the Mitigation Mapping row below. The
-│     2026-07-29 change (F-05/F-06) added PBKDF2 (600k iter, random 32-byte salt), but the
-│     derivation *input* is still `${appDataPath}|${provider}|WorldScriptStudio|v1` — entirely
-│     public/reconstructible by anyone with the file-read access this row assumes. Reading the
-│     ciphertext still reveals the key material in one PBKDF2 call; real fix tracked separately
+│  └─ Mitigation: NOT RESOLVED as of 2026-08-13 (does not apply to Gemini — see Mitigation
+│     Mapping below). The 2026-07-29 change (F-05/F-06) added PBKDF2 (600k iter, random 32-byte
+│     salt), but the derivation *input* is still `${appDataPath}|${provider}|WorldScriptStudio|v1`
+│     — entirely public/reconstructible by anyone with the file-read access this row assumes. An
+│     attacker with the ciphertext and those public/reconstructible derivation inputs can derive
+│     the key in one PBKDF2 call and decrypt the file; real fix tracked separately
 ├─ OR: Read the IDB-at-rest passphrase sentinel (enableIdbAtRestEncryption)
 │  └─ Mitigation: same PBKDF2 + non-extractable-key pattern; session-scoped in-memory key, never
 │     persisted to disk (`services/storage/storageEncryptionService.ts`)

From a80b44e1f4e74d841af68da5da8a816a0b65f409 Mon Sep 17 00:00:00 2001
From: qnbs <155236708+qnbs@users.noreply.github.com>
Date: Thu, 13 Aug 2026 18:24:07 +0200
Subject: [PATCH 4/5] fix(storage): unify desktop image reads

---
 components/CharacterView.tsx      | 10 +++++-----
 components/WorldView.tsx          | 10 +++++-----
 docs/IDB-ENCRYPTION.md            |  2 +-
 docs/SECURITY-THREAT-MODEL.md     |  7 ++++---
 tests/unit/CharacterView.test.tsx |  6 +++---
 tests/unit/WorldView.test.tsx     |  7 +++----
 6 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/components/CharacterView.tsx b/components/CharacterView.tsx
index c8b0ab0c..fb39a07c 100644
--- a/components/CharacterView.tsx
+++ b/components/CharacterView.tsx
@@ -5,13 +5,13 @@ import { ICONS } from '../constants';
 import { CharacterViewContext, useCharacterViewContext } from '../contexts/CharacterViewContext';
 import { uploadCharacterImageThunk } from '../features/project/thunks/characterThunks';
 import { useCharacterView } from '../hooks/useCharacterView';
-import { dbService } from '../services/dbService';
 import {
   characterCompleteness,
   filterByQuery,
   type RosterSort,
   sortByMode,
 } from '../services/rosterMetrics';
+import { storageService } from '../services/storageService';
 import type { Character } from '../types';
 import { CompletenessRing } from './roster/CompletenessRing';
 import { RosterToolbar } from './roster/RosterToolbar';
@@ -28,7 +28,7 @@ import { SectionIcon } from './ui/SectionIcon';
 import { Select } from './ui/Select';
 import { Spinner } from './ui/Spinner';
 
-// A local hook to fetch image data on-demand from IndexedDB
+// QNBS-v3: reads through the selected backend so Tauri uploads and views use the same storage location.
 const useStoredImage = (id: string | undefined, hasImage: boolean | undefined) => {
   const [imageUrl, setImageUrl] = useState<string | null>(null);
   useEffect(() => {
@@ -38,9 +38,9 @@ const useStoredImage = (id: string | undefined, hasImage: boolean | undefined) =
     }
     let isMounted = true;
     const fetchImage = async () => {
-      const base64 = await dbService.getImage(id);
-      if (isMounted && base64) {
-        setImageUrl(`data:image/png;base64,${base64}`);
+      const image = await storageService.getImage(id);
+      if (isMounted && image) {
+        setImageUrl(image.startsWith('data:image/') ? image : `data:image/png;base64,${image}`);
       }
     };
     fetchImage();
diff --git a/components/WorldView.tsx b/components/WorldView.tsx
index 842aa353..89e7cae6 100644
--- a/components/WorldView.tsx
+++ b/components/WorldView.tsx
@@ -5,13 +5,13 @@ import { ICONS } from '../constants';
 import { useWorldViewContext, WorldViewContext } from '../contexts/WorldViewContext';
 import { uploadWorldImageThunk } from '../features/project/thunks/worldThunks';
 import { useWorldView } from '../hooks/useWorldView';
-import { dbService } from '../services/dbService';
 import {
   filterByQuery,
   type RosterSort,
   sortByMode,
   worldCompleteness,
 } from '../services/rosterMetrics';
+import { storageService } from '../services/storageService';
 import type { World } from '../types';
 import { CompletenessRing } from './roster/CompletenessRing';
 import { RosterToolbar } from './roster/RosterToolbar';
@@ -28,7 +28,7 @@ import { SectionIcon } from './ui/SectionIcon';
 import { Spinner } from './ui/Spinner';
 import { Textarea } from './ui/Textarea';
 
-// A local hook to fetch image data on-demand from IndexedDB
+// QNBS-v3: reads through the selected backend so Tauri uploads and views use the same storage location.
 const useStoredImage = (id: string | undefined, hasImage: boolean | undefined) => {
   const [imageUrl, setImageUrl] = useState<string | null>(null);
   useEffect(() => {
@@ -38,9 +38,9 @@ const useStoredImage = (id: string | undefined, hasImage: boolean | undefined) =
     }
     let isMounted = true;
     const fetchImage = async () => {
-      const base64 = await dbService.getImage(id);
-      if (isMounted && base64) {
-        setImageUrl(`data:image/png;base64,${base64}`);
+      const image = await storageService.getImage(id);
+      if (isMounted && image) {
+        setImageUrl(image.startsWith('data:image/') ? image : `data:image/png;base64,${image}`);
       }
     };
     fetchImage();
diff --git a/docs/IDB-ENCRYPTION.md b/docs/IDB-ENCRYPTION.md
index 39f1686a..346f6c32 100644
--- a/docs/IDB-ENCRYPTION.md
+++ b/docs/IDB-ENCRYPTION.md
@@ -163,7 +163,7 @@ Every protected store writer runs inside `withProtectedWriteAdmission()` (shared
 
 **This section previously claimed desktop shares the full encryption lifecycle described above. That was inaccurate — corrected below.**
 
-On the Tauri desktop build, primary project, settings, snapshot, image, Codex, RAG, and binder-asset data is persisted by the filesystem-backed store (`services/fs/*Store.ts`), not IndexedDB. That store writes plaintext (LZ-string compressed only, no encryption) regardless of `enableIdbAtRestEncryption` — every writer is explicitly commented `ENCRYPTION: plaintext`. Enabling the setting on desktop still shows `IdbUnlockModal`/`PassphraseModal` (the passphrase sentinel lives in the WebView's own IndexedDB, which persists on desktop too), but that unlock flow gates nothing on the filesystem side today — only the UI, not the actual manuscript files under `$APPDATA`, is shared with the web build. See `README.md`'s "Encryption — which mechanism protects what" table for the authoritative per-mechanism breakdown. Extending real at-rest protection to the desktop filesystem store is a tracked, open gap — not yet implemented.
+On the Tauri desktop build, primary project, settings, snapshot, image, Codex, RAG, and binder-asset data is persisted by the filesystem-backed store (`services/fs/*Store.ts`), not IndexedDB. That store writes plaintext (LZ-string compressed only, no encryption) regardless of `enableIdbAtRestEncryption`. Enabling the setting on desktop still shows `IdbUnlockModal`/`PassphraseModal` (the passphrase sentinel lives in the WebView's own IndexedDB, which persists on desktop too), but that unlock flow gates nothing on the filesystem side today — only the UI, not the actual manuscript files under `$APPDATA`, is shared with the web build. Character and world image reads use `storageService`, so they now follow the same selected backend as image uploads; this removes the prior desktop filesystem/IndexedDB split-persistence availability bug. See `README.md`'s "Encryption — which mechanism protects what" table for the authoritative per-mechanism breakdown. Extending real at-rest protection to the desktop filesystem store is a tracked, open gap — not yet implemented.
 
 The one thing that *is* desktop-specific and already encrypted is per-provider API keys (`services/fs/settingsFsStore.ts`, via `encryptText`/`decryptText` in `services/fs/fsCore.ts`) — but that mechanism has its own, separate weakness: its PBKDF2 passphrase is derived from a string built entirely out of public/discoverable values (the app-data path, the provider name, and hardcoded constants), not a real secret. Anyone with filesystem read access to the encrypted key file — the exact threat model at-rest encryption exists to defend against — can reconstruct the same derivation and decrypt it. This is also a tracked, open gap, independent from the project-data gap above; do not treat the presence of `encryptText`/`decryptText` as evidence that desktop API keys are meaningfully protected today. **"Per-provider" excludes Gemini**: `components/ApiKeySection.tsx` never adopted the `storageService`/`FsSettingsStore` path at all — it still reads/writes the Gemini key directly through `dbService` (the browser IndexedDB store), even when running on desktop. `services/geminiService.ts` reads the key through `storageService`, which resolves to the filesystem backend on desktop — so a Gemini key saved via Settings → AI on desktop is written to a location `geminiService.ts` never looks in. This is a functional bug, not a security one; tracked in [#358](https://github.com/qnbs/WorldScript-Studio/issues/358), independent of the two gaps above.
 
diff --git a/docs/SECURITY-THREAT-MODEL.md b/docs/SECURITY-THREAT-MODEL.md
index 151a1fc2..96e6a9b9 100644
--- a/docs/SECURITY-THREAT-MODEL.md
+++ b/docs/SECURITY-THREAT-MODEL.md
@@ -20,7 +20,8 @@ This document provides a formal STRIDE threat analysis for WorldScript Studio, m
 
 | Threat | Mitigation | Code Location |
 |--------|------------|-------------|
-| Manuscript data modification | AES-256-GCM authentication tag verification | `services/storage/storageEncryptionService.ts:decrypt()` |
+| Browser IndexedDB manuscript-data modification | AES-256-GCM authentication tag verification when optional at-rest encryption is configured | `services/storage/storageEncryptionService.ts:decrypt()` |
+| Desktop filesystem manuscript-data modification by a local file-write attacker | Not mitigated on current `main`: Tauri filesystem records are plaintext/compressed and require filesystem write access to alter; schema validation detects only some malformed settings, not authenticated tampering | `services/fs/*Store.ts`, `services/fs/fsCore.ts` |
 | Collaboration payload tampering | RTCDataChannel E2E encryption | `packages/collab-transport/src/crypto.js` |
 | Settings corruption | Schema validation on load | `features/settings/settingsSlice.ts:normalizePersistedSettings()` |
 | Plugin code injection | Content guard script | `scripts/content-guard.mjs` |
@@ -40,7 +41,7 @@ This document provides a formal STRIDE threat analysis for WorldScript Studio, m
 |--------|------------|-------------|
 | API key leakage via logs | StructuredLogger sanitization; never log keys | `services/logger.ts:sanitizeLogContext()` |
 | Desktop API key exposure via local file-read access _(does not apply to Gemini — see note below)_ | **Not resolved — corrected 2026-08-13.** The 2026-07-29 change (F-05/F-06) replaced a single unsalted SHA-256 digest with PBKDF2 (600 000 iterations, SHA-256, random 32-byte salt), which stops rainbow-table and multi-target reuse attacks — but the derivation *input* passed to PBKDF2 is still `${appDataPath}\|${provider}\|WorldScriptStudio\|v1`, built entirely from a standard OS app-data path, a public provider-name enum, and hardcoded literals. An attacker with the ciphertext (`config/<provider>_key.enc.json` — the exact threat this row exists to cover) and those public/reconstructible derivation inputs can derive the key in one PBKDF2 call and decrypt the file; no brute force or precomputed table is needed, so the added iteration count provides no real defense here. The underlying "obfuscation, not encryption" finding was never actually closed. Real fix tracked: fold API keys into the same user-passphrase-protected store scheme `storageEncryptionService.ts`/`encryptionMigrationOrchestrator.ts` already provide, keyed by an actual user secret instead of a derived public string; honest plaintext fallback when no passphrase is set. **Gemini exception:** `components/ApiKeySection.tsx` never adopted this filesystem path at all — it reads/writes the Gemini key through `dbService` (browser IndexedDB) even on desktop, while `services/geminiService.ts` reads it through `storageService` (filesystem on desktop); this row's file-read analysis doesn't apply to Gemini, whose actual failure mode is a functional split-persistence bug (a key saved on desktop is invisible to the code that uses it), tracked in [#358](https://github.com/qnbs/WorldScript-Studio/issues/358). | `services/fs/fsCore.ts:deriveFileSystemCryptoKey()`, `services/fs/settingsFsStore.ts:getApiKey()` |
-| Desktop project/settings/snapshot/Codex/RAG/image data exposure and tampering via local file-read access | **Not resolved as of 2026-08-13.** `services/fs/*Store.ts` writes this data as plaintext (LZ-string compressed only) regardless of the `enableIdbAtRestEncryption` setting — there is neither confidentiality (no encryption) nor authentication (no AEAD tag, so silent tampering is possible) for any of it on disk today, unlike the IndexedDB manuscript rows above. Enabling "Encrypt project data at rest" in Settings → Privacy shows the same unlock screen as the browser/PWA build but does not protect these files. Real fix in progress: [PR #356](https://github.com/qnbs/WorldScript-Studio/pull/356) reuses `storageEncryptionService.ts`'s real passphrase-derived key for this filesystem path; update this row to "Resolved" once that PR merges and is verified. | `services/fs/*Store.ts` |
+| Desktop project/settings/snapshot/Codex/RAG/image data disclosure via local file-read access | **Not resolved on current `main`.** Tauri filesystem records are plaintext (some compressed only), so an attacker who can read the app-data directory can disclose them. The separate tampering threat requires local file-write access and is modeled under Tampering above. Enabling the current browser/IndexedDB setting does not protect these files. [PR #356](https://github.com/qnbs/WorldScript-Studio/pull/356) is the active remediation; do not broaden this claim until its combined-state runtime proof completes. | `services/fs/*Store.ts` |
 | Manuscript data in IndexedDB | AES-256-GCM at-rest encryption | `services/storage/storageEncryptionService.ts` |
 | Voice audio to cloud | Web Speech API consent gate | `components/voice/VoicePrivacyConsentModal.tsx` |
 | DuckDB analytics unencrypted (SEC-6) | **Bounded by design, with one prose column now encrypted:** most persisted fields are local metadata only (titles, loglines, character names, word counts, embeddings) and **nothing leaves the device**. The one column that genuinely holds literal manuscript prose, `codex_mentions.excerpt`, is now cell-level encrypted (AES-256-GCM via `services/duckdb/duckdbEncryption.ts`, reusing the IDB at-rest encryption key) whenever `enableIdbAtRestEncryption` is active: `duckdbCodexWrite()` writes ciphertext into `excerpt_enc BLOB` and nulls the plaintext `excerpt` column; `services/duckdb/codexExcerptEncryptionMigration.ts` backfills any pre-existing plaintext rows once encryption is unlocked. Gated by `enableDuckDbAnalytics` **and** the Settings → Privacy "Analytics" opt-out (`isAnalyticsPersistenceAllowed` in `app/listenerMiddleware.ts`); turning the toggle off stops all DuckDB writes + inference telemetry. Full OPFS file-level encryption remains **infeasible** — DuckDB-WASM owns the OPFS file handle directly, so there is no app-level interception point; the other metadata columns stay intentionally plaintext (bounded-exposure design). | `app/listenerMiddleware.ts:isAnalyticsPersistenceAllowed`, `services/duckdb/duckdbAnalytics.ts:duckdbCodexWrite()`, `services/duckdb/duckdbEncryption.ts`, `services/duckdb/codexExcerptEncryptionMigration.ts` |
@@ -263,4 +264,4 @@ platform dashboard, not in application code.
 - NIST SP 800-63B Digital Identity Guidelines
 - CWE-200: Exposure of Sensitive Information
 - CWE-79: Cross-site Scripting (XSS)
-- CWE-89: SQL Injection (N/A - no SQL backend)
\ No newline at end of file
+- CWE-89: SQL Injection (N/A - no SQL backend)
diff --git a/tests/unit/CharacterView.test.tsx b/tests/unit/CharacterView.test.tsx
index 172d9adf..6c1e5ed3 100644
--- a/tests/unit/CharacterView.test.tsx
+++ b/tests/unit/CharacterView.test.tsx
@@ -68,9 +68,9 @@ vi.mock('../../hooks/useTranslation', () => ({
   useTranslation: () => ({ t: (k: string) => k, language: 'en' }),
 }));
 
