chore: Add i18n rules, perf script, insights & URL opener

Enforce i18n shipping contract across docs and standards (require translations for user-visible copy, placeholders, aria-labels, loading/skeleton labels, route metadata and browser preview copy) and update design/docs to reflect that requirement. Add a new npm script (bun) perf:artifact:shell for generating checked-in shell perf artifacts. Rust/backend changes: implement paginated export_history via collect_history_for_export; add profile storage byte accounting (history, favicons, sidecar bytes) and surface those fields on BrowserProfile; add insight canonical summary and On This Day evidence (load_on_this_day, build_canonical_summary, models/types and tests). Desktop integrations: add external URL validation and platform-specific commands, spawn helpers and a tauri command open_external_url. Update many front-end tests and fixtures to use i18n keys/placeholders and adjust expectations accordingly; remove preview-data files. Overall: docs, tooling, backend, insights and platform URL opening were extended to improve shipping correctness, observability and i18n coverage.

Author: t41372

AGENTS.md

@@ -72,6 +72,7 @@ Tech: Tauri 2 + Rust + React 19 + TypeScript + Vite + Bun。
 - 看 `docs/design/screens-and-nav.md` — 畫面結構和導航規格
 - 看 `docs/design/ux-principles.md` — PME 模型
 - 看 `docs/design/design-tokens.md` — token 與 theme contract 的 source of truth
+- i18n 是 UI 的硬性契約：所有新的 user-visible copy、placeholder、aria-label、loading / skeleton label、empty / error / disabled state、以及 browser preview honesty copy 都必須先想好 `en` / `zh-CN` / `zh-TW`
 - `src/app/`、`src/styles/`、`src/pages/` 是目前活的 shell surface；不要把新工作塞回已刪除的 `AppNew` 思路
 
 ### Rust/後端相關
@@ -85,6 +86,7 @@ Tech: Tauri 2 + Rust + React 19 + TypeScript + Vite + Bun。
 
 - 先讀對應的 `docs/features/` 子文檔
 - 如果「讀先」文檔之間打架：先修文檔，讓 source of truth 恢復一致，再寫代碼
+- 新功能沒有 i18n 就不算完成：至少同步補齊翻譯 key、locale / pseudo-locale smoke、以及相關 literal guard / coverage
 - 完成後跑 `bun run check`，通過才提交
 
 ---
@@ -94,9 +96,9 @@ Tech: Tauri 2 + Rust + React 19 + TypeScript + Vite + Bun。
 ```
 src/                          React 19 + TypeScript 前端
   main.tsx                    入口（載入 src/app）
-  app/                        shell、router、preview data、onboarding shell
+  app/                        shell、router、onboarding shell
   styles/                     token layer + app shell styles
-  lib/backend.ts              legacy helper / reference surface，避免新增 shell contract
+  lib/backend.ts              legacy helper / reference / browser-preview fixture surface，避免新增 shell contract，也不要往裡加新的 raw English UI copy
   lib/ipc/bridge.ts           typed IPC wrapper
   lib/app-context.tsx         舊全域狀態，reference only，不再擴寫
   pages/                      route-scoped page skeletons 與後續正式頁面
@@ -137,6 +139,7 @@ reference/
 3. **Longevity** — 設計壽命 20 年，選 SQLite/plaintext，不鎖死用戶
 4. **Intelligence Is Optional** — 沒有 AI provider 時 PathKeep 仍完整可用，AI 是增值層
 5. **Recoverability** — 所有操作可回滾，用戶不因我們的 bug 永久丟失數據
+6. **Internationalization Is A Shipping Contract** — user-visible copy、honesty note、loading label、preview fixture text 都不是最後才補的 polish，而是開發當下就要交付的產品契約
 
 ---
 

docs/design/screens-and-nav.md

@@ -48,6 +48,7 @@
 - long-running operation、generated artifact review、rollback confirmation、manual fallback 與 verify / rollback hint，全都遵循 PME grammar，而不是各頁自己發明流程。
 - `On This Day` 與其他 evidence surface 以使用者目前系統 timezone 的本地日曆日判斷，不再用 raw UTC slice 假裝是「今天」。
