diff --git a/backend/apps/agents/agent_manager.py b/backend/apps/agents/agent_manager.py
index 81da2584..6c1ba332 100644
--- a/backend/apps/agents/agent_manager.py
+++ b/backend/apps/agents/agent_manager.py
@@ -22,7 +22,7 @@ from backend.apps.agents.manager.streaming.PartialReply import PartialReply
 from backend.apps.agents.manager.session.SessionLifecycle import SessionLifecycle
 from backend.apps.agents.manager.SpawnAgentRun import SpawnAgentRun
 from backend.apps.agents.manager.session.SessionPersistence import SessionPersistence
-from backend.apps.agents.manager.Messaging import Messaging
+from backend.apps.agents.manager.Messaging import Messaging, QueuedMessage
 from backend.apps.agents.manager.SessionControl import SessionControl
 from backend.apps.agents.manager.AgentLaunch import AgentLaunch
 from backend.apps.agents.manager.MockAgent import MockAgent
@@ -55,6 +55,8 @@ class AgentManager(SessionLifecycle, SessionPersistence, Messaging, SessionContr
         # Per-SESSION hook context + stderr buffer, updated in place each turn: a persistent client's hooks/stderr callback were bound at connect, so they must read stable objects, not per-turn rebuilds.
         self.hook_ctxs: Dict[str, HookContext] = {}
         self.stderr_buffers: Dict[str, List[str]] = {}
+        # Messages typed while a turn was live, replayed in order when it ends (see Messaging).
+        self.pending_messages: Dict[str, List[QueuedMessage]] = {}
         # Admission gate: one shared semaphore caps concurrent ROOT turns (children bypass). (Re)created per running loop by get_turn_admission so it never binds to a dead loop across a uvicorn reload or a test's asyncio.run.
         self.p_turn_admission_sema: Optional[asyncio.Semaphore] = None
         self.p_turn_admission_loop: Optional[asyncio.AbstractEventLoop] = None
diff --git a/backend/apps/agents/agents.py b/backend/apps/agents/agents.py
index 2b21d5cb..a0b54f8f 100644
--- a/backend/apps/agents/agents.py
+++ b/backend/apps/agents/agents.py
@@ -438,10 +438,11 @@ async def subscriptions_connect(body: dict, request: Request):
             raise HTTPException(status_code=503, detail="9Router not available. Please install Node.js.")
 
     # Reconnecting gemini-cli must wipe antigravity; registry prefers AG and a stale AG token would 400 after gemini-cli refreshes.
-    cascade = P_PROVIDER_CASCADE_REMOVES.get(provider, [])
+    from backend.apps.agents.disconnect_subscription import PROVIDER_CASCADE_REMOVES, delete_provider_connections
+    cascade = PROVIDER_CASCADE_REMOVES.get(provider, [])
     if cascade:
         try:
-            await p_delete_provider_connections(cascade)
+            await delete_provider_connections(cascade)
         except Exception:
             pass
 
@@ -894,47 +895,12 @@ async def list_models():
     return {"models": result, "notes": notes}
 
 
-# gemini-cli and antigravity are two Google OAuth lanes; registry prefers AG, so we cascade-wipe AG when reconnecting gemini-cli to avoid stale-AG 400s. One-directional: AG operations MUST NOT cascade back.
-P_PROVIDER_CASCADE_REMOVES: dict[str, list[str]] = {
-    "gemini-cli": ["antigravity"],
-}
-
-
-async def p_delete_provider_connections(providers: list[str]) -> int:
-    """Delete 9Router connections in `providers`; returns count removed, silent on 9Router unreachable."""
-    import httpx
-    from backend.apps.nine_router import NINE_ROUTER_API, get_providers
-    try:
-        connections = await get_providers()
-    except Exception:
-        return 0
-    targets = [c for c in connections if c.get("provider") in providers and c.get("id")]
-    removed = 0
-    async with httpx.AsyncClient(timeout=10.0) as client:
-        for c in targets:
-            try:
-                await client.delete(f"{NINE_ROUTER_API}/providers/{c['id']}")
-                removed += 1
-            except Exception:
-                pass
-    return removed
-
-
 @agents.router.post("/subscriptions/disconnect")
 async def subscriptions_disconnect(body: dict):
-    """Disconnect a subscription provider via 9Router; cascades-wipe Google's paired lanes."""
+    """Disconnect a subscription provider's 9Router lane; reports ok only once the lane is verifiably gone."""
+    from backend.apps.agents.disconnect_subscription import disconnect_subscription
     provider = body.get("provider", "")
     if not provider:
         raise HTTPException(status_code=400, detail="provider required")
-
-    try:
-        to_remove = [provider, *P_PROVIDER_CASCADE_REMOVES.get(provider, [])]
-        removed = await p_delete_provider_connections(to_remove)
-        if removed:
-            from backend.apps.service.client import sync as p_sync
-            from backend.apps.settings.settings import load_settings
-            p_sync(load_settings().model_dump())
-            return {"ok": True}
-        return {"ok": False, "error": "Connection not found"}
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=str(e))
+    result = await disconnect_subscription(provider)
+    return result.model_dump()
diff --git a/backend/apps/agents/browser/browser_agent.py b/backend/apps/agents/browser/browser_agent.py
index 6e5ad5eb..c63e5f02 100644
--- a/backend/apps/agents/browser/browser_agent.py
+++ b/backend/apps/agents/browser/browser_agent.py
@@ -53,6 +53,7 @@ from backend.apps.agents.browser.browser_loop import (
     stagnation_exhausted,
 )
 from backend.apps.agents.browser.browser_validator import adjudicate_stuck
+from backend.apps.agents.browser.humanize_element_rows import humanize_element_rows
 from backend.apps.agents.browser.strip_lone_surrogates import strip_lone_surrogates
 
 # Single actions the model could have folded into one BrowserBatch turn; reads, waits, and the batch tools themselves don't count toward the streak.
@@ -3598,8 +3599,13 @@ async def run_browser_agents(
 
     final = []
     for r in results:
-        if isinstance(r, Exception):
+        # gather(return_exceptions=True) hands back a cancelled child as a bare BaseException too, and that is not a result dict either.
+        if not isinstance(r, dict):
             final.append({"summary": f"Error: {str(r)}", "action_log": [], "final_screenshot": None})
-        else:
-            final.append(r)
+            continue
+        # Last stop before the sub-agent's own words reach a parent agent or, on the fast path, the user verbatim.
+        for p_key in ("summary", "error"):
+            if isinstance(r.get(p_key), str):
+                r[p_key] = humanize_element_rows(r[p_key])
+        final.append(r)
     return final
diff --git a/backend/apps/agents/browser/humanize_element_rows.py b/backend/apps/agents/browser/humanize_element_rows.py
new file mode 100644
index 00000000..5c600f08
--- /dev/null
+++ b/backend/apps/agents/browser/humanize_element_rows.py
@@ -0,0 +1,69 @@
+"""Rewrite the browser subsystem's internal element-index rows into plain prose.
+
+BrowserListInteractives hands the sub-agent rows like `[3]<button "Post">` so it can
+click things by number. That shape is machine input; a human reading a chat should
+never see it. Ask a sub-agent to "report the list verbatim" and it will happily copy
+those rows into its summary, which is the one string that crosses out of the browser
+subsystem into a person's transcript, so the summary gets laundered here.
+"""
+
+import re
+from typing import Dict, Match
+
+from typeguard import typechecked
+
+from backend.apps.agents.browser.browser_history import PAGE_STATE_MARKER
+
+# Exact inverse of the row the renderer builds in frontend/src/shared/browserCommandHandler.ts:
+# `[index]*<role "name" ctx="..." value="...">`. test_browser_index_leak.py pins that
+# template so a change over there can't quietly outrun this pattern.
+P_ROW_RE = re.compile(
+    r'\[\d+\]\*?<\s*(?P<role>[A-Za-z][A-Za-z0-9_-]*)\s+"(?P<name>[^"]*)"'
+    r'(?P<attrs>(?:\s+[a-z]+="[^"]*")*)\s*>'
+)
+P_ATTR_RE = re.compile(r'\s+(?P<key>[a-z]+)="(?P<val>[^"]*)"')
+# The asterisk legend and the truncation footer only mean anything next to indices, and
+# the footer names a tool the person reading it cannot call.
+P_LEGEND_RE = re.compile(r' *\(\* = new since your last look;[^)]*\)')
+P_TRUNCATION_RE = re.compile(r'(\d+ more not shown);[^.\n]*\.')
+P_MARKER_RE = re.compile(re.escape(PAGE_STATE_MARKER) + r'\n?')
+
+# ARIA role names a normal person would not recognize.
+P_ROLE_LABELS: Dict[str, str] = {
+    "combobox": "dropdown",
+    "textbox": "text field",
+    "searchbox": "search box",
+    "listbox": "list",
+    "menuitem": "menu item",
+    "menuitemcheckbox": "menu checkbox",
+    "menuitemradio": "menu option",
+    "spinbutton": "number field",
+    "treeitem": "tree item",
+}
+
+
+@typechecked
+def p_render_row(match: Match[str]) -> str:
+    role: str = match.group("role").lower()
+    name: str = match.group("name").strip()
+    attrs: Dict[str, str] = {
+        m.group("key"): m.group("val").strip()
+        for m in P_ATTR_RE.finditer(match.group("attrs") or "")
+    }
+    value: str = attrs.get("value", "")
+    role_label: str = P_ROLE_LABELS.get(role, role)
+    if name and value:
+        return f'"{name}" ({role_label}, currently "{value}")'
+    label: str = name or value
+    if not label:
+        return f"an unlabeled {role_label}"
+    return f'"{label}" ({role_label})'
+
+
+@typechecked
+def humanize_element_rows(text: str) -> str:
+    """Strip the click-by-index serialization out of browser-agent-authored prose."""
+    out: str = P_ROW_RE.sub(p_render_row, text)
+    out = P_LEGEND_RE.sub("", out)
+    out = P_TRUNCATION_RE.sub(r"\1.", out)
+    return P_MARKER_RE.sub("", out)
diff --git a/backend/apps/agents/core/models.py b/backend/apps/agents/core/models.py
index bc93cdff..41964275 100644
--- a/backend/apps/agents/core/models.py
+++ b/backend/apps/agents/core/models.py
@@ -9,7 +9,8 @@ class AgentConfig(BaseModel):
     mode: str = "agent"
     provider: str = "anthropic"
     system_prompt: Optional[str] = None
-    allowed_tools: list[str] = Field(default_factory=lambda: ["Read", "Edit", "Write", "Bash", "Glob", "Grep", "AskUserQuestion"])
+    # None means "whatever the mode allows". A list is an actual restriction and IS enforced at launch, so it must stay None unless the caller really means to narrow the surface.
+    allowed_tools: Optional[list[str]] = None
     max_turns: Optional[int] = None
     target_directory: Optional[str] = None
     dashboard_id: Optional[str] = None
diff --git a/backend/apps/agents/core/ws_manager.py b/backend/apps/agents/core/ws_manager.py
index 5e66d58e..48fe69a0 100644
--- a/backend/apps/agents/core/ws_manager.py
+++ b/backend/apps/agents/core/ws_manager.py
@@ -68,6 +68,8 @@ class ConnectionManager:
     def __init__(self):
         self.connections: dict[str, list[WebSocket]] = {}
         self.global_connections: list[WebSocket] = []
+        # Latched on the first renderer and never cleared: it answers "can a window reach this backend at all", which a momentary socket blip must not un-answer. Only the process dying resets it.
+        self.renderer_ever_attached: bool = False
         # Which dashboard each global socket is currently showing, keyed by id(websocket). active_dashboard_id is the last one activated (the window the user is looking at most recently); a scheduled run targets it so its browser card spawns where the renderer can render it.
         self.global_dashboard_ids: dict[int, str] = {}
         self.active_dashboard_id: Optional[str] = None
@@ -85,6 +87,7 @@ class ConnectionManager:
     async def connect_global(self, websocket: WebSocket):
         await websocket.accept()
         self.global_connections.append(websocket)
+        self.renderer_ever_attached = True
 
     async def connect_main(self, websocket: WebSocket):
         """Register the single Electron-main bridge socket (replaces any stale prior one)."""
diff --git a/backend/apps/agents/disconnect_subscription.py b/backend/apps/agents/disconnect_subscription.py
new file mode 100644
index 00000000..91ab3e92
--- /dev/null
+++ b/backend/apps/agents/disconnect_subscription.py
@@ -0,0 +1,111 @@
+"""Drop a subscription provider's 9Router lane and report only what actually happened.
+
+Deleting is the easy half; honesty is the hard half. 9Router answers a bad id with a 404 and a JSON
+error body, so a caller that ignores status codes reports "disconnected" for a lane that is still
+live, and the user reconnects on top of a stale row. So success here is verified, never inferred:
+`ok` means the provider has no connection row left, confirmed by re-reading 9Router.
+"""
+
+import logging
+from typing import Dict, List, Optional
+
+import httpx
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from backend.apps.nine_router.process import NINE_ROUTER_API, cli_auth_headers, is_running
+from backend.apps.nine_router.subscription_health import invalidate_health_cache
+
+logger = logging.getLogger(__name__)
+
+# gemini-cli and antigravity are two Google OAuth lanes; the registry prefers AG, so dropping gemini-cli must drop the stale AG row too or it 400s. One-directional: AG operations MUST NOT cascade back.
+PROVIDER_CASCADE_REMOVES: Dict[str, List[str]] = {
+    "gemini-cli": ["antigravity"],
+}
+
+P_TIMEOUT_S = 10.0
+
+
+class SubscriptionDisconnectResult(BaseModel):
+    """What the user may be told: `ok` only once the lane is verifiably empty."""
+
+    model_config = ConfigDict(validate_assignment=True)
+    ok: bool
+    removed: int = 0
+    error: str = ""
+
+
+@typechecked
+def sync_settings_state() -> None:
+    """Push the settings snapshot to the cloud state sync, exactly as connecting does. Imported late: service.client reaches back into this package."""
+    from backend.apps.service.client import sync
+    from backend.apps.settings.settings import load_settings
+    sync(load_settings().model_dump())
+
+
+@typechecked
+async def p_list_connections() -> Optional[List[Dict]]:
+    """Every 9Router connection row, or None when the router can't be read.
+
+    Deliberately not `nine_router.get_providers`, which folds an unreachable router into an empty
+    list: here "I couldn't look" and "nothing is connected" must not be the same answer.
+    """
+    try:
+        async with httpx.AsyncClient(timeout=P_TIMEOUT_S, headers=cli_auth_headers()) as client:
+            r = await client.get(f"{NINE_ROUTER_API}/providers")
+            if r.status_code != 200:
+                return None
+            data = r.json()
+            if not isinstance(data, dict):
+                return None
+            return data.get("connections") or []
+    except Exception as e:
+        logger.debug(f"9Router provider list failed: {e}")
+        return None
+
+
+@typechecked
+async def delete_provider_connections(providers: List[str]) -> int:
+    """Delete every 9Router connection belonging to `providers`; returns how many really went."""
+    connections = await p_list_connections()
+    if connections is None:
+        return 0
+    removed = 0
+    async with httpx.AsyncClient(timeout=P_TIMEOUT_S, headers=cli_auth_headers()) as client:
+        for c in connections:
+            if c.get("provider") not in providers or not c.get("id"):
+                continue
+            try:
+                r = await client.delete(f"{NINE_ROUTER_API}/providers/{c['id']}")
+                if r.status_code < 400:
+                    removed += 1
+                else:
+                    logger.warning(f"9Router refused to drop the {c.get('provider')} connection: HTTP {r.status_code}")
+            except Exception as e:
+                logger.warning(f"9Router delete failed for {c.get('provider')}: {e}")
+    return removed
+
+
+@typechecked
+async def disconnect_subscription(provider: str) -> SubscriptionDisconnectResult:
+    """Clear `provider` (and its cascade lanes) from 9Router, confirming the lane is gone."""
+    if not is_running():
+        return SubscriptionDisconnectResult(ok=False, error="The subscription service isn't running.")
+
+    targets = [provider, *PROVIDER_CASCADE_REMOVES.get(provider, [])]
+    removed = await delete_provider_connections(targets)
+
+    remaining = await p_list_connections()
+    if remaining is None:
+        return SubscriptionDisconnectResult(
+            ok=False, removed=removed, error="Couldn't confirm the disconnect. Please try again.",
+        )
+    if any(c.get("provider") in targets for c in remaining):
+        return SubscriptionDisconnectResult(
+            ok=False, removed=removed, error="The subscription service kept the connection. Please try again.",
+        )
+
+    sync_settings_state()
+    # A deliberate disconnect makes the cached boot verdict a lie: it would nag "reconnect" about the lane the user just dropped.
+    invalidate_health_cache()
+    return SubscriptionDisconnectResult(ok=True, removed=removed)
diff --git a/backend/apps/agents/manager/AgentLaunch.py b/backend/apps/agents/manager/AgentLaunch.py
index abf3a806..179110ae 100644
--- a/backend/apps/agents/manager/AgentLaunch.py
+++ b/backend/apps/agents/manager/AgentLaunch.py
@@ -29,6 +29,21 @@ from backend.apps.agents.manager.prompt.prompt_context import resolve_mode
 logger = logging.getLogger(__name__)
 
 
+@typechecked
+def resolve_launch_tools(mode_tools: List[str], allowed: Optional[List[str]]) -> List[str]:
+    """The tool surface a session actually launches with.
+
+    None means "whatever the mode allows". A list is a real restriction: a workflow whose Actions
+    set the user froze. This used to be computed and then discarded, so the Actions page sold a
+    boundary the runtime never enforced. Intersecting rather than trusting means a stale saved set
+    can only ever narrow the mode, never widen it.
+    """
+    if allowed is None:
+        return mode_tools
+    permitted = set(allowed)
+    return [t for t in mode_tools if t in permitted]
+
+
 from backend.apps.agents.manager.AgentManagerProtocol import AgentManagerProtocol
 
 
@@ -50,7 +65,7 @@ class AgentLaunch(AgentManagerProtocol):
                 config.target_directory = bound
 
         mode_tools, _, mode_folder = resolve_mode(config.mode, get_all_tool_names)
-        tools = mode_tools
+        tools = resolve_launch_tools(mode_tools, config.allowed_tools)
 
         global_settings = load_settings()
         effective_cwd = (
diff --git a/backend/apps/agents/manager/AgentManagerProtocol.py b/backend/apps/agents/manager/AgentManagerProtocol.py
index da6987b5..904f531a 100644
--- a/backend/apps/agents/manager/AgentManagerProtocol.py
+++ b/backend/apps/agents/manager/AgentManagerProtocol.py
@@ -17,6 +17,7 @@ from typing import TYPE_CHECKING, Any, Dict, List
 
 if TYPE_CHECKING:
     from backend.apps.agents.core.models import AgentSession
+    from backend.apps.agents.manager.Messaging import QueuedMessage
     from backend.apps.agents.manager.run.client_pool import ClientHandle
     from backend.apps.agents.manager.streaming.HookContext import HookContext
     from backend.apps.agents.manager.streaming.PartialReply import PartialReply
@@ -31,11 +32,14 @@ class AgentManagerProtocol:
     client_pool: Dict[str, ClientHandle]
     hook_ctxs: Dict[str, HookContext]
     stderr_buffers: Dict[str, List[str]]
+    pending_messages: Dict[str, List[QueuedMessage]]
 
     if TYPE_CHECKING:
         # Methods implemented on sibling mixins / AgentManager itself and called cross-mixin. Loose signatures on purpose: typeCheckingMode is off, so this only has to assert the names exist, not pin their call shapes.
         def run_agent_loop(self, *args: Any, **kwargs: Any) -> Any: ...
         def generate_turn_label(self, *args: Any, **kwargs: Any) -> Any: ...
+        def register_turn_task(self, *args: Any, **kwargs: Any) -> Any: ...
+        def deliver_next_queued_message(self, *args: Any, **kwargs: Any) -> Any: ...
         def commit_partial_now(self, *args: Any, **kwargs: Any) -> Any: ...
         def stop_agent(self, *args: Any, **kwargs: Any) -> Any: ...
         def drain_task(self, *args: Any, **kwargs: Any) -> Any: ...
diff --git a/backend/apps/agents/manager/Messaging.py b/backend/apps/agents/manager/Messaging.py
index fa67bfee..169f3e3f 100644
--- a/backend/apps/agents/manager/Messaging.py
+++ b/backend/apps/agents/manager/Messaging.py
@@ -6,6 +6,7 @@ import asyncio
 import logging
 from typing import List, Optional
 
+from pydantic import BaseModel, ConfigDict
 from typeguard import typechecked
 from uuid import uuid4
 
@@ -24,6 +25,27 @@ logger = logging.getLogger(__name__)
 from backend.apps.agents.manager.AgentManagerProtocol import AgentManagerProtocol
 
 
+class QueuedMessage(BaseModel):
+    """A user message that arrived while a turn was live, held until that turn ends.
+    Carries the full send_message argument set so delivery is a faithful replay."""
+
+    model_config = ConfigDict(validate_assignment=True)
+
+    prompt: str
+    mode: Optional[str] = None
+    model: Optional[str] = None
+    provider: Optional[str] = None
+    images: Optional[List] = None
+    context_paths: Optional[List] = None
+    forced_tools: Optional[List[str]] = None
+    attached_skills: Optional[List] = None
+    hidden: bool = False
+    selected_browser_ids: Optional[List[str]] = None
+    selected_app_output_ids: Optional[List[str]] = None
+    selected_setting_ids: Optional[List[str]] = None
+    client_message_id: Optional[str] = None
+
+
 class Messaging(AgentManagerProtocol):
     @typechecked
     async def send_message(
@@ -57,6 +79,16 @@ class Messaging(AgentManagerProtocol):
         
         existing = self.tasks.get(session_id)
         if existing and not existing.done():
+            # A mid-turn message used to be silently dropped here (no bubble, no trace); queue it and the turn task's done callback replays it.
+            self.pending_messages.setdefault(session_id, []).append(QueuedMessage(
+                prompt=prompt, mode=mode, model=model, provider=provider, images=images,
+                context_paths=context_paths, forced_tools=forced_tools,
+                attached_skills=attached_skills, hidden=hidden,
+                selected_browser_ids=selected_browser_ids,
+                selected_app_output_ids=selected_app_output_ids,
+                selected_setting_ids=selected_setting_ids,
+                client_message_id=client_message_id,
+            ))
             return
 
         session_changed = False
@@ -141,7 +173,37 @@ class Messaging(AgentManagerProtocol):
             task = asyncio.create_task(run_browser_fast_path(session, session_id, prompt, selected_browser_ids, fast_brief, fast_verdict))
         else:
             task = asyncio.create_task(self.run_agent_loop(session_id, prompt, images=images, context_paths=context_paths, forced_tools=forced_tools, attached_skills=attached_skills, selected_browser_ids=selected_browser_ids, selected_app_output_ids=selected_app_output_ids, selected_setting_ids=selected_setting_ids))
+        self.register_turn_task(session_id, task)
+
+    @typechecked
+    def register_turn_task(self, session_id: str, task: asyncio.Task) -> None:
+        """One chokepoint for installing a turn task: every turn end (success, error, stop)
+        fires the done callback, so a queued mid-turn message can never strand."""
         self.tasks[session_id] = task
+        task.add_done_callback(lambda t: self.deliver_next_queued_message(session_id))
+
+    @typechecked
+    def deliver_next_queued_message(self, session_id: str) -> None:
+        """Replay the oldest queued mid-turn message once no turn is live. One at a time:
+        the delivered turn's own done callback drains the rest."""
+        queue = self.pending_messages.get(session_id)
+        if not queue:
+            return
+        live = self.tasks.get(session_id)
+        if live and not live.done():
+            return
+        qm = queue.pop(0)
+        if not queue:
+            self.pending_messages.pop(session_id, None)
+        asyncio.create_task(self.send_message(
+            session_id, qm.prompt, mode=qm.mode, model=qm.model, provider=qm.provider,
+            images=qm.images, context_paths=qm.context_paths, forced_tools=qm.forced_tools,
+            attached_skills=qm.attached_skills, hidden=qm.hidden,
+            selected_browser_ids=qm.selected_browser_ids,
+            selected_app_output_ids=qm.selected_app_output_ids,
+            selected_setting_ids=qm.selected_setting_ids,
+            client_message_id=qm.client_message_id,
+        ))
 
     @typechecked
     async def edit_message(self, session_id: str, message_id: str, new_content: str):
@@ -228,5 +290,5 @@ class Messaging(AgentManagerProtocol):
             attached_skills=target_msg.attached_skills,
             fork_session=True,
         ))
-        self.tasks[session_id] = task
+        self.register_turn_task(session_id, task)
 
diff --git a/backend/apps/agents/manager/RunSupport.py b/backend/apps/agents/manager/RunSupport.py
index 774e0a46..bc51c5dc 100644
--- a/backend/apps/agents/manager/RunSupport.py
+++ b/backend/apps/agents/manager/RunSupport.py
@@ -11,7 +11,6 @@ from typeguard import typechecked
 
 from backend.apps.agents.core.models import AgentSession, Message
 from backend.apps.agents.core.ws_manager import ws_manager
-from backend.apps.settings.settings import load_settings
 from backend.apps.agents.manager import context_budget
 from backend.apps.agents.manager import metadata
 from backend.apps.agents.manager.streaming.upsert_message import upsert_message
diff --git a/backend/apps/agents/manager/SessionControl.py b/backend/apps/agents/manager/SessionControl.py
index 497442ed..b74ee0f5 100644
--- a/backend/apps/agents/manager/SessionControl.py
+++ b/backend/apps/agents/manager/SessionControl.py
@@ -41,15 +41,18 @@ class SessionControl(AgentManagerProtocol):
                 ws_manager.resolve_approval(req.id, {"behavior": "deny", "message": "Agent stopped"})
             session.pending_approvals = []
 
-            session.status = "stopped"
-            session.needs_fresh_session = True
-            if not session.closed_at:
-                session.closed_at = datetime.now()
-            # Persist the partial reply NOW, before tearing down the SDK. The cancel handler also does this, but it sits behind the generator's teardown, which can take several seconds; doing it here means the streamed text stays put the instant Stop is pressed instead of blinking out and reappearing once teardown finishes.
-            await self.commit_partial_now(session)
+            # Only a LIVE turn can be stopped. A finished session's task lingers in the registry, and shutdown stops every task it finds, so an unconditional flip relabelled every completed chat "stopped" on restart and hung a Resume button off a conversation that was already answered.
+            p_was_live = session.status in ("running", "waiting_approval")
+            if p_was_live:
+                session.status = "stopped"
+                session.needs_fresh_session = True
+                if not session.closed_at:
+                    session.closed_at = datetime.now()
+                # Persist the partial reply NOW, before tearing down the SDK. The cancel handler also does this, but it sits behind the generator's teardown, which can take several seconds; doing it here means the streamed text stays put the instant Stop is pressed instead of blinking out and reappearing once teardown finishes.
+                await self.commit_partial_now(session)
             await ws_manager.send_to_session(session_id, "agent:status", {
                 "session_id": session_id,
-                "status": "stopped",
+                "status": session.status,
                 "session": session.model_dump(mode="json"),
             })
             # Snapshot now: the cancelled task's finally skips the save (it's no longer the live task once we pop it below), so persist the partial here or it'd live only in memory until the next turn / shutdown.
diff --git a/backend/apps/agents/manager/SpawnAgentRun.py b/backend/apps/agents/manager/SpawnAgentRun.py
index 1c3e601a..dd512980 100644
--- a/backend/apps/agents/manager/SpawnAgentRun.py
+++ b/backend/apps/agents/manager/SpawnAgentRun.py
@@ -88,7 +88,7 @@ class SpawnAgentRun(AgentManagerProtocol):
         if run_in_background:
             # Fire-and-forget; the child's card carries its progress and result. Keep a handle in self.tasks so stop/shutdown machinery sees it.
             task = asyncio.create_task(self.run_agent_loop(child.id, prompt))
-            self.tasks[child.id] = task
+            self.register_turn_task(child.id, task)
             return {"session_id": child.id, "background": True}
 
         await self.run_agent_loop(child.id, prompt)
diff --git a/backend/apps/agents/manager/permissions/build_effective_tool_lists.py b/backend/apps/agents/manager/permissions/build_effective_tool_lists.py
index 7548768a..5a6f17d8 100644
--- a/backend/apps/agents/manager/permissions/build_effective_tool_lists.py
+++ b/backend/apps/agents/manager/permissions/build_effective_tool_lists.py
@@ -18,6 +18,7 @@ from backend.apps.tools_lib.tools_lib import (
     load_all_tools as load_all_tools,
     sanitize_server_name as sanitize_server_name,
 )
+from backend.config.headless import apply_unreachable_denies
 
 # Mutation/exec tools a read-only session must never reach: Edit (rewrites files), Bash (rm/mv/overwrite),
 # NotebookEdit (rewrites notebooks). Write is intentionally NOT here, the audit needs its one report.
@@ -33,6 +34,8 @@ def build_effective_tool_lists(
     browser_delegation_tools: List[str],
     invoke_agent_tools: List[str],
 ) -> Tuple[List[str], List[str]]:
+    # Same shadow the server registration takes: anything that would dead-end goes straight onto disallowed instead of being offered and failing when called.
+    builtin_perms = apply_unreachable_denies(builtin_perms)
     effective_allowed = [
         t for t in session.allowed_tools
         if t in FULL_TOOLS and builtin_perms.get(t, "always_allow") == "always_allow"
@@ -134,6 +137,10 @@ def build_effective_tool_lists(
     for bt in path_gate.CLAUDE_INTERNAL_SCHEDULER_TOOLS:
         if bt not in effective_disallowed:
             effective_disallowed.append(bt)
+    # Nothing consumes a between-turn event here, so arming one of these strands the user waiting on a report that can never arrive.
+    for bt in path_gate.UNDELIVERABLE_BACKGROUND_TOOLS:
+        if bt not in effective_disallowed:
+            effective_disallowed.append(bt)
     # The claude_code preset ships its own bare `Skill` tool that reads ~/.claude/skills directly; always withhold it so skills only ever load through our provider-agnostic mcp__openswarm-skill__Skill (or not at all).
     if "Skill" not in effective_disallowed:
         effective_disallowed.append("Skill")
diff --git a/backend/apps/agents/manager/permissions/path_gate.py b/backend/apps/agents/manager/permissions/path_gate.py
index e930f67b..d215ec3d 100644
--- a/backend/apps/agents/manager/permissions/path_gate.py
+++ b/backend/apps/agents/manager/permissions/path_gate.py
@@ -157,6 +157,8 @@ p_SCHEDULE_GATED = {
     "mcp__openswarm-schedule__PauseAllWorkflows",
 }
 CLAUDE_INTERNAL_SCHEDULER_TOOLS = ("CronCreate", "CronList", "CronDelete")
+# Preset built-ins that deliver their payload BETWEEN turns. We drive the CLI one turn at a time and stop reading at the ResultMessage, so nothing ever consumes the event: the agent arms a Monitor, promises "I'll report back", ends the turn, and the user waits forever for a message that cannot arrive. Withheld here rather than only in the tool manifest, because the manifest has a kill switch (OSW_TOOL_MANIFEST=0) that would otherwise hand the model a promise we cannot keep.
+UNDELIVERABLE_BACKGROUND_TOOLS = ("Monitor", "PushNotification", "RemoteTrigger", "ScheduleWakeup")
 
 
 @typechecked
diff --git a/backend/apps/agents/manager/permissions/workflow_approval.py b/backend/apps/agents/manager/permissions/workflow_approval.py
index a7596d72..acc12cfe 100644
--- a/backend/apps/agents/manager/permissions/workflow_approval.py
+++ b/backend/apps/agents/manager/permissions/workflow_approval.py
@@ -16,6 +16,7 @@ from typeguard import typechecked
 from backend.apps.agents.manager.permissions.ApprovalDecision import ApprovalDecision
 from backend.apps.agents.manager.permissions.decision import request_user_approval
 from backend.apps.agents.manager.streaming.HookContext import HookContext
+from backend.config.headless import is_headless
 
 logger = logging.getLogger(__name__)
 
@@ -90,7 +91,8 @@ async def resolve_ask(
 ) -> ApprovalDecision:
     """Resolve an 'ask' policy. On a workflow run, reuse a remembered decision
     (this step first, then the workflow-level fallback) instead of prompting, and
-    persist any fresh non-sensitive answer so later fires don't re-ask. Shared by
+    persist any fresh non-sensitive answer so later fires don't re-ask. Headless,
+    anything still unresolved is denied on the spot instead of prompting. Shared by
     both gates so they can't disagree (and so the first one's answer is reused by
     the second within the same call)."""
     mem = p_approval_memory.get(ctx.session_id)
@@ -113,6 +115,12 @@ async def resolve_ask(
         if prior == "deny":
             note_tool_used(ctx.session_id, tool_name, False)
             return ApprovalDecision(behavior="deny", message="Denied by a remembered workflow permission")
+    # Headless there is no one to ask, so the request would just be broadcast into the void and come back denied ten minutes later; deny now, but only after the remembered decisions above got their say.
+    if is_headless():
+        return ApprovalDecision(
+            behavior="deny",
+            message="This run is headless, so nobody can approve a tool that asks. Use a tool that doesn't need approval, or report what you'd need permission for.",
+        )
     timeout = mem.ask_timeout if mem is not None else 600.0
     decision = await request_user_approval(
         ctx.session, ctx.session_id, tool_name, tool_input, ctx.builtin_perms,
diff --git a/backend/apps/agents/manager/prompt/compose_turn_system_prompt.py b/backend/apps/agents/manager/prompt/compose_turn_system_prompt.py
index f05f9ba0..e99841df 100644
--- a/backend/apps/agents/manager/prompt/compose_turn_system_prompt.py
+++ b/backend/apps/agents/manager/prompt/compose_turn_system_prompt.py
@@ -17,6 +17,7 @@ from backend.apps.agents.manager.prompt.prompt_context import (
     build_installed_skills_catalog,
     build_mcp_registry_summary,
     build_selected_app_context,
+    build_unselected_app_context,
     build_selected_settings_context,
     compose_system_prompt,
 )
@@ -122,6 +123,9 @@ def compose_turn_system_prompt(
 
     # App cards the user picked via the dashboard element picker: give the agent each app's on-disk path + meta + SKILL.md pointer so it can edit them in place (the dashboard card's runtime live-reloads). Additive and independent of view-builder mode above.
     app_ctx = build_selected_app_context(selected_app_output_ids)
+    # Nothing picked: name the apps anyway so the agent can point the user at the selection step instead of acting like their app does not exist.
+    if not app_ctx:
+        app_ctx = build_unselected_app_context()
     if app_ctx:
         composed_prompt = f"{composed_prompt}\n\n{app_ctx}" if composed_prompt else app_ctx
 
diff --git a/backend/apps/agents/manager/prompt/prompt_context.py b/backend/apps/agents/manager/prompt/prompt_context.py
index b9ae5bb3..e9d8a75e 100644
--- a/backend/apps/agents/manager/prompt/prompt_context.py
+++ b/backend/apps/agents/manager/prompt/prompt_context.py
@@ -132,6 +132,39 @@ def build_browser_context(dashboard_id: Optional[str], selected_browser_ids: Opt
     return "\n".join(lines)
 
 
+@typechecked
+def build_unselected_app_context() -> Optional[str]:
+    """Name the user's existing apps when none is selected.
+
+    Selecting a card is what grants edit access, but a user who has not learned that ritual just
+    sees an agent that appears not to know their app exists, and the agent cannot tell them what to
+    do because it was never told the app was there either. Names only, no paths: enough to say
+    "select it and I can edit it", not enough to start editing something the user did not point at.
+    """
+    from backend.apps.outputs.workspace_io import load_all
+    try:
+        apps = [o for o in load_all() if o.workspace_id and not getattr(o, "deleted_at", None)]
+    except Exception:
+        return None
+    if not apps:
+        return None
+    names = ", ".join(f'"{o.name or "Untitled App"}"' for o in apps[:P_UNSELECTED_APP_CAP])
+    more = "" if len(apps) <= P_UNSELECTED_APP_CAP else f", and {len(apps) - P_UNSELECTED_APP_CAP} more"
+    return (
+        "<available_apps>\n"
+        f"The user has these Apps on their dashboard: {names}{more}.\n"
+        "You do NOT have access to their files right now. If the user asks you to change, look at, "
+        "or use one of them, say so plainly and tell them to click the App card to select it, then "
+        "resend. Do not guess at file paths, do not scaffold a replacement, and do not claim the app "
+        "does not exist.\n"
+        "</available_apps>"
+    )
+
+
+# A long list burns prompt tokens for no gain; past a handful the agent only needs to know apps exist.
+P_UNSELECTED_APP_CAP = 12
+
+
 @typechecked
 def build_selected_app_context(selected_app_output_ids: Optional[List[str]]) -> Optional[str]:
     """Build a context block for dashboard App cards the user selected to edit.
diff --git a/backend/apps/agents/manager/prompt/tool_catalog.py b/backend/apps/agents/manager/prompt/tool_catalog.py
index dfb41235..b6574f7e 100644
--- a/backend/apps/agents/manager/prompt/tool_catalog.py
+++ b/backend/apps/agents/manager/prompt/tool_catalog.py
@@ -17,7 +17,8 @@ logger = logging.getLogger(__name__)
 FULL_TOOLS = [
     "Read", "Edit", "Write", "Bash", "Glob", "Grep", "AskUserQuestion",
     "WebSearch", "WebFetch", "NotebookEdit", "TodoWrite",
-    "EnterPlanMode", "ExitPlanMode", "EnterWorktree",
+    # Both halves of each pair, always: EnterWorktree shipped without ExitWorktree, so an agent told to work in a worktree had no way back out mid-session.
+    "EnterPlanMode", "ExitPlanMode", "EnterWorktree", "ExitWorktree",
     "TaskOutput", "TaskStop",
     # ToolSearch is the loader the CLI uses to expose deferred tool schemas on demand. Must be in the allowedTools whitelist or the model can't call it, which means none of the deferred extended tools become reachable even when the CLI advertises them in the system prompt.
     "ToolSearch",
@@ -28,16 +29,20 @@ FULL_TOOLS = [
 def resolve_builtin_tools_option() -> Union[List[str], Dict[str, str]]:
     """The SDK `tools` option (CLI `--tools`), the base set of built-in tools.
 
-    Default: the full claude_code preset, which ships every preset built-in's schema. With
-    OSW_TOOL_MANIFEST=1, an explicit FULL_TOOLS list instead, ONLY the built-ins OpenSwarm exposes,
-    which prunes the ~9 preset extras nothing here references (Cron*/Monitor/Task*/PushNotification/
-    RemoteTrigger/etc) for ~940 schema tokens/turn, cache-stable. MCP tools ride mcp_servers, so
-    SpawnAgent/browser/schedule/skill/web/user MCPs are untouched; ToolSearch stays in FULL_TOOLS so
-    deferred loading survives (live-proven: the model still ToolSearch-loads + calls MCP tools under
-    the manifest). Flag-gated pending a real-app soak before default-on."""
-    if os.environ.get("OSW_TOOL_MANIFEST") == "1":
-        return list(FULL_TOOLS)
-    return {"type": "preset", "preset": "claude_code"}
+    Default: an explicit FULL_TOOLS list, ONLY the built-ins OpenSwarm exposes. The claude_code
+    preset also ships Monitor/PushNotification/RemoteTrigger/ScheduleWakeup, which deliver their
+    payload between turns and so can never fire here, plus a bare `Skill`. All five are ALSO
+    hard-denied in build_effective_tool_lists, because this list has a kill switch and those
+    promises must not come back with it. Measured on a live "hi" turn (Anthropic count_tokens on
+    the captured wire request, and the provider's own usage reporting, agreeing within 1 token):
+    31,091 -> 26,880 prompt tokens, 4,211 saved per turn, cache-stable; that figure predates
+    ExitWorktree rejoining the list, so the real saving is now one tool schema smaller. MCP tools
+    ride mcp_servers, so SpawnAgent/browser/schedule/skill/web/user MCPs are untouched; ToolSearch
+    stays in FULL_TOOLS so deferred loading survives.
+    Kill switch: OSW_TOOL_MANIFEST=0 restores the preset."""
+    if os.environ.get("OSW_TOOL_MANIFEST") == "0":
+        return {"type": "preset", "preset": "claude_code"}
+    return list(FULL_TOOLS)
 
 
 @typechecked
diff --git a/backend/apps/agents/manager/register_builtin_mcp_servers.py b/backend/apps/agents/manager/register_builtin_mcp_servers.py
index 32e25239..aad257b2 100644
--- a/backend/apps/agents/manager/register_builtin_mcp_servers.py
+++ b/backend/apps/agents/manager/register_builtin_mcp_servers.py
@@ -12,6 +12,7 @@ from typeguard import typechecked
 
 from backend.apps.agents.core.models import AgentSession
 from backend.auth import get_auth_token
+from backend.config.headless import apply_unreachable_denies
 
 
 @typechecked
@@ -24,6 +25,8 @@ def register_builtin_mcp_servers(
 ) -> Tuple[List[str], List[str]]:
     import backend.apps.agents as p_agents_pkg
     agents_dir = os.path.dirname(p_agents_pkg.__file__)
+    # With no renderer for a webview and no human for a prompt, we shadow the map once here and let the existing deny short-circuits skip those servers; nothing below may read the un-shadowed one.
+    builtin_perms = apply_unreachable_denies(builtin_perms)
     browser_delegation_tools = ["CreateBrowserAgent", "BrowserAgent", "BrowserAgents", "AppAgent"]
     browser_all_denied = all(
         builtin_perms.get(t, "always_allow") == "deny"
diff --git a/backend/apps/agents/manager/run/TurnRunner.py b/backend/apps/agents/manager/run/TurnRunner.py
index b749a32a..3a650d50 100644
--- a/backend/apps/agents/manager/run/TurnRunner.py
+++ b/backend/apps/agents/manager/run/TurnRunner.py
@@ -15,7 +15,7 @@ from backend.apps.agents.core.error_classify import CAPACITY_BACKOFFS, capacity_
 from backend.apps.agents.manager.streaming.state import ThinkingState, TurnState
 from backend.apps.agents.manager.streaming.handle_stream_event import handle_stream_event
 from backend.apps.agents.manager.streaming.handle_assistant_message import handle_assistant_message
-from backend.apps.agents.manager.streaming.handle_result_message import handle_result_message
+from backend.apps.agents.manager.streaming.handle_result_message import TurnResultError, handle_result_message
 from backend.apps.agents.manager.run.client_pool import (
     SdkClientLike,
     acquire_client,
@@ -152,6 +152,9 @@ class TurnRunner(AgentManagerProtocol):
                 else:
                     await p_run_streaming_turn()
                 break
+            except TurnResultError:
+                # The CLI already ran the whole turn (tools executed) and then reported failure; a resume-retry would re-execute side effects, so this goes straight to the error card.
+                raise
             except Exception as e:
                 # Make sure the consolidated-thinking ticker doesn't outlive the turn on error/retry. Without this, an exception mid-stream leaves a dangling task that keeps re-emitting against a stale msg id.
                 if thinking.ticker_task is not None and not thinking.ticker_task.done():
diff --git a/backend/apps/agents/manager/run/client_pool.py b/backend/apps/agents/manager/run/client_pool.py
index 722cb30a..3cebc2cc 100644
--- a/backend/apps/agents/manager/run/client_pool.py
+++ b/backend/apps/agents/manager/run/client_pool.py
@@ -40,11 +40,16 @@ p_last_field_digests: Dict[str, Dict[str, str]] = {}
 def boot_fingerprint(options_kwargs: Dict, session: AgentSession) -> str:
     """Hash of every input the CLI subprocess freezes at boot. Includes the full mcp_servers config
     (so MCPActivate / model-env changes respawn), the composed system prompt (so per-turn selection
-    context respawns instead of silently not applying), branch, and the compaction cutoff (else a
-    live client would keep the untrimmed transcript forever)."""
+    context respawns instead of silently not applying), and the branch.
+
+    The compaction cutoff is deliberately NOT hashed. It only ever changes prompt_content (the
+    rebuilt history prefix), which is sent per query, never frozen at boot, and on the resume path
+    the CLI replays its own untrimmed transcript regardless. Every path that does rebuild history
+    (needs_fresh_session / needs_fork / fork) already forces a respawn through force_respawn. Hashing
+    it bought nothing and cost a full CLI respawn on EVERY turn once a session crossed
+    compact_threshold_pct, measured at +1.0s TTFT per turn."""
     frozen = {k: v for k, v in options_kwargs.items() if k not in P_NON_BOOT_KEYS}
     frozen["p_branch"] = session.active_branch_id
-    frozen["p_compacted_through"] = session.compacted_through_msg_id
     # Pool diagnostics (OPENSWARM_POOL_DIAG=1): on a respawn, names WHICH boot field drifted; the tool for debugging respawn churn (e.g. the thinking short/long-prompt flip) in the field.
     if os.environ.get("OPENSWARM_POOL_DIAG") == "1":
         digests = {k: hashlib.sha256(json.dumps(v, sort_keys=True, default=str).encode()).hexdigest()[:10] for k, v in frozen.items()}
diff --git a/backend/apps/agents/manager/session/SessionLifecycle.py b/backend/apps/agents/manager/session/SessionLifecycle.py
index dc85279e..5b958144 100644
--- a/backend/apps/agents/manager/session/SessionLifecycle.py
+++ b/backend/apps/agents/manager/session/SessionLifecycle.py
@@ -105,6 +105,7 @@ class SessionLifecycle(AgentManagerProtocol):
         self.tasks.pop(session_id, None)
         self.live_partial.pop(session_id, None)
         self.cancel_events.pop(session_id, None)
+        self.pending_messages.pop(session_id, None)
         view_builder_render_retry_counts.pop(session_id, None)
         view_builder_dirty_sessions.discard(session_id)
         dispose_client_soon(self.client_pool, session_id)
@@ -161,11 +162,10 @@ class SessionLifecycle(AgentManagerProtocol):
         """Return paginated, optionally filtered summaries of sessions, live ones included."""
         # A malformed file (a list, a bare string) would blow up data.get and 500 the whole endpoint.
         all_data = [pair for pair in load_all_session_data() if isinstance(pair[1], dict)]
-        # Restore deletes the file of every still-open session at boot, so the live ones exist ONLY in memory; without merging them your current chats simply are not in history.
-        on_disk = {data.get("id", sid) for sid, data in all_data}
+        # Live sessions usually also have a disk copy (boot restore keeps the file), but the disk copy lags the turn in flight; memory wins the dedupe because it is never staler.
+        in_memory = set(self.sessions.keys())
+        all_data = [pair for pair in all_data if pair[0] not in in_memory and pair[1].get("id") not in in_memory]
         for sid, session in self.sessions.items():
-            if sid in on_disk:
-                continue
             all_data.append((sid, {
                 "id": sid,
                 "name": session.name,
@@ -234,10 +234,10 @@ class SessionLifecycle(AgentManagerProtocol):
             return list(self.sessions.values())
         # Memory first, then promote on-disk sessions for this dashboard, but ONLY ones the dashboard's layout still has a card for. A session keeps its dashboard_id when its card is deleted, so promoting by tag alone resurrected deleted chats on every reopen; the layout's cards are the real source of truth for what's on the board. Imported sessions ARE in the layout, so they still surface, and this bounds the disk read to once per session per run, like resume_session.
         result = [s for s in self.sessions.values() if s.dashboard_id == dashboard_id]
-        seen = {s.id for s in result}
         card_ids = self.p_dashboard_card_ids(dashboard_id)
         for sid, data in load_all_session_data():
-            if sid in seen or sid not in card_ids:
+            # Skip anything already in memory (not just this dashboard's slice): promoting a stale disk copy over a live session would clobber its in-flight state.
+            if sid in self.sessions or sid not in card_ids:
                 continue
             if data.get("dashboard_id") != dashboard_id:
                 continue
diff --git a/backend/apps/agents/manager/session/SessionPersistence.py b/backend/apps/agents/manager/session/SessionPersistence.py
index 82f5b3cb..bfd0fe24 100644
--- a/backend/apps/agents/manager/session/SessionPersistence.py
+++ b/backend/apps/agents/manager/session/SessionPersistence.py
@@ -10,7 +10,6 @@ from typeguard import typechecked
 from backend.apps.agents.core.models import AgentSession
 from backend.apps.agents.core.ws_manager import ws_manager
 from backend.apps.agents.manager.session.session_store import (
-    delete_session_file,
     load_all_session_data,
     save_session,
 )
@@ -85,8 +84,8 @@ class SessionPersistence(AgentManagerProtocol):
                 session.status = "completed" if (p_last is not None and p_last.role == "assistant") else "stopped"
             session.pending_approvals = []
             apply_context_window(session)
+            # The file stays on disk: unlinking here made RAM the only copy, so any non-graceful shutdown (updater SIGKILL, crash) destroyed the chat.
             self.sessions[session.id] = session
-            delete_session_file(sid)
             restored += 1
         # One summary line, not one per session (startups with hundreds of sessions flooded the console).
         if restored:
diff --git a/backend/apps/agents/manager/session/distill_history.py b/backend/apps/agents/manager/session/distill_history.py
index f9227539..e12d2523 100644
--- a/backend/apps/agents/manager/session/distill_history.py
+++ b/backend/apps/agents/manager/session/distill_history.py
@@ -26,6 +26,9 @@ logger = logging.getLogger(__name__)
 
 DISTILL_ENABLED = os.environ.get("OPENSWARM_DISTILL_HISTORY", "1") != "0"
 MAX_DISTILL_INPUT_CHARS = 60_000
+# Prose is free to paraphrase, so the paths get re-attached deterministically instead. Capped so a hundred-file refactor can't reinflate what the distill just shrank.
+MAX_PINNED_PATHS = 40
+PATH_INPUT_KEYS = ("file_path", "notebook_path", "path")
 
 P_SYSTEM = (
     "You are a note-taker that condenses a conversation transcript into a briefing. "
@@ -61,6 +64,34 @@ def p_format_dropped(messages: List) -> str:
     return body[-MAX_DISTILL_INPUT_CHARS:] if len(body) > MAX_DISTILL_INPUT_CHARS else body
 
 
+@typechecked
+def touched_file_paths(messages: List) -> List[str]:
+    """Every file path the dropped span operated on, read off the tool_call inputs rather than
+    scraped out of prose. Order-preserving and deduped."""
+    seen: List[str] = []
+    for m in messages:
+        if m.role != "tool_call" or not isinstance(m.content, dict):
+            continue
+        tool_input = m.content.get("input")
+        if not isinstance(tool_input, dict):
+            continue
+        for key in PATH_INPUT_KEYS:
+            value = tool_input.get(key)
+            if isinstance(value, str) and value and value not in seen:
+                seen.append(value)
+    return seen
+
+
+@typechecked
+def pin_missing_paths(summary: str, messages: List) -> str:
+    """Re-attach any touched path the summary dropped. A briefing that says 'the twelve handler
+    files' is unusable to the next turn; the literal paths have to survive verbatim."""
+    missing = [p for p in touched_file_paths(messages) if p not in summary][:MAX_PINNED_PATHS]
+    if not missing:
+        return summary
+    return summary + "\n\nFiles touched earlier: " + ", ".join(missing)
+
+
 @typechecked
 async def distilled_history_summary(session: AgentSession, settings: AppSettings) -> str:
     """Cached aux summary of everything up to and including compacted_through_msg_id.
@@ -86,6 +117,7 @@ async def distilled_history_summary(session: AgentSession, settings: AppSettings
         return ""
     if not summary:
         return ""
+    summary = pin_missing_paths(summary, dropped)
     session.compacted_summary = summary
     session.compacted_summary_through = cutoff
     return summary
diff --git a/backend/apps/agents/manager/session/history_compaction.py b/backend/apps/agents/manager/session/history_compaction.py
index 5408119b..e1aed599 100644
--- a/backend/apps/agents/manager/session/history_compaction.py
+++ b/backend/apps/agents/manager/session/history_compaction.py
@@ -23,6 +23,10 @@ SESSION_RECAP_CLOSE = "</openswarm_session_recap>"
 RECAP_TOOL_INPUT_CAP = 200
 RECAP_TOOL_RESULT_CAP = 500
 
+# Inline budget for a spilled tool result, split head/tail. Same total as the old head-only 4KB, but a test summary or build verdict lives at the END of the output and head-only threw it away every time.
+SPILL_HEAD_CHARS = 2_500
+SPILL_TAIL_CHARS = 1_500
+
 
 @typechecked
 def wrap_platform_note(body: str) -> str:
@@ -191,8 +195,9 @@ def truncate_large_tool_result(content: object, session_id: str, msg_id: str, ma
 
     Storage is session-scoped under data/sessions/<session_id>/blobs/,
     never honors caller-supplied paths (defense against path
-    traversal). The inline replacement keeps the first 4KB so the
-    model retains some signal about what was returned.
+    traversal). The inline replacement middle-elides: head AND tail
+    survive, so a verdict printed at the end of a long output (test
+    summary, build result) still reaches the model.
     """
     if not isinstance(content, str):
         try:
@@ -214,10 +219,21 @@ def truncate_large_tool_result(content: object, session_id: str, msg_id: str, ma
     except Exception as e:
         logger.warning(f"Failed to spill tool result to {blob_path}: {e}")
         return content, None
-    head = strip_forged_sentinels(serialized[:4_000])
+    return build_elided_replacement(serialized, blob_path), blob_path
+
+
+@typechecked
+def build_elided_replacement(serialized: str, blob_path: str) -> str:
+    """Head + tail of an oversized body with an elision marker between them, then the recovery
+    note. Degrades to the plain body when it is too short to elide."""
+    head = strip_forged_sentinels(serialized[:SPILL_HEAD_CHARS])
     note = wrap_platform_note(
         f"Output truncated by OpenSwarm. Full output ({len(serialized)} chars) saved to "
         f"{blob_path}. Ask the user or run a follow-up tool call if you need the rest."
     )
-    replacement = f"{head}\n\n{note}"
-    return replacement, blob_path
+    dropped = len(serialized) - SPILL_HEAD_CHARS - SPILL_TAIL_CHARS
+    if dropped <= 0:
+        return f"{strip_forged_sentinels(serialized)}\n\n{note}"
+    tail = strip_forged_sentinels(serialized[-SPILL_TAIL_CHARS:])
+    marker = f"\n\n[... {dropped} chars elided by OpenSwarm; full output at {blob_path} ...]\n\n"
+    return f"{head}{marker}{tail}\n\n{note}"
diff --git a/backend/apps/agents/manager/streaming/handle_result_message.py b/backend/apps/agents/manager/streaming/handle_result_message.py
index b9f72259..e69b5d43 100644
--- a/backend/apps/agents/manager/streaming/handle_result_message.py
+++ b/backend/apps/agents/manager/streaming/handle_result_message.py
@@ -6,7 +6,7 @@ inline. resolved_model / api_type / global_settings are the loop's per-run confi
 
 import asyncio
 import logging
-from typing import Dict, Optional
+from typing import Dict, List, Optional
 
 from typeguard import typechecked
 
@@ -23,6 +23,35 @@ except ImportError:  # the SDK is optional at runtime (mock mode); keep this mod
 logger = logging.getLogger(__name__)
 
 
+class TurnResultError(Exception):
+    """The CLI's ResultMessage reported the turn ended in an error state (is_error, an
+    error_* subtype, or a max_tokens/refusal stop). Raised after the turn's token/cost
+    accounting so the run loop's existing error-card path owns the failure instead of the
+    turn being consumed as a silent success."""
+
+
+@typechecked
+def p_turn_result_error_text(message: ResultMessage, subtype: str, stop_reason: Optional[str]) -> str:
+    parts: List[str] = [str(x).strip() for x in (getattr(message, "errors", None) or []) if str(x).strip()]
+    if not parts:
+        result_text = getattr(message, "result", None)
+        if isinstance(result_text, str) and result_text.strip():
+            parts.append(result_text.strip())
+    denials = getattr(message, "permission_denials", None) or []
+    denied_tools = [str(d.get("tool_name")) for d in denials if isinstance(d, dict) and d.get("tool_name")]
+    if denied_tools:
+        parts.append("denied tools: " + ", ".join(denied_tools))
+    if stop_reason == "max_tokens":
+        headline = "The model hit its maximum output length before finishing"
+    elif stop_reason == "refusal":
+        headline = "The model refused to continue this turn"
+    else:
+        headline = "The agent runtime reported this turn failed"
+    label = subtype if subtype and subtype != "success" else (stop_reason or "unknown")
+    detail = "; ".join(parts)
+    return f"{headline} ({label})." + (f" {detail}" if detail else "")
+
+
 @typechecked
 async def handle_result_message(
     message: ResultMessage,
@@ -189,3 +218,13 @@ async def handle_result_message(
             })
         except Exception:
             logger.exception("Failed to emit agent:context_update")
+
+    # An error-shaped result used to be consumed as a normal end-of-turn: the user got preamble, then silence. Raise AFTER the accounting above so the failure surfaces as a real error card.
+    p_subtype = str(getattr(message, "subtype", "") or "")
+    p_stop_reason = getattr(message, "stop_reason", None)
+    if (
+        bool(getattr(message, "is_error", False))
+        or p_subtype.startswith("error")
+        or p_stop_reason in ("max_tokens", "refusal")
+    ):
+        raise TurnResultError(p_turn_result_error_text(message, p_subtype, p_stop_reason))
diff --git a/backend/apps/agents/tools/browser_http.py b/backend/apps/agents/tools/browser_http.py
new file mode 100644
index 00000000..e201dc2d
--- /dev/null
+++ b/backend/apps/agents/tools/browser_http.py
@@ -0,0 +1,116 @@
+"""One browser-shaped HTTP request, shared by every keyless web rung.
+
+Search frontends gate on the TLS/JA3 fingerprint of the CLIENT, not on the
+headers or the verb. Measured over 8 interleaved randomised rounds against
+DuckDuckGo from one machine: plain httpx POST to the html endpoint 4/8, plain
+httpx GET to the lite endpoint 4/8 (so switching verb or endpoint changes
+nothing), and curl_cffi's Chrome impersonation 8/8 with the same headers, verb
+and URL. That is the whole difference between "search sometimes works" and
+"search works", so we impersonate whenever curl_cffi imports.
+
+If it doesn't import (a packaging regression), we degrade to httpx with a full
+Chrome header set rather than failing: half a search beats no search.
+
+This does NOT validate the target host, so it is only for the FIXED hosts we
+choose ourselves. User- or model-supplied URLs must go through
+`ssrf_guard.safe_fetch`, which re-checks every redirect hop.
+"""
+
+from typing import Dict, Optional
+
+import httpx
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+CHROME_UA = (
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 "
+    "(KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
+)
+
+# A real navigation sends all of these; httpx sends almost none of them by default.
+BROWSER_HEADERS: Dict[str, str] = {
+    "User-Agent": CHROME_UA,
+    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
+    "Accept-Language": "en-US,en;q=0.9",
+    "Sec-Ch-Ua": '"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"',
+    "Sec-Ch-Ua-Mobile": "?0",
+    "Sec-Ch-Ua-Platform": '"macOS"',
+    "Sec-Fetch-Dest": "document",
+    "Sec-Fetch-Mode": "navigate",
+    "Sec-Fetch-Site": "none",
+    "Sec-Fetch-User": "?1",
+    "Upgrade-Insecure-Requests": "1",
+}
+
+P_IMPERSONATE_PROFILE = "chrome"
+
+
+class HttpReply(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    status: int
+    text: str
+    content: bytes
+    content_type: str
+    url: str
+
+
+@typechecked
+def impersonation_available() -> bool:
+    """Whether the TLS-impersonating client is installed in this environment."""
+    try:
+        import curl_cffi.requests  # noqa: F401
+    except Exception:
+        return False
+    return True
+
+
+@typechecked
+async def p_impersonated(
+    url: str, method: str, params: Optional[Dict], headers: Dict[str, str],
+    timeout: float, follow_redirects: bool,
+) -> HttpReply:
+    from curl_cffi.requests import AsyncSession
+    async with AsyncSession() as session:
+        resp = await session.request(
+            method, url, params=params, headers=headers, timeout=timeout,
+            impersonate=P_IMPERSONATE_PROFILE, allow_redirects=follow_redirects,
+        )
+        return HttpReply(
+            status=resp.status_code, text=resp.text, content=resp.content,
+            content_type=resp.headers.get("content-type", ""), url=str(resp.url),
+        )
+
+
+@typechecked
+async def p_plain(
+    url: str, method: str, params: Optional[Dict], headers: Dict[str, str],
+    timeout: float, follow_redirects: bool,
+) -> HttpReply:
+    async with httpx.AsyncClient(
+        timeout=timeout, follow_redirects=follow_redirects, headers=headers,
+    ) as client:
+        resp = await client.request(method, url, params=params)
+        return HttpReply(
+            status=resp.status_code, text=resp.text, content=resp.content,
+            content_type=resp.headers.get("content-type", ""), url=str(resp.url),
+        )
+
+
+@typechecked
+async def browser_request(
+    url: str,
+    *,
+    method: str = "GET",
+    params: Optional[Dict] = None,
+    headers: Optional[Dict[str, str]] = None,
+    timeout: float = 10.0,
+    follow_redirects: bool = True,
+) -> HttpReply:
+    """Fetch `url` looking like Chrome. Fixed hosts only; see the module docstring."""
+    merged = dict(BROWSER_HEADERS)
+    if headers:
+        merged.update(headers)
+    if impersonation_available():
+        return await p_impersonated(url, method, params, merged, timeout, follow_redirects)
+    return await p_plain(url, method, params, merged, timeout, follow_redirects)
diff --git a/backend/apps/agents/tools/fetch/bot_wall.py b/backend/apps/agents/tools/fetch/bot_wall.py
new file mode 100644
index 00000000..15d0ba7f
--- /dev/null
+++ b/backend/apps/agents/tools/fetch/bot_wall.py
@@ -0,0 +1,50 @@
+"""Tell a bot wall apart from a page, so the cascade keeps going instead of
+handing the model a challenge screen and calling it content.
+
+An HTTP error is easy: the fetch tier already falls through on any 4xx/5xx. The
+gap was the wall that answers 200. Measured live, Reddit serves "Reddit -
+Please wait for verification" with a 200, and Cloudflare's interstitial is a
+normal 200 whose whole body is "Enable JavaScript and cookies to continue".
+Those are exactly the pages our own offscreen Chromium CAN read, because it
+runs a real browser on the user's own residential IP, so treating them as a
+successful fetch spends the one tier that would have worked.
+
+Both conditions must hold: a challenge phrase AND a page too small to be an
+article. A news story about Cloudflare outages contains the phrase and must not
+be thrown away for it.
+"""
+
+import re
+from typing import Tuple
+
+from typeguard import typechecked
+
+# A wall is a stub page. Real articles that merely mention these run long.
+MAX_WALL_CHARS = 2000
+
+P_WALL_MARKERS: Tuple[str, ...] = (
+    "just a moment...",
+    "enable javascript and cookies to continue",
+    "checking your browser before accessing",
+    "verifying you are human",
+    "please wait for verification",
+    "attention required! | cloudflare",
+    "you need to enable javascript to run this app",
+    "please enable js and disable any ad blocker",
+    "sorry, you have been blocked",
+    "why have i been blocked",
+    "performed triggered the security solution",
+    "confirm you are a human",
+    "press & hold",
+)
+
+P_SPACE_RE = re.compile(r"\s+")
+
+
+@typechecked
+def looks_like_bot_wall(text: str) -> bool:
+    """True when this 200 is a challenge screen rather than the page."""
+    if len(text) > MAX_WALL_CHARS:
+        return False
+    # Rendered walls arrive line-wrapped ("confirm you are\na human"), so match on flattened text.
+    return any(marker in P_SPACE_RE.sub(" ", text.lower()) for marker in P_WALL_MARKERS)
diff --git a/backend/apps/agents/tools/fetch/html_to_text.py b/backend/apps/agents/tools/fetch/html_to_text.py
new file mode 100644
index 00000000..6e4b9b28
--- /dev/null
+++ b/backend/apps/agents/tools/fetch/html_to_text.py
@@ -0,0 +1,86 @@
+"""Turn raw HTML into the page's main content, dropping nav / ads / footers.
+
+Measured side by side on 15 cached real pages (same bytes into every variant),
+scored on whether the article survived and whether the chrome did:
+
+    variant            content kept   boilerplate dropped
+    regex tag-strip        92%              20%
+    favor_precision        92%              90%   <- what we shipped
+    this ladder            92%              88%*
+
+The headline numbers barely move because the averages hide the failures, and
+the failures are the whole point. `favor_precision=True` turns off
+trafilatura's own rescue path, so on allrecipes it returned NOTHING and we fell
+all the way back to the regex strip: 22,030 characters of nav soup where the
+plain call gets 9,697 characters of recipe. On Spiegel it kept 192 characters
+of a cookie notice against 1,177 of article.
+
+Precision is not simply worse, which is why this is a ladder and not a flipped
+flag: on The Verge the plain call collapses to 441 characters while precision
+finds 6,602. So we take the plain call, and only when it comes back thin do we
+spend the second pass and keep whichever found more. trafilatura's own
+`baseline` (which reads JSON-LD articleBody and <article>) is the floor under
+that, and the regex strip is the floor under everything.
+
+(*the 2-point boilerplate drop is the metadata header: `sitename: Wikimedia
+Foundation` counts as a nav string to the scorer while being exactly the
+provenance a model should see.)
+
+`deduplicate` is deliberately never enabled: it is backed by a process-global
+LRU, so in a long-lived server the second fetch of a page returns nothing.
+"""
+
+from typing import Optional
+
+from typeguard import typechecked
+
+# Below this an extraction has clearly missed the article, so the next rung is worth its cost.
+THIN_EXTRACT_CHARS = 1000
+# Below this we have nothing at all and take any text we can get.
+MIN_EXTRACT_CHARS = 200
+
+
+@typechecked
+def p_trafilatura_extract(raw_html: str, *, favor_precision: bool) -> str:
+    try:
+        import trafilatura  # type: ignore
+        return trafilatura.extract(
+            raw_html, include_comments=False, include_tables=True,
+            output_format="markdown", with_metadata=True,
+            favor_precision=favor_precision,
+        ) or ""
+    except Exception:
+        return ""
+
+
+@typechecked
+def p_trafilatura_floor(raw_html: str, fn_name: str) -> str:
+    try:
+        import trafilatura  # type: ignore
+        out = getattr(trafilatura, fn_name)(raw_html)
+    except Exception:
+        return ""
+    # `baseline` hands back (doc, text, length); `html2txt` hands back the text.
+    body: Optional[str] = out[1] if isinstance(out, tuple) else out
+    return body or ""
+
+
+@typechecked
+def html_to_text(raw_html: str) -> str:
+    """The page's main content as markdown, with a title/url/date header."""
+    from backend.apps.agents.tools.search.search_ddg import strip_html
+
+    best = p_trafilatura_extract(raw_html, favor_precision=False)
+    if len(best) < THIN_EXTRACT_CHARS:
+        alt = p_trafilatura_extract(raw_html, favor_precision=True)
+        if len(alt) > len(best):
+            best = alt
+    if len(best) < THIN_EXTRACT_CHARS:
+        alt = p_trafilatura_floor(raw_html, "baseline")
+        if len(alt) > len(best):
+            best = alt
+    if len(best) < MIN_EXTRACT_CHARS:
+        alt = p_trafilatura_floor(raw_html, "html2txt")
+        if len(alt) > len(best):
+            best = alt
+    return best or strip_html(raw_html)
diff --git a/backend/apps/agents/tools/fetch/page_text.py b/backend/apps/agents/tools/fetch/page_text.py
new file mode 100644
index 00000000..dbcd5a04
--- /dev/null
+++ b/backend/apps/agents/tools/fetch/page_text.py
@@ -0,0 +1,96 @@
+"""Turn a fetched response body into text a model can actually read.
+
+WebFetch used to hand anything non-HTML straight to the model as `resp.text`,
+so fetching a PDF posted ~173KB-2MB of `%PDF-1.5` binary into the context
+window: pure cost, zero information, and it pushed real content out. PDFs now
+get their text layer extracted, and anything else that isn't textual is refused
+with a message that says what it was instead of dumping its bytes."""
+
+import io
+from typing import Optional
+
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+# A 2.2MB, 15-page paper extracts to ~40K chars in 0.8s; this bounds a pathological book-sized PDF.
+MAX_PDF_PAGES = 100
+P_PDF_MAGIC = b"%PDF"
+P_TEXTUAL_HINTS = ("text/", "json", "xml", "javascript", "csv", "yaml", "markdown")
+
+
+class PageText(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    text: str
+    kind: str
+
+
+@typechecked
+def looks_like_pdf(content_type: str, content: bytes) -> bool:
+    """Servers mislabel PDFs constantly, so the magic bytes get the final say."""
+    return "pdf" in content_type.lower() or content[:4].startswith(P_PDF_MAGIC)
+
+
+@typechecked
+def p_is_textual(content_type: str, content: bytes) -> bool:
+    if any(hint in content_type.lower() for hint in P_TEXTUAL_HINTS):
+        return True
+    sample = content[:4096]
+    if not sample:
+        return True
+    if b"\x00" in sample:
+        return False
+    printable = sum(1 for byte in sample if byte >= 32 or byte in (9, 10, 13))
+    return printable / len(sample) > 0.9
+
+
+@typechecked
+def p_describe_size(content: bytes) -> str:
+    kb = len(content) / 1024
+    return f"{kb:.0f} KB" if kb < 1024 else f"{kb / 1024:.1f} MB"
+
+
+@typechecked
+def extract_pdf_text(content: bytes) -> Optional[str]:
+    """The PDF's text layer, or None when there isn't one we can read."""
+    try:
+        from pypdf import PdfReader
+    except Exception:
+        return None
+    try:
+        reader = PdfReader(io.BytesIO(content))
+        pages = reader.pages[:MAX_PDF_PAGES]
+        chunks = [(page.extract_text() or "").strip() for page in pages]
+    except Exception:
+        return None
+    body = "\n\n".join(chunk for chunk in chunks if chunk).strip()
+    if not body:
+        return None
+    if len(reader.pages) > MAX_PDF_PAGES:
+        body += f"\n\n... (first {MAX_PDF_PAGES} of {len(reader.pages)} pages)"
+    return body
+
+
+@typechecked
+def body_to_text(content_type: str, content: bytes, raw_text: str) -> PageText:
+    """Readable text plus what it came from; never raw binary."""
+    if looks_like_pdf(content_type, content):
+        extracted = extract_pdf_text(content)
+        if extracted:
+            return PageText(text=extracted, kind="pdf")
+        return PageText(
+            text=(
+                f"This URL is a PDF ({p_describe_size(content)}) with no extractable text layer; "
+                "it is probably a scan or is encrypted. Nothing was read from it."
+            ),
+            kind="pdf_unreadable",
+        )
+    if p_is_textual(content_type, content):
+        return PageText(text=raw_text, kind="text")
+    return PageText(
+        text=(
+            f"This URL is not a readable document: {content_type or 'unknown type'}, "
+            f"{p_describe_size(content)} of binary data. Nothing was read from it."
+        ),
+        kind="binary",
+    )
diff --git a/backend/apps/agents/tools/fetch/wayback.py b/backend/apps/agents/tools/fetch/wayback.py
new file mode 100644
index 00000000..4f843d4d
--- /dev/null
+++ b/backend/apps/agents/tools/fetch/wayback.py
@@ -0,0 +1,64 @@
+"""Wayback Machine fallback for URLs the live web won't hand over.
+
+When a page is gone (404, domain dead, article pulled) or sits behind a wall
+that no client-side trick beats, the archive usually still has the REAL text,
+which beats a grounded model's summary of a page it also couldn't read.
+
+Uses `web.archive.org/web/2id_/<url>`, which redirects to the closest snapshot
+and serves the ORIGINAL bytes. Without the `id_` the archive injects its own
+calendar toolbar into the page, and on a Reddit snapshot that toolbar was all
+the text there was: we returned "Jun JUL Aug 30 2025 2026 2027 success fail
+About this capture" as if it were the article, and it cleared the substance
+floor because it is made of real words. `id_` also keeps the page's own URL in
+the extracted metadata instead of stamping it `hostname: archive.org`.
+
+The documented `archive.org/wayback/available` JSON API is NOT used: it is
+aggressively throttled and answered 429 on every probe from this machine, while
+the redirect path answered in 0.5-3s.
+"""
+
+import re
+from typing import Optional
+from urllib.parse import urlparse
+
+from typeguard import typechecked
+
+from backend.apps.agents.tools.browser_http import browser_request
+from backend.apps.agents.tools.fetch.html_to_text import html_to_text
+
+P_WAYBACK_LATEST = "https://web.archive.org/web/2id_/"
+P_ALLOWED_HOST = "web.archive.org"
+P_TIMEOUT = 10.0
+# Below this the "snapshot" is a stub or an archived error page, not the article.
+P_MIN_SUBSTANCE_CHARS = 200
+P_SNAPSHOT_RE = re.compile(r"/web/(\d{4})(\d{2})(\d{2})\d*(?:id_)?/")
+# What the archive shows when the crawler was bounced to a login page: it is a 200 with real words, so only the wording gives it away.
+P_INTERSTITIAL_MARKER = "response at crawl time"
+
+
+@typechecked
+def snapshot_date(archived_url: str) -> Optional[str]:
+    """The snapshot's date, so the model knows how stale the text is."""
+    match = P_SNAPSHOT_RE.search(archived_url)
+    if not match:
+        return None
+    return f"{match.group(1)}-{match.group(2)}-{match.group(3)}"
+
+
+@typechecked
+async def fetch_wayback(url: str) -> Optional[str]:
+    """The archived page text, or None when there is no usable snapshot."""
+    reply = await browser_request(P_WAYBACK_LATEST + url, timeout=P_TIMEOUT)
+    # We hand the archive a caller-supplied URL, so confirm we actually ended up on the archive and not somewhere it redirected us.
+    if urlparse(reply.url).hostname != P_ALLOWED_HOST:
+        return None
+    if reply.status != 200:
+        return None
+    text = html_to_text(reply.text).strip()
+    if len(text) < P_MIN_SUBSTANCE_CHARS or P_INTERSTITIAL_MARKER in text:
+        return None
+    taken = snapshot_date(reply.url)
+    header = f"Archived copy of {url}"
+    header += f" (Wayback Machine snapshot from {taken}); the live page could not be read." if taken \
+        else " (Wayback Machine); the live page could not be read."
+    return f"{header}\n\n{text}"
diff --git a/backend/apps/agents/tools/search_ddg.py b/backend/apps/agents/tools/search/search_ddg.py
similarity index 59%
rename from backend/apps/agents/tools/search_ddg.py
rename to backend/apps/agents/tools/search/search_ddg.py
index ba478251..630d32d1 100644
--- a/backend/apps/agents/tools/search_ddg.py
+++ b/backend/apps/agents/tools/search/search_ddg.py
@@ -1,32 +1,33 @@
 """DuckDuckGo web search: html endpoint primary, lite endpoint fallback.
 
 The html endpoint is the richer parse; lite (see search_ddg_lite) covers the two
-ways html dies: a 202 throttle and silent markup drift. Only both endpoints
-throttling raises DDGRateLimited, so free search no longer has a single point
-of failure (the outage class that stranded subscription-only users on
-"No search backend is configured")."""
+ways html dies: the 202 bot challenge and silent markup drift. Only both
+endpoints challenging raises DDGRateLimited, so free search no longer has a
+single point of failure (the outage class that stranded subscription-only users
+on "No search backend is configured").
+
+Both rungs go out through `browser_http`, whose Chrome TLS fingerprint is what
+actually decides whether DuckDuckGo answers; a plain httpx client scored 4/8 on
+the same queries this one scored 8/8 on."""
 
 import html
 import re
 
-import httpx
-
-from backend.apps.agents.tools.search_ddg_lite import search_ddg_lite
+from backend.apps.agents.tools.browser_http import CHROME_UA
+from backend.apps.agents.tools.browser_http import browser_request
+from backend.apps.agents.tools.search.search_ddg_lite import search_ddg_lite
 
 HTTP_TIMEOUT = 30
-USER_AGENT = (
-    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) "
-    "AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
-)
+USER_AGENT = CHROME_UA
 
 
 class DDGRateLimited(Exception):
-    """Both DuckDuckGo endpoints answered with the throttle challenge (HTTP 202).
+    """Every DuckDuckGo frontend answered with the bot challenge (HTTP 202).
 
-    Distinct from 'genuinely zero hits' so the caller can fail over to another
-    backend instead of reporting an empty search to the user. The throttle is
-    per-IP and burst-triggered; once BOTH html and lite serve it, the only cure
-    is a different backend or waiting it out."""
+    Named for history; this is an anti-automation challenge keyed on the
+    client's fingerprint, NOT a per-IP rate limit. Distinct from 'genuinely
+    zero hits' so the caller can fail over to another backend instead of
+    reporting an empty search to the user."""
 
 
 def strip_html(raw_html: str) -> str:
@@ -41,24 +42,28 @@ def strip_html(raw_html: str) -> str:
 
 async def search_ddg(query: str, num_results: int) -> str:
     """Query DuckDuckGo's html endpoint and parse results; lite is the free fallback."""
-    async with httpx.AsyncClient(
-        timeout=HTTP_TIMEOUT,
-        follow_redirects=True,
-        headers={"User-Agent": USER_AGENT},
-    ) as client:
-        resp = await client.post(
-            "https://html.duckduckgo.com/html/",
-            data={"q": query},
-        )
-        # DDG serves its throttle challenge as 202 (a ~14KB no-results page), which is a 2xx so raise_for_status() sails right past it. Before declaring rate-limited, try the lite frontend; only when BOTH throttle is free search actually dead.
-        if resp.status_code == 202:
+    reply = await browser_request(
+        "https://html.duckduckgo.com/html/", params={"q": query}, timeout=HTTP_TIMEOUT,
+    )
+    # DDG serves its bot challenge as 202 (a ~14KB no-results page), which is a 2xx so a status check sails right past it. Before giving up, try the lite frontend; only when BOTH challenge is free DDG actually dead.
+    if reply.status == 202:
+        lite = await search_ddg_lite(query, num_results)
+        if lite is None:
+            raise DDGRateLimited(query)
+        return lite
+    # A hard block (403 is what html escalates to after the 202s) used to skip lite entirely, so a whole second frontend went untried; measured 7 times in one 44-query round.
+    if reply.status >= 400:
+        try:
             lite = await search_ddg_lite(query, num_results)
-            if lite is None:
-                raise DDGRateLimited(query)
+        except Exception as exc:
+            raise RuntimeError(f"DuckDuckGo html returned HTTP {reply.status}; lite: {exc}") from None
+        if lite is None:
+            raise DDGRateLimited(query)
+        if lite:
             return lite
-        resp.raise_for_status()
+        raise RuntimeError(f"DuckDuckGo html returned HTTP {reply.status}")
 
-    body = resp.text
+    body = reply.text
 
     result_blocks = re.findall(
         r'<div[^>]*class="[^"]*result[^"]*"[^>]*>(.*?)</div>\s*(?=<div[^>]*class="[^"]*result|$)',
diff --git a/backend/apps/agents/tools/search_ddg_lite.py b/backend/apps/agents/tools/search/search_ddg_lite.py
similarity index 57%
rename from backend/apps/agents/tools/search_ddg_lite.py
rename to backend/apps/agents/tools/search/search_ddg_lite.py
index fe5ac608..77eae343 100644
--- a/backend/apps/agents/tools/search_ddg_lite.py
+++ b/backend/apps/agents/tools/search/search_ddg_lite.py
@@ -1,23 +1,22 @@
-"""DuckDuckGo lite-endpoint search: the free fallback when html.duckduckgo.com
-throttles (HTTP 202) or its markup drifts. lite.duckduckgo.com is a separate
-frontend with simpler, stabler HTML and direct result URLs (no uddg redirect).
+"""DuckDuckGo lite-endpoint search: the fallback when html.duckduckgo.com
+serves its bot challenge (HTTP 202) or its markup drifts. lite.duckduckgo.com
+is a separate frontend with simpler, stabler HTML and direct result URLs (no
+uddg redirect).
 