-vi.mock('../../services/dbService', () => ({
-  dbService: {
-    getCharacterImage: vi.fn().mockResolvedValue(null),
+vi.mock('../../services/storageService', () => ({
+  storageService: {
+    getImage: vi.fn().mockResolvedValue(null),
   },
 }));
 
diff --git a/tests/unit/WorldView.test.tsx b/tests/unit/WorldView.test.tsx
index 15a02820..aa1b54ab 100644
--- a/tests/unit/WorldView.test.tsx
+++ b/tests/unit/WorldView.test.tsx
@@ -67,10 +67,9 @@ vi.mock('../../hooks/useTranslation', () => ({
   useTranslation: () => ({ t: (k: string) => k, language: 'en' }),
 }));
 
-vi.mock('../../services/dbService', () => ({
-  dbService: {
-    getWorldImage: vi.fn().mockResolvedValue(null),
-    getCharacterImage: vi.fn().mockResolvedValue(null),
+vi.mock('../../services/storageService', () => ({
+  storageService: {
+    getImage: vi.fn().mockResolvedValue(null),
   },
 }));
 

From efa7c18c5ced3a92ce493635e67d6b538a27588d Mon Sep 17 00:00:00 2001
From: qnbs <155236708+qnbs@users.noreply.github.com>
Date: Thu, 13 Aug 2026 19:14:37 +0200
Subject: [PATCH 5/5] fix(storage): preserve uploaded image MIME types