 - keyboard-only walkthrough、reduced-motion fallback、locale-length wrapping 已是 trust-critical acceptance contract；剩餘的全站 accessibility review 與 release-level polish 留在 M4。
+- route metadata、sidebar section label、topbar title / subtitle、loading / skeleton label、empty / error / disabled state，以及 browser preview honesty copy 都屬於正式 i18n surface；不能因為 prototype 沒畫到文字細節就留下英文硬編碼。
 - Settings 的 remote backup 現在以 `Preview / Manual / Execute / Verify` tabs 呈現：Preview 顯示 bundle path / object key / upload URL，Manual 保留 curl command 與 retention guidance，Execute 顯示 upload result，Verify 則列出 checksum / required-entry / restore-readiness checks。
 - Settings 的 enrichment / derived-state panel 是正式 review surface，而不是 debug affordance。它必須顯示 plugin version、queue、freshness、derived tables、storage impact，以及 rebuild / clear controls。
 - Settings 的 general diagnostics 現在是 support / release 文檔依賴的正式入口：至少要顯示 app data root、archive DB path、audit repo path、app version、git short SHA，並提供直接打開對應路徑的動作。

docs/design/ux-principles.md

@@ -56,6 +56,13 @@
 - 空狀態友好：沒有數據時告訴用戶該怎麼開始。
 - 降級狀態友好：AI 未配置時明確提示，但不阻礙核心備份功能。
 
+### 國際化是 UX 契約
+
+- 所有新的 user-visible copy 都先假設要同時支援 `en` / `zh-CN` / `zh-TW`，而不是先寫英文再回頭補翻譯。
+- i18n 範圍不只正文，也包含 route title / subtitle、sidebar label、button 文案、error / warning / success callout、placeholder、aria-label、loading / skeleton label、busy overlay detail，以及 browser preview honesty copy。
+- sample / preview / disabled / empty state 不是例外；如果畫面會顯示給使用者看，它就屬於產品文案。
+- 設計和實作都必須預留 locale-length wrapping；至少要能承受 pseudo-locale、中文長句與較長的錯誤說明，不可因翻譯後溢出就回退成英文硬編碼。
+
 ---
 
 ## 4. Loading States & Skeleton Screens

docs/features/intelligence.md

@@ -184,6 +184,7 @@
 
 - 每張 insight card 都必須顯示生成時間、資料視窗、evidence 數量，以及是否依賴 Chromium-only enhancement。
 - On This Day、Site Analytics、Periodic Summary、Topic Timeline 都必須能 deep-link 回 Explorer evidence，或帶著 scoped question 跳進 Assistant。
+- 即使 AI disabled、provider unavailable、embedding 尚未建立，或 AI-generated card / topic surface 暫時為空，On This Day、Site Analytics、Periodic Summary 這類 canonical / statistical surface 仍必須用純資料庫 / 統計結果繼續顯示，而不是讓整個 Insights / Dashboard intelligence 區塊變空白。
 - explainability panel 必須可列出該 insight 使用的 evidence 與補充 notes，不能只顯示一段摘要。
 - zero-data、新 archive、AI disabled、index rebuilding、provider unavailable 等情境都必須回傳 honest fallback，而不是合成看似完整的 insight。
 - Insights page 必須顯示目前是否套用了共享 profile scope；若有套用，UI 要明講這是 scoped view，而不是假裝所有 KPI 都已 per-profile 重算。

docs/plan/README.md

@@ -93,7 +93,7 @@
 - 2026-04-08 closeout：`WORK-M4-A` 已把 enrichment / derived-state v1、storage analytics / growth evidence、以及 remote backup 的 bundle / verify / PME 閉環正式落地；`WORK-M4-B` 隨後也已完成，正式補齊 release / support 文檔、platform validation runbook、release workflow preflight 與 Settings diagnostics。blocking path、coverage、`mutation:js`、browser-preview smoke 與 debug desktop build 都已通過；其後 `WORK-M4-D` 把 Rust mutation baseline 收斂成 parser crate + AI status/helper slice 的 signed-off contract，並把 whole-workspace `mutation:rust:full` 保留作 exploratory triage，而 `WORK-M4-C` 的安全研究也已在 ADR-005 / App Lock 實作中正式 close out。
 - 2026-04-08 性能 closeout：`WORK-M4-G` 已把 Explorer day-one keyword recall 從 `LIKE` 收斂到 FTS5 `history_search` projection，manual backup 也改為透過 desktop progress event 顯示 profile-scoped phase log；同時補齊 [large-archive-performance-runbook.md](m4-full-polish/large-archive-performance-runbook.md)，讓之後的大型 archive triage 有固定 artifact bundle，而不是再靠一次性的口頭記錄。