-Returns None on a throttle (caller decides whether that means rate-limited
-overall) and a formatted results string (possibly empty) on success."""
+Returns None on a challenge (caller decides whether that means every DDG
+frontend is closed) and a formatted results string (possibly empty) on
+success."""
 
 import html
 import re
 from typing import List, Optional
 
-import httpx
 from typeguard import typechecked
 
+from backend.apps.agents.tools.browser_http import browser_request
+
 P_LITE_URL = "https://lite.duckduckgo.com/lite/"
 P_TIMEOUT = 12.0
-P_USER_AGENT = (
-    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 "
-    "(KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
-)
 P_TAG_RE = re.compile(r"<[^>]+>")
 # Lite uses single-quoted class attrs today; accept either quote style so a cosmetic flip doesn't kill the parser.
 P_LINK_RE = re.compile(
@@ -52,14 +51,10 @@ def parse_lite_results(body: str, num_results: int) -> str:
 
 @typechecked
 async def search_ddg_lite(query: str, num_results: int) -> Optional[str]:
-    """None = throttled (202), string = parsed results (may be empty on no hits)."""
-    async with httpx.AsyncClient(
-        timeout=P_TIMEOUT,
-        follow_redirects=True,
-        headers={"User-Agent": P_USER_AGENT},
-    ) as client:
-        resp = await client.post(P_LITE_URL, data={"q": query})
-        if resp.status_code == 202:
-            return None
-        resp.raise_for_status()
-    return parse_lite_results(resp.text, num_results)
+    """None = bot challenge (202), string = parsed results (may be empty on no hits)."""
+    reply = await browser_request(P_LITE_URL, params={"q": query}, timeout=P_TIMEOUT)
+    if reply.status == 202:
+        return None
+    if reply.status >= 400:
+        raise RuntimeError(f"DuckDuckGo lite returned HTTP {reply.status}")
+    return parse_lite_results(reply.text, num_results)
diff --git a/backend/apps/agents/tools/search/search_startpage.py b/backend/apps/agents/tools/search/search_startpage.py
new file mode 100644
index 00000000..30dd0465
--- /dev/null
+++ b/backend/apps/agents/tools/search/search_startpage.py
@@ -0,0 +1,98 @@
+"""Startpage search: the second independent engine behind DuckDuckGo.
+
+DuckDuckGo is one operator, so its bot challenge is one point of failure for
+every keyless user. Startpage serves Google's index and answered 8/8 on the
+same machine and rounds where DuckDuckGo's shipped client shape answered 4/8,
+so it is a genuine second opinion rather than a retry.
+
+It must be a POST: a GET to /sp/search is answered with an Anubis
+proof-of-work interstitial (measured, ~10KB and zero results), while the POST
+returns the real result page. Parsing is anchored on `result-link` /
+`gl-title-link` and the `description` paragraph, never on the emotion CSS
+hashes in the same class attributes, which change build to build.
+
+Answers a `StartpageAnswer` rather than a string because "closed" and
+"genuinely no hits" look identical on the wire (both are a 200 with no result
+anchors) and the caller has to act on them differently: a refusal is a failed
+tier that should count against the engine, an empty result set is the honest
+answer to a nonsense query. Startpage names the second case itself, in an
+"Uh-oh, there are no results for this search" page."""
+
+import html
+import re
+from typing import List
+
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from backend.apps.agents.tools.browser_http import browser_request
+
+P_SEARCH_URL = "https://www.startpage.com/sp/search"
+P_TIMEOUT = 12.0
+
+P_ANCHOR_RE = re.compile(
+    r"<a\b([^>]*(?:result-link|gl-title-link)[^>]*)>(.*?)</a>", flags=re.DOTALL,
+)
+P_HREF_RE = re.compile(r'href="([^"]+)"')
+P_TITLE_RE = re.compile(r"<h2[^>]*>(.*?)</h2>", flags=re.DOTALL)
+P_DESC_RE = re.compile(
+    r'<p[^>]*class="[^"]*\bdescription\b[^"]*"[^>]*>(.*?)</p>', flags=re.DOTALL,
+)
+# Startpage inlines a <style> block inside each result anchor, so tag-stripping alone would emit CSS as the title.
+P_NOISE_RE = re.compile(r"<(script|style)\b[^>]*>.*?</\1>", flags=re.DOTALL | re.IGNORECASE)
+P_TAG_RE = re.compile(r"<[^>]+>")
+P_NO_RESULTS_MARKER = "there are no results for this search"
+
+
+class StartpageAnswer(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    results: str = ""
+    # Challenge, error, or markup we no longer recognise: Startpage did not answer the question.
+    refused: bool = False
+
+
+@typechecked
+def p_strip(raw: str) -> str:
+    return re.sub(r"\s+", " ", html.unescape(P_TAG_RE.sub("", P_NOISE_RE.sub("", raw)))).strip()
+
+
+@typechecked
+def parse_startpage_results(body: str, num_results: int) -> str:
+    """Format Startpage's result rows; a snippet is only paired when it sits INSIDE its own result block."""
+    anchors = list(P_ANCHOR_RE.finditer(body))
+    entries: List[str] = []
+    for i, match in enumerate(anchors[:num_results]):
+        href = P_HREF_RE.search(match.group(1))
+        if not href:
+            continue
+        title_match = P_TITLE_RE.search(match.group(2))
+        title = p_strip(title_match.group(1)) if title_match else p_strip(match.group(2))
+        if not title:
+            continue
+        entry = f"[{len(entries) + 1}] {title}\n    {html.unescape(href.group(1))}"
+        block_end = anchors[i + 1].start() if i + 1 < len(anchors) else len(body)
+        desc = P_DESC_RE.search(body, match.end(), block_end)
+        if desc:
+            snippet = p_strip(desc.group(1))
+            if snippet:
+                entry += f"\n    {snippet}"
+        entries.append(entry)
+    return "\n\n".join(entries)
+
+
+@typechecked
+async def search_startpage(query: str, num_results: int) -> StartpageAnswer:
+    """Startpage's answer: results, an honest nothing, or a refusal."""
+    reply = await browser_request(
+        P_SEARCH_URL, method="POST", params={"query": query, "cat": "web"}, timeout=P_TIMEOUT,
+    )
+    if reply.status != 200:
+        return StartpageAnswer(refused=True)
+    results = parse_startpage_results(reply.text, num_results)
+    if results:
+        return StartpageAnswer(results=results)
+    # Measured once in 14 tight-loop requests: Startpage serves its own no-results page for a query that answered 10 results a second later, so an empty page is only trustworthy when it says so.
+    if P_NO_RESULTS_MARKER in reply.text:
+        return StartpageAnswer()
+    return StartpageAnswer(refused=True)
diff --git a/backend/apps/agents/tools/ssrf_guard.py b/backend/apps/agents/tools/ssrf_guard.py
index 1a9621e1..d5272fce 100644
--- a/backend/apps/agents/tools/ssrf_guard.py
+++ b/backend/apps/agents/tools/ssrf_guard.py
@@ -27,6 +27,19 @@ class SSRFBlocked(Exception):
     """A fetch was refused because it targets a forbidden IP range."""
 
 
+class DomainUnreachable(SSRFBlocked):
+    """The host has no DNS records at all: dead domain, typo, or no network.
+
+    A subclass so every existing `except SSRFBlocked` still fails closed, but
+    callers that care can tell "we refused this" apart from "this doesn't
+    exist", which are opposite messages to show a user and have opposite
+    fallbacks (nothing vs the archive)."""
+
+
+# A page we will truncate to ~250KB anyway; without this a link to a disk image buffers the whole thing into RAM.
+MAX_FETCH_BYTES = 10 * 1024 * 1024
+
+
 P_BLOCKED_V4_NETS = [
     ipaddress.ip_network("10.0.0.0/8"),
     ipaddress.ip_network("172.16.0.0/12"),
@@ -52,7 +65,7 @@ async def p_resolve_host_async(host: str) -> list[str]:
     try:
         infos = await loop.getaddrinfo(host, None)
     except OSError as e:
-        raise SSRFBlocked(f"DNS resolution failed for {host}: {e}") from e
+        raise DomainUnreachable(f"{host} could not be resolved (dead domain, typo, or no network): {e}") from e
     return list({info[4][0] for info in infos})
 
 
@@ -101,13 +114,40 @@ async def assert_safe_url(url: str) -> str:
 
     resolved = await p_resolve_host_async(host)
     if not resolved:
-        raise SSRFBlocked(f"No DNS records for {host}.")
+        raise DomainUnreachable(f"No DNS records for {host}.")
     for ip in resolved:
         if p_is_forbidden_ip(ip):
             raise SSRFBlocked(f"Host {host} resolves to forbidden IP {ip}.")
     return url
 
 
+async def p_read_capped(client: httpx.AsyncClient, request: httpx.Request,
+                        max_bytes: int) -> httpx.Response:
+    """Send `request` and buffer at most `max_bytes` of the body.
+
+    Returns a detached Response so callers keep the plain `.content` / `.text`
+    interface. Content-Encoding and Content-Length are dropped because
+    `aiter_bytes` already yields decoded bytes and the count may be short.
+    """
+    streamed = await client.send(request, stream=True)
+    chunks: list[bytes] = []
+    total = 0
+    try:
+        async for chunk in streamed.aiter_bytes():
+            chunks.append(chunk)
+            total += len(chunk)
+            if total >= max_bytes:
+                break
+    finally:
+        await streamed.aclose()
+    headers = httpx.Headers(
+        [(k, v) for k, v in streamed.headers.multi_items()
+         if k.lower() not in ("content-encoding", "content-length")]
+    )
+    return httpx.Response(status_code=streamed.status_code, headers=headers,
+                          content=b"".join(chunks)[:max_bytes], request=request)
+
+
 async def safe_fetch(
     url: str,
     *,
@@ -117,6 +157,7 @@ async def safe_fetch(
     max_redirects: int = 5,
     json_body: dict | None = None,
     data: dict | None = None,
+    max_bytes: int = MAX_FETCH_BYTES,
 ) -> httpx.Response:
     """Fetch with per-redirect SSRF re-validation.
 
@@ -126,15 +167,14 @@ async def safe_fetch(
     current_url = await assert_safe_url(url)
     async with httpx.AsyncClient(timeout=timeout, follow_redirects=False, headers=headers or {}) as client:
         for _ in range(max_redirects + 1):
+            req_kwargs: dict = {}
             if method.upper() == "POST":
-                req_kwargs = {}
                 if json_body is not None:
                     req_kwargs["json"] = json_body
                 if data is not None:
                     req_kwargs["data"] = data
-                resp = await client.post(current_url, **req_kwargs)
-            else:
-                resp = await client.get(current_url)
+            request = client.build_request(method.upper(), current_url, **req_kwargs)
+            resp = await p_read_capped(client, request, max_bytes)
             if not (300 <= resp.status_code < 400):
                 return resp
             location = resp.headers.get("location")
diff --git a/backend/apps/agents/tools/web.py b/backend/apps/agents/tools/web.py
index ea637e99..b963d14b 100644
--- a/backend/apps/agents/tools/web.py
+++ b/backend/apps/agents/tools/web.py
@@ -9,14 +9,15 @@ import httpx
 from typeguard import typechecked
 
 from backend.apps.agents.tools.base import BaseTool, ToolContext
-from backend.apps.agents.tools.search_ddg import (
+from backend.apps.agents.tools.search.search_ddg import (
     DDGRateLimited,
     HTTP_TIMEOUT,
     USER_AGENT,
-    strip_html,
 )
-from backend.apps.agents.tools.search_ddg import search_ddg as run_ddg_search
-from backend.apps.agents.tools.ssrf_guard import SSRFBlocked, safe_fetch
+from backend.apps.agents.tools.fetch.html_to_text import html_to_text
+from backend.apps.agents.tools.fetch.page_text import PageText, body_to_text, looks_like_pdf
+from backend.apps.agents.tools.search.search_ddg import search_ddg as run_ddg_search
+from backend.apps.agents.tools.ssrf_guard import DomainUnreachable, SSRFBlocked, safe_fetch
 
 P_MAX_OUTPUT_BYTES = 250 * 1024  # ~250 KB covers ~95% of articles/wikis/docs.
 
@@ -126,9 +127,11 @@ class WebSearchTool(BaseTool):
                 return [{"type": "text", "text": f"No search results found for: {query}"}]
             return [{"type": "text", "text": results}]
         except DDGRateLimited:
+            # "Wait and retry" was a dead end: the 202 is an anti-automation challenge on the client, not a cooldown, so an immediate retry gets the same answer.
             return [{"type": "text", "text": (
-                "DuckDuckGo is rate-limiting this network right now (HTTP 202). "
-                "Wait a bit and retry, or use a different search source."
+                "DuckDuckGo answered its bot challenge (HTTP 202) instead of results, on both "
+                "its html and lite frontends. Retrying the same query will not clear it; use "
+                "another search source."
             )}]
         except Exception as exc:
             return [{"type": "text", "text": f"Web search error: {exc}"}]
@@ -163,9 +166,13 @@ class WebFetchTool(BaseTool):
         }
 
     async def execute(self, input_data: dict, context: ToolContext) -> list[dict]:
-        url: str = input_data["url"]
-        prompt: str | None = input_data.get("prompt")
+        page = await self.fetch_page(input_data["url"], input_data.get("prompt"))
+        return [{"type": "text", "text": page.text}]
 
+    @staticmethod
+    async def fetch_page(url: str, prompt: str | None = None) -> PageText:
+        """The page as readable text, plus WHAT it was, so callers can tell a
+        JS wall (worth another tier) from a PNG (nothing left to try)."""
         try:
             resp = await safe_fetch(
                 url,
@@ -174,38 +181,27 @@ class WebFetchTool(BaseTool):
                 timeout=HTTP_TIMEOUT,
             )
             resp.raise_for_status()
+        except DomainUnreachable as exc:
+            return PageText(text=f"Could not reach {url}: {exc}", kind="error")
         except SSRFBlocked as exc:
-            return [{"type": "text", "text": f"Refused to fetch {url}: {exc}"}]
+            return PageText(text=f"Refused to fetch {url}: {exc}", kind="error")
         except httpx.HTTPStatusError as exc:
-            return [{"type": "text", "text": f"HTTP error {exc.response.status_code} fetching {url}"}]
+            return PageText(text=f"HTTP error {exc.response.status_code} fetching {url}", kind="error")
         except Exception as exc:
-            return [{"type": "text", "text": f"Error fetching {url}: {exc}"}]
+            return PageText(text=f"Error fetching {url}: {exc}", kind="error")
 
         content_type = resp.headers.get("content-type", "")
-        is_html = "html" in content_type or resp.text.strip().startswith("<!")
+        # A PDF's content-type often says html, so check the magic bytes before trusting the header.
+        is_pdf = looks_like_pdf(content_type, resp.content)
+        is_html = not is_pdf and ("html" in content_type or resp.text.strip().startswith("<!"))
 
         if is_html:
-            # Prefer trafilatura for main-content extraction; fall back to regex strip on apps/login walls/JS-heavy pages.
-            text: str | None = None
-            try:
-                import trafilatura  # type: ignore
-                text = trafilatura.extract(
-                    resp.text,
-                    include_comments=False,
-                    include_tables=True,
-                    favor_precision=True,
-                )
-            except Exception:
-                text = None
-            if not text:
-                text = strip_html(resp.text)
+            body = PageText(text=html_to_text(resp.text), kind="html")
         else:
-            text = resp.text
-
-        text = p_truncate(text)
+            body = body_to_text(content_type, resp.content, resp.text)
 
         header = f"Contents of {url}:"
         if prompt:
             header += f"\n(Looking for: {prompt})"
 
-        return [{"type": "text", "text": f"{header}\n\n{text}"}]
+        return PageText(text=f"{header}\n\n{p_truncate(body.text)}", kind=body.kind)
diff --git a/backend/apps/agents/web_mcp_server.py b/backend/apps/agents/web_mcp_server.py
index 973550ad..662fa686 100755
--- a/backend/apps/agents/web_mcp_server.py
+++ b/backend/apps/agents/web_mcp_server.py
@@ -87,7 +87,11 @@ def send_response(id_, result=None, error=None):
     sys.stdout.flush()
 
 
-def p_post(url: str, body: dict, timeout: float = 60.0) -> dict:
+# The backend bounds its own cascade at 60s and always answers within it (with an honest "here is why every backend failed" body). Waiting slightly longer than that means the useful answer wins; the old 45s cap aborted the call BEFORE the later tiers could even be reached, so search reliability came down to whether an early tier won the race.
+TOOL_TIMEOUT = 75.0
+
+
+def p_post(url: str, body: dict, timeout: float = TOOL_TIMEOUT) -> dict:
     payload = json.dumps(body).encode()
     headers = {"Content-Type": "application/json"}
     if BACKEND_AUTH:
@@ -118,7 +122,7 @@ def handle_tool_call(tool_name: str, arguments: dict) -> dict:
         body = {"query": query, "num_results": num, "browser_ok": BROWSER_OK}
         if PRIMARY_HINT:
             body["primary"] = PRIMARY_HINT
-        r = p_post(SEARCH_URL, body, timeout=45.0)
+        r = p_post(SEARCH_URL, body, timeout=TOOL_TIMEOUT)
         if "error" in r:
             return {"content": [{"type": "text", "text": f"Search failed: {r['error']}"}], "isError": True}
         results = r.get("results", "")
@@ -140,7 +144,7 @@ def handle_tool_call(tool_name: str, arguments: dict) -> dict:
             body["prompt"] = str(prompt)
         if PRIMARY_HINT:
             body["primary"] = PRIMARY_HINT
-        r = p_post(FETCH_URL, body, timeout=45.0)
+        r = p_post(FETCH_URL, body, timeout=TOOL_TIMEOUT)
         if "error" in r:
             return {"content": [{"type": "text", "text": f"Fetch failed: {r['error']}"}], "isError": True}
         content = r.get("content", "")
diff --git a/backend/apps/health/health.py b/backend/apps/health/health.py
index 5637152c..ed555db0 100644
--- a/backend/apps/health/health.py
+++ b/backend/apps/health/health.py
@@ -1,6 +1,7 @@
 from backend.config.Apps import SubApp
 from contextlib import asynccontextmanager
 from fastapi.responses import PlainTextResponse
+from pydantic import BaseModel, ConfigDict
 from typeguard import typechecked
 from fastapi import status, HTTPException
 
@@ -14,10 +15,33 @@ health = SubApp("health", health_lifespan)
 @typechecked
 async def check() -> PlainTextResponse:
     return PlainTextResponse(
-        content="OK", 
+        content="OK",
         status_code=status.HTTP_200_OK,
         headers={
             "Content-Type": "text/plain",
             "Content-Length": "2"
         }
-    )
\ No newline at end of file
+    )
+
+
+class RendererHealth(BaseModel):
+    """Whether an Electron window is driving this backend, which is what makes browser tools real."""
+
+    model_config = ConfigDict(validate_assignment=True)
+
+    attached: bool
+    ever_attached: bool
+    connections: int
+
+
+@health.router.get("/renderer")
+@typechecked
+async def renderer() -> RendererHealth:
+    """Renderer readiness. The cloud runner blocks on this before it fires a workflow, because a
+    browser step with no window behind it burns turns narrating timeouts at nothing."""
+    from backend.apps.agents.core.ws_manager import ws_manager
+    return RendererHealth(
+        attached=bool(ws_manager.global_connections),
+        ever_attached=ws_manager.renderer_ever_attached,
+        connections=len(ws_manager.global_connections),
+    )
diff --git a/backend/apps/help/bundle.py b/backend/apps/help/bundle.py
index f4f4ee99..13037c6f 100644
--- a/backend/apps/help/bundle.py
+++ b/backend/apps/help/bundle.py
@@ -1,8 +1,8 @@
-"""Diagnostic bundle for bug reports: one folder a user can drag into a GitHub issue.
+"""Routes for the Help panel: the product-knowledge feed, and the diagnostic bundle for bug reports.
 
-Everything is assembled LOCALLY and only revealed in the file manager; nothing uploads
-anywhere by itself. Contents are deliberately allowlisted (identity, versions, feature
-booleans, provider KINDS, counts, log tail) so no secret or API key can ever ride along.
+The bundle is assembled LOCALLY and only revealed in the file manager; nothing uploads anywhere by
+itself. Contents are deliberately allowlisted (identity, versions, feature booleans, provider KINDS,
+counts, log tail) so no secret or API key can ever ride along.
 """
 
 import base64
@@ -18,6 +18,7 @@ from typing import AsyncIterator, List
 from pydantic import BaseModel, ConfigDict, Field
 from typeguard import typechecked
 
+from backend.apps.help.knowledge import HelpKnowledgeResponse, build_knowledge_response
 from backend.config.Apps import SubApp
 from backend.config.paths import DATA_ROOT, SESSIONS_DIR
 
@@ -138,6 +139,12 @@ def p_build_report(req: BundleRequest) -> str:
     return "\n".join(lines)
 
 
+@help_app.router.get("/knowledge")
+@typechecked
+async def get_help_knowledge() -> HelpKnowledgeResponse:
+    return build_knowledge_response()
+
+
 @help_app.router.post("/bundle")
 @typechecked
 async def build_bundle(body: BundleRequest) -> dict:
diff --git a/backend/apps/help/help_topics.py b/backend/apps/help/help_topics.py
new file mode 100644
index 00000000..76866f2d
--- /dev/null
+++ b/backend/apps/help/help_topics.py
@@ -0,0 +1,269 @@
+"""Curated product knowledge for the in-app help chat.
+
+Every fact here is written from the CODE, not from the docs site, and ships inside the same
+build as the surfaces it describes, so help can never describe a version the user isn't running.
+Each topic is self-contained on purpose: the help panel searches these offline with no model at
+all, and the chat gets them as a cached system-prompt block.
+
+When you move or rename a surface, update the topic in the SAME change. A help topic that lies is
+worse than no help topic.
+"""
+
+from typing import List
+
+from pydantic import BaseModel, ConfigDict
+
+
+class HelpTopic(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    id: str
+    title: str
+    # Where the thing physically is on screen. Empty when the topic is a concept, not a surface.
+    where: str
+    body: str
+    keywords: List[str]
+
+
+HELP_TOPICS: List[HelpTopic] = [
+    HelpTopic(
+        id="canvas",
+        title="The dashboard canvas",
+        where="The whole main window.",
+        body=(
+            "Each dashboard is an infinite canvas holding cards: agent chats, browsers, apps you "
+            "built, and workflows. Scroll or pinch to zoom, hold Space and drag to pan, drag a card "
+            "by its header to move it, and drag on empty canvas to marquee-select several."
+        ),
+        keywords=["canvas", "dashboard", "zoom", "pan", "move", "cards", "select"],
+    ),
+    HelpTopic(
+        id="dock",
+        title="The dock",
+        where="A dark vertical rail down the left edge of the window.",
+        body=(
+            "Every open card gets a colored tile at the top of the dock; click one to jump to that "
+            "card, right-click it for its menu. Below the divider sit four actions in this order: "
+            "New browser, Workflows, then Settings and Applications."
+        ),
+        keywords=["dock", "rail", "sidebar", "left", "tiles", "icons"],
+    ),
+    HelpTopic(
+        id="applications",
+        title="Applications, your app library",
+        where="The grid icon at the very bottom of the left dock.",
+        body=(
+            "Opens a window listing every app you have built or imported, with thumbnails. Click one "
+            "to drop it onto the current dashboard as a live card. A search box appears once you have "
+            "more than eight apps. It lists YOUR apps, not the programs installed on your computer."
+        ),
+        keywords=["applications", "apps", "library", "grid", "built", "outputs"],
+    ),
+    HelpTopic(
+        id="new-chat",
+        title="Starting a new chat",
+        where="The 'Ask me anything...' pill at the bottom center of the canvas.",
+        body=(
+            "Type in the pill and press Enter to spawn an agent card. The pill is hidden while a "
+            "dashboard is completely empty, so the keyboard shortcut is the reliable way in; it works "
+            "from anywhere. The new card lands beside whatever is selected, otherwise in view."
+        ),
+        keywords=["new chat", "agent", "spawn", "pill", "ask", "start", "composer"],
+    ),
+    HelpTopic(
+        id="window-controls",
+        title="Card window controls and tiling",
+        where="The three traffic-light dots in the top-left corner of any card.",
+        body=(
+            "Red closes, yellow minimizes, green toggles full screen. HOVER the green dot instead of "
+            "clicking it and a macOS-style tiling menu opens with two groups: Fill and Halves (fill, "
+            "left, right, top, bottom) and Quarters. Clicking green again restores a tiled card."
+        ),
+        keywords=["traffic lights", "fullscreen", "tile", "halves", "quarters", "minimize", "close", "green"],
+    ),
+    HelpTopic(
+        id="minimized",
+        title="Minimized cards",
+        where="A stack of small thumbnails on the right edge of the canvas.",
+        body=(
+            "Minimizing a card with the yellow dot parks it in the right-edge stack instead of closing "
+            "it. Click a thumbnail to put the card back on the canvas exactly where it was."
+        ),
+        keywords=["minimize", "minimized", "restore", "stack", "thumbnail", "yellow"],
+    ),
+    HelpTopic(
+        id="spaces",
+        title="Dashboards, which behave like Spaces",
+        where="Rest the cursor on the very top edge of the window to reveal the spaces bar.",
+        body=(
+            "Dashboards are separate canvases, like macOS Spaces. The top-edge bar switches between "
+            "them, + adds one, and right-clicking a space renames or removes it. There is also a "
+            "keyboard shortcut for the previous and next dashboard."
+        ),
+        keywords=["spaces", "dashboards", "switch", "top edge", "workspace", "add"],
+    ),
+    HelpTopic(
+        id="history",
+        title="Chat history",
+        where="The island at the top center of the dashboard.",
+        body=(
+            "History lists past chats across ALL dashboards, not just the current one. Picking a chat "
+            "reopens it as a card. It is on the top island, not in the dock."
+        ),
+        keywords=["history", "past chats", "previous", "reopen", "recent", "island"],
+    ),
+    HelpTopic(
+        id="search",
+        title="Search everything",
+        where="The global search palette, opened with the search shortcut.",
+        body=(
+            "One palette searches chats, apps, and commands across every dashboard. There is a "
+            "separate find that searches only the cards on the current canvas, and inside a browser "
+            "card that same find searches the web page instead."
+        ),
+        keywords=["search", "find", "palette", "command", "lookup", "cmd k"],
+    ),
+    HelpTopic(
+        id="workflows",
+        title="Workflows and scheduled tasks",
+        where="The repeating-calendar icon in the left dock, above Settings.",
+        body=(
+            "A workflow is a sequence of agent steps that runs on a schedule, for example every "
+            "weekday at 9am. Open the Workflows window from the dock to create one, set its steps and "
+            "schedule, run it immediately with Run now, or pause it. You can also just ask an agent in "
+            "chat to schedule something and it will build the workflow for you."
+        ),
+        keywords=["workflow", "schedule", "scheduled", "task", "cron", "recurring", "automation", "daily"],
+    ),
+    HelpTopic(
+        id="apps",
+        title="Building apps",
+        where="Ask any agent chat, or the + menu on the canvas.",
+        body=(
+            "Ask an agent for a tool, dashboard, or game and it calls CreateApp, which seeds a "
+            "workspace and puts a live preview card on the dashboard, then writes the code. To change "
+            "an app, select its card and tell the agent what to change; the preview reloads itself."
+        ),
+        keywords=["app", "build", "create", "app builder", "preview", "vite", "code"],
+    ),
+    HelpTopic(
+        id="publish",
+        title="Publishing an app to the web",
+        where="The share or publish control on a built app's card.",
+        body=(
+            "An app can be published to a public {slug}.openswarm.host URL. Publishing first scans the "
+            "code for anything sensitive and shows the findings before it uploads. Published apps can "
+            "be unpublished again from the same place."
+        ),
+        keywords=["publish", "share", "host", "openswarm.host", "deploy", "public", "link"],
+    ),
+    HelpTopic(
+        id="browser",
+        title="Browser cards",
+        where="The globe icon in the left dock.",
+        body=(
+            "A browser card is a real browser on the canvas, with tabs, its own zoom, find-in-page, and "
+            "a persistent login session that survives quitting the app. Agents can drive these cards "
+            "for you, and you stay signed in to the sites you use."
+        ),
+        keywords=["browser", "web", "tabs", "globe", "login", "website", "internet"],
+    ),
+    HelpTopic(
+        id="browser-agent",
+        title="Agents that use the browser",
+        where="Happens automatically inside a chat.",
+        body=(
+            "When a task needs a real website, the agent delegates to a browser sub-agent, which opens "
+            "a browser card and works in it while you watch. It is the last resort: agents prefer "
+            "connected tools and plain web search first, because those are faster and more reliable."
+        ),
+        keywords=["browser agent", "sub-agent", "automation", "click", "website", "delegate"],
+    ),
+    HelpTopic(
+        id="tools",
+        title="Tools and MCP integrations",
+        where="Settings, then Tools.",
+        body=(
+            "Integrations (Gmail, Notion, Slack and so on) are MCP servers. They are deliberately NOT "
+            "active by default: an agent has to find one with MCPSearch and then activate it with "
+            "MCPActivate, which asks for your approval first. Nothing gets tool access silently."
+        ),
+        keywords=["tools", "mcp", "integration", "connect", "gmail", "notion", "slack", "approval", "activate"],
+    ),
+    HelpTopic(
+        id="approvals",
+        title="Approvals",
+        where="In the chat card, as a prompt from the agent.",
+        body=(
+            "Before an agent does something that needs your say-so it stops and asks in the chat. You "
+            "approve or deny, and you can tell it to remember the choice so it stops asking for that "
+            "same action."
+        ),
+        keywords=["approval", "permission", "approve", "deny", "hitl", "ask", "confirm"],
+    ),
+    HelpTopic(
+        id="skills",
+        title="Skills",
+        where="Settings, then Skills.",
+        body=(
+            "A skill is a reusable set of instructions that teaches agents how to do a specific task. "
+            "You can write one, install one from the registry, or import one, and agents pull in a "
+            "skill on demand when it is relevant instead of carrying all of them every turn."
+        ),
+        keywords=["skill", "skills", "instructions", "registry", "teach", "import"],
+    ),
+    HelpTopic(
+        id="dictation",
+        title="Voice dictation",
+        where="The mic button on the composer, or the dictation shortcut.",
+        body=(
+            "Dictation transcribes speech locally on your machine and drops the words wherever your "
+            "cursor is. The first use downloads a voice model, so it is slower once and fast after. "
+            "Hold-to-talk versus click-to-toggle is a setting under General."
+        ),
+        keywords=["dictation", "voice", "mic", "speak", "transcribe", "talk", "whisper"],
+    ),
+    HelpTopic(
+        id="models",
+        title="Connecting a model",
+        where="Settings, then Models.",
+        body=(
+            "You can connect a Claude, ChatGPT, or Gemini subscription, paste an API key, or use "
+            "OpenSwarm's own paid plan. Brand-new installs get a small free trial that runs on a "
+            "shared pool. If a connection dies, this is the page with the Reconnect button."
+        ),
+        keywords=["model", "models", "connect", "api key", "subscription", "claude", "gpt", "gemini", "provider", "reconnect", "free trial"],
+    ),
+    HelpTopic(
+        id="settings",
+        title="Settings",
+        where="The gear icon in the left dock; it opens as a card on the canvas.",
+        body=(
+            "Sections are Account; then App: General, Appearance, Privacy, Advanced; then "
+            "Capabilities: Models, Skills, Tools, Commands, Usage. Theme, accent color, and text size "
+            "live under Appearance. Agent defaults and shortcuts live under General."
+        ),
+        keywords=["settings", "preferences", "gear", "config", "theme", "account", "appearance", "privacy", "advanced", "usage"],
+    ),
+    HelpTopic(
+        id="swarm-file",
+        title="Sharing with .swarm files",
+        where="Share on the thing you want to export; drag a .swarm file onto the app to import.",
+        body=(
+            "Apps, skills, and workflows export to a single .swarm file you can send someone. Importing "
+            "one adds it to your library. The export is scanned so credentials never travel inside it."
+        ),
+        keywords=["swarm", "export", "import", "share", "file", "backup", "send"],
+    ),
+    HelpTopic(
+        id="report-bug",
+        title="Reporting a bug",
+        where="The Help pill, top right, then Report a bug.",
+        body=(
+            "It writes a diagnostics folder locally (versions, platform, recent log tail, with secrets "
+            "stripped), reveals that folder in your file manager, and opens a prefilled GitHub issue to "
+            "drag the files into. Nothing uploads on its own."
+        ),
+        keywords=["bug", "report", "issue", "broken", "diagnostics", "github", "feedback", "crash"],
+    ),
+]
diff --git a/backend/apps/help/knowledge.py b/backend/apps/help/knowledge.py
new file mode 100644
index 00000000..78db0d59
--- /dev/null
+++ b/backend/apps/help/knowledge.py
@@ -0,0 +1,187 @@
+"""Assembles what the in-app help chat knows: shipped product facts plus live facts about THIS
+install (version, platform, the user's actual shortcuts, whether a model is even connected).
+
+Shipped facts can't drift from the build. Live facts are the part a shipped file can never get
+right, and they are exactly where a hardcoded help prompt goes stale first.
+
+The result is handed to the chat as its system prompt, which lands in the provider's cached
+prefix (see RunOptions), so the knowledge is paid for once per session rather than per turn.
+"""
+
+import platform
+from typing import List, Optional
+
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from backend.apps.help.help_topics import HELP_TOPICS, HelpTopic
+from backend.apps.help.known_issues import KNOWN_ISSUES, HelpKnownIssue
+from backend.apps.help.prompt_rules import GROUNDING_RULES, ROLE
+
+IS_MAC = platform.system() == "Darwin"
+
+# Off mac these handlers fire on Ctrl (the code reads metaKey||ctrlKey), so "Meta" must READ as Ctrl.
+P_MAC_GLYPH = {"meta": "⌘", "ctrl": "⌃", "alt": "⌥", "shift": "⇧"}
+P_OTHER_NAME = {"meta": "Ctrl", "ctrl": "Ctrl", "alt": "Alt", "shift": "Shift"}
+
+# Same "Meta+l" parts format the settings fields use, so one renderer covers stock and configured alike.
+P_FIXED_SHORTCUTS: List[tuple] = [
+    ("Meta+k", "Search everything, across all dashboards"),
+    ("Meta+f", "Find cards on this canvas; inside a browser card it finds text on the page"),
+    ("Meta+Shift+t", "Reopen the card you just closed"),
+    ("Meta+a", "Select every card"),
+    ("Meta+c", "Copy the selected cards"),
+    ("Meta+v", "Paste the copied cards"),
+    ("Delete", "Delete the selected cards"),
+    ("Enter", "Expand or collapse the selected chat"),
+    ("Meta+Alt+Left", "Previous dashboard"),
+    ("Meta+Alt+Right", "Next dashboard"),
+    ("Meta+=", "Zoom in; inside a browser card it zooms the page"),
+    ("Meta+-", "Zoom out; inside a browser card it zooms the page"),
+    ("Meta+0", "Reset zoom"),
+    ("Ctrl+Tab", "Next tab in the focused browser card"),
+    ("Space", "Hold and drag to pan the canvas"),
+    ("Arrows", "Move between cards"),
+    ("Escape", "Close the open panel or menu"),
+]
+
+
+class HelpShortcut(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    keys: str
+    action: str
+
+
+class HelpKnowledgeResponse(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    system_prompt: str
+    topics: List[HelpTopic]
+    known_issues: List[HelpKnownIssue]
+    shortcuts: List[HelpShortcut]
+    app_version: str
+
+
+@typechecked
+def render_combo(combo: str) -> str:
+    """'Meta+Shift+d' -> '⇧⌘D' on mac, 'Ctrl+Shift+D' elsewhere."""
+    parts = [p for p in combo.split("+") if p]
+    out: List[str] = []
+    for part in parts:
+        low = part.lower()
+        if IS_MAC:
+            out.append(P_MAC_GLYPH.get(low, part.upper() if len(part) == 1 else part))
+        else:
+            out.append(P_OTHER_NAME.get(low, part.upper() if len(part) == 1 else part))
+    return ("" if IS_MAC else "+").join(out)
+
+
+@typechecked
+def dictation_default_combo() -> str:
+    return "Meta+Shift+d" if IS_MAC else "Ctrl+Shift+d"
+
+
+@typechecked
+def build_shortcuts(new_agent_combo: str, dictation_combo: Optional[str]) -> List[HelpShortcut]:
+    live = [
+        HelpShortcut(keys=render_combo(new_agent_combo or "Meta+l"), action="Open the new-chat composer"),
+        HelpShortcut(keys=render_combo(dictation_combo or dictation_default_combo()), action="Start or stop voice dictation"),
+    ]
+    return live + [HelpShortcut(keys=render_combo(c), action=a) for c, a in P_FIXED_SHORTCUTS]
+
+
+@typechecked
+def p_provider_state() -> str:
+    """One honest line about whether this install can actually run a model."""
+    from backend.apps.settings.store import load_settings
+
+    s = load_settings()
+    mode = getattr(s, "connection_mode", "own_key")
+    if mode == "free-trial":
+        return "on the free trial (a shared capacity pool)"
+    if mode == "openswarm-pro":
+        return "on an OpenSwarm paid plan"
+    keyed = any(
+        getattr(s, f, None)
+        for f in ("anthropic_api_key", "openai_api_key", "google_api_key", "openrouter_api_key")
+    )
+    subbed = any(
+        getattr(s, f, None)
+        for f in ("claude_subscription_token", "openai_subscription_token", "gemini_subscription_token")
+    )
+    if subbed:
+        return "on a connected provider subscription"
+    if keyed:
+        return "on their own API key"
+    return "with NO model connected yet, so most agent work will fail until they connect one in Settings > Models"
+
+
+@typechecked
+def p_topics_block() -> str:
+    lines: List[str] = []
+    for t in HELP_TOPICS:
+        where = f" WHERE: {t.where}" if t.where else ""
+        lines.append(f"- [{t.id}] {t.title}.{where} {t.body}")
+    return "\n".join(lines)
+
+
+@typechecked
+def p_issues_block() -> str:
+    lines: List[str] = []
+    for i in KNOWN_ISSUES:
+        fix = f" Workaround: {i.workaround}" if i.workaround else ""
+        lines.append(f"- [{i.id}] ({i.status}) {i.title}. {i.detail}{fix}")
+    return "\n".join(lines)
+
+
+@typechecked
+def build_system_prompt(shortcuts: List[HelpShortcut], app_version: str) -> str:
+    shortcut_lines = "\n".join(f"- {s.keys}: {s.action}" for s in shortcuts)
+    os_name = "macOS" if IS_MAC else platform.system()
+    return "\n".join(
+        [
+            ROLE,
+            "",
+            "<this_install>",
+            f"OpenSwarm version {app_version} on {os_name}. This user is {p_provider_state()}.",
+            "These are live facts about the machine you are talking to; trust them over anything you recall.",
+            "</this_install>",
+            "",
+            "<surfaces>",
+            "Verified against this exact build. This is your ground truth for where things are.",
+            p_topics_block(),
+            "</surfaces>",
+            "",
+            "<shortcuts>",
+            "This user's real shortcuts, already written for their platform. Quote them exactly.",
+            shortcut_lines,
+            "</shortcuts>",
+            "",
+            "<known_issues>",
+            "The complete list of issues shipped with this build. You cannot see live bug reports.",
+            p_issues_block(),
+            "</known_issues>",
+            "",
+            GROUNDING_RULES,
+        ]
+    )
+
+
+@typechecked
+def build_knowledge_response() -> HelpKnowledgeResponse:
+    from backend.apps.service.version import APP_VERSION
+    from backend.apps.settings.store import load_settings
+
+    s = load_settings()
+    shortcuts = build_shortcuts(
+        getattr(s, "new_agent_shortcut", "Meta+l") or "Meta+l",
+        getattr(s, "dictation_shortcut", None),
+    )
+    return HelpKnowledgeResponse(
+        system_prompt=build_system_prompt(shortcuts, APP_VERSION),
+        topics=HELP_TOPICS,
+        known_issues=KNOWN_ISSUES,
+        shortcuts=shortcuts,
+        app_version=APP_VERSION,
+    )
diff --git a/backend/apps/help/known_issues.py b/backend/apps/help/known_issues.py
new file mode 100644
index 00000000..aa52f6b4
--- /dev/null
+++ b/backend/apps/help/known_issues.py
@@ -0,0 +1,61 @@
+"""The curated known-issues list that ships with this build.
+
+Deliberately NOT the live GitHub issue queue: that queue is engineering-facing (path guards, token
+budgets) and phrased in nothing like the words a user would use for their symptom, so matching a
+user's complaint against it produces false confidence. It is also network-dependent and publicly
+writable, which is a prompt-injection surface for no gain.
+
+So: a short list of real, user-visible symptoms, each verified. The help chat is told this list is
+complete and that it has no live view of the tracker, so it can never invent a bug status.
+"""
+
+from typing import List, Literal, Optional
+
+from pydantic import BaseModel, ConfigDict
+
+
+class HelpKnownIssue(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    id: str
+    title: str
+    status: Literal["known", "mitigated", "fixed"]
+    detail: str
+    workaround: Optional[str] = None
+
+
+KNOWN_ISSUES: List[HelpKnownIssue] = [
+    HelpKnownIssue(
+        id="free-trial-capacity",
+        title="Free-trial runs fail with a capacity or busy message",
+        status="mitigated",
+        detail=(
+            "The free trial runs on one shared pool of capacity, so under load a run can come back "
+            "saying it is out of capacity. The app now waits and retries automatically instead of "
+            "erroring straight away, but a sustained busy period still ends in that message."
+        ),
+        workaround="Connecting your own subscription or API key under Settings, then Models, avoids the shared pool entirely.",
+    ),
+    HelpKnownIssue(
+        id="windows-cli-quarantine",
+        title="Windows: 'Claude Code not found' after installing",
+        status="mitigated",
+        detail=(
+            "Some Windows antivirus products quarantine the command-line binary that ships inside the "
+            "app, which makes every run fail with a not-found error. Newer builds ship that binary "
+            "code-signed, and the app now detects the case and shows repair steps instead of a raw error."
+        ),
+        workaround="Restore the file from your antivirus quarantine, or reinstall OpenSwarm. Your chats are kept either way.",
+    ),
+    HelpKnownIssue(
+        id="dashboard-switch-logout",
+        title="Switching dashboards can sign you out of a site in a browser card",
+        status="known",
+        detail=(
+            "Some sites keep their login in per-tab storage that only lives as long as the page is "
+            "mounted. Panning away from a card and back preserves it, because that state is captured "
+            "and restored, but switching to another dashboard and back can still lose it."
+        ),
+        workaround="Keep browser cards you are signed into on the dashboard you are working in, or sign in again after switching.",
+    ),
+]
diff --git a/backend/apps/help/prompt_rules.py b/backend/apps/help/prompt_rules.py
new file mode 100644
index 00000000..9608a24e
--- /dev/null
+++ b/backend/apps/help/prompt_rules.py
@@ -0,0 +1,61 @@
+"""The behavior contract for the help chat, kept apart from the facts it reasons over.
+
+The single property that matters here is refusal: a help assistant that invents a menu item is
+worse than one that says it doesn't know, because the user burns real time hunting for a button
+that was never built. Everything below exists to make "I don't know" the cheap answer.
+"""
+
+ROLE = (
+    "You are OpenSwarm's help assistant, a support chat built into the app itself.\n"
+    "You help people use OpenSwarm: where things are, how to do them, and what went wrong.\n"
+    "You are talking to someone with the app open in front of them right now."
+)
+
+GROUNDING_RULES = "\n".join(
+    [
+        "<rules>",
+        "GROUNDING. The blocks above are your only source of truth about OpenSwarm. They were written",
+        "from this build's code, so they beat anything you remember about this or any similar app.",
+        "- Answer from those blocks. Name the surface you are drawing on, in plain prose, so the user",
+        "  can go look at it: 'the dock, on the left edge' rather than an unsourced instruction.",
+        "- Quote shortcuts EXACTLY as they appear in <shortcuts>. Never guess a key combination, and",
+        "  never convert between platforms yourself; the list is already correct for this machine.",
+        "- Never invent a button, menu item, tab, setting, or page name. If you cannot name the exact",
+        "  surface from the blocks above, you do not know where it is, and you must say so.",
+        "- The [bracketed ids] are internal labels for your own lookup. Never print one; the user has",
+        "  never seen them and they read as a glitch.",
+        "",
+        "SAYING YOU DON'T KNOW. This is a correct, expected answer, not a failure.",
+        "- If something is not covered above, say plainly that you don't know or that OpenSwarm does",
+        "  not appear to have it, in one sentence, with no hedging and no invented alternative.",
+        "- Then point at something real: the docs (Help pill, then Docs and shortcuts), the Discord",
+        "  (Help pill, then Talk to the team), or Report a bug for something broken.",
+        "- If the user asks for a feature that is genuinely absent, say it is absent and offer to help",
+        "  them file it as a feature request. Do not describe a workflow that does not exist.",
+        "- Never dress a guess as an answer. A wrong click path costs more than an honest 'not sure'.",
+        "",
+        "BUGS AND KNOWN ISSUES. Be exact about what you can and cannot see.",
+        "- <known_issues> is the complete list that shipped with this build. You have no live view of",
+        "  the bug tracker, so you cannot confirm or deny anything outside that list.",
+        "- If it matches a listed issue, say so and give the status and workaround verbatim.",
+        "- If it does not match, say you cannot tell whether it is a known bug, then walk them to the",
+        "  Help pill and Report a bug, which packages diagnostics automatically.",
+        "- Never invent a bug status, a fix version, or an ETA.",
+        "",
+        "TROUBLESHOOTING. Diagnose from <this_install> before theorizing. If no model is connected,",
+        "that is the answer to most 'it failed' questions. Ask for the exact error text when you need",
+        "it rather than guessing which of several causes applies.",
+        "",
+        "SCOPE AND STYLE.",
+        "- Stay a help chat. Never start unrelated agent work from here; if they want real work done,",
+        "  tell them to start a normal chat from the canvas composer.",
+        "- You may read their settings to answer a question about their setup. Ask before changing any.",
+        "- The docs site can lag the installed version. If docs and the blocks above disagree, the",
+        "  blocks win, and say so.",
+        "- Be brief. Give the click path or the key, not an essay. Two or three sentences is usually the",
+        "  whole answer. No preamble, no restating the question.",
+        "- Never mention your own tools, or narrate one failing. If a tool won't cooperate, just answer",
+        "  in plain text as if you had never reached for it.",
+        "</rules>",
+    ]
+)
diff --git a/backend/apps/nine_router/credential_lease.py b/backend/apps/nine_router/credential_lease.py
new file mode 100644
index 00000000..425fb761
--- /dev/null
+++ b/backend/apps/nine_router/credential_lease.py
@@ -0,0 +1,209 @@
+"""Handing custody of a rotating provider credential between this device and the cloud.
+
+Cloud runs execute a user's workflow while their laptop is off, using the user's OWN subscription.
+That means our server needs to refresh their token, and providers issue a new refresh token on every
+refresh while treating a replayed one as theft, revoking the entire grant family. So a credential
+gets exactly ONE holder that can rotate it, and the handover has to be ordered so there is never an
+instant where both sides can.
+
+The order is strip-then-upload, never the reverse:
+  - Strip first, then upload: worst case nobody can rotate for a moment, which is harmless because
+    the access token stays valid for hours. We restore on failure.
+  - Upload first, then strip: if the strip fails, BOTH sides hold a rotating token, which is the
+    exact incident this whole design exists to prevent.
+
+The one genuinely ambiguous case is an upload that times out after the server already committed.
+Restoring blindly there would recreate the two-holder state, so we ask the server who owns it
+before deciding.
+"""
+
+import logging
+from datetime import datetime
+from typing import Literal, Optional
+
+import httpx
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from backend.apps.nine_router import credential_store
+from backend.apps.settings.credentials import proxy_auth
+from backend.apps.settings.store import load_settings
+
+logger = logging.getLogger(__name__)
+
+P_TIMEOUT_S = 20.0
+
+LeaseStatus = Literal[
+    "leased",
+    "released",
+    "refreshed",
+    "not_signed_in",
+    "no_such_connection",
+    "not_rotatable",
+    "cloud_rejected",
+    "local_write_failed",
+    "ownership_unknown",
+]
+
+
+class LeaseOutcome(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    status: LeaseStatus
+    detail: str = ""
+
+
+@typechecked
+def p_cloud() -> Optional[tuple[str, str]]:
+    """(bearer, base_url) for the signed-in user, or None when there is nothing to talk to."""
+    token, base = proxy_auth(load_settings())
+    if not token or not base:
+        return None
+    return (token, base)
+
+
+@typechecked
+async def p_lease_is_cloud_owned(connection_id: str) -> Optional[bool]:
+    """True/False if we can read ownership, None if we cannot tell. The None case is load-bearing:
+    guessing here is how you end up with two rotators."""
+    cloud = p_cloud()
+    if cloud is None:
+        return None
+    token, base = cloud
+    try:
+        async with httpx.AsyncClient(timeout=P_TIMEOUT_S) as client:
+            r = await client.get(
+                f"{base}/api/credentials/status",
+                headers={"Authorization": f"Bearer {token}"},
+            )
+        if r.status_code != 200:
+            return None
+        for lease in r.json().get("leases") or []:
+            if lease.get("connection_id") == connection_id:
+                return lease.get("owner") == "cloud"
+        return False
+    except (httpx.HTTPError, ValueError):
+        return None
+
+
+@typechecked
+async def lease_to_cloud(connection_id: str) -> LeaseOutcome:
+    """Give the cloud sole custody so it can run this user's workflows while the laptop is off."""
+    cloud = p_cloud()
+    if cloud is None:
+        return LeaseOutcome(status="not_signed_in")
+    token, base = cloud
+
+    cred = credential_store.read_credential(connection_id)
+    if cred is None:
+        return LeaseOutcome(status="no_such_connection")
+    if not cred.refresh_token:
+        # Already stripped, or an api-key row. Either way there is no rotating secret to hand over.
+        return LeaseOutcome(status="not_rotatable")
+
+    refresh_token = cred.refresh_token
+    if not await credential_store.apply_to_connection(connection_id, changes={}, drop=["refreshToken"]):
+        return LeaseOutcome(status="local_write_failed")
+
+    payload = {
+        "connection_id": connection_id,
+        "provider": cred.provider,
+        "access_token": cred.access_token,
+        "refresh_token": refresh_token,
+        "expires_at": expires_ms(cred.expires_at),
+    }
+    try:
+        async with httpx.AsyncClient(timeout=P_TIMEOUT_S) as client:
+            r = await client.post(
+                f"{base}/api/credentials/lease",
+                headers={"Authorization": f"Bearer {token}"},
+                json=payload,
+            )
+        if r.status_code == 200:
+            return LeaseOutcome(status="leased")
+        await p_restore(connection_id, refresh_token)
+        return LeaseOutcome(status="cloud_rejected", detail=f"HTTP {r.status_code}")
+    except httpx.HTTPError as exc:
+        # The request may still have committed server-side, so ask before putting the token back.
+        owned = await p_lease_is_cloud_owned(connection_id)
+        if owned is True:
+            return LeaseOutcome(status="leased", detail="upload reported an error but the lease exists")
+        if owned is False:
+            await p_restore(connection_id, refresh_token)
+            return LeaseOutcome(status="cloud_rejected", detail=str(exc))
+        logger.error("lease upload outcome unknown for %s; leaving the token off this device", connection_id)
+        return LeaseOutcome(status="ownership_unknown", detail=str(exc))
+
+
+@typechecked
+async def p_restore(connection_id: str, refresh_token: str) -> None:
+    if not await credential_store.apply_to_connection(
+        connection_id, changes={"refreshToken": refresh_token}, drop=[]
+    ):
+        logger.error("could not restore the local refresh token for %s; the user must reconnect", connection_id)
+
+
+@typechecked
+def expires_ms(expires_at: Optional[str]) -> int:
+    """9Router stores an ISO string; the cloud wants unix ms. Unparseable reads as already expired,
+    which makes the server refresh on first use instead of trusting a bad clock."""
+    if not expires_at:
+        return 0
+    try:
+        return int(datetime.fromisoformat(expires_at.replace("Z", "+00:00")).timestamp() * 1000)
+    except ValueError:
+        return 0
+
+
+@typechecked
+async def release_to_device(connection_id: str) -> LeaseOutcome:
+    """Take custody back. The server hands the live refresh token home and drops its own copy."""
+    cloud = p_cloud()
+    if cloud is None:
+        return LeaseOutcome(status="not_signed_in")
+    token, base = cloud
+    try:
+        async with httpx.AsyncClient(timeout=P_TIMEOUT_S) as client:
+            r = await client.post(
+                f"{base}/api/credentials/release",
+                headers={"Authorization": f"Bearer {token}"},
+                json={"connection_id": connection_id},
+            )
+    except httpx.HTTPError as exc:
+        return LeaseOutcome(status="cloud_rejected", detail=str(exc))
+    if r.status_code != 200:
+        # 409 means a refresh is mid-exchange; the caller retries rather than taking a doomed token.
+        return LeaseOutcome(status="cloud_rejected", detail=f"HTTP {r.status_code}")
+    body = r.json()
+    ok = await credential_store.apply_to_connection(
+        connection_id,
+        changes={"accessToken": body["access_token"], "refreshToken": body["refresh_token"]},
+        drop=[],
+    )
+    return LeaseOutcome(status="released" if ok else "local_write_failed")
+
+
+@typechecked
+async def pull_access_token(connection_id: str) -> LeaseOutcome:
+    """Get a usable access token for a cloud-owned credential. This is what keeps LOCAL work going
+    once this device can no longer mint one itself."""
+    cloud = p_cloud()
+    if cloud is None:
+        return LeaseOutcome(status="not_signed_in")
+    token, base = cloud
+    try:
+        async with httpx.AsyncClient(timeout=P_TIMEOUT_S) as client:
+            r = await client.get(
+                f"{base}/api/credentials/access",
+                headers={"Authorization": f"Bearer {token}"},
+                params={"connection_id": connection_id},
+            )
+    except httpx.HTTPError as exc:
+        return LeaseOutcome(status="cloud_rejected", detail=str(exc))
+    if r.status_code != 200:
+        return LeaseOutcome(status="cloud_rejected", detail=f"HTTP {r.status_code}")
+    body = r.json()
+    ok = await credential_store.apply_to_connection(
+        connection_id, changes={"accessToken": body["access_token"]}, drop=[]
+    )
+    return LeaseOutcome(status="refreshed" if ok else "local_write_failed")
diff --git a/backend/apps/nine_router/credential_store.py b/backend/apps/nine_router/credential_store.py
new file mode 100644
index 00000000..9825a53f
--- /dev/null
+++ b/backend/apps/nine_router/credential_store.py
@@ -0,0 +1,167 @@
+"""Safe read/modify/write of 9Router's on-disk provider credentials.
+
+9Router owns ~/.9router/db.json and rewrites the whole file whenever it refreshes a token or a
+user edits a provider, and its HTTP API has no route that can write an OAuth connection's tokens
+(PUT /api/providers/[id] accepts name/priority/isActive/apiKey only, and apiKey only for apikey
+connections). So the only way to move an OAuth credential is to edit the file, which means we have
+to not race the router for it. Every mutation here happens with the router stopped.
+
+The reason any of this exists: providers hand back a NEW refresh token on every refresh and treat
+a replayed one as theft, revoking the whole grant family. So a credential may have exactly one
+holder that can refresh it. Removing `refreshToken` from a connection is what makes a given
+9Router instance structurally unable to rotate, because its refresh dispatcher bails on a falsy
+refreshToken before it ever calls the provider.
+"""
+
+import asyncio
+import json
+import logging
+import os
+import tempfile
+from typing import Any, Dict, List, Optional
+
+import httpx
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from backend.apps.nine_router import process
+
+logger = logging.getLogger(__name__)
+
+P_SHUTDOWN_TIMEOUT_S = 5.0
+P_DOWN_POLL_INTERVAL_S = 0.1
+P_DOWN_WAIT_S = 10.0
+
+
+class ProviderCredential(BaseModel):
+    """The transferable half of a 9Router provider connection."""
+
+    model_config = ConfigDict(validate_assignment=True)
+
+    connection_id: str
+    provider: str
+    access_token: str
+    refresh_token: Optional[str] = None
+    expires_at: Optional[str] = None
+
+
+@typechecked
+def db_path() -> str:
+    return os.path.join(process.nine_router_data_dir(), "db.json")
+
+
+@typechecked
+def p_load_db() -> Optional[Dict[str, Any]]:
+    try:
+        with open(db_path(), encoding="utf-8") as f:
+            db = json.load(f)
+        return db if isinstance(db, dict) else None
+    except (OSError, ValueError):
+        logger.warning("could not read 9router db.json", exc_info=True)
+        return None
+
+
+@typechecked
+def p_write_db(db: Dict[str, Any]) -> bool:
+    """Atomic replace at 0600. A half-written db.json costs the user every provider connection."""
+    path = db_path()
+    directory = os.path.dirname(path)
+    handle, temp_path = tempfile.mkstemp(dir=directory, prefix=".db.json.", suffix=".tmp")
+    try:
+        with os.fdopen(handle, "w", encoding="utf-8") as f:
+            json.dump(db, f, indent=2)
+        os.chmod(temp_path, 0o600)
+        os.replace(temp_path, path)
+        return True
+    except OSError:
+        logger.warning("could not write 9router db.json", exc_info=True)
+        try:
+            os.unlink(temp_path)
+        except OSError:
+            pass
+        return False
+
+
+@typechecked
+def read_credential(connection_id: str) -> Optional[ProviderCredential]:
+    """The tokens for one connection, readable whether or not the router is up."""
+    for c in process.read_persisted_connections():
+        if c.get("id") != connection_id:
+            continue
+        access = c.get("accessToken")
+        if not isinstance(access, str) or not access:
+            return None
+        refresh = c.get("refreshToken")
+        expires = c.get("expiresAt")
+        return ProviderCredential(
+            connection_id=connection_id,
+            provider=str(c.get("provider") or ""),
+            access_token=access,
+            refresh_token=refresh if isinstance(refresh, str) and refresh else None,
+            expires_at=expires if isinstance(expires, str) else None,
+        )
+    return None
+
+
+@typechecked
+def list_oauth_connection_ids() -> List[str]:
+    """Connections that carry a rotating credential; apikey rows have nothing to lease."""
+    return [
+        str(c.get("id"))
+        for c in process.read_persisted_connections()
+        if c.get("authType") == "oauth" and c.get("id")
+    ]
+
+
+@typechecked
+async def request_shutdown() -> None:
+    """Ask the router to exit over HTTP. Its own seam so a test can never reach a real router."""
+    try:
+        async with httpx.AsyncClient(timeout=P_SHUTDOWN_TIMEOUT_S, headers=process.cli_auth_headers()) as client:
+            await client.post(f"{process.NINE_ROUTER_API}/shutdown")
+    except (httpx.HTTPError, AttributeError):
+        pass
+
+
+@typechecked
+async def p_stop_router() -> bool:
+    """Down the router however we can reach it. `stop()` alone only kills one we spawned; an
+    adopted port-holder has no handle, so ask it to shut itself down over HTTP first."""
+    await request_shutdown()
+    process.stop()
+    waited = 0.0
+    while waited < P_DOWN_WAIT_S:
+        if not process.is_running():
+            return True
+        await asyncio.sleep(P_DOWN_POLL_INTERVAL_S)
+        waited += P_DOWN_POLL_INTERVAL_S
+    return not process.is_running()
+
+
+@typechecked
+async def apply_to_connection(connection_id: str, changes: Dict[str, Any], drop: List[str]) -> bool:
+    """Set `changes` and delete `drop` on one connection, with the router stopped throughout.
+
+    Refuses to run if the router will not go down, because a concurrent refresh would either lose
+    our edit or, far worse, resurrect a refresh token we are in the middle of handing away.
+    """
+    if not await p_stop_router():
+        logger.error("refusing to edit 9router db.json: router would not stop")
+        return False
+    try:
+        db = p_load_db()
+        if db is None:
+            return False
+        connections = db.get("providerConnections")
+        if not isinstance(connections, list):
+            return False
+        target = next((c for c in connections if isinstance(c, dict) and c.get("id") == connection_id), None)
+        if target is None:
+            logger.error("9router connection %s not found", connection_id)
+            return False
+        target.update(changes)
+        for key in drop:
+            target.pop(key, None)
+        return p_write_db(db)
+    finally:
+        await process.ensure_running()
diff --git a/backend/apps/nine_router/process.py b/backend/apps/nine_router/process.py
index 79eea7ad..5bbdfcad 100644
--- a/backend/apps/nine_router/process.py
+++ b/backend/apps/nine_router/process.py
@@ -17,6 +17,7 @@ import os
 import secrets
 import shutil
 import socket
+import stat
 import subprocess
 import tempfile
 import time
@@ -98,7 +99,7 @@ def is_running() -> bool:
         return False
 
 
-def p_nine_router_data_dir() -> str:
+def nine_router_data_dir() -> str:
     """Where 9Router persists machine-id + auth/cli-secret, the two files we
     hash into the /api/* auth token on 0.4.x. Mirrors 9Router's own default
     (DATA_DIR env, else ~/.9router on unix, %APPDATA%/9router on win) so we read
@@ -115,6 +116,25 @@ def p_nine_router_data_dir() -> str:
     return os.path.join(os.path.expanduser("~"), ".9router")
 
 
+def harden_data_dir_permissions() -> None:
+    """Make the 9Router state dir owner-only. Its db.json holds live subscription access AND refresh
+    tokens in plaintext and 9Router writes it 0644, so on a shared machine any other local account
+    can read them. We tighten the DIRECTORY rather than the file because 9Router rewrites db.json on
+    every token refresh, which would drop a chmod on the file itself within the hour."""
+    if os.name == "nt":
+        return
+    data_dir = nine_router_data_dir()
+    try:
+        if not os.path.isdir(data_dir):
+            return
+        current = stat.S_IMODE(os.stat(data_dir).st_mode)
+        if current & 0o077:
+            os.chmod(data_dir, 0o700)
+            logger.info("tightened 9router data dir from %s to 0700", oct(current))
+    except OSError:
+        logger.warning("could not tighten 9router data dir permissions", exc_info=True)
+
+
 p_cli_token_cache: str | None = None
 
 
@@ -132,7 +152,7 @@ def cli_auth_token() -> str | None:
     if not is_running():
         return None
     try:
-        data_dir = p_nine_router_data_dir()
+        data_dir = nine_router_data_dir()
         try:
             with open(os.path.join(data_dir, "machine-id"), encoding="utf-8") as f:
                 machine_id = f.read().strip()
@@ -180,7 +200,6 @@ def p_find_9router_dir() -> str | None:
     p_is_packaged = os.environ.get("OPENSWARM_PACKAGED") == "1"
 
     if p_is_packaged:
-        import sys
         p_resources = os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
         p_candidate = os.path.join(p_resources, "router")
         if os.path.isdir(p_candidate):
@@ -353,6 +372,7 @@ async def ensure_running():
         p_start_lock = asyncio.Lock()
     async with p_start_lock:
         await p_ensure_running_impl()
+    harden_data_dir_permissions()
     # Arm both healers the moment the router becomes a live dependency; users who never route through it never spawn them.
     if is_running():
         start_watchdog()
@@ -365,7 +385,7 @@ def read_persisted_connections() -> list[dict]:
     Empty list on any read problem."""
     try:
         import json as p_json
-        with open(os.path.join(p_nine_router_data_dir(), "db.json"), encoding="utf-8") as f:
+        with open(os.path.join(nine_router_data_dir(), "db.json"), encoding="utf-8") as f:
             db = p_json.load(f)
         return [c for c in (db.get("providerConnections") or []) if isinstance(c, dict)]
     except Exception:
diff --git a/backend/apps/nine_router/subscription_health.py b/backend/apps/nine_router/subscription_health.py
index a805b7cf..ac01ef86 100644
--- a/backend/apps/nine_router/subscription_health.py
+++ b/backend/apps/nine_router/subscription_health.py
@@ -43,6 +43,14 @@ def health_probe_enabled() -> bool:
     return os.environ.get("OPENSWARM_BOOT_HEALTH", "1") != "0"
 
 
+@typechecked
+def invalidate_health_cache() -> None:
+    """Drop the cached verdict after a deliberate connect/disconnect, which makes it stale by definition."""
+    global p_cached_result, p_cached_at
+    p_cached_result = None
+    p_cached_at = 0.0
+
+
 @typechecked
 def classify_auth_dead(status_code: int, body_text: str) -> bool:
     """Dead ONLY on a definitive auth failure; anything ambiguous reads healthy (silence beats a false reconnect prompt)."""
diff --git a/backend/apps/outputs/code_safety.py b/backend/apps/outputs/code_safety.py
new file mode 100644
index 00000000..8c7ddda0
--- /dev/null
+++ b/backend/apps/outputs/code_safety.py
@@ -0,0 +1,226 @@
+"""Static safety gate for user-supplied Output backend code.
+
+`executor.py` owns the subprocess; this file owns the verdict on whether the
+code may run without asking the user first. The gate is allowlist-shaped: code
+may import a data-shaping module and touch its ordinary attributes, and that is
+all. Every other way of getting hold of a module the allowlist withholds (a bare
+handle the sandbox preamble binds, an attribute chain that lands on a module, a
+dunder walk, an attribute name spelled as a string) is a warning, so it reaches
+the user as a consent prompt instead of auto-running.
+"""
+
+import ast
+import importlib
+import types
+from typing import Dict, List, Optional, Set
+
+# Modules backend code is allowed to import. This is not an OS-level jail, so keep the list to "data shaping" libraries; no I/O, no networking, no subprocess. It pairs with cwd=tempdir + minimal env so the blast radius stays small.
+ALLOWED_MODULES = frozenset({
+    "json", "math", "re", "datetime", "collections", "itertools",
+    "functools", "statistics", "decimal", "fractions", "random",
+    "string", "textwrap", "unicodedata", "csv", "copy", "enum",
+    "dataclasses", "typing", "abc", "numbers", "uuid", "hashlib",
+    "base64", "binascii", "operator", "heapq", "bisect", "array",
+})
+
+# Builtins that punch holes through the allowlist or do I/O. Most are also deleted off `builtins` inside the subprocess; exec/compile/__import__ can't be, because the import machinery runs on them.
+P_BLOCKED_BUILTINS = frozenset({
+    "exec", "eval", "compile", "__import__", "open", "input",
+    "breakpoint", "exit", "quit",
+})
+
+# These hand back a live namespace dict, which is every blocked name again through a different door. Warned about but never deleted: library code calls them constantly, and a scrubbed `builtins` would break `import csv` itself.
+P_NAMESPACE_BUILTINS = frozenset({"vars", "globals", "locals"})
+
+# Spell an attribute as a string and the AST can't read it, so these are allowed only with a plain literal that would have passed written out longhand.
+P_DYNAMIC_ATTR_BUILTINS = frozenset({"getattr", "setattr", "delattr"})
+
+# Modules the executor preamble binds into the user's namespace with no import. `json` stays usable (it is allowlisted anyway); these three were the free handles that made the whole allowlist decorative.
+P_SANDBOX_MODULE_HANDLES = frozenset({"sys", "io", "builtins"})
+
+# Dunders that hold a reference to nothing at all, and `if __name__ == "__main__"` is far too common to punish.
+P_INERT_DUNDERS = frozenset({"__name__", "__file__", "__doc__"})
+
+
+class UnsafeCodeError(Exception):
+    """Raised when the static gate rejects user-supplied backend code."""
+
+
+def p_is_dunder(name: str) -> bool:
+    return len(name) > 4 and name.startswith("__") and name.endswith("__")
+
+
+def p_dotted_chain(node: ast.expr) -> Optional[List[str]]:
+    """['json', 'codecs', 'open'] for `json.codecs.open`; None when the chain
+    doesn't start at a plain name."""
+    parts: List[str] = []
+    current: ast.expr = node
+    while isinstance(current, ast.Attribute):
+        parts.append(current.attr)
+        current = current.value
+    if not isinstance(current, ast.Name):
+        return None
+    parts.append(current.id)
+    parts.reverse()
+    return parts
+
+
+def p_resolved_module(chain: List[str], aliases: Dict[str, str]) -> Optional[str]:
+    """The name of the module an attribute chain resolves to, or None if it
+    resolves to something that isn't a module.
+
+    `json.codecs` is a module and `datetime.time` is a class, and only the live
+    object knows which; matching attribute names against a list of module names
+    would flag both. So resolve against the module actually imported. Safe to
+    import here because `aliases` only ever holds allowlisted stdlib roots.
+    """
+    root = aliases.get(chain[0])
+    if root is None:
+        return None
+    try:
+        value: object = importlib.import_module(root)
+        for attr in chain[1:]:
+            value = getattr(value, attr)
+    except Exception:
+        return None
+    return value.__name__ if isinstance(value, types.ModuleType) else None
+
+
+def p_module_aliases(tree: ast.Module) -> Dict[str, str]:
+    """Local name -> allowlisted module it holds. Plain assignment counts, so
+    `m = json` doesn't launder `m.codecs` past the chain check. Modules outside
+    the allowlist are never recorded, which is what keeps the resolver above
+    from importing anything a hostile file names."""
+    aliases: Dict[str, str] = {"json": "json"}
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                root = alias.name.split(".")[0]
+                if root in ALLOWED_MODULES:
+                    aliases[alias.asname or root] = root
+    assigns = [n for n in ast.walk(tree) if isinstance(n, ast.Assign)]
+    for _ in range(len(assigns)):
+        before = len(aliases)
+        for node in assigns:
+            if len(node.targets) != 1 or not isinstance(node.targets[0], ast.Name):
+                continue
+            chain = p_dotted_chain(node.value)
+            resolved = p_resolved_module(chain, aliases) if chain else None
+            if resolved and resolved.split(".")[0] in ALLOWED_MODULES:
+                aliases[node.targets[0].id] = resolved
+        if len(aliases) == before:
+            break
+    return aliases
+
+
+def p_dunder_warning(attr: str, prefix: str) -> Optional[str]:
+    if p_is_dunder(attr) and attr not in P_INERT_DUNDERS:
+        return f"Uses dunder '{prefix}{attr}', which walks the object graph past the allowlist"
+    return None
+
+
+def p_attribute_warning(chain: List[str], aliases: Dict[str, str]) -> Optional[str]:
+    """The verdict on one resolved attribute chain, dunders first."""
+    for attr in chain[1:]:
+        dunder = p_dunder_warning(attr, ".")
+        if dunder:
+            return dunder
+    for depth in range(2, len(chain) + 1):
+        reached = p_resolved_module(chain[:depth], aliases)
+        if reached and reached.split(".")[0] not in ALLOWED_MODULES:
+            return f"Reaches module '{reached}' via '{'.'.join(chain[:depth])}' (outside the safe-data-shaping allowlist)"
+    return None
+
+
+def p_call_warning(node: ast.Call, aliases: Dict[str, str]) -> Optional[str]:
+    if not isinstance(node.func, ast.Name):
+        return None
+    name = node.func.id
+    if name in P_BLOCKED_BUILTINS:
+        return f"Calls builtin '{name}()' which can escape the sandbox"
+    if name in P_NAMESPACE_BUILTINS:
+        return f"Calls '{name}()', which hands back the sandbox's own namespace"
+    if name not in P_DYNAMIC_ATTR_BUILTINS:
+        return None
+    attr = node.args[1] if len(node.args) > 1 else None
+    if not isinstance(attr, ast.Constant) or not isinstance(attr.value, str):
+        return f"Computes an attribute name for '{name}()', which can spell any escape as a string"
+    base = p_dotted_chain(node.args[0])
+    if base is None:
+        return p_dunder_warning(attr.value, ".")
+    return p_attribute_warning(base + [attr.value], aliases)
+
+
+def p_star_import_warning(module: str, aliases: Dict[str, str]) -> Optional[str]:
+    """`from json import *` binds whatever json's __all__ names, which is a
+    short list of functions today but is not ours to assume."""
+    try:
+        imported = importlib.import_module(module)
+    except Exception:
+        return None
+    names = getattr(imported, "__all__", None) or [n for n in dir(imported) if not n.startswith("_")]
+    for name in names:
+        warning = p_attribute_warning([module, str(name)], aliases)
+        if warning:
+            return warning
+    return None
+
+
+def get_code_warnings(code: str) -> List[str]:
+    """Return human-readable warnings for every static risk, without raising.
+
+    `/api/outputs/execute` surfaces these in the run dialog, so an Output that
+    genuinely needs `pandas` gets a "review and click Run Anyway" affordance
+    instead of a silent 500. An empty list is what buys the no-prompt auto-run
+    path, so anything that could reach past the allowlist has to land in it. A
+    syntax error is reported as a warning rather than raised, so the dialog can
+    show it next to the code.
+    """
+    try:
+        tree = ast.parse(code)
+    except SyntaxError as e:
+        return [f"Syntax error: {e}"]
+
+    aliases = p_module_aliases(tree)
+    warnings: List[str] = []
+    seen: Set[str] = set()
+
+    def note(msg: Optional[str]) -> None:
+        if msg and msg not in seen:
+            seen.add(msg)
+            warnings.append(msg)
+
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                if alias.name.split(".")[0] not in ALLOWED_MODULES:
+                    note(f"Imports '{alias.name}' (outside the safe-data-shaping allowlist)")
+        elif isinstance(node, ast.ImportFrom):
+            root = (node.module or "").split(".")[0]
+            if root not in ALLOWED_MODULES:
+                note(f"Imports from '{node.module}' (outside the safe-data-shaping allowlist)")
+                continue
+            for alias in node.names:
+                if alias.name == "*":
+                    note(p_star_import_warning(root, aliases))
+                else:
+                    note(p_attribute_warning([root, alias.name], aliases))
+        elif isinstance(node, ast.Call):
+            note(p_call_warning(node, aliases))
+        elif isinstance(node, ast.Attribute):
+            chain = p_dotted_chain(node)
+            note(p_attribute_warning(chain, aliases) if chain else p_dunder_warning(node.attr, "."))
+        elif isinstance(node, ast.Name):
+            if node.id in P_SANDBOX_MODULE_HANDLES:
+                note(f"References '{node.id}', a live module the sandbox binds but the allowlist withholds")
+            else:
+                note(p_dunder_warning(node.id, ""))
+    return warnings
+
+
+def validate_code_safety(code: str) -> None:
+    """Raise UnsafeCodeError on the first static risk. The strict wrapper around
+    get_code_warnings, for callers with no user to ask."""
+    warnings = get_code_warnings(code)
+    if warnings:
+        raise UnsafeCodeError(warnings[0])
diff --git a/backend/apps/outputs/executor.py b/backend/apps/outputs/executor.py
index 51167376..c79da34b 100644
--- a/backend/apps/outputs/executor.py
+++ b/backend/apps/outputs/executor.py
@@ -1,4 +1,3 @@
-import ast
 import asyncio
 import json
 import logging
@@ -7,88 +6,13 @@ import sys
 import tempfile
 from dataclasses import dataclass
 
+from backend.apps.outputs.code_safety import ALLOWED_MODULES, validate_code_safety
+
 logger = logging.getLogger(__name__)
 
 TIMEOUT_SECONDS = 30
 
-# Modules backend code is allowed to import. Trade-off: a determined attacker can find ways around this (e.g. string-encoded imports via tricks the AST validator can't see), but the allowlist kills the easy paths cheaply and pairs with cwd=tempdir + minimal env so the blast radius is small even if a payload slips past. Keep this list to "data shaping" libraries; no I/O, no networking, no subprocess.
-P_ALLOWED_MODULES = frozenset({
-    "json", "math", "re", "datetime", "collections", "itertools",
-    "functools", "statistics", "decimal", "fractions", "random",
-    "string", "textwrap", "unicodedata", "csv", "copy", "enum",
-    "dataclasses", "typing", "abc", "numbers", "uuid", "hashlib",
-    "base64", "binascii", "operator", "heapq", "bisect", "array",
-})
-
-# Builtin functions that punch holes through the allowlist or do I/O. Direct calls (e.g. `eval(...)`) are caught here. Attribute-style calls (`__builtins__.eval(...)`) are blocked by the preamble's `delattr` loop in the subprocess.
-P_BLOCKED_BUILTINS = frozenset({
-    "exec", "eval", "compile", "__import__", "open", "input",
-    "breakpoint", "exit", "quit",
-})
-
-
-class UnsafeCodeError(Exception):
-    """Raised when AST validation rejects user-supplied backend code."""
-
-
-def get_code_warnings(code: str) -> list[str]:
-    """Return human-readable warnings for AST-visible risks, without raising.
-
-    Used by `/api/outputs/execute` to surface risks to the user in the run
-    dialog before executing; so a legit Output that needs `pandas` doesn't
-    silently 500 with "import not allowed," it gets a "this Output uses
-    unsafe imports; review and click Run Anyway" affordance.
-
-    Returns [] for code that's fully inside the allowlist. A syntax error
-    is reported as a single warning rather than raised so the dialog can
-    show it next to the code.
-    """
-    try:
-        tree = ast.parse(code)
-    except SyntaxError as e:
-        return [f"Syntax error: {e}"]
-
-    warnings: list[str] = []
-    seen: set[str] = set()
-    for node in ast.walk(tree):
-        if isinstance(node, ast.Import):
-            for alias in node.names:
-                root = alias.name.split(".")[0]
-                if root not in P_ALLOWED_MODULES:
-                    msg = f"Imports '{alias.name}' (outside the safe-data-shaping allowlist)"
-                    if msg not in seen:
-                        seen.add(msg)
-                        warnings.append(msg)
-        elif isinstance(node, ast.ImportFrom):
-            if node.module:
-                root = node.module.split(".")[0]
-                if root not in P_ALLOWED_MODULES:
-                    msg = f"Imports from '{node.module}' (outside the safe-data-shaping allowlist)"
-                    if msg not in seen:
-                        seen.add(msg)
-                        warnings.append(msg)
-        elif isinstance(node, ast.Call):
-            if isinstance(node.func, ast.Name) and node.func.id in P_BLOCKED_BUILTINS:
-                msg = f"Calls builtin '{node.func.id}()' which can escape the sandbox"
-                if msg not in seen:
-                    seen.add(msg)
-                    warnings.append(msg)
-    return warnings
-
-
-def p_validate_code_safety(code: str) -> None:
-    """Raise UnsafeCodeError on the first AST-visible risk. Thin wrapper
-    around get_code_warnings for callers that want the strict-reject
-    behavior (the default `execute_backend_code` path). Callers that want
-    to show warnings to a user and let them override should call
-    get_code_warnings directly and pass `skip_validation=True` to
-    execute_backend_code."""
-    warnings = get_code_warnings(code)
-    if warnings:
-        raise UnsafeCodeError(warnings[0])
-
-
-# Env vars we always scrub from the subprocess, regardless of strict-vs-force. These are the keys an attacker would actually want; install token, provider API keys, cloud credentials. Everything else is local-machine convenience.
+# Env vars we always scrub from the subprocess, approved or not. These are the keys an attacker would actually want; install token, provider API keys, cloud credentials. Everything else is local-machine convenience.
 P_SCRUBBED_ENV_KEYS = frozenset({
     "OPENSWARM_AUTH_TOKEN",
     "ANTHROPIC_API_KEY",
@@ -106,24 +30,23 @@ P_SCRUBBED_ENV_KEYS = frozenset({
 })
 
 
-def p_minimal_env(force: bool = False) -> dict:
+def exec_env(approved: bool = False) -> dict:
     """Build the env for the executor subprocess.
 
-    Strict mode (force=False): only language essentials. AST-validated code
-    is data-shaping only; `import os` and `open()` are blocked, so the
-    subprocess can't read env vars or expand `~` anyway. Minimal env is
-    correct here.
+    Sandboxed (approved=False): only language essentials. Gate-passing code is
+    data-shaping only; `import os` and `open()` are blocked, so the subprocess
+    can't read env vars or expand `~` anyway. No PATH, no HOME.
 
-    Force mode (force=True): user has explicitly approved unsafe imports
-    via the HITL preview. They expect the code to behave like a normal
-    Python process; read HOME, find files, etc. Inherit the real env
-    minus credentials, so an `open(os.path.expanduser("~/data.csv"))`
-    actually works instead of silently misbehaving.
+    Approved (approved=True): the user has explicitly okayed unsafe imports via
+    the HITL preview. They expect the code to behave like a normal Python
+    process; read HOME, find files, etc. Inherit the real env minus credentials,
+    so an `open(os.path.expanduser("~/data.csv"))` actually works instead of
+    silently misbehaving.
 
-    Both modes scrub P_SCRUBBED_ENV_KEYS so even force-mode code never
-    sees the install token or provider API keys.
+    Both modes scrub P_SCRUBBED_ENV_KEYS so even approved code never sees the
+    install token or provider API keys.
     """
-    if force:
+    if approved:
         env = {k: v for k, v in os.environ.items() if k not in P_SCRUBBED_ENV_KEYS}
         env["PYTHONDONTWRITEBYTECODE"] = "1"
         # Force UTF-8 even if the parent somehow lacked it (dev mode where Electron didn't inject PYTHONUTF8). Without this, a child reading non-ASCII stdin/files on a cp1252 Windows machine raises UnicodeDecodeError, the "works on my laptop, not theirs" failure.
@@ -146,6 +69,30 @@ def p_minimal_env(force: bool = False) -> dict:
     return env
 
 
+# The subprocess bootstrap: capture stdout, read the input, and hand the code a `result` to fill. Bound objects rather than modules carry the answer back out, so the hardening below can take the modules away.
+P_PREAMBLE = (
+    "import json, sys, io, builtins\n"
+    "p_stdout = sys.stdout\n"
+    "p_capture = io.StringIO()\n"
+    "sys.stdout = p_capture\n"
+    "input_data = json.loads(sys.stdin.read())\n"
+    "result = {}\n"
+)
+# Warm the allowlist BEFORE scrubbing builtins, because half the stdlib borrows the builtins the scrub deletes while it loads (tokenize does `from builtins import open`, which is how `import dataclasses` dies). Warm imports are cache hits, so gate-passing code never touches the loader again. Then the module handles go: leaving `sys` bound handed gate-passing code a live `sys.modules['os']` with no import statement in sight. exec/eval/compile/__import__ stay put whatever we'd like: the import statement, the loader and namedtuple all run on them, and calling them by name is a static-gate warning anyway.
+P_SANDBOX_HARDENING = (
+    f"for p_name in {tuple(sorted(ALLOWED_MODULES))!r}:\n"
+    "    try: __import__(p_name)\n"
+    "    except ImportError: pass\n"
+    "for p_name in ('open','input','breakpoint','exit','quit'):\n"
+    "    try: delattr(builtins, p_name)\n"
+    "    except AttributeError: pass\n"
+    "del sys, io, builtins, p_name\n"
+)
+P_POSTAMBLE = (
+    "\np_stdout.write(json.dumps({\"__stdout__\": p_capture.getvalue(), \"__result__\": result}))\n"
+)
+
+
 @dataclass
 class BackendExecResult:
     result: dict
@@ -154,7 +101,7 @@ class BackendExecResult:
 
 
 async def execute_backend_code(
-    code: str, input_data: dict, *, skip_validation: bool = False
+    code: str, input_data: dict, *, approved: bool = False
 ) -> BackendExecResult:
     """Execute user-provided Python code in a subprocess.
 
@@ -163,39 +110,23 @@ async def execute_backend_code(
     separately from the result via an in-process StringIO redirect.
 
     Security boundaries (defense in depth; none alone is sufficient):
-      1. AST allowlist on imports + blocked-builtin call list.
+      1. The static gate in code_safety.py, on every run that isn't approved.
       2. Subprocess cwd = fresh temp dir (not the OpenSwarm process cwd).
       3. Subprocess env strips PATH, all *TOKEN / *_API_KEY inheritance.
-      4. Preamble scrubs dangerous attrs off `builtins` inside the subprocess
-         to catch AST-bypass tricks (e.g. metaclass shenanigans).
+      4. Preamble scrubs the I/O builtins and drops the module handles it
+         needed, so gate-passing code starts with no reachable module.
       5. 30s wall-clock timeout, killed on overrun.
 