---
 CHANGELOG.md                                        |  2 +-
 components/CharacterView.tsx                        | 12 +++++++++---
 components/WorldView.tsx                            | 12 +++++++++---
 docs/SECURITY-THREAT-MODEL.md                       |  2 +-
 features/project/thunks/characterThunks.ts          |  4 ++--
 features/project/thunks/worldThunks.ts              |  4 ++--
 locales/en/help.json                                | 12 ++++++------
 public/locales/en/bundle.json                       | 12 ++++++------
 services/fs/assetFsStore.ts                         |  8 ++++----
 tests/unit/services/fs/fsStores.test.ts             | 11 ++++++++---
 tests/unit/thunks/writingAndCharacterThunks.test.ts |  5 +++--
 11 files changed, 51 insertions(+), 33 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a34379ba..038aa2ee 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -391,7 +391,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   both the ciphertext *and* the public derivation inputs, not the ciphertext alone) in both the
   Mitigation Mapping row and the attack tree; added the same Gemini-exception note to the attack
   tree (previously only in the table row); and added a new Mitigation Mapping row for desktop
-  project/settings/snapshot/Codex/RAG/image data, which this threat model previously didn't
+  project/settings/snapshot/Codex/RAG/image/binder-asset data, which this threat model previously didn't
   mention at all despite it having neither confidentiality nor authentication on disk — real fix
   in progress on [PR #356](https://github.com/qnbs/WorldScript-Studio/pull/356).
 - **F-08 — Tauri/web `connect-src` completeness.** Added LanguageTool's default self-hosted port
diff --git a/components/CharacterView.tsx b/components/CharacterView.tsx
index fb39a07c..fa394f8b 100644
--- a/components/CharacterView.tsx
+++ b/components/CharacterView.tsx
@@ -5,6 +5,7 @@ import { ICONS } from '../constants';
 import { CharacterViewContext, useCharacterViewContext } from '../contexts/CharacterViewContext';
 import { uploadCharacterImageThunk } from '../features/project/thunks/characterThunks';
 import { useCharacterView } from '../hooks/useCharacterView';
+import { logger } from '../services/logger';
 import {
   characterCompleteness,
   filterByQuery,
@@ -38,9 +39,14 @@ const useStoredImage = (id: string | undefined, hasImage: boolean | undefined) =
     }
     let isMounted = true;
     const fetchImage = async () => {
-      const image = await storageService.getImage(id);
-      if (isMounted && image) {
-        setImageUrl(image.startsWith('data:image/') ? image : `data:image/png;base64,${image}`);
+      try {
+        const image = await storageService.getImage(id);
+        if (isMounted && image) {
+          setImageUrl(image.startsWith('data:image/') ? image : `data:image/png;base64,${image}`);
+        }
+      } catch (error) {
+        // QNBS-v3: an unavailable image must retain the placeholder instead of causing an unhandled async rejection.
+        logger.warn('Failed to load character image', { error: String(error) });
       }
     };
     fetchImage();
diff --git a/components/WorldView.tsx b/components/WorldView.tsx
index 89e7cae6..6e08371c 100644
--- a/components/WorldView.tsx
+++ b/components/WorldView.tsx
@@ -5,6 +5,7 @@ import { ICONS } from '../constants';
 import { useWorldViewContext, WorldViewContext } from '../contexts/WorldViewContext';
 import { uploadWorldImageThunk } from '../features/project/thunks/worldThunks';
 import { useWorldView } from '../hooks/useWorldView';
+import { logger } from '../services/logger';
 import {
   filterByQuery,
   type RosterSort,
@@ -38,9 +39,14 @@ const useStoredImage = (id: string | undefined, hasImage: boolean | undefined) =
     }
     let isMounted = true;
     const fetchImage = async () => {
-      const image = await storageService.getImage(id);
-      if (isMounted && image) {
-        setImageUrl(image.startsWith('data:image/') ? image : `data:image/png;base64,${image}`);
+      try {
+        const image = await storageService.getImage(id);
+        if (isMounted && image) {
+          setImageUrl(image.startsWith('data:image/') ? image : `data:image/png;base64,${image}`);
+        }
+      } catch (error) {
+        // QNBS-v3: an unavailable image must retain the placeholder instead of causing an unhandled async rejection.
+        logger.warn('Failed to load world image', { error: String(error) });
       }
     };
     fetchImage();
diff --git a/docs/SECURITY-THREAT-MODEL.md b/docs/SECURITY-THREAT-MODEL.md
index 96e6a9b9..b5af98d7 100644
--- a/docs/SECURITY-THREAT-MODEL.md
+++ b/docs/SECURITY-THREAT-MODEL.md
@@ -41,7 +41,7 @@ This document provides a formal STRIDE threat analysis for WorldScript Studio, m
 |--------|------------|-------------|
 | API key leakage via logs | StructuredLogger sanitization; never log keys | `services/logger.ts:sanitizeLogContext()` |
 | Desktop API key exposure via local file-read access _(does not apply to Gemini — see note below)_ | **Not resolved — corrected 2026-08-13.** The 2026-07-29 change (F-05/F-06) replaced a single unsalted SHA-256 digest with PBKDF2 (600 000 iterations, SHA-256, random 32-byte salt), which stops rainbow-table and multi-target reuse attacks — but the derivation *input* passed to PBKDF2 is still `${appDataPath}\|${provider}\|WorldScriptStudio\|v1`, built entirely from a standard OS app-data path, a public provider-name enum, and hardcoded literals. An attacker with the ciphertext (`config/<provider>_key.enc.json` — the exact threat this row exists to cover) and those public/reconstructible derivation inputs can derive the key in one PBKDF2 call and decrypt the file; no brute force or precomputed table is needed, so the added iteration count provides no real defense here. The underlying "obfuscation, not encryption" finding was never actually closed. Real fix tracked: fold API keys into the same user-passphrase-protected store scheme `storageEncryptionService.ts`/`encryptionMigrationOrchestrator.ts` already provide, keyed by an actual user secret instead of a derived public string; honest plaintext fallback when no passphrase is set. **Gemini exception:** `components/ApiKeySection.tsx` never adopted this filesystem path at all — it reads/writes the Gemini key through `dbService` (browser IndexedDB) even on desktop, while `services/geminiService.ts` reads it through `storageService` (filesystem on desktop); this row's file-read analysis doesn't apply to Gemini, whose actual failure mode is a functional split-persistence bug (a key saved on desktop is invisible to the code that uses it), tracked in [#358](https://github.com/qnbs/WorldScript-Studio/issues/358). | `services/fs/fsCore.ts:deriveFileSystemCryptoKey()`, `services/fs/settingsFsStore.ts:getApiKey()` |
-| Desktop project/settings/snapshot/Codex/RAG/image data disclosure via local file-read access | **Not resolved on current `main`.** Tauri filesystem records are plaintext (some compressed only), so an attacker who can read the app-data directory can disclose them. The separate tampering threat requires local file-write access and is modeled under Tampering above. Enabling the current browser/IndexedDB setting does not protect these files. [PR #356](https://github.com/qnbs/WorldScript-Studio/pull/356) is the active remediation; do not broaden this claim until its combined-state runtime proof completes. | `services/fs/*Store.ts` |
+| Desktop project/settings/snapshot/Codex/RAG/image/binder-asset data disclosure via local file-read access | **Not resolved on current `main`.** Tauri filesystem records, including binder `.bin` payloads, are plaintext (some text records are compressed only), so an attacker who can read the app-data directory can disclose them. The separate tampering threat requires local file-write access and is modeled under Tampering above. Enabling the current browser/IndexedDB setting does not protect these files. [PR #356](https://github.com/qnbs/WorldScript-Studio/pull/356) is the active remediation; do not broaden this claim until its combined-state runtime proof completes. | `services/fs/*Store.ts` |
 | Manuscript data in IndexedDB | AES-256-GCM at-rest encryption | `services/storage/storageEncryptionService.ts` |
 | Voice audio to cloud | Web Speech API consent gate | `components/voice/VoicePrivacyConsentModal.tsx` |
 | DuckDB analytics unencrypted (SEC-6) | **Bounded by design, with one prose column now encrypted:** most persisted fields are local metadata only (titles, loglines, character names, word counts, embeddings) and **nothing leaves the device**. The one column that genuinely holds literal manuscript prose, `codex_mentions.excerpt`, is now cell-level encrypted (AES-256-GCM via `services/duckdb/duckdbEncryption.ts`, reusing the IDB at-rest encryption key) whenever `enableIdbAtRestEncryption` is active: `duckdbCodexWrite()` writes ciphertext into `excerpt_enc BLOB` and nulls the plaintext `excerpt` column; `services/duckdb/codexExcerptEncryptionMigration.ts` backfills any pre-existing plaintext rows once encryption is unlocked. Gated by `enableDuckDbAnalytics` **and** the Settings → Privacy "Analytics" opt-out (`isAnalyticsPersistenceAllowed` in `app/listenerMiddleware.ts`); turning the toggle off stops all DuckDB writes + inference telemetry. Full OPFS file-level encryption remains **infeasible** — DuckDB-WASM owns the OPFS file handle directly, so there is no app-level interception point; the other metadata columns stay intentionally plaintext (bounded-exposure design). | `app/listenerMiddleware.ts:isAnalyticsPersistenceAllowed`, `services/duckdb/duckdbAnalytics.ts:duckdbCodexWrite()`, `services/duckdb/duckdbEncryption.ts`, `services/duckdb/codexExcerptEncryptionMigration.ts` |
diff --git a/features/project/thunks/characterThunks.ts b/features/project/thunks/characterThunks.ts
index e0964a69..e4458232 100644
--- a/features/project/thunks/characterThunks.ts
+++ b/features/project/thunks/characterThunks.ts
@@ -92,8 +92,8 @@ export const uploadCharacterImageThunk = createAsyncThunk(
     return new Promise<{ characterId: string }>((resolve, reject) => {
       const reader = new FileReader();
       reader.onloadend = async () => {
-        const base64 = (reader.result as string).replace(/^data:image\/\w+;base64,/, '');
-        await storageService.saveImage(characterId, base64);
+        // QNBS-v3: retain the data-URL MIME type so uploaded JPEG/WebP images survive filesystem round-trips.
+        await storageService.saveImage(characterId, reader.result as string);
         resolve({ characterId });
       };
       reader.onerror = reject;
diff --git a/features/project/thunks/worldThunks.ts b/features/project/thunks/worldThunks.ts
index e6a1d29f..ec4e49ae 100644
--- a/features/project/thunks/worldThunks.ts
+++ b/features/project/thunks/worldThunks.ts
@@ -85,8 +85,8 @@ export const uploadWorldImageThunk = createAsyncThunk(
     return new Promise<{ worldId: string }>((resolve, reject) => {
       const reader = new FileReader();
       reader.onloadend = async () => {
-        const base64 = (reader.result as string).replace(/^data:image\/\w+;base64,/, '');
-        await storageService.saveImage(worldId, base64);
+        // QNBS-v3: retain the data-URL MIME type so uploaded JPEG/WebP images survive filesystem round-trips.
+        await storageService.saveImage(worldId, reader.result as string);
         resolve({ worldId });
       };
       reader.onerror = reject;
diff --git a/locales/en/help.json b/locales/en/help.json
index 22e0a9f9..d413805e 100644
--- a/locales/en/help.json
+++ b/locales/en/help.json
@@ -25,7 +25,7 @@
   "help.aiStudio.overview.title": "Overview of the AI Writing Studio",
   "help.aiStudio.plotAi.content": "<h3>Plot Board AI: Suggest Next Beat</h3><p>The <b>Suggest next beat</b> feature uses your manuscript and outline as context to propose the next scene card for the Plot Board. It is designed for moments when you know a chapter needs \"something\" but are unsure what.</p><ul><li><b>Trigger:</b> Open the Plot Board (enable <b>Plot Board v2</b> in feature flags first). Click the <b>AI ✦</b> button in the Plot Board toolbar to open the suggestion panel.</li><li><b>How it works:</b> WorldScript assembles a RAG-enriched prompt from your recent manuscript sections, existing beat cards, and your project outline. This context is sent to your configured AI provider.</li><li><b>Output:</b> The AI returns a suggested beat title, a short description, and a recommended act placement. A preview card appears in the panel with <b>Accept</b> and <b>Reject</b> buttons.</li><li><b>Accept:</b> Clicking Accept creates the beat card on the board in the suggested act column. You can drag it to reposition or edit the title inline.</li><li><b>Multiple suggestions:</b> Click <b>Suggest again</b> to get an alternative without accepting the first. Both suggestions appear side-by-side for comparison.</li><li><b>Best results:</b> Works best when your manuscript has at least 500 words and existing beat cards have descriptive titles. Enable RAG context in Settings → Advanced AI for richer retrieval.</li></ul>",
   "help.aiStudio.plotAi.title": "Plot Board AI beats",
-  "help.aiStudio.providers.content": "<h3>AI Providers &amp; API Keys</h3><p>WorldScript Studio connects to nine AI backends. Configure them under <b>Settings → AI Models</b> and <b>Settings → Advanced AI</b>. All API keys are encrypted with AES-256-GCM (PBKDF2 600 000 iterations, SHA-256) before being stored in IndexedDB — they are never transmitted to any WorldScript server.</p><h3>Cloud Providers</h3><ul><li><b>Google Gemini (default):</b> Fast, generous free tier. Get a free API key from <a href='https://aistudio.google.com/app/apikey' target='_blank'>Google AI Studio</a>. Recommended models: <code>gemini-2.5-flash</code> for everyday use, <code>gemini-2.5-pro</code> for complex generation tasks.</li><li><b>OpenAI:</b> GPT-4o and GPT-4o-mini. Enter your OpenAI API key in <b>Settings → AI → OpenAI key</b>. Strong at instruction-following and prose rewriting.</li><li><b>Anthropic (Claude):</b> Claude Opus 4.7, Sonnet 4.6, and Haiku 4.5. Enter your API key from <a href='https://console.anthropic.com' target='_blank'>console.anthropic.com</a>. Excellent for long-form narrative and nuanced tone. Works natively in the desktop app; on the web it's relayed through WorldScript's own serverless proxy on Vercel/Cloudflare Pages deployments (unavailable on the static GitHub Pages mirror) — see <b>Settings → AI</b> for the exact status on your deployment.</li><li><b>Grok (xAI):</b> <code>grok-3</code> and <code>grok-3-mini</code>. Enter your key from the xAI developer portal. Competitive on creative tasks with a lower cost per token than GPT-4.</li><li><b>OpenRouter:</b> A unified gateway to DeepSeek R1, Llama 3.3 70B, Qwen 2.5 72B, and hundreds more. Sign up for a free key at <a href='https://openrouter.ai/keys' target='_blank'>openrouter.ai/keys</a> — models with a <code>:free</code> suffix cost nothing. A circuit breaker automatically pauses OpenRouter after repeated rate-limit errors and retries a few minutes later.</li></ul><h3>Local / Self-Hosted Providers</h3><ul><li><b>Ollama (local):</b> Runs models on your machine via <code>http://localhost:11434</code>. Install Ollama and run <code>ollama pull llama3.2</code> to get started. The desktop app connects natively — no setup needed, browsers can't reach <code>localhost</code> across origins by default (CORS, not CSP). The web/PWA build is desktop-only <i>by default</i>; an opt-in <b>Browser-Ollama connection</b> flag under <b>Settings → Experimental</b> lets the browser connect directly if you start your own server with <code>OLLAMA_ORIGINS</code> covering this page's exact origin (shown in Settings once the flag is on) — advanced and unsupported, same real-CORS model NovelCrafter uses. Supports any Ollama-compatible model including fine-tuned LoRA adapters.</li><li><b>WebLLM (browser, GPU):</b> Runs quantized LLMs in the browser via WebGPU — no API key, no internet required after first download. Supported models: Llama 3.2 1B/3B, Phi-3.5 Mini, Gemma 2 2B. Requires a WebGPU-capable GPU (~2–6 GB VRAM). Download a model under <b>Settings → Advanced AI → Local AI models</b>.</li><li><b>ONNX Runtime Web (browser, CPU):</b> WASM-based inference without a GPU. Slower than WebLLM but works on any device. Good for short completions and classification tasks.</li><li><b>Transformers.js (automatic):</b> Powers the local embedding model used by the hybrid RAG index (MiniLM-L6-v2, 384 dimensions). Runs automatically — no configuration needed.</li></ul><h3>Hybrid Fallback Chain</h3><p>Under <b>Settings → Advanced AI → Hybrid fallback chain</b>, define an ordered list of providers. If the primary provider returns a rate-limit or network error, WorldScript automatically retries with the next provider in the chain. This creates a resilient setup — for example: try Gemini first, fall back to OpenAI, fall back to Ollama on desktop.</p><h3>Creativity Setting</h3><p>The <b>Creativity</b> slider (0–1) maps to the AI temperature parameter. Use 0.2–0.4 for factual tasks (summaries, consistency checks), 0.5–0.7 for balanced prose continuation, and 0.8–1.0 for brainstorming and highly creative generation.</p>",
+  "help.aiStudio.providers.content": "<h3>AI Providers &amp; API Keys</h3><p>WorldScript Studio connects to nine AI backends. Configure them under <b>Settings → AI Models</b> and <b>Settings → Advanced AI</b>. Browser/PWA API keys are AES-256-GCM protected in IndexedDB; desktop API-key protection follows the desktop storage lifecycle and is documented in Settings → Privacy &amp; Security. API keys are never transmitted to any WorldScript server.</p><h3>Cloud Providers</h3><ul><li><b>Google Gemini (default):</b> Fast, generous free tier. Get a free API key from <a href='https://aistudio.google.com/app/apikey' target='_blank'>Google AI Studio</a>. Recommended models: <code>gemini-2.5-flash</code> for everyday use, <code>gemini-2.5-pro</code> for complex generation tasks.</li><li><b>OpenAI:</b> GPT-4o and GPT-4o-mini. Enter your OpenAI API key in <b>Settings → AI → OpenAI key</b>. Strong at instruction-following and prose rewriting.</li><li><b>Anthropic (Claude):</b> Claude Opus 4.7, Sonnet 4.6, and Haiku 4.5. Enter your API key from <a href='https://console.anthropic.com' target='_blank'>console.anthropic.com</a>. Excellent for long-form narrative and nuanced tone. Works natively in the desktop app; on the web it's relayed through WorldScript's own serverless proxy on Vercel/Cloudflare Pages deployments (unavailable on the static GitHub Pages mirror) — see <b>Settings → AI</b> for the exact status on your deployment.</li><li><b>Grok (xAI):</b> <code>grok-3</code> and <code>grok-3-mini</code>. Enter your key from the xAI developer portal. Competitive on creative tasks with a lower cost per token than GPT-4.</li><li><b>OpenRouter:</b> A unified gateway to DeepSeek R1, Llama 3.3 70B, Qwen 2.5 72B, and hundreds more. Sign up for a free key at <a href='https://openrouter.ai/keys' target='_blank'>openrouter.ai/keys</a> — models with a <code>:free</code> suffix cost nothing. A circuit breaker automatically pauses OpenRouter after repeated rate-limit errors and retries a few minutes later.</li></ul><h3>Local / Self-Hosted Providers</h3><ul><li><b>Ollama (local):</b> Runs models on your machine via <code>http://localhost:11434</code>. Install Ollama and run <code>ollama pull llama3.2</code> to get started. The desktop app connects natively — no setup needed, browsers can't reach <code>localhost</code> across origins by default (CORS, not CSP). The web/PWA build is desktop-only <i>by default</i>; an opt-in <b>Browser-Ollama connection</b> flag under <b>Settings → Experimental</b> lets the browser connect directly if you start your own server with <code>OLLAMA_ORIGINS</code> covering this page's exact origin (shown in Settings once the flag is on) — advanced and unsupported, same real-CORS model NovelCrafter uses. Supports any Ollama-compatible model including fine-tuned LoRA adapters.</li><li><b>WebLLM (browser, GPU):</b> Runs quantized LLMs in the browser via WebGPU — no API key, no internet required after first download. Supported models: Llama 3.2 1B/3B, Phi-3.5 Mini, Gemma 2 2B. Requires a WebGPU-capable GPU (~2–6 GB VRAM). Download a model under <b>Settings → Advanced AI → Local AI models</b>.</li><li><b>ONNX Runtime Web (browser, CPU):</b> WASM-based inference without a GPU. Slower than WebLLM but works on any device. Good for short completions and classification tasks.</li><li><b>Transformers.js (automatic):</b> Powers the local embedding model used by the hybrid RAG index (MiniLM-L6-v2, 384 dimensions). Runs automatically — no configuration needed.</li></ul><h3>Hybrid Fallback Chain</h3><p>Under <b>Settings → Advanced AI → Hybrid fallback chain</b>, define an ordered list of providers. If the primary provider returns a rate-limit or network error, WorldScript automatically retries with the next provider in the chain. This creates a resilient setup — for example: try Gemini first, fall back to OpenAI, fall back to Ollama on desktop.</p><h3>Creativity Setting</h3><p>The <b>Creativity</b> slider (0–1) maps to the AI temperature parameter. Use 0.2–0.4 for factual tasks (summaries, consistency checks), 0.5–0.7 for balanced prose continuation, and 0.8–1.0 for brainstorming and highly creative generation.</p>",
   "help.aiStudio.providers.title": "AI providers & keys",
   "help.aiStudio.ragContext.content": "<h3>Retrieval-augmented prompts (local)</h3><p>When <b>RAG context</b> is enabled in the AI Tools panel, WorldScript retrieves relevant manuscript chunks before calling the model. Hybrid mode blends semantic embeddings (~60%), lexical overlap (~30%), and recency (~10%).</p><ol><li>Build the index under <b>Settings → Advanced AI → Rebuild local search index</b> (requires the local embedding model on capable devices).</li><li>Open the <b>AI Writing Studio</b>, enable <b>RAG context</b>, and run Continue, Brainstorm, or Critic.</li><li>The chunk badge shows how many passages were injected; Plot Board beat suggestions use the same pipeline.</li></ol><p>Your manuscript text stays in the browser; only the assembled prompt is sent to your chosen AI provider.</p>",
   "help.aiStudio.ragContext.title": "RAG context for AI generation",
@@ -65,25 +65,25 @@
   "help.docs.featureFlags.title": "Feature flag system",
   "help.docs.lazyLoading.content": "<h3>Lazy Loading &amp; Bundle Architecture</h3><p>WorldScript Studio is engineered for a fast initial load. All 14 major views and several heavy libraries are loaded on-demand, only when first needed.</p><ul><li><b>Views:</b> Every view is wrapped in <code>React.lazy()</code> with a <code>Suspense</code> boundary. The view bundle downloads the first time you navigate to it; subsequent visits use the browser cache.</li><li><b>Vite manual chunks:</b> The build splits vendor code into named chunks: <code>vendor-react</code>, <code>vendor-redux</code>, <code>plot-board</code> (canvas + SVG), <code>export-docx</code> (docx/jsPDF/jszip), <code>collab-yjs</code> (Yjs + y-webrtc). These download only when you first open their respective view.</li><li><b>AI provider layer:</b> <code>services/ai/index.ts</code> is dynamically imported the first time an AI tool is used. The Vercel AI SDK and provider adapters (~200 KB gzipped) are not bundled in the entry chunk.</li><li><b>DuckDB &amp; RAG:</b> The DuckDB listener and local embedding model are loaded by the Redux listener middleware only when their feature flags are on. They do not contribute to cold-start bundle size.</li><li><b>Force graph:</b> <code>react-force-graph-2d</code> is lazy-imported only when you navigate to the Character Graph and have at least one character — the empty-state view loads without triggering the import.</li><li><b>Bundle budget:</b> The CI <code>bundle:budget</code> job enforces a maximum of 7 000 KB for the vendor chunk and 4 500 KB for the entry chunk. PRs that exceed these limits fail the build.</li></ul>",
   "help.docs.lazyLoading.title": "Lazy loading & bundles",
-  "help.docs.privacySecurity.content": "<h3>Privacy &amp; Security Model</h3><p>WorldScript Studio is designed local-first: your story never leaves your device unless you explicitly send a prompt to a cloud AI provider.</p><ul><li><b>No account required:</b> There is no sign-up, no cloud sync, and no server that stores your manuscripts. All data lives in your browser's IndexedDB and OPFS.</li><li><b>API key encryption:</b> When you enter an API key, it is encrypted with <b>AES-256-GCM</b> (256-bit key, random 12-byte IV, PBKDF2 with 600,000 SHA-256 iterations) before being stored in IndexedDB. The plaintext key is never written to disk or localStorage.</li><li><b>AI requests:</b> Only the text you explicitly submit (e.g. a selected passage for \"Improve Text\") is sent to your chosen provider. The RAG pipeline runs locally; only the final assembled prompt travels over the network.</li><li><b>Content Security Policy:</b> The web build includes a strict CSP that blocks inline scripts, arbitrary network requests, and localhost connections (preventing a compromised extension from accessing Ollama via the page).</li><li><b>Tauri desktop:</b> The Rust shell restricts plugin permissions to the app data directory. Arbitrary filesystem access is blocked; the <code>dialog</code> plugin requires user confirmation for every open/save operation.</li><li><b>Collaboration:</b> When Collaboration is enabled, Yjs updates are end-to-end encrypted (AES-256-GCM + PBKDF2) before leaving the browser. The signaling server never sees plaintext document content.</li><li><b>Dependency audits:</b> OSV + CodeQL scanning runs on every CI push. Dependabot watches for new CVEs; override pins in <code>pnpm.overrides</code> are used when a patched version is not yet available upstream.</li></ul>",