 - 2026-04-08 UI closeout：`WORK-M4-E` 已把 Dashboard / Explorer / Insights / Import / AI action 的 loading grammar 收斂成 skeleton + readable progress contract；`WORK-M4-C` 也補上 App Lock route、session guard、MCP refusal path 與 source-of-truth docs。M4 當前已切好的 work blocks 全部收口，下一輪需要從剩餘 docs/plan 開放項重新切出新的 half-milestone block。
-- 2026-04-09 audit closeout：`WORK-QC-D` 與 `WORK-M1-C` 已完成，`bun run verify` / `bun run check` / `bun run build` 重新全綠；但這次審核也確認 repo **不能**聲稱「所有設計文檔需求都已完成」。M4 仍保留兩個真正的未完成主線：`WORK-M4-J`（60-year performance proof）與 `WORK-M4-I`（advanced intelligence shipping）。
+- 2026-04-09 audit closeout：`WORK-QC-D` 與 `WORK-M1-C` 已完成，當時 closeout environment 的 `bun run verify` / `bun run check` / `bun run build` 已重新回綠；但這次審核也確認 repo **不能**聲稱「所有設計文檔需求都已完成」。M4 仍保留兩個真正的未完成主線：`WORK-M4-J`（60-year performance proof）與 `WORK-M4-I`（advanced intelligence shipping）。在目前這台 workspace 上，`WORK-M4-J` 的 acceptance 仍被缺少 `pkg-config` / glib dev libraries 與 `protoc` 阻塞。
 
 這個結果很重要，因為它代表 repo 現在不只保住 desktop entry + typed IPC contract，也重新把 living M0-M3 quality surface 的 coverage、build、e2e 與 deep-check 分層拉回可兌現狀態。
 

docs/plan/m4-full-polish/README.md

@@ -18,7 +18,9 @@
 >
 > **2026-04-09 intelligence truth closeout 註記**：`WORK-QC-D` 沒有把 M4 粉飾成「advanced intelligence 全做完」。這輪實際完成的是 semantic stale / cost read model、MCP consent / scope / audit preview、model-scoped index readiness 與 run-type truth；同時新增 [intelligence-60-year-envelope.md](intelligence-60-year-envelope.md)，明確標出 repo 目前**不能**聲稱已通過「60 年資料量、所有 AI 開啟、8 GB / 4-core 仍流暢」的最終性能背書。revisit / resurfacing、plugin sandbox、獨立 enrichment queue family 仍屬 deferred。
 >
-> **2026-04-09 審核結論**：`bun run verify` 現在已重新全綠，但這不等於 M4 已整體完成。release / support / remote backup / truthful intelligence v1 已簽收；尚未簽收的是兩塊真正會決定「設計文檔是否全完成」的剩餘工作：`WORK-M4-J` 的 60-year performance proof，以及 `WORK-M4-I` 的 advanced intelligence shipping（plugin sandbox / queue family / revisit surfaces）。
+> **2026-04-09 shell-scaling 註記**：shell 已切成 route-level chunks，並新增 checked-in artifact bundle [`artifacts/perf/2026-04-09-large-archive-shell-scaling/`](../../../artifacts/perf/2026-04-09-large-archive-shell-scaling/) 與 `bun run perf:artifact:shell`。目前可重跑的證據是 shell payload summary（base shell 約 `513901` bytes、heaviest first route 約 `563227` bytes）與 synthetic FTS query-plan artifact；這仍**不等於**已完成真實 large-profile replay。
+>
+> **2026-04-09 審核結論**：M4 仍未整體完成。release / support / remote backup / truthful intelligence v1 已簽收；尚未簽收的是兩塊真正會決定「設計文檔是否全完成」的剩餘工作：`WORK-M4-J` 的 60-year performance proof，以及 `WORK-M4-I` 的 advanced intelligence shipping（plugin sandbox / queue family / revisit surfaces）。`bun run verify` 仍是 `WORK-M4-J` 的驗收路徑，但在目前這台機器上被缺少 `pkg-config` / glib dev libraries 與 `protoc` 阻塞，不能誠實寫成已 rerun 全綠。
 
 ---
 

docs/plan/m4-full-polish/intelligence-60-year-envelope.md

@@ -21,14 +21,13 @@
   - `bun run check`
   - `bun run build`
   - `bun run verify`
-- 2026-04-09 release-style sweep status:
-  - `bun run verify` passed end-to-end, including `coverage:js`, `coverage:rust`, `mutation:js`, `mutation:rust`, `test:e2e`, and `desktop:build:debug`
-  - the current Vite production build still emits a single main-chunk warning (`dist/assets/index-*.js` at roughly 702 kB minified), so checker parity is back but whole-shell payload size is not yet signed off as "large-archive smooth"
-- Focused intelligence regressions were re-run while closing this work:
-  - `cargo test --manifest-path src-tauri/Cargo.toml -p vault-core ai:: -- --nocapture`
-  - `cargo test --manifest-path src-tauri/Cargo.toml -p vault-worker mcp_ -- --nocapture`
-  - `cargo test --manifest-path src-tauri/Cargo.toml -p vault-core takeout:: -- --nocapture`
-  - `bunx vitest run src/lib/backend.test.ts src/lib/intelligence.test.ts src/lib/trust-review.test.ts src/app/index.test.tsx src/pages/intelligence-surfaces.test.tsx`
+- 2026-04-09 current rerunnable evidence on this workspace:
+  - `bun run build` passes and no longer emits the earlier single-main-chunk warning; shell routes are now code-split
+  - `bun run check:js` passes for the living JS surface
+  - `bun run perf:artifact:shell` regenerates a checked-in artifact bundle at `artifacts/perf/2026-04-09-large-archive-shell-scaling/`
+  - that bundle currently records `513901` approx base-shell bytes, `563227` approx first-route bytes for the heaviest route (`settings`), and a synthetic Explorer FTS query plan that still uses `VIRTUAL TABLE INDEX`
+- Current environment blockers:
+  - `bun run verify` is still the acceptance target for `WORK-M4-J`, but it is not rerunnable on this machine right now because `pkg-config` / glib dev libraries and `protoc` are missing
 - Code / architecture fixes landed during this closeout:
   - semantic retrieval now queries the LanceDB sidecar first and only falls back to the SQLite compatibility mirror with explicit notes
   - index state now reports `stale` when archive visibility / import watermark or readable-content enrichment freshness diverges from the last semantic build
@@ -38,7 +37,7 @@
   - MCP searches now write dedicated `mcp_query` run-ledger entries, and import restore no longer masquerades as `rollback`
   - selected provider/model readiness is now model-scoped, so switching embedding models no longer reuses readiness from a different model
 - Missing evidence that still matters:
-  - there is still no checked-in `artifacts/perf/<date>-large-archive-...>/` bundle for a real large-profile replay
+  - there is now a checked-in perf artifact bundle, but it is only a shell-scaling / synthetic SQLite query-plan bundle, not a real large-profile replay with actual webview trace + Rust CPU sample
   - there is still no synthetic long-horizon benchmark that exercises semantic search, assistant retrieval, insights rebuild, and shell responsiveness under a defined 60-year corpus shape
   - exploratory whole-workspace JS mutation still shows concentrated survivors in `src/app/shell-data.tsx` and `src/lib/backend.ts`; that debt does not fail the current gate, but it is still evidence that shell-state / preview-state complexity needs another hardening pass before we advertise long-horizon smoothness
 
@@ -100,4 +99,4 @@
 - No: PathKeep should not yet be documented as having completed every intelligence requirement in the design docs.
 - No: PathKeep should not yet claim a fully verified "60-year, all AI on, smooth on 8 GB / 4-core" baseline.
 - Yes: the current M3 / M4 intelligence slice is now materially more honest and more reviewable. Semantic staleness, cost visibility, MCP consent / scope / audit copy, and run-type truth have all been pulled into the shipped contract.
-- The next promotion from "truthful partial support" to "large-archive signed-off support" requires a real perf artifact bundle plus a replayable corpus definition, not just another docs-only closeout.