-    `skip_validation=True` bypasses #1; intended ONLY for callers that
-    have already surfaced the warnings to a user and gotten explicit
-    consent (the `/api/outputs/execute` HITL flow). #2, #5 always run.
+    `approved=True` means a user saw the warnings and clicked Run Anyway, and
+    it relaxes 1, 3 and 4 together. It is the ONLY thing that relaxes them: a
+    caller that has already run the gate itself still gets the sandbox, because
+    "we checked" must never be the reason the walls come down.
     """
 
-    if not skip_validation:
-        p_validate_code_safety(code)
+    if not approved:
+        validate_code_safety(code)
 
-    preamble = (
-        "import json, sys, io, builtins\n"
-        # Defense-in-depth: scrub dangerous attrs off `builtins` so attribute-style accesses (metaclass.__subclasses__ chains) can't reach them. NOTE: __import__ is deliberately NOT scrubbed, Python's `import` statement bytecode reads `__import__` from builtins, so removing it makes EVERY import (including allowlisted ones like `import math`) fail with "ImportError: __import__ not found". The AST allowlist on the host is what blocks `import subprocess`; the per-subprocess scrub just plugs the named-builtin attack vectors that the AST can't see (eval/exec via attribute access on objects, etc.).
-        "for _b in ('exec','eval','compile','open','input',\n"
-        "           'breakpoint','exit','quit'):\n"
-        "    try: delattr(builtins, _b)\n"
-        "    except AttributeError: pass\n"
-        "_orig_stdout = sys.stdout\n"
-        "_capture = io.StringIO()\n"
-        "sys.stdout = _capture\n"
-        "input_data = json.loads(sys.stdin.read())\n"
-        "result = {}\n"
-    )
-    postamble = (
-        "\nsys.stdout = _orig_stdout\n"
-        'json.dump({"__stdout__": _capture.getvalue(), "__result__": result}, sys.stdout)\n'
-    )
-    wrapper = preamble + code + postamble
+    wrapper = P_PREAMBLE + ("" if approved else P_SANDBOX_HARDENING) + code + P_POSTAMBLE
 
     with tempfile.TemporaryDirectory(prefix="openswarm-exec-") as workdir:
         proc = await asyncio.create_subprocess_exec(
@@ -204,7 +135,7 @@ async def execute_backend_code(
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
             cwd=workdir,
-            env=p_minimal_env(force=skip_validation),
+            env=exec_env(approved=approved),
         )
 
         try:
diff --git a/backend/apps/outputs/outputs.py b/backend/apps/outputs/outputs.py
index 51c480a4..930d4f1a 100644
--- a/backend/apps/outputs/outputs.py
+++ b/backend/apps/outputs/outputs.py
@@ -15,7 +15,8 @@ from backend.apps.outputs.models import (
     PublishPreflightRequest, PublishRequest, PublishPreflightResponse,
     PublishResult, PublishReview,
 )
-from backend.apps.outputs.executor import execute_backend_code, get_code_warnings
+from backend.apps.outputs.code_safety import get_code_warnings
+from backend.apps.outputs.executor import execute_backend_code
 from backend.apps.outputs.publish_common import slugify, PublishError
 from backend.apps.outputs.publish_scan import scan_for_publish, quick_ast_gate
 from backend.apps.outputs.publish_build import build_static, collect_bundle
@@ -41,7 +42,9 @@ from backend.apps.outputs.workspace_io import (
     save,
     load,
     load_output,
+    resolve_in_workspace,
     walk_directory,
+    workspace_root,
     would_shrink_oversize_file,
 )
 from backend.apps.outputs.prompts import VIBE_CODE_SYSTEM_PROMPT
@@ -53,6 +56,12 @@ logger = logging.getLogger(__name__)
 async def outputs_lifespan():
     os.makedirs(DATA_DIR, exist_ok=True)
     os.makedirs(WORKSPACE_DIR, exist_ok=True)
+    # One-time sweep: an app whose record vanished still has its work on disk, and no way for the user to know it is there.
+    try:
+        from backend.apps.outputs.recover_orphaned_apps import recover_orphaned_apps
+        recover_orphaned_apps()
+    except Exception:
+        logger.exception("orphaned-app recovery failed; apps stay hidden but nothing else breaks")
     try:
         yield
     finally:
@@ -75,8 +84,8 @@ outputs = SubApp("outputs", outputs_lifespan)
 async def serve_workspace_file(workspace_id: str, filepath: str, p_d: str = ""):
     """Serve a file from a workspace folder. For index.html, inject OUTPUT data."""
     folder = os.path.join(WORKSPACE_DIR, workspace_id)
-    full_path = os.path.normpath(os.path.join(folder, filepath))
-    if not full_path.startswith(os.path.normpath(folder)):
+    full_path = resolve_in_workspace(folder, filepath)
+    if full_path is None:
         raise HTTPException(status_code=403, detail="Path traversal not allowed")
     if not os.path.isfile(full_path):
         raise HTTPException(status_code=404, detail="File not found")
@@ -362,8 +371,8 @@ async def seed_workspace(body: WorkspaceSeedRequest):
     # Legacy flat path. Seed only fills in MISSING files; it never overwrites what's already on disk. A reopen re-sends the inline output.files snapshot, which lags behind whatever the agent just wrote to the workspace; writing it back reverted every edited file (new files survived, edited ones snapped to the snapshot). Disk wins once an app exists.
     if body.files:
         for rel_path, content in body.files.items():
-            full_path = os.path.normpath(os.path.join(folder, rel_path))
-            if not full_path.startswith(os.path.normpath(folder)):
+            full_path = resolve_in_workspace(folder, rel_path)
+            if full_path is None:
                 continue
             if os.path.exists(full_path):
                 continue
@@ -523,10 +532,8 @@ async def write_workspace_file(workspace_id: str, filepath: str, body: dict):
     folder = os.path.join(WORKSPACE_DIR, workspace_id)
     if not os.path.isdir(folder):
         raise HTTPException(status_code=404, detail="Workspace not found")
-    folder_norm = os.path.normpath(folder)
-    full_path = os.path.normpath(os.path.join(folder, filepath))
-    # `startswith(folder_norm + os.sep)` (not just folder_norm) so a workspace `abc-123` can't be tricked into writing into a sibling `abc-1234-evil`, prefix-string collision rather than path-component containment. Today's UUID-format ids make the collision unlikely in practice, but the check is one character and immunizes future id schemes.
-    if full_path != folder_norm and not full_path.startswith(folder_norm + os.sep):
+    full_path = resolve_in_workspace(folder, filepath)
+    if full_path is None:
         raise HTTPException(status_code=403, detail="Path traversal not allowed")
     content = body.get("content", "")
     if would_shrink_oversize_file(full_path, content):
@@ -543,14 +550,14 @@ async def delete_workspace_file(workspace_id: str, filepath: str):
     folder = os.path.join(WORKSPACE_DIR, workspace_id)
     if not os.path.isdir(folder):
         raise HTTPException(status_code=404, detail="Workspace not found")
-    folder_norm = os.path.normpath(folder)
-    full_path = os.path.normpath(os.path.join(folder, filepath))
-    if full_path != folder_norm and not full_path.startswith(folder_norm + os.sep):
+    full_path = resolve_in_workspace(folder, filepath)
+    if full_path is None:
         raise HTTPException(status_code=403, detail="Path traversal not allowed")
     if os.path.isfile(full_path):
         os.remove(full_path)
+        root = workspace_root(folder)
         parent = os.path.dirname(full_path)
-        while parent != os.path.normpath(folder):
+        while parent != root:
             if os.path.isdir(parent) and not os.listdir(parent):
                 os.rmdir(parent)
                 parent = os.path.dirname(parent)
@@ -723,9 +730,9 @@ async def execute_output(body: OutputExecute):
                 code_preview = output.backend_code
         if not warnings_out:
             try:
-                # We've either already vetted (no warnings above) or the user explicitly opted in with force=True. Pass skip_validation=True so we don't pay for a redundant AST walk inside execute_backend_code.
+                # `approved` is body.force alone: code that merely passed the gate above still runs sandboxed, because a clean scan is not consent.
                 exec_result = await execute_backend_code(
-                    output.backend_code, body.input_data, skip_validation=True
+                    output.backend_code, body.input_data, approved=bool(body.force)
                 )
                 backend_result = exec_result.result
                 stdout_text = exec_result.stdout
diff --git a/backend/apps/outputs/publish_cloud.py b/backend/apps/outputs/publish_cloud.py
index 09f1cc39..d35c4a0d 100644
--- a/backend/apps/outputs/publish_cloud.py
+++ b/backend/apps/outputs/publish_cloud.py
@@ -3,18 +3,10 @@ it back down. Reads the bearer directly (publish works for any signed-in account
 not just pro/free-trial), matching the cloud's requireAuthedUser gate."""
 from __future__ import annotations
 
-from typing import Optional
-
 import httpx
 
 from backend.apps.outputs.publish_common import PublishError
-from backend.apps.settings.credentials import OPENSWARM_DEFAULT_PROXY_URL
-
-
-def p_cloud_auth(settings) -> tuple[Optional[str], str]:
-    base = (getattr(settings, "openswarm_proxy_url", None) or OPENSWARM_DEFAULT_PROXY_URL).rstrip("/")
-    token = getattr(settings, "openswarm_bearer_token", None)
-    return token, base
+from backend.apps.settings.credentials import account_auth
 
 
 def p_safe_detail(resp: httpx.Response, fallback: str) -> str:
@@ -31,7 +23,7 @@ def p_safe_detail(resp: httpx.Response, fallback: str) -> str:
 async def upload_to_cloud(
     settings, *, output_id: str, name: str, slug_hint: str, bundle: bytes, override: bool
 ) -> dict:
-    token, base = p_cloud_auth(settings)
+    token, base = account_auth(settings)
     if not token:
         raise PublishError("Sign in to your OpenSwarm account to publish apps.")
     try:
@@ -51,7 +43,7 @@ async def upload_to_cloud(
 
 
 async def unpublish_from_cloud(settings, slug: str) -> None:
-    token, base = p_cloud_auth(settings)
+    token, base = account_auth(settings)
     if not token:
         raise PublishError("Sign in to your OpenSwarm account to manage published apps.")
     try:
diff --git a/backend/apps/outputs/publish_scan.py b/backend/apps/outputs/publish_scan.py
index a9ca3829..d74794fa 100644
--- a/backend/apps/outputs/publish_scan.py
+++ b/backend/apps/outputs/publish_scan.py
@@ -15,7 +15,7 @@ import os
 from collections import OrderedDict
 from typing import Literal
 
-from backend.apps.outputs.executor import get_code_warnings
+from backend.apps.outputs.code_safety import get_code_warnings
 from backend.apps.outputs.models import Output, PublishReview
 from backend.apps.outputs.publish_common import is_webapp, workspace_dir
 from backend.apps.outputs.workspace_io import WALK_SKIP_DIRS
diff --git a/backend/apps/outputs/recover_orphaned_apps.py b/backend/apps/outputs/recover_orphaned_apps.py
new file mode 100644
index 00000000..28417686
--- /dev/null
+++ b/backend/apps/outputs/recover_orphaned_apps.py
@@ -0,0 +1,105 @@
+"""Bring back apps whose workspace survived but whose record did not.
+
+An app is two things: an Output record and a workspace folder. The record is what makes it appear;
+the folder is what holds the work. Lose the record and the work is still on disk, completely
+invisible, with no way for the user to know it is there.
+
+Only workspaces that hold REAL work come back. A workspace whose meta.json says "Untitled App", or
+has none at all, is a template seed that was created and never used; resurrecting those would hand
+every user a pile of empty cards, which is a worse product than the bug.
+
+This runs once ever, behind a marker. Deleting an app leaves its workspace behind, so a recovery
+that ran on every boot would make deletion impossible: the app would return the next morning.
+"""
+
+import json
+import logging
+import os
+from typing import List, Optional
+
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from backend.apps.outputs.models import Output
+from backend.config.paths import DATA_ROOT, OUTPUTS_WORKSPACE_DIR
+
+logger = logging.getLogger(__name__)
+
+P_MARKER = os.path.join(DATA_ROOT, "orphan_app_recovery.done")
+# What the seeder writes before a user has named anything, so it means "never used", not "an app".
+P_PLACEHOLDER_NAMES = {"untitled app", "untitled", ""}
+
+
+class RecoveryReport(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    scanned: int = 0
+    recovered: List[str] = []
+    skipped_unused: int = 0
+
+
+@typechecked
+def p_real_name(workspace_dir: str) -> Optional[str]:
+    """The app's own name, or None when this workspace was never actually used."""
+    meta = os.path.join(workspace_dir, "meta.json")
+    if not os.path.isfile(meta):
+        return None
+    try:
+        with open(meta, encoding="utf-8") as f:
+            data = json.load(f)
+    except (OSError, ValueError):
+        return None
+    name = data.get("name")
+    if not isinstance(name, str) or name.strip().lower() in P_PLACEHOLDER_NAMES:
+        return None
+    return name.strip()
+
+
+@typechecked
+def p_description(workspace_dir: str) -> str:
+    meta = os.path.join(workspace_dir, "meta.json")
+    try:
+        with open(meta, encoding="utf-8") as f:
+            desc = json.load(f).get("description")
+        return desc if isinstance(desc, str) else ""
+    except (OSError, ValueError):
+        return ""
+
+
+@typechecked
+def recover_orphaned_apps(force: bool = False) -> RecoveryReport:
+    """Re-register orphaned workspaces that hold real work. Runs once unless forced."""
+    report = RecoveryReport()
+    # Cheap checks BEFORE the import: this runs on every boot and pays for itself exactly once.
+    if not force and os.path.exists(P_MARKER):
+        return report
+    if not os.path.isdir(OUTPUTS_WORKSPACE_DIR):
+        return report
+    from backend.apps.outputs.workspace_io import load_all, save
+
+    claimed = {o.workspace_id for o in load_all() if o.workspace_id}
+    for entry in sorted(os.listdir(OUTPUTS_WORKSPACE_DIR)):
+        path = os.path.join(OUTPUTS_WORKSPACE_DIR, entry)
+        if not os.path.isdir(path) or entry in claimed:
+            continue
+        report.scanned += 1
+        name = p_real_name(path)
+        if name is None:
+            report.skipped_unused += 1
+            continue
+        try:
+            save(Output(name=name, description=p_description(path), workspace_id=entry))
+        except Exception:
+            logger.warning("could not re-register orphaned app workspace %s", entry, exc_info=True)
+            continue
+        report.recovered.append(name)
+
+    if report.recovered:
+        logger.info("recovered %d orphaned app(s): %s", len(report.recovered), ", ".join(report.recovered))
+    try:
+        os.makedirs(os.path.dirname(P_MARKER), exist_ok=True)
+        with open(P_MARKER, "w", encoding="utf-8") as f:
+            f.write(json.dumps({"recovered": report.recovered, "skipped_unused": report.skipped_unused}))
+    except OSError:
+        logger.warning("could not write the app-recovery marker; it may run again", exc_info=True)
+    return report
diff --git a/backend/apps/outputs/workspace_io.py b/backend/apps/outputs/workspace_io.py
index d9347bcb..c93f711e 100644
--- a/backend/apps/outputs/workspace_io.py
+++ b/backend/apps/outputs/workspace_io.py
@@ -3,6 +3,7 @@ the workspace file-tree walk used by the polling read endpoint."""
 
 import logging
 import os
+from typing import Optional
 
 from fastapi import HTTPException
 
@@ -58,6 +59,29 @@ def app_workspace_dir(output_id: str) -> str | None:
     return path if os.path.isdir(path) else None
 
 
+def workspace_root(folder: str) -> str:
+    """The canonical form of a workspace folder. Every containment check and
+    every path handed back to a caller is anchored here."""
+    return os.path.realpath(folder)
+
+
+def resolve_in_workspace(folder: str, relative_path: str) -> Optional[str]:
+    """Resolve `relative_path` under workspace `folder`, or None if it escapes.
+
+    The single containment guard for every workspace read/write/delete.
+    `realpath`, never `normpath`: normpath is string math that strolls straight
+    through a symlink pointing out of the workspace. Both sides are resolved so
+    a symlinked ancestor (macOS `/var` -> `/private/var`, every tempdir) doesn't
+    reject a legitimate file. It also compares whole path COMPONENTS, not
+    strings: without the trailing separator, workspace `abc` owns `abc-evil`.
+    """
+    root = workspace_root(folder)
+    target = os.path.realpath(os.path.join(root, relative_path))
+    if target != root and not target.startswith(root + os.sep):
+        return None
+    return target
+
+
 # Build/install/cache directories that the polling endpoint must never descend into. Without this skip-list the workspace endpoint reads `node_modules/` (300 MB of MUI source, when it's a real dir and not a symlink), `.venv/` (10k+ Python files from the hardlinked cache), `__pycache__/`, `dist/`, `.git/`, etc; every 2 seconds while the agent is active. Result: backend CPU pegged on JSON-serializing auto-generated chunks the frontend will then throw away. The frontend already filters these for display; this skip is the real fix.
 WALK_SKIP_DIRS = frozenset({
     "node_modules",
diff --git a/backend/apps/settings/credentials.py b/backend/apps/settings/credentials.py
index 8b0cec02..4f1d20e7 100644
--- a/backend/apps/settings/credentials.py
+++ b/backend/apps/settings/credentials.py
@@ -28,6 +28,15 @@ def proxy_auth(settings: AppSettings) -> tuple[str | None, str | None]:
     return (None, None)
 
 
+def account_auth(settings: AppSettings) -> tuple[str | None, str]:
+    """(bearer, base_url) for cloud routes that identify the ACCOUNT rather than
+    route LLM traffic: publishing, hosted workflows, anything behind the cloud's
+    requireAuthedUser. Deliberately ignores connection_mode, because a signed-in
+    own-key user still has a real account. Bearer is None when signed out."""
+    base = (getattr(settings, "openswarm_proxy_url", None) or OPENSWARM_DEFAULT_PROXY_URL).rstrip("/")
+    return (getattr(settings, "openswarm_bearer_token", None) or None, base)
+
+
 def p_check_9router() -> bool:
     """Check if 9Router is running locally."""
     try:
diff --git a/backend/apps/settings/models.py b/backend/apps/settings/models.py
index a504dc18..46c77ae9 100644
--- a/backend/apps/settings/models.py
+++ b/backend/apps/settings/models.py
@@ -52,6 +52,8 @@ class AppSettings(BaseModel):
     # None = platform default (Cmd/Ctrl+Shift+D); parts format matches new_agent_shortcut.
     dictation_shortcut: Optional[str] = None
     voice_hold_to_talk: bool = True
+    # Whisper model id from the desktop catalog (electron/voice/whisperModels.js); None = its default.
+    dictation_model: Optional[str] = None
     anthropic_api_key: Optional[str] = None
     browser_homepage: str = "https://www.google.com"
     # Opt-in: let a blocked browser agent borrow the sign-in you already have in your everyday
diff --git a/backend/apps/skills/skills.py b/backend/apps/skills/skills.py
index 85678095..1f0d6ff6 100644
--- a/backend/apps/skills/skills.py
+++ b/backend/apps/skills/skills.py
@@ -395,12 +395,12 @@ def clear_skill_dir(skill_id: str) -> None:
     """Empty a skill's folder before an in-place update so files removed upstream
     don't linger as orphans. write_folder_skill recreates the dir right after."""
     import shutil
-    d = os.path.join(SKILLS_DIR, p_safe_slug(skill_id))
+    d = os.path.join(SKILLS_DIR, safe_slug(skill_id))
     if os.path.isdir(d):
         shutil.rmtree(d, ignore_errors=True)
 
 
-def p_safe_slug(raw: str) -> str:
+def safe_slug(raw: str) -> str:
     slug = re.sub(r"[^a-zA-Z0-9_-]+", "-", (raw or "").strip().lower()).strip("-")
     return slug or "skill"
 
@@ -417,7 +417,7 @@ def unique_skill_slug(base: str) -> str:
     """A free slug for `base`, suffixing -2, -3, ... on collision. Lets a
     registry install land beside a same-named skill instead of silently
     overwriting the user's existing one."""
-    slug = p_safe_slug(base)
+    slug = safe_slug(base)
     if not p_skill_exists(slug):
         return slug
     i = 2
@@ -432,7 +432,7 @@ def write_folder_skill(skill_id: str, files: dict[str, str], meta: dict) -> Skil
     zip/.swarm import. Relpaths that try to escape the skill folder (../, abs
     paths) are dropped, an untrusted registry archive can't write outside its
     own dir."""
-    slug = p_safe_slug(skill_id)
+    slug = safe_slug(skill_id)
     base = os.path.join(SKILLS_DIR, slug)
     base_abs = os.path.abspath(base)
     # A folder write supersedes any legacy flat <slug>.md, so we never leave a phantom flat file shadowed by the folder (folder wins in skill_md_path).
diff --git a/backend/apps/swarm/scan_app_files.py b/backend/apps/swarm/scan_app_files.py
index 98313fea..2fe872de 100644
--- a/backend/apps/swarm/scan_app_files.py
+++ b/backend/apps/swarm/scan_app_files.py
@@ -6,7 +6,7 @@ user choosing to open/run the app and the flat-app /execute HITL. A full semanti
 LLM scan is the separate App Publishing feature, not this."""
 from __future__ import annotations
 
-from backend.apps.outputs.executor import get_code_warnings
+from backend.apps.outputs.code_safety import get_code_warnings
 
 from backend.apps.swarm.models import ReviewSummary
 
diff --git a/backend/apps/web/cascade.py b/backend/apps/web/cascade.py
new file mode 100644
index 00000000..16229271
--- /dev/null
+++ b/backend/apps/web/cascade.py
@@ -0,0 +1,62 @@
+"""Deadline-bounded tier runner shared by /api/web/search and /api/web/fetch.
+
+The cascades used to sum their per-tier leashes to 244s (search) and 270s
+(fetch) while the MCP shim calling them gave up at 45s, so the later tiers
+could never run at all: whether a search worked came down to whether an early
+tier happened to win the race before the client-side guillotine. One wall-clock
+deadline for the whole cascade makes that unrepresentable. A tier can only ever
+spend what is LEFT of the budget, so a slow tier cannot starve the ones behind
+it, and the endpoint always answers within the deadline."""
+
+import asyncio
+from typing import Awaitable, Callable, Dict, List, Optional
+
+from pydantic import BaseModel, ConfigDict, Field, InstanceOf
+from typeguard import typechecked
+
+# A tier handed less than this has no realistic chance, and reporting it as a timeout would be a lie; we say the budget ran out instead.
+MIN_TIER_SECONDS = 3.0
+
+
+class CascadeTier(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    name: str
+    run: InstanceOf[Callable[[], Awaitable[Optional[Dict]]]]
+    budget: float
+
+
+class CascadeOutcome(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    result: Optional[Dict] = None
+    errors: List[str] = Field(default_factory=list)
+
+
+@typechecked
+async def run_cascade(tiers: List[CascadeTier], total_budget: float) -> CascadeOutcome:
+    """Run tiers in order until one returns a result or the budget is gone."""
+    loop = asyncio.get_running_loop()
+    deadline = loop.time() + total_budget
+    errors: List[str] = []
+
+    for tier in tiers:
+        remaining = deadline - loop.time()
+        if remaining < MIN_TIER_SECONDS:
+            skipped = [t.name for t in tiers[tiers.index(tier):]]
+            errors.append(
+                f"{total_budget:.0f}s cascade budget spent; not attempted: {', '.join(skipped)}"
+            )
+            break
+        slice_seconds = min(tier.budget, remaining)
+        try:
+            result = await asyncio.wait_for(tier.run(), timeout=slice_seconds)
+        except asyncio.TimeoutError:
+            errors.append(f"{tier.name}: timed out after {slice_seconds:.0f}s")
+        except Exception as exc:
+            errors.append(f"{tier.name}: {str(exc)[:150]}")
+        else:
+            if result is not None:
+                return CascadeOutcome(result=result, errors=errors)
+
+    return CascadeOutcome(result=None, errors=errors)
diff --git a/backend/apps/web/grounded.py b/backend/apps/web/grounded.py
new file mode 100644
index 00000000..d3c9382c
--- /dev/null
+++ b/backend/apps/web/grounded.py
@@ -0,0 +1,265 @@
+"""Provider-grounded search/fetch backends for the /api/web cascade.
+
+These are the PAID tiers: the user's own Gemini / OpenAI key, or the same
+providers reached through a 9Router subscription. They are slow (tens of
+seconds) but render and reason over pages, so they sit behind the free
+keyless tiers and only run when those come up empty."""
+
+import time
+from typing import Dict, List, Optional, Set, Tuple
+
+import httpx
+from typeguard import typechecked
+
+GEMINI_API_BASE = "https://generativelanguage.googleapis.com/v1beta"
+GEMINI_GROUNDING_MODEL = "gemini-2.5-flash"  # cheapest + fastest for grounded calls
+
+OPENAI_API_BASE = "https://api.openai.com/v1"
+OPENAI_SEARCH_MODEL = "gpt-5-mini"  # cheapest model that supports web_search_preview
+
+NINE_ROUTER_MESSAGES_URL = "http://localhost:20128/v1/messages"
+
+
+@typechecked
+async def gemini_grounded_call(api_key: str, prompt: str, *, use_url_context: bool) -> Dict:
+    """Call Gemini with googleSearch (+ optionally urlContext) grounding.
+
+    Returns {"text": grounded_answer, "chunks": [(title, uri), ...],
+             "queries": [...]} or raises httpx.HTTPError on failure.
+    """
+    tools: List[Dict] = [{"googleSearch": {}}]
+    if use_url_context:
+        tools.append({"urlContext": {}})
+    body = {
+        "contents": [{"role": "user", "parts": [{"text": prompt}]}],
+        "tools": tools,
+        "generationConfig": {"thinkingConfig": {"thinkingBudget": 0}},
+    }
+    url = f"{GEMINI_API_BASE}/models/{GEMINI_GROUNDING_MODEL}:generateContent"
+    async with httpx.AsyncClient(timeout=45.0) as client:
+        r = await client.post(
+            url,
+            headers={"x-goog-api-key": api_key, "Content-Type": "application/json"},
+            json=body,
+        )
+        r.raise_for_status()
+        data = r.json()
+
+    cand = (data.get("candidates") or [{}])[0]
+    text = "".join(
+        p.get("text", "") for p in (cand.get("content", {}).get("parts") or [])
+        if isinstance(p, dict)
+    )
+    gm = cand.get("groundingMetadata") or {}
+    chunks: List[Tuple[str, str]] = []
+    for gc in (gm.get("groundingChunks") or []):
+        web = (gc or {}).get("web") or {}
+        uri = web.get("uri") or web.get("url") or ""
+        title = web.get("title") or uri
+        if uri:
+            chunks.append((title, uri))
+    queries = gm.get("webSearchQueries") or []
+    return {"text": text, "chunks": chunks, "queries": queries}
+
+
+@typechecked
+def format_grounded_as_search_results(grounded: Dict, query: str) -> str:
+    """Format Gemini grounding output to match WebSearchTool's text shape."""
+    lines: List[str] = []
+    chunks = grounded.get("chunks") or []
+    for i, (title, uri) in enumerate(chunks[:10], start=1):
+        lines.append(f"[{i}] {title}\n    {uri}")
+    text = grounded.get("text") or ""
+    if text:
+        lines.append("\n" + text)
+    if not lines:
+        return f"No search results found for: {query}"
+    return "\n\n".join(lines)
+
+
+@typechecked
+def format_grounded_as_fetch(grounded: Dict, url: str) -> str:
+    """Format Gemini urlContext output to match WebFetchTool's text shape."""
+    parts = [f"Contents of {url}:", ""]
+    text = grounded.get("text") or ""
+    if text:
+        parts.append(text)
+    chunks = grounded.get("chunks") or []
+    if chunks:
+        parts.append("\nCited sources:")
+        for i, (title, uri) in enumerate(chunks[:5], start=1):
+            parts.append(f"  [{i}] {title}; {uri}")
+    return "\n".join(parts)
+
+
+@typechecked
+def resolve_gemini_api_key() -> Optional[str]:
+    """Pull the AI Studio API key from settings, or None."""
+    try:
+        from backend.apps.settings.settings import load_settings
+        s = load_settings()
+        return getattr(s, "google_api_key", None) or None
+    except Exception:
+        return None
+
+
+@typechecked
+def resolve_openai_api_key() -> Optional[str]:
+    try:
+        from backend.apps.settings.settings import load_settings
+        s = load_settings()
+        return getattr(s, "openai_api_key", None) or None
+    except Exception:
+        return None
+
+
+# Cache of which 9Router subscriptions are connected. Refreshed rather than hit on every search call; 9Router's /api/providers is fast but not free and we already query it from many places.
+p_nine_router_connected: Set[str] = set()
+p_nine_router_cache_at: float = 0.0
+
+
+@typechecked
+async def refresh_9r_connected() -> Set[str]:
+    """The currently-active 9Router subscription providers, cached 20s."""
+    global p_nine_router_connected, p_nine_router_cache_at
+    now = time.time()
+    if now - p_nine_router_cache_at < 20.0:
+        return p_nine_router_connected
+    try:
+        from backend.apps.nine_router import is_running as p_9r_running, get_providers as p_9r_providers
+        if not p_9r_running():
+            p_nine_router_connected = set()
+        else:
+            conns = await p_9r_providers()
+            p_nine_router_connected = {
+                c.get("provider")
+                for c in conns
+                if isinstance(c, dict) and c.get("isActive") and c.get("provider")
+            }
+        p_nine_router_cache_at = now
+    except Exception:
+        # Cache stays; best-effort.
+        pass
+    return p_nine_router_connected
+
+
+@typechecked
+async def p_nine_router_text(body: Dict) -> str:
+    """POST an Anthropic-shape body to 9Router and concatenate its text blocks."""
+    async with httpx.AsyncClient(timeout=20.0) as client:
+        r = await client.post(
+            NINE_ROUTER_MESSAGES_URL,
+            json=body,
+            headers={"x-api-key": "9router", "anthropic-version": "2023-06-01"},
+        )
+        if r.status_code != 200:
+            return ""
+        data = r.json()
+    return "".join(
+        block.get("text", "")
+        for block in (data.get("content") or [])
+        if isinstance(block, dict) and block.get("type") == "text"
+    )
+
+
+@typechecked
+async def gemini_grounded_via_9router(prompt: str, use_url_context: bool) -> Dict:
+    """Grounded Gemini through the user's OAuth subscription instead of an AI Studio key.
+
+    Shapes its return like `gemini_grounded_call` so the formatters work
+    unchanged. 9Router doesn't surface citations as a structured field
+    uniformly across providers, so we hand back text-only."""
+    connected = await refresh_9r_connected()
+    if "gemini-cli" in connected:
+        model = "gc/gemini-2.5-flash"
+    elif "antigravity" in connected:
+        model = "ag/gemini-3-flash"
+    else:
+        return {}
+    sys_prompt = (
+        "You fetch URLs and return concise summaries with citations."
+        if use_url_context
+        else "You search the web and return concise grounded answers with "
+             "source citations. Always cite the URLs you used."
+    )
+    text = await p_nine_router_text({
+        "model": model,
+        "max_tokens": 1024,
+        "system": sys_prompt,
+        "messages": [{"role": "user", "content": prompt}],
+    })
+    return {"text": text, "chunks": []}
+
+
+@typechecked
+async def openai_websearch_via_9router(query: str) -> Dict:
+    """Same idea for OpenAI, through the user's Codex 9Router connection."""
+    connected = await refresh_9r_connected()
+    if "codex" not in connected:
+        return {}
+    text = await p_nine_router_text({
+        "model": "cx/gpt-5.4-mini",
+        "max_tokens": 1024,
+        "system": (
+            "You search the web and return concise grounded answers "
+            "with source citations. Always cite the URLs you used."
+        ),
+        "messages": [{"role": "user", "content": f"Search the web for: {query}"}],
+    })
+    return {"text": text, "chunks": []}
+
+
+@typechecked
+def p_parse_openai_response(data: Dict) -> Dict:
+    """Pull output_text + url_citation annotations out of a Responses API body."""
+    text_parts: List[str] = []
+    chunks: List[Tuple[str, str]] = []
+    for item in (data.get("output") or []):
+        if not isinstance(item, dict):
+            continue
+        for content in (item.get("content") or []):
+            if not isinstance(content, dict):
+                continue
+            if content.get("type") == "output_text":
+                text_parts.append(content.get("text", ""))
+            for ann in (content.get("annotations") or []):
+                if isinstance(ann, dict) and ann.get("type") == "url_citation":
+                    uri = ann.get("url", "")
+                    if uri:
+                        chunks.append((ann.get("title", uri), uri))
+    return {"text": "".join(text_parts), "chunks": chunks}
+
+
+@typechecked
+async def p_openai_responses(api_key: str, prompt: str) -> Dict:
+    async with httpx.AsyncClient(timeout=45.0) as client:
+        r = await client.post(
+            f"{OPENAI_API_BASE}/responses",
+            headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
+            json={
+                "model": OPENAI_SEARCH_MODEL,
+                "input": prompt,
+                "tools": [{"type": "web_search_preview"}],
+            },
+        )
+        r.raise_for_status()
+        return p_parse_openai_response(r.json())
+
+
+@typechecked
+async def openai_websearch(api_key: str, query: str) -> Dict:
+    """Call OpenAI Responses API with the web_search_preview tool."""
+    grounded = await p_openai_responses(
+        api_key, f"Search the web for: {query}\n\nReturn a concise summary. Cite sources.",
+    )
+    grounded["queries"] = [query]
+    return grounded
+
+
+@typechecked
+async def openai_urlfetch(api_key: str, url: str, prompt: Optional[str]) -> Dict:
+    """Use OpenAI's web_search_preview to fetch/summarize a specific URL."""
+    prompt_text = f"Fetch and summarize the content at: {url}"
+    if prompt:
+        prompt_text += f"\n\nFocus on: {prompt}"
+    return await p_openai_responses(api_key, prompt_text)
diff --git a/backend/apps/web/keyless_race.py b/backend/apps/web/keyless_race.py
new file mode 100644
index 00000000..db64ab80
--- /dev/null
+++ b/backend/apps/web/keyless_race.py
@@ -0,0 +1,126 @@
+"""Race the free search engines instead of queueing them.
+
+Walking them in order made whether search was FAST depend on whether the first
+engine happened to be alive, which is not a property we control. Measured from
+a fresh backend on a machine where DuckDuckGo had stopped answering TCP: the
+first three searches took 8.8s each, because each one waited out the dead
+engine's whole tier budget before Startpage was allowed to try. A desktop app
+starts its backend on every launch, so that was the first thing a user saw.
+
+So the second engine no longer waits for the first to fail; it waits only for
+the first to be SLOW. If the leader answers inside the hedge delay, which a
+healthy frontend does with room to spare, nothing else is sent and the traffic
+is exactly what it was before. If it doesn't, the next engine starts alongside
+it and the first good answer wins. A dead engine now costs the hedge delay
+once, instead of its full budget forever.
+
+The breaker underneath is what makes it cost nothing on the queries after that,
+but it is now an optimisation rather than the thing standing between the user
+and an answer.
+"""
+
+import asyncio
+from typing import Awaitable, Callable, Dict, List, Optional, Set
+
+from pydantic import BaseModel, ConfigDict, Field, InstanceOf
+from typeguard import typechecked
+
+from backend.apps.web.tier_breaker import (
+    record_tier_failure,
+    record_tier_success,
+    tier_cooldown_left,
+)
+
+# Measured across 44 queries: a healthy DuckDuckGo answered in 0.68-1.14s and a healthy Startpage in 0.46-1.33s, so a frontend still silent at 1.5s is not about to win the race.
+HEDGE_AFTER_SECONDS = 1.5
+
+
+class KeylessEngine(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    name: str
+    run: InstanceOf[Callable[[], Awaitable[Optional[Dict]]]]
+
+
+class RaceOutcome(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    result: Optional[Dict] = None
+    errors: List[str] = Field(default_factory=list)
+
+
+@typechecked
+async def race_keyless(
+    engines: List[KeylessEngine],
+    budget: float,
+    hedge_after: float = HEDGE_AFTER_SECONDS,
+) -> RaceOutcome:
+    """First good answer wins; a slow engine pulls in the next one rather than blocking it."""
+    loop = asyncio.get_running_loop()
+    deadline = loop.time() + budget
+    errors: List[str] = []
+
+    live: List[KeylessEngine] = []
+    for engine in engines:
+        cooling = tier_cooldown_left(engine.name)
+        if cooling:
+            errors.append(f"{engine.name}: skipped, still failing (retry in {cooling:.0f}s)")
+        else:
+            live.append(engine)
+    if not live:
+        return RaceOutcome(errors=errors)
+
+    running: Dict[asyncio.Task, str] = {}
+    started: Dict[str, float] = {}
+    next_engine = 0
+
+    def start_next() -> None:
+        nonlocal next_engine
+        engine = live[next_engine]
+        next_engine += 1
+        started[engine.name] = loop.time()
+        running[asyncio.ensure_future(engine.run())] = engine.name
+
+    start_next()
+    result: Optional[Dict] = None
+
+    while running and result is None:
+        remaining = deadline - loop.time()
+        if remaining <= 0:
+            break
+        wait_for = remaining
+        if next_engine < len(live):
+            # Hedge off the engine that has been waiting longest, so a stalled leader pulls the next one in on time.
+            oldest = min(started[name] for name in running.values())
+            wait_for = min(wait_for, max(0.0, oldest + hedge_after - loop.time()))
+        done: Set[asyncio.Task] = set()
+        done, _ = await asyncio.wait(set(running), timeout=wait_for,
+                                     return_when=asyncio.FIRST_COMPLETED)
+        for task in done:
+            name = running.pop(task)
+            try:
+                answer = task.result()
+            except asyncio.CancelledError:
+                continue
+            except Exception as exc:
+                errors.append(f"{name}: {str(exc)[:150]}")
+                record_tier_failure(name)
+                continue
+            # Answering "no hits" still proves the host is up, so it clears the failure streak.
+            record_tier_success(name)
+            if answer is not None and result is None:
+                result = answer
+        if result is None and next_engine < len(live) and (not done or not running):
+            start_next()
+
+    for task, name in running.items():
+        task.cancel()
+        silent_for = loop.time() - started[name]
+        # It never answered in the window a healthy engine answers three times over, so stop asking it for a while.
+        if silent_for >= hedge_after:
+            errors.append(f"{name}: no response in {silent_for:.0f}s")
+            record_tier_failure(name, conclusive=True)
+    if running:
+        await asyncio.gather(*running, return_exceptions=True)
+
+    return RaceOutcome(result=result, errors=errors)
diff --git a/backend/apps/web/tier_breaker.py b/backend/apps/web/tier_breaker.py
new file mode 100644
index 00000000..8c0dd126
--- /dev/null
+++ b/backend/apps/web/tier_breaker.py
@@ -0,0 +1,80 @@
+"""Short-lived circuit breaker for the cascade's fixed-host tiers.
+
+Measured on this machine over three 44-query rounds: DuckDuckGo answered the
+first 7 searches, then served its bot challenge, then 403'd, then stopped
+answering TCP altogether. Once that happened EVERY search paid the full 8s
+DuckDuckGo tier budget before Startpage answered, so the keyless p50 went from
+1.0s to 8.5s while the success rate stayed at 100%. The engine wasn't broken,
+our retrying of a known-dead engine was.
+
+A tier only opts in when "closed" is a property of the HOST rather than of the
+request, which is true for a search frontend and false for a page fetch (one
+404 says nothing about the next URL). State is per-process and time-boxed, so
+the worst a wrong guess costs is one cooldown window of a tier we skip.
+"""
+
+import time
+from typing import Dict, Optional
+
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+# Two failures can be one bad minute; three in a row is a closed door.
+FAILURES_TO_OPEN = 3
+FIRST_COOLDOWN_SECONDS = 120.0
+MAX_COOLDOWN_SECONDS = 900.0
+
+
+class TierHealth(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    consecutive_failures: int = 0
+    open_until: float = 0.0
+    cooldown: float = 0.0
+
+
+p_health: Dict[str, TierHealth] = {}
+
+
+@typechecked
+def p_entry(name: str) -> TierHealth:
+    if name not in p_health:
+        p_health[name] = TierHealth()
+    return p_health[name]
+
+
+@typechecked
+def tier_cooldown_left(name: str, now: Optional[float] = None) -> float:
+    """Seconds until this tier is worth trying again; 0 when it is open for business."""
+    entry = p_health.get(name)
+    if entry is None:
+        return 0.0
+    return max(0.0, entry.open_until - (time.monotonic() if now is None else now))
+
+
+@typechecked
+def record_tier_failure(name: str, now: Optional[float] = None, *, conclusive: bool = False) -> None:
+    """A failure. An error ANSWER is one strike of three, because a 202 or a 403 can be a bad
+    minute. SILENCE is conclusive and shuts the tier at once: a frontend that returns nothing at
+    all in the time a healthy one answers three times over is not having a bad minute, and making
+    the user prove it three times is what put 8.8s on their first three searches after launch."""
+    stamp = time.monotonic() if now is None else now
+    entry = p_entry(name)
+    entry.consecutive_failures += 1
+    if not conclusive and entry.consecutive_failures < FAILURES_TO_OPEN:
+        return
+    # The half-open probe that fails again doubles the wait, so a permanently dead engine stops costing anything.
+    entry.cooldown = min(max(entry.cooldown * 2, FIRST_COOLDOWN_SECONDS), MAX_COOLDOWN_SECONDS)
+    entry.open_until = stamp + entry.cooldown
+
+
+@typechecked
+def record_tier_success(name: str) -> None:
+    """The tier answered, even if the answer was 'no hits'. It is alive; forget the history."""
+    if name in p_health:
+        p_health[name] = TierHealth()
+
+
+@typechecked
+def reset_tier_health() -> None:
+    p_health.clear()
diff --git a/backend/apps/web/web.py b/backend/apps/web/web.py
index 2f154cbe..adc29893 100644
--- a/backend/apps/web/web.py
+++ b/backend/apps/web/web.py
@@ -1,22 +1,36 @@
 """Web search + fetch sub-app.
 
-Thin HTTP wrappers around `WebSearchTool` and `WebFetchTool` from
-`backend.apps.agents.tools.web`. Exists so the in-process MCP server
-(`backend.apps.agents.web_mcp_server`) can proxy tool calls to the
-backend instead of re-implementing DuckDuckGo scraping + trafilatura
-extraction in the MCP process.
+Thin HTTP wrappers around the keyless search rungs and `WebFetchTool` from
+`backend.apps.agents.tools`. Exists so the in-process MCP server
+(`backend.apps.agents.web_mcp_server`) can proxy tool calls to the backend
+instead of re-implementing scraping + trafilatura extraction in the MCP
+process.
 
 Mounted at `/api/web`.
 """
 
-import asyncio
 from contextlib import asynccontextmanager
-from typing import Any
+from typing import Any, Dict, List, Optional
+from uuid import uuid4
 
 from fastapi import HTTPException
 from pydantic import BaseModel, Field
 from typeguard import typechecked
 
+from backend.apps.web.cascade import CascadeTier, run_cascade
+from backend.apps.web.keyless_race import KeylessEngine, race_keyless
+from backend.apps.web.grounded import (
+    format_grounded_as_fetch,
+    format_grounded_as_search_results,
+    gemini_grounded_call,
+    gemini_grounded_via_9router,
+    openai_urlfetch,
+    openai_websearch,
+    openai_websearch_via_9router,
+    refresh_9r_connected,
+    resolve_gemini_api_key,
+    resolve_openai_api_key,
+)
 from backend.config.Apps import SubApp
 
 
@@ -35,48 +49,37 @@ class SearchBody(BaseModel):
     query: str = Field(..., description="The search query.")
     num_results: int = Field(5, ge=1, le=10, description="Max results to return.")
     # Hint from the MCP server about which primary provider the session is using. Lets us route to that provider's native search tool (Gemini googleSearch, OpenAI web_search_preview) when available, costs come out of the user's existing primary budget.
-    primary: str | None = Field(None, description="Primary provider hint: 'gemini' | 'openai' | 'anthropic' | None")
+    primary: Optional[str] = Field(None, description="Primary provider hint: 'gemini' | 'openai' | 'anthropic' | None")
     # Set by the openswarm-web shim from OPENSWARM_BROWSER_OK; the browser-fallback nudge must never fire in a session without browser-delegation tools.
     browser_ok: bool = Field(False, description="Whether this session has browser-delegation tools available.")
 
 
 class FetchBody(BaseModel):
     url: str = Field(..., description="The URL to fetch.")
-    prompt: str | None = Field(None, description="Optional context hint.")
-    primary: str | None = Field(None, description="Primary provider hint.")
+    prompt: Optional[str] = Field(None, description="Optional context hint.")
+    primary: Optional[str] = Field(None, description="Primary provider hint.")
 
 
-# --------------------------------------------------------------------------- Helper; extract plain text from a tool's structured output list ---------------------------------------------------------------------------
+# --------------------------------------------------------------------------- Budgets ---------------------------------------------------------------------------
+
+# Whole-cascade wall clock. Nothing below can push an endpoint past this, and the MCP shim waits LONGER (see web_mcp_server) so our honest "here is why every backend failed" answer beats a client-side abort.
+SEARCH_BUDGET_SECONDS = 60.0
+FETCH_BUDGET_SECONDS = 60.0
+
+KEYLESS_TIER_SECONDS = 8.0        # a search frontend answers in ~1s; >8s is a hang
+BROWSER_TIER_SECONDS = 12.0       # the main-bridge send has its own per-action timeout
+GROUNDED_TIER_SECONDS = 45.0      # grounded native search legitimately takes 30-42s
+LOCAL_FETCH_TIER_SECONDS = 15.0   # normal pages return in <2s
+ARCHIVE_TIER_SECONDS = 10.0       # the Wayback redirect path answered in 0.5-3s
 
 
-def p_join_text(parts: list[dict[str, Any]]) -> str:
-    out = []
-    for p in parts:
-        if isinstance(p, dict) and p.get("type") == "text":
-            out.append(str(p.get("text", "")))
-    return "\n".join(out)
+# --------------------------------------------------------------------------- Helpers ---------------------------------------------------------------------------
 
 
-# --------------------------------------------------------------------------- Endpoints ---------------------------------------------------------------------------
-
-
-GEMINI_API_BASE = "https://generativelanguage.googleapis.com/v1beta"
-GEMINI_GROUNDING_MODEL = "gemini-2.5-flash"  # cheapest + fastest for grounded calls
-
-OPENAI_API_BASE = "https://api.openai.com/v1"
-OPENAI_SEARCH_MODEL = "gpt-5-mini"  # cheapest model that supports web_search_preview
-
-# Per-attempt timeouts for the search/fetch cascade. The fast-first ORDERING is what fixes the ~75s stall (DDG answers in ~1s so the slow grounded backends are rarely reached); these bounds are hang safety-nets, set just ABOVE each path's own httpx timeout so a normally-slow call still completes and only a truly hung provider (no response at all) gets cut. Grounded native search legitimately takes 32-42s (httpx ceiling 45s), so its leash sits at 48s, NOT below 45, or we'd clip the slow tail of a valid paid call.
-P_DDG_ATTEMPT_TIMEOUT = 6.0       # DDG answers <1s; >6s is a network hang, fall through
-P_GROUNDED_ATTEMPT_TIMEOUT = 48.0  # just above the providers' own 45s httpx timeout
-# Local httpx + trafilatura fetch of a real page; the fast path for /fetch (normal pages return in <2s). Set just above WebFetchTool's own 30s httpx ceiling so a valid-but-slow page still completes locally instead of being clipped down to a grounded summary; only a truly hung server gets cut.
-P_LOCAL_FETCH_TIMEOUT = 32.0
-P_BROWSER_TIER_TIMEOUT = 46.0  # main-bridge send has its own per-action timeout; this outer wait_for is just a backstop above it
-
 # Drive the packaged app's offscreen Chromium (main-process hidden window) for a fetch/search. Returns the bridge result dict, or None when no Electron main bridge is connected (dev/headless/backend-only) so the cascade just skips this tier. This is the real "browser reachable" gate, OPENSWARM_BROWSER_OK is effectively always "1" and not trustworthy for this.
-async def p_browser_bridge(action: str, params: dict) -> dict | None:
+@typechecked
+async def p_browser_bridge(action: str, params: Dict) -> Optional[Dict]:
     from backend.apps.agents.core.ws_manager import ws_manager
-    from uuid import uuid4
     if ws_manager.main_connection is None:
         return None
     res = await ws_manager.send_main_command(uuid4().hex, action, params)
@@ -85,559 +88,285 @@ async def p_browser_bridge(action: str, params: dict) -> dict | None:
     return res
 
 
-# When every search backend fails, point the model at the in-product browser (always-on CreateBrowserAgent tool) instead of telling it to "wait and retry", which it can't do and just relays as a dead end. The real Chromium renders pages and isn't subject to the DDG scrape throttle.
+# When every search backend fails, point the model at the in-product browser (always-on CreateBrowserAgent tool) instead of telling it to "wait and retry", which it can't do and just relays as a dead end. A real Chromium carries a real browser fingerprint, which is what the challenge is actually keyed on.
+@typechecked
 def p_browser_fallback_nudge(query: str) -> str:
     return (
         "Don't stop here: fall back to the in-product browser, which renders real pages and "
-        "isn't subject to this rate limit. Call CreateBrowserAgent with a task like: "
+        "isn't subject to this block. Call CreateBrowserAgent with a task like: "
         f'"Search the web for: {query}. Report the top results with their titles and URLs, '
         'plus a direct answer if you find one."'
     )
 
 
-async def p_gemini_grounded_call(api_key: str, prompt: str, *, use_url_context: bool) -> dict:
-    """Call Gemini with googleSearch (+ optionally urlContext) grounding.
-
-    Returns {"text": grounded_answer, "chunks": [(title, uri), ...],
-             "queries": [...]} or raises httpx.HTTPError on failure.
-    """
-    import httpx
-    tools = [{"googleSearch": {}}]
-    if use_url_context:
-        tools.append({"urlContext": {}})
-    body = {
-        "contents": [{"role": "user", "parts": [{"text": prompt}]}],
-        "tools": tools,
-        "generationConfig": {"thinkingConfig": {"thinkingBudget": 0}},
-    }
-    url = f"{GEMINI_API_BASE}/models/{GEMINI_GROUNDING_MODEL}:generateContent"
-    async with httpx.AsyncClient(timeout=45.0) as client:
-        r = await client.post(
-            url,
-            headers={"x-goog-api-key": api_key, "Content-Type": "application/json"},
-            json=body,
-        )
-        r.raise_for_status()
-        data = r.json()
-
-    cand = (data.get("candidates") or [{}])[0]
-    text = "".join(
-        p.get("text", "") for p in (cand.get("content", {}).get("parts") or [])
-        if isinstance(p, dict)
-    )
-    gm = cand.get("groundingMetadata") or {}
-    chunks = []
-    for gc in (gm.get("groundingChunks") or []):
-        web = (gc or {}).get("web") or {}
-        uri = web.get("uri") or web.get("url") or ""
-        title = web.get("title") or uri
-        if uri:
-            chunks.append((title, uri))
-    queries = gm.get("webSearchQueries") or []
-    return {"text": text, "chunks": chunks, "queries": queries}
+@typechecked
+def p_grounded_tiers(kind: str, primary: Optional[str], runners: Dict[str, Any]) -> List[CascadeTier]:
+    """Order the four grounded backends, promoting the session's own primary."""
+    names = ["gemini_native", "gemini_subscription", "openai_native", "openai_subscription"]
+    if (primary or "").lower() == "openai":
+        names = names[2:] + names[:2]
+    return [
+        CascadeTier(name=f"{kind}:{n}", run=runners[n], budget=GROUNDED_TIER_SECONDS)
+        for n in names
+    ]
 
 
-def p_format_grounded_as_search_results(grounded: dict, query: str) -> str:
-    """Format Gemini grounding output to match WebSearchTool's text shape."""
-    lines = []
-    chunks = grounded.get("chunks") or []
-    for i, (title, uri) in enumerate(chunks[:10], start=1):
-        lines.append(f"[{i}] {title}\n    {uri}")
-    text = grounded.get("text") or ""
-    if text:
-        lines.append("\n" + text)
-    if not lines:
-        return f"No search results found for: {query}"
-    return "\n\n".join(lines)
-
-
-def p_format_grounded_as_fetch(grounded: dict, url: str) -> str:
-    """Format Gemini urlContext output to match WebFetchTool's text shape."""
-    parts = [f"Contents of {url}:", ""]
-    text = grounded.get("text") or ""
-    if text:
-        parts.append(text)
-    chunks = grounded.get("chunks") or []
-    if chunks:
-        parts.append("\nCited sources:")
-        for i, (title, uri) in enumerate(chunks[:5], start=1):
-            parts.append(f"  [{i}] {title}; {uri}")
-    return "\n".join(parts)
-
-
-def p_resolve_gemini_api_key() -> str | None:
-    """Pull the AI Studio API key from settings, or None."""
-    try:
-        from backend.apps.settings.settings import load_settings
-        s = load_settings()
-        return getattr(s, "google_api_key", None) or None
-    except Exception:
-        return None
-
-
-def p_resolve_openai_api_key() -> str | None:
-    try:
-        from backend.apps.settings.settings import load_settings
-        s = load_settings()
-        return getattr(s, "openai_api_key", None) or None
-    except Exception:
-        return None
-
-
-# Cache of which 9Router subscriptions are connected. Refreshed via `_refresh_9r_connected()` rather than hit on every search call, 9Router's /api/providers is fast but not free, and we already query it from many places.
-P_NINE_ROUTER_CONNECTED: set[str] = set()
-P_NINE_ROUTER_CACHE_AT: float = 0.0
-
-
-async def p_refresh_9r_connected() -> set[str]:
-    """Return the set of currently-active 9Router subscription providers
-    (e.g. {"claude", "codex", "antigravity", "gemini-cli"}). Cached for
-    20s to keep search/fetch endpoints snappy."""
-    global P_NINE_ROUTER_CONNECTED, P_NINE_ROUTER_CACHE_AT
-    import time as p_t
-    now = p_t.time()
-    if now - P_NINE_ROUTER_CACHE_AT < 20.0:
-        return P_NINE_ROUTER_CONNECTED
-    try:
-        from backend.apps.nine_router import is_running as p_9r_running, get_providers as p_9r_providers
-        if not p_9r_running():
-            P_NINE_ROUTER_CONNECTED = set()
-        else:
-            conns = await p_9r_providers()
-            P_NINE_ROUTER_CONNECTED = {
-                c.get("provider")
-                for c in conns
-                if isinstance(c, dict) and c.get("isActive") and c.get("provider")
-            }
-        P_NINE_ROUTER_CACHE_AT = now
-    except Exception:
-        # Cache stays; best-effort.
-        pass
-    return P_NINE_ROUTER_CONNECTED
-
-
-async def p_gemini_grounded_via_9router(prompt: str, use_url_context: bool) -> dict:
-    """Call 9Router's /v1/messages endpoint with a Gemini model so the
-    user's OAuth subscription (Gemini CLI or Antigravity) covers the
-    search call instead of needing a separate AI Studio API key.
-
-    Routes through Anthropic-shape against 9Router's translator. We
-    request a tool result naturally; the translator surfaces grounded
-    URIs as text + cited sources in the response body. Format-shape
-    matches the existing `_gemini_grounded_call` so downstream
-    `_format_grounded_as_search_results` works unchanged."""
-    import httpx
-    # Prefer Gemini CLI (broader model coverage). Fall back to Antigravity if CLI isn't connected.
-    connected = await p_refresh_9r_connected()
-    if "gemini-cli" in connected:
-        model = "gc/gemini-2.5-flash"
-    elif "antigravity" in connected:
-        model = "ag/gemini-3-flash"
-    else:
-        return {}
-
-    sys_prompt = (
-        "You search the web and return concise grounded answers with "
-        "source citations. Always cite the URLs you used."
-        if not use_url_context
-        else "You fetch URLs and return concise summaries with citations."
-    )
-    body = {
-        "model": model,
-        "max_tokens": 1024,
-        "system": sys_prompt,
-        "messages": [{"role": "user", "content": prompt}],
-    }
-    async with httpx.AsyncClient(timeout=20.0) as client:
-        r = await client.post(
-            "http://localhost:20128/v1/messages",
-            json=body,
-            headers={"x-api-key": "9router", "anthropic-version": "2023-06-01"},
-        )
-        if r.status_code != 200:
-            return {}
-        data = r.json()
-    # Synthesize a grounded shape so the existing formatter works: _format_grounded_as_search_results expects {"text": str, "chunks": [(title, uri), ...]}. 9Router doesn't surface citations as a structured field uniformly across providers, so we hand back text-only and let the formatter do its thing.
-    text = ""
-    for block in (data.get("content") or []):
-        if isinstance(block, dict) and block.get("type") == "text":
-            text += block.get("text", "")
-    return {"text": text, "chunks": []}
-
-
-async def p_openai_websearch_via_9router(query: str) -> dict:
-    """Same idea, but for OpenAI's web_search_preview through Codex's
-    9Router connection. Goes through 9Router's openai-compat endpoint
-    (the responses API) so the user's Codex subscription covers it."""
-    import httpx
-    connected = await p_refresh_9r_connected()
-    if "codex" not in connected:
-        return {}
-    body = {
-        "model": "cx/gpt-5.4-mini",
-        "max_tokens": 1024,
-        "system": (
-            "You search the web and return concise grounded answers "
-            "with source citations. Always cite the URLs you used."
-        ),
-        "messages": [{"role": "user", "content": f"Search the web for: {query}"}],
-    }
-    async with httpx.AsyncClient(timeout=20.0) as client:
-        r = await client.post(
-            "http://localhost:20128/v1/messages",
-            json=body,
-            headers={"x-api-key": "9router", "anthropic-version": "2023-06-01"},
-        )
-        if r.status_code != 200:
-            return {}
-        data = r.json()
-    text = ""
-    for block in (data.get("content") or []):
-        if isinstance(block, dict) and block.get("type") == "text":
-            text += block.get("text", "")
-    return {"text": text, "chunks": []}
-
-
-async def p_openai_websearch(api_key: str, query: str) -> dict:
-    """Call OpenAI Responses API with the web_search_preview tool.
-
-    Returns {"text": grounded_answer, "chunks": [(title, uri), ...]}.
-    """
-    import httpx
-    body = {
-        "model": OPENAI_SEARCH_MODEL,
-        "input": f"Search the web for: {query}\n\nReturn a concise summary. Cite sources.",
-        "tools": [{"type": "web_search_preview"}],
-    }
-    async with httpx.AsyncClient(timeout=45.0) as client:
-        r = await client.post(
-            f"{OPENAI_API_BASE}/responses",
-            headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
-            json=body,
-        )
-        r.raise_for_status()
-        data = r.json()
-
-    text_parts = []
-    chunks: list[tuple[str, str]] = []
-    for item in (data.get("output") or []):
-        if not isinstance(item, dict):
-            continue
-        for content in (item.get("content") or []):
-            if not isinstance(content, dict):
-                continue
-            if content.get("type") == "output_text":
-                text_parts.append(content.get("text", ""))
-            for ann in (content.get("annotations") or []):
-                if isinstance(ann, dict) and ann.get("type") == "url_citation":
-                    uri = ann.get("url", "")
-                    title = ann.get("title", uri)
-                    if uri:
-                        chunks.append((title, uri))
-    return {"text": "".join(text_parts), "chunks": chunks, "queries": [query]}
-
-
-async def p_openai_urlfetch(api_key: str, url: str, prompt: str | None) -> dict:
-    """Use OpenAI's web_search_preview to fetch/summarize a specific URL."""
-    prompt_text = f"Fetch and summarize the content at: {url}"
-    if prompt:
-        prompt_text += f"\n\nFocus on: {prompt}"
-    import httpx
-    body = {
-        "model": OPENAI_SEARCH_MODEL,
-        "input": prompt_text,
-        "tools": [{"type": "web_search_preview"}],
-    }
-    async with httpx.AsyncClient(timeout=45.0) as client:
-        r = await client.post(
-            f"{OPENAI_API_BASE}/responses",
-            headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
-            json=body,
-        )
-        r.raise_for_status()
-        data = r.json()
-    text_parts = []
-    chunks = []
-    for item in (data.get("output") or []):
-        for content in (item.get("content") or []):
-            if isinstance(content, dict) and content.get("type") == "output_text":
-                text_parts.append(content.get("text", ""))
-            for ann in (content.get("annotations") or []) if isinstance(content, dict) else []:
-                if isinstance(ann, dict) and ann.get("type") == "url_citation":
-                    uri = ann.get("url", "")
-                    title = ann.get("title", uri)
-                    if uri:
-                        chunks.append((title, uri))
-    return {"text": "".join(text_parts), "chunks": chunks}
+# --------------------------------------------------------------------------- Endpoints ---------------------------------------------------------------------------
 
 
 @web.router.post("/search")
 @typechecked
-async def search(body: SearchBody) -> dict:
-    """Web search, primary-aware. Prefers the native search tool of the
-    provider the user is already paying for:
+async def search(body: SearchBody) -> Dict:
+    """Web search, primary-aware.
 
-        Gemini primary + Gemini key → googleSearch grounding
-        OpenAI primary + OpenAI key → web_search_preview
-        Anthropic path available   → handled at agent_manager layer
-                                     (MCP isn't registered; built-in
-                                     WebSearch routes through 9Router
-                                     → Anthropic's server-side tool)
-        otherwise                  → DDG fallback (CAPTCHA-prone)
+    Free keyless rungs lead (they answer at human speed and cost nothing),
+    then the packaged app's real browser, then the provider-grounded backends
+    of whichever provider the user already pays for."""
+    gemini_key = resolve_gemini_api_key()
+    openai_key = resolve_openai_api_key()
 
-    If the primary's own native path fails, we cascade to whichever
-    other provider's credentials are available, then DDG last."""
-    gemini_key = p_resolve_gemini_api_key()
-    openai_key = p_resolve_openai_api_key()
-    primary = (body.primary or "").lower()
-    errors: list[str] = []
-
-    async def try_gemini():
-        if not gemini_key:
-            return None
-        prompt = (
-            f"Search the web for: {body.query}\n\n"
-            f"Return a concise summary of what you found. Cite sources."
-        )
-        grounded = await p_gemini_grounded_call(gemini_key, prompt, use_url_context=False)
-        return {
-            "query": body.query,
-            "results": p_format_grounded_as_search_results(grounded, body.query),
-            "backend": "gemini_native",
-        }
-
-    async def try_openai():
-        if not openai_key:
-            return None
-        grounded = await p_openai_websearch(openai_key, body.query)
-        return {
-            "query": body.query,
-            "results": p_format_grounded_as_search_results(grounded, body.query),
-            "backend": "openai_native",
-        }
-
-    async def try_gemini_subscription():
-        prompt = (
-            f"Search the web for: {body.query}\n\n"
-            f"Return a concise summary of what you found. Cite sources."
-        )
-        grounded = await p_gemini_grounded_via_9router(prompt, use_url_context=False)
-        if not grounded.get("text"):
-            return None
-        return {
-            "query": body.query,
-            "results": p_format_grounded_as_search_results(grounded, body.query),
-            "backend": "gemini_subscription",
-        }
-
-    async def try_openai_subscription():
-        grounded = await p_openai_websearch_via_9router(body.query)
-        if not grounded.get("text"):
-            return None
-        return {
-            "query": body.query,
-            "results": p_format_grounded_as_search_results(grounded, body.query),
-            "backend": "openai_subscription",
-        }
-
-    async def try_ddg():
-        # Fast path: direct HTML search, sub-second when DDG isn't throttling us. Returns None on a real no-hits OR a 202 throttle so the chain falls through to the slower-but-grounded backends.
-        from backend.apps.agents.tools.web import WebSearchTool, DDGRateLimited
+    async def try_keyless() -> Optional[Dict]:
+        # DuckDuckGo (html then lite); sub-second when it isn't challenged. None on a real no-hits so the chain falls through.
+        from backend.apps.agents.tools.web import DDGRateLimited, WebSearchTool
         try:
             text = await WebSearchTool.search_ddg(body.query, body.num_results)
         except DDGRateLimited:
-            # Surface the throttle as a recorded error (not a silent None) so the caller can see WHY we fell through to a slower backend.
-            raise RuntimeError("DuckDuckGo rate-limited (HTTP 202)") from None
+            # Surface the challenge as a recorded error (not a silent None) so the caller can see WHY we fell through to a slower backend.
+            raise RuntimeError("DuckDuckGo served its bot challenge (HTTP 202)") from None
         if not text:
             return None
         return {"query": body.query, "results": text, "backend": "ddg"}
 
-    async def try_browser_search():
-        # Packaged-app tier: a real Chromium's fingerprint isn't subject to the httpx DDG 202 throttle (proven: browser-DDG returns hits where our headless client 202s), and it can scrape Google/Bing directly. Skipped (None) when no Electron main bridge is connected.
+    async def try_startpage() -> Optional[Dict]:
+        # Second independent engine (Google's index), so DuckDuckGo's bot challenge is no longer a single point of failure for keyless users.
+        from backend.apps.agents.tools.search.search_startpage import search_startpage
+        answer = await search_startpage(body.query, body.num_results)
+        # Raise rather than return None: a refusal is the engine failing, and the breaker must count it so a closed Startpage stops costing its budget too.
+        if answer.refused:
+            raise RuntimeError("Startpage answered with a challenge instead of results")
+        if not answer.results:
+            return None
+        return {"query": body.query, "results": answer.results, "backend": "startpage"}
+
+    async def try_browser_search() -> Optional[Dict]:
+        # Packaged-app tier: a real Chromium's fingerprint isn't subject to the headless-client challenge, and it can scrape Google/Bing directly. Skipped (None) when no Electron main bridge is connected.
         res = await p_browser_bridge("browser_search", {"query": body.query, "num_results": body.num_results})
         if not res or not res.get("results"):
             return None
         return {"query": body.query, "results": res["results"], "backend": f"browser_{res.get('engine', 'search')}"}
 
-    # Fast-first cascade: DDG leads (~1s = human speed); then the packaged browser (real fingerprint, throttle-immune, no LLM cost); then the 30-42s LLM-grounded backends. The primary hint only reorders the grounded tier. Every attempt is wait_for-bounded so a slow/hung provider fails over fast.
-    grounded = [
-        ("gemini_native", try_gemini),
-        ("gemini_subscription", try_gemini_subscription),
-        ("openai_native", try_openai),
-        ("openai_subscription", try_openai_subscription),
-    ]
-    if primary == "openai":
-        grounded = grounded[2:] + grounded[:2]
+    async def try_gemini() -> Optional[Dict]:
+        if not gemini_key:
+            return None
+        grounded = await gemini_grounded_call(
+            gemini_key,
+            f"Search the web for: {body.query}\n\nReturn a concise summary of what you found. Cite sources.",
+            use_url_context=False,
+        )
+        return {"query": body.query, "results": format_grounded_as_search_results(grounded, body.query),
+                "backend": "gemini_native"}
 
-    cascade = [
-        ("ddg", try_ddg, P_DDG_ATTEMPT_TIMEOUT),
-        ("browser_search", try_browser_search, P_BROWSER_TIER_TIMEOUT),
-    ] + [
-        (name, fn, P_GROUNDED_ATTEMPT_TIMEOUT) for name, fn in grounded
-    ]
+    async def try_openai() -> Optional[Dict]:
+        if not openai_key:
+            return None
+        grounded = await openai_websearch(openai_key, body.query)
+        return {"query": body.query, "results": format_grounded_as_search_results(grounded, body.query),
+                "backend": "openai_native"}
 
-    for name, fn, timeout in cascade:
-        try:
-            res = await asyncio.wait_for(fn(), timeout=timeout)
-            if res is not None:
-                if errors:
-                    res["cascade_errors"] = errors
-                return res
-        except asyncio.TimeoutError:
-            errors.append(f"{name}: timed out after {timeout:.0f}s")
-        except Exception as e:
-            errors.append(f"{name}: {str(e)[:150]}")
+    async def try_gemini_subscription() -> Optional[Dict]:
+        grounded = await gemini_grounded_via_9router(
+            f"Search the web for: {body.query}\n\nReturn a concise summary of what you found. Cite sources.",
+            False,
+        )
+        if not grounded.get("text"):
+            return None
+        return {"query": body.query, "results": format_grounded_as_search_results(grounded, body.query),
+                "backend": "gemini_subscription"}
+
+    async def try_openai_subscription() -> Optional[Dict]:
+        grounded = await openai_websearch_via_9router(body.query)
+        if not grounded.get("text"):
+            return None
+        return {"query": body.query, "results": format_grounded_as_search_results(grounded, body.query),
+                "backend": "openai_subscription"}
+
+    # Collected out-of-band because the race reports per-engine outcomes and a cascade tier can only report one.
+    keyless_errors: List[str] = []
+
+    async def try_keyless_engines() -> Optional[Dict]:
+        outcome = await race_keyless(
+            [KeylessEngine(name="ddg", run=try_keyless),
+             KeylessEngine(name="startpage", run=try_startpage)],
+            KEYLESS_TIER_SECONDS,
+        )
+        keyless_errors.extend(outcome.errors)
+        return outcome.result
+
+    tiers = [
+        CascadeTier(name="keyless", run=try_keyless_engines, budget=KEYLESS_TIER_SECONDS),
+        CascadeTier(name="browser_search", run=try_browser_search, budget=BROWSER_TIER_SECONDS),
+    ] + p_grounded_tiers("search", body.primary, {
+        "gemini_native": try_gemini,
+        "gemini_subscription": try_gemini_subscription,
+        "openai_native": try_openai,
+        "openai_subscription": try_openai_subscription,
+    })
+
+    outcome = await run_cascade(tiers, SEARCH_BUDGET_SECONDS)
+    outcome.errors = keyless_errors + [e for e in outcome.errors if not e.startswith("keyless:")]
+    if outcome.result is not None:
+        if outcome.errors:
+            outcome.result["cascade_errors"] = outcome.errors
+        return outcome.result
+
+    # Nothing refused us, the engines simply had no matches; saying otherwise sends the model hunting for an outage that isn't there.
+    if not keyless_errors:
+        return {
+            "query": body.query,
+            "results": f"No results for: {body.query}\n\nThe search engines answered normally "
+                       "and had no matches for this query.",
+            "backend": "none",
+        }
 
     # Everything failed. Be honest about why instead of an empty "no results".
-    connected = await p_refresh_9r_connected()
+    connected = await refresh_9r_connected()
     has_subscription = bool(connected & {"codex", "antigravity", "gemini-cli"})
     if not (gemini_key or openai_key or has_subscription):
         tail = (
-            "No search backend is configured and DuckDuckGo is rate-limiting this "
-            "network. Connect Codex / Antigravity / Gemini CLI in Settings, or add "
+            "Every free search frontend refused this request and no paid search backend "
+            "is configured. Connect Codex / Antigravity / Gemini CLI in Settings, or add "
             "an OpenAI / Gemini API key, for reliable search."
         )
     else:
         tail = (
-            "DuckDuckGo is rate-limiting this network and every configured provider "
-            "errored (see details below)."
+            "Every free search frontend refused this request and every configured "
+            "provider errored (see details below)."
         )
     nudge = p_browser_fallback_nudge(body.query) if body.browser_ok else ""
-    p_results_text = f"No results for: {body.query}\n\n{tail}" + (f"\n\n{nudge}" if nudge else "")
+    results_text = f"No results for: {body.query}\n\n{tail}" + (f"\n\n{nudge}" if nudge else "")
     return {
         "query": body.query,
-        "results": p_results_text,
+        "results": results_text,
         "backend": "none",
-        "cascade_errors": errors,
+        "cascade_errors": outcome.errors,
     }
 
 
 @web.router.post("/fetch")
 @typechecked
-async def fetch(body: FetchBody) -> dict:
-    """Fetch a URL, primary-aware. Mirrors /search cascade logic."""
+async def fetch(body: FetchBody) -> Dict:
+    """Fetch a URL, primary-aware. Mirrors the /search cascade."""
     # Belt-and-suspenders: even though we delegate to remote Gemini/OpenAI fetchers (which can't reach private IPs), validating the URL here means a private/metadata URL gets a 4xx instead of being silently forwarded.
-    from backend.apps.agents.tools.ssrf_guard import SSRFBlocked, assert_safe_url
+    from backend.apps.agents.tools.ssrf_guard import DomainUnreachable, SSRFBlocked, assert_safe_url
     try:
         await assert_safe_url(body.url)
+    except DomainUnreachable:
+        # A domain that no longer resolves is the archive's whole reason for existing, so let the cascade run instead of 400ing here.
+        pass
     except SSRFBlocked as exc:
-        from fastapi import HTTPException
         raise HTTPException(status_code=400, detail=f"Refused: {exc}")
-    gemini_key = p_resolve_gemini_api_key()
-    openai_key = p_resolve_openai_api_key()
-    primary = (body.primary or "").lower()
+    gemini_key = resolve_gemini_api_key()
+    openai_key = resolve_openai_api_key()
 
-    async def try_gemini():
+    # Remembered so a thin/errored local read is still returned as the last resort if every other tier also fails (never worse than before).
+    local_text: Optional[str] = None
+
+    async def try_local() -> Optional[Dict]:
+        # Fast path: direct httpx + trafilatura, and it returns the page's ACTUAL text (the grounded fetchers summarize, which is slower and loses detail). Thin/errored reads (JS walls, paywalls, HTTP errors) fall through.
+        nonlocal local_text
+        from backend.apps.agents.tools.web import WebFetchTool
+        page = await WebFetchTool.fetch_page(body.url, body.prompt)
+        local_text = page.text
+        if page.kind == "error":
+            return None
+        # A PNG or a scanned PDF has no text for ANY tier to find, so spending a paid fetcher on it buys nothing.
+        if page.kind in ("binary", "pdf_unreadable"):
+            return {"url": body.url, "content": page.text, "backend": "local"}
+        body_text = page.text.split("\n\n", 1)[-1]
+        if len(body_text.strip()) < 200:
+            return None
+        # A challenge screen answers 200 and reads like prose, and it is exactly what our own Chromium on the user's own IP can get past, so never stop here for one.
+        from backend.apps.agents.tools.fetch.bot_wall import looks_like_bot_wall
+        if looks_like_bot_wall(body_text):
+            return None
+        return {"url": body.url, "content": page.text, "backend": "local"}
+
+    async def try_browser_fetch() -> Optional[Dict]:
+        # Packaged-app tier: renders the page in a real offscreen Chromium and returns its visible text, so JS-only / SPA / soft-paywall pages that give httpx nothing actually resolve. Shares the user's browser cookies, so pages they're logged into fetch authed.
+        from backend.apps.agents.tools.fetch.bot_wall import looks_like_bot_wall
+        res = await p_browser_bridge("browser_fetch", {"url": body.url})
+        if not res or not res.get("text"):
+            return None
+        # Measured live: Cloudflare and PerimeterX beat even a real browser on some sites, and their challenge screen is not the page; the archive still has the real one.
+        if looks_like_bot_wall(res["text"]):
+            return None
+        return {"url": body.url, "content": f"Contents of {body.url}:\n\n{res['text']}", "backend": "browser"}
+
+    async def try_wayback() -> Optional[Dict]:
+        # A dead link or a hard bot wall is exactly what the archive is for, and it returns the page's REAL text where a grounded fetcher can only summarise a page it also can't read.
+        from backend.apps.agents.tools.fetch.wayback import fetch_wayback
+        text = await fetch_wayback(body.url)
+        if not text:
+            return None
+        return {"url": body.url, "content": text, "backend": "wayback"}
+
+    async def try_gemini() -> Optional[Dict]:
         if not gemini_key:
             return None
         prompt_bits = [f"Fetch and summarize this URL: {body.url}"]
         if body.prompt:
             prompt_bits.append(f"Focus on: {body.prompt}")
-        grounded = await p_gemini_grounded_call(
-            gemini_key, "\n".join(prompt_bits), use_url_context=True,
-        )
-        return {
-            "url": body.url,
-            "content": p_format_grounded_as_fetch(grounded, body.url),
-            "backend": "gemini_native",
-        }
+        grounded = await gemini_grounded_call(gemini_key, "\n".join(prompt_bits), use_url_context=True)
+        return {"url": body.url, "content": format_grounded_as_fetch(grounded, body.url),
+                "backend": "gemini_native"}
 
-    async def try_openai():
+    async def try_openai() -> Optional[Dict]:
         if not openai_key:
             return None
-        grounded = await p_openai_urlfetch(openai_key, body.url, body.prompt)
-        return {
-            "url": body.url,
-            "content": p_format_grounded_as_fetch(grounded, body.url),
-            "backend": "openai_native",
-        }
+        grounded = await openai_urlfetch(openai_key, body.url, body.prompt)
+        return {"url": body.url, "content": format_grounded_as_fetch(grounded, body.url),
+                "backend": "openai_native"}
 
-    async def try_gemini_subscription():
+    async def try_gemini_subscription() -> Optional[Dict]:
         prompt_bits = [f"Fetch and summarize this URL: {body.url}"]
         if body.prompt:
             prompt_bits.append(f"Focus on: {body.prompt}")
-        grounded = await p_gemini_grounded_via_9router(
-            "\n".join(prompt_bits), use_url_context=True,
-        )
+        grounded = await gemini_grounded_via_9router("\n".join(prompt_bits), True)
         if not grounded.get("text"):
             return None
-        return {
-            "url": body.url,
-            "content": p_format_grounded_as_fetch(grounded, body.url),
-            "backend": "gemini_subscription",
-        }
+        return {"url": body.url, "content": format_grounded_as_fetch(grounded, body.url),
+                "backend": "gemini_subscription"}
 
-    async def try_openai_subscription():
+    async def try_openai_subscription() -> Optional[Dict]:
         # Codex's web_search is general; URL fetch via search query works adequately for our use.
         prompt = f"Fetch this URL and summarize: {body.url}"
         if body.prompt:
             prompt += f"\nFocus on: {body.prompt}"
-        grounded = await p_openai_websearch_via_9router(prompt)
+        grounded = await openai_websearch_via_9router(prompt)
         if not grounded.get("text"):
             return None
-        return {
-            "url": body.url,
-            "content": p_format_grounded_as_fetch(grounded, body.url),
-            "backend": "openai_subscription",
-        }
+        return {"url": body.url, "content": format_grounded_as_fetch(grounded, body.url),
+                "backend": "openai_subscription"}
 
-    # Remembered so a thin/errored local read is still returned as the last resort if every grounded fetcher also fails (never worse than before).
-    local_text: str | None = None
+    tiers = [
+        CascadeTier(name="local", run=try_local, budget=LOCAL_FETCH_TIER_SECONDS),
+        CascadeTier(name="browser", run=try_browser_fetch, budget=BROWSER_TIER_SECONDS),
+        CascadeTier(name="wayback", run=try_wayback, budget=ARCHIVE_TIER_SECONDS),
+    ] + p_grounded_tiers("fetch", body.primary, {
+        "gemini_native": try_gemini,
+        "gemini_subscription": try_gemini_subscription,
+        "openai_native": try_openai,
+        "openai_subscription": try_openai_subscription,
+    })
 
-    async def try_local():
-        # Fast path: direct httpx + trafilatura, sub-second to a few seconds and returns the page's ACTUAL text (the grounded fetchers summarize, which is slower and loses detail). Thin/errored reads (JS walls, paywalls, HTTP errors) fall through to the grounded fetchers that can render them.
-        nonlocal local_text
-        from backend.apps.agents.tools.web import WebFetchTool
-        parts = await WebFetchTool().execute(
-            {"url": body.url, "prompt": body.prompt or ""}, None,
-        )
-        text = p_join_text(parts)
-        local_text = text
-        if text.startswith(("HTTP error", "Error fetching", "Refused to fetch")):
-            return None
-        body_text = text.split("\n\n", 1)[-1] if "\n\n" in text else text
-        if len(body_text.strip()) < 200:
-            return None
-        return {"url": body.url, "content": text, "backend": "local"}
+    outcome = await run_cascade(tiers, FETCH_BUDGET_SECONDS)
+    if outcome.result is not None:
+        if outcome.errors:
+            outcome.result["cascade_errors"] = outcome.errors
+        return outcome.result
 