+  "help.docs.privacySecurity.content": "<h3>Privacy &amp; Security Model</h3><p>WorldScript Studio is designed local-first: your story never leaves your device unless you explicitly send a prompt to a cloud AI provider.</p><ul><li><b>No account required:</b> There is no sign-up, no cloud sync, and no server that stores your manuscripts. All data lives in your browser's IndexedDB and OPFS.</li><li><b>API key protection:</b> Browser/PWA API keys are AES-256-GCM protected in IndexedDB. Desktop API-key protection follows the desktop storage lifecycle; do not assume browser storage details apply to desktop files.</li><li><b>AI requests:</b> Only the text you explicitly submit (e.g. a selected passage for \"Improve Text\") is sent to your chosen provider. The RAG pipeline runs locally; only the final assembled prompt travels over the network.</li><li><b>Content Security Policy:</b> The web build includes a strict CSP that blocks inline scripts, arbitrary network requests, and localhost connections (preventing a compromised extension from accessing Ollama via the page).</li><li><b>Tauri desktop:</b> The Rust shell restricts plugin permissions to the app data directory. Arbitrary filesystem access is blocked; the <code>dialog</code> plugin requires user confirmation for every open/save operation.</li><li><b>Collaboration:</b> When Collaboration is enabled, Yjs updates are end-to-end encrypted (AES-256-GCM + PBKDF2) before leaving the browser. The signaling server never sees plaintext document content.</li><li><b>Dependency audits:</b> OSV + CodeQL scanning runs on every CI push. Dependabot watches for new CVEs; override pins in <code>pnpm.overrides</code> are used when a patched version is not yet available upstream.</li></ul>",
   "help.docs.privacySecurity.title": "Privacy & security model",
   "help.docs.pwaDesktop.content": "<h3>PWA &amp; Desktop Packaging</h3><p>WorldScript Studio ships as both a Progressive Web App (PWA) and a native desktop app (Tauri). Both options keep your data local — no account required.</p><h3>PWA (browser)</h3><ul><li><b>Install:</b> Visit the web app in Chrome, Edge, or Safari and click the \"Install\" prompt in the address bar. The app icon appears on your desktop or home screen.</li><li><b>Offline shell cache:</b> The Service Worker pre-caches the app shell (HTML, CSS, JS entry chunks) so the interface loads instantly, even offline. Only cloud AI requests need a network connection.</li><li><b>Storage:</b> Data lives in IndexedDB and OPFS — persistent, sandboxed, and not cleared by normal browser cache clears.</li><li><b>Icons:</b> The PWA manifest includes 192×192 and 512×512 maskable PNG icons used by Android and Windows for the installed app shortcut.</li></ul><h3>Tauri desktop app</h3><ul><li><b>What it adds:</b> Native filesystem access, Ollama on localhost, window-state persistence (size, position), a File/Help menu bar, and an optional auto-updater banner under <b>Settings → About</b>.</li><li><b>Rust plugins bundled:</b> <code>fs</code>, <code>dialog</code>, <code>http</code>, <code>shell</code>, <code>updater</code>, plus optional <code>menu</code>, <code>tray</code>, and <code>window-state</code>.</li><li><b>Data folder:</b> On the desktop app, <b>Settings → Data → Open data folder</b> reveals the OS path where all IndexedDB and OPFS data is stored — safe to back up manually.</li><li><b>Installers:</b> Built by the Tauri CI workflow on tagged releases. Available for macOS (.dmg), Windows (.msi), and Linux (.AppImage / .deb).</li></ul>",
   "help.docs.pwaDesktop.title": "PWA & desktop packaging",
   "help.docs.ragPipeline.content": "<h3>RAG &amp; Prompt Assembly</h3><p>WorldScript's retrieval-augmented generation (RAG) pipeline enriches every AI request with relevant passages from your own manuscript — so the model knows your story before it writes the next line.</p><ul><li><b>Building the index:</b> Go to <b>Settings → Advanced AI → Rebuild local search index</b>. WorldScript splits your manuscript into overlapping ~200-token chunks and encodes each with <b>MiniLM-L6-v2</b> (384-dimensional embeddings) running locally via Transformers.js.</li><li><b>Hybrid retrieval:</b> When a request is made, the pipeline scores candidate chunks three ways — semantic cosine similarity (~60%), lexical keyword overlap (~30%), and recency (favoring later chapters, ~10%) — then selects the top-K passages.</li><li><b>Prompt assembly:</b> <code>assembleRAGPrompt()</code> builds a token-budgeted context block from the selected chunks and prepends it to the AI prompt. The chunk badge in the Writer panel shows how many passages were injected.</li><li><b>Where RAG is used:</b> Continue Writing, Brainstorm, AI Critic, and Plot Board \"Suggest next beat\" all use the same pipeline when RAG is enabled.</li><li><b>Rebuild triggers:</b> Rebuild the index after importing a backup, adding many new characters, or when AI completions seem unfamiliar with your story's details.</li><li><b>Privacy:</b> The index lives entirely in your browser's OPFS. Manuscript text is never uploaded to build the index — only the final assembled prompt travels to your chosen cloud provider.</li></ul>",
   "help.docs.ragPipeline.title": "RAG & prompt assembly",
-  "help.docs.tauriDesktop.content": "<h3>Tauri Desktop App</h3><p>The WorldScript Studio desktop app wraps the same React codebase in a native <b>Tauri v2</b> shell (Rust). It adds capabilities that browsers cannot provide while keeping your data fully local.</p><h3>What the Desktop App Adds</h3><ul><li><b>Native filesystem access:</b> Read and write files directly via the Tauri <code>fs</code> plugin — no browser file picker required for every operation. Logs are written to <code>$APPDATA/logs/worldscript-YYYY-MM-DD.jsonl</code>.</li><li><b>Local AI servers (Ollama, LM Studio, vLLM):</b> Browsers block direct <code>localhost</code> connections (CSP + Private Network Access); the desktop app routes these calls through the native Tauri HTTP stack — no proxy and no <code>OLLAMA_ORIGINS</code> setup needed. Use <b>Settings → AI → Scan common local ports</b> to auto-detect servers at <code>localhost:11434</code> (Ollama), <code>:1234</code> (LM Studio) and <code>:8000</code> (vLLM), then adopt a found URL with one click.</li><li><b>Window-state persistence:</b> Window size, position, and maximized state are restored exactly on each launch via the Tauri <code>window-state</code> plugin.</li><li><b>Native menu bar:</b> A File / Edit / View / Help menu bar following OS conventions (macOS: menu in toolbar; Windows/Linux: embedded in the window).</li><li><b>Auto-updater:</b> The Tauri <code>updater</code> plugin checks the GitHub releases JSON endpoint on startup and shows a banner under <b>Settings → About</b> when a new version is available. Click <b>Install update</b> to download and apply it in the background.</li><li><b>Open data folder:</b> <b>Settings → Data → Open data folder</b> opens the OS file explorer at the directory where IndexedDB and OPFS data are stored — useful for manual backups.</li><li><b>Stronghold (optional):</b> The <code>tauri-plugin-stronghold</code> can store the IDB encryption passphrase in the OS keychain so the unlock modal never appears on desktop.</li></ul><h3>Installers &amp; Distribution</h3><p>The Tauri CI workflow builds platform-specific installers on every tagged release (<code>v*</code>): <b>.dmg</b> for macOS (code-signed), <b>.msi</b> / <b>.exe</b> for Windows (code-signed), <b>.AppImage</b> and <b>.deb</b> for Linux. Installers are attached to GitHub Releases and referenced by the auto-updater endpoint.</p><h3>Data Location</h3><p>On desktop, data lives in the Tauri app data directory — typically <code>%APPDATA%\\WorldScript Studio</code> on Windows, <code>~/Library/Application Support/WorldScript Studio</code> on macOS, and <code>~/.local/share/worldscript-studio</code> on Linux. You can safely copy this directory for a full manual backup.</p>",
+  "help.docs.tauriDesktop.content": "<h3>Tauri Desktop App</h3><p>The WorldScript Studio desktop app wraps the same React codebase in a native <b>Tauri v2</b> shell (Rust). It adds capabilities that browsers cannot provide while keeping your data fully local.</p><h3>What the Desktop App Adds</h3><ul><li><b>Native filesystem access:</b> Read and write files directly via the Tauri <code>fs</code> plugin — no browser file picker required for every operation. Logs are written to <code>$APPDATA/logs/worldscript-YYYY-MM-DD.jsonl</code>.</li><li><b>Local AI servers (Ollama, LM Studio, vLLM):</b> Browsers block direct <code>localhost</code> connections (CSP + Private Network Access); the desktop app routes these calls through the native Tauri HTTP stack — no proxy and no <code>OLLAMA_ORIGINS</code> setup needed. Use <b>Settings → AI → Scan common local ports</b> to auto-detect servers at <code>localhost:11434</code> (Ollama), <code>:1234</code> (LM Studio) and <code>:8000</code> (vLLM), then adopt a found URL with one click.</li><li><b>Window-state persistence:</b> Window size, position, and maximized state are restored exactly on each launch via the Tauri <code>window-state</code> plugin.</li><li><b>Native menu bar:</b> A File / Edit / View / Help menu bar following OS conventions (macOS: menu in toolbar; Windows/Linux: embedded in the window).</li><li><b>Auto-updater:</b> The Tauri <code>updater</code> plugin checks the GitHub releases JSON endpoint on startup and shows a banner under <b>Settings → About</b> when a new version is available. Click <b>Install update</b> to download and apply it in the background.</li><li><b>Open data folder:</b> <b>Settings → Data → Open data folder</b> opens the OS file explorer at the directory where IndexedDB and OPFS data are stored — useful for manual backups.</li></ul><h3>Installers &amp; Distribution</h3><p>The Tauri CI workflow builds platform-specific installers on every tagged release (<code>v*</code>): <b>.dmg</b> for macOS (code-signed), <b>.msi</b> / <b>.exe</b> for Windows (code-signed), <b>.AppImage</b> and <b>.deb</b> for Linux. Installers are attached to GitHub Releases and referenced by the auto-updater endpoint.</p><h3>Data Location</h3><p>On desktop, data lives in the Tauri app data directory — typically <code>%APPDATA%\\WorldScript Studio</code> on Windows, <code>~/Library/Application Support/WorldScript Studio</code> on macOS, and <code>~/.local/share/worldscript-studio</code> on Linux. You can safely copy this directory for a full manual backup.</p>",
   "help.docs.tauriDesktop.title": "Tauri desktop app",
-  "help.faq.api.content": "<h3>Do I Need an API Key?</h3><p>Only for cloud AI providers. You can use WorldScript for all writing, the Plot Board, characters, version control, and export without any API key. AI features with local providers also need no key.</p><h3>Cloud providers (require an API key)</h3><ul><li><b>Google Gemini (recommended — free tier available):</b> Get a free key from <a href='https://aistudio.google.com/app/apikey' target='_blank'>Google AI Studio</a>. Enter it under <b>Settings → AI Models → Gemini API key</b>. Recommended models: <code>gemini-2.5-flash</code> for everyday use, <code>gemini-2.5-pro</code> for complex tasks.</li><li><b>OpenAI:</b> GPT-4o and GPT-4o-mini. Get a key from platform.openai.com. Enter it under <b>Settings → AI Models → OpenAI key</b>. Strong at instruction-following and prose rewriting.</li><li><b>Anthropic (Claude):</b> Claude Opus 4.7, Sonnet 4.6, and Haiku 4.5. Get a key from console.anthropic.com. Enter it under <b>Settings → AI Models → Anthropic key</b>. Excellent for long-form narrative and nuanced tone. Native on desktop; relayed through a serverless proxy on the web (Vercel/Cloudflare Pages), unavailable on GitHub Pages.</li><li><b>Grok (xAI):</b> <code>grok-3</code> and <code>grok-3-mini</code>. Get a key from the xAI developer portal. Enter it under <b>Settings → AI Models → xAI key</b>. Competitive on creative tasks with lower cost per token than GPT-4.</li><li><b>OpenRouter:</b> A unified gateway to DeepSeek R1, Llama 3.3 70B, Qwen 2.5 72B, and more. Free key at <a href='https://openrouter.ai/keys' target='_blank'>openrouter.ai/keys</a>; <code>:free</code>-suffixed models cost nothing.</li></ul><h3>Local providers (no API key required)</h3><ul><li><b>WebLLM (browser, GPU):</b> Runs quantized LLMs (Llama 3.2, Phi-3.5 Mini, Gemma 2) directly in the browser via WebGPU. Download a model under <b>Settings → Advanced AI → Local AI models</b>. Once downloaded, inference runs fully offline at zero cost.</li><li><b>ONNX Runtime Web (browser, CPU):</b> WASM-based inference without a GPU. Works on any device; slower than WebLLM but suitable for short completions and classification tasks.</li><li><b>Transformers.js:</b> Runs the local RAG embedding model automatically in the background. No configuration needed — it starts when RAG context is enabled.</li><li><b>Ollama:</b> Connects to a locally-running Ollama server at <code>localhost:11434</code>. Works natively in the desktop app. Run <code>ollama pull llama3.2</code> to get started. Zero API cost, fully private, supports any Ollama-compatible model including LoRA adapters. In the web/PWA build it's desktop-only by default — an opt-in <b>Browser-Ollama connection</b> flag (Settings → Experimental) lets the browser connect directly if you configure your own server's <code>OLLAMA_ORIGINS</code> for this page's origin.</li></ul><h3>Key security</h3><p>Every API key is encrypted with <b>AES-256-GCM</b> (PBKDF2, 600,000 SHA-256 iterations) before being stored in IndexedDB. The plaintext key is never written to disk, never stored in localStorage, and never sent to any WorldScript server. You can store keys for multiple providers simultaneously and switch between them without re-entering them.</p>",
+  "help.faq.api.content": "<h3>Do I Need an API Key?</h3><p>Only for cloud AI providers. You can use WorldScript for all writing, the Plot Board, characters, version control, and export without any API key. AI features with local providers also need no key.</p><h3>Cloud providers (require an API key)</h3><ul><li><b>Google Gemini (recommended — free tier available):</b> Get a free key from <a href='https://aistudio.google.com/app/apikey' target='_blank'>Google AI Studio</a>. Enter it under <b>Settings → AI Models → Gemini API key</b>. Recommended models: <code>gemini-2.5-flash</code> for everyday use, <code>gemini-2.5-pro</code> for complex tasks.</li><li><b>OpenAI:</b> GPT-4o and GPT-4o-mini. Get a key from platform.openai.com. Enter it under <b>Settings → AI Models → OpenAI key</b>. Strong at instruction-following and prose rewriting.</li><li><b>Anthropic (Claude):</b> Claude Opus 4.7, Sonnet 4.6, and Haiku 4.5. Get a key from console.anthropic.com. Enter it under <b>Settings → AI Models → Anthropic key</b>. Excellent for long-form narrative and nuanced tone. Native on desktop; relayed through a serverless proxy on the web (Vercel/Cloudflare Pages), unavailable on GitHub Pages.</li><li><b>Grok (xAI):</b> <code>grok-3</code> and <code>grok-3-mini</code>. Get a key from the xAI developer portal. Enter it under <b>Settings → AI Models → xAI key</b>. Competitive on creative tasks with lower cost per token than GPT-4.</li><li><b>OpenRouter:</b> A unified gateway to DeepSeek R1, Llama 3.3 70B, Qwen 2.5 72B, and more. Free key at <a href='https://openrouter.ai/keys' target='_blank'>openrouter.ai/keys</a>; <code>:free</code>-suffixed models cost nothing.</li></ul><h3>Local providers (no API key required)</h3><ul><li><b>WebLLM (browser, GPU):</b> Runs quantized LLMs (Llama 3.2, Phi-3.5 Mini, Gemma 2) directly in the browser via WebGPU. Download a model under <b>Settings → Advanced AI → Local AI models</b>. Once downloaded, inference runs fully offline at zero cost.</li><li><b>ONNX Runtime Web (browser, CPU):</b> WASM-based inference without a GPU. Works on any device; slower than WebLLM but suitable for short completions and classification tasks.</li><li><b>Transformers.js:</b> Runs the local RAG embedding model automatically in the background. No configuration needed — it starts when RAG context is enabled.</li><li><b>Ollama:</b> Connects to a locally-running Ollama server at <code>localhost:11434</code>. Works natively in the desktop app. Run <code>ollama pull llama3.2</code> to get started. Zero API cost, fully private, supports any Ollama-compatible model including LoRA adapters. In the web/PWA build it's desktop-only by default — an opt-in <b>Browser-Ollama connection</b> flag (Settings → Experimental) lets the browser connect directly if you configure your own server's <code>OLLAMA_ORIGINS</code> for this page's origin.</li></ul><h3>Key security</h3><p>Browser/PWA API keys are AES-256-GCM protected in IndexedDB. Desktop API-key protection follows the desktop storage lifecycle, so browser persistence details do not describe desktop files. API keys are never sent to any WorldScript server. You can store keys for multiple providers simultaneously and switch between them without re-entering them.</p>",
   "help.faq.api.title": "Do I need an API key?",
   "help.faq.offline.content": "<h3>Working Offline</h3><p>WorldScript Studio is local-first. Almost everything works without an internet connection once the app is loaded.</p><ul><li><b>Always available offline:</b> Writing, the Plot Board, character and world editing, snapshot creation and restore, Export to PDF / Markdown / TXT, all Settings.</li><li><b>Needs network:</b> Cloud AI providers (Gemini, OpenAI, Anthropic, Grok) send your prompt over the internet. Writing is never blocked — only AI features return an error when offline.</li><li><b>Pre-download local models:</b> Go to <b>Settings → Advanced AI → Local AI models</b> and download a WebLLM or ONNX model while online. Once cached, inference runs fully offline.</li><li><b>PWA shell cache:</b> Install WorldScript as a PWA (browser \"Install\" prompt) to cache the app shell via the Service Worker. Subsequent loads work offline even without internet.</li><li><b>OPFS storage:</b> DuckDB analytics and the local embedding model use the browser Origin Private File System (OPFS) — a persistent, sandboxed area not cleared by normal cache-clearing actions.</li></ul>",
   "help.faq.offline.title": "Can I work offline?",
-  "help.faq.privacy.content": "<h3>Your Story Stays On Your Device</h3><p><b>Yes, completely.</b> WorldScript Studio is local-first by design — there is no WorldScript account, no cloud server, and no company that can access your manuscripts. All data lives in your browser's IndexedDB and OPFS, storage that only your device can read.</p><h3>What stays local (everything, by default)</h3><ul><li><b>Manuscripts, characters, and world-building</b> — never transmitted anywhere unless you explicitly send a specific passage to an AI provider for processing.</li><li><b>API keys</b> — encrypted at rest with AES-256-GCM (PBKDF2, 600,000 SHA-256 iterations) before being saved to IndexedDB. The plaintext key is never written to disk, never stored in localStorage, and never sent to any WorldScript server.</li><li><b>Snapshots and backups</b> — stored entirely in your browser's IndexedDB. Exported JSON files go directly to your device's downloads folder.</li><li><b>RAG index and DuckDB analytics</b> — manuscript chunks, vector embeddings, and analytics data all live in your browser's OPFS. Only the final assembled prompt, not the raw index, is ever sent to a provider.</li></ul><h3>What leaves your device (only when you choose)</h3><ul><li><b>Cloud AI requests:</b> When you use Gemini, OpenAI, Anthropic, or Grok, only the text you explicitly submitted for that specific action is sent to the provider. WorldScript adds no hidden telemetry to these requests.</li><li><b>AI provider data policies:</b> Each provider has its own data-retention terms. Google Gemini API requests are not used to train Google's models by default. Check your chosen provider's developer terms for the current policy.</li><li><b>Collaboration (opt-in only):</b> If you enable P2P collaboration, Yjs document updates are end-to-end encrypted (AES-256-GCM + PBKDF2) before leaving the browser. The signaling server coordinates connections but never sees your manuscript content.</li></ul><h3>Go fully offline</h3><p>Switch to a local AI provider — <b>WebLLM</b> in the browser or <b>Ollama</b> on the desktop app — or disable AI features entirely. In fully offline mode, zero data is transmitted anywhere. Writing, version control, export, and all settings work without any network connection.</p>",
+  "help.faq.privacy.content": "<h3>Your Story Stays On Your Device</h3><p><b>Yes, completely.</b> WorldScript Studio is local-first by design — there is no WorldScript account, no cloud server, and no company that can access your manuscripts. All data lives in your browser's IndexedDB and OPFS, storage that only your device can read.</p><h3>What stays local (everything, by default)</h3><ul><li><b>Manuscripts, characters, and world-building</b> — never transmitted anywhere unless you explicitly send a specific passage to an AI provider for processing.</li><li><b>API keys</b> — Browser/PWA API keys are AES-256-GCM protected in IndexedDB. Desktop protection follows the desktop storage lifecycle; API keys are never sent to any WorldScript server.</li><li><b>Snapshots and backups</b> — stored entirely in your browser's IndexedDB. Exported JSON files go directly to your device's downloads folder.</li><li><b>RAG index and DuckDB analytics</b> — manuscript chunks, vector embeddings, and analytics data all live in your browser's OPFS. Only the final assembled prompt, not the raw index, is ever sent to a provider.</li></ul><h3>What leaves your device (only when you choose)</h3><ul><li><b>Cloud AI requests:</b> When you use Gemini, OpenAI, Anthropic, or Grok, only the text you explicitly submitted for that specific action is sent to the provider. WorldScript adds no hidden telemetry to these requests.</li><li><b>AI provider data policies:</b> Each provider has its own data-retention terms. Google Gemini API requests are not used to train Google's models by default. Check your chosen provider's developer terms for the current policy.</li><li><b>Collaboration (opt-in only):</b> If you enable P2P collaboration, Yjs document updates are end-to-end encrypted (AES-256-GCM + PBKDF2) before leaving the browser. The signaling server coordinates connections but never sees your manuscript content.</li></ul><h3>Go fully offline</h3><p>Switch to a local AI provider — <b>WebLLM</b> in the browser or <b>Ollama</b> on the desktop app — or disable AI features entirely. In fully offline mode, zero data is transmitted anywhere. Writing, version control, export, and all settings work without any network connection.</p>",
   "help.faq.privacy.title": "Is my story private?",
   "help.faq.providers.content": "<h3>Which AI Provider Should I Use?</h3><p>WorldScript supports multiple AI providers. Here is a quick guide to help you choose.</p><ul><li><b>Google Gemini (cloud):</b> The default. Gemini Flash is fast and free-tier friendly; Gemini Pro gives higher quality. Requires a free API key from Google AI Studio. Best for: everyday writing assistance.</li><li><b>OpenAI (cloud):</b> GPT-4o and GPT-4o-mini via API key. Strong instruction-following and prose rewriting. Best for: users already on the OpenAI ecosystem.</li><li><b>Ollama (local — desktop only):</b> Runs models on your machine via <code>localhost:11434</code>. Requires the Tauri desktop app (browsers block localhost connections); the <b>Scan common local ports</b> button in Settings → AI auto-detects Ollama, LM Studio and vLLM. Best for: maximum privacy and zero API cost with any Ollama-supported model.</li><li><b>WebLLM (local — browser):</b> GPU inference directly in the browser; no server, no API key. Models are downloaded once and cached. Best for: privacy without the desktop app, fully offline after first download.</li><li><b>Hybrid fallback:</b> Enable under <b>Settings → Advanced AI</b> to chain providers automatically — e.g., try Gemini first, fall back to Ollama on error. Useful for resilient workflows.</li></ul>",
   "help.faq.providers.title": "Which AI provider should I use?",
   "help.faq.saving.content": "<p>Your entire project, including all text and AI-generated images, is saved automatically and continuously in your web browser's local storage (a database called IndexedDB). This means your work is persisted on your computer between sessions. A 'Saving...' indicator appears in the header when changes are being written, followed by 'All changes saved'.</p><p><b>There is no cloud account or server-side storage.</b> This ensures complete privacy but also means you are responsible for creating backups using the 'Export Backup' feature in Settings.</p>",
   "help.faq.saving.title": "How is my project data saved?",
