[hyperdrivebeep]

First part of the post-beta audit fixes, made in seven batches.

Server log for unexpected failures

• An unexpected command failure is now written to <workspace>/logs/thoth.log under its operation id. Request strings, token-shaped values and anything past 300 characters are left out of the log.
• The screen shows the same operation id with the error.
• A cancel request with a non-JSON body returns 400 instead of 500.

Answer stays visible without a model

• The question area takes 19–24% of the window instead of 39–48%.
• A conversation opens at the latest answer.
• The "no model" notice appears once instead of twice.
• The send button is named "Send" and says why it is disabled.

Wording

• Translated the English labels that were hard-coded on screen.
• Use one Korean word each for "workspace" and "evidence text".
• Rewrote sentences that used internal terms.
• Server failures are shown in the screen language.
• A new test scans the translation tables for banned words and hard-coded labels.

Accessibility

• Tabs point to their panels.
• The faint text colour meets 4.5:1 contrast.
• Elements with a label but no role now have a role.
• Notices are announced to screen readers.
• axe reports no violations on 13 screens.

Rename and detach

• Projects and conversations can be renamed.
• A source can be detached after a warning that every existing answer will need review.
• Archive, stop and detach use one in-app confirmation dialog.

Key file and request boundary

• The API key file is written atomically.
• A key file that cannot be read is no longer overwritten.
• On Windows, the key file's ACL is limited to the current user and drops broad groups.
• Changing requests are accepted only from the server's own origin and the Vite dev origin on port 5173.
• Local responses send anti-framing and nosniff headers.
• The local-actor check uses the list of read queries.
• Staging a file for an unknown project returns 404 once the workspace is open.

Result card

• The conclusion status and the answer check count appear once.
• The judgement's own unchecked conditions are named separately from the answer checks.
• One "technical details" section per card.
• Action labels say "low risk" and "can run without approval" instead of two near-identical phrases.

Validation: CI ran 7,163 tests with 0 failures. The web suite, axe and mutation checks ran for each batch.