-    async def try_browser_fetch():
-        # Packaged-app tier: renders the page in a real offscreen Chromium and returns its visible text, so JS-only / SPA / soft-paywall pages that give httpx nothing (the try_local thin-read case) actually resolve. Shares the user's browser cookies, so pages they're logged into fetch authed. Skipped (None) with no Electron main bridge.
-        res = await p_browser_bridge("browser_fetch", {"url": body.url})
-        if not res or not res.get("text"):
-            return None
-        return {"url": body.url, "content": f"Contents of {body.url}:\n\n{res['text']}", "backend": "browser"}
-
-    grounded = [
-        ("gemini_native", try_gemini),
-        ("gemini_subscription", try_gemini_subscription),
-        ("openai_native", try_openai),
-        ("openai_subscription", try_openai_subscription),
-    ]
-    if primary == "openai":
-        grounded = grounded[2:] + grounded[:2]
-
-    cascade = [
-        ("local", try_local, P_LOCAL_FETCH_TIMEOUT),
-        ("browser", try_browser_fetch, P_BROWSER_TIER_TIMEOUT),
-    ] + [
-        (name, fn, P_GROUNDED_ATTEMPT_TIMEOUT) for name, fn in grounded
-    ]
-
-    errors: list[str] = []
-    for name, fn, timeout in cascade:
-        try:
-            res = await asyncio.wait_for(fn(), timeout=timeout)
-            if res is not None:
-                if errors:
-                    res["cascade_errors"] = errors
-                return res
-        except asyncio.TimeoutError:
-            errors.append(f"{name}: timed out after {timeout:.0f}s")
-        except Exception as e:
-            errors.append(f"{name}: {str(e)[:150]}")
-
-    # Grounded all failed; hand back whatever the local read got (even an error string is useful signal) rather than nothing.
+    # Every tier failed; hand back whatever the local read got (even an error string is useful signal) rather than nothing.
     if local_text is not None:
         return {"url": body.url, "content": local_text, "backend": "local",
-                **({"cascade_errors": errors} if errors else {})}
-    raise HTTPException(status_code=502, detail=f"Fetch failed for {body.url}: " + "; ".join(errors)[:400])
+                **({"cascade_errors": outcome.errors} if outcome.errors else {})}
+    raise HTTPException(status_code=502, detail=f"Fetch failed for {body.url}: " + "; ".join(outcome.errors)[:400])
diff --git a/backend/apps/workflows/cloud/__init__.py b/backend/apps/workflows/cloud/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/backend/apps/workflows/cloud/client.py b/backend/apps/workflows/cloud/client.py
new file mode 100644
index 00000000..83c78fbd
--- /dev/null
+++ b/backend/apps/workflows/cloud/client.py
@@ -0,0 +1,361 @@
+"""Talk to the cloud's hosted-workflow routes on behalf of this desktop.
+
+Two failure kinds, kept apart on purpose. CloudRefused means the server answered
+and said no, and its message is written for the user, so it is shown verbatim.
+CloudUnreachable means we never got an answer, which is NOT a no: the caller must
+render "we cannot tell" rather than inventing a denial or a usage number.
+"""
+from __future__ import annotations
+
+import json
+from typing import Any, Dict, List, Optional
+
+import httpx
+from pydantic import BaseModel, ConfigDict, Field
+from typeguard import typechecked
+
+from backend.apps.settings.credentials import account_auth
+from backend.apps.workflows.cloud.schedule import CloudSchedule, wire
+
+# The cloud router is mounted at /api/workflows and a trailing slash 404s there, so the collection paths are the empty string, not "/".
+COLLECTION = ""
+TIMEOUT_SECONDS = 8.0
+# Files are up to 20MB each, so they get their own budget rather than the chatty-call one.
+DOWNLOAD_TIMEOUT_SECONDS = 120.0
+
+
+class CloudRefused(Exception):
+    """The cloud answered and declined. `message` is user-facing prose."""
+
+    def __init__(self, message: str, status: int) -> None:
+        super().__init__(message)
+        self.message = message
+        self.status = status
+
+
+class CloudUnreachable(Exception):
+    """No answer at all: offline, timed out, 5xx, or a body we could not parse."""
+
+    def __init__(self, detail: str) -> None:
+        super().__init__(detail)
+        self.detail = detail
+
+
+class SignedOut(Exception):
+    """No bearer on this machine, or the cloud rejected the one we have."""
+
+
+class CloudLimits(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    workflows: int = 0
+    runs_per_month: int = 0
+    concurrent: int = 0
+
+
+class CloudUsage(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    workflows_enabled: int = 0
+    runs_this_month: int = 0
+
+
+class CloudCapability(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    ok: bool
+    reason: Optional[str] = None
+
+
+class HostedWorkflow(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    id: str
+    enabled: bool = False
+    next_run_at: Optional[int] = None
+    # Total fires, cloud plus the ones done here before the handover. None from a control plane that
+    # predates the count, and a "we were not told" must never be read as a zero.
+    runs_done: Optional[int] = None
+
+
+class CloudPreflight(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    # None when the control plane did not name the plan. Entitlement is read off limits, never off this string.
+    plan: Optional[str] = None
+    limits: CloudLimits = Field(default_factory=CloudLimits)
+    usage: CloudUsage = Field(default_factory=CloudUsage)
+    # None when this control plane predates the capability check, which is a "we cannot tell", never an "it is fine".
+    capability: Optional[CloudCapability] = None
+    hosted: Optional[HostedWorkflow] = None
+
+
+class CloudRunFile(BaseModel):
+    """One file a cloud run produced. `refusal` set means it exists nowhere and says why."""
+
+    model_config = ConfigDict(validate_assignment=True)
+
+    id: str
+    path: str
+    size_bytes: int = 0
+    sha256: Optional[str] = None
+    refusal: Optional[str] = None
+
+
+class CloudRun(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    id: str
+    status: str
+    started_at: Optional[int] = None
+    finished_at: Optional[int] = None
+    error: Optional[str] = None
+    answer: Optional[str] = None
+    notices: List[str] = Field(default_factory=list)
+    cost_usd: Optional[float] = None
+    files: List[CloudRunFile] = Field(default_factory=list)
+
+
+@typechecked
+def p_message(resp: httpx.Response, fallback: str) -> str:
+    """The cloud's own words for a refusal. Hono renders an HTTPException as a bare
+    text/plain sentence, so a JSON-only reader would silently swap every written
+    reason for a generic one; both shapes are read here."""
+    raw = (resp.text or "").strip()
+    if not raw:
+        return fallback
+    try:
+        body = resp.json()
+    except (json.JSONDecodeError, ValueError):
+        body = None
+    if isinstance(body, dict):
+        for key in ("message", "error"):
+            value = body.get(key)
+            if isinstance(value, str) and value:
+                return value
+        return fallback
+    # Anything short and prose-shaped is the message itself; an HTML error page is not.
+    if len(raw) <= 500 and not raw.startswith("<"):
+        return raw
+    return fallback
+
+
+@typechecked
+async def p_call(method: str, path: str, body: Optional[Dict[str, Any]] = None) -> Any:
+    from backend.apps.settings.store import load_settings
+
+    token, base = account_auth(load_settings())
+    if not token:
+        raise SignedOut()
+    try:
+        async with httpx.AsyncClient(timeout=TIMEOUT_SECONDS) as client:
+            resp = await client.request(
+                method,
+                f"{base}/api/workflows{path}",
+                headers={"Authorization": f"Bearer {token}"},
+                json=body,
+            )
+    except httpx.HTTPError as exc:
+        raise CloudUnreachable(f"{type(exc).__name__}") from exc
+    if resp.status_code == 401:
+        raise SignedOut()
+    # A 404 on a route we expect means an older control plane; the caller decides whether that is fatal.
+    if resp.status_code >= 500:
+        raise CloudUnreachable(f"the cloud returned {resp.status_code}")
+    if resp.status_code >= 400:
+        raise CloudRefused(p_message(resp, "The cloud declined this request."), resp.status_code)
+    try:
+        return resp.json()
+    except (json.JSONDecodeError, ValueError) as exc:
+        raise CloudUnreachable("the cloud sent a response we could not read") from exc
+
+
+@typechecked
+def p_hosted(raw: Any) -> Optional[HostedWorkflow]:
+    if not isinstance(raw, dict):
+        return None
+    ident = raw.get("id")
+    if not isinstance(ident, str):
+        return None
+    nxt = raw.get("next_run_at")
+    done = raw.get("runs_done")
+    return HostedWorkflow(
+        id=ident,
+        enabled=bool(raw.get("enabled")),
+        next_run_at=nxt if isinstance(nxt, int) else None,
+        runs_done=done if isinstance(done, int) else None,
+    )
+
+
+@typechecked
+def p_allowance(raw: Dict[str, Any]) -> tuple[CloudLimits, CloudUsage]:
+    """What the plan allows and what has been spent, from either shape the cloud answers in."""
+    limits = raw.get("limits") if isinstance(raw.get("limits"), dict) else {}
+    usage = raw.get("usage") if isinstance(raw.get("usage"), dict) else {}
+    return (
+        CloudLimits(
+            workflows=int(limits.get("workflows") or 0),
+            runs_per_month=int(limits.get("runsPerMonth") or 0),
+            concurrent=int(limits.get("concurrent") or 0),
+        ),
+        CloudUsage(
+            workflows_enabled=int(usage.get("enabled") or 0),
+            runs_this_month=int(usage.get("runs_this_month") or 0),
+        ),
+    )
+
+
+@typechecked
+async def preflight(definition: Dict[str, Any], hosted_id: Optional[str]) -> CloudPreflight:
+    """Plan, spend, and whether the runner could do this job, in one round trip.
+    Falls back to the plain list route when the control plane has no preflight,
+    which leaves `capability` unknown rather than pretending it passed."""
+    body: Dict[str, Any] = {"definition": definition}
+    if hosted_id:
+        body["hosted_id"] = hosted_id
+    try:
+        raw = await p_call("POST", "/preflight", body)
+    except CloudRefused as exc:
+        if exc.status != 404:
+            raise
+        return await p_preflight_from_list(hosted_id)
+    if not isinstance(raw, dict):
+        raise CloudUnreachable("the cloud sent a preflight we could not read")
+    limits, usage = p_allowance(raw)
+    cap = raw.get("capability")
+    return CloudPreflight(
+        plan=raw.get("plan") if isinstance(raw.get("plan"), str) else None,
+        limits=limits,
+        usage=usage,
+        capability=CloudCapability(ok=bool(cap.get("ok")), reason=cap.get("reason"))
+        if isinstance(cap, dict) else None,
+        hosted=p_hosted(raw.get("hosted")),
+    )
+
+
+@typechecked
+async def p_preflight_from_list(hosted_id: Optional[str]) -> CloudPreflight:
+    raw = await p_call("GET", COLLECTION)
+    if not isinstance(raw, dict):
+        raise CloudUnreachable("the cloud sent a workflow list we could not read")
+    rows = raw.get("workflows") if isinstance(raw.get("workflows"), list) else []
+    match = next((r for r in rows if isinstance(r, dict) and r.get("id") == hosted_id), None)
+    limits, usage = p_allowance(raw)
+    return CloudPreflight(plan=None, limits=limits, usage=usage, capability=None, hosted=p_hosted(match))
+
+
+@typechecked
+async def put_workflow(
+    *, hosted_id: Optional[str], name: str, definition: Dict[str, Any],
+    schedule: CloudSchedule, runs_before: int = 0, context: Optional[Dict[str, Any]] = None,
+) -> HostedWorkflow:
+    """Create the hosted copy, or re-push onto the existing row so an edited workflow stops running
+    last week's prose. runs_before rides only on the create: an edit that resent it would hand a
+    nearly-spent run cap its whole budget back. `context` carries the user's skills and the names of
+    the apps a cloud run cannot reach; an older control plane ignores the extra keys, which costs a
+    run its skills but never its run."""
+    body: Dict[str, Any] = {"name": name, "definition": definition, "schedule": wire(schedule)}
+    if context:
+        body.update(context)
+    if hosted_id:
+        try:
+            raw = await p_call("POST", f"/{hosted_id}/update", body)
+            hosted = p_hosted(raw)
+            if hosted:
+                return hosted
+        except CloudRefused as exc:
+            # 404 is the row being gone (deleted elsewhere, or a control plane with no update route); make a fresh one.
+            if exc.status != 404:
+                raise
+    raw = await p_call("POST", COLLECTION, {**body, "runs_before": max(0, runs_before)})
+    hosted = p_hosted(raw)
+    if not hosted:
+        raise CloudUnreachable("the cloud accepted the workflow but did not say which one")
+    return hosted
+
+
+@typechecked
+async def set_enabled(hosted_id: str, enabled: bool) -> HostedWorkflow:
+    raw = await p_call("POST", f"/{hosted_id}/enable", {"enabled": enabled})
+    hosted = p_hosted(raw)
+    if not hosted:
+        raise CloudUnreachable("the cloud did not report the workflow back")
+    return hosted
+
+
+@typechecked
+async def delete_hosted(hosted_id: str) -> None:
+    """Stop the cloud copy. A 404 is success: it is already gone."""
+    try:
+        await p_call("POST", f"/{hosted_id}/delete", {})
+    except CloudRefused as exc:
+        if exc.status != 404:
+            raise
+
+
+@typechecked
+def p_files(raw: Any) -> List[CloudRunFile]:
+    """A control plane with no file support answers without the key, which is an empty list, not an error."""
+    if not isinstance(raw, list):
+        return []
+    out: List[CloudRunFile] = []
+    for row in raw:
+        if not isinstance(row, dict) or not isinstance(row.get("id"), str) or not isinstance(row.get("path"), str):
+            continue
+        size = row.get("size_bytes")
+        out.append(CloudRunFile(
+            id=row["id"],
+            path=row["path"],
+            size_bytes=size if isinstance(size, int) else 0,
+            sha256=row.get("sha256") if isinstance(row.get("sha256"), str) else None,
+            refusal=row.get("refusal") if isinstance(row.get("refusal"), str) else None,
+        ))
+    return out
+
+
+@typechecked
+async def list_runs(hosted_id: str) -> List[CloudRun]:
+    raw = await p_call("GET", f"/{hosted_id}/runs")
+    rows = raw.get("runs") if isinstance(raw, dict) else None
+    if not isinstance(rows, list):
+        raise CloudUnreachable("the cloud sent a run list we could not read")
+    out: List[CloudRun] = []
+    for row in rows:
+        if not isinstance(row, dict):
+            continue
+        notices = row.get("notices")
+        out.append(CloudRun(
+            id=str(row.get("id") or ""),
+            status=str(row.get("status") or "unknown"),
+            started_at=row.get("started_at") if isinstance(row.get("started_at"), int) else None,
+            finished_at=row.get("finished_at") if isinstance(row.get("finished_at"), int) else None,
+            error=row.get("error") if isinstance(row.get("error"), str) else None,
+            answer=row.get("answer") if isinstance(row.get("answer"), str) else None,
+            notices=[n for n in notices if isinstance(n, str)] if isinstance(notices, list) else [],
+            cost_usd=row.get("cost_usd") if isinstance(row.get("cost_usd"), (int, float)) else None,
+            files=p_files(row.get("files")),
+        ))
+    return out
+
+
+@typechecked
+async def download_run_file(hosted_id: str, run_id: str, file_id: str) -> bytes:
+    """The file's bytes. Its own call rather than p_call because this answer is not JSON."""
+    from backend.apps.settings.store import load_settings
+
+    token, base = account_auth(load_settings())
+    if not token:
+        raise SignedOut()
+    url = f"{base}/api/workflows/{hosted_id}/runs/{run_id}/files/{file_id}"
+    try:
+        async with httpx.AsyncClient(timeout=DOWNLOAD_TIMEOUT_SECONDS) as client:
+            resp = await client.get(url, headers={"Authorization": f"Bearer {token}"})
+    except httpx.HTTPError as exc:
+        raise CloudUnreachable(f"{type(exc).__name__}") from exc
+    if resp.status_code == 401:
+        raise SignedOut()
+    if resp.status_code >= 500:
+        raise CloudUnreachable(f"the cloud returned {resp.status_code}")
+    if resp.status_code >= 400:
+        raise CloudRefused(p_message(resp, "That file could not be downloaded."), resp.status_code)
+    return resp.content
diff --git a/backend/apps/workflows/cloud/definition.py b/backend/apps/workflows/cloud/definition.py
new file mode 100644
index 00000000..7101bab8
--- /dev/null
+++ b/backend/apps/workflows/cloud/definition.py
@@ -0,0 +1,66 @@
+"""The copy of a workflow the cloud is allowed to hold.
+
+Two jobs. First, drop everything the runner cannot use: local session ids, run
+history, dashboard placement, and the escalation tiers (which carry the user's
+phone number and could not ring anyone from a container anyway). Second, be
+stable, so hashing it detects a real edit and not the clock ticking.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+from typing import Any, Dict, Optional
+
+from typeguard import typechecked
+
+from backend.apps.workflows.models import Workflow
+
+# Anything that changes on its own, points at something only this machine has, or is nobody else's business.
+LOCAL_ONLY_FIELDS = (
+    "deleted_at",
+    "draft_steps",
+    "next_run_at",
+    "last_run_at",
+    "last_run_status",
+    "last_run_id",
+    "created_at",
+    "updated_at",
+    "source_session_id",
+    "edit_agent_session_id",
+    "schedule_agent_session_id",
+    "last_test_session_id",
+    "dashboard_id",
+    "unsaved",
+    "auto_named",
+    "tested_signature",
+    "step_tool_usage",
+    "permissions",
+    "cloud_workflow_id",
+    "cloud_definition_signature",
+)
+
+
+@typechecked
+def cloud_definition(wf: Workflow) -> Dict[str, Any]:
+    body = wf.model_dump(mode="json")
+    for field in LOCAL_ONLY_FIELDS:
+        body.pop(field, None)
+    # The cloud owns the timer for this copy; a live schedule inside it would be a second one.
+    schedule = body.get("schedule")
+    if isinstance(schedule, dict):
+        schedule["enabled"] = False
+    body["execution_target"] = "cloud"
+    return body
+
+
+@typechecked
+def definition_signature(
+    definition: Dict[str, Any], schedule: Dict[str, Any], context: Optional[Dict[str, Any]] = None
+) -> str:
+    """Fingerprint of exactly what we last handed the cloud, schedule and skills included,
+    so "your edits are not up there yet" is a fact rather than a guess. Editing a skill a
+    workflow leans on is an edit to that workflow's behaviour, so it belongs in here."""
+    payload = json.dumps(
+        {"definition": definition, "schedule": schedule, "context": context or {}}, sort_keys=True
+    )
+    return hashlib.sha256(payload.encode("utf-8")).hexdigest()
diff --git a/backend/apps/workflows/cloud/handover.py b/backend/apps/workflows/cloud/handover.py
new file mode 100644
index 00000000..0d92caae
--- /dev/null
+++ b/backend/apps/workflows/cloud/handover.py
@@ -0,0 +1,118 @@
+"""Moving one workflow's timer between this machine and our servers.
+
+Exactly one of the two may be armed at any moment. `execution_target` flips to
+"cloud" only once the cloud has taken the workflow, and back to "device" only
+once the cloud has let it go, so the window where both would fire does not
+exist. Every caller that stops a workflow (the toggle, Trash, purge) goes
+through take_back for the same reason.
+"""
+from __future__ import annotations
+
+import logging
+from datetime import datetime
+from typing import Optional
+
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from backend.apps.workflows import scheduler, storage
+from backend.apps.workflows.cloud import client as cloud
+from backend.apps.workflows.cloud.definition import cloud_definition, definition_signature
+from backend.apps.workflows.cloud.portable_context import portable_context
+from backend.apps.workflows.cloud.schedule import ScheduleSupported, to_cloud_schedule, wire
+from backend.apps.workflows.cloud.status import epoch_to_datetime
+from backend.apps.workflows.models import Workflow
+
+logger = logging.getLogger(__name__)
+
+SIGN_IN_MESSAGE = "Sign in to your OpenSwarm account to run workflows in the cloud."
+UNREACHABLE_UP = (
+    "Couldn't reach the cloud, so nothing was scheduled there. "
+    "This workflow still runs on this device. Try again in a moment."
+)
+UNREACHABLE_DOWN = (
+    "Couldn't reach the cloud to stop the cloud schedule, so nothing changed. "
+    "It keeps running in the cloud until this goes through."
+)
+
+
+class TargetOutcome(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    ok: bool
+    # Present only when ok is false, and written for the user: usually the cloud's own words.
+    message: Optional[str] = None
+
+
+@typechecked
+async def hand_to_cloud(wf: Workflow, enabled: bool) -> TargetOutcome:
+    mapping = to_cloud_schedule(wf.schedule)
+    if not isinstance(mapping, ScheduleSupported):
+        return TargetOutcome(ok=False, message=mapping.reason)
+    if enabled and not scheduler.is_schedule_configured(wf.schedule):
+        return TargetOutcome(ok=False, message="Finish setting up the schedule before choosing where it runs.")
+    definition = cloud_definition(wf)
+    context = portable_context().as_body()
+    try:
+        hosted = await cloud.put_workflow(
+            hosted_id=wf.cloud_workflow_id,
+            name=wf.title or "Workflow",
+            definition=definition,
+            schedule=mapping.schedule,
+            runs_before=wf.schedule.runs_count,
+            context=context,
+        )
+        if hosted.enabled != enabled:
+            hosted = await cloud.set_enabled(hosted.id, enabled)
+    except cloud.SignedOut:
+        return TargetOutcome(ok=False, message=SIGN_IN_MESSAGE)
+    except cloud.CloudRefused as exc:
+        return TargetOutcome(ok=False, message=exc.message)
+    except cloud.CloudUnreachable as exc:
+        logger.info("cloud workflow push unreachable for %s: %s", wf.id, exc.detail)
+        return TargetOutcome(ok=False, message=UNREACHABLE_UP)
+
+    wf.execution_target = "cloud"
+    wf.cloud_workflow_id = hosted.id
+    wf.cloud_definition_signature = definition_signature(definition, wire(mapping.schedule), context)
+    wf.schedule.enabled = enabled
+    wf.next_run_at = epoch_to_datetime(hosted.next_run_at) if enabled else None
+    wf.updated_at = datetime.now()
+    storage.save_workflow(wf)
+    scheduler.kick()
+    return TargetOutcome(ok=True)
+
+
+@typechecked
+async def take_back(wf: Workflow, enabled: bool) -> TargetOutcome:
+    if wf.cloud_workflow_id:
+        try:
+            await cloud.delete_hosted(wf.cloud_workflow_id)
+        except cloud.SignedOut:
+            # Signed out means the cloud copy is unreachable, not gone; arming our timer here would double-fire it.
+            return TargetOutcome(ok=False, message=SIGN_IN_MESSAGE)
+        except cloud.CloudRefused as exc:
+            return TargetOutcome(ok=False, message=exc.message)
+        except cloud.CloudUnreachable as exc:
+            logger.info("cloud workflow delete unreachable for %s: %s", wf.id, exc.detail)
+            return TargetOutcome(ok=False, message=UNREACHABLE_DOWN)
+
+    wf.execution_target = "device"
+    wf.cloud_workflow_id = None
+    wf.cloud_definition_signature = None
+    wf.schedule.enabled = enabled and scheduler.is_schedule_configured(wf.schedule)
+    wf.next_run_at = scheduler.compute_next_fire(wf) if wf.schedule.enabled else None
+    wf.updated_at = datetime.now()
+    storage.save_workflow(wf)
+    scheduler.kick()
+    return TargetOutcome(ok=True)
+
+
+@typechecked
+async def release_before_removing(wf: Workflow) -> TargetOutcome:
+    """Take the cloud copy down before a workflow disappears from this machine.
+    Trash and purge both call it: a hosted row nobody can see any more still
+    runs on its own schedule, and still costs the user money."""
+    if wf.execution_target != "cloud" and not wf.cloud_workflow_id:
+        return TargetOutcome(ok=True)
+    return await take_back(wf, False)
diff --git a/backend/apps/workflows/cloud/portable_context.py b/backend/apps/workflows/cloud/portable_context.py
new file mode 100644
index 00000000..dcf07a13
--- /dev/null
+++ b/backend/apps/workflows/cloud/portable_context.py
@@ -0,0 +1,157 @@
+"""What travels with a workflow besides the workflow, and the sharp line about what does not.
+
+Two things go up:
+
+* **Skills.** The user's own writing. A container without them does not get a weaker Skill tool,
+  it gets none at all (the backend gates the whole tool on one non-built-in skill existing), and
+  the agent then answers from general knowledge in exactly the same confident voice. So the
+  skills travel and the cloud run knows what the user's house ratio actually is.
+* **The NAMES of connected apps.** Names only, so the agent can say "I cannot reach your Notion
+  from a cloud run" instead of inventing what is in it.
+
+One thing must never go up: the credentials behind those apps. A ToolDefinition's `credentials`
+and `oauth_tokens` hold Slack session cookies, Notion and GitHub access tokens that do not expire,
+and Google refresh tokens. The destination is an ephemeral machine executing the user's own agent
+prose with Bash in it. Sending them would put a permanent, full-scope key to someone's email and
+documents inside a box designed to be thrown away, so this module reads `tool.name` and nothing
+else, and the runner's own RunSpec has no field that could hold a secret even if someone tried.
+"""
+from __future__ import annotations
+
+import logging
+import os
+from typing import Any, Dict, List
+
+from pydantic import BaseModel, ConfigDict, Field
+from typeguard import typechecked
+
+logger = logging.getLogger(__name__)
+
+# Matches openswarm-runner/runner/run_spec.py. The runner refuses past these anyway; refusing here
+# too means an oversized push is a legible error on the user's own machine, not a dead cloud run.
+MAX_SKILLS = 60
+MAX_SKILL_FILE_CHARS = 200_000
+MAX_TOTAL_SKILL_CHARS = 1_000_000
+# A skill is prose and small scripts. Anything else in the folder is somebody's stray download.
+PORTABLE_SUFFIXES = (".md", ".txt", ".py", ".sh", ".json", ".yaml", ".yml", ".csv", ".ts", ".js")
+
+
+class PortableSkillFile(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    path: str
+    text: str
+
+
+class PortableSkill(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    id: str
+    files: List[PortableSkillFile]
+
+
+class PortableContext(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    skills: List[PortableSkill] = Field(default_factory=list)
+    # Names of apps connected here whose sign-in details stay here.
+    unavailable_mcp_servers: List[str] = Field(default_factory=list)
+
+    @typechecked
+    def as_body(self) -> Dict[str, Any]:
+        return {
+            "skills": [skill.model_dump(mode="json") for skill in self.skills],
+            "unavailable_mcp_servers": self.unavailable_mcp_servers,
+        }
+
+
+@typechecked
+def p_read_text(path: str) -> str:
+    """The file's text, or empty when it is binary, unreadable, or too big to carry."""
+    try:
+        if os.path.getsize(path) > MAX_SKILL_FILE_CHARS:
+            return ""
+        with open(path, "r", encoding="utf-8") as handle:
+            return handle.read()
+    except (OSError, UnicodeDecodeError):
+        return ""
+
+
+@typechecked
+def p_skill_files(skill: Any) -> List[PortableSkillFile]:
+    """One skill flattened to SKILL.md plus whatever else is in its folder.
+
+    A legacy flat `<id>.md` skill goes up as a folder with a SKILL.md too, so the wire has one
+    shape and the container has one layout.
+    """
+    files = [PortableSkillFile(path="SKILL.md", text=skill.content)]
+    folder = getattr(skill, "dir_path", "") or ""
+    if not folder or not os.path.isdir(folder):
+        return files
+    for directory, subdirs, filenames in os.walk(folder):
+        subdirs[:] = sorted(name for name in subdirs if not name.startswith("."))
+        for filename in sorted(filenames):
+            if filename == "SKILL.md" or not filename.lower().endswith(PORTABLE_SUFFIXES):
+                continue
+            absolute = os.path.join(directory, filename)
+            if os.path.islink(absolute):
+                continue
+            text = p_read_text(absolute)
+            if text:
+                files.append(PortableSkillFile(
+                    path=os.path.relpath(absolute, folder).replace(os.sep, "/"),
+                    text=text,
+                ))
+    return files
+
+
+@typechecked
+def portable_skills() -> List[PortableSkill]:
+    """Every skill the user wrote or installed. Built-ins are skipped: the container seeds its own."""
+    from backend.apps.skills.skills import safe_slug, sync_skills
+
+    out: List[PortableSkill] = []
+    budget = MAX_TOTAL_SKILL_CHARS
+    for skill in sync_skills():
+        if skill.built_in or len(out) >= MAX_SKILLS:
+            continue
+        # The id becomes a directory name in the container, so it has to survive being one.
+        slug = safe_slug(skill.id)
+        if not slug:
+            continue
+        files = p_skill_files(skill)
+        cost = sum(len(f.text) for f in files)
+        if cost > budget:
+            logger.info("skill %s not sent to the cloud: the run spec's skill budget is spent", skill.id)
+            continue
+        budget -= cost
+        out.append(PortableSkill(id=slug, files=files))
+    return out
+
+
+@typechecked
+def unavailable_mcp_servers() -> List[str]:
+    """Connected apps, by name. Reads `tool.name` and deliberately nothing else."""
+    from backend.apps.tools_lib.tools_lib import load_all_tools
+
+    names: List[str] = []
+    for tool in load_all_tools():
+        if tool.mcp_config and tool.enabled and tool.auth_status in ("configured", "connected"):
+            names.append(tool.name)
+    return sorted(set(names))
+
+
+@typechecked
+def portable_context() -> PortableContext:
+    """Everything a cloud run should know that the workflow itself does not carry."""
+    try:
+        skills = portable_skills()
+    except Exception:
+        logger.exception("could not gather skills for the cloud; the run will have none")
+        skills = []
+    try:
+        servers = unavailable_mcp_servers()
+    except Exception:
+        logger.exception("could not gather connected app names for the cloud")
+        servers = []
+    return PortableContext(skills=skills, unavailable_mcp_servers=servers)
diff --git a/backend/apps/workflows/cloud/routes.py b/backend/apps/workflows/cloud/routes.py
new file mode 100644
index 00000000..2d664671
--- /dev/null
+++ b/backend/apps/workflows/cloud/routes.py
@@ -0,0 +1,137 @@
+"""HTTP surface for running a workflow on our servers instead of this machine.
+
+Its own SubApp so the already-large workflows.py does not grow. Prefix:
+/api/cloud_workflows. The local half of the handover (which timer is armed)
+lives in cloud/handover.py; nothing here is the authority on entitlement, the
+cloud re-decides that at create and again at dispatch.
+"""
+from __future__ import annotations
+
+import asyncio
+from contextlib import asynccontextmanager
+from datetime import datetime
+from typing import List, Literal, Optional, Union
+
+from fastapi import HTTPException
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from backend.apps.workflows import storage
+from backend.apps.workflows.cloud import client as cloud
+from backend.apps.workflows.cloud.handover import TargetOutcome, hand_to_cloud, take_back
+from backend.apps.workflows.cloud.run_files import LocalRunFile, described, downloads_root, fetch_missing
+from backend.apps.workflows.cloud.status import CloudStatus, compute_status, epoch_to_datetime
+from backend.apps.workflows.models import Workflow
+from backend.config.Apps import SubApp
+
+
+@asynccontextmanager
+async def cloud_workflows_lifespan():
+    yield
+
+
+cloud_workflows = SubApp("cloud_workflows", cloud_workflows_lifespan)
+
+
+class TargetRequest(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    # The whole desired state, not a delta: where the schedule runs and whether it runs at all.
+    target: Literal["device", "cloud"]
+    enabled: bool
+
+
+class CloudRunRow(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    id: str
+    status: str
+    started_at: Optional[datetime] = None
+    finished_at: Optional[datetime] = None
+    error: Optional[str] = None
+    answer: Optional[str] = None
+    notices: List[str] = []
+    cost_usd: Optional[float] = None
+    files: List[LocalRunFile] = []
+
+
+class CloudRunsReady(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    state: Literal["ready"] = "ready"
+    runs: List[CloudRunRow] = []
+    # Where this machine puts a cloud run's files, so the UI can say it out loud even when a run
+    # has none yet. A folder the user is told about is a folder they can find later.
+    files_folder: str = ""
+
+
+class CloudRunsUnavailable(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    # Same rule as the status route: not knowing is its own answer, and it shows no runs rather than "no runs".
+    state: Literal["signed_out", "unknown"]
+    detail: Optional[str] = None
+
+
+CloudRunsResponse = Union[CloudRunsReady, CloudRunsUnavailable]
+
+
+@typechecked
+def p_workflow(workflow_id: str) -> Workflow:
+    wf = storage.get_workflow(workflow_id)
+    if not wf or wf.deleted_at is not None:
+        raise HTTPException(status_code=404, detail="Workflow not found")
+    return wf
+
+
+@cloud_workflows.router.get("/{workflow_id}/status")
+async def workflow_cloud_status(workflow_id: str) -> CloudStatus:
+    return await compute_status(p_workflow(workflow_id))
+
+
+@cloud_workflows.router.post("/{workflow_id}/target")
+async def set_workflow_target(workflow_id: str, body: TargetRequest) -> TargetOutcome:
+    wf = p_workflow(workflow_id)
+    if body.target == "cloud":
+        return await hand_to_cloud(wf, body.enabled)
+    return await take_back(wf, body.enabled)
+
+
+@cloud_workflows.router.get("/{workflow_id}/runs")
+async def workflow_cloud_runs(workflow_id: str) -> CloudRunsResponse:
+    wf = p_workflow(workflow_id)
+    if not wf.cloud_workflow_id:
+        return CloudRunsReady(runs=[], files_folder=downloads_root())
+    try:
+        runs = await cloud.list_runs(wf.cloud_workflow_id)
+    except cloud.SignedOut:
+        return CloudRunsUnavailable(state="signed_out")
+    except cloud.CloudRefused as exc:
+        # A 404 here is the hosted copy being gone, which is an empty history, not a broken one.
+        if exc.status == 404:
+            return CloudRunsReady(runs=[], files_folder=downloads_root())
+        return CloudRunsUnavailable(state="unknown", detail=exc.message)
+    except cloud.CloudUnreachable as exc:
+        return CloudRunsUnavailable(state="unknown", detail=exc.detail)
+
+    # Answered now, files fetched behind it. A 20MB attachment must not hold up the history the
+    # user asked for, and a run's files appear a moment later without them doing anything.
+    asyncio.create_task(fetch_missing(wf.cloud_workflow_id, wf, runs))
+
+    return CloudRunsReady(
+        files_folder=downloads_root(),
+        runs=[
+            CloudRunRow(
+                id=r.id,
+                status=r.status,
+                started_at=epoch_to_datetime(r.started_at),
+                finished_at=epoch_to_datetime(r.finished_at),
+                error=r.error,
+                answer=r.answer,
+                notices=r.notices,
+                cost_usd=r.cost_usd,
+                files=described(wf, r),
+            )
+            for r in runs
+        ],
+    )
diff --git a/backend/apps/workflows/cloud/run_files.py b/backend/apps/workflows/cloud/run_files.py
new file mode 100644
index 00000000..2695c805
--- /dev/null
+++ b/backend/apps/workflows/cloud/run_files.py
@@ -0,0 +1,143 @@
+"""Bring a cloud run's files down to the machine the user actually sits at.
+
+A cloud run finishes while the laptop is shut, so the files live in the cloud until
+something fetches them. That something is this module, and it puts them in Downloads
+rather than anywhere clever: the whole point of a deliverable is that the user can
+find it without being told where to look, and "it is in Downloads" is the one answer
+nobody needs explained.
+
+Every file is fetched at most once. The local path is derived, never stored, so a
+user who moves or deletes a file just gets it back on the next look rather than
+staring at a broken link.
+"""
+from __future__ import annotations
+
+import asyncio
+import logging
+import os
+import re
+from typing import List, Optional
+
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from backend.apps.workflows.cloud import client as cloud
+from backend.apps.workflows.models import Workflow
+
+logger = logging.getLogger(__name__)
+
+# Bounded so one History open cannot spend minutes pulling a whole month of runs.
+MAX_CONCURRENT_DOWNLOADS = 3
+
+
+class LocalRunFile(BaseModel):
+    """A cloud file plus where it is (or would be) on this machine."""
+
+    model_config = ConfigDict(validate_assignment=True)
+
+    id: str
+    path: str
+    size_bytes: int
+    refusal: Optional[str] = None
+    # Set once the bytes are on disk. None means "not here yet", never "not coming".
+    local_path: Optional[str] = None
+
+
+@typechecked
+def safe_component(raw: str) -> str:
+    """One path segment a filesystem will take, with the user's own name still legible."""
+    cleaned = re.sub(r'[<>:"/\\|?*\x00-\x1f]', "-", raw).strip(" .")
+    return cleaned[:60] or "untitled"
+
+
+@typechecked
+def downloads_root() -> str:
+    home = os.path.expanduser("~")
+    downloads = os.path.join(home, "Downloads")
+    return os.path.join(downloads if os.path.isdir(downloads) else home, "OpenSwarm")
+
+
+@typechecked
+def run_folder(workflow: Workflow, run: cloud.CloudRun) -> str:
+    """Where this run's files go: one folder per run, named so a list of them reads as a history."""
+    stamp = run.finished_at or run.started_at
+    when = "unknown-date"
+    if stamp:
+        from datetime import datetime, timezone
+
+        when = datetime.fromtimestamp(stamp / 1000, tz=timezone.utc).astimezone().strftime("%Y-%m-%d %H%M")
+    return os.path.join(
+        downloads_root(),
+        safe_component(workflow.title or "Workflow"),
+        safe_component(f"{when} {run.id[:8]}"),
+    )
+
+
+@typechecked
+def local_path_for(folder: str, file: cloud.CloudRunFile) -> str:
+    """The file's home, with every segment of the run-relative path made filesystem-safe."""
+    parts = [safe_component(part) for part in file.path.split("/") if part not in ("", ".", "..")]
+    return os.path.join(folder, *(parts or ["file"]))
+
+
+@typechecked
+def p_already_here(path: str, size_bytes: int) -> bool:
+    try:
+        return os.path.getsize(path) == size_bytes
+    except OSError:
+        return False
+
+
+@typechecked
+def described(workflow: Workflow, run: cloud.CloudRun) -> List[LocalRunFile]:
+    """This run's files and where they are right now. Reads disk, never fetches."""
+    folder = run_folder(workflow, run)
+    out: List[LocalRunFile] = []
+    for file in run.files:
+        local = local_path_for(folder, file)
+        out.append(LocalRunFile(
+            id=file.id,
+            path=file.path,
+            size_bytes=file.size_bytes,
+            refusal=file.refusal,
+            local_path=local if file.refusal is None and p_already_here(local, file.size_bytes) else None,
+        ))
+    return out
+
+
+@typechecked
+async def p_fetch_one(hosted_id: str, run: cloud.CloudRun, file: cloud.CloudRunFile, target: str) -> None:
+    payload = await cloud.download_run_file(hosted_id, run.id, file.id)
+    os.makedirs(os.path.dirname(target), exist_ok=True)
+    temporary = f"{target}.part"
+    with open(temporary, "wb") as handle:
+        handle.write(payload)
+    os.replace(temporary, target)
+    logger.info("cloud run %s: saved %s to %s", run.id, file.path, target)
+
+
+@typechecked
+async def fetch_missing(hosted_id: str, workflow: Workflow, runs: List[cloud.CloudRun]) -> None:
+    """Pull down anything not already here. Never raises: a run's answer must render
+    even when its attachments cannot be fetched, and the next look tries again."""
+    semaphore = asyncio.Semaphore(MAX_CONCURRENT_DOWNLOADS)
+
+    async def p_guarded(run: cloud.CloudRun, file: cloud.CloudRunFile, target: str) -> None:
+        async with semaphore:
+            try:
+                await p_fetch_one(hosted_id, run, file, target)
+            except (cloud.SignedOut, cloud.CloudRefused, cloud.CloudUnreachable, OSError) as exc:
+                logger.info("cloud run %s: %s not fetched (%s)", run.id, file.path, exc)
+
+    pending = []
+    for run in runs:
+        folder = run_folder(workflow, run)
+        for file in run.files:
+            if file.refusal is not None:
+                continue
+            target = local_path_for(folder, file)
+            if p_already_here(target, file.size_bytes):
+                continue
+            pending.append(p_guarded(run, file, target))
+    if pending:
+        await asyncio.gather(*pending)
diff --git a/backend/apps/workflows/cloud/schedule.py b/backend/apps/workflows/cloud/schedule.py
new file mode 100644
index 00000000..88cd5f09
--- /dev/null
+++ b/backend/apps/workflows/cloud/schedule.py
@@ -0,0 +1,168 @@
+"""Map a local schedule onto the cloud scheduler's smaller vocabulary.
+
+The cloud speaks three cadences: repeat every N minutes, once a day, or on the
+weekdays you picked. Each can carry an end date and a run cap. What it does not
+speak is a cadence with a phase longer than one period (every third day, every
+other week, monthly), because the phase is anchored to the workflow's creation
+on this machine and there is nowhere on the wire to put that anchor. Silently
+rounding one of those off would fire a workflow on days the user never picked,
+so it is refused here in the user's own words and stays on their machine.
+
+The wall-clock kinds carry the IANA zone rather than a UTC hour. A UTC hour is a
+schedule that moves by an hour twice a year for everyone outside UTC: "9am" set
+in July quietly becomes 8am in November. The cloud does its recurrence maths in
+the zone for the same reason scheduler._next_fire_after does.
+"""
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Any, Dict, List, Literal, Optional, Union
+from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
+
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from backend.apps.workflows.models import ScheduleConfig
+from backend.apps.workflows.scheduler import host_timezone_name
+
+CADENCE_PREFIX = "Cloud runs repeat on an interval, once a day, or on the weekdays you pick."
+
+
+class CloudScheduleBase(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    # Both optional, both meaning "and then it is finished". Sent only when set: the cloud's schema
+    # takes an absent field, not a null one.
+    ends_at: Optional[int] = None
+    max_runs: Optional[int] = None
+
+
+class CloudIntervalSchedule(CloudScheduleBase):
+    kind: Literal["interval"] = "interval"
+    minutes: int
+
+
+class CloudDailySchedule(CloudScheduleBase):
+    kind: Literal["daily"] = "daily"
+    hour: int
+    minute: int
+    timezone: str
+
+
+class CloudWeeklySchedule(CloudScheduleBase):
+    kind: Literal["weekly"] = "weekly"
+    # Sunday=0, the same convention as ScheduleConfig.on_days.
+    days: List[int]
+    hour: int
+    minute: int
+    timezone: str
+
+
+CloudSchedule = Union[CloudIntervalSchedule, CloudDailySchedule, CloudWeeklySchedule]
+
+
+class ScheduleSupported(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    supported: Literal[True] = True
+    schedule: CloudSchedule
+
+
+class ScheduleUnsupported(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    supported: Literal[False] = False
+    reason: str
+
+
+ScheduleMapping = Union[ScheduleSupported, ScheduleUnsupported]
+
+
+@typechecked
+def wire(sched: CloudSchedule) -> Dict[str, Any]:
+    """The JSON body shape. Unset bounds are dropped rather than sent as null, which is what the
+    cloud's schema expects and what keeps the definition fingerprint stable across versions."""
+    return sched.model_dump(exclude_none=True)
+
+
+@typechecked
+def p_zone_name(name: str) -> str:
+    """A concrete IANA name the cloud can hand to its own tz database. "local" and anything
+    unresolvable fall back to this host's zone, which is what the local scheduler already does."""
+    if not name or name == "local":
+        return host_timezone_name()
+    try:
+        ZoneInfo(name)
+    except ZoneInfoNotFoundError:
+        return host_timezone_name()
+    return name
+
+
+@typechecked
+def p_epoch_ms(when: datetime) -> int:
+    # Naive datetimes are host-local, matching how the local scheduler reads its own stored dates.
+    aware = when if when.tzinfo is not None else when.replace(tzinfo=ZoneInfo(host_timezone_name()))
+    return int(aware.timestamp() * 1000)
+
+
+@typechecked
+def p_bounds(sched: ScheduleConfig) -> Dict[str, Any]:
+    out: Dict[str, Any] = {}
+    if sched.ends_at is not None:
+        out["ends_at"] = p_epoch_ms(sched.ends_at)
+    if sched.max_runs is not None:
+        out["max_runs"] = sched.max_runs
+    return out
+
+
+@typechecked
+def to_cloud_schedule(sched: ScheduleConfig) -> ScheduleMapping:
+    bounds = p_bounds(sched)
+    if sched.repeat_unit == "minute":
+        return ScheduleSupported(schedule=CloudIntervalSchedule(minutes=max(5, sched.repeat_every), **bounds))
+    if sched.repeat_unit == "hour":
+        return ScheduleSupported(
+            schedule=CloudIntervalSchedule(minutes=max(5, sched.repeat_every * 60), **bounds)
+        )
+
+    zone = p_zone_name(sched.timezone)
+    if sched.repeat_unit == "day":
+        if sched.repeat_every == 1:
+            return ScheduleSupported(
+                schedule=CloudDailySchedule(hour=sched.hour, minute=sched.minute, timezone=zone, **bounds)
+            )
+        return ScheduleUnsupported(
+            reason=(
+                f"{CADENCE_PREFIX} This one runs every {sched.repeat_every} days at a set time, "
+                "which the cloud scheduler cannot do yet, so it stays on this device."
+            ),
+        )
+
+    if sched.repeat_unit == "week":
+        if not sched.on_days:
+            return ScheduleUnsupported(
+                reason="Pick the days this should run on before choosing where it runs.",
+            )
+        if sched.repeat_every == 1:
+            return ScheduleSupported(
+                schedule=CloudWeeklySchedule(
+                    days=sorted(sched.on_days),
+                    hour=sched.hour,
+                    minute=sched.minute,
+                    timezone=zone,
+                    **bounds,
+                )
+            )
+        return ScheduleUnsupported(
+            reason=(
+                f"{CADENCE_PREFIX} This one runs every {sched.repeat_every} weeks, "
+                "which the cloud scheduler cannot do yet, so it stays on this device."
+            ),
+        )
+
+    return ScheduleUnsupported(
+        reason=(
+            f"{CADENCE_PREFIX} This one runs monthly, "
+            "which the cloud scheduler cannot do yet, so it stays on this device."
+        ),
+    )
diff --git a/backend/apps/workflows/cloud/status.py b/backend/apps/workflows/cloud/status.py
new file mode 100644
index 00000000..48f6ce67
--- /dev/null
+++ b/backend/apps/workflows/cloud/status.py
@@ -0,0 +1,142 @@
+"""What the desktop is allowed to say about cloud runs for one workflow.
+
+Three answers, and they are different answers. `ready` is the cloud having told
+us something. `signed_out` is a known no-account. `unknown` is us not knowing,
+which is deliberately NOT a denial and carries no numbers at all: a failed fetch
+that renders as "0 runs left" or "not entitled" is the bug this shape prevents.
+"""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import Literal, Optional, Union
+
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from backend.apps.workflows import storage
+from backend.apps.workflows.cloud import client as cloud
+from backend.apps.workflows.cloud.definition import cloud_definition, definition_signature
+from backend.apps.workflows.cloud.portable_context import portable_context
+from backend.apps.workflows.cloud.schedule import ScheduleSupported, to_cloud_schedule, wire
+from backend.apps.workflows.models import Workflow
+
+
+class HostedState(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    id: str
+    enabled: bool
+    next_run_at: Optional[datetime] = None
+    # False when the workflow was edited after we pushed it, so the cloud is running older prose.
+    in_sync: bool
+
+
+class CloudStatusBase(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    target: Literal["device", "cloud"]
+    schedule_supported: bool
+    schedule_reason: Optional[str] = None
+
+
+class CloudStatusSignedOut(CloudStatusBase):
+    state: Literal["signed_out"] = "signed_out"
+
+
+class CloudStatusUnknown(CloudStatusBase):
+    state: Literal["unknown"] = "unknown"
+    detail: str
+
+
+class CloudStatusReady(CloudStatusBase):
+    state: Literal["ready"] = "ready"
+    plan: Optional[str] = None
+    limits: cloud.CloudLimits
+    usage: cloud.CloudUsage
+    # None when this control plane cannot tell us whether the runner could do the job.
+    capability: Optional[cloud.CloudCapability] = None
+    hosted: Optional[HostedState] = None
+
+
+CloudStatus = Union[CloudStatusReady, CloudStatusSignedOut, CloudStatusUnknown]
+
+
+@typechecked
+def epoch_to_datetime(ms: Optional[int]) -> Optional[datetime]:
+    if ms is None:
+        return None
+    return datetime.fromtimestamp(ms / 1000, tz=timezone.utc).astimezone()
+
+
+@typechecked
+def current_signature(wf: Workflow) -> Optional[str]:
+    """The fingerprint this workflow would push right now, or None when its
+    schedule has no cloud equivalent at all."""
+    mapping = to_cloud_schedule(wf.schedule)
+    if not isinstance(mapping, ScheduleSupported):
+        return None
+    # wire() is the richer serializer (weekly, zones, ends_at); portable_context is what the runner needs to reproduce the user's setup.
+    return definition_signature(
+        cloud_definition(wf), wire(mapping.schedule), portable_context().as_body()
+    )
+
+
+@typechecked
+def p_mirror_cloud_state(wf: Workflow, hosted: Optional[cloud.HostedWorkflow]) -> None:
+    """Once the cloud holds the timer it also holds the truth about it. The local
+    scheduler stops rolling next_run_at for a cloud workflow, so every "next run"
+    in the app would sit at a time that has already passed, and an On switch read
+    off our own copy would keep saying On for a workflow paused somewhere else."""
+    if wf.execution_target != "cloud":
+        return
+    wanted = epoch_to_datetime(hosted.next_run_at) if hosted and hosted.enabled else None
+    changed = wf.next_run_at != wanted
+    wf.next_run_at = wanted
+    if hosted and wf.schedule.enabled != hosted.enabled:
+        wf.schedule.enabled = hosted.enabled
+        changed = True
+    # Runs the cloud performed count against a max_runs cap the same as ours do, so copy its total
+    # back. Without this, taking a nearly-spent schedule off the cloud would restart it at zero.
+    if hosted and hosted.runs_done is not None and wf.schedule.runs_count != hosted.runs_done:
+        wf.schedule.runs_count = hosted.runs_done
+        changed = True
+    if changed:
+        storage.save_workflow(wf)
+
+
+@typechecked
+async def compute_status(wf: Workflow) -> CloudStatus:
+    mapping = to_cloud_schedule(wf.schedule)
+    supported = isinstance(mapping, ScheduleSupported)
+    shared = {
+        "target": wf.execution_target,
+        "schedule_supported": supported,
+        "schedule_reason": None if isinstance(mapping, ScheduleSupported) else mapping.reason,
+    }
+    try:
+        pre = await cloud.preflight(cloud_definition(wf), wf.cloud_workflow_id)
+    except cloud.SignedOut:
+        return CloudStatusSignedOut(**shared)
+    except cloud.CloudUnreachable as exc:
+        return CloudStatusUnknown(detail=exc.detail, **shared)
+    except cloud.CloudRefused as exc:
+        return CloudStatusUnknown(detail=exc.message, **shared)
+
+    p_mirror_cloud_state(wf, pre.hosted)
+    hosted: Optional[HostedState] = None
+    if pre.hosted:
+        hosted = HostedState(
+            id=pre.hosted.id,
+            enabled=pre.hosted.enabled,
+            next_run_at=epoch_to_datetime(pre.hosted.next_run_at),
+            in_sync=wf.cloud_definition_signature is not None
+            and wf.cloud_definition_signature == current_signature(wf),
+        )
+    return CloudStatusReady(
+        plan=pre.plan,
+        limits=pre.limits,
+        usage=pre.usage,
+        capability=pre.capability,
+        hosted=hosted,
+        **shared,
+    )
diff --git a/backend/apps/workflows/executor.py b/backend/apps/workflows/executor.py
index 35cbb5f9..e8db1e48 100644
--- a/backend/apps/workflows/executor.py
+++ b/backend/apps/workflows/executor.py
@@ -273,9 +273,8 @@ async def execute(
             mode=wf.mode or "agent",
             provider=wf.provider or "anthropic",
             system_prompt=_resolve_system_prompt(wf),
-            allowed_tools=resolved_allowed_tools if resolved_allowed_tools is not None else [
-                "Read", "Edit", "Write", "Bash", "Glob", "Grep", "AskUserQuestion",
-            ],
+            # None when the user has not frozen the Actions set, which means the workflow runs with the mode's full surface exactly like a chat does.
+            allowed_tools=resolved_allowed_tools,
             dashboard_id=resolve_workflow_dashboard_id(wf),
             workflow_run_id=run.id,
         )
diff --git a/backend/apps/workflows/models.py b/backend/apps/workflows/models.py
index 0e56bd4c..a60724b8 100644
--- a/backend/apps/workflows/models.py
+++ b/backend/apps/workflows/models.py
@@ -91,6 +91,12 @@ class Workflow(BaseModel):
     steps: list[WorkflowStep] = Field(default_factory=list)
     actions: ActionsConfig = Field(default_factory=ActionsConfig)
     schedule: ScheduleConfig = Field(default_factory=ScheduleConfig)
+    # Where a SCHEDULED fire runs. "cloud" hands the timer to our servers outright, so this machine must never fire it nor roll next_run_at, or the same slot runs twice. Manual Run-now always stays local.
+    execution_target: Literal["device", "cloud"] = "device"
+    # The cloud's own id for our hosted copy. Only backend/apps/workflows/cloud writes these two, and only after the cloud has actually accepted the workflow.
+    cloud_workflow_id: Optional[str] = None
+    # Fingerprint of what we last pushed, so "the cloud is running an older version of this" is detectable instead of silent.
+    cloud_definition_signature: Optional[str] = None
     permissions: list[PermissionTier] = Field(
         default_factory=lambda: [PermissionTier(kind="notify")]
     )
diff --git a/backend/apps/workflows/owned_sessions.py b/backend/apps/workflows/owned_sessions.py
new file mode 100644
index 00000000..d63668a3
--- /dev/null
+++ b/backend/apps/workflows/owned_sessions.py
@@ -0,0 +1,90 @@
+"""Which agent sessions a workflow OWNS, and therefore takes with it when it is purged.
+
+Purging a workflow used to remove the record and its run history and leave the chat transcripts
+behind forever. That is a storage leak and, worse, a broken promise: the user asked for an
+irreversible delete and the conversation stayed on disk. It went unnoticed because a separate bug
+was unlinking open sessions on every boot, which garbage-collected the orphans by accident. Fixing
+that bug is what exposed this one.
+
+The owned/referenced split is the load-bearing part. A workflow's edit, scheduling and test chats
+exist only to serve it and die with it. `source_session_id` is the user's own chat that the
+workflow was generated FROM; it has its own life and must survive. Deleting it would take a real
+conversation the user never asked to lose.
+"""
+
+from typing import List
+
+from typeguard import typechecked
+
+from backend.apps.workflows.models import Workflow
+
+# Sticky session pointers whose sessions belong to the workflow. Adding a fourth without listing it
+# here leaks a transcript past a hard delete, so a test pins this against the model's own fields.
+OWNED_SESSION_FIELDS = (
+    "edit_agent_session_id",
+    "schedule_agent_session_id",
+    "last_test_session_id",
+)
+
+# Pointers to sessions the workflow did NOT create. Never delete these.
+REFERENCED_SESSION_FIELDS = ("source_session_id",)
+
+
+@typechecked
+def owned_session_ids(wf: Workflow) -> List[str]:
+    """Every session id this workflow is responsible for cleaning up."""
+    out: List[str] = []
+    for field in OWNED_SESSION_FIELDS:
+        sid = getattr(wf, field, None)
+        if isinstance(sid, str) and sid and sid not in out:
+            out.append(sid)
+    return out
+
+
+@typechecked
+async def drop_session(sid: str) -> bool:
+    """Close one chat and delete its file. Best effort: one unreadable file must not strand the rest."""
+    import logging
+    from backend.apps.agents.manager.session.session_store import delete_session_file
+
+    logger = logging.getLogger(__name__)
+    try:
+        from backend.apps.agents.agent_manager import agent_manager
+        await agent_manager.close_session(sid)
+    except Exception:
+        logger.debug("could not close session %s", sid, exc_info=True)
+    try:
+        delete_session_file(sid)
+        return True
+    except Exception:
+        logger.warning("could not delete session file %s", sid, exc_info=True)
+        return False
+
+
+@typechecked
+async def purge_owned_sessions(wf: Workflow) -> int:
+    """Close and delete the workflow's own chats. Returns how many were removed.
+
+    Best-effort per session, because a partial purge is the state that leaves a transcript behind.
+    """
+    removed = 0
+    for sid in owned_session_ids(wf):
+        if await drop_session(sid):
+            removed += 1
+    return removed
+
+
+@typechecked
+async def retire_previous_test_session(wf: Workflow) -> None:
+    """Drop the old test chat before a new one takes its place.
+
+    `last_test_session_id` holds exactly one pointer, so a second test used to strand the first
+    session: an orphan card sitting on the user's canvas that nothing references any more, and a
+    transcript that outlives a hard delete of the workflow, which is the very leak this module
+    exists to prevent.
+    """
+    sid = getattr(wf, "last_test_session_id", None)
+    if not isinstance(sid, str) or not sid:
+        return
+    await drop_session(sid)
+    wf.last_test_session_id = None
diff --git a/backend/apps/workflows/reconcile_references.py b/backend/apps/workflows/reconcile_references.py
new file mode 100644
index 00000000..ab2ccb8e
--- /dev/null
+++ b/backend/apps/workflows/reconcile_references.py
@@ -0,0 +1,67 @@
+"""Null the workflow pointers whose session no longer exists.
+
+A pointer to a missing thing is worse than no pointer at all. The UI reads `edit_agent_session_id`,
+asks for a session that is gone, gets nothing back, and renders a blank panel with no explanation.
+No pointer renders the designed empty state instead, which is the thing a user can actually read.
+
+This runs once at boot. It cannot recover a deleted transcript, and it is not a substitute for
+never losing one; it is the wall that keeps a loss from showing up as a broken-looking screen.
+"""
+
+import logging
+from typing import Dict, List
+
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from backend.apps.workflows import storage
+from backend.apps.workflows.owned_sessions import OWNED_SESSION_FIELDS
+
+logger = logging.getLogger(__name__)
+
+
+class ReconcileReport(BaseModel):
+    """What the sweep found, so a silent heal still leaves a trace worth reading."""
+
+    model_config = ConfigDict(validate_assignment=True)
+
+    workflows_scanned: int = 0
+    pointers_cleared: int = 0
+    workflows_touched: List[str] = []
+
+
+@typechecked
+def reconcile_workflow_sessions() -> ReconcileReport:
+    """Clear sticky session pointers whose file is gone. Safe to run repeatedly."""
+    from backend.apps.agents.manager.session.session_store import load_session_data
+
+    report = ReconcileReport()
+    resolved: Dict[str, bool] = {}
+    # Trashed ones too, or restoring a workflow hands the user back a pointer that already dangles.
+    for wf in list(storage.list_workflows()) + list(storage.list_deleted_workflows()):
+        report.workflows_scanned += 1
+        dirty = False
+        for field in OWNED_SESSION_FIELDS:
+            sid = getattr(wf, field, None)
+            if not isinstance(sid, str) or not sid:
+                continue
+            if sid not in resolved:
+                try:
+                    resolved[sid] = load_session_data(sid) is not None
+                except Exception:
+                    # Unreadable is not the same as missing; leave the pointer rather than guess.
+                    resolved[sid] = True
+            if resolved[sid]:
+                continue
+            setattr(wf, field, None)
+            report.pointers_cleared += 1
+            dirty = True
+        if dirty:
+            report.workflows_touched.append(wf.id)
+            storage.save_workflow(wf)
+    if report.pointers_cleared:
+        logger.info(
+            "reconcile: cleared %d dangling session pointer(s) across %d of %d workflow(s)",
+            report.pointers_cleared, len(report.workflows_touched), report.workflows_scanned,
+        )
+    return report
diff --git a/backend/apps/workflows/scheduler.py b/backend/apps/workflows/scheduler.py
index 5bb1f303..c4d88ba6 100644
--- a/backend/apps/workflows/scheduler.py
+++ b/backend/apps/workflows/scheduler.py
@@ -289,12 +289,21 @@ def _disable_schedule(wf: Workflow) -> None:
     storage.save_workflow(wf)
 
 
+def p_timer_is_ours(wf: Workflow) -> bool:
+    """Whether this process owns a workflow's timer. Both the fire loop and the sleep math must
+    agree: if only one of them skipped cloud-hosted workflows, an overdue one would never roll
+    forward and the loop would spin at its 1s floor forever."""
+    return wf.execution_target != "cloud"
+
+
 async def _tick() -> None:
     now_utc = datetime.now(timezone.utc)
     if storage.get_paused():
         return
     due: list[Workflow] = []
     for wf in storage.list_workflows():
+        if not p_timer_is_ours(wf):
+            continue
         if not wf.schedule.enabled:
             continue
         if not is_schedule_configured(wf.schedule):
@@ -330,6 +339,8 @@ def seconds_to_next_fire() -> Optional[float]:
     now_utc = datetime.now(timezone.utc)
     soonest: Optional[datetime] = None
     for wf in storage.list_workflows():
+        if not p_timer_is_ours(wf):
+            continue
         if not wf.schedule.enabled:
             continue
         nra = _as_utc(wf.next_run_at)
@@ -452,6 +463,8 @@ def reconcile_on_startup() -> None:
     """
     now_utc = datetime.now(timezone.utc)
     for wf in storage.list_workflows():
+        if not p_timer_is_ours(wf):
+            continue
         if not wf.schedule.enabled:
             wf.next_run_at = None
             storage.save_workflow(wf)
@@ -478,6 +491,9 @@ async def start() -> None:
     if _loop_task is not None:
         return
     _mark_stuck_runs_failed()
+    # A pointer at a session that is gone renders as a blank panel; nulling it renders the empty state.
+    from backend.apps.workflows.reconcile_references import reconcile_workflow_sessions
+    reconcile_workflow_sessions()
     reconcile_on_startup()
     _loop_task = asyncio.create_task(_loop())
 
diff --git a/backend/apps/workflows/storage.py b/backend/apps/workflows/storage.py
index 5422af03..05e9df3e 100644
--- a/backend/apps/workflows/storage.py
+++ b/backend/apps/workflows/storage.py
@@ -10,6 +10,7 @@ last_run_* / next_run_at summary fields; full history lives in the runs file.
 """
 
 import json
+import logging
 import os
 import tempfile
 from threading import Lock
@@ -18,6 +19,8 @@ from typing import Optional
 from backend.config.paths import DATA_ROOT
 from backend.apps.workflows.models import Workflow, WorkflowRun, MissedRun
 
+logger = logging.getLogger(__name__)
+
 DATA_DIR = os.path.join(DATA_ROOT, "workflows")
 RUNS_DIR = os.path.join(DATA_DIR, "runs")
 PAUSED_FILE = os.path.join(DATA_DIR, "paused.json")
@@ -99,7 +102,9 @@ def _load_all_from_disk() -> None:
             if wf.schedule.timezone == "local":
                 wf.schedule.timezone = host_tz
             _workflow_cache[wf.id] = wf
-        except Exception:
+        except Exception as e:
+            # A dropped file is a workflow that vanished from the UI while sitting right there on disk; say so or nobody can ever explain it.
+            logger.warning("Skipping unreadable workflow file %s: %s", fname, e)
             continue
     if os.path.exists(RUNS_DIR):
         for fname in os.listdir(RUNS_DIR):
diff --git a/backend/apps/workflows/workflows.py b/backend/apps/workflows/workflows.py
index ffd4b9a8..b646ffc9 100644
--- a/backend/apps/workflows/workflows.py
+++ b/backend/apps/workflows/workflows.py
@@ -20,6 +20,7 @@ from backend.apps.workflows.models import (
     GenerateMetadataResponse,
 )
 from backend.apps.workflows import storage, scheduler, executor, audit, escalation
+from backend.apps.workflows.cloud.handover import release_before_removing
 from backend.apps.settings.models import DEFAULT_MODEL
 
 logger = logging.getLogger(__name__)
@@ -150,8 +151,8 @@ def p_source_session_memory(session_id: Optional[str]) -> tuple[dict[str, str],
         messages = getattr(sess, "messages", None) if sess is not None else None
         tool_latencies = getattr(sess, "tool_latencies", None) if sess is not None else None
         if decisions is None:
-            from backend.apps.agents.manager.session.session_store import _load_session_data
-            data = _load_session_data(session_id) or {}
+            from backend.apps.agents.manager.session.session_store import load_session_data
+            data = load_session_data(session_id) or {}
             decisions = data.get("approval_decisions") or []
             messages = data.get("messages") or []
             tool_latencies = data.get("tool_latencies") or {}
@@ -854,6 +855,10 @@ async def delete_workflow(workflow_id: str):
     wf = storage.get_workflow(workflow_id)
     if not wf or wf.deleted_at is not None:
         raise HTTPException(status_code=404, detail="Workflow not found")
+    # Trashing a cloud-hosted workflow has to stop the cloud copy first, or it keeps running (and billing) with nobody able to see it.
+    released = await release_before_removing(wf)
+    if not released.ok:
+        raise HTTPException(status_code=409, detail=released.message)
     wf.deleted_at = datetime.now()
     wf.schedule.enabled = False
     wf.next_run_at = None
@@ -896,10 +901,16 @@ async def restore_workflow(workflow_id: str):
 
 @workflows.router.delete("/{workflow_id}/purge")
 async def purge_workflow(workflow_id: str):
-    """Hard delete, only from Trash. Removes the record and its run history."""
+    """Hard delete, only from Trash. Removes the record, its run history and its own chats."""
     wf = storage.get_workflow(workflow_id)
     if not wf or wf.deleted_at is None:
         raise HTTPException(status_code=404, detail="Workflow not in trash")
+    released = await release_before_removing(wf)
+    if not released.ok:
+        raise HTTPException(status_code=409, detail=released.message)
+    # Before the record goes, or the ids that name the transcripts go with it and they leak forever.
+    from backend.apps.workflows.owned_sessions import purge_owned_sessions
+    await purge_owned_sessions(wf)
     storage.delete_workflow(workflow_id)
     try:
         from backend.apps.agents.core.ws_manager import ws_manager
@@ -940,8 +951,8 @@ async def edit_agent_session(workflow_id: str):
             p_sess.dashboard_id = p_wsm.active_dashboard_id or executor.resolve_workflow_dashboard_id(wf)
             p_sess.workflow_edit_id = wf.id
             try:
-                from backend.apps.agents.manager.session.session_store import _save_session
-                _save_session(p_sess.id, p_sess.model_dump(mode="json"))
+                from backend.apps.agents.manager.session.session_store import save_session
+                save_session(p_sess.id, p_sess.model_dump(mode="json"))
             except Exception:
                 logger.debug("could not persist reattached edit-agent markers", exc_info=True)
             try:
@@ -1022,7 +1033,8 @@ async def edit_agent_session(workflow_id: str):
         mode=wf.mode or "agent",
         provider=wf.provider or "anthropic",
         system_prompt=system_prompt,
-        allowed_tools=[],
+        # None, not [], since an empty list is now a real restriction and would leave this chat with no tools at all.
+        allowed_tools=None,
         dashboard_id=edit_dashboard_id,
         workflow_edit_id=wf.id,
     )
@@ -1033,8 +1045,8 @@ async def edit_agent_session(workflow_id: str):
         from backend.apps.agents.core.models import Message
         session.messages.append(Message(role="assistant", content=EDIT_AGENT_INTRO))
     try:
-        from backend.apps.agents.manager.session.session_store import _save_session
-        _save_session(session.id, session.model_dump(mode="json"))
+        from backend.apps.agents.manager.session.session_store import save_session
+        save_session(session.id, session.model_dump(mode="json"))
     except Exception:
         logger.debug("could not persist edit-agent session", exc_info=True)
     try:
@@ -1250,7 +1262,10 @@ async def test_run_workflow(workflow_id: str, body: dict):
         set_workflow_approval_step,
     )
     from backend.apps.workflows import executor
+    from backend.apps.workflows.owned_sessions import retire_previous_test_session
 
+    # One test card at a time: the previous test's chat is about to lose the only pointer to it, so retire it now rather than leave an orphan card on the canvas.
+    await retire_previous_test_session(wf)
     # Like a real run, the test must attach to the dashboard the user is watching, else its browser tools have no card to drive and the test "runs" but visibly does nothing. Prefer the live active dashboard over the workflow's stored home.
     from backend.apps.agents.core.ws_manager import ws_manager as p_wsm
     test_dashboard_id = p_wsm.active_dashboard_id or executor.resolve_workflow_dashboard_id(wf)
@@ -1261,9 +1276,8 @@ async def test_run_workflow(workflow_id: str, body: dict):
         mode=wf.mode or "agent",
         provider=wf.provider or "anthropic",
         system_prompt=executor._resolve_system_prompt(wf),
-        allowed_tools=resolved_allowed_tools if resolved_allowed_tools is not None else [
-            "Read", "Edit", "Write", "Bash", "Glob", "Grep", "AskUserQuestion",
-        ],
+        # A test run has to hit the same tool surface the scheduled run will, or the test proves nothing.
+        allowed_tools=resolved_allowed_tools,
         dashboard_id=test_dashboard_id,
     )
     session = await agent_manager.launch_agent(config)
@@ -1400,7 +1414,8 @@ async def schedule_agent_session(workflow_id: str):
         mode=wf.mode or "agent",
         provider=wf.provider or "anthropic",
         system_prompt=system_prompt,
-        allowed_tools=[],
+        # None, not [], since an empty list is now a real restriction and would leave this chat with no tools at all.
+        allowed_tools=None,
         dashboard_id=wf.dashboard_id,
     )
     session = await agent_manager.launch_agent(config)
diff --git a/backend/config/entity_references.py b/backend/config/entity_references.py
new file mode 100644
index 00000000..cc7c2400
--- /dev/null
+++ b/backend/config/entity_references.py
@@ -0,0 +1,113 @@
+"""Every cross-entity id field on a backend model: what entity it points at, and where that
+entity is resolved from an id.
+
+OpenSwarm stores entities as JSON records that point at each other with bare strings. A workflow
+holds `edit_agent_session_id`, an app record holds `workspace_id`, a dashboard card holds
+`session_id`. Nothing at the type level says the referent exists, so a reader that forgets the miss
+renders a blank instead of a designed empty state. This module is the one place that says what each
+pointer means, and the `dangling-refs` linter check (linter/checks/dangling_refs.py) fails any new
+`*_id` / `*_ids` field on a backend model that is not declared here.
+
+Data only, no logic: nothing resolves a pointer for you. The `EntityStore` rows name the function
+that does, and the linter checks those names still exist so a rename can't quietly rot this file.
+"""
+
+from __future__ import annotations
+
+from enum import Enum
+from typing import List
+
+from pydantic import BaseModel, ConfigDict
+
+
+class EntityKind(str, Enum):
+    """A record type other records point at by id."""
+
+    SESSION = "session"
+    DASHBOARD = "dashboard"
+    WORKFLOW = "workflow"
+    WORKFLOW_RUN = "workflow_run"
+    OUTPUT = "output"
+    WORKSPACE = "workspace"
+    CLOUD_WORKFLOW = "cloud_workflow"
+
+
+class EntityStore(BaseModel):
+    """Where one entity kind is looked up by id, so a reader knows what a pointer resolves against."""
+
+    model_config = ConfigDict(validate_assignment=True, frozen=True)
+
+    kind: EntityKind
+    module: str
+    lookup: str
+
+
+class EntityReference(BaseModel):
+    """One id field on one backend model, and the entity kind it points at."""
+
+    model_config = ConfigDict(validate_assignment=True, frozen=True)
+
+    module: str
+    model: str
+    field: str
+    target: EntityKind
+
+
+ENTITY_STORES: List[EntityStore] = [
+    EntityStore(kind=EntityKind.SESSION, module="backend.apps.agents.manager.session.session_store", lookup="load_session_data"),
+    EntityStore(kind=EntityKind.DASHBOARD, module="backend.apps.dashboards.dashboards", lookup="load"),
+    EntityStore(kind=EntityKind.WORKFLOW, module="backend.apps.workflows.storage", lookup="get_workflow"),
+    # No get_run(run_id) exists, so a run is found by scanning the listing; a stale last_run_id just reads as "no run".
+    EntityStore(kind=EntityKind.WORKFLOW_RUN, module="backend.apps.workflows.storage", lookup="list_all_runs"),
+    EntityStore(kind=EntityKind.OUTPUT, module="backend.apps.outputs.workspace_io", lookup="load_output"),
+    # A workspace is a folder on disk, not a record, so its only by-id lookup is the read route.
+    EntityStore(kind=EntityKind.WORKSPACE, module="backend.apps.outputs.outputs", lookup="read_workspace"),
+    # The one referent that does not live on this machine. preflight asks the cloud whether it still has the row; a miss renders as "nothing is running this", never as a silent blank.
+    EntityStore(kind=EntityKind.CLOUD_WORKFLOW, module="backend.apps.workflows.cloud.client", lookup="preflight"),
+]
+
+CROSS_ENTITY_REFERENCES: List[EntityReference] = [
+    EntityReference(module="backend.apps.agents.core.models", model="AgentConfig", field="dashboard_id", target=EntityKind.DASHBOARD),
+    EntityReference(module="backend.apps.agents.core.models", model="AgentConfig", field="selected_app_output_ids", target=EntityKind.OUTPUT),
+    EntityReference(module="backend.apps.agents.core.models", model="AgentConfig", field="workflow_edit_id", target=EntityKind.WORKFLOW),
+    EntityReference(module="backend.apps.agents.core.models", model="AgentConfig", field="workflow_run_id", target=EntityKind.WORKFLOW_RUN),
+    EntityReference(module="backend.apps.agents.core.models", model="AgentSession", field="dashboard_id", target=EntityKind.DASHBOARD),
+    EntityReference(module="backend.apps.agents.core.models", model="AgentSession", field="parent_session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.agents.core.models", model="AgentSession", field="workflow_edit_id", target=EntityKind.WORKFLOW),
+    EntityReference(module="backend.apps.agents.core.models", model="AgentSession", field="workflow_run_id", target=EntityKind.WORKFLOW_RUN),
+    EntityReference(module="backend.apps.agents.core.models", model="ApprovalRequest", field="session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.agents.manager.Messaging", model="QueuedMessage", field="selected_app_output_ids", target=EntityKind.OUTPUT),
+    EntityReference(module="backend.apps.agents.manager.streaming.HookContext", model="HookContext", field="session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.dashboard_layout.models", model="CardPosition", field="session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.dashboard_layout.models", model="ViewCardPosition", field="output_id", target=EntityKind.OUTPUT),
+    EntityReference(module="backend.apps.dashboards.models", model="BrowserCardPosition", field="dashboard_id", target=EntityKind.DASHBOARD),
+    EntityReference(module="backend.apps.dashboards.models", model="CardPosition", field="session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.dashboards.models", model="DashboardLayout", field="expanded_session_ids", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.dashboards.models", model="ViewCardPosition", field="output_id", target=EntityKind.OUTPUT),
+    EntityReference(module="backend.apps.outputs.models", model="AgentCreateAppRequest", field="parent_session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.outputs.models", model="Output", field="session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.outputs.models", model="Output", field="workspace_id", target=EntityKind.WORKSPACE),
+    EntityReference(module="backend.apps.outputs.models", model="OutputCreate", field="session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.outputs.models", model="OutputCreate", field="workspace_id", target=EntityKind.WORKSPACE),
+    EntityReference(module="backend.apps.outputs.models", model="OutputExecute", field="output_id", target=EntityKind.OUTPUT),
+    EntityReference(module="backend.apps.outputs.models", model="OutputExecuteResult", field="output_id", target=EntityKind.OUTPUT),
+    EntityReference(module="backend.apps.outputs.models", model="OutputUpdate", field="session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.outputs.models", model="OutputUpdate", field="workspace_id", target=EntityKind.WORKSPACE),
+    EntityReference(module="backend.apps.outputs.models", model="PublishPreflightRequest", field="output_id", target=EntityKind.OUTPUT),
+    EntityReference(module="backend.apps.outputs.models", model="PublishRequest", field="output_id", target=EntityKind.OUTPUT),
+    EntityReference(module="backend.apps.outputs.models", model="WorkspaceSeedRequest", field="workspace_id", target=EntityKind.WORKSPACE),
+    EntityReference(module="backend.apps.skills.models", model="SkillWorkspaceSeedRequest", field="workspace_id", target=EntityKind.WORKSPACE),
+    EntityReference(module="backend.apps.workflows.models", model="AskRunBody", field="run_id", target=EntityKind.WORKFLOW_RUN),
+    EntityReference(module="backend.apps.workflows.models", model="MissedRun", field="workflow_id", target=EntityKind.WORKFLOW),
+    EntityReference(module="backend.apps.workflows.models", model="Workflow", field="cloud_workflow_id", target=EntityKind.CLOUD_WORKFLOW),
+    EntityReference(module="backend.apps.workflows.models", model="Workflow", field="dashboard_id", target=EntityKind.DASHBOARD),
+    EntityReference(module="backend.apps.workflows.models", model="Workflow", field="edit_agent_session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.workflows.models", model="Workflow", field="last_run_id", target=EntityKind.WORKFLOW_RUN),
+    EntityReference(module="backend.apps.workflows.models", model="Workflow", field="last_test_session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.workflows.models", model="Workflow", field="schedule_agent_session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.workflows.models", model="Workflow", field="source_session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.workflows.models", model="WorkflowCreate", field="dashboard_id", target=EntityKind.DASHBOARD),
+    EntityReference(module="backend.apps.workflows.models", model="WorkflowCreate", field="source_session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.workflows.models", model="WorkflowRun", field="session_id", target=EntityKind.SESSION),
+    EntityReference(module="backend.apps.workflows.models", model="WorkflowRun", field="workflow_id", target=EntityKind.WORKFLOW),
+]
diff --git a/backend/config/headless.py b/backend/config/headless.py
new file mode 100644
index 00000000..55c086c1
--- /dev/null
+++ b/backend/config/headless.py
@@ -0,0 +1,75 @@
+"""What the backend can still offer when nobody is sitting in front of it.
+
+Two different absences, and they are not the same absence. `OPENSWARM_HEADLESS=1` says no
+desktop shell owns this process, so no human will answer a prompt and no window arrives on
+its own. A renderer that has never registered on the dashboard WebSocket says there is no
+Electron window to drive a `<webview>` through. A cloud container starts as both and, once
+it boots Electron under a virtual display, becomes only the first.
+
+The browser tools therefore hang off the renderer actually being there, not off the flag,
+which is what lets the same code be right on a laptop, in the runner container, and in
+whatever environment attaches a renderer next.
+"""
+
+import os
+from typing import Dict, FrozenSet, Set
+
+from typeguard import typechecked
+
+# Each of these ends at a live Electron renderer: browser and app delegation drive real <webview>s that only the frontend can serialize and click.
+RENDERER_BOUND_TOOLS: FrozenSet[str] = frozenset({
+    "CreateBrowserAgent",
+    "BrowserAgent",
+    "BrowserAgents",
+    "AppAgent",
+})
+
+# Each of these ends at a person: ShowUI (the same gate AskUI rides) draws for someone to look at, and AskUserQuestion waits for someone to answer. A renderer nobody is watching does not bring them back.
+HUMAN_BOUND_TOOLS: FrozenSet[str] = frozenset({
+    "ShowUI",
+    "AskUserQuestion",
+})
+
+
+@typechecked
+def is_headless() -> bool:
+    """True when the backend was started with OPENSWARM_HEADLESS=1. Read per call rather than
+    frozen at import, so a launcher that sets it late still counts (and tests can flip it)."""
+    return os.environ.get("OPENSWARM_HEADLESS") == "1"
+
+
+@typechecked
+def renderer_reachable() -> bool:
+    """Whether an Electron renderer has ever registered on this backend's dashboard socket.
+
+    Imported inside the call because config sits below apps in the import order; hoisting
+    ws_manager to module scope would close a cycle."""
+    from backend.apps.agents.core.ws_manager import ws_manager
+    return ws_manager.renderer_ever_attached
+
+
+@typechecked
+def denied_tools() -> FrozenSet[str]:
+    """Every builtin that would dead-end in this process, given who is actually attached.
+
+    The renderer-bound set drops only when the shell that would have brought a window is
+    absent AND no window ever showed up. A desktop launch keeps offering them across a
+    socket blip on purpose: browser_agent's dispatch gate is what waits out a reconnect,
+    and a tool pruned at session build never comes back for the life of that session.
+    """
+    denied: Set[str] = set()
+    if is_headless():
+        denied |= HUMAN_BOUND_TOOLS
+        if not renderer_reachable():
+            denied |= RENDERER_BOUND_TOOLS
+    return frozenset(denied)
+
+
+@typechecked
+def apply_unreachable_denies(builtin_perms: Dict[str, str]) -> Dict[str, str]:
+    """The permission map with every currently-unreachable tool forced to 'deny'. Returns a
+    copy so the verdict never poisons the live snapshot."""
+    denied = denied_tools()
+    if not denied:
+        return builtin_perms
+    return {**builtin_perms, **{name: "deny" for name in denied}}
diff --git a/backend/config/paths.py b/backend/config/paths.py
index b0780135..5f28ad52 100644
--- a/backend/config/paths.py
+++ b/backend/config/paths.py
@@ -6,8 +6,12 @@ import sys
 P_BACKEND_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 
 p_is_packaged = os.environ.get("OPENSWARM_PACKAGED") == "1"
+p_data_root_override = os.environ.get("OPENSWARM_DATA_ROOT", "").strip()
 
-if p_is_packaged:
+if p_data_root_override:
+    # A container has no home to speak of, so the runner points this straight at its mounted volume.
+    DATA_ROOT = os.path.abspath(p_data_root_override)
+elif p_is_packaged:
     if sys.platform == "darwin":
         p_app_support = os.path.join(os.path.expanduser("~"), "Library", "Application Support", "OpenSwarm")
     elif sys.platform == "win32":
diff --git a/backend/main.py b/backend/main.py
index 0366a312..4550cff7 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -48,11 +48,12 @@ from backend.apps.help.bundle import help_app
 from backend.apps.agents.proxy.anthropic_proxy import anthropic_proxy
 from backend.apps.agents.core.openai_passthrough import openai_passthrough
 from backend.apps.workflows.workflows import workflows
+from backend.apps.workflows.cloud.routes import cloud_workflows
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi import WebSocket, WebSocketDisconnect
 import json
 
-main_app = MainApp([health, agents, skills, tools_lib, modes, settings, mcp_registry, skill_registry, outputs, output_versions, dashboards, swarm, service, subscription, auth, web, onboarding, voice, help_app, anthropic_proxy, workflows, openai_passthrough])
+main_app = MainApp([health, agents, skills, tools_lib, modes, settings, mcp_registry, skill_registry, outputs, output_versions, dashboards, swarm, service, subscription, auth, web, onboarding, voice, help_app, anthropic_proxy, workflows, cloud_workflows, openai_passthrough])
 app = main_app.app
 