-  "help.gettingStarted.desktop.content": "<h3>Where to Run WorldScript Studio</h3><p>WorldScript Studio runs in three environments. Your manuscripts, characters, and settings always stay on your device regardless of which you use — choose the option that best fits your workflow.</p><h3>Browser (No Install Required)</h3><p>Open WorldScript in any modern browser (Chrome, Edge, Firefox, Safari). Data is stored in your browser's IndexedDB — a persistent, sandboxed database that is not cleared by normal browser cache clears. Write, edit, export, and manage versions fully offline once the app shell is cached.</p><ul><li><b>Works on any device</b> — desktop, laptop, tablet, and phone.</li><li><b>Always up to date</b> — the Service Worker fetches updates in the background; a notification appears when a new version is ready.</li><li><b>Offline capable</b> — writing, Plot Board, characters, version control, and export all work without internet. Only cloud AI providers (Gemini, OpenAI, etc.) require a connection.</li></ul><h3>PWA (Install from Browser)</h3><p>Install WorldScript as a Progressive Web App for a dedicated window without browser chrome. In Chrome or Edge, click the ⊕ icon in the address bar, or go to <b>Settings → General → Install as App</b>. On iPhone or iPad, use Share → Add to Home Screen.</p><ul><li>Opens in its own window — no browser tabs or address bar visible.</li><li>Identical features and the same IndexedDB data as the browser tab.</li><li>Offline shell cached by the Service Worker — opens instantly even with no internet.</li><li>Install status shown in Settings → General with a green checkmark.</li></ul><h3>Desktop App (Tauri)</h3><p>The optional Tauri v2 desktop app wraps WorldScript in a native Rust shell and adds capabilities that browsers cannot provide.</p><ul><li><b>Native filesystem access</b> — read and write files directly without a file picker for every operation.</li><li><b>Ollama on localhost</b> — browser CSP blocks localhost connections; the desktop app does not. Connect a locally-running Ollama server at <code>localhost:11434</code> for fully private, zero-cost offline AI inference.</li><li><b>Window-state persistence</b> — size, position, and maximized state are restored exactly on every launch.</li><li><b>Auto-updater</b> — a banner in Settings → About alerts you when a new version is available and installs it in the background.</li><li><b>Open data folder</b> — Settings → Data → Open data folder reveals the exact OS path where your data is stored, useful for manual backups.</li><li><b>Installers</b> — .dmg (macOS), .msi (Windows), .AppImage / .deb (Linux), available via GitHub Releases.</li></ul><h3>Privacy in All Environments</h3><p>API keys are encrypted with AES-256-GCM before storage and are never transmitted to any WorldScript server. Manuscripts only leave your device when you explicitly send a specific passage to a cloud AI provider.</p>",
+  "help.gettingStarted.desktop.content": "<h3>Where to Run WorldScript Studio</h3><p>WorldScript Studio runs in three environments. Your manuscripts, characters, and settings always stay on your device regardless of which you use — choose the option that best fits your workflow.</p><h3>Browser (No Install Required)</h3><p>Open WorldScript in any modern browser (Chrome, Edge, Firefox, Safari). Data is stored in your browser's IndexedDB — a persistent, sandboxed database that is not cleared by normal browser cache clears. Write, edit, export, and manage versions fully offline once the app shell is cached.</p><ul><li><b>Works on any device</b> — desktop, laptop, tablet, and phone.</li><li><b>Always up to date</b> — the Service Worker fetches updates in the background; a notification appears when a new version is ready.</li><li><b>Offline capable</b> — writing, Plot Board, characters, version control, and export all work without internet. Only cloud AI providers (Gemini, OpenAI, etc.) require a connection.</li></ul><h3>PWA (Install from Browser)</h3><p>Install WorldScript as a Progressive Web App for a dedicated window without browser chrome. In Chrome or Edge, click the ⊕ icon in the address bar, or go to <b>Settings → General → Install as App</b>. On iPhone or iPad, use Share → Add to Home Screen.</p><ul><li>Opens in its own window — no browser tabs or address bar visible.</li><li>Identical features and the same IndexedDB data as the browser tab.</li><li>Offline shell cached by the Service Worker — opens instantly even with no internet.</li><li>Install status shown in Settings → General with a green checkmark.</li></ul><h3>Desktop App (Tauri)</h3><p>The optional Tauri v2 desktop app wraps WorldScript in a native Rust shell and adds capabilities that browsers cannot provide.</p><ul><li><b>Native filesystem access</b> — read and write files directly without a file picker for every operation.</li><li><b>Ollama on localhost</b> — browser CSP blocks localhost connections; the desktop app does not. Connect a locally-running Ollama server at <code>localhost:11434</code> for fully private, zero-cost offline AI inference.</li><li><b>Window-state persistence</b> — size, position, and maximized state are restored exactly on every launch.</li><li><b>Auto-updater</b> — a banner in Settings → About alerts you when a new version is available and installs it in the background.</li><li><b>Open data folder</b> — Settings → Data → Open data folder reveals the exact OS path where your data is stored, useful for manual backups.</li><li><b>Installers</b> — .dmg (macOS), .msi (Windows), .AppImage / .deb (Linux), available via GitHub Releases.</li></ul><h3>Privacy in All Environments</h3><p>Browser/PWA API keys are AES-256-GCM protected in IndexedDB; desktop protection follows the desktop storage lifecycle. API keys are never transmitted to any WorldScript server. Manuscripts only leave your device when you explicitly send a specific passage to a cloud AI provider.</p>",
   "help.gettingStarted.desktop.title": "Desktop app (Tauri) & PWA",
   "help.gettingStarted.firstProject.content": "<h3>Choose Your Path</h3><p>The <b>Welcome Portal</b> gives you three powerful ways to begin:</p><ol><li><b>Start with a Template:</b> This is great for structured storytelling. Go to the <b>Templates</b> view, choose a structure like the 'Three-Act Structure,' and use the 'Personalize with AI' feature to get custom prompts for each section based on your story idea.</li><li><b>Generate with AI:</b> If you have a concept but no structure, use the <b>Outline Generator</b>. Just provide your genre and a story idea, and it will create a full, editable plot outline that you can apply to your manuscript.</li><li><b>Start Blank:</b> For those who prefer a completely open canvas, this option creates a new project with an empty first chapter, ready for you to start writing immediately.</li></ol>",
   "help.gettingStarted.firstProject.title": "Starting Your First Project",
diff --git a/public/locales/en/bundle.json b/public/locales/en/bundle.json
index 4027d0f2..e3bb600c 100644
--- a/public/locales/en/bundle.json
+++ b/public/locales/en/bundle.json
@@ -1132,7 +1132,7 @@
   "help.aiStudio.overview.title": "Overview of the AI Writing Studio",
   "help.aiStudio.plotAi.content": "<h3>Plot Board AI: Suggest Next Beat</h3><p>The <b>Suggest next beat</b> feature uses your manuscript and outline as context to propose the next scene card for the Plot Board. It is designed for moments when you know a chapter needs \"something\" but are unsure what.</p><ul><li><b>Trigger:</b> Open the Plot Board (enable <b>Plot Board v2</b> in feature flags first). Click the <b>AI ✦</b> button in the Plot Board toolbar to open the suggestion panel.</li><li><b>How it works:</b> WorldScript assembles a RAG-enriched prompt from your recent manuscript sections, existing beat cards, and your project outline. This context is sent to your configured AI provider.</li><li><b>Output:</b> The AI returns a suggested beat title, a short description, and a recommended act placement. A preview card appears in the panel with <b>Accept</b> and <b>Reject</b> buttons.</li><li><b>Accept:</b> Clicking Accept creates the beat card on the board in the suggested act column. You can drag it to reposition or edit the title inline.</li><li><b>Multiple suggestions:</b> Click <b>Suggest again</b> to get an alternative without accepting the first. Both suggestions appear side-by-side for comparison.</li><li><b>Best results:</b> Works best when your manuscript has at least 500 words and existing beat cards have descriptive titles. Enable RAG context in Settings → Advanced AI for richer retrieval.</li></ul>",
   "help.aiStudio.plotAi.title": "Plot Board AI beats",
-  "help.aiStudio.providers.content": "<h3>AI Providers &amp; API Keys</h3><p>WorldScript Studio connects to nine AI backends. Configure them under <b>Settings → AI Models</b> and <b>Settings → Advanced AI</b>. All API keys are encrypted with AES-256-GCM (PBKDF2 600 000 iterations, SHA-256) before being stored in IndexedDB — they are never transmitted to any WorldScript server.</p><h3>Cloud Providers</h3><ul><li><b>Google Gemini (default):</b> Fast, generous free tier. Get a free API key from <a href='https://aistudio.google.com/app/apikey' target='_blank'>Google AI Studio</a>. Recommended models: <code>gemini-2.5-flash</code> for everyday use, <code>gemini-2.5-pro</code> for complex generation tasks.</li><li><b>OpenAI:</b> GPT-4o and GPT-4o-mini. Enter your OpenAI API key in <b>Settings → AI → OpenAI key</b>. Strong at instruction-following and prose rewriting.</li><li><b>Anthropic (Claude):</b> Claude Opus 4.7, Sonnet 4.6, and Haiku 4.5. Enter your API key from <a href='https://console.anthropic.com' target='_blank'>console.anthropic.com</a>. Excellent for long-form narrative and nuanced tone. Works natively in the desktop app; on the web it's relayed through WorldScript's own serverless proxy on Vercel/Cloudflare Pages deployments (unavailable on the static GitHub Pages mirror) — see <b>Settings → AI</b> for the exact status on your deployment.</li><li><b>Grok (xAI):</b> <code>grok-3</code> and <code>grok-3-mini</code>. Enter your key from the xAI developer portal. Competitive on creative tasks with a lower cost per token than GPT-4.</li><li><b>OpenRouter:</b> A unified gateway to DeepSeek R1, Llama 3.3 70B, Qwen 2.5 72B, and hundreds more. Sign up for a free key at <a href='https://openrouter.ai/keys' target='_blank'>openrouter.ai/keys</a> — models with a <code>:free</code> suffix cost nothing. A circuit breaker automatically pauses OpenRouter after repeated rate-limit errors and retries a few minutes later.</li></ul><h3>Local / Self-Hosted Providers</h3><ul><li><b>Ollama (local):</b> Runs models on your machine via <code>http://localhost:11434</code>. Install Ollama and run <code>ollama pull llama3.2</code> to get started. The desktop app connects natively — no setup needed, browsers can't reach <code>localhost</code> across origins by default (CORS, not CSP). The web/PWA build is desktop-only <i>by default</i>; an opt-in <b>Browser-Ollama connection</b> flag under <b>Settings → Experimental</b> lets the browser connect directly if you start your own server with <code>OLLAMA_ORIGINS</code> covering this page's exact origin (shown in Settings once the flag is on) — advanced and unsupported, same real-CORS model NovelCrafter uses. Supports any Ollama-compatible model including fine-tuned LoRA adapters.</li><li><b>WebLLM (browser, GPU):</b> Runs quantized LLMs in the browser via WebGPU — no API key, no internet required after first download. Supported models: Llama 3.2 1B/3B, Phi-3.5 Mini, Gemma 2 2B. Requires a WebGPU-capable GPU (~2–6 GB VRAM). Download a model under <b>Settings → Advanced AI → Local AI models</b>.</li><li><b>ONNX Runtime Web (browser, CPU):</b> WASM-based inference without a GPU. Slower than WebLLM but works on any device. Good for short completions and classification tasks.</li><li><b>Transformers.js (automatic):</b> Powers the local embedding model used by the hybrid RAG index (MiniLM-L6-v2, 384 dimensions). Runs automatically — no configuration needed.</li></ul><h3>Hybrid Fallback Chain</h3><p>Under <b>Settings → Advanced AI → Hybrid fallback chain</b>, define an ordered list of providers. If the primary provider returns a rate-limit or network error, WorldScript automatically retries with the next provider in the chain. This creates a resilient setup — for example: try Gemini first, fall back to OpenAI, fall back to Ollama on desktop.</p><h3>Creativity Setting</h3><p>The <b>Creativity</b> slider (0–1) maps to the AI temperature parameter. Use 0.2–0.4 for factual tasks (summaries, consistency checks), 0.5–0.7 for balanced prose continuation, and 0.8–1.0 for brainstorming and highly creative generation.</p>",
+  "help.aiStudio.providers.content": "<h3>AI Providers &amp; API Keys</h3><p>WorldScript Studio connects to nine AI backends. Configure them under <b>Settings → AI Models</b> and <b>Settings → Advanced AI</b>. Browser/PWA API keys are AES-256-GCM protected in IndexedDB; desktop API-key protection follows the desktop storage lifecycle and is documented in Settings → Privacy &amp; Security. API keys are never transmitted to any WorldScript server.</p><h3>Cloud Providers</h3><ul><li><b>Google Gemini (default):</b> Fast, generous free tier. Get a free API key from <a href='https://aistudio.google.com/app/apikey' target='_blank'>Google AI Studio</a>. Recommended models: <code>gemini-2.5-flash</code> for everyday use, <code>gemini-2.5-pro</code> for complex generation tasks.</li><li><b>OpenAI:</b> GPT-4o and GPT-4o-mini. Enter your OpenAI API key in <b>Settings → AI → OpenAI key</b>. Strong at instruction-following and prose rewriting.</li><li><b>Anthropic (Claude):</b> Claude Opus 4.7, Sonnet 4.6, and Haiku 4.5. Enter your API key from <a href='https://console.anthropic.com' target='_blank'>console.anthropic.com</a>. Excellent for long-form narrative and nuanced tone. Works natively in the desktop app; on the web it's relayed through WorldScript's own serverless proxy on Vercel/Cloudflare Pages deployments (unavailable on the static GitHub Pages mirror) — see <b>Settings → AI</b> for the exact status on your deployment.</li><li><b>Grok (xAI):</b> <code>grok-3</code> and <code>grok-3-mini</code>. Enter your key from the xAI developer portal. Competitive on creative tasks with a lower cost per token than GPT-4.</li><li><b>OpenRouter:</b> A unified gateway to DeepSeek R1, Llama 3.3 70B, Qwen 2.5 72B, and hundreds more. Sign up for a free key at <a href='https://openrouter.ai/keys' target='_blank'>openrouter.ai/keys</a> — models with a <code>:free</code> suffix cost nothing. A circuit breaker automatically pauses OpenRouter after repeated rate-limit errors and retries a few minutes later.</li></ul><h3>Local / Self-Hosted Providers</h3><ul><li><b>Ollama (local):</b> Runs models on your machine via <code>http://localhost:11434</code>. Install Ollama and run <code>ollama pull llama3.2</code> to get started. The desktop app connects natively — no setup needed, browsers can't reach <code>localhost</code> across origins by default (CORS, not CSP). The web/PWA build is desktop-only <i>by default</i>; an opt-in <b>Browser-Ollama connection</b> flag under <b>Settings → Experimental</b> lets the browser connect directly if you start your own server with <code>OLLAMA_ORIGINS</code> covering this page's exact origin (shown in Settings once the flag is on) — advanced and unsupported, same real-CORS model NovelCrafter uses. Supports any Ollama-compatible model including fine-tuned LoRA adapters.</li><li><b>WebLLM (browser, GPU):</b> Runs quantized LLMs in the browser via WebGPU — no API key, no internet required after first download. Supported models: Llama 3.2 1B/3B, Phi-3.5 Mini, Gemma 2 2B. Requires a WebGPU-capable GPU (~2–6 GB VRAM). Download a model under <b>Settings → Advanced AI → Local AI models</b>.</li><li><b>ONNX Runtime Web (browser, CPU):</b> WASM-based inference without a GPU. Slower than WebLLM but works on any device. Good for short completions and classification tasks.</li><li><b>Transformers.js (automatic):</b> Powers the local embedding model used by the hybrid RAG index (MiniLM-L6-v2, 384 dimensions). Runs automatically — no configuration needed.</li></ul><h3>Hybrid Fallback Chain</h3><p>Under <b>Settings → Advanced AI → Hybrid fallback chain</b>, define an ordered list of providers. If the primary provider returns a rate-limit or network error, WorldScript automatically retries with the next provider in the chain. This creates a resilient setup — for example: try Gemini first, fall back to OpenAI, fall back to Ollama on desktop.</p><h3>Creativity Setting</h3><p>The <b>Creativity</b> slider (0–1) maps to the AI temperature parameter. Use 0.2–0.4 for factual tasks (summaries, consistency checks), 0.5–0.7 for balanced prose continuation, and 0.8–1.0 for brainstorming and highly creative generation.</p>",
   "help.aiStudio.providers.title": "AI providers & keys",
   "help.aiStudio.ragContext.content": "<h3>Retrieval-augmented prompts (local)</h3><p>When <b>RAG context</b> is enabled in the AI Tools panel, WorldScript retrieves relevant manuscript chunks before calling the model. Hybrid mode blends semantic embeddings (~60%), lexical overlap (~30%), and recency (~10%).</p><ol><li>Build the index under <b>Settings → Advanced AI → Rebuild local search index</b> (requires the local embedding model on capable devices).</li><li>Open the <b>AI Writing Studio</b>, enable <b>RAG context</b>, and run Continue, Brainstorm, or Critic.</li><li>The chunk badge shows how many passages were injected; Plot Board beat suggestions use the same pipeline.</li></ol><p>Your manuscript text stays in the browser; only the assembled prompt is sent to your chosen AI provider.</p>",
   "help.aiStudio.ragContext.title": "RAG context for AI generation",
@@ -1172,25 +1172,25 @@
   "help.docs.featureFlags.title": "Feature flag system",
   "help.docs.lazyLoading.content": "<h3>Lazy Loading &amp; Bundle Architecture</h3><p>WorldScript Studio is engineered for a fast initial load. All 14 major views and several heavy libraries are loaded on-demand, only when first needed.</p><ul><li><b>Views:</b> Every view is wrapped in <code>React.lazy()</code> with a <code>Suspense</code> boundary. The view bundle downloads the first time you navigate to it; subsequent visits use the browser cache.</li><li><b>Vite manual chunks:</b> The build splits vendor code into named chunks: <code>vendor-react</code>, <code>vendor-redux</code>, <code>plot-board</code> (canvas + SVG), <code>export-docx</code> (docx/jsPDF/jszip), <code>collab-yjs</code> (Yjs + y-webrtc). These download only when you first open their respective view.</li><li><b>AI provider layer:</b> <code>services/ai/index.ts</code> is dynamically imported the first time an AI tool is used. The Vercel AI SDK and provider adapters (~200 KB gzipped) are not bundled in the entry chunk.</li><li><b>DuckDB &amp; RAG:</b> The DuckDB listener and local embedding model are loaded by the Redux listener middleware only when their feature flags are on. They do not contribute to cold-start bundle size.</li><li><b>Force graph:</b> <code>react-force-graph-2d</code> is lazy-imported only when you navigate to the Character Graph and have at least one character — the empty-state view loads without triggering the import.</li><li><b>Bundle budget:</b> The CI <code>bundle:budget</code> job enforces a maximum of 7 000 KB for the vendor chunk and 4 500 KB for the entry chunk. PRs that exceed these limits fail the build.</li></ul>",
   "help.docs.lazyLoading.title": "Lazy loading & bundles",
-  "help.docs.privacySecurity.content": "<h3>Privacy &amp; Security Model</h3><p>WorldScript Studio is designed local-first: your story never leaves your device unless you explicitly send a prompt to a cloud AI provider.</p><ul><li><b>No account required:</b> There is no sign-up, no cloud sync, and no server that stores your manuscripts. All data lives in your browser's IndexedDB and OPFS.</li><li><b>API key encryption:</b> When you enter an API key, it is encrypted with <b>AES-256-GCM</b> (256-bit key, random 12-byte IV, PBKDF2 with 600,000 SHA-256 iterations) before being stored in IndexedDB. The plaintext key is never written to disk or localStorage.</li><li><b>AI requests:</b> Only the text you explicitly submit (e.g. a selected passage for \"Improve Text\") is sent to your chosen provider. The RAG pipeline runs locally; only the final assembled prompt travels over the network.</li><li><b>Content Security Policy:</b> The web build includes a strict CSP that blocks inline scripts, arbitrary network requests, and localhost connections (preventing a compromised extension from accessing Ollama via the page).</li><li><b>Tauri desktop:</b> The Rust shell restricts plugin permissions to the app data directory. Arbitrary filesystem access is blocked; the <code>dialog</code> plugin requires user confirmation for every open/save operation.</li><li><b>Collaboration:</b> When Collaboration is enabled, Yjs updates are end-to-end encrypted (AES-256-GCM + PBKDF2) before leaving the browser. The signaling server never sees plaintext document content.</li><li><b>Dependency audits:</b> OSV + CodeQL scanning runs on every CI push. Dependabot watches for new CVEs; override pins in <code>pnpm.overrides</code> are used when a patched version is not yet available upstream.</li></ul>",
+  "help.docs.privacySecurity.content": "<h3>Privacy &amp; Security Model</h3><p>WorldScript Studio is designed local-first: your story never leaves your device unless you explicitly send a prompt to a cloud AI provider.</p><ul><li><b>No account required:</b> There is no sign-up, no cloud sync, and no server that stores your manuscripts. All data lives in your browser's IndexedDB and OPFS.</li><li><b>API key protection:</b> Browser/PWA API keys are AES-256-GCM protected in IndexedDB. Desktop API-key protection follows the desktop storage lifecycle; do not assume browser storage details apply to desktop files.</li><li><b>AI requests:</b> Only the text you explicitly submit (e.g. a selected passage for \"Improve Text\") is sent to your chosen provider. The RAG pipeline runs locally; only the final assembled prompt travels over the network.</li><li><b>Content Security Policy:</b> The web build includes a strict CSP that blocks inline scripts, arbitrary network requests, and localhost connections (preventing a compromised extension from accessing Ollama via the page).</li><li><b>Tauri desktop:</b> The Rust shell restricts plugin permissions to the app data directory. Arbitrary filesystem access is blocked; the <code>dialog</code> plugin requires user confirmation for every open/save operation.</li><li><b>Collaboration:</b> When Collaboration is enabled, Yjs updates are end-to-end encrypted (AES-256-GCM + PBKDF2) before leaving the browser. The signaling server never sees plaintext document content.</li><li><b>Dependency audits:</b> OSV + CodeQL scanning runs on every CI push. Dependabot watches for new CVEs; override pins in <code>pnpm.overrides</code> are used when a patched version is not yet available upstream.</li></ul>",
   "help.docs.privacySecurity.title": "Privacy & security model",
   "help.docs.pwaDesktop.content": "<h3>PWA &amp; Desktop Packaging</h3><p>WorldScript Studio ships as both a Progressive Web App (PWA) and a native desktop app (Tauri). Both options keep your data local — no account required.</p><h3>PWA (browser)</h3><ul><li><b>Install:</b> Visit the web app in Chrome, Edge, or Safari and click the \"Install\" prompt in the address bar. The app icon appears on your desktop or home screen.</li><li><b>Offline shell cache:</b> The Service Worker pre-caches the app shell (HTML, CSS, JS entry chunks) so the interface loads instantly, even offline. Only cloud AI requests need a network connection.</li><li><b>Storage:</b> Data lives in IndexedDB and OPFS — persistent, sandboxed, and not cleared by normal browser cache clears.</li><li><b>Icons:</b> The PWA manifest includes 192×192 and 512×512 maskable PNG icons used by Android and Windows for the installed app shortcut.</li></ul><h3>Tauri desktop app</h3><ul><li><b>What it adds:</b> Native filesystem access, Ollama on localhost, window-state persistence (size, position), a File/Help menu bar, and an optional auto-updater banner under <b>Settings → About</b>.</li><li><b>Rust plugins bundled:</b> <code>fs</code>, <code>dialog</code>, <code>http</code>, <code>shell</code>, <code>updater</code>, plus optional <code>menu</code>, <code>tray</code>, and <code>window-state</code>.</li><li><b>Data folder:</b> On the desktop app, <b>Settings → Data → Open data folder</b> reveals the OS path where all IndexedDB and OPFS data is stored — safe to back up manually.</li><li><b>Installers:</b> Built by the Tauri CI workflow on tagged releases. Available for macOS (.dmg), Windows (.msi), and Linux (.AppImage / .deb).</li></ul>",
   "help.docs.pwaDesktop.title": "PWA & desktop packaging",
   "help.docs.ragPipeline.content": "<h3>RAG &amp; Prompt Assembly</h3><p>WorldScript's retrieval-augmented generation (RAG) pipeline enriches every AI request with relevant passages from your own manuscript — so the model knows your story before it writes the next line.</p><ul><li><b>Building the index:</b> Go to <b>Settings → Advanced AI → Rebuild local search index</b>. WorldScript splits your manuscript into overlapping ~200-token chunks and encodes each with <b>MiniLM-L6-v2</b> (384-dimensional embeddings) running locally via Transformers.js.</li><li><b>Hybrid retrieval:</b> When a request is made, the pipeline scores candidate chunks three ways — semantic cosine similarity (~60%), lexical keyword overlap (~30%), and recency (favoring later chapters, ~10%) — then selects the top-K passages.</li><li><b>Prompt assembly:</b> <code>assembleRAGPrompt()</code> builds a token-budgeted context block from the selected chunks and prepends it to the AI prompt. The chunk badge in the Writer panel shows how many passages were injected.</li><li><b>Where RAG is used:</b> Continue Writing, Brainstorm, AI Critic, and Plot Board \"Suggest next beat\" all use the same pipeline when RAG is enabled.</li><li><b>Rebuild triggers:</b> Rebuild the index after importing a backup, adding many new characters, or when AI completions seem unfamiliar with your story's details.</li><li><b>Privacy:</b> The index lives entirely in your browser's OPFS. Manuscript text is never uploaded to build the index — only the final assembled prompt travels to your chosen cloud provider.</li></ul>",
   "help.docs.ragPipeline.title": "RAG & prompt assembly",