+- The next promotion from "truthful partial support" to "large-archive signed-off support" requires a real large-profile replay bundle plus a replayable corpus definition, not just another synthetic shell artifact or docs-only closeout.

docs/plan/m4-full-polish/large-archive-performance-runbook.md

@@ -100,10 +100,18 @@ SQL
 
 ---
 
-## Current Baseline (2026-04-08)
+## Current Baseline (2026-04-09)
 
 - Explorer day-one keyword recall 已切回 FTS5 `history_search` projection，不再走 `LIKE` 當 fast path
 - backup overlay 會收到 profile-scoped phase progress event，不再只剩 opaque spinner
 - canonical ingest 已減少 `source_profiles` / `urls` 的額外 SQLite round-trip，優先用 `RETURNING id`
+- shell route 現在已做 route-level code splitting；checked-in shell artifact bundle 位於 `artifacts/perf/2026-04-09-large-archive-shell-scaling/`
+- `bun run perf:artifact:shell` 會從最新 production build 重新生成 shell payload summary、route chunk breakdown 與 synthetic SQLite query-plan artifact
+- 目前 checked-in artifact 顯示：
+  - base shell approx bytes：`513901`
+  - largest approx first-route bytes：`563227`（`settings` route）
+  - synthetic Explorer keyword query plan 仍有 `VIRTUAL TABLE INDEX`
+- checked-in bundle 目前只對 shell scaling 與 synthetic FTS query plan 背書；`webview-trace.json` / `rust-sample.txt` 仍不是一次真實 large-profile replay 的產物
+- 在這台 workspace 上重新跑 `bun run verify` 仍被環境阻塞：缺 `pkg-config` / glib dev libraries，以及 `protoc`
 - 剩餘 hot spot 若再出現，優先考慮 `browser-history-parser` 的真正 streaming API 與 `archive/mod.rs` 的分模組化重整
-- 2026-04-09 補充：`bun run verify` 已重新全綠，但 production build 仍會對單一 main chunk（約 702 kB minified）發出 warning，且 repo 仍沒有真實 large-archive artifact bundle。下一輪若要對外背書「60 年資料量仍流暢」，至少要把 route-level payload / refresh 行為和真實 perf artifacts 一起補齊。
+- 下一輪若要對外背書「60 年資料量仍流暢」，至少還要補一份真實 large-profile replay artifact bundle，而不是只靠 synthetic shell / query-plan summary。

docs/standards.md

@@ -12,8 +12,11 @@
 - 所有用戶可見的文字都走 i18n，包括錯誤信息和通知。
 - 翻譯目錄採 namespace-based 結構（至少區分 `common`、`shell`、`navigation` 與 route / feature namespaces），避免單一巨檔持續膨脹。
 - trust-critical flow 必須同步交付 `en` / `zh-CN` / `zh-TW`；不接受靠英語 fallback 混過核心操作、warning、empty state 或修復 CTA。
+- 新功能的 shipping contract 也包含 placeholder、aria-label、loading / skeleton label、busy overlay detail、route metadata、browser preview honesty copy；這些都不算「之後再補的 polish」。
 - 日期時間、相對時間、檔案大小等格式化要走共用 helper，並跟語系解析規則一起測試。
 - route / page 級的 copy 變更至少要補一輪缺 key coverage 檢查，並保留 pseudo-locale 或等價 smoke 來提早發現 layout 溢出。
+- 活躍 TSX surface（`src/app/`、`src/components/`、`src/pages/`）由 `src/lib/i18n-literal-guard.test.ts` 擋 raw user-visible literal；新增 UI 文案若需要例外，必須先說明為什麼它不是翻譯內容。
+- browser preview fixture 不是 i18n 豁免區；新增或改動 `src/lib/backend.ts` 的 preview / honesty 文案時，也要同步考慮 locale 行為與長字串布局。
 
 ---
 

package.json

@@ -45,6 +45,7 @@
     "coverage": "bun run check:coverage",
     "ci:local": "bun run check && bun run coverage && bun run build && bun run test:e2e && bun run desktop:build:debug",
     "docs:llm": "bun scripts/build-llm-txt.mjs",
+    "perf:artifact:shell": "bun scripts/build-perf-artifact-bundle.mjs",
     "preview": "vite preview",
     "verify": "bun run check:full && bun run build && bun run desktop:build:debug"
   },