 # Generate per-install auth token BEFORE we bind the HTTP port. By the time any request lands, the token file exists. See backend/auth.py.
diff --git a/backend/requirements.lock b/backend/requirements.lock
index f4755a19..a57e9900 100644
--- a/backend/requirements.lock
+++ b/backend/requirements.lock
@@ -39,10 +39,11 @@ certifi==2026.5.20 \
     --hash=sha256:3c52e209ba0a4ad7aebe60436a4ab349c39e1e602e8c134221e546902ad25897 \
     --hash=sha256:69dea482ab64caa7b9f6aba1c6bf48bb6a5448d1c0f1b17ab42ad8c763a5344d
     # via
+    #   curl-cffi
     #   httpcore
     #   httpx
     #   trafilatura
-cffi==2.0.0 ; platform_python_implementation != 'PyPy' \
+cffi==2.0.0 \
     --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
     --hash=sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b \
     --hash=sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f \
@@ -127,7 +128,9 @@ cffi==2.0.0 ; platform_python_implementation != 'PyPy' \
     --hash=sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5 \
     --hash=sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453 \
     --hash=sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf
-    # via cryptography
+    # via
+    #   cryptography
+    #   curl-cffi
 charset-normalizer==3.4.7 \
     --hash=sha256:007d05ec7321d12a40227aae9e2bc6dca73f3cb21058999a1df9e193555a9dcc \
     --hash=sha256:03853ed82eeebbce3c2abfdbc98c96dc205f32a79627688ac9a27370ea61a49c \
@@ -275,7 +278,7 @@ click==8.4.1 \
     # via
     #   rich-toolkit
     #   uvicorn
-colorama==0.4.6 ; sys_platform == 'win32' \
+colorama==0.4.6 ; sys_platform == 'win32' or platform_system == 'Windows' \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
     --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
     # via
@@ -337,6 +340,29 @@ cryptography==48.0.0 \
     --hash=sha256:f5333311663ea94f75dd408665686aaf426563556bb5283554a3539177e03b8c \
     --hash=sha256:fdfef35d751d510fcef5252703621574364fec16418c4a1e5e1055248401054b
     # via pyjwt
+curl-cffi==0.15.0 \
+    --hash=sha256:08c799b89740b9bc49c09fbc3d5907f13ac1f845ca52620507ef9466d4639dd5 \
+    --hash=sha256:0b6c0543b993996670e9e4b78e305a2d60809d5681903ffb5568e21a387434d3 \
+    --hash=sha256:1977e1e12cfb5c11352cbb74acef1bed24eb7d226dab61ca57c168c21acd4d61 \
+    --hash=sha256:2b6c847d86283b07ae69bb72c82eb8a59242277142aa35b89850f89e792a02fc \
+    --hash=sha256:408d6f14e346841cd889c2e0962832bb235ba3b6749ebf609f347f747da5e60f \
+    --hash=sha256:41f80170ba844009273b2660da1964ec31e99e5719d16b3422ada87177e32e13 \
+    --hash=sha256:4682dc38d4336e0eb0b185374db90a760efde63cbea994b4e63f3521d44c4c92 \
+    --hash=sha256:582e570aa2586b96ed47cf4a17586b9a3c462cbe43f780487c3dc245c6ef1527 \
+    --hash=sha256:5a0c1896a0d5a5ac1eb89cd24b008d2b718dd1df6fd2f75451b59ca66e49e572 \
+    --hash=sha256:7b7a92767a888ee90147e18964b396d8435ff42737030d6fb00824ffd6094805 \
+    --hash=sha256:7e63539d0d839d0a8c5eacf86229bc68c57803547f35e0db7ee0986328b478c3 \
+    --hash=sha256:829cc357061ecb99cc2d406301f609a039e05665322f5c025ec67c38b0dc49ce \
+    --hash=sha256:838e48212447d9c81364b04707a5c861daf08f8320f9ecb3406a8919d1d5c3b3 \
+    --hash=sha256:967ad7355bd8e9586f8c2d02eaa99953747549e7ea4a9b25cd53353e6b67fe6d \
+    --hash=sha256:9e5e69eee735f659287e2c84444319d68a1fa68dd37abf228943a4074864283a \
+    --hash=sha256:a25620d9bf989c9c029a7d1642999c4c265abb0bad811deb2f77b0b5b2b12e5b \
+    --hash=sha256:a6d57f8389273a3a1f94370473c74897467bcc36af0a17336989780c507fa43d \
+    --hash=sha256:aa1323950224db24f4c510d010b3affa02196ca853fb424191fa917a513d3f4b \
+    --hash=sha256:b624c7ce087bfda967a013ed0a64702a525444e5b6e97d23534d567ccc6525aa \
+    --hash=sha256:bda66404010e9ed743b1b83c20c86f24fe21a9a6873e17479d6e67e29d8ded28 \
+    --hash=sha256:ea0c67652bf6893d34ee0f82c944f37e488f6147e9421bef1771cc6545b02ded
+    # via -r backend/requirements.txt
 dateparser==1.4.0 \
     --hash=sha256:7902b8e85d603494bf70a5a0b1decdddb2270b9c6e6b2bc8a57b93476c0df378 \
     --hash=sha256:97a21840d5ecdf7630c584f673338a5afac5dfe84f647baf4d7e8df98f9354a4
@@ -439,6 +465,7 @@ httpx==0.28.1 \
     #   anthropic
     #   fastapi
     #   mcp
+    #   swarm-analytics
 httpx-sse==0.4.3 \
     --hash=sha256:0ac1c9fe3c0afad2e0ebb25a934a59f4c7823b60792691f779fad2c5568830fc \
     --hash=sha256:9b1ed0127459a66014aec3c56bebd93da3c1bc8bb6618c8082039a44889a755d
@@ -919,7 +946,7 @@ pillow==12.2.0 \
     --hash=sha256:fb043ee2f06b41473269765c2feae53fc2e2fbf96e5e22ca94fb5ad677856f06 \
     --hash=sha256:fc3d34d4a8fbec3e88a79b92e5465e0f9b842b628675850d860b8bd300b159f5
     # via -r backend/requirements.txt
-pycparser==3.0 ; implementation_name != 'PyPy' and platform_python_implementation != 'PyPy' \
+pycparser==3.0 ; implementation_name != 'PyPy' \
     --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
     --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
     # via cffi
@@ -933,6 +960,7 @@ pydantic==2.13.3 \
     #   mcp
     #   pydantic-extra-types
     #   pydantic-settings
+    #   swarm-analytics
 pydantic-core==2.46.3 \
     --hash=sha256:0087084960f209a9a4af50ecd1fb063d9ad3658c07bb81a7a53f452dacbfb2ba \
     --hash=sha256:031bb17f4885a43773c8c763089499f242aee2ea85cf17154168775dccdecf35 \
@@ -1073,6 +1101,10 @@ pyjwt==2.13.0 \
     --hash=sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423 \
     --hash=sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728
     # via mcp
+pypdf==6.14.2 \
+    --hash=sha256:3f07891af76dc002657e04993ab9b4de81de29f9013b9761d0b7968bff12e946 \
+    --hash=sha256:7873f502fe4385e79539b21d872392dc0c4e3714327c15881cbc7fbfd1f95b25
+    # via -r backend/requirements.txt
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
     --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427
@@ -1319,6 +1351,7 @@ rich==15.0.0 \
     --hash=sha256:33bd4ef74232fb73fe9279a257718407f169c09b78a87ad3d296f548e27de0bb \
     --hash=sha256:edd07a4824c6b40189fb7ac9bc4c52536e9780fbbfbddf6f1e2502c31b068c36
     # via
+    #   curl-cffi
     #   rich-toolkit
     #   typer
 rich-toolkit==0.19.10 \
@@ -1510,7 +1543,7 @@ typing-inspection==0.4.2 \
     #   mcp
     #   pydantic
     #   pydantic-settings
-tzdata==2026.2 ; sys_platform == 'win32' \
+tzdata==2026.2 ; platform_system == 'Windows' \
     --hash=sha256:9173fde7d80d9018e02a662e168e5a2d04f87c41ea174b139fbef642eda62d10 \
     --hash=sha256:bbe9af844f658da81a5f95019480da3a89415801f6cc966806612cc7169bffe7
     # via tzlocal
diff --git a/backend/requirements.txt b/backend/requirements.txt
index a9b7fea0..358f1214 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -16,6 +16,10 @@ python-dotenv==1.1.1
 Pillow==12.2.0
 httpx==0.28.1
 trafilatura==2.0.0
+# curl_cffi: Chrome TLS-fingerprint impersonation for the keyless search rungs. Measured 8/8 against DuckDuckGo where plain httpx scored 4/8 on the same queries; abi3 wheels for macos arm64/x64 and win_amd64. Guarded import, so a missing wheel degrades to httpx instead of breaking the backend.
+curl_cffi==0.15.0
+# pypdf: pull the text layer out of a fetched PDF. Pure python, no transitive deps; without it WebFetch posts raw %PDF binary into the model's context.
+pypdf==6.14.2
 # swarm-analytics: typed client for the product-analytics ingest; fire-and-forget so it never breaks the app.
 swarm-analytics==0.1.1
 # tzlocal: dev-mode fallback for resolving the user's IANA timezone when
diff --git a/backend/tests/test_boot_fingerprint.py b/backend/tests/test_boot_fingerprint.py
new file mode 100644
index 00000000..10aa560b
--- /dev/null
+++ b/backend/tests/test_boot_fingerprint.py
@@ -0,0 +1,67 @@
+"""What the client pool's boot fingerprint does and does NOT hash.
+
+Reuse is gated on this hash, so anything the CLI subprocess freezes at boot must be in it (a stale
+live client is the bug it exists to prevent), and anything sent per query must be out of it (hashing
+those respawns the CLI for nothing, which is exactly what the compaction cutoff used to do)."""
+
+import pytest
+
+from backend.apps.agents.core.models import AgentSession
+from backend.apps.agents.manager.run.client_pool import boot_fingerprint
+
+BASE_KWARGS = {
+    "model": "haiku",
+    "cwd": "/tmp/ws",
+    "system_prompt": {"type": "preset", "preset": "claude_code"},
+    "allowed_tools": ["Read"],
+    "disallowed_tools": ["mcp__claude_ai_*"],
+    "mcp_servers": {"openswarm-mcp-meta": {"command": "python", "args": ["m.py"], "type": "stdio"}},
+    "can_use_tool": lambda: None,
+    "stderr": lambda line: None,
+    "hooks": {"PreToolUse": []},
+}
+
+
+def make_session() -> AgentSession:
+    return AgentSession(name="t", model="haiku", mode="agent")
+
+
+def test_fingerprint_stable_across_per_turn_keys():
+    s = make_session()
+    a = boot_fingerprint(dict(BASE_KWARGS), s)
+    changed = dict(BASE_KWARGS)
+    changed["can_use_tool"] = lambda: 1
+    changed["stderr"] = lambda line: 1
+    changed["hooks"] = {"PreToolUse": ["different"]}
+    changed["resume"] = "sdk-session-xyz"
+    changed["fork_session"] = True
+    assert boot_fingerprint(changed, s) == a
+
+
+def test_fingerprint_ignores_the_compaction_cutoff():
+    """The cutoff only rewrites prompt_content, which is sent per query and never frozen at boot,
+    and every path that rebuilds history already forces a respawn. Hashing it respawned the CLI on
+    every turn past compact_threshold_pct for zero token saving (+1.0s TTFT per turn, measured)."""
+    s = make_session()
+    before = boot_fingerprint(dict(BASE_KWARGS), s)
+    for cutoff in ("msg42", "msg43", "msg44"):
+        s.compacted_through_msg_id = cutoff
+        assert boot_fingerprint(dict(BASE_KWARGS), s) == before
+
+
+@pytest.mark.parametrize("mutate", [
+    lambda k, s: k.__setitem__("mcp_servers", {**k["mcp_servers"], "x": {"command": "node", "type": "stdio"}}),
+    lambda k, s: k.__setitem__("system_prompt", {"type": "preset", "preset": "claude_code", "append": "sel"}),
+    lambda k, s: k.__setitem__("model", "gpt-5-mini"),
+    lambda k, s: k.__setitem__("cwd", "/tmp/other"),
+    lambda k, s: k.__setitem__("allowed_tools", ["Read", "Bash"]),
+    lambda k, s: k.__setitem__("tools", ["Read", "Bash", "ToolSearch"]),
+    lambda k, s: setattr(s, "active_branch_id", "branch2"),
+])
+def test_fingerprint_changes_on_boot_inputs(mutate):
+    s = make_session()
+    kwargs = dict(BASE_KWARGS)
+    kwargs["mcp_servers"] = dict(BASE_KWARGS["mcp_servers"])
+    before = boot_fingerprint(kwargs, s)
+    mutate(kwargs, s)
+    assert boot_fingerprint(kwargs, s) != before
diff --git a/backend/tests/test_bot_wall.py b/backend/tests/test_bot_wall.py
new file mode 100644
index 00000000..71bd544d
--- /dev/null
+++ b/backend/tests/test_bot_wall.py
@@ -0,0 +1,137 @@
+"""A 200 that is a bot wall must not end the fetch cascade.
+
+Any 4xx already falls through. The gap was the wall that answers 200 with
+enough prose to clear the thin-page floor, which stopped the cascade one tier
+before the offscreen Chromium that can actually read the page.
+"""
+
+import pytest
+
+import backend.apps.web.web as W
+from backend.apps.agents.tools.fetch.bot_wall import MAX_WALL_CHARS, looks_like_bot_wall
+from backend.apps.agents.tools.fetch.page_text import PageText
+from backend.apps.agents.tools.web import WebFetchTool
+from backend.apps.web.web import FetchBody, fetch
+from backend.tests.web_cascade_fixtures import *  # noqa: F401,F403
+from backend.tests.web_cascade_fixtures import patch_browser_bridge
+
+P_CLOUDFLARE = (
+    "Just a moment...\nwww.example.com needs to review the security of your connection "
+    "before proceeding.\nEnable JavaScript and cookies to continue\n" + "spacer text. " * 30
+)
+P_REDDIT = "Reddit - Please wait for verification\n" + "checking. " * 40
+
+
+@pytest.mark.parametrize("text", [P_CLOUDFLARE, P_REDDIT])
+def test_challenge_screens_are_recognised(text):
+    assert looks_like_bot_wall(text)
+
+
+def test_a_long_article_mentioning_the_phrase_is_not_a_wall():
+    """A story about Cloudflare outages must not be thrown away for quoting the interstitial."""
+    article = ("Cloudflare's interstitial, the one that says Just a moment... while it runs its "
+               "checks, was at the centre of today's outage. " + "Reporting continues. " * 200)
+    assert len(article) > MAX_WALL_CHARS
+    assert not looks_like_bot_wall(article)
+
+
+def test_ordinary_page_text_is_not_a_wall():
+    assert not looks_like_bot_wall("Coroutines and tasks. This section outlines asyncio APIs.")
+
+
+def p_local_returns(monkeypatch, text: str, kind: str = "html"):
+    async def p_page(url, prompt=None):
+        return PageText(text=f"Contents of {url}:\n\n{text}", kind=kind)
+    monkeypatch.setattr(WebFetchTool, "fetch_page", staticmethod(p_page))
+
+
+@pytest.mark.asyncio
+async def test_bot_wall_hands_the_page_to_the_browser_tier(monkeypatch):
+    p_local_returns(monkeypatch, P_CLOUDFLARE)
+    patch_browser_bridge(monkeypatch, {"text": "The real rendered article body."})
+    out = await fetch(FetchBody(url="https://walled.example/article"))
+    assert out["backend"] == "browser"
+    assert "real rendered article body" in out["content"]
+
+
+@pytest.mark.asyncio
+async def test_a_real_page_never_reaches_the_browser_tier(monkeypatch):
+    """The browser tier costs a window and seconds; a page we already read must not pay for it."""
+    p_local_returns(monkeypatch, "The genuine article body. " * 40)
+    calls = []
+
+    async def p_bridge(action, params):
+        calls.append(action)
+        return {"text": "should never be used"}
+    monkeypatch.setattr(W, "p_browser_bridge", p_bridge)
+
+    out = await fetch(FetchBody(url="https://fine.example/article"))
+    assert out["backend"] == "local"
+    assert calls == []
+
+
+@pytest.mark.asyncio
+async def test_browser_tier_is_tried_before_the_archive(monkeypatch):
+    """The live page in our own browser beats an archived copy of it."""
+    import backend.apps.agents.tools.fetch.wayback as WB
+    p_local_returns(monkeypatch, P_REDDIT)
+    patch_browser_bridge(monkeypatch, {"text": "Live rendered thread."})
+
+    async def p_snapshot(url):
+        raise AssertionError("the archive must not be consulted while the browser tier can serve")
+    monkeypatch.setattr(WB, "fetch_wayback", p_snapshot)
+
+    out = await fetch(FetchBody(url="https://www.reddit.com/r/programming/"))
+    assert out["backend"] == "browser"
+
+
+@pytest.mark.asyncio
+async def test_headless_backend_skips_the_browser_tier_without_erroring(monkeypatch):
+    """`bash backend/run.sh` has no Electron main bridge, so the tier must be a no-op, not a failure."""
+    import backend.apps.agents.tools.fetch.wayback as WB
+    p_local_returns(monkeypatch, P_REDDIT)
+    patch_browser_bridge(monkeypatch, None)
+
+    async def p_snapshot(url):
+        return "Archived copy\n\n" + "archived thread text. " * 30
+    monkeypatch.setattr(WB, "fetch_wayback", p_snapshot)
+
+    out = await fetch(FetchBody(url="https://www.reddit.com/r/programming/"))
+    assert out["backend"] == "wayback"
+
+
+P_PERIMETERX = "Press & Hold to confirm you are\na human (and not a bot).\nReference ID eb3f614f"
+P_CF_BLOCK = ("Sorry, you have been blocked\nYou are unable to access crunchbase.com\n"
+              "Why have I been blocked?\n" + "boilerplate. " * 20)
+
+
+@pytest.mark.parametrize("text", [P_PERIMETERX, P_CF_BLOCK])
+def test_line_wrapped_challenges_are_recognised(text):
+    """A rendered wall arrives wrapped ('confirm you are\\na human'), so matching must flatten it."""
+    assert looks_like_bot_wall(text)
+
+
+@pytest.mark.asyncio
+async def test_a_walled_browser_result_falls_through_to_the_archive(monkeypatch):
+    """Measured live: Cloudflare and PerimeterX beat even our real Chromium on some sites, and
+    Zillow's archived copy had 6,888 characters where the live challenge screen had 106."""
+    import backend.apps.agents.tools.fetch.wayback as WB
+    p_local_returns(monkeypatch, "HTTP error 403 fetching it", kind="error")
+    patch_browser_bridge(monkeypatch, {"text": P_PERIMETERX})
+
+    async def p_snapshot(url):
+        return "Archived copy\n\n" + "real archived listings. " * 30
+    monkeypatch.setattr(WB, "fetch_wayback", p_snapshot)
+
+    out = await fetch(FetchBody(url="https://www.zillow.com/homes/for_sale/"))
+    assert out["backend"] == "wayback"
+    assert "real archived listings" in out["content"]
+
+
+@pytest.mark.asyncio
+async def test_a_genuine_browser_render_is_kept(monkeypatch):
+    p_local_returns(monkeypatch, "tiny", kind="html")
+    patch_browser_bridge(monkeypatch, {"text": "nasa\n104M followers\n" + "real profile content. " * 30})
+    out = await fetch(FetchBody(url="https://www.instagram.com/nasa/"))
+    assert out["backend"] == "browser"
+    assert "real profile content" in out["content"]
diff --git a/backend/tests/test_browser_http.py b/backend/tests/test_browser_http.py
new file mode 100644
index 00000000..50a11850
--- /dev/null
+++ b/backend/tests/test_browser_http.py
@@ -0,0 +1,107 @@
+"""The keyless rungs go out through ONE browser-shaped client.
+
+Why it matters: DuckDuckGo's 202 challenge keys on the client's TLS
+fingerprint, not on headers or verb. Measured over 8 interleaved randomised
+rounds, plain httpx scored 4/8 and Chrome impersonation 8/8 on the same
+queries. These pin the seam and the degrade path.
+"""
+
+import pytest
+
+import backend.apps.agents.tools.browser_http as BH
+import backend.apps.agents.tools.search.search_ddg as SD
+import backend.apps.agents.tools.search.search_ddg_lite as SDL
+from backend.apps.agents.tools.browser_http import BROWSER_HEADERS, HttpReply, browser_request
+
+
+def p_reply(status=200, text="ok"):
+    return HttpReply(status=status, text=text, content=text.encode(),
+                     content_type="text/html", url="https://x.example")
+
+
+def p_record_transports(monkeypatch):
+    used = []
+
+    async def p_imp(*a, **k):
+        used.append("impersonated")
+        return p_reply()
+
+    async def p_pl(*a, **k):
+        used.append("plain")
+        return p_reply()
+
+    monkeypatch.setattr(BH, "p_impersonated", p_imp)
+    monkeypatch.setattr(BH, "p_plain", p_pl)
+    return used
+
+
+@pytest.mark.asyncio
+async def test_impersonates_when_the_client_is_installed(monkeypatch):
+    used = p_record_transports(monkeypatch)
+    monkeypatch.setattr(BH, "impersonation_available", lambda: True)
+    await browser_request("https://x.example")
+    assert used == ["impersonated"]
+
+
+@pytest.mark.asyncio
+async def test_degrades_to_httpx_instead_of_failing(monkeypatch):
+    """A missing wheel must cost us reliability, never the whole backend."""
+    used = p_record_transports(monkeypatch)
+    monkeypatch.setattr(BH, "impersonation_available", lambda: False)
+    reply = await browser_request("https://x.example")
+    assert used == ["plain"]
+    assert reply.status == 200
+
+
+@pytest.mark.asyncio
+async def test_caller_headers_win_over_the_defaults(monkeypatch):
+    seen = {}
+
+    async def p_pl(url, method, params, headers, timeout, follow_redirects):
+        seen.update(headers)
+        return p_reply()
+
+    monkeypatch.setattr(BH, "p_plain", p_pl)
+    monkeypatch.setattr(BH, "impersonation_available", lambda: False)
+    await browser_request("https://x.example", headers={"Accept-Language": "de-DE"})
+    assert seen["Accept-Language"] == "de-DE"
+    assert seen["User-Agent"] == BROWSER_HEADERS["User-Agent"]
+
+
+def test_default_headers_look_like_a_real_navigation():
+    # A bare User-Agent is the tell that gets a scraper challenged.
+    for key in ("User-Agent", "Accept", "Accept-Language", "Sec-Fetch-Mode", "Upgrade-Insecure-Requests"):
+        assert BROWSER_HEADERS.get(key)
+    assert "Chrome/" in BROWSER_HEADERS["User-Agent"]
+
+
+@pytest.mark.asyncio
+async def test_ddg_rungs_send_the_query_as_a_get_param(monkeypatch):
+    """Pins the shape: a GET with params, through the shared seam, on both frontends."""
+    calls = []
+
+    async def p_req(url, **kw):
+        calls.append((url, kw.get("method", "GET"), kw.get("params")))
+        return p_reply(202, "challenge")
+
+    monkeypatch.setattr(SD, "browser_request", p_req)
+    monkeypatch.setattr(SDL, "browser_request", p_req)
+    from backend.apps.agents.tools.web import DDGRateLimited
+    with pytest.raises(DDGRateLimited):
+        await SD.search_ddg("some query", 5)
+
+    assert [c[0] for c in calls] == [
+        "https://html.duckduckgo.com/html/",
+        "https://lite.duckduckgo.com/lite/",
+    ]
+    for _, method, params in calls:
+        assert method == "GET"
+        assert params == {"q": "some query"}
+
+
+def test_curl_cffi_is_a_declared_dependency():
+    """It must be in BOTH files: the packaged python-env installs from the LOCK."""
+    from pathlib import Path
+    root = Path(__file__).resolve().parents[1]
+    assert "curl_cffi==" in (root / "requirements.txt").read_text()
+    assert "curl-cffi==" in (root / "requirements.lock").read_text()
diff --git a/backend/tests/test_browser_index_leak.py b/backend/tests/test_browser_index_leak.py
new file mode 100644
index 00000000..a7e4d833
--- /dev/null
+++ b/backend/tests/test_browser_index_leak.py
@@ -0,0 +1,95 @@
+"""The browser subsystem's click-by-index rows must never reach a human.
+
+`[1]<combobox "" value="-- pick --">` is what BrowserListInteractives hands the
+browser sub-agent so it can click by number. A user asked a normal agent to list a
+page's interactive elements and got those rows back verbatim in chat. The rows are
+produced in the renderer (frontend/src/shared/browserCommandHandler.ts) and ride into
+the transcript on the sub-agent's summary, so both the laundering and the renderer's
+template are pinned here.
+"""
+
+import asyncio
+import re
+from pathlib import Path
+
+from backend.apps.agents.browser import browser_agent as BA
+from backend.apps.agents.browser.browser_history import PAGE_STATE_MARKER
+from backend.apps.agents.browser.humanize_element_rows import humanize_element_rows
+
+# Verbatim from the bug report: six rows the agent pasted into a normal chat, on one line.
+LEAKED_REPLY = (
+    '[1]<combobox "" value="-- pick --"> [2]<button "Choose File"> '
+    '[3]<button "Shadow Button"> [4]<textbox "title"> [5]<button "Post"> '
+    '[6]<button "Frame Button">'
+)
+
+INDEX_ROW_RE = re.compile(r'\[\d+\]\*?<')
+
+
+def test_leaked_reply_loses_every_index_and_keeps_every_label():
+    out = humanize_element_rows(LEAKED_REPLY)
+    assert not INDEX_ROW_RE.search(out), out
+    assert "<" not in out and ">" not in out, out
+    for label in ("-- pick --", "Choose File", "Shadow Button", "title", "Post", "Frame Button"):
+        assert label in out, f"{label} was dropped: {out}"
+    assert "dropdown" in out and "text field" in out and "button" in out
+
+
+def test_multiline_listing_header_legend_and_footer_are_cleaned():
+    listing = (
+        "3 interactive elements (* = new since your last look; same number = same "
+        "element as before):\n"
+        '[1]<button "Like">\n'
+        '[2]*<textbox "Search" value="cats">\n'
+        '[3]<button "Message" ctx="Alice Smith">\n'
+        "... 25 more not shown; scroll or scope with BrowserGetElements to reach them."
+    )
+    out = humanize_element_rows(listing)
+    assert not INDEX_ROW_RE.search(out), out
+    assert "same number = same element as before" not in out
+    assert "BrowserGetElements" not in out
+    assert "25 more not shown." in out
+    assert out.startswith("3 interactive elements:")
+    assert '"Like" (button)' in out
+    assert '"Search" (text field, currently "cats")' in out
+
+
+def test_unlabeled_element_and_page_state_marker():
+    out = humanize_element_rows(f'{PAGE_STATE_MARKER}\n[7]<checkbox "">')
+    assert PAGE_STATE_MARKER not in out
+    assert out.strip() == "an unlabeled checkbox"
+
+
+def test_ordinary_prose_is_untouched():
+    prose = "I posted the reply as Alice at 10:43 PM. The list [1] had 3 items <b>ok</b>."
+    assert humanize_element_rows(prose) == prose
+
+
+def test_run_browser_agents_launders_summary_and_error(monkeypatch):
+    """The one funnel both delivery paths use: the MCP tool result the parent agent
+    reads, and the fast path that pipes the summary straight into the user's chat."""
+    async def p_fake_run_browser_agent(**kwargs):
+        return {"summary": LEAKED_REPLY, "error": LEAKED_REPLY,
+                "action_log": [], "final_screenshot": None}
+
+    monkeypatch.setattr(BA, "run_browser_agent", p_fake_run_browser_agent, raising=True)
+    monkeypatch.setattr(BA.ws_manager, "global_connections", [object()], raising=False)
+
+    results = asyncio.run(BA.run_browser_agents(
+        tasks=[{"task": "list the interactive elements", "browser_id": "b1"}],
+        model="sonnet",
+    ))
+
+    assert not INDEX_ROW_RE.search(results[0]["summary"]), results[0]["summary"]
+    assert not INDEX_ROW_RE.search(results[0]["error"]), results[0]["error"]
+    assert "Choose File" in results[0]["summary"]
+
+
+def test_renderer_row_template_still_matches_the_scrubber():
+    """Drift pin: the rows are built in TypeScript, so a Python-only change set can
+    silently stop matching. If this line moved, re-check humanize_element_rows."""
+    handler = Path(__file__).resolve().parents[2] / "frontend/src/shared/browserCommandHandler.ts"
+    source = handler.read_text(encoding="utf-8")
+    assert 'return `[${el.index}]${el.isNew ? \'*\' : \'\'}<${el.role} "${el.name}"${ctx}${val}>`;' in source
+    assert "const ctx = dup && el.context ? ` ctx=\"${el.context}\"` : '';" in source
+    assert "const val = el.value ? ` value=\"${el.value}\"` : '';" in source
diff --git a/backend/tests/test_client_pool.py b/backend/tests/test_client_pool.py
index 4e0f3e14..ea3db72c 100644
--- a/backend/tests/test_client_pool.py
+++ b/backend/tests/test_client_pool.py
@@ -1,19 +1,16 @@
 """Invariant + seeded-simulation tests for the persistent-client pool (lever A of the TTFT work).
-Proves the red-teamed safety properties hold by construction: fingerprint-gated reuse, respawn on
-any boot-input change, pop-first disposal, never-raising teardown, and (seeded sim) that random op
-sequences never reuse a stale client, never double-boot needlessly, and always recover a dead one."""
+Proves the red-teamed safety properties hold by construction: fingerprint-gated reuse, pop-first
+disposal, never-raising teardown, idle/LRU reclaim, and (seeded sim) that random op sequences never
+reuse a stale client, never double-boot needlessly, and always recover a dead one. What the
+fingerprint itself hashes lives in test_boot_fingerprint.py."""
 
 import asyncio
 import random
 from typing import Dict, List
 
-import pytest
-
-from backend.apps.agents.core.models import AgentSession
 from backend.apps.agents.manager.run.client_pool import (
     ClientHandle,
     acquire_client,
-    boot_fingerprint,
     dispose_all_clients,
     dispose_client,
     dispose_client_soon,
@@ -39,56 +36,6 @@ class FakeClient:
             raise RuntimeError("teardown boom")
 