-  "help.docs.tauriDesktop.content": "<h3>Tauri Desktop App</h3><p>The WorldScript Studio desktop app wraps the same React codebase in a native <b>Tauri v2</b> shell (Rust). It adds capabilities that browsers cannot provide while keeping your data fully local.</p><h3>What the Desktop App Adds</h3><ul><li><b>Native filesystem access:</b> Read and write files directly via the Tauri <code>fs</code> plugin — no browser file picker required for every operation. Logs are written to <code>$APPDATA/logs/worldscript-YYYY-MM-DD.jsonl</code>.</li><li><b>Local AI servers (Ollama, LM Studio, vLLM):</b> Browsers block direct <code>localhost</code> connections (CSP + Private Network Access); the desktop app routes these calls through the native Tauri HTTP stack — no proxy and no <code>OLLAMA_ORIGINS</code> setup needed. Use <b>Settings → AI → Scan common local ports</b> to auto-detect servers at <code>localhost:11434</code> (Ollama), <code>:1234</code> (LM Studio) and <code>:8000</code> (vLLM), then adopt a found URL with one click.</li><li><b>Window-state persistence:</b> Window size, position, and maximized state are restored exactly on each launch via the Tauri <code>window-state</code> plugin.</li><li><b>Native menu bar:</b> A File / Edit / View / Help menu bar following OS conventions (macOS: menu in toolbar; Windows/Linux: embedded in the window).</li><li><b>Auto-updater:</b> The Tauri <code>updater</code> plugin checks the GitHub releases JSON endpoint on startup and shows a banner under <b>Settings → About</b> when a new version is available. Click <b>Install update</b> to download and apply it in the background.</li><li><b>Open data folder:</b> <b>Settings → Data → Open data folder</b> opens the OS file explorer at the directory where IndexedDB and OPFS data are stored — useful for manual backups.</li><li><b>Stronghold (optional):</b> The <code>tauri-plugin-stronghold</code> can store the IDB encryption passphrase in the OS keychain so the unlock modal never appears on desktop.</li></ul><h3>Installers &amp; Distribution</h3><p>The Tauri CI workflow builds platform-specific installers on every tagged release (<code>v*</code>): <b>.dmg</b> for macOS (code-signed), <b>.msi</b> / <b>.exe</b> for Windows (code-signed), <b>.AppImage</b> and <b>.deb</b> for Linux. Installers are attached to GitHub Releases and referenced by the auto-updater endpoint.</p><h3>Data Location</h3><p>On desktop, data lives in the Tauri app data directory — typically <code>%APPDATA%\\WorldScript Studio</code> on Windows, <code>~/Library/Application Support/WorldScript Studio</code> on macOS, and <code>~/.local/share/worldscript-studio</code> on Linux. You can safely copy this directory for a full manual backup.</p>",
+  "help.docs.tauriDesktop.content": "<h3>Tauri Desktop App</h3><p>The WorldScript Studio desktop app wraps the same React codebase in a native <b>Tauri v2</b> shell (Rust). It adds capabilities that browsers cannot provide while keeping your data fully local.</p><h3>What the Desktop App Adds</h3><ul><li><b>Native filesystem access:</b> Read and write files directly via the Tauri <code>fs</code> plugin — no browser file picker required for every operation. Logs are written to <code>$APPDATA/logs/worldscript-YYYY-MM-DD.jsonl</code>.</li><li><b>Local AI servers (Ollama, LM Studio, vLLM):</b> Browsers block direct <code>localhost</code> connections (CSP + Private Network Access); the desktop app routes these calls through the native Tauri HTTP stack — no proxy and no <code>OLLAMA_ORIGINS</code> setup needed. Use <b>Settings → AI → Scan common local ports</b> to auto-detect servers at <code>localhost:11434</code> (Ollama), <code>:1234</code> (LM Studio) and <code>:8000</code> (vLLM), then adopt a found URL with one click.</li><li><b>Window-state persistence:</b> Window size, position, and maximized state are restored exactly on each launch via the Tauri <code>window-state</code> plugin.</li><li><b>Native menu bar:</b> A File / Edit / View / Help menu bar following OS conventions (macOS: menu in toolbar; Windows/Linux: embedded in the window).</li><li><b>Auto-updater:</b> The Tauri <code>updater</code> plugin checks the GitHub releases JSON endpoint on startup and shows a banner under <b>Settings → About</b> when a new version is available. Click <b>Install update</b> to download and apply it in the background.</li><li><b>Open data folder:</b> <b>Settings → Data → Open data folder</b> opens the OS file explorer at the directory where IndexedDB and OPFS data are stored — useful for manual backups.</li></ul><h3>Installers &amp; Distribution</h3><p>The Tauri CI workflow builds platform-specific installers on every tagged release (<code>v*</code>): <b>.dmg</b> for macOS (code-signed), <b>.msi</b> / <b>.exe</b> for Windows (code-signed), <b>.AppImage</b> and <b>.deb</b> for Linux. Installers are attached to GitHub Releases and referenced by the auto-updater endpoint.</p><h3>Data Location</h3><p>On desktop, data lives in the Tauri app data directory — typically <code>%APPDATA%\\WorldScript Studio</code> on Windows, <code>~/Library/Application Support/WorldScript Studio</code> on macOS, and <code>~/.local/share/worldscript-studio</code> on Linux. You can safely copy this directory for a full manual backup.</p>",
   "help.docs.tauriDesktop.title": "Tauri desktop app",
-  "help.faq.api.content": "<h3>Do I Need an API Key?</h3><p>Only for cloud AI providers. You can use WorldScript for all writing, the Plot Board, characters, version control, and export without any API key. AI features with local providers also need no key.</p><h3>Cloud providers (require an API key)</h3><ul><li><b>Google Gemini (recommended — free tier available):</b> Get a free key from <a href='https://aistudio.google.com/app/apikey' target='_blank'>Google AI Studio</a>. Enter it under <b>Settings → AI Models → Gemini API key</b>. Recommended models: <code>gemini-2.5-flash</code> for everyday use, <code>gemini-2.5-pro</code> for complex tasks.</li><li><b>OpenAI:</b> GPT-4o and GPT-4o-mini. Get a key from platform.openai.com. Enter it under <b>Settings → AI Models → OpenAI key</b>. Strong at instruction-following and prose rewriting.</li><li><b>Anthropic (Claude):</b> Claude Opus 4.7, Sonnet 4.6, and Haiku 4.5. Get a key from console.anthropic.com. Enter it under <b>Settings → AI Models → Anthropic key</b>. Excellent for long-form narrative and nuanced tone. Native on desktop; relayed through a serverless proxy on the web (Vercel/Cloudflare Pages), unavailable on GitHub Pages.</li><li><b>Grok (xAI):</b> <code>grok-3</code> and <code>grok-3-mini</code>. Get a key from the xAI developer portal. Enter it under <b>Settings → AI Models → xAI key</b>. Competitive on creative tasks with lower cost per token than GPT-4.</li><li><b>OpenRouter:</b> A unified gateway to DeepSeek R1, Llama 3.3 70B, Qwen 2.5 72B, and more. Free key at <a href='https://openrouter.ai/keys' target='_blank'>openrouter.ai/keys</a>; <code>:free</code>-suffixed models cost nothing.</li></ul><h3>Local providers (no API key required)</h3><ul><li><b>WebLLM (browser, GPU):</b> Runs quantized LLMs (Llama 3.2, Phi-3.5 Mini, Gemma 2) directly in the browser via WebGPU. Download a model under <b>Settings → Advanced AI → Local AI models</b>. Once downloaded, inference runs fully offline at zero cost.</li><li><b>ONNX Runtime Web (browser, CPU):</b> WASM-based inference without a GPU. Works on any device; slower than WebLLM but suitable for short completions and classification tasks.</li><li><b>Transformers.js:</b> Runs the local RAG embedding model automatically in the background. No configuration needed — it starts when RAG context is enabled.</li><li><b>Ollama:</b> Connects to a locally-running Ollama server at <code>localhost:11434</code>. Works natively in the desktop app. Run <code>ollama pull llama3.2</code> to get started. Zero API cost, fully private, supports any Ollama-compatible model including LoRA adapters. In the web/PWA build it's desktop-only by default — an opt-in <b>Browser-Ollama connection</b> flag (Settings → Experimental) lets the browser connect directly if you configure your own server's <code>OLLAMA_ORIGINS</code> for this page's origin.</li></ul><h3>Key security</h3><p>Every API key is encrypted with <b>AES-256-GCM</b> (PBKDF2, 600,000 SHA-256 iterations) before being stored in IndexedDB. The plaintext key is never written to disk, never stored in localStorage, and never sent to any WorldScript server. You can store keys for multiple providers simultaneously and switch between them without re-entering them.</p>",
+  "help.faq.api.content": "<h3>Do I Need an API Key?</h3><p>Only for cloud AI providers. You can use WorldScript for all writing, the Plot Board, characters, version control, and export without any API key. AI features with local providers also need no key.</p><h3>Cloud providers (require an API key)</h3><ul><li><b>Google Gemini (recommended — free tier available):</b> Get a free key from <a href='https://aistudio.google.com/app/apikey' target='_blank'>Google AI Studio</a>. Enter it under <b>Settings → AI Models → Gemini API key</b>. Recommended models: <code>gemini-2.5-flash</code> for everyday use, <code>gemini-2.5-pro</code> for complex tasks.</li><li><b>OpenAI:</b> GPT-4o and GPT-4o-mini. Get a key from platform.openai.com. Enter it under <b>Settings → AI Models → OpenAI key</b>. Strong at instruction-following and prose rewriting.</li><li><b>Anthropic (Claude):</b> Claude Opus 4.7, Sonnet 4.6, and Haiku 4.5. Get a key from console.anthropic.com. Enter it under <b>Settings → AI Models → Anthropic key</b>. Excellent for long-form narrative and nuanced tone. Native on desktop; relayed through a serverless proxy on the web (Vercel/Cloudflare Pages), unavailable on GitHub Pages.</li><li><b>Grok (xAI):</b> <code>grok-3</code> and <code>grok-3-mini</code>. Get a key from the xAI developer portal. Enter it under <b>Settings → AI Models → xAI key</b>. Competitive on creative tasks with lower cost per token than GPT-4.</li><li><b>OpenRouter:</b> A unified gateway to DeepSeek R1, Llama 3.3 70B, Qwen 2.5 72B, and more. Free key at <a href='https://openrouter.ai/keys' target='_blank'>openrouter.ai/keys</a>; <code>:free</code>-suffixed models cost nothing.</li></ul><h3>Local providers (no API key required)</h3><ul><li><b>WebLLM (browser, GPU):</b> Runs quantized LLMs (Llama 3.2, Phi-3.5 Mini, Gemma 2) directly in the browser via WebGPU. Download a model under <b>Settings → Advanced AI → Local AI models</b>. Once downloaded, inference runs fully offline at zero cost.</li><li><b>ONNX Runtime Web (browser, CPU):</b> WASM-based inference without a GPU. Works on any device; slower than WebLLM but suitable for short completions and classification tasks.</li><li><b>Transformers.js:</b> Runs the local RAG embedding model automatically in the background. No configuration needed — it starts when RAG context is enabled.</li><li><b>Ollama:</b> Connects to a locally-running Ollama server at <code>localhost:11434</code>. Works natively in the desktop app. Run <code>ollama pull llama3.2</code> to get started. Zero API cost, fully private, supports any Ollama-compatible model including LoRA adapters. In the web/PWA build it's desktop-only by default — an opt-in <b>Browser-Ollama connection</b> flag (Settings → Experimental) lets the browser connect directly if you configure your own server's <code>OLLAMA_ORIGINS</code> for this page's origin.</li></ul><h3>Key security</h3><p>Browser/PWA API keys are AES-256-GCM protected in IndexedDB. Desktop API-key protection follows the desktop storage lifecycle, so browser persistence details do not describe desktop files. API keys are never sent to any WorldScript server. You can store keys for multiple providers simultaneously and switch between them without re-entering them.</p>",
   "help.faq.api.title": "Do I need an API key?",
   "help.faq.offline.content": "<h3>Working Offline</h3><p>WorldScript Studio is local-first. Almost everything works without an internet connection once the app is loaded.</p><ul><li><b>Always available offline:</b> Writing, the Plot Board, character and world editing, snapshot creation and restore, Export to PDF / Markdown / TXT, all Settings.</li><li><b>Needs network:</b> Cloud AI providers (Gemini, OpenAI, Anthropic, Grok) send your prompt over the internet. Writing is never blocked — only AI features return an error when offline.</li><li><b>Pre-download local models:</b> Go to <b>Settings → Advanced AI → Local AI models</b> and download a WebLLM or ONNX model while online. Once cached, inference runs fully offline.</li><li><b>PWA shell cache:</b> Install WorldScript as a PWA (browser \"Install\" prompt) to cache the app shell via the Service Worker. Subsequent loads work offline even without internet.</li><li><b>OPFS storage:</b> DuckDB analytics and the local embedding model use the browser Origin Private File System (OPFS) — a persistent, sandboxed area not cleared by normal cache-clearing actions.</li></ul>",
   "help.faq.offline.title": "Can I work offline?",
-  "help.faq.privacy.content": "<h3>Your Story Stays On Your Device</h3><p><b>Yes, completely.</b> WorldScript Studio is local-first by design — there is no WorldScript account, no cloud server, and no company that can access your manuscripts. All data lives in your browser's IndexedDB and OPFS, storage that only your device can read.</p><h3>What stays local (everything, by default)</h3><ul><li><b>Manuscripts, characters, and world-building</b> — never transmitted anywhere unless you explicitly send a specific passage to an AI provider for processing.</li><li><b>API keys</b> — encrypted at rest with AES-256-GCM (PBKDF2, 600,000 SHA-256 iterations) before being saved to IndexedDB. The plaintext key is never written to disk, never stored in localStorage, and never sent to any WorldScript server.</li><li><b>Snapshots and backups</b> — stored entirely in your browser's IndexedDB. Exported JSON files go directly to your device's downloads folder.</li><li><b>RAG index and DuckDB analytics</b> — manuscript chunks, vector embeddings, and analytics data all live in your browser's OPFS. Only the final assembled prompt, not the raw index, is ever sent to a provider.</li></ul><h3>What leaves your device (only when you choose)</h3><ul><li><b>Cloud AI requests:</b> When you use Gemini, OpenAI, Anthropic, or Grok, only the text you explicitly submitted for that specific action is sent to the provider. WorldScript adds no hidden telemetry to these requests.</li><li><b>AI provider data policies:</b> Each provider has its own data-retention terms. Google Gemini API requests are not used to train Google's models by default. Check your chosen provider's developer terms for the current policy.</li><li><b>Collaboration (opt-in only):</b> If you enable P2P collaboration, Yjs document updates are end-to-end encrypted (AES-256-GCM + PBKDF2) before leaving the browser. The signaling server coordinates connections but never sees your manuscript content.</li></ul><h3>Go fully offline</h3><p>Switch to a local AI provider — <b>WebLLM</b> in the browser or <b>Ollama</b> on the desktop app — or disable AI features entirely. In fully offline mode, zero data is transmitted anywhere. Writing, version control, export, and all settings work without any network connection.</p>",
+  "help.faq.privacy.content": "<h3>Your Story Stays On Your Device</h3><p><b>Yes, completely.</b> WorldScript Studio is local-first by design — there is no WorldScript account, no cloud server, and no company that can access your manuscripts. All data lives in your browser's IndexedDB and OPFS, storage that only your device can read.</p><h3>What stays local (everything, by default)</h3><ul><li><b>Manuscripts, characters, and world-building</b> — never transmitted anywhere unless you explicitly send a specific passage to an AI provider for processing.</li><li><b>API keys</b> — Browser/PWA API keys are AES-256-GCM protected in IndexedDB. Desktop protection follows the desktop storage lifecycle; API keys are never sent to any WorldScript server.</li><li><b>Snapshots and backups</b> — stored entirely in your browser's IndexedDB. Exported JSON files go directly to your device's downloads folder.</li><li><b>RAG index and DuckDB analytics</b> — manuscript chunks, vector embeddings, and analytics data all live in your browser's OPFS. Only the final assembled prompt, not the raw index, is ever sent to a provider.</li></ul><h3>What leaves your device (only when you choose)</h3><ul><li><b>Cloud AI requests:</b> When you use Gemini, OpenAI, Anthropic, or Grok, only the text you explicitly submitted for that specific action is sent to the provider. WorldScript adds no hidden telemetry to these requests.</li><li><b>AI provider data policies:</b> Each provider has its own data-retention terms. Google Gemini API requests are not used to train Google's models by default. Check your chosen provider's developer terms for the current policy.</li><li><b>Collaboration (opt-in only):</b> If you enable P2P collaboration, Yjs document updates are end-to-end encrypted (AES-256-GCM + PBKDF2) before leaving the browser. The signaling server coordinates connections but never sees your manuscript content.</li></ul><h3>Go fully offline</h3><p>Switch to a local AI provider — <b>WebLLM</b> in the browser or <b>Ollama</b> on the desktop app — or disable AI features entirely. In fully offline mode, zero data is transmitted anywhere. Writing, version control, export, and all settings work without any network connection.</p>",
   "help.faq.privacy.title": "Is my story private?",
   "help.faq.providers.content": "<h3>Which AI Provider Should I Use?</h3><p>WorldScript supports multiple AI providers. Here is a quick guide to help you choose.</p><ul><li><b>Google Gemini (cloud):</b> The default. Gemini Flash is fast and free-tier friendly; Gemini Pro gives higher quality. Requires a free API key from Google AI Studio. Best for: everyday writing assistance.</li><li><b>OpenAI (cloud):</b> GPT-4o and GPT-4o-mini via API key. Strong instruction-following and prose rewriting. Best for: users already on the OpenAI ecosystem.</li><li><b>Ollama (local — desktop only):</b> Runs models on your machine via <code>localhost:11434</code>. Requires the Tauri desktop app (browsers block localhost connections); the <b>Scan common local ports</b> button in Settings → AI auto-detects Ollama, LM Studio and vLLM. Best for: maximum privacy and zero API cost with any Ollama-supported model.</li><li><b>WebLLM (local — browser):</b> GPU inference directly in the browser; no server, no API key. Models are downloaded once and cached. Best for: privacy without the desktop app, fully offline after first download.</li><li><b>Hybrid fallback:</b> Enable under <b>Settings → Advanced AI</b> to chain providers automatically — e.g., try Gemini first, fall back to Ollama on error. Useful for resilient workflows.</li></ul>",
   "help.faq.providers.title": "Which AI provider should I use?",
   "help.faq.saving.content": "<p>Your entire project, including all text and AI-generated images, is saved automatically and continuously in your web browser's local storage (a database called IndexedDB). This means your work is persisted on your computer between sessions. A 'Saving...' indicator appears in the header when changes are being written, followed by 'All changes saved'.</p><p><b>There is no cloud account or server-side storage.</b> This ensures complete privacy but also means you are responsible for creating backups using the 'Export Backup' feature in Settings.</p>",
   "help.faq.saving.title": "How is my project data saved?",
-  "help.gettingStarted.desktop.content": "<h3>Where to Run WorldScript Studio</h3><p>WorldScript Studio runs in three environments. Your manuscripts, characters, and settings always stay on your device regardless of which you use — choose the option that best fits your workflow.</p><h3>Browser (No Install Required)</h3><p>Open WorldScript in any modern browser (Chrome, Edge, Firefox, Safari). Data is stored in your browser's IndexedDB — a persistent, sandboxed database that is not cleared by normal browser cache clears. Write, edit, export, and manage versions fully offline once the app shell is cached.</p><ul><li><b>Works on any device</b> — desktop, laptop, tablet, and phone.</li><li><b>Always up to date</b> — the Service Worker fetches updates in the background; a notification appears when a new version is ready.</li><li><b>Offline capable</b> — writing, Plot Board, characters, version control, and export all work without internet. Only cloud AI providers (Gemini, OpenAI, etc.) require a connection.</li></ul><h3>PWA (Install from Browser)</h3><p>Install WorldScript as a Progressive Web App for a dedicated window without browser chrome. In Chrome or Edge, click the ⊕ icon in the address bar, or go to <b>Settings → General → Install as App</b>. On iPhone or iPad, use Share → Add to Home Screen.</p><ul><li>Opens in its own window — no browser tabs or address bar visible.</li><li>Identical features and the same IndexedDB data as the browser tab.</li><li>Offline shell cached by the Service Worker — opens instantly even with no internet.</li><li>Install status shown in Settings → General with a green checkmark.</li></ul><h3>Desktop App (Tauri)</h3><p>The optional Tauri v2 desktop app wraps WorldScript in a native Rust shell and adds capabilities that browsers cannot provide.</p><ul><li><b>Native filesystem access</b> — read and write files directly without a file picker for every operation.</li><li><b>Ollama on localhost</b> — browser CSP blocks localhost connections; the desktop app does not. Connect a locally-running Ollama server at <code>localhost:11434</code> for fully private, zero-cost offline AI inference.</li><li><b>Window-state persistence</b> — size, position, and maximized state are restored exactly on every launch.</li><li><b>Auto-updater</b> — a banner in Settings → About alerts you when a new version is available and installs it in the background.</li><li><b>Open data folder</b> — Settings → Data → Open data folder reveals the exact OS path where your data is stored, useful for manual backups.</li><li><b>Installers</b> — .dmg (macOS), .msi (Windows), .AppImage / .deb (Linux), available via GitHub Releases.</li></ul><h3>Privacy in All Environments</h3><p>API keys are encrypted with AES-256-GCM before storage and are never transmitted to any WorldScript server. Manuscripts only leave your device when you explicitly send a specific passage to a cloud AI provider.</p>",
+  "help.gettingStarted.desktop.content": "<h3>Where to Run WorldScript Studio</h3><p>WorldScript Studio runs in three environments. Your manuscripts, characters, and settings always stay on your device regardless of which you use — choose the option that best fits your workflow.</p><h3>Browser (No Install Required)</h3><p>Open WorldScript in any modern browser (Chrome, Edge, Firefox, Safari). Data is stored in your browser's IndexedDB — a persistent, sandboxed database that is not cleared by normal browser cache clears. Write, edit, export, and manage versions fully offline once the app shell is cached.</p><ul><li><b>Works on any device</b> — desktop, laptop, tablet, and phone.</li><li><b>Always up to date</b> — the Service Worker fetches updates in the background; a notification appears when a new version is ready.</li><li><b>Offline capable</b> — writing, Plot Board, characters, version control, and export all work without internet. Only cloud AI providers (Gemini, OpenAI, etc.) require a connection.</li></ul><h3>PWA (Install from Browser)</h3><p>Install WorldScript as a Progressive Web App for a dedicated window without browser chrome. In Chrome or Edge, click the ⊕ icon in the address bar, or go to <b>Settings → General → Install as App</b>. On iPhone or iPad, use Share → Add to Home Screen.</p><ul><li>Opens in its own window — no browser tabs or address bar visible.</li><li>Identical features and the same IndexedDB data as the browser tab.</li><li>Offline shell cached by the Service Worker — opens instantly even with no internet.</li><li>Install status shown in Settings → General with a green checkmark.</li></ul><h3>Desktop App (Tauri)</h3><p>The optional Tauri v2 desktop app wraps WorldScript in a native Rust shell and adds capabilities that browsers cannot provide.</p><ul><li><b>Native filesystem access</b> — read and write files directly without a file picker for every operation.</li><li><b>Ollama on localhost</b> — browser CSP blocks localhost connections; the desktop app does not. Connect a locally-running Ollama server at <code>localhost:11434</code> for fully private, zero-cost offline AI inference.</li><li><b>Window-state persistence</b> — size, position, and maximized state are restored exactly on every launch.</li><li><b>Auto-updater</b> — a banner in Settings → About alerts you when a new version is available and installs it in the background.</li><li><b>Open data folder</b> — Settings → Data → Open data folder reveals the exact OS path where your data is stored, useful for manual backups.</li><li><b>Installers</b> — .dmg (macOS), .msi (Windows), .AppImage / .deb (Linux), available via GitHub Releases.</li></ul><h3>Privacy in All Environments</h3><p>Browser/PWA API keys are AES-256-GCM protected in IndexedDB; desktop protection follows the desktop storage lifecycle. API keys are never transmitted to any WorldScript server. Manuscripts only leave your device when you explicitly send a specific passage to a cloud AI provider.</p>",
   "help.gettingStarted.desktop.title": "Desktop app (Tauri) & PWA",
   "help.gettingStarted.firstProject.content": "<h3>Choose Your Path</h3><p>The <b>Welcome Portal</b> gives you three powerful ways to begin:</p><ol><li><b>Start with a Template:</b> This is great for structured storytelling. Go to the <b>Templates</b> view, choose a structure like the 'Three-Act Structure,' and use the 'Personalize with AI' feature to get custom prompts for each section based on your story idea.</li><li><b>Generate with AI:</b> If you have a concept but no structure, use the <b>Outline Generator</b>. Just provide your genre and a story idea, and it will create a full, editable plot outline that you can apply to your manuscript.</li><li><b>Start Blank:</b> For those who prefer a completely open canvas, this option creates a new project with an empty first chapter, ready for you to start writing immediately.</li></ol>",
   "help.gettingStarted.firstProject.title": "Starting Your First Project",
diff --git a/services/fs/assetFsStore.ts b/services/fs/assetFsStore.ts
index 32ce52ca..9877cd3c 100644
--- a/services/fs/assetFsStore.ts
+++ b/services/fs/assetFsStore.ts
@@ -22,8 +22,8 @@ export class FsAssetStore extends FsSnapshotStore {
     }
 