 
-def make_session(branch: str = "main", compacted: str | None = None) -> AgentSession:
-    s = AgentSession(name="t", model="haiku", mode="agent")
-    s.active_branch_id = branch
-    s.compacted_through_msg_id = compacted
-    return s
-
-
-BASE_KWARGS = {
-    "model": "haiku",
-    "cwd": "/tmp/ws",
-    "system_prompt": {"type": "preset", "preset": "claude_code"},
-    "allowed_tools": ["Read"],
-    "disallowed_tools": ["mcp__claude_ai_*"],
-    "mcp_servers": {"openswarm-mcp-meta": {"command": "python", "args": ["m.py"], "type": "stdio"}},
-    "can_use_tool": lambda: None,
-    "stderr": lambda line: None,
-    "hooks": {"PreToolUse": []},
-}
-
-
-def test_fingerprint_stable_across_per_turn_keys():
-    s = make_session()
-    a = boot_fingerprint(dict(BASE_KWARGS), s)
-    changed = dict(BASE_KWARGS)
-    changed["can_use_tool"] = lambda: 1
-    changed["stderr"] = lambda line: 1
-    changed["hooks"] = {"PreToolUse": ["different"]}
-    changed["resume"] = "sdk-session-xyz"
-    changed["fork_session"] = True
-    assert boot_fingerprint(changed, s) == a
-
-
-@pytest.mark.parametrize("mutate", [
-    lambda k, s: k.__setitem__("mcp_servers", {**k["mcp_servers"], "x": {"command": "node", "type": "stdio"}}),
-    lambda k, s: k.__setitem__("system_prompt", {"type": "preset", "preset": "claude_code", "append": "sel"}),
-    lambda k, s: k.__setitem__("model", "gpt-5-mini"),
-    lambda k, s: k.__setitem__("cwd", "/tmp/other"),
-    lambda k, s: k.__setitem__("allowed_tools", ["Read", "Bash"]),
-    lambda k, s: setattr(s, "active_branch_id", "branch2"),
-    lambda k, s: setattr(s, "compacted_through_msg_id", "msg42"),
-])
-def test_fingerprint_changes_on_boot_inputs(mutate):
-    s = make_session()
-    kwargs = dict(BASE_KWARGS)
-    kwargs["mcp_servers"] = dict(BASE_KWARGS["mcp_servers"])
-    before = boot_fingerprint(kwargs, s)
-    mutate(kwargs, s)
-    assert boot_fingerprint(kwargs, s) != before
-
-
 def test_reuse_respawn_force_and_teardown():
     async def run():
         pool: Dict[str, ClientHandle] = {}
diff --git a/backend/tests/test_cloud_run_files.py b/backend/tests/test_cloud_run_files.py
new file mode 100644
index 00000000..0af62106
--- /dev/null
+++ b/backend/tests/test_cloud_run_files.py
@@ -0,0 +1,152 @@
+"""Where a cloud run's files land on the machine the user sits at, and what they are told.
+
+A deliverable the user cannot find has not been delivered, so the two things worth pinning
+are the folder (Downloads, because that is where people look) and the honesty of the list:
+a file that was refused must still appear, with its reason, and must never be fetched.
+"""
+
+import os
+
+import pytest
+
+from backend.apps.workflows.cloud.client import CloudRun, CloudRunFile
+from backend.apps.workflows.cloud.run_files import (
+    described,
+    downloads_root,
+    fetch_missing,
+    local_path_for,
+    safe_component,
+    run_folder,
+)
+from backend.apps.workflows.models import Workflow
+
+
+def p_run(**overrides) -> CloudRun:
+    body = {
+        "id": "run-abcdef123456",
+        "status": "succeeded",
+        "finished_at": 1_785_000_000_000,
+        "files": [],
+    }
+    body.update(overrides)
+    return CloudRun.model_validate(body)
+
+
+def test_files_land_in_downloads_because_that_is_where_people_look() -> None:
+    root = downloads_root()
+    assert root.endswith(os.path.join("OpenSwarm"))
+    assert os.path.expanduser("~") in root
+
+
+def test_a_run_gets_its_own_folder_named_so_a_list_of_them_reads_as_history() -> None:
+    workflow = Workflow(title="Weekly numbers")
+    folder = run_folder(workflow, p_run())
+    assert "Weekly numbers" in folder
+    # The run id's head disambiguates two runs in the same minute without being a wall of hex.
+    assert "run-abcd" in folder
+
+
+@pytest.mark.parametrize(
+    "raw,expected",
+    [
+        ("Weekly numbers", "Weekly numbers"),
+        ("bad/name", "bad-name"),
+        ("../escape", "-escape"),
+        ("with:colon", "with-colon"),
+        ("", "untitled"),
+        ("...", "untitled"),
+    ],
+)
+def test_a_title_is_made_safe_without_becoming_unrecognisable(raw: str, expected: str) -> None:
+    assert safe_component(raw) == expected
+
+
+def test_a_nested_run_path_stays_nested_locally() -> None:
+    target = local_path_for("/tmp/folder", CloudRunFile(id="f1", path="notes/method.txt", size_bytes=5))
+    assert target == os.path.join("/tmp/folder", "notes", "method.txt")
+
+
+def test_a_path_that_tries_to_climb_out_cannot(tmp_path) -> None:
+    target = local_path_for(str(tmp_path), CloudRunFile(id="f1", path="../../etc/passwd", size_bytes=1))
+    assert os.path.abspath(target).startswith(str(tmp_path))
+
+
+def test_a_file_not_yet_downloaded_reports_no_local_path_rather_than_a_broken_one(tmp_path, monkeypatch) -> None:
+    monkeypatch.setattr("backend.apps.workflows.cloud.run_files.downloads_root", lambda: str(tmp_path))
+    run = p_run(files=[{"id": "f1", "path": "summary.md", "size_bytes": 42}])
+    described_files = described(Workflow(title="W"), run)
+
+    assert len(described_files) == 1
+    assert described_files[0].local_path is None
+
+
+def test_a_file_already_on_disk_is_reported_at_its_real_path(tmp_path, monkeypatch) -> None:
+    monkeypatch.setattr("backend.apps.workflows.cloud.run_files.downloads_root", lambda: str(tmp_path))
+    workflow = Workflow(title="W")
+    run = p_run(files=[{"id": "f1", "path": "summary.md", "size_bytes": 5}])
+    target = local_path_for(run_folder(workflow, run), run.files[0])
+    os.makedirs(os.path.dirname(target), exist_ok=True)
+    with open(target, "wb") as handle:
+        handle.write(b"hello")
+
+    assert described(workflow, run)[0].local_path == target
+
+
+def test_a_refused_file_is_listed_with_its_reason_and_never_fetched(tmp_path, monkeypatch) -> None:
+    monkeypatch.setattr("backend.apps.workflows.cloud.run_files.downloads_root", lambda: str(tmp_path))
+    workflow = Workflow(title="W")
+    run = p_run(files=[
+        {"id": "f1", "path": "render.mp4", "size_bytes": 999, "refusal": "it is 512.0 MB and the limit is 20.0 MB"},
+    ])
+
+    listed = described(workflow, run)
+    assert listed[0].refusal is not None
+    assert listed[0].local_path is None
+
+    asked: list = []
+
+    async def p_never(*args, **kwargs):
+        asked.append(args)
+        return b""
+
+    monkeypatch.setattr("backend.apps.workflows.cloud.run_files.cloud.download_run_file", p_never)
+    import asyncio
+
+    asyncio.run(fetch_missing("hosted-1", workflow, [run]))
+    assert asked == [], "a file that exists nowhere must never be requested"
+
+
+def test_a_download_that_fails_leaves_the_history_readable(tmp_path, monkeypatch) -> None:
+    monkeypatch.setattr("backend.apps.workflows.cloud.run_files.downloads_root", lambda: str(tmp_path))
+    workflow = Workflow(title="W")
+    run = p_run(files=[{"id": "f1", "path": "summary.md", "size_bytes": 5}])
+
+    async def p_boom(*args, **kwargs):
+        from backend.apps.workflows.cloud.client import CloudUnreachable
+
+        raise CloudUnreachable("offline")
+
+    monkeypatch.setattr("backend.apps.workflows.cloud.run_files.cloud.download_run_file", p_boom)
+    import asyncio
+
+    asyncio.run(fetch_missing("hosted-1", workflow, [run]))
+    assert described(workflow, run)[0].local_path is None
+
+
+def test_a_downloaded_file_is_written_whole_or_not_at_all(tmp_path, monkeypatch) -> None:
+    monkeypatch.setattr("backend.apps.workflows.cloud.run_files.downloads_root", lambda: str(tmp_path))
+    workflow = Workflow(title="W")
+    run = p_run(files=[{"id": "f1", "path": "notes/summary.md", "size_bytes": 5}])
+
+    async def p_ok(*args, **kwargs):
+        return b"hello"
+
+    monkeypatch.setattr("backend.apps.workflows.cloud.run_files.cloud.download_run_file", p_ok)
+    import asyncio
+
+    asyncio.run(fetch_missing("hosted-1", workflow, [run]))
+    target = local_path_for(run_folder(workflow, run), run.files[0])
+    with open(target, "rb") as handle:
+        assert handle.read() == b"hello"
+    # The .part file is the whole point of the atomic rename: no half file is ever visible.
+    assert not os.path.exists(f"{target}.part")
diff --git a/backend/tests/test_cloud_schedule_agreement.py b/backend/tests/test_cloud_schedule_agreement.py
new file mode 100644
index 00000000..b3f91e24
--- /dev/null
+++ b/backend/tests/test_cloud_schedule_agreement.py
@@ -0,0 +1,121 @@
+"""The two schedulers have to agree on when "9am Monday" is.
+
+A workflow can sit on this machine or on our servers, and the user is told a "next run" either way.
+Two recurrence engines in two languages means two chances to be wrong, and the place they would
+diverge is exactly the place wall-clock scheduling is hard: the morning a clock jumps forward and
+2:30am never happens, and the morning it falls back and 1:30am happens twice.
+
+The vector table below is duplicated verbatim in the cloud service's tests/workflow-schedule.test.ts.
+Each row asserts the same answer on both sides, so if either engine drifts one of the suites fails.
+Nothing here talks to the network; both halves are pure functions of a schedule and a moment.
+"""
+from datetime import datetime, timezone
+from zoneinfo import ZoneInfo
+
+from backend.apps.workflows.cloud.schedule import (
+    CloudDailySchedule,
+    CloudWeeklySchedule,
+    ScheduleSupported,
+    to_cloud_schedule,
+    wire,
+)
+from backend.apps.workflows.models import ScheduleConfig, Workflow
+from backend.apps.workflows.scheduler import compute_next_fire
+
+LA = "America/Los_Angeles"
+
+# (label, ScheduleConfig kwargs, asked at, fires at). Times are UTC because that is what both
+# engines return; the point of each row is the LOCAL clock it corresponds to, named in the label.
+VECTORS = [
+    ("LA daily 9am, the Saturday before the clocks go forward",
+     dict(repeat_unit="day", repeat_every=1, hour=9, minute=0, timezone=LA),
+     "2026-03-06T20:00:00Z", "2026-03-07T17:00:00Z"),
+    ("LA daily 9am, the day the clocks go forward",
+     dict(repeat_unit="day", repeat_every=1, hour=9, minute=0, timezone=LA),
+     "2026-03-07T20:00:00Z", "2026-03-08T16:00:00Z"),
+    ("LA daily 9am, the day the clocks go back",
+     dict(repeat_unit="day", repeat_every=1, hour=9, minute=0, timezone=LA),
+     "2026-10-31T20:00:00Z", "2026-11-01T17:00:00Z"),
+    ("LA weekdays 9am, asked Friday after the slot, over a spring-forward weekend",
+     dict(repeat_unit="week", repeat_every=1, on_days=[1, 2, 3, 4, 5], hour=9, minute=0, timezone=LA),
+     "2026-03-06T18:00:00Z", "2026-03-09T16:00:00Z"),
+    ("LA weekdays 9am, asked Friday after the slot, over a fall-back weekend",
+     dict(repeat_unit="week", repeat_every=1, on_days=[1, 2, 3, 4, 5], hour=9, minute=0, timezone=LA),
+     "2026-10-30T18:00:00Z", "2026-11-02T17:00:00Z"),
+    ("LA weekends 9am, asked on a Wednesday",
+     dict(repeat_unit="week", repeat_every=1, on_days=[0, 6], hour=9, minute=0, timezone=LA),
+     "2026-06-10T18:00:00Z", "2026-06-13T16:00:00Z"),
+    ("LA daily 2:30am, an hour the clocks skip",
+     dict(repeat_unit="day", repeat_every=1, hour=2, minute=30, timezone=LA),
+     "2026-03-08T09:59:00Z", "2026-03-08T10:30:00Z"),
+    ("LA daily 1:30am, first time through the repeated hour",
+     dict(repeat_unit="day", repeat_every=1, hour=1, minute=30, timezone=LA),
+     "2026-11-01T08:00:00Z", "2026-11-01T08:30:00Z"),
+    ("LA daily 1:30am, asked at 1:45 the first time round, so today's slot has gone",
+     dict(repeat_unit="day", repeat_every=1, hour=1, minute=30, timezone=LA),
+     "2026-11-01T08:45:00Z", "2026-11-02T09:30:00Z"),
+    ("LA daily 1:30am, asked at 1:15 the second time round, so it fires again this hour",
+     dict(repeat_unit="day", repeat_every=1, hour=1, minute=30, timezone=LA),
+     "2026-11-01T09:15:00Z", "2026-11-01T09:30:00Z"),
+    ("LA daily 1:30am, asked at exactly 1:30, so this one has just gone",
+     dict(repeat_unit="day", repeat_every=1, hour=1, minute=30, timezone=LA),
+     "2026-11-01T08:30:00Z", "2026-11-02T09:30:00Z"),
+    ("Berlin daily 2:30am, an hour the clocks skip",
+     dict(repeat_unit="day", repeat_every=1, hour=2, minute=30, timezone="Europe/Berlin"),
+     "2026-03-29T00:30:00Z", "2026-03-29T01:30:00Z"),
+    ("Berlin daily 2:30am, the second time through the repeated hour",
+     dict(repeat_unit="day", repeat_every=1, hour=2, minute=30, timezone="Europe/Berlin"),
+     "2026-10-25T01:17:33Z", "2026-10-25T01:30:00Z"),
+    ("Sydney Sundays 11:45pm, over their spring-forward",
+     dict(repeat_unit="week", repeat_every=1, on_days=[0], hour=23, minute=45, timezone="Australia/Sydney"),
+     "2026-10-02T05:00:00Z", "2026-10-04T12:45:00Z"),
+    ("Kolkata daily 9am, a half-hour offset with no DST",
+     dict(repeat_unit="day", repeat_every=1, hour=9, minute=0, timezone="Asia/Kolkata"),
+     "2026-06-15T12:00:00Z", "2026-06-16T03:30:00Z"),
+    ("UTC daily midnight, asked one second after it fired",
+     dict(repeat_unit="day", repeat_every=1, hour=0, minute=0, timezone="UTC"),
+     "2026-06-15T00:00:01Z", "2026-06-16T00:00:00Z"),
+]
+
+
+def p_moment(text: str) -> datetime:
+    return datetime.fromisoformat(text.replace("Z", "+00:00"))
+
+
+def p_workflow(config: dict) -> Workflow:
+    # created_at is the phase anchor for multi-period cadences. Every schedule here repeats once per
+    # period, so it cannot move an answer; it is pinned only so nothing about these rows floats.
+    return Workflow(
+        title="agreement",
+        created_at=datetime(2020, 1, 1, tzinfo=timezone.utc),
+        schedule=ScheduleConfig(enabled=True, **config),
+    )
+
+
+def test_the_local_scheduler_hits_every_vector():
+    for label, config, asked, fires in VECTORS:
+        assert compute_next_fire(p_workflow(config), p_moment(asked)) == p_moment(fires), label
+
+
+def test_every_vector_maps_onto_a_schedule_the_cloud_can_hold():
+    """A vector the cloud would refuse proves nothing about the two engines agreeing."""
+    for label, config, *_ in VECTORS:
+        mapping = to_cloud_schedule(ScheduleConfig(enabled=True, **config))
+        assert isinstance(mapping, ScheduleSupported), label
+        assert isinstance(mapping.schedule, (CloudDailySchedule, CloudWeeklySchedule)), label
+        # The zone has to survive the trip, or the cloud does its maths in the wrong one.
+        assert wire(mapping.schedule)["timezone"] == config["timezone"], label
+
+
+def test_a_daily_nine_am_never_drifts_off_nine_am():
+    """The reason the zone travels with the schedule at all: stored as a UTC hour, every one of
+    these fires would move by an hour twice a year for anyone outside UTC."""
+    wf = p_workflow(dict(repeat_unit="day", repeat_every=1, hour=9, minute=0, timezone=LA))
+    cursor = datetime(2026, 3, 5, tzinfo=timezone.utc)
+    days = set()
+    for _ in range(250):
+        cursor = compute_next_fire(wf, cursor)
+        local = cursor.astimezone(ZoneInfo(LA))
+        assert (local.hour, local.minute) == (9, 0), cursor.isoformat()
+        days.add(local.date())
+    assert len(days) == 250, "one fire per calendar day, none doubled and none skipped"
diff --git a/backend/tests/test_cloud_workflow_definition.py b/backend/tests/test_cloud_workflow_definition.py
new file mode 100644
index 00000000..ff4c713e
--- /dev/null
+++ b/backend/tests/test_cloud_workflow_definition.py
@@ -0,0 +1,125 @@
+"""What we are willing to hand the cloud, and which schedules it can honour at all.
+
+Both are pure functions, and both decide something a user reads: a schedule the cloud cannot
+express has to be refused in words rather than rounded off, and the copy we push must not carry
+anything local (session ids, a phone number) off this machine.
+"""
+from datetime import datetime, timezone
+
+from backend.apps.workflows.cloud import schedule as cloud_schedule
+from backend.apps.workflows.cloud.definition import cloud_definition, definition_signature
+from backend.apps.workflows.cloud.schedule import (
+    ScheduleSupported,
+    ScheduleUnsupported,
+    to_cloud_schedule,
+    wire,
+)
+from backend.apps.workflows.models import PermissionTier, ScheduleConfig, Workflow, WorkflowStep
+
+
+def p_sched(**overrides) -> ScheduleConfig:
+    base = dict(enabled=True, repeat_unit="day", repeat_every=1, hour=9, minute=0, timezone="UTC")
+    base.update(overrides)
+    return ScheduleConfig(**base)
+
+
+def p_wf(**overrides) -> Workflow:
+    base = dict(title="Morning digest", steps=[WorkflowStep(text="summarize the news")], schedule=p_sched())
+    base.update(overrides)
+    return Workflow(**base)
+
+
+def test_interval_daily_and_weekday_schedules_map_to_the_cloud():
+    for supported in (
+        p_sched(),
+        p_sched(repeat_unit="minute", repeat_every=30),
+        p_sched(repeat_unit="hour", repeat_every=6),
+        p_sched(repeat_unit="week", on_days=[1, 2, 3, 4, 5]),
+        p_sched(max_runs=5),
+        p_sched(ends_at=datetime(2027, 1, 1, tzinfo=timezone.utc)),
+    ):
+        assert isinstance(to_cloud_schedule(supported), ScheduleSupported)
+
+
+def test_a_cadence_with_a_phase_the_wire_cannot_carry_is_refused_in_words():
+    for unsupported in (
+        p_sched(repeat_unit="month", day_of_month=1),
+        p_sched(repeat_unit="day", repeat_every=3),
+        p_sched(repeat_unit="week", repeat_every=2, on_days=[1]),
+        # A weekly schedule with no days chosen is not a cadence yet, and saying "monthly" here would be a lie.
+        p_sched(repeat_unit="week", on_days=[]),
+    ):
+        mapping = to_cloud_schedule(unsupported)
+        assert isinstance(mapping, ScheduleUnsupported)
+        # The reason is shown to a person verbatim, so it has to read like one wrote it.
+        assert mapping.reason.endswith(".") and " " in mapping.reason
+
+
+def test_a_wall_clock_time_travels_with_its_zone_and_not_as_a_utc_hour():
+    """Storing 9am Tokyo as its UTC hour is how a schedule silently moves an hour twice a year."""
+    mapping = to_cloud_schedule(p_sched(hour=9, minute=30, timezone="Asia/Tokyo"))
+    assert isinstance(mapping, ScheduleSupported)
+    assert wire(mapping.schedule) == {
+        "kind": "daily", "hour": 9, "minute": 30, "timezone": "Asia/Tokyo",
+    }
+
+
+def test_weekdays_travel_sorted_and_end_conditions_ride_along():
+    mapping = to_cloud_schedule(
+        p_sched(
+            repeat_unit="week",
+            on_days=[5, 1, 3],
+            max_runs=4,
+            ends_at=datetime(2027, 3, 1, 12, 0, tzinfo=timezone.utc),
+        )
+    )
+    assert isinstance(mapping, ScheduleSupported)
+    assert wire(mapping.schedule) == {
+        "kind": "weekly", "days": [1, 3, 5], "hour": 9, "minute": 0, "timezone": "UTC",
+        "max_runs": 4, "ends_at": 1803902400000,  # 2027-03-01T12:00Z
+    }
+
+
+def test_a_legacy_local_zone_becomes_this_machines_real_zone(monkeypatch):
+    """Records written before schedules carried a zone say "local". Sending that word, or flattening
+    it to UTC, moves every one of their fires by this machine's whole offset."""
+    monkeypatch.setattr(cloud_schedule, "host_timezone_name", lambda: "America/New_York")
+    for stored in ("local", "", "Mars/Olympus_Mons"):
+        mapping = to_cloud_schedule(p_sched(timezone=stored))
+        assert isinstance(mapping, ScheduleSupported)
+        assert wire(mapping.schedule)["timezone"] == "America/New_York", stored
+
+
+def test_unset_end_conditions_are_absent_rather_than_null():
+    """The cloud's schema takes an absent field, not a null one, so a null would 400 every push."""
+    mapping = to_cloud_schedule(p_sched())
+    assert isinstance(mapping, ScheduleSupported)
+    assert "ends_at" not in wire(mapping.schedule)
+    assert "max_runs" not in wire(mapping.schedule)
+
+
+def test_the_cloud_copy_carries_no_local_secrets_and_no_live_timer():
+    wf = p_wf(
+        permissions=[PermissionTier(kind="text", after_minutes=5, phone="+15550001111")],
+        edit_agent_session_id="session-abc",
+        source_session_id="session-def",
+    )
+    body = cloud_definition(wf)
+    assert "permissions" not in body, "the escalation tiers carry a phone number and cannot ring from a container"
+    for leaked in ("edit_agent_session_id", "source_session_id", "last_run_id", "dashboard_id"):
+        assert leaked not in body
+    assert body["schedule"]["enabled"] is False
+    assert body["steps"][0]["text"] == "summarize the news"
+
+
+def test_a_signature_tracks_edits_and_ignores_the_clock():
+    wf = p_wf()
+    schedule = {"kind": "daily", "hour": 9, "minute": 0, "timezone": "UTC"}
+    first = definition_signature(cloud_definition(wf), schedule)
+
+    wf.title = wf.title
+    assert definition_signature(cloud_definition(wf), schedule) == first, "a save with no edit is not a drift"
+
+    wf.steps = [WorkflowStep(id=wf.steps[0].id, text="summarize the sports news")]
+    assert definition_signature(cloud_definition(wf), schedule) != first
+    assert definition_signature(cloud_definition(wf), {"kind": "interval", "minutes": 60}) != first
diff --git a/backend/tests/test_cloud_workflow_target.py b/backend/tests/test_cloud_workflow_target.py
new file mode 100644
index 00000000..9d56949f
--- /dev/null
+++ b/backend/tests/test_cloud_workflow_target.py
@@ -0,0 +1,288 @@
+"""Handing a workflow's timer to the cloud, and taking it back.
+
+The two things worth breaking a test over: the local timer and the cloud timer must never both be
+live (that runs a workflow twice), and a cloud we could not reach must never render as a cloud that
+said no (that is a paywall built out of a dropped packet).
+"""
+import pytest
+from fastapi import HTTPException
+
+from backend.apps.workflows import storage
+from backend.apps.workflows.cloud import client as cloud
+from backend.apps.workflows.cloud.routes import TargetRequest, set_workflow_target
+from backend.apps.workflows.workflows import delete_workflow
+from backend.apps.workflows.cloud.status import compute_status
+from backend.apps.workflows.models import ScheduleConfig, Workflow, WorkflowStep
+
+pytestmark = pytest.mark.usefixtures("isolated_workflows_data")
+
+
+def p_sched(**overrides) -> ScheduleConfig:
+    base = dict(enabled=True, repeat_unit="day", repeat_every=1, hour=9, minute=0, timezone="UTC")
+    base.update(overrides)
+    return ScheduleConfig(**base)
+
+
+def p_wf(**overrides) -> Workflow:
+    base = dict(title="Morning digest", steps=[WorkflowStep(text="summarize the news")], schedule=p_sched())
+    base.update(overrides)
+    wf = Workflow(**base)
+    storage.save_workflow(wf)
+    return wf
+
+
+def p_hosted(**overrides) -> dict:
+    row = {"id": "cloud-1", "enabled": True, "next_run_at": 1893499200000}
+    row.update(overrides)
+    return row
+
+
+def p_preflight_body(**overrides) -> dict:
+    body = {
+        "plan": "pro",
+        "limits": {"workflows": 3, "runsPerMonth": 100, "concurrent": 1},
+        "usage": {"enabled": 1, "runs_this_month": 12},
+        "capability": {"ok": True, "reason": None},
+        "hosted": None,
+    }
+    body.update(overrides)
+    return body
+
+
+def p_answer(monkeypatch, handler) -> list:
+    """Replace the single network chokepoint. Every call is recorded so a test can assert we did
+    NOT talk to the cloud as well as what we said."""
+    seen: list = []
+
+    async def p_call(method: str, path: str, body=None):
+        seen.append((method, path, body))
+        return handler(method, path, body)
+
+    monkeypatch.setattr(cloud, "p_call", p_call)
+    return seen
+
+
+@pytest.mark.asyncio
+async def test_signed_out_is_a_known_answer_and_carries_no_numbers(monkeypatch):
+    wf = p_wf()
+
+    def handler(method, path, body):
+        raise cloud.SignedOut()
+
+    p_answer(monkeypatch, handler)
+    status = await compute_status(wf)
+    assert status.state == "signed_out"
+    assert not hasattr(status, "limits") and not hasattr(status, "usage")
+
+
+@pytest.mark.asyncio
+async def test_an_unreachable_cloud_is_unknown_not_denied(monkeypatch):
+    wf = p_wf()
+
+    def handler(method, path, body):
+        raise cloud.CloudUnreachable("ConnectError")
+
+    p_answer(monkeypatch, handler)
+    status = await compute_status(wf)
+    assert status.state == "unknown"
+    # The whole point: nothing here can be read as "you have no plan" or "0 runs left".
+    assert not hasattr(status, "limits")
+    assert status.schedule_supported is True
+
+
+@pytest.mark.asyncio
+async def test_a_ready_status_reports_the_plan_the_server_named(monkeypatch):
+    wf = p_wf()
+    p_answer(monkeypatch, lambda method, path, body: p_preflight_body())
+    status = await compute_status(wf)
+    assert status.state == "ready"
+    assert status.plan == "pro"
+    assert status.limits.workflows == 3
+    assert status.usage.runs_this_month == 12
+    assert status.hosted is None
+
+
+@pytest.mark.asyncio
+async def test_a_refused_flip_leaves_the_workflow_on_this_device(monkeypatch):
+    wf = p_wf()
+
+    def handler(method, path, body):
+        raise cloud.CloudRefused("Cloud workflows need a Pro plan or higher.", 402)
+
+    p_answer(monkeypatch, handler)
+    outcome = await set_workflow_target(wf.id, TargetRequest(target="cloud", enabled=True))
+    assert outcome.ok is False
+    assert outcome.message == "Cloud workflows need a Pro plan or higher."
+    assert storage.get_workflow(wf.id).execution_target == "device"
+    assert storage.get_workflow(wf.id).cloud_workflow_id is None
+
+
+@pytest.mark.asyncio
+async def test_an_unsupported_schedule_never_reaches_the_network(monkeypatch):
+    wf = p_wf(schedule=p_sched(repeat_unit="month", day_of_month=1))
+    seen = p_answer(monkeypatch, lambda method, path, body: p_preflight_body())
+    outcome = await set_workflow_target(wf.id, TargetRequest(target="cloud", enabled=True))
+    assert outcome.ok is False
+    assert seen == []
+    assert storage.get_workflow(wf.id).execution_target == "device"
+
+
+@pytest.mark.asyncio
+async def test_weekdays_go_up_with_the_days_the_user_picked(monkeypatch):
+    """"Every weekday at 9am" is the schedule people actually write, and it used to be refused."""
+    wf = p_wf(schedule=p_sched(repeat_unit="week", on_days=[5, 1, 2, 3, 4], timezone="America/Los_Angeles"))
+    seen = p_answer(monkeypatch, lambda method, path, body: p_hosted())
+    outcome = await set_workflow_target(wf.id, TargetRequest(target="cloud", enabled=True))
+    assert outcome.ok is True
+    sent = seen[-1][2]["schedule"]
+    assert sent == {"kind": "weekly", "days": [1, 2, 3, 4, 5], "hour": 9, "minute": 0,
+                    "timezone": "America/Los_Angeles"}
+    assert storage.get_workflow(wf.id).execution_target == "cloud"
+
+
+@pytest.mark.asyncio
+async def test_a_capped_schedule_hands_over_its_cap_and_what_it_has_already_spent(monkeypatch):
+    wf = p_wf(schedule=p_sched(max_runs=5, runs_count=2))
+    seen = p_answer(monkeypatch, lambda method, path, body: p_hosted())
+    assert (await set_workflow_target(wf.id, TargetRequest(target="cloud", enabled=True))).ok is True
+    body = seen[-1][2]
+    assert body["schedule"]["max_runs"] == 5
+    # Without this the cloud would give a schedule with 3 runs left a fresh 5.
+    assert body["runs_before"] == 2
+
+
+@pytest.mark.asyncio
+async def test_runs_the_cloud_performed_come_back_onto_our_own_counter(monkeypatch):
+    wf = p_wf(schedule=p_sched(max_runs=5, runs_count=2), execution_target="cloud",
+              cloud_workflow_id="cloud-1")
+    storage.save_workflow(wf)
+    p_answer(monkeypatch, lambda method, path, body: p_preflight_body(hosted=p_hosted(runs_done=4)))
+    await compute_status(wf)
+    assert storage.get_workflow(wf.id).schedule.runs_count == 4
+
+
+@pytest.mark.asyncio
+async def test_an_accepted_flip_records_which_copy_is_up_there(monkeypatch):
+    wf = p_wf()
+    p_answer(monkeypatch, lambda method, path, body: p_hosted())
+    outcome = await set_workflow_target(wf.id, TargetRequest(target="cloud", enabled=True))
+    assert outcome.ok is True
+
+    saved = storage.get_workflow(wf.id)
+    assert saved.execution_target == "cloud"
+    assert saved.cloud_workflow_id == "cloud-1"
+    assert saved.cloud_definition_signature is not None
+    # The cloud owns the clock now, so the app shows the cloud's next fire and not our frozen one.
+    assert saved.next_run_at is not None
+    assert saved.next_run_at.timestamp() * 1000 == p_hosted()["next_run_at"]
+
+
+@pytest.mark.asyncio
+async def test_an_unreachable_cloud_cannot_take_the_timer_back(monkeypatch):
+    wf = p_wf(execution_target="cloud", cloud_workflow_id="cloud-1")
+    storage.save_workflow(wf)
+
+    def handler(method, path, body):
+        raise cloud.CloudUnreachable("ReadTimeout")
+
+    p_answer(monkeypatch, handler)
+    outcome = await set_workflow_target(wf.id, TargetRequest(target="device", enabled=True))
+    assert outcome.ok is False
+    # Flipping the local timer on while the cloud still holds one is how a workflow runs twice.
+    assert storage.get_workflow(wf.id).execution_target == "cloud"
+    assert storage.get_workflow(wf.id).cloud_workflow_id == "cloud-1"
+
+
+@pytest.mark.asyncio
+async def test_taking_the_timer_back_clears_every_trace_of_the_cloud_copy(monkeypatch):
+    wf = p_wf(execution_target="cloud", cloud_workflow_id="cloud-1", cloud_definition_signature="abc")
+    storage.save_workflow(wf)
+    seen = p_answer(monkeypatch, lambda method, path, body: {"ok": True})
+    outcome = await set_workflow_target(wf.id, TargetRequest(target="device", enabled=True))
+    assert outcome.ok is True
+    assert seen == [("POST", "/cloud-1/delete", {})]
+
+    saved = storage.get_workflow(wf.id)
+    assert saved.execution_target == "device"
+    assert saved.cloud_workflow_id is None
+    assert saved.cloud_definition_signature is None
+    assert saved.next_run_at is not None, "the local timer has to be armed again on the way back"
+
+
+@pytest.mark.asyncio
+async def test_a_hosted_copy_that_vanished_shows_as_hosted_nothing(monkeypatch):
+    wf = p_wf(execution_target="cloud", cloud_workflow_id="cloud-gone")
+    storage.save_workflow(wf)
+    p_answer(monkeypatch, lambda method, path, body: p_preflight_body(hosted=None))
+    status = await compute_status(wf)
+    assert status.state == "ready"
+    assert status.target == "cloud" and status.hosted is None
+    assert storage.get_workflow(wf.id).next_run_at is None, "nothing is going to run it, so do not promise a time"
+
+
+@pytest.mark.asyncio
+async def test_an_edited_workflow_reads_as_out_of_sync(monkeypatch):
+    wf = p_wf()
+    p_answer(monkeypatch, lambda method, path, body: p_hosted())
+    await set_workflow_target(wf.id, TargetRequest(target="cloud", enabled=True))
+
+    p_answer(monkeypatch, lambda method, path, body: p_preflight_body(hosted=p_hosted()))
+    assert (await compute_status(storage.get_workflow(wf.id))).hosted.in_sync is True
+
+    edited = storage.get_workflow(wf.id)
+    edited.steps = [WorkflowStep(text="summarize the sports news instead")]
+    storage.save_workflow(edited)
+    assert (await compute_status(edited)).hosted.in_sync is False
+
+
+@pytest.mark.asyncio
+async def test_an_old_control_plane_leaves_capability_unknown_rather_than_ok(monkeypatch):
+    wf = p_wf()
+
+    def handler(method, path, body):
+        if path == "/preflight":
+            raise cloud.CloudRefused("Not Found", 404)
+        return {
+            "workflows": [],
+            "limits": {"workflows": 3, "runsPerMonth": 100, "concurrent": 1},
+            "usage": {"enabled": 0, "runs_this_month": 0},
+        }
+
+    seen = p_answer(monkeypatch, handler)
+    status = await compute_status(wf)
+    assert status.state == "ready"
+    assert status.capability is None
+    assert status.limits.workflows == 3
+    # The cloud router is mounted AT /api/workflows and a trailing slash 404s there, which would turn this fallback into a second refusal.
+    assert seen[-1][1] == "", "the collection path must not carry a trailing slash"
+
+
+@pytest.mark.asyncio
+async def test_trashing_a_cloud_workflow_stops_the_cloud_copy(monkeypatch):
+    wf = p_wf()
+    p_answer(monkeypatch, lambda method, path, body: p_hosted())
+    await set_workflow_target(wf.id, TargetRequest(target="cloud", enabled=True))
+
+    seen = p_answer(monkeypatch, lambda method, path, body: {"ok": True})
+    await delete_workflow(storage.get_workflow(wf.id).id)
+    assert seen == [("POST", "/cloud-1/delete", {})]
+    trashed = storage.get_workflow(wf.id)
+    assert trashed.deleted_at is not None
+    assert trashed.cloud_workflow_id is None
+
+
+@pytest.mark.asyncio
+async def test_a_workflow_the_cloud_still_holds_cannot_be_trashed_into_a_ghost(monkeypatch):
+    wf = p_wf()
+    p_answer(monkeypatch, lambda method, path, body: p_hosted())
+    await set_workflow_target(wf.id, TargetRequest(target="cloud", enabled=True))
+
+    def handler(method, path, body):
+        raise cloud.CloudUnreachable("ConnectError")
+
+    p_answer(monkeypatch, handler)
+    with pytest.raises(HTTPException) as caught:
+        await delete_workflow(wf.id)
+    assert caught.value.status_code == 409
+    # Deleting it locally would leave a hosted copy running on its own schedule, billing a user who cannot see it.
+    assert storage.get_workflow(wf.id).deleted_at is None
diff --git a/backend/tests/test_credential_lease.py b/backend/tests/test_credential_lease.py
new file mode 100644
index 00000000..e10a6a4f
--- /dev/null
+++ b/backend/tests/test_credential_lease.py
@@ -0,0 +1,256 @@
+"""Custody handover of a rotating credential, ordered so two holders is unrepresentable.
+
+Providers issue a new refresh token on every refresh and treat a replayed one as theft, revoking
+the whole grant family. So the invariant under test is not "the happy path works", it is: at no
+point does BOTH this device and the cloud hold a token that can rotate.
+
+Run:
+    cd backend && .venv/bin/python -m pytest tests/test_credential_lease.py -v
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Any, Dict, List
+
+import httpx
+import pytest
+
+import backend.apps.nine_router.credential_lease as lease
+import backend.apps.nine_router.credential_store as store
+from backend.apps.nine_router import process
+
+P_CONNECTION = {
+    "id": "conn-1",
+    "provider": "claude",
+    "authType": "oauth",
+    "accessToken": "access-old",
+    "refreshToken": "refresh-live",
+    "expiresAt": "2026-08-01T00:00:00.000Z",
+    "isActive": True,
+}
+
+
+@pytest.fixture
+def p_device(tmp_path, monkeypatch):
+    """A stopped-on-demand router with one oauth connection, and a signed-in cloud identity."""
+    data_dir = tmp_path / "9router"
+    data_dir.mkdir()
+    (data_dir / "db.json").write_text(json.dumps({"providerConnections": [dict(P_CONNECTION)]}))
+    monkeypatch.setattr(process, "nine_router_data_dir", lambda: str(data_dir))
+
+    state = {"running": True}
+    monkeypatch.setattr(process, "stop", lambda: state.__setitem__("running", False))
+    monkeypatch.setattr(process, "is_running", lambda: state["running"])
+
+    async def p_ensure() -> None:
+        state["running"] = True
+
+    async def p_no_http() -> None:
+        return None
+
+    monkeypatch.setattr(process, "ensure_running", p_ensure)
+    monkeypatch.setattr(store, "request_shutdown", p_no_http)
+    monkeypatch.setattr(lease, "p_cloud", lambda: ("bearer-xyz", "https://api.example.test"))
+    return state
+
+
+def p_local() -> Dict[str, Any]:
+    db = json.loads(open(store.db_path(), encoding="utf-8").read())
+    return next(c for c in db["providerConnections"] if c["id"] == "conn-1")
+
+
+class FakeClient:
+    """Records calls and replays scripted responses; never touches the network."""
+
+    def __init__(self, script: List[Any], calls: List[Dict[str, Any]]):
+        self.script = script
+        self.calls = calls
+
+    async def __aenter__(self) -> "FakeClient":
+        return self
+
+    async def __aexit__(self, *exc: Any) -> None:
+        return None
+
+    def p_next(self, method: str, url: str, kwargs: Dict[str, Any]) -> Any:
+        self.calls.append({"method": method, "url": url, **kwargs})
+        outcome = self.script.pop(0)
+        if isinstance(outcome, Exception):
+            raise outcome
+        return outcome
+
+    async def post(self, url: str, **kwargs: Any) -> Any:
+        return self.p_next("POST", url, kwargs)
+
+    async def get(self, url: str, **kwargs: Any) -> Any:
+        return self.p_next("GET", url, kwargs)
+
+
+def p_response(status: int, body: Dict[str, Any] | None = None) -> Any:
+    return httpx.Response(status, json=body if body is not None else {})
+
+
+async def p_already_leased(harness: Dict[str, Any]) -> None:
+    """Put the device in the post-handover state: cloud owns the refresh token, device does not."""
+    harness["script"].append(p_response(200, {}))
+    await lease.lease_to_cloud("conn-1")
+    harness["script"].clear()
+    harness["calls"].clear()
+
+
+@pytest.fixture
+def p_cloud_calls(monkeypatch):
+    calls: List[Dict[str, Any]] = []
+    script: List[Any] = []
+
+    def p_factory(*args: Any, **kwargs: Any) -> FakeClient:
+        return FakeClient(script, calls)
+
+    monkeypatch.setattr(lease.httpx, "AsyncClient", p_factory)
+    return {"calls": calls, "script": script}
+
+
+@pytest.mark.asyncio
+async def test_lease_strips_locally_and_uploads(p_device, p_cloud_calls):
+    p_cloud_calls["script"].append(p_response(200, {"owner": "cloud"}))
+
+    result = await lease.lease_to_cloud("conn-1")
+
+    assert result.status == "leased"
+    assert "refreshToken" not in p_local(), "the device must not keep a token it could rotate"
+    assert p_local()["accessToken"] == "access-old", "the access token still has to work locally"
+    sent = p_cloud_calls["calls"][0]["json"]
+    assert sent["refresh_token"] == "refresh-live"
+    assert sent["provider"] == "claude"
+
+
+@pytest.mark.asyncio
+async def test_device_is_stripped_before_the_upload_is_attempted(p_device, p_cloud_calls, monkeypatch):
+    """The ordering IS the safety property. If the upload could run first, a failed strip would
+    leave two live rotators, which is the incident this design exists to prevent."""
+    observed: List[bool] = []
+
+    def p_factory(*args: Any, **kwargs: Any) -> FakeClient:
+        observed.append("refreshToken" in p_local())
+        return FakeClient(p_cloud_calls["script"], p_cloud_calls["calls"])
+
+    p_cloud_calls["script"].append(p_response(200, {}))
+    monkeypatch.setattr(lease.httpx, "AsyncClient", p_factory)
+
+    await lease.lease_to_cloud("conn-1")
+
+    assert observed == [False], "the local token was still present when the upload began"
+
+
+@pytest.mark.asyncio
+async def test_rejected_upload_restores_the_local_token(p_device, p_cloud_calls):
+    p_cloud_calls["script"].append(p_response(500, {}))
+
+    result = await lease.lease_to_cloud("conn-1")
+
+    assert result.status == "cloud_rejected"
+    assert p_local()["refreshToken"] == "refresh-live", "custody never moved, so it must come back"
+
+
+@pytest.mark.asyncio
+async def test_ambiguous_upload_asks_who_owns_it_before_restoring(p_device, p_cloud_calls):
+    """A timeout can mean the server committed anyway. Restoring blindly would recreate exactly the
+    two-holder state, so ownership is checked rather than assumed."""
+    p_cloud_calls["script"].append(httpx.ReadTimeout("boom"))
+    p_cloud_calls["script"].append(
+        p_response(200, {"leases": [{"connection_id": "conn-1", "owner": "cloud"}]})
+    )
+
+    result = await lease.lease_to_cloud("conn-1")
+
+    assert result.status == "leased"
+    assert "refreshToken" not in p_local(), "the cloud owns it; putting it back makes two rotators"
+
+
+@pytest.mark.asyncio
+async def test_ambiguous_upload_restores_when_the_cloud_does_not_have_it(p_device, p_cloud_calls):
+    p_cloud_calls["script"].append(httpx.ReadTimeout("boom"))
+    p_cloud_calls["script"].append(p_response(200, {"leases": []}))
+
+    result = await lease.lease_to_cloud("conn-1")
+
+    assert result.status == "cloud_rejected"
+    assert p_local()["refreshToken"] == "refresh-live"
+
+
+@pytest.mark.asyncio
+async def test_unknown_ownership_leaves_the_token_off_the_device(p_device, p_cloud_calls):
+    """Fail safe: when we cannot learn who owns it, the safe guess is 'not us'. Worst case the user
+    reconnects; the alternative risks revoking their whole grant."""
+    p_cloud_calls["script"].append(httpx.ReadTimeout("boom"))
+    p_cloud_calls["script"].append(httpx.ReadTimeout("also boom"))
+
+    result = await lease.lease_to_cloud("conn-1")
+
+    assert result.status == "ownership_unknown"
+    assert "refreshToken" not in p_local()
+
+
+@pytest.mark.asyncio
+async def test_release_brings_the_refresh_token_home(p_device, p_cloud_calls):
+    await p_already_leased(p_cloud_calls)
+    p_cloud_calls["script"].append(
+        p_response(200, {"access_token": "access-new", "refresh_token": "refresh-rotated"})
+    )
+
+    result = await lease.release_to_device("conn-1")
+
+    assert result.status == "released"
+    assert p_local()["refreshToken"] == "refresh-rotated", "must be the CURRENT token, not the old one"
+    assert p_local()["accessToken"] == "access-new"
+
+
+@pytest.mark.asyncio
+async def test_release_conflict_does_not_write_a_doomed_token(p_device, p_cloud_calls):
+    """409 means a refresh is mid-exchange. Taking that token would hand the device one the provider
+    is about to invalidate."""
+    await p_already_leased(p_cloud_calls)
+    p_cloud_calls["script"].append(p_response(409, {}))
+
+    result = await lease.release_to_device("conn-1")
+
+    assert result.status == "cloud_rejected"
+    assert "refreshToken" not in p_local()
+
+
+@pytest.mark.asyncio
+async def test_pull_access_token_updates_only_the_access_token(p_device, p_cloud_calls):
+    await p_already_leased(p_cloud_calls)
+    p_cloud_calls["script"].append(p_response(200, {"access_token": "access-fresh"}))
+
+    result = await lease.pull_access_token("conn-1")
+
+    assert result.status == "refreshed"
+    assert p_local()["accessToken"] == "access-fresh"
+    assert "refreshToken" not in p_local(), "pulling a token must never re-arm local rotation"
+
+
+@pytest.mark.asyncio
+async def test_api_key_connection_is_not_leasable(p_device, p_cloud_calls):
+    """No rotating secret means nothing to hand over, and no reason to touch the row."""
+    await p_already_leased(p_cloud_calls)
+
+    result = await lease.lease_to_cloud("conn-1")
+
+    assert result.status == "not_rotatable"
+    assert p_cloud_calls["calls"] == [], "a row with nothing to rotate must not be uploaded at all"
+
+
+@pytest.mark.asyncio
+async def test_signed_out_device_does_nothing(p_device, monkeypatch):
+    monkeypatch.setattr(lease, "p_cloud", lambda: None)
+    result = await lease.lease_to_cloud("conn-1")
+    assert result.status == "not_signed_in"
+    assert p_local()["refreshToken"] == "refresh-live"
+
+
+def test_expiry_converts_to_unix_ms():
+    assert lease.expires_ms("2026-08-01T00:00:00.000Z") == 1785542400000
+    assert lease.expires_ms("garbage") == 0, "an unreadable clock must read as expired, not valid"
+    assert lease.expires_ms(None) == 0
diff --git a/backend/tests/test_credential_store.py b/backend/tests/test_credential_store.py
new file mode 100644
index 00000000..df305bdf
--- /dev/null
+++ b/backend/tests/test_credential_store.py
@@ -0,0 +1,142 @@
+"""Moving a rotating credential out of 9Router's db.json without racing 9Router for the file.
+
+The stakes: providers issue a NEW refresh token on every refresh and treat a replayed one as
+theft, revoking the whole grant family. So exactly one holder may be able to refresh. Removing
+`refreshToken` from a connection is what makes an instance structurally unable to rotate. If that
+edit were lost to a concurrent router write, or if the router resurrected the token afterwards,
+we would have two rotators and a dead account.
+
+Run:
+    cd backend && .venv/bin/python -m pytest tests/test_credential_store.py -v
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import stat
+
+import pytest
+
+import backend.apps.nine_router.credential_store as store
+from backend.apps.nine_router import process
+
+P_CONNECTION = {
+    "id": "conn-1",
+    "provider": "claude",
+    "authType": "oauth",
+    "accessToken": "access-value",
+    "refreshToken": "refresh-value",
+    "expiresAt": "2026-08-01T00:00:00.000Z",
+    "isActive": True,
+}
+
+
+@pytest.fixture
+def p_router(tmp_path, monkeypatch):
+    """A stopped router with one oauth connection on disk. Restart is recorded, never real."""
+    data_dir = tmp_path / "9router"
+    data_dir.mkdir()
+    db = {"providerConnections": [dict(P_CONNECTION), {"id": "conn-2", "authType": "apikey"}]}
+    (data_dir / "db.json").write_text(json.dumps(db))
+    monkeypatch.setattr(process, "nine_router_data_dir", lambda: str(data_dir))
+
+    state = {"running": True, "restarts": 0}
+
+    def p_stop() -> None:
+        state["running"] = False
+
+    async def p_ensure() -> None:
+        state["restarts"] += 1
+        state["running"] = True
+
+    async def p_no_http() -> None:
+        state["shutdown_calls"] += 1
+
+    state["shutdown_calls"] = 0
+    monkeypatch.setattr(process, "stop", p_stop)
+    monkeypatch.setattr(process, "is_running", lambda: state["running"])
+    monkeypatch.setattr(process, "ensure_running", p_ensure)
+    # Hard-stubbed: without this the suite would POST /shutdown at whatever real router owns the port.
+    monkeypatch.setattr(store, "request_shutdown", p_no_http)
+    return state
+
+
+def p_connection(data_dir_owner) -> dict:
+    db = json.loads(open(store.db_path(), encoding="utf-8").read())
+    return next(c for c in db["providerConnections"] if c["id"] == "conn-1")
+
+
+def test_read_credential_returns_the_tokens(p_router):
+    cred = store.read_credential("conn-1")
+    assert cred is not None
+    assert cred.provider == "claude"
+    assert cred.access_token == "access-value"
+    assert cred.refresh_token == "refresh-value"
+
+
+def test_only_oauth_connections_are_listed(p_router):
+    assert store.list_oauth_connection_ids() == ["conn-1"]
+
+
+@pytest.mark.asyncio
+async def test_dropping_the_refresh_token_removes_the_key(p_router):
+    """Absent, not blank. 9Router's refresh dispatcher bails on a falsy refreshToken, so the key
+    being gone is precisely what makes this instance unable to rotate."""
+    ok = await store.apply_to_connection("conn-1", changes={}, drop=["refreshToken"])
+    assert ok
+    after = p_connection(p_router)
+    assert "refreshToken" not in after
+    assert after["accessToken"] == "access-value", "must not disturb the rest of the connection"
+
+
+@pytest.mark.asyncio
+async def test_router_is_stopped_then_restarted(p_router):
+    await store.apply_to_connection("conn-1", changes={}, drop=["refreshToken"])
+    assert p_router["shutdown_calls"] == 1, "an adopted router only goes down over HTTP"
+    assert p_router["restarts"] == 1
+    assert p_router["running"] is True
+
+
+@pytest.mark.asyncio
+async def test_refuses_to_edit_when_the_router_will_not_stop(p_router, monkeypatch):
+    """The load-bearing guard. Editing under a live router risks losing the edit, or worse, the
+    router rewriting the refresh token back after we have already handed it to the cloud."""
+    monkeypatch.setattr(process, "is_running", lambda: True)
+    monkeypatch.setattr(process, "stop", lambda: None)
+    monkeypatch.setattr(store, "P_DOWN_WAIT_S", 0.2)
+
+    ok = await store.apply_to_connection("conn-1", changes={}, drop=["refreshToken"])
+
+    assert ok is False
+    assert p_connection(p_router)["refreshToken"] == "refresh-value", "file must be untouched"
+
+
+@pytest.mark.asyncio
+async def test_restoring_a_refresh_token_round_trips(p_router):
+    await store.apply_to_connection("conn-1", changes={}, drop=["refreshToken"])
+    ok = await store.apply_to_connection("conn-1", changes={"refreshToken": "returned"}, drop=[])
+    assert ok
+    assert p_connection(p_router)["refreshToken"] == "returned"
+
+
+@pytest.mark.asyncio
+async def test_written_db_is_owner_only(p_router):
+    await store.apply_to_connection("conn-1", changes={}, drop=["refreshToken"])
+    mode = stat.S_IMODE(os.stat(store.db_path()).st_mode)
+    assert mode & 0o077 == 0
+
+
+@pytest.mark.asyncio
+async def test_unknown_connection_changes_nothing(p_router):
+    ok = await store.apply_to_connection("conn-missing", changes={"x": 1}, drop=[])
+    assert ok is False
+    assert p_connection(p_router)["refreshToken"] == "refresh-value"
+
+
+@pytest.mark.asyncio
+async def test_corrupt_db_is_not_overwritten(p_router):
+    open(store.db_path(), "w", encoding="utf-8").write("{not json")
+    ok = await store.apply_to_connection("conn-1", changes={}, drop=["refreshToken"])
+    assert ok is False
+    assert open(store.db_path(), encoding="utf-8").read() == "{not json"
diff --git a/backend/tests/test_distill_history.py b/backend/tests/test_distill_history.py
index 63fc91bc..d58b8ed6 100644
--- a/backend/tests/test_distill_history.py
+++ b/backend/tests/test_distill_history.py
@@ -98,3 +98,56 @@ def test_kill_switch_disables(monkeypatch) -> None:
     out = asyncio.run(dh.distilled_history_summary(s, load_settings()))
     assert out == ""
     assert calls == []
+
+
+def p_edit_session(paths: list) -> AgentSession:
+    s = AgentSession(name="t", model="sonnet")
+    s.messages = [Message(role="user", content="refactor them")]
+    for p in paths:
+        s.messages.append(Message(role="tool_call", content={"tool": "Edit", "input": {"file_path": p}}))
+        s.messages.append(Message(role="tool_result", content={"text": f"edited {p}", "tool_name": "Edit"}))
+    s.messages.append(Message(role="assistant", content="done"))
+    return s
+
+
+def test_touched_paths_come_from_tool_inputs_not_prose() -> None:
+    s = p_edit_session(["/a/one.py", "/b/two.py", "/a/one.py"])
+    s.messages.append(Message(role="tool_call", content={"tool": "NotebookEdit", "input": {"notebook_path": "/c/n.ipynb"}}))
+    assert dh.touched_file_paths(s.messages) == ["/a/one.py", "/b/two.py", "/c/n.ipynb"]
+
+
+def test_paths_the_summary_paraphrased_away_are_pinned_back(monkeypatch) -> None:
+    """Live-measured: the aux model collapsed 12 literal paths into '/repo/src/module_N/handler_N.py'
+    and 0 survived verbatim. Prose may paraphrase; the paths get re-attached deterministically."""
+    paths = [f"/repo/src/module_{i}/handler_{i}.py" for i in range(12)]
+
+    async def paraphrase(session, settings, body):
+        return "The agent edited the twelve handler files under /repo/src."
+    monkeypatch.setattr(dh, "p_call_distiller", paraphrase)
+    s = p_edit_session(paths)
+    s.compacted_through_msg_id = s.messages[-1].id
+    out = asyncio.run(dh.distilled_history_summary(s, load_settings()))
+    for p in paths:
+        assert p in out
+
+
+def test_paths_already_in_the_summary_are_not_repeated(monkeypatch) -> None:
+    async def verbatim(session, settings, body):
+        return "Edited /a/one.py and /b/two.py."
+    monkeypatch.setattr(dh, "p_call_distiller", verbatim)
+    s = p_edit_session(["/a/one.py", "/b/two.py"])
+    s.compacted_through_msg_id = s.messages[-1].id
+    out = asyncio.run(dh.distilled_history_summary(s, load_settings()))
+    assert out == "Edited /a/one.py and /b/two.py."
+
+
+def test_pinned_path_list_is_capped(monkeypatch) -> None:
+    paths = [f"/repo/f{i}.py" for i in range(dh.MAX_PINNED_PATHS + 25)]
+
+    async def paraphrase(session, settings, body):
+        return "Edited a lot of files."
+    monkeypatch.setattr(dh, "p_call_distiller", paraphrase)
+    s = p_edit_session(paths)
+    s.compacted_through_msg_id = s.messages[-1].id
+    out = asyncio.run(dh.distilled_history_summary(s, load_settings()))
+    assert sum(1 for p in paths if p in out) == dh.MAX_PINNED_PATHS
diff --git a/backend/tests/test_edge_sandbox_mirrors_backend.py b/backend/tests/test_edge_sandbox_mirrors_backend.py
new file mode 100644
index 00000000..6f7783e4
--- /dev/null
+++ b/backend/tests/test_edge_sandbox_mirrors_backend.py
@@ -0,0 +1,29 @@
+"""The public edge vendors the desktop sandbox's static gate, and a gate that
+only gets tightened on the desktop leaves the internet-facing copy open. So the
+two files must stay byte-identical below their docstrings; SECURITY.md has
+carried "drift risk" as an open note on this pair since the edge shipped.
+
+Run:
+    backend/.venv/bin/python -m pytest backend/tests/test_edge_sandbox_mirrors_backend.py -v
+"""
+
+import ast
+from pathlib import Path
+
+P_ROOT = Path(__file__).resolve().parents[2]
+P_DESKTOP = P_ROOT / "backend" / "apps" / "outputs" / "code_safety.py"
+P_EDGE = P_ROOT / "openswarm-edge" / "app" / "code_safety.py"
+
+
+def p_body(path: Path) -> str:
+    """The file with its module docstring (the only licensed difference) removed."""
+    source = path.read_text()
+    docstring = ast.parse(source).body[0]
+    return "".join(source.splitlines(keepends=True)[docstring.end_lineno:])
+
+
+def test_edge_gate_is_a_verbatim_copy_of_the_desktop_gate() -> None:
+    assert p_body(P_EDGE) == p_body(P_DESKTOP), (
+        "openswarm-edge/app/code_safety.py has drifted from "
+        "backend/apps/outputs/code_safety.py; re-copy it below the docstring."
+    )
diff --git a/backend/tests/test_frozen_workflow_tools.py b/backend/tests/test_frozen_workflow_tools.py
new file mode 100644
index 00000000..db6cde75
--- /dev/null
+++ b/backend/tests/test_frozen_workflow_tools.py
@@ -0,0 +1,77 @@
+"""A workflow's frozen Actions set has to actually restrict the run.
+
+It did not. `AgentConfig.allowed_tools` was computed by the executor, passed to launch, and then
+dropped on the floor: launch resolved tools purely from the mode. So the Actions page offered a
+permission toggle that no dispatch code read, which is worse than offering nothing, because it
+sells a boundary that is not there. An unattended 3am run with Bash and nobody to deny an approval
+is exactly the case the toggle exists for.
+
+None still means "whatever the mode allows", so an unfrozen workflow keeps the full surface.
+
+Run:
+    cd backend && .venv/bin/python -m pytest tests/test_frozen_workflow_tools.py -v
+"""
+
+from __future__ import annotations
+
+from typing import List
+
+from backend.apps.agents.core.models import AgentConfig
+from backend.apps.agents.manager.AgentLaunch import resolve_launch_tools
+
+
+def p_resolve(config: AgentConfig, mode_tools: List[str]) -> List[str]:
+    """Drives the REAL launch-time resolver, not a copy of it. A mirrored implementation here would
+    keep passing even if launch went back to ignoring the frozen set entirely."""
+    return resolve_launch_tools(mode_tools, config.allowed_tools)
+
+
+P_MODE = ["Read", "Edit", "Write", "Bash", "Glob", "Grep", "WebSearch", "AskUserQuestion"]
+
+
+def test_default_is_unrestricted():
+    """Every normal chat posts a config with no allowed_tools. If the default were a list instead of
+    None, honouring it would silently strip the whole app down to that list."""
+    assert AgentConfig(name="chat").allowed_tools is None
+
+
+def test_unfrozen_workflow_keeps_the_full_mode_surface():
+    assert p_resolve(AgentConfig(name="wf"), P_MODE) == P_MODE
+
+
+def test_frozen_set_actually_removes_tools():
+    config = AgentConfig(name="wf", allowed_tools=["Read", "Glob"])
+    resolved = p_resolve(config, P_MODE)
+    assert resolved == ["Read", "Glob"]
+    assert "Bash" not in resolved, "the whole point: a frozen set must be able to withhold Bash"
+    assert "Write" not in resolved
+
+
+def test_a_frozen_set_cannot_widen_the_mode():
+    """Intersect, never trust. A stale saved set naming a tool the mode does not grant must not
+    smuggle it back in."""
+    config = AgentConfig(name="wf", allowed_tools=["Read", "NotebookEdit", "BrowserClick"])
+    resolved = p_resolve(config, ["Read", "Bash"])
+    assert resolved == ["Read"]
+
+
+def test_an_explicitly_empty_set_grants_nothing():
+    """Distinct from None on purpose. This is why the workflow edit and scheduling chats had to move
+    off [] and onto None: under the old dead code [] was harmless, now it means zero tools."""
+    assert p_resolve(AgentConfig(name="wf", allowed_tools=[]), P_MODE) == []
+
+
+def test_order_follows_the_mode_not_the_saved_set():
+    config = AgentConfig(name="wf", allowed_tools=["Grep", "Read"])
+    assert p_resolve(config, P_MODE) == ["Read", "Grep"]
+
+
+def test_workflow_call_sites_do_not_pass_an_empty_list():
+    """Guards the migration: an [] left behind at any AgentConfig site is now a silently toolless
+    agent, which reads to the user as the agent being broken."""
+    import re
+    from pathlib import Path
+    root = Path(__file__).resolve().parents[1]
+    for rel in ("apps/workflows/workflows.py", "apps/workflows/executor.py"):
+        src = (root / rel).read_text()
+        assert not re.search(r"allowed_tools=\[\]", src), f"{rel} still passes an empty allowed_tools"
diff --git a/backend/tests/test_headless_mode.py b/backend/tests/test_headless_mode.py
new file mode 100644
index 00000000..2f884d1e
--- /dev/null
+++ b/backend/tests/test_headless_mode.py
@@ -0,0 +1,163 @@
+"""Headless gating: the tools that dead-end must be gone from the effective tool surface, and an
+'ask' must deny on the spot instead of parking on the 600s approval timeout. Two gates, not one:
+ShowUI/AskUI and AskUserQuestion need a person, so OPENSWARM_HEADLESS=1 alone kills them, while
+browser/app delegation only needs a window, so a headless box that boots one (the cloud runner
+under Xvfb) keeps them. Every case is paired with its twin, because a gate that can't be seen
+switching off proves nothing."""
+
+import pytest
+from unittest.mock import AsyncMock, patch
+
+from backend.apps.agents.core.models import AgentSession
+from backend.apps.agents.manager.permissions import workflow_approval
+from backend.apps.agents.manager.permissions.build_effective_tool_lists import build_effective_tool_lists
+from backend.apps.agents.manager.register_builtin_mcp_servers import register_builtin_mcp_servers
+from backend.apps.agents.manager.streaming.HookContext import HookContext
+from backend.apps.agents.core.ws_manager import ws_manager
+from backend.config.headless import HUMAN_BOUND_TOOLS, RENDERER_BOUND_TOOLS, denied_tools
+
+BROWSER_DELEGATION = ("CreateBrowserAgent", "BrowserAgent", "BrowserAgents", "AppAgent")
+
+
+def p_session():
+    session = AgentSession(name="t", model="sonnet", dashboard_id="d")
+    session.allowed_tools = ["Read", "Bash", "AskUserQuestion"]
+    return session
+
+
+def p_run_the_real_pipeline():
+    """Registration then tool-list build, in the order the agent loop runs them."""
+    session = p_session()
+    mcp_servers = {}
+    browser_tools, invoke_tools = register_builtin_mcp_servers(
+        mcp_servers, session, {}, None, None)
+    allowed, disallowed = build_effective_tool_lists(
+        session, mcp_servers, {}, False, browser_tools, invoke_tools)
+    return mcp_servers, allowed, disallowed
+
+
+def p_ctx() -> HookContext:
+    session = p_session()
+    return HookContext(
+        session=session,
+        session_id=session.id,
+        prompt="hi",
+        builtin_perms={},
+        policy_defaults={},
+        sessions={},
+    )
+
+
+@pytest.fixture
+def no_renderer(monkeypatch):
+    """No window has ever attached, the state a container starts in."""
+    monkeypatch.setattr(ws_manager, "renderer_ever_attached", False, raising=False)
+
+
+@pytest.fixture
+def renderer_attached(monkeypatch):
+    """A window registered on the dashboard socket, the state the runner waits for."""
+    monkeypatch.setattr(ws_manager, "renderer_ever_attached", True, raising=False)
+
+
+def test_the_two_denied_sets_split_by_what_they_actually_need():
+    assert RENDERER_BOUND_TOOLS == frozenset(BROWSER_DELEGATION)
+    assert HUMAN_BOUND_TOOLS == frozenset({"ShowUI", "AskUserQuestion"})
+
+
+def test_a_renderer_buys_back_the_browser_tools_but_never_the_human_ones(monkeypatch, renderer_attached):
+    monkeypatch.setenv("OPENSWARM_HEADLESS", "1")
+    assert denied_tools() == HUMAN_BOUND_TOOLS
+
+
+def test_a_desktop_launch_denies_nothing_even_before_its_window_loads(monkeypatch, no_renderer):
+    monkeypatch.delenv("OPENSWARM_HEADLESS", raising=False)
+    assert denied_tools() == frozenset()
+
+
+def test_headless_with_a_renderer_offers_the_browser_server_again(monkeypatch, renderer_attached):
+    monkeypatch.setenv("OPENSWARM_HEADLESS", "1")
+    mcp_servers, allowed, disallowed = p_run_the_real_pipeline()
+    assert "openswarm-browser-agent" in mcp_servers
+    for tool in BROWSER_DELEGATION:
+        assert f"mcp__openswarm-browser-agent__{tool}" in allowed
+    # Still nobody to answer, so the human-bound pair stays gone.
+    assert "openswarm-ui" not in mcp_servers
+    assert "AskUserQuestion" in disallowed
+
+
+def test_headless_drops_the_renderer_bound_servers_and_tools(monkeypatch, no_renderer):
+    monkeypatch.setenv("OPENSWARM_HEADLESS", "1")
+    mcp_servers, allowed, disallowed = p_run_the_real_pipeline()
+    assert "openswarm-browser-agent" not in mcp_servers
+    assert "openswarm-ui" not in mcp_servers
+    for tool in BROWSER_DELEGATION:
+        assert f"mcp__openswarm-browser-agent__{tool}" not in allowed
+    for ui_tool in ("ShowUI", "AskUI"):
+        assert f"mcp__openswarm-ui__{ui_tool}" not in allowed
+    assert "AskUserQuestion" not in allowed
+    assert "AskUserQuestion" in disallowed
+    # The rest of the surface is untouched; headless prunes the renderer, it doesn't lobotomise the agent.
+    assert "Read" in allowed and "Bash" in allowed
+    assert "openswarm-invoke-agent" in mcp_servers
+    assert "openswarm-apps" in mcp_servers
+
+
+def test_without_headless_every_one_of_them_is_offered(monkeypatch, no_renderer):
+    monkeypatch.delenv("OPENSWARM_HEADLESS", raising=False)
+    mcp_servers, allowed, _ = p_run_the_real_pipeline()
+    assert "openswarm-browser-agent" in mcp_servers
+    assert "openswarm-ui" in mcp_servers
+    for tool in BROWSER_DELEGATION:
+        assert f"mcp__openswarm-browser-agent__{tool}" in allowed
+    for ui_tool in ("ShowUI", "AskUI"):
+        assert f"mcp__openswarm-ui__{ui_tool}" in allowed
+
+
+def test_askuserquestion_survives_when_the_ui_server_is_absent(monkeypatch):
+    # With no openswarm-ui registered nothing else denies AskUserQuestion, so this isolates the headless gate.
+    monkeypatch.delenv("OPENSWARM_HEADLESS", raising=False)
+    allowed, disallowed = build_effective_tool_lists(p_session(), {}, {}, False, [], [])
+    assert "AskUserQuestion" in allowed and "AskUserQuestion" not in disallowed
+    monkeypatch.setenv("OPENSWARM_HEADLESS", "1")
+    allowed, disallowed = build_effective_tool_lists(p_session(), {}, {}, False, [], [])
+    assert "AskUserQuestion" not in allowed and "AskUserQuestion" in disallowed
+
+
+def test_only_the_exact_flag_value_turns_headless_on(monkeypatch, no_renderer):
+    monkeypatch.setenv("OPENSWARM_HEADLESS", "0")
+    _, allowed, _ = p_run_the_real_pipeline()
+    assert "mcp__openswarm-ui__ShowUI" in allowed
+
+
+@pytest.mark.asyncio
+async def test_headless_denies_an_ask_without_ever_prompting(monkeypatch):
+    monkeypatch.setenv("OPENSWARM_HEADLESS", "1")
+    ask = AsyncMock()
+    with patch.object(workflow_approval, "request_user_approval", new=ask):
+        decision = await workflow_approval.resolve_ask(p_ctx(), "Bash", {"command": "ls"}, None)
+    assert decision.behavior == "deny"
+    assert not ask.called  # never broadcast into the void, so never a 600s park
+
+
+@pytest.mark.asyncio
+async def test_without_headless_an_ask_still_prompts(monkeypatch):
+    monkeypatch.delenv("OPENSWARM_HEADLESS", raising=False)
+    ask = AsyncMock(return_value=workflow_approval.ApprovalDecision(behavior="allow"))
+    with patch.object(workflow_approval, "request_user_approval", new=ask):
+        decision = await workflow_approval.resolve_ask(p_ctx(), "Bash", {"command": "ls"}, None)
+    assert decision.behavior == "allow"
+    assert ask.called
+
+
+@pytest.mark.asyncio
+async def test_headless_still_honors_a_remembered_allow(monkeypatch):
+    monkeypatch.setenv("OPENSWARM_HEADLESS", "1")
+    ctx = p_ctx()
+    workflow_approval.set_workflow_approval_memory(
+        ctx.session_id, decisions={"Bash": "allow"}, step_usage={}, remember=None, ask_timeout=5.0)
+    try:
+        decision = await workflow_approval.resolve_ask(ctx, "Bash", {"command": "ls"}, None)
+    finally:
+        workflow_approval.clear_workflow_approval_memory(ctx.session_id)
+    assert decision.behavior == "allow"
diff --git a/backend/tests/test_help_knowledge.py b/backend/tests/test_help_knowledge.py
new file mode 100644
index 00000000..ee8ad24f
--- /dev/null
+++ b/backend/tests/test_help_knowledge.py
@@ -0,0 +1,110 @@
+"""The help chat's knowledge feed. The invariants here are all about honesty: the facts must be
+present, the shortcuts must be the user's real ones, and the prompt must forbid guessing.
+
+A help assistant that invents a menu item is the failure mode this whole feature exists to prevent,
+so the grounding rules are pinned by test rather than trusted to survive a future prompt edit.
+"""
+
+from fastapi.testclient import TestClient
+
+from backend.apps.help.help_topics import HELP_TOPICS
+from backend.apps.help.knowledge import (
+    build_knowledge_response,
+    build_shortcuts,
+    build_system_prompt,
+    render_combo,
+)
+from backend.apps.help.known_issues import KNOWN_ISSUES
+from backend.main import app
+
+
+def test_knowledge_endpoint_serves_topics_and_issues():
+    import backend.auth as auth_mod
+
+    with TestClient(app, headers={"Authorization": f"Bearer {auth_mod.TOKEN}"}) as client:
+        res = client.get("/api/help/knowledge")
+    assert res.status_code == 200
+    body = res.json()
+    assert len(body["topics"]) == len(HELP_TOPICS)
+    assert len(body["known_issues"]) == len(KNOWN_ISSUES)
+    assert body["system_prompt"]
+    assert body["app_version"]
+
+
+def test_every_topic_is_self_contained():
+    """Kapa's rule: a chunk retrieved alone still has to make sense alone."""
+    for topic in HELP_TOPICS:
+        assert topic.id and topic.title and topic.body
+        assert topic.keywords, f"{topic.id} has no keywords, so local search can never find it"
+        assert len(topic.body) > 40, f"{topic.id} body is too thin to answer anything"
+
+
+def test_topic_ids_are_unique():
+    ids = [t.id for t in HELP_TOPICS]
+    assert len(ids) == len(set(ids))
+
+
+def test_known_issues_never_carry_a_fix_date_or_eta():
+    """Bug status is the easiest thing to lie about, so the data itself must not invite it."""
+    for issue in KNOWN_ISSUES:
+        assert issue.status in ("known", "mitigated", "fixed")
+        assert issue.detail
+        for banned in ("ETA", "next release", "soon", "will be fixed"):
+            assert banned.lower() not in issue.detail.lower()
+
+
+def test_render_combo_matches_the_platform():
+    from backend.apps.help.knowledge import IS_MAC
+
+    if IS_MAC:
+        assert render_combo("Meta+l") == "⌘L"
+        assert render_combo("Meta+Shift+d") == "⌘⇧D"
+    else:
+        assert render_combo("Meta+l") == "Ctrl+L"
+        assert render_combo("Meta+Shift+d") == "Ctrl+Shift+D"
+
+
+def test_shortcuts_use_the_users_configured_combo_not_the_default():
+    shortcuts = build_shortcuts("Meta+Shift+j", "Alt+m")
+    new_chat = next(s for s in shortcuts if s.action == "Open the new-chat composer")
+    dictation = next(s for s in shortcuts if "dictation" in s.action)
+    assert new_chat.keys == render_combo("Meta+Shift+j")
+    assert dictation.keys == render_combo("Alt+m")
+
+
+def test_dictation_falls_back_to_the_platform_default_when_unset():
+    from backend.apps.help.knowledge import dictation_default_combo
+
+    shortcuts = build_shortcuts("Meta+l", None)
+    dictation = next(s for s in shortcuts if "dictation" in s.action)
+    assert dictation.keys == render_combo(dictation_default_combo())
+
+
+def test_prompt_forbids_guessing_and_permits_not_knowing():
+    prompt = build_knowledge_response().system_prompt
+    assert "Never invent a button" in prompt
+    assert "Never invent a bug status" in prompt
+    assert "you don't know" in prompt.lower()
+    # The refusal has to be framed as acceptable, or the model treats it as a last resort.
+    assert "not a failure" in prompt
+
+
+def test_prompt_states_it_cannot_see_live_bug_reports():
+    prompt = build_knowledge_response().system_prompt
+    assert "cannot see live bug reports" in prompt
+    assert "no live view of" in prompt
+
+
+def test_prompt_carries_every_topic_and_issue():
+    prompt = build_system_prompt(build_shortcuts("Meta+l", None), "9.9.9")
+    for topic in HELP_TOPICS:
+        assert f"[{topic.id}]" in prompt
+    for issue in KNOWN_ISSUES:
+        assert f"[{issue.id}]" in prompt
+    assert "9.9.9" in prompt
+
+
+def test_prompt_stays_within_a_sane_token_budget():
+    """It rides the cached prefix, but an unbounded knowledge blob still costs a cache write."""
+    prompt = build_knowledge_response().system_prompt
+    assert len(prompt) < 24_000, "help knowledge is growing past its budget; tighten the topics"
diff --git a/backend/tests/test_html_to_text.py b/backend/tests/test_html_to_text.py
new file mode 100644
index 00000000..e2738032
--- /dev/null
+++ b/backend/tests/test_html_to_text.py
@@ -0,0 +1,102 @@
+"""The extraction ladder, pinned against the failures that motivated it.
+
+`favor_precision=True` disables trafilatura's own rescue, so on real pages
+(allrecipes, Spiegel) it returned NOTHING and we shipped the regex strip's nav
+soup instead of the article. Flipping the flag off is not the fix either: on
+The Verge the plain call collapses to 441 chars where precision finds 6,602.
+Hence a ladder that keeps whichever rung found the most text.
+"""
+
+import pytest
+
+import backend.apps.agents.tools.fetch.html_to_text as HT
+from backend.apps.agents.tools.fetch.html_to_text import (
+    MIN_EXTRACT_CHARS,
+    THIN_EXTRACT_CHARS,
+    html_to_text,
+)
+
+
+def p_stub(monkeypatch, plain: str, precise: str, baseline: str = "", html2txt: str = ""):
+    def p_extract(raw_html, *, favor_precision):
+        return precise if favor_precision else plain
+    monkeypatch.setattr(HT, "p_trafilatura_extract", p_extract)
+
+    def p_floor(raw_html, fn_name):
+        return baseline if fn_name == "baseline" else html2txt
+    monkeypatch.setattr(HT, "p_trafilatura_floor", p_floor)
+
+
+def test_full_plain_extraction_never_pays_for_a_second_pass(monkeypatch):
+    calls = []
+
+    def p_extract(raw_html, *, favor_precision):
+        calls.append(favor_precision)
+        return "x" * (THIN_EXTRACT_CHARS + 10)
+    monkeypatch.setattr(HT, "p_trafilatura_extract", p_extract)
+    out = html_to_text("<html></html>")
+    assert len(out) == THIN_EXTRACT_CHARS + 10
+    assert calls == [False], "a healthy extraction must not trigger the precision pass"
+
+
+def test_thin_plain_falls_to_precision(monkeypatch):
+    """The Verge case: default recall collapses, precision finds the article."""
+    p_stub(monkeypatch, plain="short", precise="y" * 6000)
+    assert len(html_to_text("<html></html>")) == 6000
+
+
+def test_precision_returning_nothing_falls_to_baseline(monkeypatch):
+    """The allrecipes case: precision extracted nothing at all."""
+    p_stub(monkeypatch, plain="", precise="", baseline="b" * 5000)
+    assert len(html_to_text("<html></html>")) == 5000
+
+
+def test_ladder_keeps_the_fullest_rung(monkeypatch):
+    p_stub(monkeypatch, plain="a" * 300, precise="b" * 200, baseline="c" * 100)
+    assert html_to_text("<html></html>") == "a" * 300
+
+
+def test_everything_empty_falls_back_to_regex_strip(monkeypatch):
+    p_stub(monkeypatch, plain="", precise="", baseline="", html2txt="")
+    out = html_to_text("<html><body><p>hello &amp; goodbye</p></body></html>")
+    assert "hello & goodbye" in out
+
+
+def test_html2txt_only_rescues_a_truly_empty_read(monkeypatch):
+    p_stub(monkeypatch, plain="", precise="", baseline="", html2txt="z" * 400)
+    assert len(html_to_text("<html></html>")) == 400
+    p_stub(monkeypatch, plain="q" * (MIN_EXTRACT_CHARS + 1), precise="", baseline="", html2txt="z" * 400)
+    assert html_to_text("<html></html>") == "q" * (MIN_EXTRACT_CHARS + 1)
+
+
+def test_extractor_exception_degrades_instead_of_raising(monkeypatch):
+    def p_boom(raw_html, *, favor_precision):
+        raise ValueError("lxml exploded")
+    monkeypatch.setattr(HT, "p_trafilatura_extract", p_boom)
+    with pytest.raises(ValueError):
+        p_boom("", favor_precision=False)
+    # Through the real wrapper the same failure is swallowed and the floor answers.
+    monkeypatch.undo()
+    out = html_to_text("<html><body><p>" + "words " * 100 + "</p></body></html>")
+    assert "words" in out
+
+
+@pytest.mark.parametrize("markup,needle", [
+    ("<html><body><article><p>" + "Real body text. " * 60 + "</p></article></body></html>", "Real body text"),
+    ("<html><body><main><p>" + "Docs paragraph. " * 60 + "</p></main></body></html>", "Docs paragraph"),
+])
+def test_real_trafilatura_extracts_article_bodies(markup, needle):
+    """No mocks: the shipped library on the shipped call must find an article body."""
+    assert needle in html_to_text(markup)
+
+
+def test_real_trafilatura_drops_nav_chrome():
+    markup = (
+        "<html><body><nav>Home About Careers Privacy Policy Sign in</nav>"
+        "<article><p>" + "The measured content sentence. " * 40 + "</p></article>"
+        "<footer>Copyright Terms of Use Cookie Settings</footer></body></html>"
+    )
+    out = html_to_text(markup)
+    assert "measured content sentence" in out
+    assert "Cookie Settings" not in out
+    assert "Careers" not in out
diff --git a/backend/tests/test_keyless_race.py b/backend/tests/test_keyless_race.py
new file mode 100644
index 00000000..9d65ba95
--- /dev/null
+++ b/backend/tests/test_keyless_race.py
@@ -0,0 +1,228 @@
+"""The free engines race; a dead one must not stand between the user and an answer.
+
+The bug these pin is a cold-start bug, so it hides from any average taken over a
+long-lived process. Measured on a fresh backend against a DuckDuckGo that had
+stopped answering TCP: q1 8,812ms, q2 8,825ms, q3 8,934ms, then 585ms. Breaker
+state is per-process and the desktop app starts a backend on every launch, so
+every user's first three searches after opening the app paid full price to
+rediscover what the last process already knew.
+"""
+
+import asyncio
+
+import pytest
+
+from backend.apps.web.keyless_race import KeylessEngine, race_keyless
+from backend.apps.web.tier_breaker import (
+    FIRST_COOLDOWN_SECONDS,
+    reset_tier_health,
+    tier_cooldown_left,
+)
+
+
+@pytest.fixture(autouse=True)
+def p_clean():
+    reset_tier_health()
+    yield
+    reset_tier_health()
+
+
+def p_engine(name, fn):
+    return KeylessEngine(name=name, run=fn)
+
+
+def p_answers(name, after=0.0, calls=None):
+    async def run():
+        if calls is not None:
+            calls.append(name)
+        if after:
+            await asyncio.sleep(after)
+        return {"backend": name}
+    return run
+
+
+def p_silent(name, calls=None):
+    async def run():
+        if calls is not None:
+            calls.append(name)
+        await asyncio.sleep(30)
+    return run
+
+
+def p_raises(name, calls=None):
+    async def run():
+        if calls is not None:
+            calls.append(name)
+        raise RuntimeError(f"{name} served its bot challenge")
+    return run
+
+
+def p_empty(name, calls=None):
+    async def run():
+        if calls is not None:
+            calls.append(name)
+        return None
+    return run
+
+
+@pytest.mark.asyncio
+async def test_healthy_leader_wins_alone_and_sends_no_extra_traffic():
+    """The whole cost case for racing rests on this: a healthy engine must not double our requests."""
+    calls = []
+    out = await race_keyless(
+        [p_engine("ddg", p_answers("ddg", 0.01, calls)),
+         p_engine("startpage", p_answers("startpage", 0.01, calls))],
+        budget=5.0, hedge_after=0.3,
+    )
+    assert out.result == {"backend": "ddg"}
+    assert calls == ["ddg"], "the second engine must not be dispatched when the first is fast"
+
+
+@pytest.mark.asyncio
+async def test_a_silent_leader_costs_the_hedge_not_the_budget():
+    """This is the cold-start fix: a blackholed engine used to cost its full 8s tier budget."""
+    loop = asyncio.get_running_loop()
+    t0 = loop.time()
+    out = await race_keyless(
+        [p_engine("ddg", p_silent("ddg")),
+         p_engine("startpage", p_answers("startpage", 0.01))],
+        budget=5.0, hedge_after=0.3,
+    )
+    elapsed = loop.time() - t0
+    assert out.result == {"backend": "startpage"}
+    assert elapsed < 1.0, f"a dead leader should cost about the hedge delay, took {elapsed:.2f}s"
+
+
+@pytest.mark.asyncio
+async def test_a_fast_failure_starts_the_next_engine_immediately():
+    """An engine that refuses outright should not make us wait out the hedge as well."""
+    loop = asyncio.get_running_loop()
+    t0 = loop.time()
+    out = await race_keyless(
+        [p_engine("ddg", p_raises("ddg")),
+         p_engine("startpage", p_answers("startpage", 0.01))],
+        budget=5.0, hedge_after=2.0,
+    )
+    assert out.result == {"backend": "startpage"}
+    assert loop.time() - t0 < 1.0
+    assert any("bot challenge" in e for e in out.errors)
+
+
+@pytest.mark.asyncio
+async def test_silence_shuts_the_engine_after_one_query():
+    """One conclusive silence, not three, so the tax is one slow search rather than three."""
+    await race_keyless(
+        [p_engine("ddg", p_silent("ddg")),
+         p_engine("startpage", p_answers("startpage", 0.01))],
+        budget=5.0, hedge_after=0.3,
+    )
+    assert tier_cooldown_left("ddg") > 0
+    assert tier_cooldown_left("startpage") == 0.0
+
+
+@pytest.mark.asyncio
+async def test_a_cooling_engine_is_not_dispatched_at_all():
+    calls = []
+    for _ in range(2):
+        await race_keyless(
+            [p_engine("ddg", p_silent("ddg", calls)),
+             p_engine("startpage", p_answers("startpage", 0.01, calls))],
+            budget=5.0, hedge_after=0.3,
+        )
+    assert calls.count("ddg") == 1, "the second query must not re-probe a conclusively dead engine"
+    out = await race_keyless(
+        [p_engine("ddg", p_silent("ddg", calls)),
+         p_engine("startpage", p_answers("startpage", 0.01, calls))],
+        budget=5.0, hedge_after=0.3,
+    )
+    assert any("skipped, still failing" in e for e in out.errors)
+
+
+@pytest.mark.asyncio
+async def test_a_recovered_engine_is_used_again(monkeypatch):
+    """The fix must not quietly blacklist an engine that comes back."""
+    import backend.apps.web.tier_breaker as TB
+    calls = []
+    await race_keyless(
+        [p_engine("ddg", p_silent("ddg", calls)),
+         p_engine("startpage", p_answers("startpage", 0.01, calls))],
+        budget=5.0, hedge_after=0.3,
+    )
+    assert tier_cooldown_left("ddg") > 0
+
+    # Jump past the cooldown rather than sleep through it.
+    real_monotonic = TB.time.monotonic
+    monkeypatch.setattr(TB.time, "monotonic",
+                        lambda: real_monotonic() + FIRST_COOLDOWN_SECONDS + 1)
+    calls.clear()
+    out = await race_keyless(
+        [p_engine("ddg", p_answers("ddg", 0.01, calls)),
+         p_engine("startpage", p_answers("startpage", 0.01, calls))],
+        budget=5.0, hedge_after=0.3,
+    )
+    assert out.result == {"backend": "ddg"}, "a healthy engine must be used again after the cooldown"
+    assert tier_cooldown_left("ddg") == 0.0
+
+
+@pytest.mark.asyncio
+async def test_both_empty_reports_no_hits_not_a_failure():
+    """A nonsense query must not slowly cool down two perfectly healthy engines."""
+    for _ in range(5):
+        out = await race_keyless(
+            [p_engine("ddg", p_empty("ddg")), p_engine("startpage", p_empty("startpage"))],
+            budget=5.0, hedge_after=0.3,
+        )
+        assert out.result is None
+    assert tier_cooldown_left("ddg") == 0.0
+    assert tier_cooldown_left("startpage") == 0.0
+
+
+@pytest.mark.asyncio
+async def test_an_empty_leader_still_lets_the_other_answer():
+    out = await race_keyless(
+        [p_engine("ddg", p_empty("ddg")),
+         p_engine("startpage", p_answers("startpage", 0.01))],
+        budget=5.0, hedge_after=2.0,
+    )
+    assert out.result == {"backend": "startpage"}
+
+
+@pytest.mark.asyncio
+async def test_every_engine_closed_returns_honestly():
+    out = await race_keyless(
+        [p_engine("ddg", p_raises("ddg")), p_engine("startpage", p_raises("startpage"))],
+        budget=5.0, hedge_after=0.3,
+    )
+    assert out.result is None
+    assert len(out.errors) == 2
+
+
+@pytest.mark.asyncio
+async def test_budget_bounds_the_whole_race():
+    loop = asyncio.get_running_loop()
+    t0 = loop.time()
+    out = await race_keyless(
+        [p_engine("ddg", p_silent("ddg")), p_engine("startpage", p_silent("startpage"))],
+        budget=0.6, hedge_after=0.2,
+    )
+    assert out.result is None
+    assert loop.time() - t0 < 2.0
+
+
+@pytest.mark.asyncio
+async def test_losing_engines_do_not_outlive_the_race():
+    """A cancelled request must not keep running and surprise the user's network later."""
+    live = {"n": 0}
+
+    async def clingy():
+        live["n"] += 1
+        try:
+            await asyncio.sleep(30)
+        finally:
+            live["n"] -= 1
+
+    await race_keyless(
+        [p_engine("ddg", clingy), p_engine("startpage", p_answers("startpage", 0.01))],
+        budget=5.0, hedge_after=0.2,
+    )
+    assert live["n"] == 0
diff --git a/backend/tests/test_mid_turn_message_queue.py b/backend/tests/test_mid_turn_message_queue.py
new file mode 100644
index 00000000..59a782fb
--- /dev/null
+++ b/backend/tests/test_mid_turn_message_queue.py
@@ -0,0 +1,97 @@
+"""A message typed while a turn is live must never vanish. send_message used to
+early-return when the session's task was still running, dropping the prompt with
+no bubble and no trace. It now queues the full send, and the turn task's done
+callback replays it the moment the agent is free.
+
+Run with:  backend/.venv/bin/python -m pytest backend/tests/test_mid_turn_message_queue.py
+"""
+import asyncio
+
+import pytest
+
+from backend.apps.agents import agent_manager as am
+from backend.apps.agents.core.models import AgentSession
+import backend.apps.agents.core.ws_manager as ws_mod
+
+
+@pytest.fixture(autouse=True)
+def p_quiet_ws(monkeypatch):
+    async def fake_send(session_id, event, data):
+        return None
+    monkeypatch.setattr(ws_mod.ws_manager, "send_to_session", fake_send, raising=True)
+
+
+def p_manager(monkeypatch, ran, gate):
+    mgr = am.AgentManager()
+    session = AgentSession(name="t", model="sonnet")
+    mgr.sessions[session.id] = session
+
+    async def fake_loop(session_id, prompt, **kwargs):
+        ran.append(prompt)
+        await gate.wait()
+
+    async def fake_label(*a, **k):
+        return None
+
+    monkeypatch.setattr(mgr, "run_agent_loop", fake_loop)
+    monkeypatch.setattr(mgr, "generate_turn_label", fake_label)
+    from backend.apps.agents.browser import browser_fast_path
+    monkeypatch.setattr(browser_fast_path, "fast_path_eligible", lambda *a, **k: False)
+    return mgr, session
+
+
+@pytest.mark.asyncio
+async def test_mid_turn_message_is_queued_then_replayed(monkeypatch):
+    ran = []
+    gate = asyncio.Event()
+    mgr, session = p_manager(monkeypatch, ran, gate)
+
+    await mgr.send_message(session.id, "first", client_message_id="c1")
+    await asyncio.sleep(0)  # let the created turn task actually start
+    assert ran == ["first"]
+
+    await mgr.send_message(session.id, "second", client_message_id="c2")
+    # Queued, not dropped; not yet appended either (the running CLI turn can't see it anyway).
+    assert [q.prompt for q in mgr.pending_messages[session.id]] == ["second"]
+    assert [m.content for m in session.messages if m.role == "user"] == ["first"]
+
+    gate.set()
+    await mgr.tasks[session.id]
+    for _ in range(50):
+        if len(ran) == 2:
+            break
+        await asyncio.sleep(0.01)
+
+    assert ran == ["first", "second"]
+    user_msgs = [m for m in session.messages if m.role == "user"]
+    assert [m.content for m in user_msgs] == ["first", "second"]
+    # The original client id round-trips, so the UI's pending optimistic bubble reconciles.
+    assert user_msgs[1].client_message_id == "c2"
+    assert session.id not in mgr.pending_messages
+
+
+@pytest.mark.asyncio
+async def test_multiple_queued_messages_replay_in_order(monkeypatch):
+    ran = []
+    p_first_gate = asyncio.Event()
+    mgr, session = p_manager(monkeypatch, ran, p_first_gate)
+
+    async def p_fast_loop(session_id, prompt, **kwargs):
+        ran.append(prompt)
+
+    await mgr.send_message(session.id, "one")  # blocks on p_first_gate
+    await asyncio.sleep(0)
+    monkeypatch.setattr(mgr, "run_agent_loop", p_fast_loop)
+    await mgr.send_message(session.id, "two")
+    await mgr.send_message(session.id, "three")
+    assert [q.prompt for q in mgr.pending_messages[session.id]] == ["two", "three"]
+
+    p_first_gate.set()
+    await mgr.tasks[session.id]
+    for _ in range(50):
+        if len(ran) == 3:
+            break
+        await asyncio.sleep(0.01)
+
+    assert ran == ["one", "two", "three"]
+    assert session.id not in mgr.pending_messages
diff --git a/backend/tests/test_outputs_executor_sandbox.py b/backend/tests/test_outputs_executor_sandbox.py
new file mode 100644
index 00000000..118bc04a
--- /dev/null
+++ b/backend/tests/test_outputs_executor_sandbox.py
@@ -0,0 +1,178 @@
+"""Sandbox escape in the Output backend-code executor (issue #134).
+
+The gate only ever looked at import statements and calls to a bare builtin
+name, while the subprocess preamble handed user code live `sys`, `io` and
+`builtins`. `sys.modules['os']` therefore scanned clean, and clean means the
+`/api/outputs/execute` auto-run path with no consent prompt. Live before the
+fix: arbitrary file read, arbitrary file write, and `os.system`, all with
+`AST warnings: []`.
+
+The payloads below are the class, not the one string: bare handles, attribute
+chains that land on a module, dunder traversal, `getattr` indirection, and
+aliasing. The legit block underneath is the other half of the bar; a gate that
+warns about `datetime.time` would just train users to click through.
+
+Run:
+    backend/.venv/bin/python -m pytest backend/tests/test_outputs_executor_sandbox.py -v
+"""
+
+import asyncio
+import os
+from typing import Any
+
+import pytest
+
+from backend.apps.outputs import executor
+from backend.apps.outputs.code_safety import UnsafeCodeError, get_code_warnings
+from backend.apps.outputs.executor import execute_backend_code, exec_env
+
+
+def p_run(coro: Any) -> Any:
+    return asyncio.new_event_loop().run_until_complete(coro)
+
+
+P_ESCAPES = [
+    # The reported exploit, verbatim.
+    "result = {'escaped': sys.modules['os'].getcwd(), 'uid': sys.modules['os'].getuid()}",
+    # The other two handles the preamble left lying around.
+    "result = {'x': str(io.open)}",
+    "result = {'b': str(builtins.__dict__)}",
+    # Attribute chains that land on a module the allowlist withholds.
+    "result = {'c': str(json.codecs)}",
+    "import random\nresult = {'cwd': random._os.getcwd()}",
+    "import collections\nresult = {'m': str(collections._sys.modules)}",
+    "import hashlib\nresult = {'h': str(hashlib._hashlib)}",
+    "import base64\nresult = {'s': str(base64.struct)}",
+    "from json import codecs\nresult = {'c': str(codecs)}",
+    # Aliasing the module first.
+    "m = json\nresult = {'c': str(m.codecs)}",
+    # Dunder traversal.
+    "result = {'n': len(().__class__.__bases__[0].__subclasses__())}",
+    "f = lambda: 0\nresult = {'g': str(f.__globals__)}",
+    "result = {'i': str(__import__('os'))}",
+    # exec/eval/compile survive in the subprocess (the import machinery needs them), so the gate is the only thing standing here.
+    "exec('import os')\nresult = {}",
+    "result = {'e': eval('__import__(\"os\").getcwd()')}",
+    "result = {'f': open('/etc/hosts').read()}",
+    # getattr indirection, literal and computed.
+    "result = {'c': str(getattr(json, 'codecs'))}",
+    "n = 'codecs'\nresult = {'c': str(getattr(json, n))}",
+    "result = {'c': str(getattr((), '__class__'))}",
+    # Namespace grabs.
+    "result = {'g': str(globals())}",
+    "result = {'v': str(vars())}",
+    "result = {'l': str(locals())}",
+]
+
+P_LEGIT = [
+    'import math, json\nresult = {"a": math.floor(1.9), "b": json.dumps([1, 2])}',
+    # datetime.time is a CLASS, not the `time` module: a name-matching gate would flag it.
+    'import datetime\nresult = {"t": datetime.time(12, 0).isoformat()}',
+    'import collections\nresult = {"c": dict(collections.Counter("aab"))}',
+    'import collections.abc\nresult = {"ok": isinstance({}, collections.abc.Mapping)}',
+    'import re\nresult = {"m": re.findall(r"\\d+", "a1b22")}',
+    'import csv\nresult = {"rows": [r for r in csv.reader("a,b\\n1,2".splitlines())]}',
+    'import statistics\nresult = {"mean": statistics.mean([1, 2, 3])}',
+    'import textwrap\nresult = {"w": textwrap.wrap("word " * 20, 10)}',
+    'import decimal\nresult = {"d": str(decimal.Decimal("1.10") + decimal.Decimal("2.20"))}',
+    'import uuid\nresult = {"u": str(uuid.uuid5(uuid.NAMESPACE_DNS, "x"))}',
+    # dataclasses and namedtuple exec their generated methods, so they prove the builtins scrub left the plumbing alone.
+    'import dataclasses\n@dataclasses.dataclass\nclass Row:\n    n: int\nresult = dataclasses.asdict(Row(1))',
+    'import collections\nPoint = collections.namedtuple("Point", "x y")\nresult = {"s": sum(Point(1, 2))}',
+    'import functools, operator\nresult = {"s": functools.reduce(operator.add, [1, 2, 3])}',
+    'from json import dumps\nresult = {"j": dumps({"a": 1})}',
+    'from math import *\nresult = {"p": floor(pi)}',
+    'if __name__ == "__main__":\n    pass\nresult = {"ok": True}',
+    'result = {"n": len(input_data), "keys": sorted(input_data)}',
+    'result = {"v": getattr(input_data, "get")("missing", 7)}',
+]
+
+
+# --- the gate must see every escape -----------------------------------------
+
+@pytest.mark.parametrize("code", P_ESCAPES)
+def test_escape_is_warned(code: str) -> None:
+    assert get_code_warnings(code), f"no warning for: {code!r}"
+
+
+@pytest.mark.parametrize("code", P_ESCAPES)
+def test_escape_is_refused_before_it_runs(code: str) -> None:
+    with pytest.raises(UnsafeCodeError):
+        p_run(execute_backend_code(code, {}))
+
+
+# --- and must stay quiet about ordinary data shaping -------------------------
+
+@pytest.mark.parametrize("code", P_LEGIT)
+def test_legit_code_is_clean(code: str) -> None:
+    assert get_code_warnings(code) == []
+
+
+@pytest.mark.parametrize("code", P_LEGIT)
+def test_legit_code_still_runs(code: str) -> None:
+    out = p_run(execute_backend_code(code, {"a": 1}))
+    assert isinstance(out.result, dict) and out.result
+
+
+def test_syntax_error_is_reported_not_raised() -> None:
+    assert get_code_warnings("result = {")[0].startswith("Syntax error")
+
+
+def test_print_output_is_still_captured() -> None:
+    out = p_run(execute_backend_code('print("hi")\nresult = {"ok": 1}', {}))
+    assert out.stdout.strip() == "hi"
+    assert out.result == {"ok": 1}
+
+
+# --- second wall: the subprocess itself, with the gate bypassed ---------------
+
+@pytest.fixture
+def gate_bypassed(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Pretend a future payload beats the static gate, and check the subprocess
+    still has nothing to grab. Defense in depth is only real if it holds alone."""
+    monkeypatch.setattr(executor, "validate_code_safety", lambda code: None)
+
+
+@pytest.mark.parametrize("handle", ["sys", "io", "builtins"])
+def test_module_handles_are_gone_from_the_subprocess(gate_bypassed: None, handle: str) -> None:
+    with pytest.raises(RuntimeError) as e:
+        p_run(execute_backend_code(f"result = {{'x': str({handle})}}", {}))
+    assert "NameError" in str(e.value)
+
+
+def test_open_builtin_is_gone_from_the_subprocess(gate_bypassed: None) -> None:
+    with pytest.raises(RuntimeError) as e:
+        p_run(execute_backend_code("result = {'x': open('/etc/hosts').read()}", {}))
+    assert "NameError" in str(e.value)
+
+
+def test_no_credentials_or_shell_reachable_when_not_approved(gate_bypassed: None, tmp_path: Any) -> None:
+    """The end-to-end version of the report: read HOME, then shell out."""
+    marker = tmp_path / "pwned.txt"
+    code = (
+        "os_mod = sys.modules['os']\n"
+        f"result = {{'home': os_mod.environ.get('HOME'), 'rc': os_mod.system('echo x > {marker}')}}"
+    )
+    with pytest.raises(RuntimeError):
+        p_run(execute_backend_code(code, {}))
+    assert not marker.exists()
+
+
+def test_sandboxed_env_carries_no_path_or_home() -> None:
+    env = exec_env(approved=False)
+    assert "PATH" not in env and "HOME" not in env
+
+
+def test_approved_env_inherits_but_scrubs_credentials(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-ant-should-not-leak")
+    monkeypatch.setenv("OPENSWARM_AUTH_TOKEN", "should-not-leak")
+    env = exec_env(approved=True)
+    assert env.get("PATH") == os.environ.get("PATH")
+    assert "ANTHROPIC_API_KEY" not in env and "OPENSWARM_AUTH_TOKEN" not in env
+
+
+def test_approved_run_still_gets_its_escape_hatch() -> None:
+    """The HITL "Run Anyway" path must keep working, or the fix just breaks the
+    feature instead of securing it."""
+    out = p_run(execute_backend_code("import os\nresult = {'sep': os.sep}", {}, approved=True))
+    assert out.result == {"sep": os.sep}
diff --git a/backend/tests/test_recover_orphaned_apps.py b/backend/tests/test_recover_orphaned_apps.py
new file mode 100644
index 00000000..e49dca86
--- /dev/null
+++ b/backend/tests/test_recover_orphaned_apps.py
@@ -0,0 +1,145 @@
+"""An app whose record vanished but whose work survived must come back.
+
+An app is a record plus a workspace folder. Lose the record and the work sits on disk completely
+invisible, with no way for the user to even know it is there. Measured on a real packaged store:
+2 apps with genuine work ("Calculator", a 235-line rewrite of the template; "Voxelcraft", a
+hand-written game.js) had no record.
+
+The hard part is NOT recovering. It is refusing to recover the other 6, which were template seeds
+minted seconds apart by a page that has since been deleted and never touched again. Bringing those
+back would hand every user a pile of empty cards, which is a worse product than the bug.
+
+Run:
+    cd backend && .venv/bin/python -m pytest tests/test_recover_orphaned_apps.py -v
+"""
+
+from __future__ import annotations
+
+import json
+import os
+
+import pytest
+
+
+@pytest.fixture
+def p_store(tmp_path, monkeypatch):
+    """A data root with a workspace dir, isolated from the real store."""
+    root = tmp_path / "data"
+    ws = root / "outputs_workspace"
+    out = root / "outputs"
+    ws.mkdir(parents=True)
+    out.mkdir(parents=True)
+    import backend.apps.outputs.recover_orphaned_apps as mod
+    import backend.apps.outputs.workspace_io as wio
+    monkeypatch.setattr(mod, "OUTPUTS_WORKSPACE_DIR", str(ws))
+    monkeypatch.setattr(mod, "P_MARKER", str(root / "orphan_app_recovery.done"))
+    monkeypatch.setattr(wio, "OUTPUTS_WORKSPACE_DIR", str(ws), raising=False)
+    monkeypatch.setattr(wio, "DATA_DIR", str(out), raising=False)
+    return {"root": root, "ws": ws, "out": out, "mod": mod, "wio": wio}
+
+
+def p_workspace(p_store, wid: str, name=None, description="") -> str:
+    d = p_store["ws"] / wid
+    d.mkdir()
+    (d / "index.html").write_text("<html></html>")
+    if name is not None:
+        (d / "meta.json").write_text(json.dumps({"name": name, "description": description}))
+    return wid
+
+
+def p_names(p_store):
+    return sorted(o.name for o in p_store["wio"].load_all())
+
+
+def test_an_app_with_real_work_comes_back(p_store):
+    p_workspace(p_store, "ws-calc", name="Calculator", description="does sums")
+
+    report = p_store["mod"].recover_orphaned_apps()
+
+    assert report.recovered == ["Calculator"]
+    assert p_names(p_store) == ["Calculator"]
+    restored = p_store["wio"].load_all()[0]
+    assert restored.workspace_id == "ws-calc"
+    assert restored.description == "does sums", "the app's own meta.json is the source of truth"
+
+
+def test_an_unused_template_seed_stays_buried(p_store):
+    """THE constraint. 6 of 8 real orphans were these; resurrecting them is worse than the bug."""
+    p_workspace(p_store, "ws-seed", name="Untitled App")
+
+    report = p_store["mod"].recover_orphaned_apps()
+
+    assert report.recovered == []
+    assert report.skipped_unused == 1
+    assert p_names(p_store) == []
+
+
+def test_a_workspace_with_no_meta_stays_buried(p_store):
+    p_workspace(p_store, "ws-bare", name=None)
+    report = p_store["mod"].recover_orphaned_apps()
+    assert report.recovered == []
+    assert report.skipped_unused == 1
+
+
+def test_the_real_mix_recovers_exactly_the_two(p_store):
+    """The packaged store as measured: 3 named 'Untitled App', 3 with no meta, 2 real."""
+    for i in range(3):
+        p_workspace(p_store, f"ws-seed{i}", name="Untitled App")
+    for i in range(3):
+        p_workspace(p_store, f"ws-bare{i}", name=None)
+    p_workspace(p_store, "ws-calc", name="Calculator")
+    p_workspace(p_store, "ws-voxel", name="Voxelcraft")
+
+    report = p_store["mod"].recover_orphaned_apps()
+
+    assert sorted(report.recovered) == ["Calculator", "Voxelcraft"]
+    assert report.skipped_unused == 6
+
+
+def test_a_workspace_that_still_has_a_record_is_left_alone(p_store):
+    from backend.apps.outputs.models import Output
+    p_workspace(p_store, "ws-live", name="Live App")
+    p_store["wio"].save(Output(name="Live App", workspace_id="ws-live"))
+
+    report = p_store["mod"].recover_orphaned_apps()
+
+    assert report.recovered == []
+    assert p_names(p_store) == ["Live App"], "must not create a duplicate record"
+
+
+def test_it_runs_only_once(p_store):
+    """Deleting an app leaves its workspace behind, so a recovery that ran every boot would make
+    deletion impossible: the app would be back the next morning."""
+    p_workspace(p_store, "ws-calc", name="Calculator")
+    assert p_store["mod"].recover_orphaned_apps().recovered == ["Calculator"]
+
+    for o in p_store["wio"].load_all():
+        os.remove(os.path.join(str(p_store["out"]), f"{o.id}.json"))
+
+    assert p_store["mod"].recover_orphaned_apps().recovered == []
+    assert p_names(p_store) == [], "the user deleted it; it must stay deleted"
+
+
+def test_force_overrides_the_marker(p_store):
+    p_workspace(p_store, "ws-calc", name="Calculator")
+    p_store["mod"].recover_orphaned_apps()
+    for o in p_store["wio"].load_all():
+        os.remove(os.path.join(str(p_store["out"]), f"{o.id}.json"))
+
+    assert p_store["mod"].recover_orphaned_apps(force=True).recovered == ["Calculator"]
+
+
+def test_a_blank_name_counts_as_unused(p_store):
+    p_workspace(p_store, "ws-blank", name="   ")
+    assert p_store["mod"].recover_orphaned_apps().skipped_unused == 1
+
+
+def test_unparseable_meta_does_not_break_the_sweep(p_store):
+    d = p_store["ws"] / "ws-broken"
+    d.mkdir()
+    (d / "meta.json").write_text("{not json")
+    p_workspace(p_store, "ws-calc", name="Calculator")
+
+    report = p_store["mod"].recover_orphaned_apps()
+
+    assert report.recovered == ["Calculator"], "one bad workspace must not strand the rest"
diff --git a/backend/tests/test_reference_integrity.py b/backend/tests/test_reference_integrity.py
new file mode 100644
index 00000000..4414a074
--- /dev/null
+++ b/backend/tests/test_reference_integrity.py
@@ -0,0 +1,173 @@
+"""Referential integrity for workflows: no transcript outlives a hard delete, no pointer outlives
+its session.
+
+Two failures of the same class, both seen live:
+  - Purge removed the workflow and its runs and left the chat transcripts on disk forever. The user
+    asked for an irreversible delete and the conversation survived it.
+  - 0 of 5 workflow chat pointers resolved in the real packaged store, so the UI read a pointer,
+    got nothing, and rendered a blank panel instead of an empty state.
+
+The last test here is the one that matters most: it pins OWNED_SESSION_FIELDS against the model, so
+adding a fourth sticky session pointer and forgetting to clean it up fails CI instead of quietly
+leaking a transcript six months from now.
+
+Run:
+    cd backend && .venv/bin/python -m pytest tests/test_reference_integrity.py -v
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from backend.apps.workflows import storage
+from backend.apps.workflows.models import Workflow
+from backend.apps.workflows.owned_sessions import (
+    OWNED_SESSION_FIELDS,
+    REFERENCED_SESSION_FIELDS,
+    owned_session_ids,
+    purge_owned_sessions,
+    retire_previous_test_session,
+)
+from backend.apps.workflows.reconcile_references import reconcile_workflow_sessions
+
+
+@pytest.fixture(autouse=True)
+def p_wf_env(isolated_workflows_data, reset_scheduler_state, tmp_path, monkeypatch):
+    # isolated_workflows_data isolates workflows but NOT sessions, so without this the fixture
+    # transcripts below land in the developer's real backend/data/sessions and stay there.
+    import backend.apps.agents.manager.session.session_store as store
+    sessions = tmp_path / "sessions"
+    sessions.mkdir()
+    monkeypatch.setattr(store, "sessions_dir", lambda: str(sessions))
+    yield
+
+
+def p_session_on_disk(sid: str) -> None:
+    from backend.apps.agents.manager.session.session_store import save_session
+    save_session(sid, {"id": sid, "name": "t", "messages": []})
+
+
+def p_session_exists(sid: str) -> bool:
+    from backend.apps.agents.manager.session.session_store import load_session_data
+    return load_session_data(sid) is not None
+
+
+def test_owned_ids_collects_every_owned_pointer(make_wf):
+    wf = make_wf(
+        edit_agent_session_id="s-edit",
+        schedule_agent_session_id="s-sched",
+        last_test_session_id="s-test",
+    )
+    assert sorted(owned_session_ids(wf)) == ["s-edit", "s-sched", "s-test"]
+
+
+def test_the_originating_chat_is_never_owned(make_wf):
+    """source_session_id is the user's own chat that the workflow was generated from. Deleting it
+    on purge would destroy a real conversation nobody asked to lose."""
+    wf = make_wf(source_session_id="s-users-own-chat")
+    assert owned_session_ids(wf) == []
+
+
+@pytest.mark.asyncio
+async def test_purge_takes_the_transcripts_with_it(make_wf):
+    wf = make_wf(edit_agent_session_id="s-edit", last_test_session_id="s-test")
+    for sid in ("s-edit", "s-test"):
+        p_session_on_disk(sid)
+    assert p_session_exists("s-edit")
+
+    removed = await purge_owned_sessions(wf)
+
+    assert removed == 2
+    assert not p_session_exists("s-edit"), "a hard delete must not leave the conversation behind"
+    assert not p_session_exists("s-test")
+
+
+@pytest.mark.asyncio
+async def test_purge_spares_the_originating_chat(make_wf):
+    wf = make_wf(edit_agent_session_id="s-edit", source_session_id="s-users-own-chat")
+    p_session_on_disk("s-edit")
+    p_session_on_disk("s-users-own-chat")
+
+    await purge_owned_sessions(wf)
+
+    assert not p_session_exists("s-edit")
+    assert p_session_exists("s-users-own-chat"), "the user's own chat outlives the workflow"
+
+
+@pytest.mark.asyncio
+async def test_a_second_test_run_retires_the_first(make_wf):
+    """Live: building one workflow ran five tests and left five orphan cards on the canvas. Each new
+    test overwrites last_test_session_id, so the displaced chat had no pointer left and would have
+    survived a hard delete of the workflow."""
+    wf = make_wf(last_test_session_id="s-test-1")
+    p_session_on_disk("s-test-1")
+
+    await retire_previous_test_session(wf)
+
+    assert wf.last_test_session_id is None
+    assert not p_session_exists("s-test-1"), "the displaced test chat must not outlive its pointer"
+
+
+@pytest.mark.asyncio
+async def test_retiring_with_no_previous_test_is_a_no_op(make_wf):
+    """The discriminating half: the first test of a workflow must not try to drop anything."""
+    wf = make_wf(edit_agent_session_id="s-edit")
+    p_session_on_disk("s-edit")
+
+    await retire_previous_test_session(wf)
+
+    assert p_session_exists("s-edit"), "retiring a test must never touch the edit chat"
+
+
+def test_reconcile_nulls_a_pointer_whose_session_is_gone(make_wf):
+    wf = make_wf(edit_agent_session_id="s-vanished")
+    storage.save_workflow(wf)
+
+    report = reconcile_workflow_sessions()
+
+    assert report.pointers_cleared == 1
+    assert report.workflows_scanned == 1
+    assert storage.get_workflow(wf.id).edit_agent_session_id is None
+
+
+def test_reconcile_leaves_a_live_pointer_alone(make_wf):
+    """The discriminating half. A sweep that nulls everything would destroy working history."""
+    p_session_on_disk("s-alive")
+    wf = make_wf(edit_agent_session_id="s-alive")
+    storage.save_workflow(wf)
+
+    report = reconcile_workflow_sessions()
+
+    assert report.pointers_cleared == 0
+    assert storage.get_workflow(wf.id).edit_agent_session_id == "s-alive"
+
+
+def test_reconcile_covers_trashed_workflows(make_wf):
+    """Otherwise restoring from Trash hands back a pointer that already dangles."""
+    from datetime import datetime
+    wf = make_wf(edit_agent_session_id="s-vanished", deleted_at=datetime.now())
+    storage.save_workflow(wf)
+
+    reconcile_workflow_sessions()
+
+    assert storage.get_workflow(wf.id).edit_agent_session_id is None
+
+
+def test_reconcile_is_idempotent(make_wf):
+    wf = make_wf(edit_agent_session_id="s-vanished")
+    storage.save_workflow(wf)
+    reconcile_workflow_sessions()
+    assert reconcile_workflow_sessions().pointers_cleared == 0
+
+
+def test_every_session_pointer_on_the_model_is_classified():
+    """THE seal on this bug class. Any new *_session_id field on Workflow must be declared either
+    owned (purged with the workflow) or referenced (spared). Forgetting leaks a transcript past a
+    hard delete, and this fails loudly instead of letting that ship."""
+    declared = set(OWNED_SESSION_FIELDS) | set(REFERENCED_SESSION_FIELDS)
+    on_model = {f for f in Workflow.model_fields if f.endswith("_session_id")}
+    missing = on_model - declared
+    assert not missing, (
+        f"{sorted(missing)} is a session pointer nobody classified. Add it to OWNED_SESSION_FIELDS "
+        f"(deleted with the workflow) or REFERENCED_SESSION_FIELDS (survives it)."
+    )
diff --git a/backend/tests/test_result_message.py b/backend/tests/test_result_message.py
index 916ab2a4..44ecad4d 100644
--- a/backend/tests/test_result_message.py
+++ b/backend/tests/test_result_message.py
@@ -57,6 +57,50 @@ async def test_free_route_zeroes_cost():
     assert session.cost_usd == 0.0  # cc/ is a subscription (server-funded) route, never billed per-token
 
 
+@pytest.mark.asyncio
+async def test_error_shaped_result_raises_after_accounting():
+    # is_error / error_* subtype used to be consumed as a normal end-of-turn (silent success).
+    session, turn, thinking = p_fixt()
+    m = ResultMessage(subtype="error_during_execution", duration_ms=100, duration_api_ms=80,
+                      is_error=True, num_turns=1, session_id="sdk-1",
+                      usage={"input_tokens": 100, "output_tokens": 50},
+                      errors=["tool crashed hard"])
+    with patch.object(result_message.ws_manager, "send_to_session", new=AsyncMock()):
+        with pytest.raises(result_message.TurnResultError) as exc:
+            await result_message.handle_result_message(
+                m, session, session.id, turn, thinking, {}, "sonnet", "anthropic", load_settings())
+    assert "tool crashed hard" in str(exc.value)
+    assert session.tokens["output"] == 50  # token accounting still lands before the raise
+
+
+@pytest.mark.asyncio
+async def test_max_tokens_and_refusal_stops_raise_even_with_success_subtype():
+    for stop_reason, phrase in (("max_tokens", "maximum output length"), ("refusal", "refused")):
+        session, turn, thinking = p_fixt()
+        m = ResultMessage(subtype="success", duration_ms=100, duration_api_ms=80,
+                          is_error=False, num_turns=1, session_id="sdk-1",
+                          usage={"input_tokens": 10, "output_tokens": 5}, stop_reason=stop_reason)
+        with patch.object(result_message.ws_manager, "send_to_session", new=AsyncMock()):
+            with pytest.raises(result_message.TurnResultError) as exc:
+                await result_message.handle_result_message(
+                    m, session, session.id, turn, thinking, {}, "sonnet", "anthropic", load_settings())
+        assert phrase in str(exc.value)
+
+
+@pytest.mark.asyncio
+async def test_success_result_never_raises():
+    # The mutation pair for the error detection: the happy path must stay a normal completion.
+    session, turn, thinking = p_fixt()
+    m = ResultMessage(subtype="success", duration_ms=100, duration_api_ms=80,
+                      is_error=False, num_turns=1, session_id="sdk-1",
+                      usage={"input_tokens": 10, "output_tokens": 5}, stop_reason="end_turn",
+                      permission_denials=[{"tool_name": "Bash"}])
+    with patch.object(result_message.ws_manager, "send_to_session", new=AsyncMock()):
+        await result_message.handle_result_message(
+            m, session, session.id, turn, thinking, {}, "sonnet", "anthropic", load_settings())
+    assert session.tokens["output"] == 5
+
+
 @pytest.mark.asyncio
 async def test_resets_per_turn_state_at_completion():
     session, turn, thinking = p_fixt()
diff --git a/backend/tests/test_router_data_dir_permissions.py b/backend/tests/test_router_data_dir_permissions.py
new file mode 100644
index 00000000..68d75271
--- /dev/null
+++ b/backend/tests/test_router_data_dir_permissions.py
@@ -0,0 +1,56 @@
+"""9Router's state dir must be owner-only.
+
+Its db.json carries live subscription access AND refresh tokens in plaintext, and 9Router writes
+that file 0644. On a shared machine every other local account could read them. We tighten the
+directory rather than the file because 9Router rewrites db.json on every token refresh, so a chmod
+on the file itself would be undone within the hour.
+
+Run:
+    cd backend && .venv/bin/python -m pytest tests/test_router_data_dir_permissions.py -v
+"""
+
+import os
+import stat
+
+import pytest
+
+import backend.apps.nine_router.process as process
+
+
+@pytest.fixture
+def p_data_dir(tmp_path, monkeypatch):
+    d = tmp_path / "9router"
+    d.mkdir()
+    monkeypatch.setenv("DATA_DIR", str(d))
+    return d
+
+
+@pytest.mark.skipif(os.name == "nt", reason="POSIX mode bits only")
+def test_group_and_world_readable_dir_is_tightened(p_data_dir):
+    os.chmod(p_data_dir, 0o755)
+    process.harden_data_dir_permissions()
+    assert stat.S_IMODE(os.stat(p_data_dir).st_mode) == 0o700
+
+
+@pytest.mark.skipif(os.name == "nt", reason="POSIX mode bits only")
+def test_tokens_are_unreadable_by_others_afterwards(p_data_dir):
+    """The property that actually matters, stated as the attacker sees it: no bit outside the owner."""
+    os.chmod(p_data_dir, 0o755)
+    (p_data_dir / "db.json").write_text('{"providerConnections":[]}')
+    process.harden_data_dir_permissions()
+    assert stat.S_IMODE(os.stat(p_data_dir).st_mode) & 0o077 == 0
+
+
+@pytest.mark.skipif(os.name == "nt", reason="POSIX mode bits only")
+def test_already_tight_dir_is_left_alone(p_data_dir):
+    os.chmod(p_data_dir, 0o700)
+    before = os.stat(p_data_dir).st_mtime_ns
+    process.harden_data_dir_permissions()
+    assert stat.S_IMODE(os.stat(p_data_dir).st_mode) == 0o700
+    assert os.stat(p_data_dir).st_mtime_ns == before
+
+
+def test_missing_dir_does_not_raise(tmp_path, monkeypatch):
+    """Runs before 9Router has ever started, so the dir legitimately may not exist yet."""
+    monkeypatch.setenv("DATA_DIR", str(tmp_path / "nope"))
+    process.harden_data_dir_permissions()
diff --git a/backend/tests/test_schedule_execution_target.py b/backend/tests/test_schedule_execution_target.py
new file mode 100644
index 00000000..5c2af802
--- /dev/null
+++ b/backend/tests/test_schedule_execution_target.py
@@ -0,0 +1,113 @@
+"""A cloud-hosted workflow's timer belongs to the server, not to this machine.
+
+The failure these guard against is a double run: if the laptop is awake when a
+cloud-hosted slot comes due, both the laptop and the server fire it, and the
+user gets two of everything. Ownership is expressed once, on
+Workflow.execution_target, and every reader of the schedule must honour it.
+
+Run:
+    cd backend && .venv/bin/python -m pytest tests/test_schedule_execution_target.py -v
+"""
+
+from __future__ import annotations
+
+import asyncio
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+
+@pytest.fixture(autouse=True)
+def p_wf_env(isolated_workflows_data, reset_scheduler_state):
+    yield
+
+
+def test_default_target_is_this_device(make_wf):
+    """Every existing workflow predates the field, so the default has to keep them local."""
+    wf = make_wf()
+    assert wf.execution_target == "device"
+
+
+@pytest.mark.asyncio
+async def test_tick_does_not_fire_a_cloud_workflow(make_wf, monkeypatch):
+    from backend.apps.workflows import storage, scheduler
+    fired: list[str] = []
+
+    async def p_capture(wf, scheduled_for=None):
+        fired.append(wf.id)
+
+    monkeypatch.setattr(scheduler, "_fire", p_capture)
+    overdue = datetime.now(timezone.utc) - timedelta(minutes=5)
+
+    local = make_wf(execution_target="device", next_run_at=overdue)
+    cloud = make_wf(execution_target="cloud", next_run_at=overdue)
+    storage.save_workflow(local)
+    storage.save_workflow(cloud)
+
+    await scheduler._tick()
+    # _tick hands each fire to create_task, so nothing has actually run until we yield the loop.
+    await asyncio.sleep(0)
+
+    assert local.id in fired, "a device workflow must still fire; the test is vacuous otherwise"
+    assert cloud.id not in fired
+
+
+@pytest.mark.asyncio
+async def test_tick_does_not_roll_a_cloud_next_run_at(make_wf, monkeypatch):
+    """Rolling the timer forward locally is its own bug even when nothing fires: the server owns
+    that field, and a local write silently competes with it."""
+    from backend.apps.workflows import storage, scheduler
+
+    async def p_noop(wf, scheduled_for=None):
+        return None
+
+    monkeypatch.setattr(scheduler, "_fire", p_noop)
+    overdue = datetime.now(timezone.utc) - timedelta(minutes=5)
+    cloud = make_wf(execution_target="cloud", next_run_at=overdue)
+    storage.save_workflow(cloud)
+
+    await scheduler._tick()
+
+    after = storage.get_workflow(cloud.id)
+    assert after.next_run_at == cloud.next_run_at
+
+
+def test_sleep_math_ignores_cloud_workflows(make_wf):
+    """_tick and seconds_to_next_fire must agree. If only _tick skipped cloud workflows, an
+    overdue one would stay overdue forever and pin the loop at its 1s floor, burning a core."""
+    from backend.apps.workflows import storage, scheduler
+    overdue = datetime.now(timezone.utc) - timedelta(minutes=5)
+    storage.save_workflow(make_wf(execution_target="cloud", next_run_at=overdue))
+
+    assert scheduler.seconds_to_next_fire() is None
+    assert scheduler._seconds_until_next() == 60.0
+
+
+def test_reconcile_leaves_cloud_workflows_untouched(make_wf):
+    """A closed laptop did not "miss" a cloud run; the server ran it. Capturing it would offer the
+    user a review card for work that already happened, and rewrite a server-owned field."""
+    from backend.apps.workflows import storage, scheduler
+    anchor = datetime.now(timezone.utc) - timedelta(days=3)
+    # occurrences_between never enumerates fires from before the workflow existed, so it has to be old.
+    born = datetime.now(timezone.utc) - timedelta(days=10)
+    cloud = make_wf(execution_target="cloud", next_run_at=anchor, created_at=born)
+    storage.save_workflow(cloud)
+
+    scheduler.reconcile_on_startup()
+
+    assert storage.list_missed() == []
+    after = storage.get_workflow(cloud.id)
+    assert after.next_run_at == cloud.next_run_at
+
+
+def test_reconcile_still_captures_device_workflows(make_wf):
+    """The discriminating half: the same walk must keep working for local workflows."""
+    from backend.apps.workflows import storage, scheduler
+    anchor = datetime.now(timezone.utc) - timedelta(days=3)
+    born = datetime.now(timezone.utc) - timedelta(days=10)
+    local = make_wf(execution_target="device", next_run_at=anchor, created_at=born)
+    storage.save_workflow(local)
+
+    scheduler.reconcile_on_startup()
+
+    assert storage.list_missed() != []
diff --git a/backend/tests/test_session_cleanup.py b/backend/tests/test_session_cleanup.py
index 4c37fba3..b9ddf333 100644
--- a/backend/tests/test_session_cleanup.py
+++ b/backend/tests/test_session_cleanup.py
@@ -19,6 +19,7 @@ def test_purge_session_memory_clears_every_structure():
     mgr.sessions = {"dead": object(), "alive": object()}
     mgr.tasks = {"dead": object()}
     mgr.live_partial = {"dead": {"text": "half a reply"}}
+    mgr.pending_messages = {"dead": [object()]}
     vbs.view_builder_render_retry_counts["dead"] = 4
     vbs.view_builder_dirty_sessions.add("dead")
 
@@ -27,6 +28,7 @@ def test_purge_session_memory_clears_every_structure():
     assert "dead" not in mgr.sessions
     assert "dead" not in mgr.tasks
     assert "dead" not in mgr.live_partial
+    assert "dead" not in mgr.pending_messages
     assert "dead" not in vbs.view_builder_render_retry_counts
     assert "dead" not in vbs.view_builder_dirty_sessions
     # Only the target id is purged; an unrelated live session survives.
diff --git a/backend/tests/test_session_restore_durability.py b/backend/tests/test_session_restore_durability.py
new file mode 100644
index 00000000..d55f064f
--- /dev/null
+++ b/backend/tests/test_session_restore_durability.py
@@ -0,0 +1,64 @@
+"""Boot restore must never destroy the durable copy of a session.
+
+restore_all_sessions used to unlink every open session's JSON file after loading
+it into memory, making RAM the ONLY copy; any non-graceful shutdown (updater
+SIGKILL, crash, power loss) then wiped the chat permanently. This pins the
+invariant: restoring an open session loads it into memory AND leaves its file on
+disk, while closed sessions stay on disk untouched and out of memory.
+
+Run with:  backend/.venv/bin/python -m pytest backend/tests/test_session_restore_durability.py
+"""
+import asyncio
+import os
+from datetime import datetime
+
+from pytest import MonkeyPatch
+
+from backend.apps.agents import agent_manager as am
+from backend.apps.agents.core.models import AgentSession
+from backend.apps.agents.manager.session.session_store import save_session
+
+
+def p_session_path(sessions_dir: str, session_id: str) -> str:
+    return os.path.join(sessions_dir, f"{session_id}.json")
+
+
+def test_restore_keeps_open_session_file_on_disk(tmp_path, monkeypatch: MonkeyPatch) -> None:
+    monkeypatch.setattr(am, "SESSIONS_DIR", str(tmp_path))
+    mgr = am.AgentManager()
+    session = AgentSession(name="open chat", model="sonnet")
+    assert session.closed_at is None
+    save_session(session.id, session.model_dump(mode="json"))
+
+    asyncio.run(mgr.restore_all_sessions())
+
+    assert session.id in mgr.sessions
+    assert os.path.exists(p_session_path(str(tmp_path), session.id)), (
+        "restore must not unlink the durable session file; memory-only sessions "
+        "are lost on any non-graceful shutdown"
+    )
+
+
+def test_restore_skips_closed_sessions_but_keeps_their_files(tmp_path, monkeypatch: MonkeyPatch) -> None:
+    monkeypatch.setattr(am, "SESSIONS_DIR", str(tmp_path))
+    mgr = am.AgentManager()
+    closed = AgentSession(name="closed chat", model="sonnet", closed_at=datetime.now())
+    save_session(closed.id, closed.model_dump(mode="json"))
+
+    asyncio.run(mgr.restore_all_sessions())
+
+    assert closed.id not in mgr.sessions
+    assert os.path.exists(p_session_path(str(tmp_path), closed.id))
+
+
+def test_restore_settles_stale_running_status(tmp_path, monkeypatch: MonkeyPatch) -> None:
+    # The app died mid-turn: restore settles the status, and the file still survives.
+    monkeypatch.setattr(am, "SESSIONS_DIR", str(tmp_path))
+    mgr = am.AgentManager()
+    session = AgentSession(name="mid turn", model="sonnet", status="running")
+    save_session(session.id, session.model_dump(mode="json"))
+
+    asyncio.run(mgr.restore_all_sessions())
+
+    assert mgr.sessions[session.id].status in ("completed", "stopped")
+    assert os.path.exists(p_session_path(str(tmp_path), session.id))
diff --git a/backend/tests/test_stop_agent_preserves_terminal_status.py b/backend/tests/test_stop_agent_preserves_terminal_status.py
new file mode 100644
index 00000000..5803f176
--- /dev/null
+++ b/backend/tests/test_stop_agent_preserves_terminal_status.py
@@ -0,0 +1,60 @@
+"""Stopping is for LIVE turns. A settled chat must come back settled.
+
+Found live: quit the app and relaunch, and every finished conversation came back labelled
+"stopped" with a Resume button hanging off an answer that was already delivered. The chain is
+short. `self.tasks[session_id]` is written when a turn starts and only removed by stop/close, so a
+completed session leaves its done task in the registry forever; the agents sub-app's shutdown hook
+loops over every task it finds and calls `stop_agent` on each; `stop_agent` then wrote
+`status = "stopped"` unconditionally. One ordinary session was enough to reproduce it.
+
+The guard belongs in `stop_agent`, not in the shutdown loop, so no future caller can express the
+bad state either. `close_session` already had exactly this guard, which is what made the
+inconsistency easy to miss.
+
+Run:
+    cd backend && .venv/bin/python -m pytest tests/test_stop_agent_preserves_terminal_status.py -v
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from backend.apps.agents.agent_manager import agent_manager
+from backend.apps.agents.core.models import AgentSession, Message
+
+
+def p_seed(status: str) -> AgentSession:
+    s = AgentSession(name="t", model="sonnet")
+    s.status = status
+    s.messages = [Message(role="user", content="hi"), Message(role="assistant", content="hello")]
+    agent_manager.sessions[s.id] = s
+    return s
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("terminal", ["completed", "error", "stopped"])
+async def test_stopping_a_settled_chat_leaves_its_status_alone(terminal: str) -> None:
+    s = p_seed(terminal)
+    try:
+        await agent_manager.stop_agent(s.id)
+        assert s.status == terminal, "a restart must not relabel a finished conversation"
+        assert s.needs_fresh_session is False, "nothing was interrupted, so nothing needs rebuilding"
+        assert s.closed_at is None
+    finally:
+        agent_manager.sessions.pop(s.id, None)
+        agent_manager.tasks.pop(s.id, None)
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("live", ["running", "waiting_approval"])
+async def test_stopping_a_live_turn_still_stops_it(live: str) -> None:
+    """The discriminating half: the Stop button must keep working."""
+    s = p_seed(live)
+    try:
+        await agent_manager.stop_agent(s.id)
+        assert s.status == "stopped"
+        assert s.needs_fresh_session is True
+        assert s.closed_at is not None
+    finally:
+        agent_manager.sessions.pop(s.id, None)
+        agent_manager.tasks.pop(s.id, None)
diff --git a/backend/tests/test_streaming_harness.py b/backend/tests/test_streaming_harness.py
index da327b39..01bb3779 100644
--- a/backend/tests/test_streaming_harness.py
+++ b/backend/tests/test_streaming_harness.py
@@ -345,6 +345,40 @@ def test_thinking_block_before_text_is_handled(monkeypatch):
     assert session.status == "completed"
 