     const imageFile = await apis.join(imagesPath, `${sanitizePathSegment(id, 'image')}.png`);
-    const cleanBase64 = base64Data.replace(/^data:image\/png;base64,/, '');
-    await retryFs(() => apis.writeTextFile(imageFile, cleanBase64));
+    // QNBS-v3: data URLs retain an uploaded image's MIME type; legacy raw payloads remain readable as PNG below.
+    await retryFs(() => apis.writeTextFile(imageFile, base64Data));
   }
 
   async getImage(id: string): Promise<string | null> {
@@ -40,8 +40,8 @@ export class FsAssetStore extends FsSnapshotStore {
         return null;
       }
 
-      const base64Data = await retryFs(() => apis.readTextFile(imageFile));
-      return `data:image/png;base64,${base64Data}`;
+      const imageData = await retryFs(() => apis.readTextFile(imageFile));
+      return imageData.startsWith('data:image/') ? imageData : `data:image/png;base64,${imageData}`;
     } catch (error) {
       logger.error('Failed to load image:', error);
       return null;
diff --git a/tests/unit/services/fs/fsStores.test.ts b/tests/unit/services/fs/fsStores.test.ts
index 596511f1..76576114 100644
--- a/tests/unit/services/fs/fsStores.test.ts
+++ b/tests/unit/services/fs/fsStores.test.ts
@@ -288,13 +288,18 @@ describe('FsCodexStore — codex + RAG vectors', () => {
 });
 