 
+def test_error_result_surfaces_error_card_not_silent_success(monkeypatch):
+    # An error-shaped ResultMessage used to be consumed as a normal end-of-turn: status "completed", no card, the user saw preamble then silence.
+    session, events = p_drive(monkeypatch, [
+        p_assistant([TextBlock(text="Let me work on that.")]),
+        p_result(subtype="error_during_execution", is_error=True,
+                 errors=["upstream exploded mid-run"]),
+    ])
+    assert session.status == "error"
+    p_cards = [m for m in session.messages if m.role == "system"]
+    assert any("upstream exploded mid-run" in str(m.content) for m in p_cards)
+    # the card is broadcast so the UI renders it, not just stored
+    assert any(e == "agent:message" and (d.get("message") or {}).get("role") == "system"
+               for e, d in events)
+
+
+def test_max_tokens_stop_reason_is_a_failed_turn(monkeypatch):
+    session, events = p_drive(monkeypatch, [
+        p_assistant([TextBlock(text="half an answ")]),
+        p_result(stop_reason="max_tokens"),
+    ])
+    assert session.status == "error"
+    assert any(m.role == "system" and "maximum output length" in str(m.content) for m in session.messages)
+
+
+def test_success_result_still_completes_normally(monkeypatch):
+    # the mutation pair for the error-result detection: success + is_error False must never be flagged
+    session, events = p_drive(monkeypatch, [
+        p_assistant([TextBlock(text="all done")]),
+        p_result(subtype="success", is_error=False, stop_reason="end_turn"),
+    ])
+    assert session.status == "completed"
+    assert not any(m.role == "system" for m in session.messages)
+
+
 def test_transient_capacity_error_is_retried_then_succeeds(monkeypatch):
     # the capacity-retry while-loop: first query() raises a transient error, the loop backs off (sleep mocked to no-op) and re-queries, which succeeds. This is the exact behavior the streaming restructuring must preserve.
     real_sleep = asyncio.sleep  # capture before patching to avoid self-recursion
diff --git a/backend/tests/test_subscription_disconnect.py b/backend/tests/test_subscription_disconnect.py
new file mode 100644
index 00000000..2e29ab2f
--- /dev/null
+++ b/backend/tests/test_subscription_disconnect.py
@@ -0,0 +1,127 @@
+"""Disconnecting a subscription reports the VERIFIED end state, never the attempt.
+
+The shipped bug this pins: 9Router answers a bad id with a 404 and a JSON error body, and the old
+code counted every DELETE it managed to send as a removal, so the UI said "disconnected" for a lane
+that was still live and the next connect stacked on a stale row.
+"""
+
+import asyncio
+from typing import Dict, List, Optional
+
+import backend.apps.agents.disconnect_subscription as ds
+
+
+class FakeResponse:
+    def __init__(self, status_code: int, payload: Optional[Dict] = None):
+        self.status_code = status_code
+        self.p_payload = payload or {}
+
+    def json(self) -> Dict:
+        return self.p_payload
+
+
+class FakeRouter:
+    """A 9Router whose rows only disappear when `deletable` allows the delete to succeed."""
+
+    def __init__(self, rows: List[Dict], deletable: bool = True, readable: bool = True):
+        self.rows = list(rows)
+        self.deletable = deletable
+        self.readable = readable
+        self.deletes: List[str] = []
+
+    def client(self, **kwargs) -> "FakeClient":
+        return FakeClient(self)
+
+
+class FakeClient:
+    def __init__(self, router: FakeRouter):
+        self.router = router
+
+    async def __aenter__(self) -> "FakeClient":
+        return self
+
+    async def __aexit__(self, *exc) -> None:
+        return None
+
+    async def get(self, url: str, **kw) -> FakeResponse:
+        if not self.router.readable:
+            return FakeResponse(503, {"error": "router down"})
+        return FakeResponse(200, {"connections": self.router.rows})
+
+    async def delete(self, url: str, **kw) -> FakeResponse:
+        conn_id = url.rsplit("/", 1)[-1]
+        self.router.deletes.append(conn_id)
+        if not self.router.deletable:
+            return FakeResponse(404, {"error": "Connection not found"})
+        self.router.rows = [r for r in self.router.rows if r["id"] != conn_id]
+        return FakeResponse(200, {"message": "Connection deleted successfully"})
+
+
+CLAUDE_AND_CODEX = [
+    {"id": "c1", "provider": "claude", "name": "Account 1"},
+    {"id": "x1", "provider": "codex", "name": "Account 1"},
+    {"id": "x2", "provider": "codex", "name": "Account 2"},
+]
+
+
+def p_install(monkeypatch, router: FakeRouter) -> None:
+    monkeypatch.setattr(ds, "is_running", lambda: True)
+    monkeypatch.setattr(ds.httpx, "AsyncClient", lambda **kw: router.client(**kw))
+    monkeypatch.setattr(ds, "invalidate_health_cache", lambda: None)
+    monkeypatch.setattr(ds, "sync_settings_state", lambda: None)
+
+
+def test_disconnect_clears_every_row_of_the_lane(monkeypatch):
+    router = FakeRouter(CLAUDE_AND_CODEX)
+    p_install(monkeypatch, router)
+    result = asyncio.run(ds.disconnect_subscription("codex"))
+    assert result.ok and result.removed == 2 and result.error == ""
+    assert [r["provider"] for r in router.rows] == ["claude"]
+
+
+def test_a_refused_delete_is_never_reported_as_success(monkeypatch):
+    router = FakeRouter(CLAUDE_AND_CODEX, deletable=False)
+    p_install(monkeypatch, router)
+    result = asyncio.run(ds.disconnect_subscription("claude"))
+    assert not result.ok
+    assert result.removed == 0
+    assert result.error
+    assert len(router.rows) == 3  # the lane really is still there
+
+
+def test_an_unreadable_router_cannot_confirm(monkeypatch):
+    router = FakeRouter(CLAUDE_AND_CODEX, readable=False)
+    p_install(monkeypatch, router)
+    result = asyncio.run(ds.disconnect_subscription("claude"))
+    assert not result.ok and result.error
+
+
+def test_disconnect_is_idempotent_when_the_lane_is_already_clear(monkeypatch):
+    router = FakeRouter([{"id": "c1", "provider": "claude"}])
+    p_install(monkeypatch, router)
+    result = asyncio.run(ds.disconnect_subscription("codex"))
+    assert result.ok and result.removed == 0
+    assert router.deletes == []
+
+
+def test_google_lanes_cascade_together(monkeypatch):
+    router = FakeRouter([
+        {"id": "g1", "provider": "gemini-cli"},
+        {"id": "a1", "provider": "antigravity"},
+        {"id": "c1", "provider": "claude"},
+    ])
+    p_install(monkeypatch, router)
+    result = asyncio.run(ds.disconnect_subscription("gemini-cli"))
+    assert result.ok and result.removed == 2
+    assert [r["provider"] for r in router.rows] == ["claude"]
+    # One-directional: dropping antigravity must NOT take gemini-cli with it.
+    assert ds.PROVIDER_CASCADE_REMOVES.get("antigravity") is None
+
+
+def test_router_down_fails_closed(monkeypatch):
+    router = FakeRouter(CLAUDE_AND_CODEX)
+    p_install(monkeypatch, router)
+    monkeypatch.setattr(ds, "is_running", lambda: False)
+    result = asyncio.run(ds.disconnect_subscription("claude"))
+    assert not result.ok and result.error
+    assert router.deletes == []
diff --git a/backend/tests/test_tier_breaker.py b/backend/tests/test_tier_breaker.py
new file mode 100644
index 00000000..dfbffcac
--- /dev/null
+++ b/backend/tests/test_tier_breaker.py
@@ -0,0 +1,82 @@
+"""Engine health: how many failures shut a frontend, and for how long.
+
+Measured before this existed: once DuckDuckGo stopped answering TCP, three
+consecutive 44-query rounds each paid its full 8s budget on EVERY query, so
+keyless p50 went 1.0s -> 8.5s while Startpage still served 40/40.
+
+The racing behaviour that keeps a dead engine off the critical path lives in
+test_keyless_race.py; this file pins the state machine underneath it.
+"""
+
+import pytest
+
+from backend.apps.web.tier_breaker import (
+    FAILURES_TO_OPEN,
+    FIRST_COOLDOWN_SECONDS,
+    MAX_COOLDOWN_SECONDS,
+    record_tier_failure,
+    record_tier_success,
+    reset_tier_health,
+    tier_cooldown_left,
+)
+
+
+@pytest.fixture(autouse=True)
+def p_clean():
+    reset_tier_health()
+    yield
+    reset_tier_health()
+
+
+def test_an_error_answer_takes_three_strikes():
+    """A 202 or a 403 can be a bad minute, so one is not enough to shut an engine out."""
+    for _ in range(FAILURES_TO_OPEN - 1):
+        record_tier_failure("ddg")
+    assert tier_cooldown_left("ddg") == 0.0
+    record_tier_failure("ddg")
+    assert 0 < tier_cooldown_left("ddg") <= FIRST_COOLDOWN_SECONDS
+
+
+def test_silence_is_conclusive_on_the_first_failure():
+    """A frontend returning nothing at all is not ambiguous, and making the user prove it
+    three times is what put 8.8s on their first three searches after launch."""
+    record_tier_failure("ddg", conclusive=True)
+    assert 0 < tier_cooldown_left("ddg") <= FIRST_COOLDOWN_SECONDS
+
+
+def test_success_clears_the_streak():
+    for _ in range(FAILURES_TO_OPEN):
+        record_tier_failure("ddg")
+    assert tier_cooldown_left("ddg") > 0
+    record_tier_success("ddg")
+    assert tier_cooldown_left("ddg") == 0.0
+
+
+def test_a_recovered_engine_is_not_blacklisted_forever():
+    """The cooldown must expire on its own, or one bad afternoon costs us an engine for good."""
+    record_tier_failure("ddg", now=0.0, conclusive=True)
+    assert tier_cooldown_left("ddg", now=0.0) == pytest.approx(FIRST_COOLDOWN_SECONDS)
+    assert tier_cooldown_left("ddg", now=FIRST_COOLDOWN_SECONDS + 1) == 0.0
+    record_tier_success("ddg")
+    for _ in range(FAILURES_TO_OPEN - 1):
+        record_tier_failure("ddg")
+    assert tier_cooldown_left("ddg") == 0.0, "a success must reset the streak, not just the clock"
+
+
+def test_cooldown_doubles_and_is_capped():
+    seen = []
+    now = 0.0
+    for _ in range(12):
+        record_tier_failure("ddg", now=now, conclusive=True)
+        seen.append(tier_cooldown_left("ddg", now=now))
+        now += seen[-1] + 1
+    assert seen[0] == pytest.approx(FIRST_COOLDOWN_SECONDS)
+    assert seen[1] > seen[0]
+    assert max(seen) <= MAX_COOLDOWN_SECONDS
+
+
+def test_engines_are_tracked_independently():
+    for _ in range(FAILURES_TO_OPEN):
+        record_tier_failure("ddg")
+    assert tier_cooldown_left("ddg") > 0
+    assert tier_cooldown_left("startpage") == 0.0
diff --git a/backend/tests/test_tool_manifest.py b/backend/tests/test_tool_manifest.py
index 75e08dfc..a37913f4 100644
--- a/backend/tests/test_tool_manifest.py
+++ b/backend/tests/test_tool_manifest.py
@@ -1,7 +1,7 @@
-"""OSW_TOOL_MANIFEST gate: default ships the full claude_code preset; flag-on ships an explicit
-FULL_TOOLS list that prunes dead preset built-ins WITHOUT dropping anything OpenSwarm uses. The
-manifest MUST keep every built-in in effective_allowed's source set + ToolSearch (so deferred MCP
-loading survives); MCP tools ride mcp_servers, not this list."""
+"""OSW_TOOL_MANIFEST gate: default ships an explicit FULL_TOOLS list that prunes dead preset
+built-ins WITHOUT dropping anything OpenSwarm uses; OSW_TOOL_MANIFEST=0 is the kill switch back to
+the full claude_code preset. The manifest MUST keep every built-in in effective_allowed's source set
++ ToolSearch (so deferred MCP loading survives); MCP tools ride mcp_servers, not this list."""
 
 
 from backend.apps.agents.manager.prompt.tool_catalog import (
@@ -9,14 +9,11 @@ from backend.apps.agents.manager.prompt.tool_catalog import (
     resolve_builtin_tools_option,
 )
 
+PRESET = {"type": "preset", "preset": "claude_code"}
 
-def test_default_is_the_full_preset(monkeypatch):
+
+def test_default_is_the_explicit_full_tools_manifest(monkeypatch):
     monkeypatch.delenv("OSW_TOOL_MANIFEST", raising=False)
-    assert resolve_builtin_tools_option() == {"type": "preset", "preset": "claude_code"}
-
-
-def test_flag_on_is_the_explicit_full_tools_manifest(monkeypatch):
-    monkeypatch.setenv("OSW_TOOL_MANIFEST", "1")
     out = resolve_builtin_tools_option()
     assert isinstance(out, list)
     assert out == list(FULL_TOOLS)
@@ -24,22 +21,43 @@ def test_flag_on_is_the_explicit_full_tools_manifest(monkeypatch):
     assert out is not FULL_TOOLS
 
 
+def test_kill_switch_restores_the_full_preset(monkeypatch):
+    monkeypatch.setenv("OSW_TOOL_MANIFEST", "0")
+    assert resolve_builtin_tools_option() == PRESET
+
+
 def test_manifest_keeps_toolsearch_so_deferred_mcp_loading_survives(monkeypatch):
-    monkeypatch.setenv("OSW_TOOL_MANIFEST", "1")
-    out = resolve_builtin_tools_option()
-    assert "ToolSearch" in out
+    monkeypatch.delenv("OSW_TOOL_MANIFEST", raising=False)
+    assert "ToolSearch" in resolve_builtin_tools_option()
 
 
 def test_manifest_keeps_every_core_builtin_openswarm_exposes(monkeypatch):
     # These are the built-ins the agent actually uses; none may vanish from the manifest.
-    monkeypatch.setenv("OSW_TOOL_MANIFEST", "1")
+    monkeypatch.delenv("OSW_TOOL_MANIFEST", raising=False)
     out = resolve_builtin_tools_option()
     for core in ("Read", "Edit", "Write", "Bash", "Glob", "Grep", "AskUserQuestion"):
         assert core in out
 
 
-def test_only_the_exact_flag_value_flips_it(monkeypatch):
-    monkeypatch.setenv("OSW_TOOL_MANIFEST", "true")  # not "1"
-    assert resolve_builtin_tools_option() == {"type": "preset", "preset": "claude_code"}
-    monkeypatch.setenv("OSW_TOOL_MANIFEST", "0")
-    assert resolve_builtin_tools_option() == {"type": "preset", "preset": "claude_code"}
+def test_manifest_drops_only_builtins_nothing_in_the_repo_references(monkeypatch):
+    # Live-measured saving comes from exactly these; if one ever gains a caller, it must come back.
+    monkeypatch.delenv("OSW_TOOL_MANIFEST", raising=False)
+    out = resolve_builtin_tools_option()
+    for dead in ("Monitor", "PushNotification", "RemoteTrigger", "ScheduleWakeup", "Skill"):
+        assert dead not in out
+
+
+def test_both_halves_of_a_paired_tool_ship_together(monkeypatch):
+    """An Enter with no Exit strands the agent in whatever mode it entered. ExitWorktree was pruned
+    as "unreferenced" while EnterWorktree stayed, which is how that gap got in."""
+    monkeypatch.delenv("OSW_TOOL_MANIFEST", raising=False)
+    out = resolve_builtin_tools_option()
+    for enter, exit_ in (("EnterPlanMode", "ExitPlanMode"), ("EnterWorktree", "ExitWorktree")):
+        assert (enter in out) == (exit_ in out), f"{enter} and {exit_} must ship together"
+
+
+def test_only_the_exact_kill_switch_value_flips_it(monkeypatch):
+    monkeypatch.setenv("OSW_TOOL_MANIFEST", "false")  # not "0"
+    assert resolve_builtin_tools_option() == list(FULL_TOOLS)
+    monkeypatch.setenv("OSW_TOOL_MANIFEST", "1")
+    assert resolve_builtin_tools_option() == list(FULL_TOOLS)
diff --git a/backend/tests/test_tool_result_spill.py b/backend/tests/test_tool_result_spill.py
new file mode 100644
index 00000000..8efbc1c5
--- /dev/null
+++ b/backend/tests/test_tool_result_spill.py
@@ -0,0 +1,67 @@
+"""Oversized tool results spill to disk and come back MIDDLE-elided, not head-only.
+
+Head-only truncation threw away the tail of every long output, which is exactly where a test
+summary or build verdict lives. These lock the head, the tail, the elision marker, the recovery
+note, and the "leave small bodies alone" boundary."""
+
+import json
+
+import pytest
+
+from backend.apps.agents.manager.session import history_compaction as hc
+
+
+@pytest.fixture
+def spill_dir(tmp_path, monkeypatch):
+    monkeypatch.setattr(hc, "SESSIONS_DIR", str(tmp_path))
+    return tmp_path
+
+
+def big_body(marker: str = "FINAL VERDICT: 3 failed") -> str:
+    return "\n".join([f"trace line {i:05d} " + "." * 50 for i in range(1400)] + [marker])
+
+
+def test_under_cap_bodies_are_untouched(spill_dir):
+    content = {"text": "tiny", "tool_name": "Bash"}
+    out, path = hc.truncate_large_tool_result(content, "sess", "msg")
+    assert out == content
+    assert path is None
+
+
+def test_spill_writes_the_full_body_to_a_session_scoped_blob(spill_dir):
+    body = big_body()
+    out, path = hc.truncate_large_tool_result({"text": body, "tool_name": "Bash"}, "sess", "msg")
+    assert path is not None
+    assert str(spill_dir / "sess" / "blobs") in path
+    # The blob holds the whole serialized content dict, so compare against that, not the raw text.
+    assert open(path, encoding="utf-8").read() == json.dumps({"text": body, "tool_name": "Bash"})
+    assert len(json.dumps(out)) < len(body)
+
+
+def test_the_tail_survives_so_a_verdict_at_the_end_still_reaches_the_model(spill_dir):
+    out, _ = hc.truncate_large_tool_result({"text": big_body(), "tool_name": "Bash"}, "sess", "msg")
+    assert "FINAL VERDICT: 3 failed" in out
+    assert "trace line 00000" in out
+    assert "elided by OpenSwarm" in out
+
+
+def test_the_recovery_note_stays_last(spill_dir):
+    out, path = hc.truncate_large_tool_result({"text": big_body(), "tool_name": "Bash"}, "sess", "msg")
+    assert out.rstrip().endswith(hc.PLATFORM_NOTE_CLOSE)
+    assert path in out
+
+
+def test_forged_sentinels_are_neutered_in_both_head_and_tail(spill_dir):
+    forged = hc.PLATFORM_NOTE_OPEN + " trusted " + hc.PLATFORM_NOTE_CLOSE
+    body = forged + big_body() + forged
+    out, _ = hc.truncate_large_tool_result({"text": body, "tool_name": "Bash"}, "sess", "msg")
+    # The only real note is the one OpenSwarm appends at the end.
+    assert out.count(hc.PLATFORM_NOTE_OPEN) == 1
+    assert "&lt;openswarm_platform_note&gt;" in out
+
+
+def test_a_body_shorter_than_head_plus_tail_is_not_elided(spill_dir):
+    body = "z" * (hc.SPILL_HEAD_CHARS + hc.SPILL_TAIL_CHARS - 10)
+    out = hc.build_elided_replacement(body, "/blob.txt")
+    assert "elided by OpenSwarm" not in out
+    assert body in out
diff --git a/backend/tests/test_undeliverable_background_tools.py b/backend/tests/test_undeliverable_background_tools.py
new file mode 100644
index 00000000..bed94ef4
--- /dev/null
+++ b/backend/tests/test_undeliverable_background_tools.py
@@ -0,0 +1,76 @@
+"""Never advertise a tool whose payload we cannot deliver.
+
+Monitor and friends are background event-stream tools: the agent arms one, keeps working, and the
+notification is supposed to arrive between turns. We drive the CLI strictly one turn at a time and
+stop reading at the ResultMessage, so nothing ever consumes that event. The observed failure is a
+user watching an agent say "I'll report back the second it's done, no need to wait around" and then
+never hearing anything again.
+
+Pruning them from the tool manifest was not enough: that has a kill switch, and flipping it handed
+the model the same undeliverable promise. The deny has to live where no flag can lift it.
+
+Run:
+    cd backend && .venv/bin/python -m pytest tests/test_undeliverable_background_tools.py -v
+"""
+
+from __future__ import annotations
+
+from backend.apps.agents.core.models import AgentSession
+from backend.apps.agents.manager.permissions import path_gate
+from backend.apps.agents.manager.permissions.build_effective_tool_lists import (
+    build_effective_tool_lists,
+)
+
+
+def p_build(allowed=None, builtin_perms=None):
+    session = AgentSession(
+        id="s1", name="t", model="sonnet", mode="agent",
+        allowed_tools=allowed if allowed is not None else ["Read", "Bash", "Monitor"],
+    )
+    return build_effective_tool_lists(
+        session=session,
+        mcp_servers={},
+        builtin_perms=builtin_perms or {},
+        need_web_mcp=False,
+        browser_delegation_tools=[],
+        invoke_agent_tools=[],
+    )
+
+
+def p_disallowed(**kwargs) -> list:
+    return p_build(kwargs.get("allowed_tools"), kwargs.get("builtin_perms"))[1]
+
+
+def test_every_undeliverable_tool_is_withheld():
+    disallowed = p_disallowed()
+    for name in path_gate.UNDELIVERABLE_BACKGROUND_TOOLS:
+        assert name in disallowed, f"{name} promises a between-turn callback we never deliver"
+
+
+def test_monitor_specifically_cannot_be_reached():
+    """The one a real user hit. Named on its own so a future edit to the tuple cannot quietly drop it."""
+    assert "Monitor" in path_gate.UNDELIVERABLE_BACKGROUND_TOOLS
+    assert "Monitor" in p_disallowed()
+
+
+def test_withheld_even_when_explicitly_allowed():
+    """A saved permission set or the manifest kill switch must not be able to hand it back."""
+    disallowed = p_disallowed(
+        allowed_tools=["Monitor", "PushNotification"],
+        builtin_perms={"Monitor": "always_allow", "PushNotification": "always_allow"},
+    )
+    assert "Monitor" in disallowed
+    assert "PushNotification" in disallowed
+
+
+def test_ordinary_tools_are_untouched():
+    """The discriminating half: this must withhold exactly these, not quietly narrow the surface."""
+    allowed, disallowed = p_build(["Read", "Bash", "Glob"])
+    assert "Read" in allowed and "Bash" in allowed and "Glob" in allowed
+    for name in ("Read", "Bash", "Glob"):
+        assert name not in disallowed
+
+
+def test_no_duplicates_when_already_denied():
+    disallowed = p_disallowed(builtin_perms={"Monitor": "deny"})
+    assert disallowed.count("Monitor") == 1
diff --git a/backend/tests/test_unselected_app_context.py b/backend/tests/test_unselected_app_context.py
new file mode 100644
index 00000000..aad4dcf5
--- /dev/null
+++ b/backend/tests/test_unselected_app_context.py
@@ -0,0 +1,116 @@
+"""An agent that cannot see an app must still know it exists.
+
+Selecting an App card is what grants edit access, and that gate is deliberate. But a user who has
+not learned the ritual just sees an agent behaving as though their app was never built, and the
+agent cannot explain the problem because it was never told the app was there either. So with
+nothing selected we name the apps and nothing more: enough to say "select it and I can edit it",
+not enough to start editing something the user never pointed at.
+
+Run:
+    cd backend && .venv/bin/python -m pytest tests/test_unselected_app_context.py -v
+"""
+
+from __future__ import annotations
+
+from backend.apps.agents.manager.prompt import prompt_context
+from backend.apps.outputs.models import Output
+
+
+def p_app(name: str, workspace_id: str = "ws") -> Output:
+    return Output(name=name, workspace_id=workspace_id)
+
+
+def test_names_the_apps_when_nothing_is_selected(monkeypatch):
+    monkeypatch.setattr(prompt_context, "load_all", lambda: [p_app("Budget Tracker")], raising=False)
+    monkeypatch.setattr(
+        "backend.apps.outputs.workspace_io.load_all",
+        lambda: [p_app("Budget Tracker"), p_app("Habit Log")],
+    )
+
+    out = prompt_context.build_unselected_app_context()
+
+    assert out is not None
+    assert "Budget Tracker" in out and "Habit Log" in out
+
+
+def test_tells_the_agent_to_ask_for_a_selection(monkeypatch):
+    """The whole point: the agent has to hand the user the next step, not stonewall them."""
+    monkeypatch.setattr("backend.apps.outputs.workspace_io.load_all", lambda: [p_app("Budget Tracker")])
+
+    out = prompt_context.build_unselected_app_context() or ""
+
+    assert "select" in out.lower()
+    assert "does not exist" in out, "must explicitly forbid claiming the app is missing"
+
+
+def test_leaks_no_paths(monkeypatch):
+    """Names only. A path here would let the agent edit an app the user never pointed at, which is
+    exactly the access the selection gate exists to withhold."""
+    monkeypatch.setattr("backend.apps.outputs.workspace_io.load_all", lambda: [p_app("Budget Tracker")])
+
+    out = prompt_context.build_unselected_app_context() or ""
+
+    assert "/" not in out.replace("</available_apps>", ""), "no filesystem paths may appear"
+    assert "workspace" not in out.lower()
+
+
+def test_silent_when_the_user_has_no_apps(monkeypatch):
+    monkeypatch.setattr("backend.apps.outputs.workspace_io.load_all", lambda: [])
+    assert prompt_context.build_unselected_app_context() is None
+
+
+def test_skips_apps_with_no_workspace(monkeypatch):
+    """A row without a workspace is not a real app the user can select."""
+    monkeypatch.setattr(
+        "backend.apps.outputs.workspace_io.load_all",
+        lambda: [Output(name="Ghost", workspace_id=None)],
+    )
+    assert prompt_context.build_unselected_app_context() is None
+
+
+def test_caps_a_long_list(monkeypatch):
+    many = [p_app(f"App {i}") for i in range(30)]
+    monkeypatch.setattr("backend.apps.outputs.workspace_io.load_all", lambda: many)
+
+    out = prompt_context.build_unselected_app_context() or ""
+
+    assert "App 0" in out
+    assert "App 29" not in out, "an uncapped list burns prompt tokens on every turn"
+    assert "more" in out, "the user must still learn there are others"
+
+
+def test_a_broken_store_does_not_break_the_turn(monkeypatch):
+    def p_boom():
+        raise OSError("disk gone")
+
+    monkeypatch.setattr("backend.apps.outputs.workspace_io.load_all", p_boom)
+    assert prompt_context.build_unselected_app_context() is None
+
+
+def test_selection_still_wins(monkeypatch):
+    """With a real selection the rich block must be used; this fallback must not shadow it."""
+    monkeypatch.setattr("backend.apps.outputs.workspace_io.load_all", lambda: [p_app("Budget Tracker")])
+    selected = prompt_context.build_selected_app_context(None)
+    assert selected is None, "no ids means no rich block, which is what triggers the fallback"
+
+
+def test_the_block_actually_reaches_the_composed_prompt(monkeypatch):
+    """The one that matters. Every test above passes even with the builder unwired from the prompt,
+    so without this the feature could ship doing nothing at all."""
+    from backend.apps.agents.core.models import AgentSession
+    from backend.apps.agents.manager.prompt.compose_turn_system_prompt import compose_turn_system_prompt
+
+    monkeypatch.setattr("backend.apps.outputs.workspace_io.load_all", lambda: [p_app("Budget Tracker")])
+    session = AgentSession(id="s1", name="t", model="sonnet", mode="agent")
+
+    composed = compose_turn_system_prompt(
+        session=session,
+        mode_sys_prompt=None,
+        default_system_prompt=None,
+        selected_browser_ids=None,
+        selected_app_output_ids=None,
+        selected_setting_ids=None,
+    ) or ""
+
+    assert "Budget Tracker" in composed
+    assert "<available_apps>" in composed
diff --git a/backend/tests/test_wayback_snapshot.py b/backend/tests/test_wayback_snapshot.py
new file mode 100644
index 00000000..66e10241
--- /dev/null
+++ b/backend/tests/test_wayback_snapshot.py
@@ -0,0 +1,96 @@
+"""The archive's redirect interstitial is not a copy of the page.
+
+Measured on instagram.com/nasa: the Wayback tier answered 200 and we handed
+the model 225 characters reading "Got an HTTP 302 response at crawl time /
+Redirecting to .../accounts/login". It passed the substance floor because the
+interstitial has real words in it, so only the wording gives it away.
+"""
+
+import pytest
+
+import backend.apps.agents.tools.fetch.wayback as WB
+from backend.apps.agents.tools.browser_http import HttpReply
+from backend.apps.agents.tools.fetch.wayback import fetch_wayback, snapshot_date
+
+P_ARCHIVED_URL = "https://web.archive.org/web/20260711073650/https://example.com/story"
+
+
+def p_patch(monkeypatch, status: int, text: str, url: str = P_ARCHIVED_URL):
+    async def p_req(u, **kw):
+        return HttpReply(status=status, text=text, content=text.encode(),
+                         content_type="text/html", url=url)
+    monkeypatch.setattr(WB, "browser_request", p_req)
+
+
+P_INTERSTITIAL = (
+    "<html><body><p>Loading...</p><p>https://www.instagram.com/nasa/</p>"
+    "<p>07:36:50 July 11, 2026</p><p>Got an HTTP 302 response at crawl time</p>"
+    "<p>Redirecting to...</p><p>https://www.instagram.com/accounts/login/?next=%2Fnasa%2F</p>"
+    "<p>Wayback Machine has not archived that URL beyond the redirect target given here.</p>"
+    "</body></html>"
+)
+
+P_REAL_ARTICLE = (
+    "<html><body><article><p>" + "The archived article body says something real. " * 20
+    + "</p></article></body></html>"
+)
+
+
+@pytest.mark.asyncio
+async def test_redirect_interstitial_is_not_content(monkeypatch):
+    p_patch(monkeypatch, 200, P_INTERSTITIAL)
+    assert await fetch_wayback("https://www.instagram.com/nasa/") is None
+
+
+@pytest.mark.asyncio
+async def test_real_snapshot_still_returns_with_its_date(monkeypatch):
+    p_patch(monkeypatch, 200, P_REAL_ARTICLE)
+    out = await fetch_wayback("https://example.com/story")
+    assert out is not None
+    assert "archived article body" in out
+    assert "2026-07-11" in out
+
+
+@pytest.mark.asyncio
+async def test_stub_snapshot_below_the_floor_is_rejected(monkeypatch):
+    p_patch(monkeypatch, 200, "<html><body><p>Loading...</p></body></html>")
+    assert await fetch_wayback("https://example.com/story") is None
+
+
+@pytest.mark.asyncio
+async def test_offsite_redirect_is_refused(monkeypatch):
+    """We hand the archive a caller-supplied URL, so landing anywhere else means no answer."""
+    p_patch(monkeypatch, 200, P_REAL_ARTICLE, url="https://evil.example/whatever")
+    assert await fetch_wayback("https://example.com/story") is None
+
+
+def test_snapshot_date_parsing():
+    assert snapshot_date(P_ARCHIVED_URL) == "2026-07-11"
+    assert snapshot_date("https://web.archive.org/nope") is None
+
+
+@pytest.mark.asyncio
+async def test_raw_snapshot_form_is_requested(monkeypatch):
+    """Without `id_` the archive injects its calendar toolbar, and on a Reddit snapshot
+    that toolbar WAS the whole extracted text."""
+    seen = []
+
+    async def p_req(u, **kw):
+        seen.append(u)
+        return HttpReply(status=200, text=P_REAL_ARTICLE, content=P_REAL_ARTICLE.encode(),
+                         content_type="text/html", url=P_ARCHIVED_URL)
+    monkeypatch.setattr(WB, "browser_request", p_req)
+    await fetch_wayback("https://example.com/story")
+    assert seen == ["https://web.archive.org/web/2id_/https://example.com/story"]
+
+
+def test_snapshot_date_parsing_survives_the_raw_form():
+    assert snapshot_date("https://web.archive.org/web/20260727222838id_/https://x.example/") == "2026-07-27"
+
+
+@pytest.mark.asyncio
+async def test_archive_toolbar_text_alone_is_below_the_floor(monkeypatch):
+    toolbar = ("<html><body>Jun JUL Aug 30 2025 2026 2027 success fail About this capture "
+               "COLLECTED BY Collection: Save Page Now TIMESTAMPS</body></html>")
+    p_patch(monkeypatch, 200, toolbar)
+    assert await fetch_wayback("https://www.reddit.com/r/programming/") is None
diff --git a/backend/tests/test_web_cascade_budget.py b/backend/tests/test_web_cascade_budget.py
new file mode 100644
index 00000000..b0c4baeb
--- /dev/null
+++ b/backend/tests/test_web_cascade_budget.py
@@ -0,0 +1,131 @@
+"""The /api/web cascade is bounded by ONE wall-clock budget.
+
+Seals the class of bug where the cascade's own leashes summed to 244s (search)
+/ 270s (fetch) while the MCP shim gave up at 45s, so the later tiers were
+unreachable and search "worked" only when an early tier won the race.
+"""
+
+import asyncio
+import time
+
+import pytest
+
+import backend.apps.web.cascade as C
+from backend.apps.web.cascade import CascadeTier, run_cascade
+
+
+@pytest.fixture
+def p_tiny_floor(monkeypatch):
+    """Shrink the honest-slice floor so budget tests run in milliseconds, not seconds."""
+    monkeypatch.setattr(C, "MIN_TIER_SECONDS", 0.05)
+
+
+def p_tier(name, budget, fn):
+    return CascadeTier(name=name, run=fn, budget=budget)
+
+
+async def p_hangs():
+    await asyncio.sleep(60)
+
+
+async def p_none():
+    return None
+
+
+@pytest.mark.asyncio
+async def test_first_result_short_circuits():
+    async def p_hit():
+        return {"backend": "one"}
+
+    async def p_boom():
+        raise AssertionError("later tiers must not run once a tier answers")
+
+    out = await run_cascade([p_tier("a", 5, p_hit), p_tier("b", 5, p_boom)], 10.0)
+    assert out.result == {"backend": "one"}
+    assert out.errors == []
+
+
+@pytest.mark.asyncio
+async def test_total_budget_bounds_the_whole_cascade(p_tiny_floor):
+    # Four tiers each willing to burn 60s: without a shared deadline this runs for minutes.
+    tiers = [p_tier(f"t{i}", 60.0, p_hangs) for i in range(4)]
+    t0 = time.monotonic()
+    out = await run_cascade(tiers, 1.0)
+    elapsed = time.monotonic() - t0
+    assert elapsed < 2.0, f"cascade overran its budget: {elapsed:.2f}s"
+    assert out.result is None
+    assert any("timed out" in e for e in out.errors)
+
+
+@pytest.mark.asyncio
+async def test_a_slow_tier_cannot_starve_the_ones_behind_it(p_tiny_floor):
+    # A hanging tier is cut at ITS OWN budget, so the tier behind it still gets its turn and wins.
+    async def p_hit():
+        return {"backend": "rescue"}
+
+    out = await run_cascade([p_tier("slow", 0.4, p_hangs), p_tier("fast", 5.0, p_hit)], 3.0)
+    assert out.result == {"backend": "rescue"}
+    assert any("slow" in e and "timed out" in e for e in out.errors)
+
+
+@pytest.mark.asyncio
+async def test_unreachable_tiers_are_reported_not_silently_dropped():
+    async def p_slow():
+        await asyncio.sleep(0.6)
+        return None
+
+    out = await run_cascade(
+        [p_tier("burn", 5.0, p_slow), p_tier("never_a", 5.0, p_none), p_tier("never_b", 5.0, p_none)],
+        0.6 + C.MIN_TIER_SECONDS - 0.1,
+    )
+    assert out.result is None
+    tail = out.errors[-1]
+    assert "budget spent" in tail
+    assert "never_a" in tail and "never_b" in tail
+
+
+@pytest.mark.asyncio
+async def test_a_tier_slice_never_drops_below_the_honest_floor():
+    # A tier handed 0.2s would "time out" on a hair trigger; we must say the budget ran out instead.
+    async def p_slow():
+        await asyncio.sleep(0.5)
+        return None
+
+    out = await run_cascade([p_tier("burn", 5.0, p_slow), p_tier("squeezed", 5.0, p_hangs)], 0.5 + 1.0)
+    assert out.result is None
+    assert not any("squeezed" in e and "timed out" in e for e in out.errors)
+    assert any("budget spent" in e for e in out.errors)
+
+
+@pytest.mark.asyncio
+async def test_tier_exception_is_recorded_and_the_chain_continues():
+    async def p_boom():
+        raise RuntimeError("provider down")
+
+    async def p_hit():
+        return {"backend": "next"}
+
+    out = await run_cascade([p_tier("bad", 5.0, p_boom), p_tier("good", 5.0, p_hit)], 10.0)
+    assert out.result == {"backend": "next"}
+    assert out.errors == ["bad: provider down"]
+
+
+def test_mcp_shim_waits_longer_than_the_server_budget():
+    """The shim must outlast the cascade, or the later tiers are unreachable again."""
+    from backend.apps.agents.web_mcp_server import TOOL_TIMEOUT
+    from backend.apps.web.web import FETCH_BUDGET_SECONDS, SEARCH_BUDGET_SECONDS
+
+    assert TOOL_TIMEOUT > SEARCH_BUDGET_SECONDS
+    assert TOOL_TIMEOUT > FETCH_BUDGET_SECONDS
+
+
+def test_search_tier_budgets_leave_room_for_the_grounded_tier():
+    """The free rungs must not eat the whole budget before a paid backend is tried."""
+    import backend.apps.web.web as W
+
+    # A grounded native call needs ~30-42s, so the free rungs must leave it a usable slice.
+    grounded_floor = 20.0
+    search_cheap = 2 * W.KEYLESS_TIER_SECONDS + W.BROWSER_TIER_SECONDS
+    assert W.SEARCH_BUDGET_SECONDS - search_cheap >= grounded_floor
+    fetch_cheap = W.LOCAL_FETCH_TIER_SECONDS + W.BROWSER_TIER_SECONDS + W.ARCHIVE_TIER_SECONDS
+    assert W.FETCH_BUDGET_SECONDS - fetch_cheap >= grounded_floor
diff --git a/backend/tests/test_web_fetch_body.py b/backend/tests/test_web_fetch_body.py
new file mode 100644
index 00000000..4995d140
--- /dev/null
+++ b/backend/tests/test_web_fetch_body.py
@@ -0,0 +1,154 @@
+"""WebFetch must never post raw binary into the model's context.
+
+The field bug: fetching a PDF handed the model megabytes of `%PDF-1.5`
+gibberish, which cost real money, told it nothing, and pushed real content out
+of the window. Same class for images and any other binary body.
+"""
+
+import pytest
+
+import backend.apps.agents.tools.fetch.wayback as WB
+from backend.apps.agents.tools.fetch.page_text import (
+    MAX_PDF_PAGES,
+    body_to_text,
+    extract_pdf_text,
+    looks_like_pdf,
+)
+from backend.apps.agents.tools.browser_http import HttpReply
+from backend.apps.agents.tools.fetch.wayback import fetch_wayback, snapshot_date
+
+
+def p_minimal_pdf(text: str = "Hello from a real PDF") -> bytes:
+    """A genuine 600-byte one-page PDF with a real font resource and xref table."""
+    stream = f"BT /F1 18 Tf 20 100 Td ({text}) Tj ET".encode()
+    objects = [
+        b"<< /Type /Catalog /Pages 2 0 R >>",
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Contents 4 0 R "
+        b"/Resources << /Font << /F1 5 0 R >> >> >>",
+        b"<< /Length " + str(len(stream)).encode() + b" >>\nstream\n" + stream + b"\nendstream",
+        b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>",
+    ]
+    out = bytearray(b"%PDF-1.4\n")
+    offsets = []
+    for i, body in enumerate(objects, start=1):
+        offsets.append(len(out))
+        out += f"{i} 0 obj\n".encode() + body + b"\nendobj\n"
+    xref = len(out)
+    out += f"xref\n0 {len(objects) + 1}\n".encode() + b"0000000000 65535 f \n"
+    for offset in offsets:
+        out += f"{offset:010d} 00000 n \n".encode()
+    out += f"trailer\n<< /Size {len(objects) + 1} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n".encode()
+    return bytes(out)
+
+
+# ------------------------------------------------------------------ PDF
+
+
+def test_pdf_is_detected_by_magic_bytes_not_just_the_header():
+    # Servers mislabel PDFs as text/html constantly.
+    assert looks_like_pdf("text/html", b"%PDF-1.7\n...") is True
+    assert looks_like_pdf("application/pdf", b"") is True
+    assert looks_like_pdf("text/html", b"<!doctype html>") is False
+
+
+def test_a_real_pdf_yields_its_text_not_its_bytes():
+    raw = p_minimal_pdf("Attention Is All You Need")
+    out = body_to_text("application/pdf", raw, raw.decode("latin-1"))
+    assert out.kind == "pdf"
+    assert "Attention Is All You Need" in out.text
+    assert "%PDF" not in out.text
+
+
+def test_a_pdf_with_no_text_layer_says_so_instead_of_dumping_it():
+    fake = b"%PDF-1.4\n" + b"\x00\x01\x02" * 500
+    out = body_to_text("application/pdf", fake, "ignored")
+    assert out.kind == "pdf_unreadable"
+    assert "no extractable text layer" in out.text
+    assert "\x00" not in out.text
+
+
+def test_extract_returns_none_rather_than_raising_on_garbage():
+    assert extract_pdf_text(b"not a pdf at all") is None
+
+
+def test_page_cap_is_bounded():
+    assert 0 < MAX_PDF_PAGES <= 500
+
+
+# ------------------------------------------------------------------ other binaries
+
+
+def test_an_image_is_refused_with_a_description_not_its_bytes():
+    png = b"\x89PNG\r\n\x1a\n" + bytes(range(256)) * 40
+    out = body_to_text("image/png", png, png.decode("latin-1"))
+    assert out.kind == "binary"
+    assert "image/png" in out.text
+    assert "\x89PNG" not in out.text
+    assert len(out.text) < 400
+
+
+def test_json_and_plain_text_still_pass_through_verbatim():
+    payload = '{"stars": 68000, "name": "cpython"}'
+    out = body_to_text("application/json", payload.encode(), payload)
+    assert out.kind == "text"
+    assert out.text == payload
+
+
+def test_mislabelled_text_is_still_treated_as_text():
+    # application/octet-stream on a plain-text file is common; the bytes get the final say.
+    payload = "name,value\nalpha,1\nbeta,2\n"
+    out = body_to_text("application/octet-stream", payload.encode(), payload)
+    assert out.kind == "text"
+    assert out.text == payload
+
+
+# ------------------------------------------------------------------ wayback
+
+
+def p_wayback_reply(monkeypatch, status: int, text: str, url: str):
+    async def p_req(target, **kw):
+        return HttpReply(status=status, text=text, content=text.encode(),
+                         content_type="text/html", url=url)
+    monkeypatch.setattr(WB, "browser_request", p_req)
+
+
+P_ARCHIVED = "<html><body><article>" + ("The original article text. " * 40) + "</article></body></html>"
+
+
+def test_snapshot_date_is_read_from_the_archive_url():
+    assert snapshot_date("https://web.archive.org/web/20260728200922/https://x.example/") == "2026-07-28"
+    assert snapshot_date("https://web.archive.org/web/2/https://x.example/") is None
+
+
+@pytest.mark.asyncio
+async def test_a_dead_link_is_answered_from_the_archive(monkeypatch):
+    p_wayback_reply(monkeypatch, 200, P_ARCHIVED,
+                    "https://web.archive.org/web/20260508082837/https://gone.example/post")
+    out = await fetch_wayback("https://gone.example/post")
+    assert out is not None
+    assert "The original article text." in out
+    # the model must know it is reading a snapshot, and from when
+    assert "2026-05-08" in out
+    assert "Archived copy" in out
+
+
+@pytest.mark.asyncio
+async def test_no_snapshot_reads_as_no_answer(monkeypatch):
+    p_wayback_reply(monkeypatch, 404, "not archived",
+                    "https://web.archive.org/web/2/https://gone.example/post")
+    assert await fetch_wayback("https://gone.example/post") is None
+
+
+@pytest.mark.asyncio
+async def test_a_stub_snapshot_is_not_passed_off_as_the_page(monkeypatch):
+    p_wayback_reply(monkeypatch, 200, "<html><body>tiny</body></html>",
+                    "https://web.archive.org/web/20260101000000/https://x.example/")
+    assert await fetch_wayback("https://x.example/") is None
+
+
+@pytest.mark.asyncio
+async def test_a_redirect_off_the_archive_is_refused(monkeypatch):
+    """We hand the archive a caller-supplied URL, so we confirm where we landed."""
+    p_wayback_reply(monkeypatch, 200, P_ARCHIVED, "http://127.0.0.1:8324/api/settings")
+    assert await fetch_wayback("https://x.example/") is None
diff --git a/backend/tests/test_web_fetch_cascade.py b/backend/tests/test_web_fetch_cascade.py
new file mode 100644
index 00000000..a7ff75d0
--- /dev/null
+++ b/backend/tests/test_web_fetch_cascade.py
@@ -0,0 +1,124 @@
+"""Deadline-bounded /api/web/fetch cascade.
+
+Mirrors /search: the local httpx + trafilatura read is the fast path, the
+packaged browser and the Wayback archive cover JS walls and dead links, and the
+grounded fetchers are the last resort. A body with no text layer at all stops
+the chain rather than buying a paid summary of nothing.
+"""
+
+import time
+
+import pytest
+
+import backend.apps.agents.tools.fetch.wayback as WB
+import backend.apps.web.web as W
+from backend.apps.agents.tools.fetch.page_text import PageText
+from backend.apps.agents.tools.web import WebFetchTool
+from backend.apps.web.web import fetch, FetchBody
+from backend.tests.web_cascade_fixtures import (  # noqa: F401
+    allow_urls,
+    patch_browser_bridge,
+    no_network,
+)
+
+
+def p_local_returns(monkeypatch, text, kind="html"):
+    async def p_fetch(url, prompt=None):
+        return PageText(text=text, kind=kind)
+    monkeypatch.setattr(WebFetchTool, "fetch_page", staticmethod(p_fetch))
+
+
+
+@pytest.mark.asyncio
+async def test_fetch_local_first_wins_and_is_fast(monkeypatch):
+    big = "Contents of https://x.example:\n\n" + ("real article body " * 50)
+    p_local_returns(monkeypatch, big)
+    async def p_boom(*a, **k):
+        raise AssertionError("grounded fetch should not run when local has content")
+    monkeypatch.setattr(W, "gemini_grounded_call", p_boom)
+
+    t = time.monotonic()
+    res = await fetch(FetchBody(url="https://x.example"))
+    assert res["backend"] == "local"
+    assert "real article body" in res["content"]
+    assert time.monotonic() - t < 1.0
+
+
+@pytest.mark.asyncio
+async def test_fetch_thin_local_falls_to_grounded(monkeypatch):
+    p_local_returns(monkeypatch, "Contents of https://spa.example:\n\n")  # JS wall, empty body
+    monkeypatch.setattr(W, "resolve_gemini_api_key", lambda: "gkey")
+    async def p_gem(api_key, prompt, *, use_url_context):
+        return {"text": "rendered page text from grounding", "chunks": []}
+    monkeypatch.setattr(W, "gemini_grounded_call", p_gem)
+
+    res = await fetch(FetchBody(url="https://spa.example"))
+    assert res["backend"] == "gemini_native"
+    assert "rendered page text" in res["content"]
+
+
+@pytest.mark.asyncio
+async def test_fetch_local_error_returned_as_last_resort(monkeypatch):
+    p_local_returns(monkeypatch, "HTTP error 403 fetching https://blocked.example", kind="error")
+    # no grounded keys/subs (autouse fixtures) -> all grounded skip/fail
+    res = await fetch(FetchBody(url="https://blocked.example"))
+    assert res["backend"] == "local"
+    assert "HTTP error 403" in res["content"]
+
+
+@pytest.mark.asyncio
+async def test_fetch_falls_to_the_archive_when_the_live_page_is_gone(monkeypatch):
+    """A dead link is exactly what the archive is for; the real text beats a grounded summary of nothing."""
+    p_local_returns(monkeypatch, "HTTP error 404 fetching https://gone.example/post")
+
+    async def p_snapshot(url):
+        return "Archived copy of https://gone.example/post (Wayback Machine snapshot from 2026-05-08)\n\nThe original text."
+    monkeypatch.setattr(WB, "fetch_wayback", p_snapshot)
+
+    async def p_boom(*a, **k):
+        raise AssertionError("a paid fetcher must not run once the archive answered")
+    monkeypatch.setattr(W, "gemini_grounded_call", p_boom)
+
+    res = await fetch(FetchBody(url="https://gone.example/post"))
+    assert res["backend"] == "wayback"
+    assert "The original text." in res["content"]
+
+
+@pytest.mark.asyncio
+async def test_browser_fetch_tier_fires_when_local_thin(monkeypatch):
+    p_local_returns(monkeypatch, "Contents of x:\n\ntiny")  # <200 chars -> try_local returns None
+    patch_browser_bridge(monkeypatch, {"title": "T", "text": "the full rendered article body " * 20, "url": "https://x.example"})
+
+    res = await fetch(FetchBody(url="https://x.example"))
+    assert res["backend"] == "browser"
+    assert "rendered article" in res["content"]
+
+
+@pytest.mark.asyncio
+async def test_an_unreadable_binary_stops_the_cascade_instead_of_buying_a_summary(monkeypatch):
+    """A PNG has no text for ANY tier to find; spending a paid fetcher on it buys nothing."""
+    p_local_returns(monkeypatch, "This URL is not a readable document: image/png, 219 KB of binary data.",
+                    kind="binary")
+    monkeypatch.setattr(W, "resolve_gemini_api_key", lambda: "gkey")
+
+    async def p_boom(*a, **k):
+        raise AssertionError("a paid fetcher must never be spent on a body with no text layer")
+    monkeypatch.setattr(W, "gemini_grounded_call", p_boom)
+
+    res = await fetch(FetchBody(url="https://x.example/photo.png"))
+    assert res["backend"] == "local"
+    assert "image/png" in res["content"]
+
+
+@pytest.mark.asyncio
+async def test_a_scanned_pdf_also_stops_the_cascade(monkeypatch):
+    p_local_returns(monkeypatch, "This URL is a PDF (4 MB) with no extractable text layer.",
+                    kind="pdf_unreadable")
+    monkeypatch.setattr(W, "resolve_gemini_api_key", lambda: "gkey")
+
+    async def p_boom(*a, **k):
+        raise AssertionError("a scanned PDF is not worth a paid fetcher either")
+    monkeypatch.setattr(W, "gemini_grounded_call", p_boom)
+
+    res = await fetch(FetchBody(url="https://x.example/scan.pdf"))
+    assert res["backend"] == "local"
diff --git a/backend/tests/test_web_fetch_reachability.py b/backend/tests/test_web_fetch_reachability.py
new file mode 100644
index 00000000..4db293f4
--- /dev/null
+++ b/backend/tests/test_web_fetch_reachability.py
@@ -0,0 +1,98 @@
+"""A dead domain is an archive lookup, not a security refusal.
+
+Measured: fetching a domain with no DNS records returned HTTP 400 "Refused:
+DNS resolution failed", which reads like we blocked it AND short-circuited the
+cascade before the Wayback tier, which exists for exactly that case. These pin
+the split: unresolvable falls through, forbidden ranges still 400.
+"""
+
+import httpx
+import pytest
+
+import backend.apps.agents.tools.fetch.wayback as WB
+import backend.apps.agents.tools.ssrf_guard as SG
+from backend.apps.agents.tools.ssrf_guard import DomainUnreachable, SSRFBlocked, safe_fetch
+from backend.apps.agents.tools.web import WebFetchTool
+from backend.apps.web.web import FetchBody, fetch
+from backend.tests.web_cascade_fixtures import *  # noqa: F401,F403
+
+
+def p_unresolvable(monkeypatch):
+    async def p_dns_dead(url):
+        raise DomainUnreachable("nowhere.invalid could not be resolved (dead domain, typo, or no network)")
+    monkeypatch.setattr(SG, "assert_safe_url", p_dns_dead)
+
+
+def test_domain_unreachable_is_an_ssrf_blocked_subclass():
+    """Every existing `except SSRFBlocked` must keep failing closed on it."""
+    assert issubclass(DomainUnreachable, SSRFBlocked)
+
+
+@pytest.mark.asyncio
+async def test_dead_domain_reaches_the_archive(monkeypatch):
+    p_unresolvable(monkeypatch)
+
+    async def p_snapshot(url):
+        return "Archived copy of the dead site\n\n" + "real archived text. " * 40
+    monkeypatch.setattr(WB, "fetch_wayback", p_snapshot)
+
+    out = await fetch(FetchBody(url="https://nowhere.invalid/page"))
+    assert out["backend"] == "wayback"
+    assert "real archived text" in out["content"]
+
+
+@pytest.mark.asyncio
+async def test_dead_domain_without_a_snapshot_says_unreachable_not_refused(monkeypatch):
+    p_unresolvable(monkeypatch)
+    out = await fetch(FetchBody(url="https://nowhere.invalid/page"))
+    assert "Could not reach" in out["content"]
+    assert "Refused" not in out["content"]
+
+
+@pytest.mark.asyncio
+async def test_forbidden_range_still_gets_a_hard_refusal(monkeypatch):
+    from fastapi import HTTPException
+
+    async def p_blocked(url):
+        raise SSRFBlocked("URL host 169.254.169.254 is in a blocked range.")
+    monkeypatch.setattr(SG, "assert_safe_url", p_blocked)
+
+    with pytest.raises(HTTPException) as exc:
+        await fetch(FetchBody(url="http://169.254.169.254/latest/meta-data/"))
+    assert exc.value.status_code == 400
+    assert "Refused" in str(exc.value.detail)
+
+
+@pytest.mark.asyncio
+async def test_fetch_page_reports_unreachable_as_error_kind(monkeypatch):
+    p_unresolvable(monkeypatch)
+    page = await WebFetchTool.fetch_page("https://nowhere.invalid/page")
+    assert page.kind == "error"
+    assert "Could not reach" in page.text
+
+
+@pytest.mark.asyncio
+async def test_oversized_body_is_capped_not_buffered(monkeypatch):
+    """A link to a disk image must not pull gigabytes into RAM before we truncate to 250KB."""
+    served = {"bytes": 0}
+
+    class p_HugeStream(httpx.AsyncByteStream):
+        async def __aiter__(self):
+            for _ in range(500):
+                served["bytes"] += 100_000
+                yield b"x" * 100_000
+
+        async def aclose(self) -> None:
+            return None
+
+    async def p_send(self, request, **kw):
+        return httpx.Response(200, headers={"content-type": "text/plain"}, stream=p_HugeStream())
+    monkeypatch.setattr(httpx.AsyncClient, "send", p_send)
+
+    async def p_ok(url):
+        return url
+    monkeypatch.setattr(SG, "assert_safe_url", p_ok)
+
+    resp = await safe_fetch("https://example.com/huge.bin", max_bytes=250_000)
+    assert len(resp.content) == 250_000
+    assert served["bytes"] < 50_000_000, "the stream must stop early, not download the whole file"
diff --git a/backend/tests/test_web_search_cascade.py b/backend/tests/test_web_search_cascade.py
index bddc88c4..2654cf0a 100644
--- a/backend/tests/test_web_search_cascade.py
+++ b/backend/tests/test_web_search_cascade.py
@@ -1,9 +1,8 @@
-"""Fast-first, bounded web-search cascade (/api/web/search).
+"""Fast-first, deadline-bounded /api/web/search cascade.
 
-Pins the behaviour that fixes the ~75s stall and the human-speed goal:
-  - DuckDuckGo is tried FIRST and short-circuits the chain when it has results.
-  - When DDG is throttled, the chain falls over to the grounded backends.
-  - Every attempt is wait_for-bounded, so a hung provider can't stall the request.
+  - The free keyless engines are tried FIRST and short-circuit the chain.
+  - One engine's bot challenge falls over to the other, then to the grounded backends.
+  - Every attempt is bounded, so a hung provider can't stall the request.
   - The `primary` hint reorders only the grounded tier.
   - When everything fails we return an honest message, not a bogus empty result.
 
@@ -17,45 +16,29 @@ import pytest
 
 import backend.apps.web.web as W
 from backend.apps.web.web import search, SearchBody
-from backend.apps.agents.tools.web import WebSearchTool, DDGRateLimited
+from backend.tests.web_cascade_fixtures import (  # noqa: F401
+    allow_urls,
+    fresh_breaker,
+    patch_browser_bridge,
+    ddg_returns,
+    ddg_throttled,
+    no_network,
+    startpage_refuses,
+    startpage_returns,
+)
 
 
-@pytest.fixture(autouse=True)
-def p_no_network(monkeypatch):
-    # Default everything to "unavailable / no network"; each test opts paths in.
-    monkeypatch.setattr(W, "p_resolve_gemini_api_key", lambda: None)
-    monkeypatch.setattr(W, "p_resolve_openai_api_key", lambda: None)
-
-    async def p_no_subs():
-        return set()
-    monkeypatch.setattr(W, "p_refresh_9r_connected", p_no_subs)
-
-    async def p_empty(*a, **k):
-        return {}
-    # subscription helpers hit localhost:20128 otherwise
-    monkeypatch.setattr(W, "p_gemini_grounded_via_9router", p_empty)
-    monkeypatch.setattr(W, "p_openai_websearch_via_9router", p_empty)
 
 
-def p_ddg_returns(monkeypatch, text):
-    async def p_f(query, num):
-        return text
-    monkeypatch.setattr(WebSearchTool, "search_ddg", staticmethod(p_f))
-
-
-def p_ddg_throttled(monkeypatch):
-    async def p_f(query, num):
-        raise DDGRateLimited(query)
-    monkeypatch.setattr(WebSearchTool, "search_ddg", staticmethod(p_f))
 
 
 @pytest.mark.asyncio
 async def test_ddg_is_tried_first_and_wins(monkeypatch):
-    p_ddg_returns(monkeypatch, "[1] Foo\n    https://foo.example")
+    ddg_returns(monkeypatch, "[1] Foo\n    https://foo.example")
     # grounded would raise if reached; prove it isn't
     async def p_boom(*a, **k):
         raise AssertionError("grounded should not be called when DDG has results")
-    monkeypatch.setattr(W, "p_gemini_grounded_call", p_boom)
+    monkeypatch.setattr(W, "gemini_grounded_call", p_boom)
 
     t = time.monotonic()
     res = await search(SearchBody(query="foo"))
@@ -67,12 +50,12 @@ async def test_ddg_is_tried_first_and_wins(monkeypatch):
 
 @pytest.mark.asyncio
 async def test_ddg_throttled_falls_over_to_openai(monkeypatch):
-    p_ddg_throttled(monkeypatch)
-    monkeypatch.setattr(W, "p_resolve_openai_api_key", lambda: "okey")
+    ddg_throttled(monkeypatch)
+    monkeypatch.setattr(W, "resolve_openai_api_key", lambda: "okey")
 
     async def p_openai(api_key, query):
         return {"text": "grounded answer", "chunks": [("Title", "https://u.example")]}
-    monkeypatch.setattr(W, "p_openai_websearch", p_openai)
+    monkeypatch.setattr(W, "openai_websearch", p_openai)
 
     res = await search(SearchBody(query="x"))
     assert res["backend"] == "openai_native"
@@ -81,15 +64,31 @@ async def test_ddg_throttled_falls_over_to_openai(monkeypatch):
     assert any("ddg" in e for e in res.get("cascade_errors", []))
 
 
+@pytest.mark.asyncio
+async def test_startpage_rescues_a_ddg_challenge(monkeypatch):
+    """Two independent engines: one operator's bot challenge must not close free search."""
+    ddg_throttled(monkeypatch)
+    startpage_returns(monkeypatch, "[1] Rescued\n    https://sp.example")
+
+    async def p_boom(*a, **k):
+        raise AssertionError("a paid backend must not run while a free engine still answers")
+    monkeypatch.setattr(W, "gemini_grounded_call", p_boom)
+
+    res = await search(SearchBody(query="x"))
+    assert res["backend"] == "startpage"
+    assert "sp.example" in res["results"]
+    assert any("ddg" in e for e in res["cascade_errors"])
+
+
 @pytest.mark.asyncio
 async def test_a_hung_grounded_attempt_is_bounded(monkeypatch):
-    p_ddg_throttled(monkeypatch)
-    monkeypatch.setattr(W, "P_GROUNDED_ATTEMPT_TIMEOUT", 0.3)
-    monkeypatch.setattr(W, "p_resolve_gemini_api_key", lambda: "gkey")
+    ddg_throttled(monkeypatch)
+    monkeypatch.setattr(W, "GROUNDED_TIER_SECONDS", 0.3)
+    monkeypatch.setattr(W, "resolve_gemini_api_key", lambda: "gkey")
 
     async def p_hangs(*a, **k):
         await asyncio.sleep(30)
-    monkeypatch.setattr(W, "p_gemini_grounded_call", p_hangs)
+    monkeypatch.setattr(W, "gemini_grounded_call", p_hangs)
 
     t = time.monotonic()
     res = await search(SearchBody(query="x"))
@@ -101,16 +100,16 @@ async def test_a_hung_grounded_attempt_is_bounded(monkeypatch):
 
 @pytest.mark.asyncio
 async def test_primary_openai_reorders_grounded_tier(monkeypatch):
-    p_ddg_throttled(monkeypatch)
-    monkeypatch.setattr(W, "p_resolve_gemini_api_key", lambda: "gkey")
-    monkeypatch.setattr(W, "p_resolve_openai_api_key", lambda: "okey")
+    ddg_throttled(monkeypatch)
+    monkeypatch.setattr(W, "resolve_gemini_api_key", lambda: "gkey")
+    monkeypatch.setattr(W, "resolve_openai_api_key", lambda: "okey")
 
     async def p_gem(*a, **k):
         return {"text": "GEM", "chunks": [("g", "https://gem.example")]}
     async def p_oai(api_key, query):
         return {"text": "OAI", "chunks": [("o", "https://oai.example")]}
-    monkeypatch.setattr(W, "p_gemini_grounded_call", p_gem)
-    monkeypatch.setattr(W, "p_openai_websearch", p_oai)
+    monkeypatch.setattr(W, "gemini_grounded_call", p_gem)
+    monkeypatch.setattr(W, "openai_websearch", p_oai)
 
     res = await search(SearchBody(query="x", primary="openai"))
     # openai must be tried before gemini when it's the primary
@@ -120,7 +119,7 @@ async def test_primary_openai_reorders_grounded_tier(monkeypatch):
 
 @pytest.mark.asyncio
 async def test_everything_fails_is_honest_not_empty(monkeypatch):
-    p_ddg_throttled(monkeypatch)  # no keys, no subs (from fixture)
+    ddg_throttled(monkeypatch)  # no keys, no subs (from fixture)
     res = await search(SearchBody(query="obscure thing"))
     assert res["backend"] == "none"
     assert "obscure thing" in res["results"]
@@ -131,12 +130,12 @@ async def test_everything_fails_is_honest_not_empty(monkeypatch):
 @pytest.mark.asyncio
 async def test_everything_fails_nudges_browser_not_retry(monkeypatch):
     # All-fail must hand the model the browser as an escape hatch, not a dead-end "wait and retry".
-    p_ddg_throttled(monkeypatch)
-    monkeypatch.setattr(W, "p_resolve_openai_api_key", lambda: "okey")  # configured but errors
+    ddg_throttled(monkeypatch)
+    monkeypatch.setattr(W, "resolve_openai_api_key", lambda: "okey")  # configured but errors
 
     async def p_openai_boom(*a, **k):
         raise RuntimeError("openai down")
-    monkeypatch.setattr(W, "p_openai_websearch", p_openai_boom)
+    monkeypatch.setattr(W, "openai_websearch", p_openai_boom)
 
     res = await search(SearchBody(query="sony zv-e10 price", browser_ok=True))
     assert res["backend"] == "none"
@@ -147,12 +146,12 @@ async def test_everything_fails_nudges_browser_not_retry(monkeypatch):
 @pytest.mark.asyncio
 async def test_nudge_suppressed_when_browser_denied(monkeypatch):
     # A session without browser-delegation tools must never be told to call CreateBrowserAgent.
-    p_ddg_throttled(monkeypatch)
-    monkeypatch.setattr(W, "p_resolve_openai_api_key", lambda: "okey")
+    ddg_throttled(monkeypatch)
+    monkeypatch.setattr(W, "resolve_openai_api_key", lambda: "okey")
 
     async def p_openai_boom(*a, **k):
         raise RuntimeError("openai down")
-    monkeypatch.setattr(W, "p_openai_websearch", p_openai_boom)
+    monkeypatch.setattr(W, "openai_websearch", p_openai_boom)
 
     res = await search(SearchBody(query="sony zv-e10 price"))
     assert res["backend"] == "none"
@@ -160,80 +159,16 @@ async def test_nudge_suppressed_when_browser_denied(monkeypatch):
     assert "retry" not in res["results"].lower()
 
 
-# -------------------------------------------------------------------------- /fetch mirrors /search: local httpx + trafilatura is the fast path, grounded fetchers are the fallback for JS/paywalled pages, every attempt is bounded. --------------------------------------------------------------------------
-
-from backend.apps.web.web import fetch, FetchBody
-from backend.apps.agents.tools.web import WebFetchTool
-import backend.apps.agents.tools.ssrf_guard as p_ssrf
-
-
-@pytest.fixture(autouse=True)
-def p_allow_urls(monkeypatch):
-    async def p_ok(url):
-        return None
-    monkeypatch.setattr(p_ssrf, "assert_safe_url", p_ok)
-
-
-def p_local_returns(monkeypatch, text):
-    async def p_exec(self, input_data, context):
-        return [{"type": "text", "text": text}]
-    monkeypatch.setattr(WebFetchTool, "execute", p_exec)
-
-
-@pytest.mark.asyncio
-async def test_fetch_local_first_wins_and_is_fast(monkeypatch):
-    big = "Contents of https://x.example:\n\n" + ("real article body " * 50)
-    p_local_returns(monkeypatch, big)
-    async def p_boom(*a, **k):
-        raise AssertionError("grounded fetch should not run when local has content")
-    monkeypatch.setattr(W, "p_gemini_grounded_call", p_boom)
-
-    t = time.monotonic()
-    res = await fetch(FetchBody(url="https://x.example"))
-    assert res["backend"] == "local"
-    assert "real article body" in res["content"]
-    assert time.monotonic() - t < 1.0
-
-
-@pytest.mark.asyncio
-async def test_fetch_thin_local_falls_to_grounded(monkeypatch):
-    p_local_returns(monkeypatch, "Contents of https://spa.example:\n\n")  # JS wall, empty body
-    monkeypatch.setattr(W, "p_resolve_gemini_api_key", lambda: "gkey")
-    async def p_gem(api_key, prompt, *, use_url_context):
-        return {"text": "rendered page text from grounding", "chunks": []}
-    monkeypatch.setattr(W, "p_gemini_grounded_call", p_gem)
-
-    res = await fetch(FetchBody(url="https://spa.example"))
-    assert res["backend"] == "gemini_native"
-    assert "rendered page text" in res["content"]
-
-
-@pytest.mark.asyncio
-async def test_fetch_local_error_returned_as_last_resort(monkeypatch):
-    p_local_returns(monkeypatch, "HTTP error 403 fetching https://blocked.example")
-    # no grounded keys/subs (autouse fixtures) -> all grounded skip/fail
-    res = await fetch(FetchBody(url="https://blocked.example"))
-    assert res["backend"] == "local"
-    assert "HTTP error 403" in res["content"]
-
-
 # --- packaged-browser tier: fires when DDG throttles, skipped when no bridge ---
 
-def p_browser_bridge(monkeypatch, result):
-    """Patch the offscreen-browser bridge helper; result=None simulates 'no Electron main bridge connected'."""
-    async def p_f(action, params):
-        return result
-    monkeypatch.setattr(W, "p_browser_bridge", p_f)
-
-
 @pytest.mark.asyncio
 async def test_browser_search_tier_fires_when_ddg_throttled(monkeypatch):
-    p_ddg_throttled(monkeypatch)
-    p_browser_bridge(monkeypatch, {"engine": "ddg", "results": "[1] Real\n    https://real.example", "count": 1})
+    ddg_throttled(monkeypatch)
+    patch_browser_bridge(monkeypatch, {"engine": "ddg", "results": "[1] Real\n    https://real.example", "count": 1})
 
     async def p_boom(*a, **k):
         raise AssertionError("grounded should not be reached once the browser tier answers")
-    monkeypatch.setattr(W, "p_gemini_grounded_call", p_boom)
+    monkeypatch.setattr(W, "gemini_grounded_call", p_boom)
 
     res = await search(SearchBody(query="q"))
     assert res["backend"] == "browser_ddg"
@@ -243,28 +178,61 @@ async def test_browser_search_tier_fires_when_ddg_throttled(monkeypatch):
 @pytest.mark.asyncio
 async def test_browser_search_skipped_when_no_bridge(monkeypatch):
     # DDG throttled, no browser bridge -> must fall THROUGH to grounded, not crash.
-    p_ddg_throttled(monkeypatch)
-    p_browser_bridge(monkeypatch, None)
-    monkeypatch.setattr(W, "p_resolve_openai_api_key", lambda: "okey")
+    ddg_throttled(monkeypatch)
+    patch_browser_bridge(monkeypatch, None)
+    monkeypatch.setattr(W, "resolve_openai_api_key", lambda: "okey")
 
     async def p_openai(api_key, query):
         return {"text": "grounded", "chunks": [("T", "https://u.example")]}
-    monkeypatch.setattr(W, "p_openai_websearch", p_openai)
+    monkeypatch.setattr(W, "openai_websearch", p_openai)
 
     res = await search(SearchBody(query="q"))
     assert res["backend"] == "openai_native"
 
 
 @pytest.mark.asyncio
-async def test_browser_fetch_tier_fires_when_local_thin(monkeypatch):
-    from backend.apps.web.web import fetch, FetchBody
-    from backend.apps.agents.tools.web import WebFetchTool
+async def test_a_refusing_startpage_counts_against_it(monkeypatch):
+    """A challenge and a genuinely empty web look identical on the wire, and treating a
+    refusal as 'no hits' meant a closed Startpage kept costing its full budget forever."""
+    from backend.apps.web.tier_breaker import FAILURES_TO_OPEN, tier_cooldown_left
+    ddg_throttled(monkeypatch)
+    startpage_refuses(monkeypatch)
+    for _ in range(FAILURES_TO_OPEN):
+        out = await search(SearchBody(query="anything", num_results=5))
+        assert out["backend"] == "none"
+    assert tier_cooldown_left("startpage") > 0
+    assert any("challenge" in e for e in out["cascade_errors"])
 
-    async def p_thin(self, input_data, context):
-        return [{"type": "text", "text": "Contents of x:\n\ntiny"}]  # <200 chars -> try_local returns None
-    monkeypatch.setattr(WebFetchTool, "execute", p_thin)
-    p_browser_bridge(monkeypatch, {"title": "T", "text": "the full rendered article body " * 20, "url": "https://x.example"})
 
-    res = await fetch(FetchBody(url="https://x.example"))
-    assert res["backend"] == "browser"
-    assert "rendered article" in res["content"]
+@pytest.mark.asyncio
+async def test_an_honestly_empty_startpage_does_not_count_against_it(monkeypatch):
+    """Nonsense queries must not slowly cool down a perfectly healthy engine."""
+    from backend.apps.web.tier_breaker import FAILURES_TO_OPEN, tier_cooldown_left
+    ddg_throttled(monkeypatch)
+    for _ in range(FAILURES_TO_OPEN + 2):
+        out = await search(SearchBody(query="zxqvbnmklwertyuiopasdfg", num_results=5))
+        assert out["backend"] == "none"
+    assert tier_cooldown_left("startpage") == 0.0
+
+
+@pytest.mark.asyncio
+async def test_a_genuinely_empty_search_does_not_claim_an_outage(monkeypatch):
+    """Both engines answering 'no matches' is an answer; calling it a refusal sends the model
+    hunting for an outage that isn't there."""
+    ddg_returns(monkeypatch, "")
+    startpage_returns(monkeypatch, "")
+    out = await search(SearchBody(query="xyzzyplughnothinghere1234567", num_results=5))
+    assert out["backend"] == "none"
+    assert "had no matches" in out["results"]
+    assert "refused" not in out["results"]
+    assert not out.get("cascade_errors")
+
+
+@pytest.mark.asyncio
+async def test_a_real_outage_still_says_so(monkeypatch):
+    ddg_throttled(monkeypatch)
+    startpage_refuses(monkeypatch)
+    out = await search(SearchBody(query="capital of Burkina Faso", num_results=5))
+    assert out["backend"] == "none"
+    assert "refused" in out["results"]
+    assert out["cascade_errors"]
diff --git a/backend/tests/test_web_search_ddg.py b/backend/tests/test_web_search_ddg.py
index 05c8435e..53ff9ac7 100644
--- a/backend/tests/test_web_search_ddg.py
+++ b/backend/tests/test_web_search_ddg.py
@@ -1,47 +1,33 @@
-"""DuckDuckGo parsing robustness: rate-limit (202) and ad-row stripping.
+"""DuckDuckGo parsing robustness: bot challenge (202) and ad-row stripping.
 
 These pin the two bugs that turned DDG into a flaky 'No results found' source:
-  1. DDG serves its throttle challenge as HTTP 202 (a 2xx), so raise_for_status()
-     missed it and we parsed an empty page as a real empty result set.
+  1. DDG serves its bot challenge as HTTP 202 (a 2xx), so a status check missed
+     it and we parsed an empty page as a real empty result set.
   2. Sponsored rows point at DDG's own y.js click-tracker (ad_domain/ad_provider)
      and were emitted as junk 'duckduckgo.com/y.js?...' results.
 