 describe('FsAssetStore — images + binder assets', () => {
-  it('round-trips an image (strips/re-adds the data-url prefix)', async () => {
-    await store.saveImage('char-1', 'data:image/png;base64,QUJD');
-    expect(await store.getImage('char-1')).toBe('data:image/png;base64,QUJD');
+  it('round-trips an image while preserving its data-url MIME type', async () => {
+    await store.saveImage('char-1', 'data:image/webp;base64,QUJD');
+    expect(await store.getImage('char-1')).toBe('data:image/webp;base64,QUJD');
     await store.deleteImage('char-1');
     expect(await store.getImage('char-1')).toBeNull();
   });
 
+  it('treats legacy raw image payloads as PNG', async () => {
+    await store.saveImage('legacy-char', 'QUJD');
+    expect(await store.getImage('legacy-char')).toBe('data:image/png;base64,QUJD');
+  });
+
   it('round-trips a binder binary asset with metadata', async () => {
     const data = new Uint8Array([1, 2, 3, 4]).buffer;
     await store.saveBinderAsset('p1', 'a1', data, {
diff --git a/tests/unit/thunks/writingAndCharacterThunks.test.ts b/tests/unit/thunks/writingAndCharacterThunks.test.ts
index 2436626b..e39abff1 100644
--- a/tests/unit/thunks/writingAndCharacterThunks.test.ts
+++ b/tests/unit/thunks/writingAndCharacterThunks.test.ts
@@ -435,7 +435,7 @@ describe('generateCharacterPortraitThunk', () => {
 // uploadCharacterImageThunk
 // ---------------------------------------------------------------------------
 describe('uploadCharacterImageThunk', () => {
-  it('reads file as dataURL and saves base64 without prefix', async () => {
+  it('reads file as a MIME-preserving data URL', async () => {
     const fakeBase64 = 'iVBORw0KGgoAAAANSUhEUgAAAA';
     const fakeDataUrl = `data:image/png;base64,${fakeBase64}`;
 
@@ -453,7 +453,7 @@ describe('uploadCharacterImageThunk', () => {
     const action = await store.dispatch(uploadCharacterImageThunk({ characterId: 'c99', file }));
 
     expect(action.type).toBe('project/uploadCharacterImage/fulfilled');
-    expect(storageService.saveImage).toHaveBeenCalledWith('c99', fakeBase64);
+    expect(storageService.saveImage).toHaveBeenCalledWith('c99', fakeDataUrl);
   });
 
   it('dispatches fulfilled with characterId', async () => {
@@ -473,5 +473,6 @@ describe('uploadCharacterImageThunk', () => {
     const action = await store.dispatch(uploadCharacterImageThunk({ characterId: 'c7', file }));
 
     expect((action as { payload: { characterId: string } }).payload?.characterId).toBe('c7');
+    expect(storageService.saveImage).toHaveBeenCalledWith('c7', 'data:image/jpeg;base64,abc123');
   });
 });