 We mock the network so the test is deterministic and offline.
 """
 
-import httpx
 import pytest
 
+import backend.apps.agents.tools.search.search_ddg as SD
+import backend.apps.agents.tools.search.search_ddg_lite as SDL
+from backend.apps.agents.tools.browser_http import HttpReply
 from backend.apps.agents.tools.web import WebSearchTool, DDGRateLimited
 
 
-class p_FakeResp:
-    def __init__(self, status_code: int, text: str):
-        self.status_code = status_code
-        self.text = text
-
-    def raise_for_status(self):
-        if self.status_code >= 400:
-            raise httpx.HTTPStatusError("err", request=None, response=None)
+def p_reply(status: int, text: str) -> HttpReply:
+    return HttpReply(status=status, text=text, content=text.encode(),
+                     content_type="text/html", url="https://duckduckgo.example")
 
 
-class p_FakeClient:
-    """Stands in for httpx.AsyncClient; returns a canned response."""
-    def __init__(self, resp: p_FakeResp):
-        self.p_resp = resp
-
-    async def __aenter__(self):
-        return self
-
-    async def __aexit__(self, *a):
-        return False
-
-    async def post(self, *a, **k):
-        return self.p_resp
-
-
-def p_patch_client(monkeypatch, resp: p_FakeResp):
-    monkeypatch.setattr(httpx, "AsyncClient", lambda *a, **k: p_FakeClient(resp))
+def p_patch_client(monkeypatch, reply: HttpReply):
+    """Mock the ONE seam every keyless rung goes through, whatever transport it picks."""
+    async def p_req(url, **kw):
+        return reply
+    monkeypatch.setattr(SD, "browser_request", p_req)
+    monkeypatch.setattr(SDL, "browser_request", p_req)
 
 
 # One real organic result + one sponsored (ad) row in DDG's html markup.
@@ -59,23 +45,26 @@ P_HTML_WITH_AD = """
 
 @pytest.mark.asyncio
 async def test_202_raises_rate_limited_not_empty(monkeypatch):
-    p_patch_client(monkeypatch, p_FakeResp(202, "<html>throttle challenge, no results</html>"))
+    p_patch_client(monkeypatch, p_reply(202, "<html>throttle challenge, no results</html>"))
     with pytest.raises(DDGRateLimited):
         await WebSearchTool.search_ddg("anything", 5)
 
 
 @pytest.mark.asyncio
-async def test_execute_reports_rate_limit_clearly(monkeypatch):
-    p_patch_client(monkeypatch, p_FakeResp(202, "throttle"))
+async def test_execute_names_the_real_cause_not_a_rate_limit(monkeypatch):
+    p_patch_client(monkeypatch, p_reply(202, "challenge"))
     parts = await WebSearchTool().execute({"query": "x", "num_results": 5}, None)
     msg = parts[0]["text"].lower()
-    assert "rate-limit" in msg
+    assert "bot challenge" in msg
     assert "no search results" not in msg  # the old bogus message must be gone
+    # It is a fingerprint challenge, not a cooldown, so we must not send the model off to wait.
+    assert "rate-limit" not in msg and "rate limit" not in msg
+    assert "wait" not in msg
 
 
 @pytest.mark.asyncio
 async def test_ads_are_stripped_real_results_kept(monkeypatch):
-    p_patch_client(monkeypatch, p_FakeResp(200, P_HTML_WITH_AD))
+    p_patch_client(monkeypatch, p_reply(200, P_HTML_WITH_AD))
     out = await WebSearchTool.search_ddg("topic", 5)
     assert "example.com/real" in out
     assert "Real Result Title" in out
@@ -88,6 +77,49 @@ async def test_ads_are_stripped_real_results_kept(monkeypatch):
 @pytest.mark.asyncio
 async def test_genuinely_empty_is_not_a_rate_limit(monkeypatch):
     # 200 with no result blocks is a real empty result set, not a throttle.
-    p_patch_client(monkeypatch, p_FakeResp(200, "<html><body>nothing here</body></html>"))
+    p_patch_client(monkeypatch, p_reply(200, "<html><body>nothing here</body></html>"))
     out = await WebSearchTool.search_ddg("zxcvqwer no hits", 5)
     assert out == ""
+
+
+P_LITE_RESULTS = """
+<table><tr><td><a href="https://example.org/lite" class="result-link">Lite Result</a></td></tr>
+<tr><td class="result-snippet">A snippet from the lite frontend.</td></tr></table>
+"""
+
+
+def p_patch_split(monkeypatch, html_reply: HttpReply, lite_reply: HttpReply):
+    """Let the two DDG frontends answer differently, which is the whole point of having both."""
+    async def p_html(url, **kw):
+        return html_reply
+
+    async def p_lite(url, **kw):
+        return lite_reply
+    monkeypatch.setattr(SD, "browser_request", p_html)
+    monkeypatch.setattr(SDL, "browser_request", p_lite)
+
+
+@pytest.mark.asyncio
+async def test_html_403_still_tries_lite(monkeypatch):
+    """Measured 7 times in one 44-query round: html escalates from 202 to 403, and the old
+    code raised on the status without ever asking the second frontend."""
+    p_patch_split(monkeypatch, p_reply(403, "blocked"), p_reply(200, P_LITE_RESULTS))
+    out = await WebSearchTool.search_ddg("topic", 5)
+    assert "example.org/lite" in out
+    assert "Lite Result" in out
+
+
+@pytest.mark.asyncio
+async def test_html_403_and_lite_challenged_is_the_bot_challenge(monkeypatch):
+    p_patch_split(monkeypatch, p_reply(403, "blocked"), p_reply(202, "challenge"))
+    with pytest.raises(DDGRateLimited):
+        await WebSearchTool.search_ddg("topic", 5)
+
+
+@pytest.mark.asyncio
+async def test_both_frontends_erroring_names_both(monkeypatch):
+    p_patch_split(monkeypatch, p_reply(403, "blocked"), p_reply(500, "boom"))
+    with pytest.raises(RuntimeError) as exc:
+        await WebSearchTool.search_ddg("topic", 5)
+    assert "403" in str(exc.value)
+    assert "lite" in str(exc.value).lower()
diff --git a/backend/tests/test_web_search_ddg_lite.py b/backend/tests/test_web_search_ddg_lite.py
index 41fc7485..4b779b04 100644
--- a/backend/tests/test_web_search_ddg_lite.py
+++ b/backend/tests/test_web_search_ddg_lite.py
@@ -12,11 +12,13 @@ Network is mocked; the lite fixture is the real markup shape captured live
 
 import asyncio
 
-import httpx
 import pytest
 
+import backend.apps.agents.tools.search.search_ddg as SD
+import backend.apps.agents.tools.search.search_ddg_lite as SDL
+from backend.apps.agents.tools.browser_http import HttpReply
 from backend.apps.agents.tools.web import WebSearchTool, DDGRateLimited
-from backend.apps.agents.tools.search_ddg_lite import parse_lite_results
+from backend.apps.agents.tools.search.search_ddg_lite import parse_lite_results
 
 P_LITE_BODY = """
 <table>
@@ -34,36 +36,20 @@ P_LITE_BODY = """
 P_HTML_202_BODY = "anomaly detected, challenge page"
 
 
-class p_FakeResp:
-    def __init__(self, status_code: int, text: str):
-        self.status_code = status_code
-        self.text = text
-
-    def raise_for_status(self):
-        if self.status_code >= 400:
-            raise httpx.HTTPStatusError("err", request=None, response=None)
-
-
-class p_RoutedClient:
-    """Fake AsyncClient that answers per-URL, so the html and lite endpoints can behave differently in one test."""
-    def __init__(self, routes: dict):
-        self.routes = routes
-
-    async def __aenter__(self):
-        return self
-
-    async def __aexit__(self, *a):
-        return False
-
-    async def post(self, url, *a, **k):
-        for key, resp in self.routes.items():
-            if key in url:
-                return resp
-        raise AssertionError(f"unexpected URL {url}")
+def p_FakeResp(status: int, text: str) -> HttpReply:
+    return HttpReply(status=status, text=text, content=text.encode(),
+                     content_type="text/html", url="https://duckduckgo.example")
 
 
 def p_route(monkeypatch, routes: dict):
-    monkeypatch.setattr(httpx, "AsyncClient", lambda *a, **k: p_RoutedClient(routes))
+    """Answer per-URL so the html and lite endpoints can behave differently in one test."""
+    async def p_req(url, **kw):
+        for key, reply in routes.items():
+            if key in url:
+                return reply
+        raise AssertionError(f"unexpected URL {url}")
+    monkeypatch.setattr(SD, "browser_request", p_req)
+    monkeypatch.setattr(SDL, "browser_request", p_req)
 
 
 def test_lite_parser_on_real_shape():
diff --git a/backend/tests/test_web_search_startpage.py b/backend/tests/test_web_search_startpage.py
new file mode 100644
index 00000000..a311ebd0
--- /dev/null
+++ b/backend/tests/test_web_search_startpage.py
@@ -0,0 +1,127 @@
+"""Startpage rung: the second independent engine behind DuckDuckGo.
+
+The fixture is the real markup shape captured live 2026-07-30: an inline
+<style> block INSIDE each result anchor, the title in an <h2>, volatile
+emotion CSS hashes in every class attribute, and a stray description
+paragraph that does not belong to any result block.
+"""
+
+import pytest
+
+import backend.apps.agents.tools.search.search_startpage as SP
+from backend.apps.agents.tools.browser_http import HttpReply
+from backend.apps.agents.tools.search.search_startpage import (
+    parse_startpage_results,
+    search_startpage,
+)
+
+P_BODY = """
+<div class="w-gl__result">
+<style data-emotion="css 1bggj8v">.css-1bggj8v{color:#2E39B3;}</style>
+<a class="result-title result-link css-1bggj8v" href="https://docs.python.org/3/library/asyncio.html"
+   rel="noopener nofollow" data-testid="gl-title-link">
+  <style data-emotion="css i3irj7">.css-i3irj7{font-size:18px;}</style>
+  <h2 class="wgl-title css-i3irj7">asyncio &mdash; Asynchronous I/O</h2>
+</a>
+<p class="description css-1507v2l">The <b>asyncio</b> library, explained.</p>
+</div>
+<div class="w-gl__result">
+<a class="result-title result-link css-zzz" href="https://realpython.com/async-io-python/"
+   data-testid="gl-title-link"><h2 class="wgl-title css-qqq">Real Python walkthrough</h2></a>
+<p class="description css-x">A hands-on tour.</p>
+</div>
+<p class="description css-orphan">Unrelated footer blurb, belongs to no result.</p>
+"""
+
+P_CHALLENGE_BODY = """
+<html><head><script id="anubis_challenge" type="application/json">{"difficulty":2}</script></head>
+<body><div class="sp-wrap">Making sure you are not a bot...</div></body></html>
+"""
+
+
+def p_reply(status: int, text: str) -> HttpReply:
+    return HttpReply(status=status, text=text, content=text.encode(),
+                     content_type="text/html", url="https://www.startpage.com/sp/search")
+
+
+def p_answer(monkeypatch, reply: HttpReply, seen=None):
+    async def p_req(url, **kw):
+        if seen is not None:
+            seen.append((url, kw.get("method"), kw.get("params")))
+        return reply
+    monkeypatch.setattr(SP, "browser_request", p_req)
+
+
+def test_parses_title_url_and_the_snippet_from_its_own_block():
+    out = parse_startpage_results(P_BODY, 5)
+    assert "[1] asyncio — Asynchronous I/O" in out
+    assert "https://docs.python.org/3/library/asyncio.html" in out
+    assert "The asyncio library, explained." in out
+    assert "[2] Real Python walkthrough" in out
+    assert "A hands-on tour." in out
+
+
+def test_inline_style_never_becomes_the_title():
+    """Tag-stripping alone would emit the anchor's own CSS as the result title."""
+    out = parse_startpage_results(P_BODY, 5)
+    assert "css-" not in out
+    assert "font-size" not in out
+
+
+def test_an_orphan_snippet_is_not_attached_to_a_result():
+    out = parse_startpage_results(P_BODY, 5)
+    assert "Unrelated footer blurb" not in out
+
+
+def test_respects_num_results():
+    out = parse_startpage_results(P_BODY, 1)
+    assert "[1]" in out and "[2]" not in out
+
+
+@pytest.mark.asyncio
+async def test_challenge_page_reads_as_refused_not_as_zero_hits(monkeypatch):
+    # Startpage answers its proof-of-work interstitial with a normal 200, so "parsed nothing" is the only honest signal.
+    p_answer(monkeypatch, p_reply(200, P_CHALLENGE_BODY))
+    answer = await search_startpage("q", 5)
+    assert answer.refused and not answer.results
+
+
+@pytest.mark.asyncio
+async def test_http_error_reads_as_refused(monkeypatch):
+    p_answer(monkeypatch, p_reply(503, "nope"))
+    assert (await search_startpage("q", 5)).refused
+
+
+@pytest.mark.asyncio
+async def test_must_post_or_startpage_serves_the_proof_of_work_wall(monkeypatch):
+    seen = []
+    p_answer(monkeypatch, p_reply(200, P_BODY), seen)
+    out = (await search_startpage("some query", 5)).results
+    assert out
+    url, method, params = seen[0]
+    assert url == "https://www.startpage.com/sp/search"
+    assert method == "POST"
+    assert params == {"query": "some query", "cat": "web"}
+
+
+P_NO_RESULTS_BODY = """
+<html><body><div><img src="https://cdn.startpage.com/sp/cdn/images/dislike-face.svg"/></div>
+<h2>Uh-oh, there are no results for this search.</h2>
+<p>Let&#x27;s see, it could be due to:</p></body></html>
+"""
+
+
+@pytest.mark.asyncio
+async def test_startpages_own_no_results_page_is_an_answer_not_a_refusal(monkeypatch):
+    """Nonsense queries must read as 'nothing matched', not as an engine that shut us out."""
+    p_answer(monkeypatch, p_reply(200, P_NO_RESULTS_BODY))
+    answer = await search_startpage("zxqvbnmklwertyuiopasdfg", 5)
+    assert not answer.refused
+    assert answer.results == ""
+
+
+@pytest.mark.asyncio
+async def test_unrecognised_markup_is_a_refusal_not_zero_hits(monkeypatch):
+    """If Startpage redesigns, we must fail loudly rather than report the web as empty."""
+    p_answer(monkeypatch, p_reply(200, "<html><body><div class=whatever>redesigned</div></body></html>"))
+    assert (await search_startpage("python", 5)).refused
diff --git a/backend/tests/test_workflows_storage.py b/backend/tests/test_workflows_storage.py
index 877d8333..42b8b1a4 100644
--- a/backend/tests/test_workflows_storage.py
+++ b/backend/tests/test_workflows_storage.py
@@ -11,9 +11,13 @@ Run:
 
 from __future__ import annotations
 
+import io
 import json
+import logging
 import os
+from contextlib import contextmanager
 from datetime import datetime, timedelta, timezone
+from typing import Iterator
 
 import pytest
 
@@ -23,6 +27,21 @@ def _wf_env(isolated_workflows_data):
     yield
 
 
+@contextmanager
+def p_storage_warnings() -> Iterator[io.StringIO]:
+    """Not caplog: backend/main.py pins propagate=False on the 'backend' logger, and
+    caplog listens at the root, so these records only exist if you sit on the logger itself."""
+    from backend.apps.workflows import storage
+    buf = io.StringIO()
+    handler = logging.StreamHandler(buf)
+    handler.setLevel(logging.WARNING)
+    storage.logger.addHandler(handler)
+    try:
+        yield buf
+    finally:
+        storage.logger.removeHandler(handler)
+
+
 # --- atomic write ------------------------------------------------------------
 
 def test_atomic_write_round_trips(tmp_path):
@@ -60,7 +79,7 @@ def test_atomic_write_leaves_no_temp_and_preserves_old_on_failure(monkeypatch):
 
 def test_corrupt_workflow_record_is_skipped_not_fatal(make_wf):
     """A truncated <id>.json must not take down the whole load; the bad record
-    silently drops out and the good ones still come back."""
+    drops out and the good ones still come back."""
     from backend.apps.workflows import storage
     good = make_wf(title="good")
     storage.save_workflow(good)
@@ -74,6 +93,37 @@ def test_corrupt_workflow_record_is_skipped_not_fatal(make_wf):
     assert "broken" not in ids
 
 
+def test_dropped_workflow_record_names_the_file_it_dropped(make_wf):
+    """The drop is what makes a workflow vanish from the UI with its file still
+    on disk. If it happens without naming the file, nobody can ever diagnose it."""
+    from backend.apps.workflows import storage
+    storage.save_workflow(make_wf(title="good"))
+    storage._ensure_dirs()
+    with open(os.path.join(storage.DATA_DIR, "broken.json"), "w") as f:
+        f.write('{"id": "broken", "title": "trunc')
+
+    storage._cache_loaded = False
+    with p_storage_warnings() as logged:
+        storage.list_workflows()
+    assert "broken.json" in logged.getvalue()
+
+
+def test_record_a_newer_build_wrote_is_reported_when_it_fails_to_load():
+    """Every Workflow field has a default, so unknown keys survive a downgrade
+    fine. A field whose VALUE the running build's schema rejects does not: the
+    record takes the same exit as a truncated file, and must say so."""
+    from backend.apps.workflows import storage
+    storage._ensure_dirs()
+    with open(os.path.join(storage.DATA_DIR, "fromfuture.json"), "w") as f:
+        json.dump({"id": "fromfuture", "execution_target": "orbital-relay"}, f)
+
+    storage._cache_loaded = False
+    with p_storage_warnings() as logged:
+        ids = {w.id for w in storage.list_workflows()}
+    assert "fromfuture" not in ids
+    assert "fromfuture.json" in logged.getvalue()
+
+
 def test_corrupt_runs_file_yields_empty_history(make_wf):
     from backend.apps.workflows import storage
     wf = make_wf()
diff --git a/backend/tests/test_workspace_path_containment.py b/backend/tests/test_workspace_path_containment.py
new file mode 100644
index 00000000..b427ebe9
--- /dev/null
+++ b/backend/tests/test_workspace_path_containment.py
@@ -0,0 +1,188 @@
+"""Workspace path containment for the Output file endpoints (issues #135, #136).
+
+#135: all four guards used `os.path.normpath`, which is pure string math and
+never resolves symlinks, so a symlink planted inside a workspace pointed the
+read/write/delete anywhere on disk.
+
+#136: `serve_workspace_file` and `seed_workspace` compared with a bare
+`startswith(folder)`, so a sibling folder whose name merely PREFIXES the
+workspace (`abc` vs `abc-evil`) sailed through a guard meant for `abc`.
+
+Run:
+    backend/.venv/bin/python -m pytest backend/tests/test_workspace_path_containment.py -v
+"""
+
+import asyncio
+import os
+from typing import Any, Dict
+
+import pytest
+from fastapi import HTTPException
+
+from backend.apps.outputs import outputs as outputs_mod
+from backend.apps.outputs.models import WorkspaceSeedRequest
+from backend.apps.outputs.workspace_io import resolve_in_workspace
+
+
+def p_run(coro: Any) -> Any:
+    return asyncio.new_event_loop().run_until_complete(coro)
+
+
+@pytest.fixture
+def workspace(monkeypatch: pytest.MonkeyPatch, tmp_path: Any) -> Dict[str, str]:
+    """A workspace root with one real workspace, a prefix-colliding sibling, and
+    an out-of-tree secret, wired into every endpoint under test."""
+    root = tmp_path / "workspaces"
+    (root / "abc").mkdir(parents=True)
+    (root / "abc-evil").mkdir()
+    (root / "abc" / "index.html").write_text("<html>hi</html>")
+    (root / "abc-evil" / "loot.txt").write_text("sibling loot")
+    outside = tmp_path / "outside"
+    outside.mkdir()
+    (outside / "secret.txt").write_text("top secret")
+    monkeypatch.setattr(outputs_mod, "WORKSPACE_DIR", str(root))
+    return {"root": str(root), "folder": str(root / "abc"), "outside": str(outside)}
+
+
+def p_symlink(target: str, link: str) -> None:
+    try:
+        os.symlink(target, link, target_is_directory=os.path.isdir(target))
+    except (OSError, NotImplementedError) as e:
+        pytest.skip(f"symlinks unavailable on this platform: {e}")
+
+
+# --- the resolver itself -----------------------------------------------------
+
+def test_plain_relative_path_resolves(workspace: Dict[str, str]) -> None:
+    got = resolve_in_workspace(workspace["folder"], "sub/dir/file.txt")
+    assert got == os.path.join(os.path.realpath(workspace["folder"]), "sub", "dir", "file.txt")
+
+
+def test_folder_itself_is_inside(workspace: Dict[str, str]) -> None:
+    assert resolve_in_workspace(workspace["folder"], "") == os.path.realpath(workspace["folder"])
+
+
+def test_dotdot_escape_is_rejected(workspace: Dict[str, str]) -> None:
+    assert resolve_in_workspace(workspace["folder"], "../../outside/secret.txt") is None
+
+
+def test_absolute_path_is_rejected(workspace: Dict[str, str]) -> None:
+    assert resolve_in_workspace(workspace["folder"], "/etc/hosts") is None
+
+
+def test_sibling_prefix_collision_is_rejected(workspace: Dict[str, str]) -> None:
+    """#136: `<root>/abc-evil/loot.txt` string-prefixes `<root>/abc`."""
+    assert resolve_in_workspace(workspace["folder"], "../abc-evil/loot.txt") is None
+
+
+def test_symlink_inside_workspace_is_rejected(workspace: Dict[str, str]) -> None:
+    """#135: normpath happily walks `esc` because it never resolves the link."""
+    p_symlink(workspace["outside"], os.path.join(workspace["folder"], "esc"))
+    assert resolve_in_workspace(workspace["folder"], "esc/secret.txt") is None
+
+
+def test_symlinked_file_inside_workspace_is_rejected(workspace: Dict[str, str]) -> None:
+    p_symlink(os.path.join(workspace["outside"], "secret.txt"),
+              os.path.join(workspace["folder"], "leak.txt"))
+    assert resolve_in_workspace(workspace["folder"], "leak.txt") is None
+
+
+def test_symlinked_workspace_root_is_not_false_rejected(tmp_path: Any) -> None:
+    """Both sides get realpath'd, so a symlinked ancestor (macOS /var ->
+    /private/var, every tempfile path) must not reject a legitimate file."""
+    real = tmp_path / "real_ws"
+    real.mkdir()
+    (real / "index.html").write_text("hi")
+    link = tmp_path / "linked_ws"
+    p_symlink(str(real), str(link))
+    got = resolve_in_workspace(str(link), "index.html")
+    assert got == os.path.join(os.path.realpath(str(real)), "index.html")
+
+
+def test_symlink_pointing_back_inside_is_allowed(workspace: Dict[str, str]) -> None:
+    """Containment, not a symlink ban: a link that stays in the workspace works."""
+    inner = os.path.join(workspace["folder"], "assets")
+    os.makedirs(inner)
+    p_symlink(inner, os.path.join(workspace["folder"], "static"))
+    assert resolve_in_workspace(workspace["folder"], "static/logo.svg") == os.path.join(
+        os.path.realpath(inner), "logo.svg"
+    )
+
+
+# --- the four endpoints that guard with it -----------------------------------
+
+def test_serve_rejects_symlink_escape(workspace: Dict[str, str]) -> None:
+    p_symlink(workspace["outside"], os.path.join(workspace["folder"], "esc"))
+    with pytest.raises(HTTPException) as e:
+        p_run(outputs_mod.serve_workspace_file("abc", "esc/secret.txt"))
+    assert e.value.status_code == 403
+
+
+def test_serve_rejects_sibling_prefix(workspace: Dict[str, str]) -> None:
+    with pytest.raises(HTTPException) as e:
+        p_run(outputs_mod.serve_workspace_file("abc", "../abc-evil/loot.txt"))
+    assert e.value.status_code == 403
+
+
+def test_serve_still_serves_a_real_file(workspace: Dict[str, str]) -> None:
+    resp = p_run(outputs_mod.serve_workspace_file("abc", "index.html"))
+    assert b"hi" in resp.body
+
+
+def test_seed_skips_symlink_escape(workspace: Dict[str, str]) -> None:
+    p_symlink(workspace["outside"], os.path.join(workspace["folder"], "esc"))
+    p_run(outputs_mod.seed_workspace(WorkspaceSeedRequest(
+        workspace_id="abc", files={"esc/planted.txt": "x"}, template_mode="flat",
+    )))
+    assert not os.path.exists(os.path.join(workspace["outside"], "planted.txt"))
+
+
+def test_seed_skips_sibling_prefix(workspace: Dict[str, str]) -> None:
+    p_run(outputs_mod.seed_workspace(WorkspaceSeedRequest(
+        workspace_id="abc", files={"../abc-evil/planted.txt": "x"}, template_mode="flat",
+    )))
+    assert not os.path.exists(os.path.join(workspace["root"], "abc-evil", "planted.txt"))
+
+
+def test_seed_still_writes_a_real_file(workspace: Dict[str, str]) -> None:
+    p_run(outputs_mod.seed_workspace(WorkspaceSeedRequest(
+        workspace_id="abc", files={"app/main.py": "print(1)"}, template_mode="flat",
+    )))
+    assert os.path.isfile(os.path.join(workspace["folder"], "app", "main.py"))
+
+
+def test_write_rejects_symlink_escape(workspace: Dict[str, str]) -> None:
+    p_symlink(workspace["outside"], os.path.join(workspace["folder"], "esc"))
+    with pytest.raises(HTTPException) as e:
+        p_run(outputs_mod.write_workspace_file("abc", "esc/planted.txt", {"content": "x"}))
+    assert e.value.status_code == 403
+    assert not os.path.exists(os.path.join(workspace["outside"], "planted.txt"))
+
+
+def test_write_still_writes_a_real_file(workspace: Dict[str, str]) -> None:
+    p_run(outputs_mod.write_workspace_file("abc", "notes/todo.md", {"content": "hello"}))
+    assert (open(os.path.join(workspace["folder"], "notes", "todo.md")).read()) == "hello"
+
+
+def test_delete_rejects_symlink_escape(workspace: Dict[str, str]) -> None:
+    p_symlink(workspace["outside"], os.path.join(workspace["folder"], "esc"))
+    with pytest.raises(HTTPException) as e:
+        p_run(outputs_mod.delete_workspace_file("abc", "esc/secret.txt"))
+    assert e.value.status_code == 403
+    assert os.path.exists(os.path.join(workspace["outside"], "secret.txt"))
+
+
+def test_delete_still_deletes_a_real_file(workspace: Dict[str, str]) -> None:
+    victim = os.path.join(workspace["folder"], "deep", "gone.txt")
+    os.makedirs(os.path.dirname(victim))
+    open(victim, "w").write("x")
+    p_run(outputs_mod.delete_workspace_file("abc", "deep/gone.txt"))
+    assert not os.path.exists(victim)
+    assert not os.path.isdir(os.path.dirname(victim))
+
+
+def test_delete_prunes_up_to_but_not_past_the_workspace(workspace: Dict[str, str]) -> None:
+    victim = os.path.join(workspace["folder"], "only.txt")
+    open(victim, "w").write("x")
+    p_run(outputs_mod.delete_workspace_file("abc", "only.txt"))
+    assert os.path.isdir(workspace["folder"])
diff --git a/backend/tests/web_cascade_fixtures.py b/backend/tests/web_cascade_fixtures.py
new file mode 100644
index 00000000..f128e17d
--- /dev/null
+++ b/backend/tests/web_cascade_fixtures.py
@@ -0,0 +1,82 @@
+"""Shared fixtures for the /api/web cascade tests: everything offline by default."""
+
+import pytest
+
+import backend.apps.agents.tools.fetch.wayback as WB
+import backend.apps.agents.tools.search.search_startpage as SP
+from backend.apps.agents.tools.search.search_startpage import StartpageAnswer
+import backend.apps.web.web as W
+from backend.apps.agents.tools.web import DDGRateLimited, WebSearchTool
+import backend.apps.agents.tools.ssrf_guard as p_ssrf
+from backend.apps.web.tier_breaker import reset_tier_health
+
+
+@pytest.fixture(autouse=True)
+def fresh_breaker():
+    # The breaker is per-process by design, so without this one test's forced outage cools the next test's tier.
+    reset_tier_health()
+    yield
+    reset_tier_health()
+
+
+@pytest.fixture(autouse=True)
+def no_network(monkeypatch):
+    # Default everything to "unavailable / no network"; each test opts paths in.
+    monkeypatch.setattr(W, "resolve_gemini_api_key", lambda: None)
+    monkeypatch.setattr(W, "resolve_openai_api_key", lambda: None)
+
+    async def p_no_subs():
+        return set()
+    monkeypatch.setattr(W, "refresh_9r_connected", p_no_subs)
+
+    async def p_empty(*a, **k):
+        return {}
+    # subscription helpers hit localhost:20128 otherwise
+    monkeypatch.setattr(W, "gemini_grounded_via_9router", p_empty)
+    monkeypatch.setattr(W, "openai_websearch_via_9router", p_empty)
+
+    async def p_startpage_closed(query, num):
+        return StartpageAnswer()
+    monkeypatch.setattr(SP, "search_startpage", p_startpage_closed)
+
+    async def p_no_snapshot(url):
+        return None
+    monkeypatch.setattr(WB, "fetch_wayback", p_no_snapshot)
+
+
+@pytest.fixture(autouse=True)
+def allow_urls(monkeypatch):
+    async def p_ok(url):
+        return None
+    monkeypatch.setattr(p_ssrf, "assert_safe_url", p_ok)
+
+
+def ddg_returns(monkeypatch, text):
+    async def p_f(query, num):
+        return text
+    monkeypatch.setattr(WebSearchTool, "search_ddg", staticmethod(p_f))
+
+
+def ddg_throttled(monkeypatch):
+    async def p_f(query, num):
+        raise DDGRateLimited(query)
+    monkeypatch.setattr(WebSearchTool, "search_ddg", staticmethod(p_f))
+
+
+def startpage_returns(monkeypatch, text):
+    async def p_f(query, num):
+        return StartpageAnswer(results=text)
+    monkeypatch.setattr(SP, "search_startpage", p_f)
+
+
+def startpage_refuses(monkeypatch):
+    async def p_f(query, num):
+        return StartpageAnswer(refused=True)
+    monkeypatch.setattr(SP, "search_startpage", p_f)
+
+
+def patch_browser_bridge(monkeypatch, result):
+    """Patch the offscreen-browser bridge; result=None simulates 'no Electron main bridge connected'."""
+    async def p_f(action, params):
+        return result
+    monkeypatch.setattr(W, "p_browser_bridge", p_f)
diff --git a/electron/build/after-pack.js b/electron/build/after-pack.js
index f6b5177e..30325ca8 100644
--- a/electron/build/after-pack.js
+++ b/electron/build/after-pack.js
@@ -83,8 +83,45 @@ function stageRouterNodeModules(context) {
   console.log(`[afterPack] staged 9Router node_modules into ${routerDir}`);
 }
 
+// prebuildify packages (uiohook-napi and friends) ship a .node for EVERY platform+arch they support.
+// Six of the seven are dead weight in any one build, and on macOS an x86_64 Mach-O sitting inside an
+// arm64 bundle is what makes the OS put up its Intel-deprecation dialog. node-gyp-build only ever
+// looks in prebuilds/<platform>-<arch>, so deleting the rest is invisible to the app. Runs here in
+// afterPack because code-signing comes next and seals the bundle; a later delete breaks the seal.
+function pruneForeignPrebuilds(context) {
+  const { appOutDir, electronPlatformName, arch } = context;
+  // Read the arch name off electron-builder's own enum rather than hardcoding its numbering.
+  const archName = require('builder-util').Arch[arch];
+  const root = electronPlatformName === 'darwin'
+    ? path.join(appOutDir, `${context.packager.appInfo.productFilename}.app`, 'Contents', 'Resources')
+    : path.join(appOutDir, 'resources');
+  let removed = 0;
+
+  (function walk(dir, depth) {
+    if (depth > 12) return;
+    let ents = [];
+    try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of ents) {
+      if (!e.isDirectory()) continue;
+      const full = path.join(dir, e.name);
+      if (e.name !== 'prebuilds') { walk(full, depth + 1); continue; }
+      for (const tuple of fs.readdirSync(full, { withFileTypes: true })) {
+        // prebuildify names dirs "<platform>-<arch>", sometimes fat: "darwin-x64+arm64".
+        const [tuplePlatform, archPart] = tuple.name.split('-');
+        const covers = tuplePlatform === electronPlatformName && String(archPart || '').split('+').includes(archName);
+        if (covers) continue;
+        fs.rmSync(path.join(full, tuple.name), { recursive: true, force: true });
+        removed += 1;
+      }
+    }
+  })(root, 0);
+
+  console.log(`[afterPack] pruned ${removed} foreign prebuild dir(s), kept ${electronPlatformName}-${archName}`);
+}
+
 exports.default = async function afterPack(context) {
   stageRouterNodeModules(context);
+  pruneForeignPrebuilds(context);
   // VMP signing runs last and unconditionally, after every file is staged, so the
   // OS code-sign that electron-builder runs next seals the VMP signature too.
   signVmp(context);
diff --git a/electron/hiddenBrowser.js b/electron/hiddenBrowser.js
index df85186c..9cb5756f 100644
--- a/electron/hiddenBrowser.js
+++ b/electron/hiddenBrowser.js
@@ -123,7 +123,8 @@ async function hiddenEvalWithCookies(url, cookieRecords, js) {
 // Google first (direct result URLs, best quality); DuckDuckGo in a real browser
 // second (immune to the httpx 202 throttle); Bing last (results are redirect-wrapped).
 const ENGINES = [
-  { name: 'google', url: (q) => `https://www.google.com/search?q=${encodeURIComponent(q)}&num=10&hl=en`,
+  // udm=14 is Google's plain "Web" tab: ten blue links, no AI Overview and no answer widgets, so the a-h3 scrape gets real result URLs instead of whatever the SERP decided to render today.
+  { name: 'google', url: (q) => `https://www.google.com/search?q=${encodeURIComponent(q)}&udm=14&num=10&hl=en`,
     scrape: `Array.from(document.querySelectorAll('a h3')).map(function(h){var a=h.closest('a');return a&&a.href?{t:h.innerText,u:a.href}:null;}).filter(function(x){return x&&x.u.indexOf('http')===0&&x.u.indexOf('google.')===-1;})` },
   { name: 'ddg', url: (q) => `https://html.duckduckgo.com/html/?q=${encodeURIComponent(q)}`,
     scrape: `Array.from(document.querySelectorAll('a.result__a')).map(function(a){var m=a.href.match(/uddg=([^&]+)/);return {t:a.innerText,u:m?decodeURIComponent(m[1]):a.href};})` },
diff --git a/electron/main.js b/electron/main.js
index 7123adbf..1816a2fc 100644
--- a/electron/main.js
+++ b/electron/main.js
@@ -1,5 +1,6 @@
 const { app, components, BrowserWindow, ipcMain, shell, session, dialog, crashReporter, powerMonitor, Menu, clipboard, globalShortcut } = require('electron');
 const whisperService = require('./voice/whisperService');
+const whisperModels = require('./voice/whisperModels');
 const { injectText } = require('./voice/textInjector');
 
 // Browser cards live in their own persistent partition so cookies/localStorage/IndexedDB survive reload + quit (Discord etc. stay logged in) and site data stays isolated from the app's defaultSession. The "clear browsing data" wipe nukes only this partition. MUST match BROWSER_PARTITION in frontend BrowserCard.tsx.
@@ -141,6 +142,17 @@ function _squirrelUpdate(args) {
   if (sq === '--squirrel-obsolete') { process.exit(0); }
 })();
 
+// Windows toast notifications are dropped on the floor unless our AppUserModelID
+// matches the one Squirrel stamped on the Start Menu shortcut, and Squirrel's rule
+// is com.squirrel.<nuspec id>.<exe name>. Derived, not hardcoded, so renaming the
+// app can't silently kill notifications. Must run before the first Notification.
+if (process.platform === 'win32' && app.isPackaged) {
+  try {
+    const nuspecId = require('./package.json').name;
+    app.setAppUserModelId(`com.squirrel.${nuspecId}.${path.basename(process.execPath, '.exe')}`);
+  } catch (_) {}
+}
+
 // NSIS->Squirrel migration cleanup. The first time this Squirrel build runs after
 // an existing NSIS OpenSwarm was updated into it, silently uninstall that legacy
 // NSIS copy so the user isn't left with two installs + two shortcuts. Found via
@@ -1184,6 +1196,8 @@ function markBackendReady() {
   _backendReadyResolve();
   try {
     workflowsLifecycle.setBackend({ port: backendPort, token: authToken });
+    // Read lazily: mainWindow is replaced by recreateMainWindow, so a captured value goes stale.
+    workflowsLifecycle.setNotificationTarget(() => mainWindow);
     workflowsLifecycle.startPolling();
   } catch (_) {}
   try { connectMainBridge(); } catch (_) {}
@@ -1586,19 +1600,8 @@ function sendToRenderer(channel, ...args) {
 // Maps a raw electron-updater error to a short, human message. The raw error
 // is always logged separately for debugging; users only ever see this. No
 // em/en dashes per repo style.
-function friendlyUpdateError(err) {
-  const raw = ((err && err.message) || String(err) || '').toLowerCase();
-  // Experimental on, but there is no pre-release to fetch: the provider 404s
-  // looking for the pre-release channel feed. This is the screenshot case.
-  if (autoUpdater && autoUpdater.allowPrerelease &&
-      /404|not found|cannot find|no published|latest.*\.yml/.test(raw)) {
-    return 'No experimental builds available right now. You are on the latest version.';
-  }
-  if (/net::|enotfound|etimedout|econnrefused|getaddrinfo|network/.test(raw)) {
-    return 'Could not reach the update server. Check your connection and try again.';
-  }
-  return 'Update check failed. Please try again later.';
-}
+// Extracted to electron/updateErrorMessage.js so the mapping is unit-testable; see node --test there.
+const { friendlyUpdateError } = require('./updateErrorMessage');
 
 // Phase 2 provenance: which exact commit produced this build. The build
 // scripts write electron/build-info.json (gitignored, regenerated each build)
@@ -1708,7 +1711,7 @@ function setupAutoUpdater() {
     // but no pre-release exists": the GitHub provider 404s hunting a pre-release
     // feed, which is not a real failure, just "nothing newer to install".
     console.error('Auto-update error:', err);
-    const friendly = friendlyUpdateError(err);
+    const friendly = friendlyUpdateError(err, !!(autoUpdater && autoUpdater.allowPrerelease));
     cachedUpdateStatus = { status: 'error', info: null, error: friendly };
     sendToRenderer('update-error', friendly);
   });
@@ -2154,6 +2157,15 @@ app.whenReady().then(async () => {
     // Don't block on Widevine; it'll resolve in the background. Logged above.
     widevinePromise.catch(() => {});
 
+    // Warm the dictation model well after the window is up, so the first phrase transcribes at the
+    // steady-state speed instead of waiting out a cold model load under the user's keypress.
+    const warmDelay = setTimeout(() => {
+      const started = whisperService.warmInBackground(voiceResourceDir(), voiceUserDataDir());
+      console.log(started ? '[voice] warming whisper in background' : '[voice] no model yet, skipping boot warm');
+    }, 8000);
+    if (warmDelay.unref) warmDelay.unref();
+    powerMonitor.on('resume', () => { whisperService.reprimeAfterWake().catch(() => {}); });
+
     // Affiliate / referral handshake. On the very first launch, opens the
     // landing page's /welcome handler in the user's default browser so the
     // browser (which holds the install_token from the click on the
@@ -3019,6 +3031,17 @@ ipcMain.handle('voice:warmup', async () => {
 });
 // First-run model download progress so the pill can show "Preparing voice N%".
 ipcMain.handle('voice:status', () => whisperService.modelStatus());
+// Settings' model picker: the catalog with per-model install state, and the user's pick.
+ipcMain.handle('voice:models', () => ({
+  models: whisperModels.catalog(voiceUserDataDir()),
+  selected: whisperService.selectedModel(),
+}));
+ipcMain.handle('voice:set-model', (_e, id) => {
+  const ready = whisperService.setModel(voiceUserDataDir(), String(id || ''));
+  // Already on disk: warm the new one now so the next phrase is instant, same as at boot.
+  if (ready) whisperService.warmInBackground(voiceResourceDir(), voiceUserDataDir());
+  return { ok: true, ready };
+});
 // Paste the text into the frontmost app (dictate-anywhere). Returns whether the OS paste actually fired.
 ipcMain.handle('voice:inject', async (_e, text) => {
   try { const pasted = await injectText(String(text || '')); return { ok: true, pasted }; } catch (err) { return { ok: false, error: String(err && err.message ? err.message : err) }; }
@@ -3375,6 +3398,39 @@ ipcMain.handle('open-external', (_event, url) => {
   }
 });
 
+// The renderer's own Notification API only reaches Notification Center while a
+// window exists and is not suspended, which is exactly the case a finished
+// workflow is trying to survive. This hands it to the main process instead.
+// Everything is clamped here: the payload crosses a trust boundary and the click
+// handler can hand `deepLink` to the OS.
+const NOTIFY_OUTCOMES = new Set(['open', 'ack', 'rerun', 'edit']);
+function cleanNotifyText(value, max) {
+  return typeof value === 'string' ? value.replace(/\s+/g, ' ').trim().slice(0, max) : '';
+}
+ipcMain.handle('workflow:notify', (_event, payload) => {
+  if (!payload || typeof payload !== 'object') return false;
+  const title = cleanNotifyText(payload.title, 120);
+  if (!title) return false;
+  // Only our own scheme: this string can reach shell.openExternal, and a file:// or
+  // an installed-app scheme there would be a renderer-triggered arbitrary launch.
+  const deepLink = typeof payload.deepLink === 'string' && payload.deepLink.startsWith('openswarm://')
+    ? payload.deepLink.slice(0, 500)
+    : undefined;
+  const actions = (Array.isArray(payload.actions) ? payload.actions : [])
+    .filter((a) => a && NOTIFY_OUTCOMES.has(a.outcome) && cleanNotifyText(a.text, 30))
+    .slice(0, 3)
+    .map((a) => ({ text: cleanNotifyText(a.text, 30), outcome: a.outcome }));
+  const shown = workflowsLifecycle.showNativeNotification({
+    title,
+    body: cleanNotifyText(payload.body, 300),
+    deepLink,
+    runId: cleanNotifyText(payload.runId, 200) || undefined,
+    workflowId: cleanNotifyText(payload.workflowId, 200) || undefined,
+    actions,
+  });
+  return Boolean(shown);
+});
+
 // Applications launcher support. Names are bare .app basenames from the local scan; both
 // handlers hard-validate the name and resolve strictly inside /Applications so a hostile
 // renderer string can't traverse anywhere else.
diff --git a/electron/node_modules b/electron/node_modules
new file mode 120000
index 00000000..59a9e1bc
--- /dev/null
+++ b/electron/node_modules
@@ -0,0 +1 @@
+/Users/ericzeng/Downloads/openswarm/electron/node_modules
\ No newline at end of file
diff --git a/electron/package.json b/electron/package.json
index 34ddef3f..cd253d26 100644
--- a/electron/package.json
+++ b/electron/package.json
@@ -1,6 +1,6 @@
 {
   "name": "openswarm",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "license": "AGPL-3.0-only",
   "description": "OpenSwarm — AI Agent Orchestrator",
   "author": "openswarm-ai",
@@ -15,7 +15,7 @@
     "dist:win": "electron-builder --win --x64 --publish never",
     "dist:win:publish": "electron-builder --win --x64 --publish always",
     "dist:all": "electron-builder --mac --win --linux",
-    "test": "node --test affiliateTracking.test.js",
+    "test": "node --test affiliateTracking.test.js updateErrorMessage.test.js",
     "test:mouseclamp": "bash native/mouseclamp/run-tests.sh"
   },
   "dependencies": {
diff --git a/electron/preload.js b/electron/preload.js
index 1406fdcc..1d30ad75 100644
--- a/electron/preload.js
+++ b/electron/preload.js
@@ -64,6 +64,9 @@ contextBridge.exposeInMainWorld('openswarm', {
   // text into the frontmost app; warmup pre-loads the model; onVoiceToggle fires on the global hotkey.
   voiceWarmup: () => ipcRenderer.invoke('voice:warmup'),
   voiceStatus: () => ipcRenderer.invoke('voice:status'),
+  // Settings' model picker: the catalog with install state, and switching (downloads on demand).
+  voiceModels: () => ipcRenderer.invoke('voice:models'),
+  voiceSetModel: (id) => ipcRenderer.invoke('voice:set-model', id),
   voiceTranscribe: (wavArrayBuffer) => ipcRenderer.invoke('voice:transcribe', wavArrayBuffer),
   voiceInject: (text) => ipcRenderer.invoke('voice:inject', text),
   onVoiceToggle: (cb) => {
@@ -73,6 +76,18 @@ contextBridge.exposeInMainWorld('openswarm', {
   },
   // Reveal a diagnostics folder in Finder/Explorer (path validated in main; diagnostics dir only).
   revealBundle: (folderPath) => ipcRenderer.invoke('help:reveal-bundle', folderPath),
+
+  // Native OS notification for a finished workflow run, posted by the MAIN process
+  // so it survives a minimized/hidden/backgrounded renderer (the renderer's own
+  // Notification API does not). Resolves true once it is handed to the OS, which can
+  // still refuse it afterwards (main logs that). Fields are clamped in main;
+  // onNotificationAction carries the clicked outcome back.
+  notify: (payload) => ipcRenderer.invoke('workflow:notify', payload),
+  onNotificationAction: (cb) => {
+    const listener = (_event, payload) => cb(payload);
+    ipcRenderer.on('workflow:notification-action', listener);
+    return () => ipcRenderer.removeListener('workflow:notification-action', listener);
+  },
   // True keyboard hold-to-talk needs the native key tap; renderers ask so Settings copy stays honest,
   // and request triggers the macOS Accessibility prompt when the tap is blocked on permission.
   setVoiceHotkey: (combo) => ipcRenderer.send('voice:set-hotkey', combo),
diff --git a/electron/updateErrorMessage.js b/electron/updateErrorMessage.js
new file mode 100644
index 00000000..05221939
--- /dev/null
+++ b/electron/updateErrorMessage.js
@@ -0,0 +1,46 @@
+// Turning an updater failure into something the user can act on.
+//
+// electron-updater reports check, download and install failures through one 'error' event, so the
+// message a user sees is whatever this mapping decides. The default used to be "Update check
+// failed. Please try again later." for everything that was not a Chromium net:: error, which is a
+// dead end: the two most common real causes (running from the DMG on macOS, a quarantined
+// Update.exe on Windows) never resolve themselves no matter how long you wait, and the user is told
+// to wait. Each branch below names a failure the user can actually fix.
+
+'use strict';
+
+/**
+ * @param {unknown} err the error electron-updater emitted
+ * @param {boolean} allowPrerelease whether the experimental channel is on
+ * @returns {string} a message safe to show in Settings
+ */
+function friendlyUpdateError(err, allowPrerelease) {
+  const raw = ((err && err.message) || String(err) || '').toLowerCase();
+  // Experimental on, but there is no pre-release to fetch: the provider 404s looking for the
+  // pre-release channel feed.
+  if (allowPrerelease && /404|not found|cannot find|no published|latest.*\.yml/.test(raw)) {
+    return 'No experimental builds available right now. You are on the latest version.';
+  }
+  if (/net::|enotfound|etimedout|econnrefused|getaddrinfo|network/.test(raw)) {
+    return 'Could not reach the update server. Check your connection and try again.';
+  }
+  // Running from the DMG or a Gatekeeper-translocated copy in ~/Downloads. Squirrel.Mac refuses
+  // deterministically, so this user can never update until the app moves.
+  if (/read-only volume|read only volume|translocat/.test(raw)) {
+    return 'Move OpenSwarm to your Applications folder, then check again. Updates cannot install while it runs from the disk image.';
+  }
+  // Windows Squirrel missing or quarantined by antivirus; retrying never fixes it either.
+  if (/can not find squirrel|cannot find squirrel|update\.exe/.test(raw)) {
+    return 'The updater is missing, which usually means antivirus quarantined it. Reinstall from openswarm.com to fix it.';
+  }
+  // Reachability failures whose text carries no net:: token, so they would otherwise look unexplained.
+  if (/http error|econnreset|certificate|self.signed|\b403\b|\b429\b|econnaborted/.test(raw)) {
+    return 'The update server refused the request. Check your VPN or network, then try again.';
+  }
+  if (/enospc|no space/.test(raw)) {
+    return 'Not enough disk space to download the update. Free up some space and try again.';
+  }
+  return 'Update check failed. Please try again later.';
+}
+
+module.exports = { friendlyUpdateError };
diff --git a/electron/updateErrorMessage.test.js b/electron/updateErrorMessage.test.js
new file mode 100644
index 00000000..5fa94da2
--- /dev/null
+++ b/electron/updateErrorMessage.test.js
@@ -0,0 +1,70 @@
+// A user who cannot update needs to be told what to DO.
+//
+// Every failure that was not a Chromium net:: error used to collapse into "Update check failed.
+// Please try again later." A real 1.5.9 user sat on that message with a perfectly healthy release
+// feed: the release, its ymls, checksums, signature and notarization all verified good. The cause
+// was local and permanent, and the app told them to wait.
+//
+// Run: cd electron && node --test updateErrorMessage.test.js
+
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const { friendlyUpdateError } = require('./updateErrorMessage');
+
+const GENERIC = 'Update check failed. Please try again later.';
+
+test('running from the disk image tells the user to move the app', () => {
+  const msg = friendlyUpdateError(new Error('Cannot update while running on a read-only volume'), false);
+  assert.match(msg, /Applications folder/);
+  assert.notEqual(msg, GENERIC);
+});
+
+test('a Gatekeeper-translocated copy gets the same advice', () => {
+  const msg = friendlyUpdateError(new Error('app is translocated'), false);
+  assert.match(msg, /Applications folder/);
+});
+
+test('a quarantined Windows updater says so instead of "try again"', () => {
+  const msg = friendlyUpdateError(new Error('Can not find Squirrel'), false);
+  assert.match(msg, /antivirus/);
+  assert.notEqual(msg, GENERIC);
+});
+
+test('an HTTP refusal reads as reachability, not as an unexplained failure', () => {
+  for (const raw of ['HTTP error: Forbidden', 'ECONNRESET', 'unable to verify the first certificate']) {
+    const msg = friendlyUpdateError(new Error(raw), false);
+    assert.match(msg, /VPN or network/, `"${raw}" should read as reachability`);
+  }
+});
+
+test('a full disk names the disk', () => {
+  assert.match(friendlyUpdateError(new Error('ENOSPC: no space left on device'), false), /disk space/);
+});
+
+test('network errors keep their existing message', () => {
+  const msg = friendlyUpdateError(new Error('net::ERR_INTERNET_DISCONNECTED'), false);
+  assert.match(msg, /Check your connection/);
+});
+
+test('the experimental-channel 404 still wins when prerelease is on', () => {
+  const msg = friendlyUpdateError(new Error('404 Not Found: latest-mac.yml'), true);
+  assert.match(msg, /No experimental builds/);
+});
+
+test('the same 404 is NOT the experimental message when prerelease is off', () => {
+  const msg = friendlyUpdateError(new Error('404 Not Found: latest-mac.yml'), false);
+  assert.doesNotMatch(msg, /No experimental builds/);
+});
+
+test('a genuinely unknown failure still falls through to the generic message', () => {
+  // The discriminating half. If everything matched something, the buckets would be meaningless.
+  assert.equal(friendlyUpdateError(new Error('something nobody predicted'), false), GENERIC);
+});
+
+test('a null error does not throw', () => {
+  assert.equal(typeof friendlyUpdateError(null, false), 'string');
+  assert.equal(typeof friendlyUpdateError(undefined, true), 'string');
+});
diff --git a/electron/voice/whisperModels.js b/electron/voice/whisperModels.js
new file mode 100644
index 00000000..919a39ab
--- /dev/null
+++ b/electron/voice/whisperModels.js
@@ -0,0 +1,154 @@
+// The dictation model catalog: which whisper builds we offer, where they come from, and how a
+// chosen one gets onto disk intact. Split out of whisperService.js because "which file" and "the
+// running server" are different jobs with different failure modes.
+//
+// Only English models: dictation lands in the user's own text field, and the .en builds are both
+// smaller and more accurate than their multilingual siblings at the same size. Quantized (q5_1)
+// variants are the field default (Handy and FluidVoice both standardised on quantized weights);
+// they trade a sliver of accuracy for a third of the download.
+//
+// sha256 is the trust anchor. These are the HuggingFace LFS object ids, which ARE the file digests,
+// so a truncated, resumed-wrong, or proxy-substituted body is rejected instead of handed to a
+// native parser.
+
+const fs = require('fs');
+const path = require('path');
+const https = require('https');
+const crypto = require('crypto');
+
+const MODELS = [
+  { id: 'tiny.en-q5_1', file: 'ggml-tiny.en-q5_1.bin', label: 'Tiny', note: 'Fastest, but gets lost past ~15s of speech', bytes: 32166155, sha256: 'c77c5766f1cef09b6b7d47f21b546cbddd4157886b3b5d6d4f709e91e66c7c2b' },
+  { id: 'base.en-q5_1', file: 'ggml-base.en-q5_1.bin', label: 'Base (compact)', note: 'Base quality and speed, 90MB less to download and hold', bytes: 59721011, sha256: '4baf70dd0d7c4247ba2b81fafd9c01005ac77c2f9ef064e00dcf195d0e2fdd2f' },
+  { id: 'base.en', file: 'ggml-base.en.bin', label: 'Base', note: 'Balanced, the default', bytes: 147964211, sha256: 'a03779c86df3323075f5e796cb2ce5029f00ec8869eee3fdfb897afe36c6d002' },
+  { id: 'small.en-q5_1', file: 'ggml-small.en-q5_1.bin', label: 'Small', note: 'Steadier on accents and noise, ~2.7x slower', bytes: 190098681, sha256: 'bfdff4894dcb76bbf647d56263ea2a96645423f1669176f4844a1bf8e478ad30' },
+];
+// Measured on an M2 (quiet machine, 3.5s/8.1s/26.4s utterances, median of 5):
+//   tiny  174/154/241ms  base-q5_1  212/414/656ms  base  208/398/734ms  small  865/1108/1869ms
+// base.en stays the default: quantizing it saves download and RAM but buys no speed on Metal, and
+// small costs 2.7x the latency. large-v3-turbo is deliberately absent, it measured both slowest and
+// least accurate here (4.1s on a 3.5s clip, and it fell apart on the long one).
+
+const DEFAULT_MODEL_ID = 'base.en';
+const BASE_URL = 'https://huggingface.co/ggerganov/whisper.cpp/resolve/main/';
+
+function modelById(id) {
+  return MODELS.find((m) => m.id === id) || MODELS.find((m) => m.id === DEFAULT_MODEL_ID);
+}
+
+function modelDir(userDataDir) {
+  return path.join(userDataDir, 'whisper');
+}
+
+function modelPath(userDataDir, id) {
+  return path.join(modelDir(userDataDir), modelById(id).file);
+}
+
+// A file is only "installed" once it is exactly the size the catalog says. A short file is a
+// half-download someone's disk filled up on, and whisper would die parsing it.
+function isInstalled(userDataDir, id) {
+  const m = modelById(id);
+  try { return fs.statSync(modelPath(userDataDir, id)).size === m.bytes; } catch (_) { return false; }
+}
+
+// Resolve the model file to actually load: env override, then the user's pick, then anything else
+// already on disk, then bundled. Never returns a path that isn't a complete file.
+function resolveModelFile(resourceDir, userDataDir, id) {
+  if (process.env.OPENSWARM_WHISPER_MODEL && fs.existsSync(process.env.OPENSWARM_WHISPER_MODEL)) {
+    return process.env.OPENSWARM_WHISPER_MODEL;
+  }
+  if (id && isInstalled(userDataDir, id)) return modelPath(userDataDir, id);
+  const bundled = path.join(resourceDir, modelById(DEFAULT_MODEL_ID).file);
+  if (fs.existsSync(bundled)) return bundled;
+  // The user's pick isn't down yet but something else is: dictate with what we have rather than
+  // dead-ending on "no model" while a 190MB download runs.
+  const fallback = MODELS.find((m) => isInstalled(userDataDir, m.id));
+  return fallback ? modelPath(userDataDir, fallback.id) : null;
+}
+
+const download = { active: false, id: null, pct: 0, error: null };
+
+function downloadStatus() {
+  return { downloading: download.active, id: download.id, pct: download.pct, error: download.error };
+}
+
+function sha256File(file) {
+  return new Promise((resolve, reject) => {
+    const h = crypto.createHash('sha256');
+    const s = fs.createReadStream(file);
+    s.on('data', (c) => h.update(c));
+    s.on('end', () => resolve(h.digest('hex')));
+    s.on('error', reject);
+  });
+}
+
+// Fetch a catalog model into the user data dir. One at a time, resumable-free but atomic: bytes land
+// in a .part file that only gets its real name after the digest matches.
+function downloadModel(userDataDir, id) {
+  if (download.active) return;
+  const m = modelById(id);
+  const dest = modelPath(userDataDir, m.id);
+  download.active = true;
+  download.id = m.id;
+  download.pct = 0;
+  download.error = null;
+  try { fs.mkdirSync(modelDir(userDataDir), { recursive: true }); } catch (_) {}
+  const tmp = `${dest}.part`;
+  try { fs.unlinkSync(tmp); } catch (_) {}
+
+  const fail = (msg) => {
+    download.active = false;
+    download.error = String(msg);
+    try { fs.unlinkSync(tmp); } catch (_) {}
+  };
+
+  // HuggingFace bounces resolve -> CDN -> signed URL, so follow redirects instead of assuming one hop.
+  const fetchUrl = (url, hops) => {
+    if (hops > 6) { fail('too-many-redirects'); return; }
+    const req = https.get(url, { headers: { 'User-Agent': 'openswarm-voice' } }, (res) => {
+      const code = res.statusCode || 0;
+      if (code >= 300 && code < 400 && res.headers.location) {
+        res.resume(); // drain so the socket frees
+        fetchUrl(new URL(res.headers.location, url).toString(), hops + 1);
+        return;
+      }
+      if (code !== 200) { res.resume(); fail(`http-${code}`); return; }
+      let got = 0;
+      const file = fs.createWriteStream(tmp);
+      res.on('data', (c) => {
+        got += c.length;
+        download.pct = Math.min(99, Math.round((got / m.bytes) * 100));
+        // A server that keeps sending past the advertised size must not be allowed to fill the disk.
+        if (got > m.bytes) { req.destroy(); fail('oversize'); }
+      });
+      res.pipe(file);
+      file.on('finish', () => file.close(async () => {
+        if (!download.active) return; // already failed out
+        if (got !== m.bytes) { fail('truncated'); return; }
+        try {
+          const digest = await sha256File(tmp);
+          if (digest !== m.sha256) { fail('checksum-mismatch'); return; }
+          fs.renameSync(tmp, dest);
+          download.pct = 100;
+          download.active = false;
+        } catch (e) { fail(e && e.message ? e.message : e); }
+      }));
+      res.on('error', () => fail('stream-error'));
+      file.on('error', () => fail('write-error'));
+    });
+    req.on('error', (e) => fail(e && e.message ? e.message : e));
+  };
+  fetchUrl(`${BASE_URL}${m.file}`, 0);
+}
+
+// What Settings renders: every model, its size, and whether it is already on this machine.
+function catalog(userDataDir) {
+  return MODELS.map((m) => ({
+    id: m.id,
+    label: m.label,
+    note: m.note,
+    sizeMb: Math.round(m.bytes / 1048576),
+    installed: isInstalled(userDataDir, m.id),
+  }));
+}
+
+module.exports = { MODELS, DEFAULT_MODEL_ID, catalog, downloadModel, downloadStatus, isInstalled, modelById, modelPath, resolveModelFile };
diff --git a/electron/voice/whisperService.js b/electron/voice/whisperService.js
index 69391e13..809c7103 100644
--- a/electron/voice/whisperService.js
+++ b/electron/voice/whisperService.js
@@ -6,58 +6,15 @@
 const { spawn } = require('child_process');
 const path = require('path');
 const fs = require('fs');
-const https = require('https');
+const net = require('net');
 const os = require('os');
+const whisperModels = require('./whisperModels');
 
-const MODEL_FILE = 'ggml-base.en.bin';
-const MODEL_URL = 'https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-base.en.bin';
-
-// First-run model fetch, so a dev build (or a prod build that shipped without the model) still works
-// instead of dead-ending on "no model". Progress is exposed so the pill can say "Preparing voice 40%".
-const download = { active: false, pct: 0, error: null };
-
-function downloadModel(dest) {
-  if (download.active) return;
-  download.active = true;
-  download.pct = 0;
-  download.error = null;
-  try { fs.mkdirSync(path.dirname(dest), { recursive: true }); } catch (_) {}
-  const tmp = `${dest}.part`;
-  try { fs.unlinkSync(tmp); } catch (_) {}
-
-  const fail = (msg) => { download.active = false; download.error = String(msg); try { fs.unlinkSync(tmp); } catch (_) {} };
-
-  // HuggingFace bounces resolve -> CDN -> signed URL, so follow redirects instead of assuming one hop.
-  const fetchUrl = (url, hops) => {
-    if (hops > 6) { fail('too-many-redirects'); return; }
-    const req = https.get(url, { headers: { 'User-Agent': 'openswarm-voice' } }, (res) => {
-      const code = res.statusCode || 0;
-      if (code >= 300 && code < 400 && res.headers.location) {
-        res.resume(); // drain so the socket frees
-        fetchUrl(new URL(res.headers.location, url).toString(), hops + 1);
-        return;
-      }
-      if (code !== 200) { res.resume(); fail(`http-${code}`); return; }
-      const total = Number(res.headers['content-length'] || 0);
-      let got = 0;
-      const file = fs.createWriteStream(tmp);
-      res.on('data', (c) => { got += c.length; if (total) download.pct = Math.round((got / total) * 100); });
-      res.pipe(file);
-      file.on('finish', () => file.close(() => {
-        // A truncated download is worse than none: only accept a complete file.
-        if (total && got < total) { fail('truncated'); return; }
-        try { fs.renameSync(tmp, dest); download.pct = 100; download.active = false; } catch (e) { fail(e && e.message ? e.message : e); }
-      }));
-      res.on('error', () => fail('stream-error'));
-      file.on('error', () => fail('write-error'));
-    });
-    req.on('error', (e) => fail(e && e.message ? e.message : e));
-  };
-  fetchUrl(MODEL_URL, 0);
-}
+// Which catalog model the user picked. Settings pushes it in; until then the catalog default wins.
+let selectedModelId = whisperModels.DEFAULT_MODEL_ID;
 
 function modelStatus() {
-  return { downloading: download.active, pct: download.pct, error: download.error };
+  return whisperModels.downloadStatus();
 }
 
 // Resolve the whisper-server binary. Env override wins (dev convenience), then the bundled per-arch
@@ -74,65 +31,131 @@ function resolveBinary(resourceDir) {
   return exe; // last resort: hope it is on PATH
 }
 
-// Resolve the model file. Env override, then bundled, then a dev cache under the app's data dir.
 function resolveModel(resourceDir, userDataDir) {
-  if (process.env.OPENSWARM_WHISPER_MODEL && fs.existsSync(process.env.OPENSWARM_WHISPER_MODEL)) {
-    return process.env.OPENSWARM_WHISPER_MODEL;
-  }
-  const bundled = path.join(resourceDir, MODEL_FILE);
-  if (fs.existsSync(bundled)) return bundled;
-  const cached = path.join(userDataDir, 'whisper', MODEL_FILE);
-  if (fs.existsSync(cached)) return cached;
-  return null;
+  return whisperModels.resolveModelFile(resourceDir, userDataDir, selectedModelId);
 }
 
 let proc = null;
 let port = 0;
 let readyPromise = null;
+let idleTimer = null;
+let loadedModelFile = null;
 
-function pickPort() {
-  // Fixed-ish high port; whisper-server has no ephemeral-port reporting, so we pick and probe.
-  return 8300 + Math.floor(Math.random() * 400);
+// A warm server holds ~210MB (measured, base.en). Free it after a long quiet spell; the reload that
+// costs is the FIRST one on a cold page cache, and boot-warm already paid that.
+const IDLE_UNLOAD_MS = 10 * 60 * 1000;
+
+// Let the OS name a free port instead of guessing one. A guessed port that is already taken makes
+// whisper exit(1) AND makes our readiness probe accept the squatter's reply as proof of life, so we
+// would happily POST the user's audio at a stranger.
+function freePort() {
+  return new Promise((resolve, reject) => {
+    const probe = net.createServer();
+    probe.once('error', reject);
+    probe.listen(0, '127.0.0.1', () => {
+      const addr = probe.address();
+      probe.close(() => resolve(addr.port));
+    });
+  });
 }
 
-async function waitForReady(p, timeoutMs) {
+async function waitForReady(child, p, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
+    if (child.exitCode !== null || child.signalCode !== null) return false; // died mid-load; stop waiting
     try {
       const res = await fetch(`http://127.0.0.1:${p}/`, { method: 'GET' });
-      if (res.status) return true; // any HTTP answer means the socket is serving
+      if (res.status) return true; // the socket is ours and it is serving
     } catch (_) { /* not up yet */ }
-    await new Promise((r) => setTimeout(r, 150));
+    await new Promise((r) => setTimeout(r, 50));
   }
   return false;
 }
 
+function p_touchIdle() {
+  if (idleTimer) clearTimeout(idleTimer);
+  idleTimer = setTimeout(() => { idleTimer = null; stopServer(); }, IDLE_UNLOAD_MS);
+  if (idleTimer.unref) idleTimer.unref(); // an idle countdown must never be the reason the app won't quit
+}
+
+// 44-byte RIFF header + silence, 16kHz mono, matching what the renderer sends.
+function p_silentWav(seconds) {
+  const samples = Math.round(16000 * seconds);
+  const buf = Buffer.alloc(44 + samples * 2);
+  buf.write('RIFF', 0); buf.writeUInt32LE(36 + samples * 2, 4); buf.write('WAVE', 8);
+  buf.write('fmt ', 12); buf.writeUInt32LE(16, 16); buf.writeUInt16LE(1, 20); buf.writeUInt16LE(1, 22);
+  buf.writeUInt32LE(16000, 24); buf.writeUInt32LE(32000, 28); buf.writeUInt16LE(2, 32); buf.writeUInt16LE(16, 34);
+  buf.write('data', 36); buf.writeUInt32LE(samples * 2, 40);
+  return buf;
+}
+
+// A loaded model is not a ready one: the first inference pays a one-off graph/kernel allocation
+// (measured ~180ms on an M2). Spend it on silence at boot so the user's first phrase doesn't.
+async function p_primeGraph(p) {
+  try {
+    const form = new FormData();
+    form.append('file', new Blob([p_silentWav(0.5)], { type: 'audio/wav' }), 'warm.wav');
+    form.append('response_format', 'text');
+    const res = await fetch(`http://127.0.0.1:${p}/inference`, { method: 'POST', body: form });
+    await res.text();
+  } catch (_) { /* priming is an optimization; a failure just means the first phrase pays it */ }
+}
+
+// Pull the one line a human can act on out of whisper's chatty output.
+function p_reasonFrom(tail) {
+  const lines = tail.split('\n').map((l) => l.trim()).filter(Boolean);
+  const blame = lines.filter((l) => /error|failed|invalid|unable|cannot|no such|not found/i.test(l));
+  const pick = blame.length ? blame[blame.length - 1] : lines[lines.length - 1];
+  return pick ? `: ${pick.slice(0, 200)}` : '';
+}
+
 async function p_bootServer(resourceDir, userDataDir) {
   const bin = resolveBinary(resourceDir);
   const model = resolveModel(resourceDir, userDataDir);
   if (!model) {
     // Kick off a one-time background fetch so the NEXT dictation just works.
-    downloadModel(path.join(userDataDir, 'whisper', MODEL_FILE));
-    throw new Error(download.active ? 'model-downloading' : 'no-model');
+    whisperModels.downloadModel(userDataDir, selectedModelId);
+    throw new Error(whisperModels.downloadStatus().downloading ? 'model-downloading' : 'no-model');
   }
-  const p = pickPort();
+  loadedModelFile = model;
+  const p = await freePort();
   // No --convert: our WAV is already 16kHz mono, and the flag makes whisper demand ffmpeg on PATH at boot; a Finder-launched app has no brew PATH, so it exited before ever binding the port.
   const child = spawn(bin, ['-m', model, '--port', String(p), '-nt'], {
     cwd: os.tmpdir(), // whisper writes per-request temp files beside cwd, and a Finder launch starts at the unwritable /
-    stdio: ['ignore', 'ignore', 'pipe'],
+    // BOTH pipes: whisper writes its fatal reasons to STDOUT and then exits 0, so an ignored stdout
+    // turns "ffmpeg is missing" into an unexplained failure. Draining also stops the pipe buffer
+    // filling and blocking the child.
+    stdio: ['ignore', 'pipe', 'pipe'],
   });
-  // Drain stderr or the pipe buffer fills and blocks the child; it is also the only diagnostic we get.
-  child.stderr.on('data', (c) => console.log('[voice] whisper:', String(c).trim().slice(0, 400)));
+  // Keep a rolling tail rather than the last chunk: whisper prints its real reason and THEN keeps
+  // banner-dumping, so "the most recent bytes" is reliably the least useful line it wrote.
+  let tail = '';
+  const drain = (c) => {
+    const said = String(c);
+    if (!said.trim()) return;
+    tail = (tail + said).slice(-4000);
+    console.log('[voice] whisper:', said.trim().slice(0, 400));
+  };
+  child.stdout.on('data', drain);
+  child.stderr.on('data', drain);
   child.on('error', () => { proc = null; port = 0; });
   child.on('exit', (code) => { if (code) console.log(`[voice] whisper-server exited code=${code}`); proc = null; port = 0; readyPromise = null; });
   // Cold model load measured 15-38s on an M2; the old 20s budget timed out real first uses.
-  const ok = await waitForReady(p, 60000);
+  const ok = await waitForReady(child, p, 60000);
   if (!ok) {
     try { child.kill(); } catch (_) {}
+    // A dead child is not a slow one. Whisper can die in ~0.1s with exit code 0 (a missing ffmpeg on
+    // a Finder-launched PATH does exactly that), so report ITS reason instantly instead of making the
+    // user sit through the full ready budget for a process that was never coming back.
+    if (child.exitCode !== null || child.signalCode !== null) {
+      throw new Error(`whisper-exited-${child.exitCode}${p_reasonFrom(tail)}`);
+    }
     throw new Error('server-timeout');
   }
   proc = child;
   port = p;
+  await p_primeGraph(p);
+  p_touchIdle();
   return p;
 }
 
@@ -143,6 +166,9 @@ async function p_bootServer(resourceDir, userDataDir) {
 // settled-rejected promise forever so every later call kept throwing "model-downloading" even after
 // the model finished. Clearing on rejection here lets the next call retry cleanly.
 async function ensureServer(resourceDir, userDataDir) {
+  // A warm server is only reusable if it holds the file we would load now: a model switch, or the
+  // user's pick finishing its download while a fallback was serving, has to re-boot.
+  if (proc && port && resolveModel(resourceDir, userDataDir) !== loadedModelFile) stopServer();
   if (proc && port) return port;
   if (readyPromise) return readyPromise;
   readyPromise = p_bootServer(resourceDir, userDataDir);
@@ -158,6 +184,7 @@ async function ensureServer(resourceDir, userDataDir) {
 // never crosses a CORS boundary; we POST from the main process where there is none.
 async function transcribe(resourceDir, userDataDir, wavBuffer) {
   const p = await ensureServer(resourceDir, userDataDir);
+  p_touchIdle();
   const form = new FormData();
   form.append('file', new Blob([wavBuffer], { type: 'audio/wav' }), 'audio.wav');
   form.append('response_format', 'text');
@@ -167,13 +194,53 @@ async function transcribe(resourceDir, userDataDir, wavBuffer) {
   return text;
 }
 
+// Boot the model in the background at app start so the expensive FIRST load (cold page cache, and on
+// a packaged build the OS's first-exec check of the bundled binary) never lands under a keypress.
+// Deliberately refuses to download: a user who never dictates should not silently pull 148MB.
+// Returns whether a warm was actually started, so the caller can log the honest reason.
+function warmInBackground(resourceDir, userDataDir) {
+  if (proc || readyPromise) return true; // already warm or warming; ensureServer dedupes anyway
+  if (!resolveModel(resourceDir, userDataDir)) return false;
+  ensureServer(resourceDir, userDataDir).catch(() => {});
+  return true;
+}
+
 function stopServer() {
+  if (idleTimer) { clearTimeout(idleTimer); idleTimer = null; }
   if (proc) {
     try { proc.kill(); } catch (_) {}
   }
   proc = null;
   port = 0;
   readyPromise = null;
+  loadedModelFile = null;
 }
 
-module.exports = { ensureServer, transcribe, stopServer, resolveBinary, resolveModel, modelStatus };
+// Settings picked a different model. Downloads it if missing; the running server keeps serving the
+// old one until the new file is complete, so switching never leaves dictation dead in between.
+function setModel(userDataDir, id) {
+  const next = whisperModels.modelById(id).id;
+  if (next === selectedModelId) return whisperModels.isInstalled(userDataDir, next);
+  selectedModelId = next;
+  if (whisperModels.isInstalled(userDataDir, next)) return true;
+  whisperModels.downloadModel(userDataDir, next);
+  return false;
+}
+
+function selectedModel() {
+  return selectedModelId;
+}
+
+function isWarm() {
+  return Boolean(proc && port);
+}
+
+// Sleep evicts the GPU-side state a warm server built, so the first phrase after a lid-open pays for
+// it again. Re-prime on wake instead of restarting: same fix openwhispr and VoiceInk landed.
+async function reprimeAfterWake() {
+  if (!isWarm()) return false;
+  await p_primeGraph(port);
+  return true;
+}
+
+module.exports = { ensureServer, warmInBackground, reprimeAfterWake, transcribe, stopServer, isWarm, setModel, selectedModel, resolveBinary, resolveModel, modelStatus };
diff --git a/electron/workflowsLifecycle.js b/electron/workflowsLifecycle.js
index 7b79b6ee..d739bf47 100644
--- a/electron/workflowsLifecycle.js
+++ b/electron/workflowsLifecycle.js
@@ -126,12 +126,20 @@ function drainOnQuit(maxSeconds = 30) {
   });
 }
 
+// Who receives the notification outcome. main.js injects the main window;
+// BrowserWindow.getAllWindows()[0] is not it after a window recreate (the
+// splash and browser popups get in front of it in creation order).
+let notificationTarget = () => null;
+
+function setNotificationTarget(fn) {
+  notificationTarget = typeof fn === 'function' ? fn : () => null;
+}
+
 // Native OS notification. Falls back silently when Notification isn't
 // supported (some Linux setups, headless test envs). When `actions` is
 // provided AND we're on macOS, attaches button actions so the user can
 // ack/re-run/open without the app taking focus. Routes the chosen
-// outcome back to the renderer via an IPC channel that the renderer's
-// WebSocketManager already listens for.
+// outcome back to the renderer over 'workflow:notification-action'.
 function showNativeNotification({ title, body, deepLink, runId, workflowId, actions }) {
   if (!Notification || !Notification.isSupported()) return null;
   try {
@@ -141,23 +149,39 @@ function showNativeNotification({ title, body, deepLink, runId, workflowId, acti
       : undefined;
     if (platformActions && platformActions.length) opts.actions = platformActions;
     const n = new Notification(opts);
-    const route = (outcome) => {
-      try {
-        const { BrowserWindow } = require('electron');
-        const wins = BrowserWindow.getAllWindows();
-        const wc = wins[0]?.webContents;
-        if (wc) wc.send('workflow:notification-action', { outcome, runId, workflowId, deepLink });
-      } catch (_) {}
+    const win = () => {
+      const w = notificationTarget();
+      return w && !w.isDestroyed() ? w : null;
     };
+    const route = (outcome) => {
+      const w = win();
+      if (!w) return false;
+      try {
+        w.webContents.send('workflow:notification-action', { outcome, runId, workflowId, deepLink });
+        return true;
+      } catch (_) { return false; }
+    };
+    // The OS can refuse after show() returns (unauthorized app, notifications off).
+    // Silence here is how a dead notifier looks exactly like a working one, so say it out loud.
+    n.on('failed', (_event, error) => {
+      console.warn('[notify] the OS refused a workflow notification:', error);
+    });
     n.on('action', (_event, idx) => {
       const a = (actions || [])[idx];
       if (a) route(a.outcome);
     });
     n.on('click', () => {
-      if (deepLink) {
+      const w = win();
+      if (w) {
+        try { if (!w.isVisible()) w.show(); } catch (_) {}
+        try { if (w.isMinimized()) w.restore(); } catch (_) {}
+        try { w.focus(); } catch (_) {}
+      }
+      // Only when there's no renderer to talk to does the deep link go through
+      // the OS, which re-launches us and lands on the openswarm:// handler.
+      if (!route('open') && deepLink) {
         try { shell.openExternal(deepLink); } catch (_) {}
       }
-      route('open');
     });
     n.show();
     return n;
@@ -202,6 +226,7 @@ module.exports = {
   getActive,
   maybeVetoInstall,
   drainOnQuit,
+  setNotificationTarget,
   showNativeNotification,
   getLoginItem,
   setLoginItem,
diff --git a/frontend/src/app/Main.tsx b/frontend/src/app/Main.tsx
index a9209932..43fed04a 100644
--- a/frontend/src/app/Main.tsx
+++ b/frontend/src/app/Main.tsx
@@ -208,6 +208,7 @@ const SettingsLoader: React.FC<{ children: React.ReactNode }> = ({ children }) =
   const accentColor = useAppSelector((s) => s.settings.data.accent_color);
   const accentGradient = useAppSelector((s) => s.settings.data.accent_gradient);
   const loaded = useAppSelector((s) => s.settings.loaded);
+  const settled = useAppSelector((s) => s.settings.settled);
   const allowExperimentalUpdates = useAppSelector((s) => s.settings.data.allow_experimental_updates);
   useEffect(() => {
     dispatch(fetchSettings());
@@ -275,8 +276,8 @@ const SettingsLoader: React.FC<{ children: React.ReactNode }> = ({ children }) =
     if (!loaded) return;
     (window as any).openswarm?.setAllowPrerelease?.(allowExperimentalUpdates);
   }, [loaded, allowExperimentalUpdates]);
-  // Hold paint until settings land so the user's theme renders first; Electron's ready-to-show relies on this.
-  if (!loaded) return null;
+  // Hold paint until the settings fetch SETTLES so the user's theme renders first; Electron's ready-to-show relies on this. Settling, not succeeding: a backend that never answers used to leave a blank window forever.
+  if (!settled) return null;
   return <>{children}</>;
 };
 
diff --git a/frontend/src/app/components/Layout/AppShell.tsx b/frontend/src/app/components/Layout/AppShell.tsx
index 08db74c3..f089ec5f 100644
--- a/frontend/src/app/components/Layout/AppShell.tsx
+++ b/frontend/src/app/components/Layout/AppShell.tsx
@@ -30,7 +30,8 @@ import { hasModelConnected as selectHasModelConnected } from '@/app/components/O
 import { shallowEqual } from 'react-redux';
 import { fetchDashboards, createDashboard } from '@/shared/state/dashboardsSlice';
 import { setPendingFocusAgentId } from '@/shared/state/tempStateSlice';
-import { addBrowserCard, addBrowserTab, cycleBrowserTab, reopenLastClosed, addViewCard, selectFullscreenCardId, setTiledCard, clearTiledCard } from '@/shared/state/dashboardLayoutSlice';
+import { addBrowserCard, addBrowserTab, cycleBrowserTab, reopenLastClosed, addViewCard, selectFullscreenCardId, setTiledCard, clearTiledCard, openWorkflowMonitor, openWorkflowsApp } from '@/shared/state/dashboardLayoutSlice';
+import { ackRun, runWorkflowNow } from '@/shared/state/workflowsSlice';
 import { setPendingBrowserUrl } from '@/shared/state/tempStateSlice';
 import { fetchOutputs } from '@/shared/state/outputsSlice';
 import { setInstalling } from '@/shared/state/updateSlice';
@@ -88,6 +89,8 @@ const AppShell: React.FC = () => {
   }, []);
 
   const modelsLoaded = useAppSelector((s) => s.models.loaded);
+  // The models list is marked loaded even when its fetch fails, so it alone can't tell "no model" from "couldn't ask". Settings is where the user's own key/sub lives, so the banner waits for it.
+  const settingsKnown = useAppSelector((s) => s.settings.loaded);
   // "Connected" = the user's OWN model (key/sub/pro/custom), NOT a non-empty /models list: the free-trial Haiku is always in that list now, so a byProvider-length check would falsely read as connected and hide the out-of-runs banner.
   const hasModelConnected = useAppSelector(selectHasModelConnected);
   // While onboarding owns the window, the floating sidebar (and its hover-peek strip) must not exist; both out-z the overlay.
@@ -147,12 +150,14 @@ const AppShell: React.FC = () => {
   // Hold the banner until the boot free-trial mint settles, else a brand-new user sees it flash red for the ~1-3s the trial takes to arm. (Offline shows immediately, it's its own signal.)
   const freeTrialArmSettled = useAppSelector((s) => s.settings.freeTrialArmSettled);
   // The red wall is for genuine "no way to run" only; the free-trial states get the quiet nudge below.
-  const showWarningBanner = !isOnline || (modelsLoaded && freeTrialArmSettled && !hasModelConnected && !freeTrialActive && !freeTrialSpent);
+  const settingsSettled = useAppSelector((s) => s.settings.settled);
+  const backendUnreachable = settingsSettled && !settingsKnown;
+  const showWarningBanner = !isOnline || backendUnreachable || (settingsKnown && modelsLoaded && freeTrialArmSettled && !hasModelConnected && !freeTrialActive && !freeTrialSpent);
   const [ftNudgeDismissed, setFtNudgeDismissed] = useState<boolean>(() => {
     try { return localStorage.getItem('os_ft_nudge_dismissed') === '1'; } catch { return false; }
   });
   // Spent nudge hides the moment they connect a real model; the post-wow nudge only shows on the trial lane (so it already implies no own model) and is dismissible.
-  const showFreeTrialNudge = isOnline && ((freeTrialSpent && !hasModelConnected) || (freeTrialUsed && !ftNudgeDismissed));
+  const showFreeTrialNudge = isOnline && settingsKnown && ((freeTrialSpent && !hasModelConnected) || (freeTrialUsed && !ftNudgeDismissed));
 
   const bannerDismissedForVersion = availableVersion != null && dismissedVersion === availableVersion;
   const isUpdateActionable = updateStatus === 'available' || updateStatus === 'downloaded' || updateStatus === 'downloading';
@@ -301,6 +306,21 @@ const AppShell: React.FC = () => {
     });
   }, []);
 
+  // A click or an action button on the OS notification a finished workflow posted. Every outcome lands on something real; an unwired button on a notification is worse than no button.
+  useEffect(() => {
+    const bridge = window.openswarm;
+    if (!bridge?.onNotificationAction) return;
+    return bridge.onNotificationAction(({ outcome, runId, workflowId }) => {
+      if (!workflowId) return;
+      switch (outcome) {
+        case 'open': dispatch(openWorkflowMonitor({ workflowId, runId })); break;
+        case 'ack': if (runId) dispatch(ackRun(runId)); break;
+        case 'rerun': dispatch(runWorkflowNow(workflowId)); break;
+        case 'edit': dispatch(openWorkflowsApp({ workflowId })); break;
+      }
+    });
+  }, [dispatch]);
+
   // Zoom / find / tab-cycle from a focused browser GUEST (keydowns inside a webview can't reach this document, so main forwards them with the guest's id). Targets that exact browser; the host-focused counterparts live in the keydown below + useCanvasControls (zoom).
   useEffect(() => {
     const w = window as any;
@@ -478,6 +498,8 @@ const AppShell: React.FC = () => {
           <Typography sx={{ fontSize: '0.875rem', color: '#ef4444', flex: 1, fontWeight: 500, letterSpacing: '0.01em' }}>
             {!isOnline
               ? 'No internet connection; agents cannot reach AI models or external services'
+              : backendUnreachable
+              ? 'Cannot reach the OpenSwarm backend; your settings and agents are unavailable until it comes back'
               : (
                 <>
                   No AI model connected.{' '}
diff --git a/frontend/src/app/components/overlays/DynamicIsland.tsx b/frontend/src/app/components/overlays/DynamicIsland.tsx
index 25fd5bbe..4ac30c6d 100644
--- a/frontend/src/app/components/overlays/DynamicIsland.tsx
+++ b/frontend/src/app/components/overlays/DynamicIsland.tsx
@@ -21,14 +21,12 @@ import {
   stopAgent,
   dismissAgentNotification,
   dismissAllFinishedNotifications,
-  clearSessionMessages,
   ApprovalRequest,
   AgentSession,
   HistorySession,
 } from '@/shared/state/agentsSlice';
 import { displaySessionName } from '@/shared/state/sessionDisplay';
-import { API_BASE, getAuthToken } from '@/shared/config';
-import { store } from '@/shared/state/store';
+import { isUserLaunchedSession } from '@/shared/state/isUserLaunchedSession';
 import { setPendingFocusAgentId } from '@/shared/state/tempStateSlice';
 import ApprovalBar, { BatchApprovalBar, parseMcpToolName, useMcpToolMeta, getToolIcon } from '@/app/pages/AgentChat/shell/ApprovalBar';
 import GlobalSearchPalette from '@/app/components/overlays/GlobalSearchPalette';
@@ -183,6 +181,7 @@ type DiSession = {
   name: string;
   status: string;
   dashboard_id?: string;
+  userLaunched: boolean;
   pending_approvals: AgentSession['pending_approvals'];
 };
 
@@ -210,6 +209,7 @@ const selectDynamicIslandSessions = createSelector(
           name: s.name,
           status: s.status,
           dashboard_id: s.dashboard_id,
+          userLaunched: isUserLaunchedSession(s),
           pending_approvals: s.pending_approvals,
         };
         _diSessionCache.set(sid, next);
@@ -255,48 +255,6 @@ const DynamicIsland: React.FC = () => {
     };
   }, []);
 
-  // Cmd/Ctrl+L: clear the chat (focused card > activeSessionId > sole session); same as /clear.
-  useEffect(() => {
-    const handler = (e: KeyboardEvent) => {
-      if (!(e.metaKey || e.ctrlKey)) return;
-      if (e.shiftKey || e.altKey) return;
-      if (e.key.toLowerCase() !== 'l') return;
-
-      let target: string | null = null;
-      const ae = document.activeElement as HTMLElement | null;
-      if (ae) {
-        let el: HTMLElement | null = ae;
-        while (el) {
-          if (el.getAttribute?.('data-select-type') === 'agent-card') {
-            const sid = el.getAttribute('data-select-id');
-            if (sid) { target = sid; break; }
-          }
-          el = el.parentElement;
-        }
-      }
-      const state = store.getState();
-      if (!target) {
-        const activeId = state.agents.activeSessionId;
-        if (activeId) target = activeId;
-      }
-      if (!target) {
-        const ids = Object.keys(state.agents.sessions);
-        if (ids.length === 1) target = ids[0];
-      }
-      if (!target) return;
-
-      e.preventDefault();
-      const headers: Record<string, string> = { 'Content-Type': 'application/json' };
-      try {
-        const tok = getAuthToken();
-        if (tok) headers['Authorization'] = `Bearer ${tok}`;
-      } catch { /* unauthenticated dev mode */ }
-      fetch(`${API_BASE}/agents/sessions/${target}/clear`, { method: 'POST', headers }).catch(() => {});
-      dispatch(clearSessionMessages(target));
-    };
-    window.addEventListener('keydown', handler);
-    return () => window.removeEventListener('keydown', handler);
-  }, [dispatch]);
 
   const groups: SessionApprovalGroup[] = useMemo(() => {
     const result: SessionApprovalGroup[] = [];
@@ -322,10 +280,11 @@ const DynamicIsland: React.FC = () => {
       .map((id): TrackedAgent | null => {
         const session = sessions[id];
         if (session && session.status !== 'draft') {
+          if (!session.userLaunched) return null;
           return { id, name: session.name, status: session.status, dashboardId: session.dashboard_id };
         }
         const hist: HistorySession | undefined = history[id];
-        if (hist) {
+        if (hist && isUserLaunchedSession(hist)) {
           return { id, name: hist.name, status: hist.status, dashboardId: hist.dashboard_id };
         }
         return null;
@@ -336,7 +295,7 @@ const DynamicIsland: React.FC = () => {
     for (const g of groups) {
       if (!trackedIdSet.has(g.sessionId)) {
         const session = sessions[g.sessionId];
-        if (session && session.status !== 'draft') {
+        if (session && session.status !== 'draft' && session.userLaunched) {
           agents.push({ id: g.sessionId, name: session.name, status: session.status, dashboardId: session.dashboard_id });
         }
       }
@@ -615,12 +574,14 @@ const CompactPill: React.FC<{
         userSelect: 'none',
       }}
     >
-      <ActivityIndicator c={c} />
+      {activeCount > 0
+        ? <ActivityIndicator c={c} />
+        : <CheckIcon sx={{ fontSize: 13, color: c.status.success, flexShrink: 0 }} />}
       <Typography
         sx={{
           fontSize: '0.6875rem',
           fontWeight: 500,
-          color: c.text.tertiary,
+          color: activeCount > 0 ? c.text.tertiary : c.status.success,
           flex: 1,
           overflow: 'hidden',
           textOverflow: 'ellipsis',
diff --git a/frontend/src/app/components/overlays/GlobalSearchPalette.tsx b/frontend/src/app/components/overlays/GlobalSearchPalette.tsx
index 2633bbae..ce50cbb4 100644
--- a/frontend/src/app/components/overlays/GlobalSearchPalette.tsx
+++ b/frontend/src/app/components/overlays/GlobalSearchPalette.tsx
@@ -16,6 +16,7 @@ import { createDashboard } from '@/shared/state/dashboardsSlice';
 import { openSettingsModal } from '@/shared/state/settingsSlice';
 import { useClaudeTokens } from '@/shared/styles/ThemeContext';
 import { friendlyStatusLabel } from '@/shared/statusLabel';
+import TopLayerPortal from '@/shared/TopLayerPortal';
 
 interface Props {
   open: boolean;
@@ -205,7 +206,7 @@ const GlobalSearchPalette: React.FC<Props> = ({ open, onClose }) => {
   const isStillSearching = !!query.trim() && searchLoading && searchQuery !== query.trim();
 
   return (
-    <>
+    <TopLayerPortal>
       {/* Backdrop */}
       <Box
         onClick={onClose}
@@ -338,7 +339,7 @@ const GlobalSearchPalette: React.FC<Props> = ({ open, onClose }) => {
           <span>esc close</span>
         </Box>
       </Box>
-    </>
+    </TopLayerPortal>
   );
 };
 
diff --git a/frontend/src/app/pages/AgentChat/AgentChat.tsx b/frontend/src/app/pages/AgentChat/AgentChat.tsx
index 229b10d5..ad380fb4 100644
--- a/frontend/src/app/pages/AgentChat/AgentChat.tsx
+++ b/frontend/src/app/pages/AgentChat/AgentChat.tsx
@@ -20,6 +20,7 @@ import DragIndicatorIcon from '@mui/icons-material/DragIndicator';
 import RestartAltIcon from '@mui/icons-material/RestartAlt';
 import { useAppDispatch, useAppSelector } from '@/shared/hooks';
 import { friendlyStatusLabel } from '@/shared/statusLabel';
+import { getScrollFocusedCard } from '@/shared/cardScrollFocus';
 import { openSettingsModal, dismissMcpSuggestion } from '@/shared/state/settingsSlice';
 import { API_BASE, getAuthToken } from '@/shared/config';
 import {
@@ -77,6 +78,7 @@ import { setCardSidecar, commitDraft, updateWorkflowCard, controlWorkflowRun } f
 import { shallowEqual } from 'react-redux';
 import { useClaudeTokens, useThemeAccent, useThemeMode } from '@/shared/styles/ThemeContext';
 import { parseMcpToolName, getMcpInputSummary } from '@/shared/mcpToolMeta';
+import { isNarration } from './parsing/isNarration';
 
 const CONTEXT_WINDOWS: Record<string, number> = {
   'opus-4-8': 1_000_000,
@@ -694,6 +696,9 @@ const AgentChat: React.FC<AgentChatProps> = ({ sessionId: sessionIdProp, onClose
       if (e.ctrlKey || e.metaKey) return;
       // Horizontal-dominant gestures must also reach the canvas so a sideways swipe pans the dashboard (chat has no horizontal scroll to absorb).
       if (Math.abs(e.deltaX) > Math.abs(e.deltaY)) return;
+      // Google Maps model: a plain wheel over a chat you haven't clicked INTO belongs to the canvas, so let it through instead of swallowing it here (this is what made zoom look dead over any chat).
+      const cardId = el.closest('[data-select-id]')?.getAttribute('data-select-id') ?? null;
+      if (cardId && cardId !== getScrollFocusedCard()) return;
       const atTop = el.scrollTop <= 0;
       const atBottom = el.scrollTop + el.clientHeight >= el.scrollHeight - 1;
       const scrollingDown = e.deltaY > 0;
@@ -1112,7 +1117,9 @@ const AgentChat: React.FC<AgentChatProps> = ({ sessionId: sessionIdProp, onClose
             let j = i;
             while (j < activeBranchMessages.length && activeBranchMessages[j].role === 'assistant') j++;
             const next = activeBranchMessages[j];
-            if (next && (next.role === 'tool_call' || next.role === 'tool_result')) {
+            const absorbable = activeBranchMessages.slice(i, j).every((a) => isNarration(a.content));
+            // A long or structured message is the answer, not narration. Absorbing it hides the whole deliverable in a grey tool row and strips its markdown, which is worse than showing one redundant line.
+            if (next && absorbable && (next.role === 'tool_call' || next.role === 'tool_result')) {
               for (let k = i; k < j; k++) {
                 if (!activeBranchMessages[k].hidden) noteMarks.push({ afterCall: callsSoFar, msg: activeBranchMessages[k] });
               }
diff --git a/frontend/src/app/pages/AgentChat/parsing/isNarration.test.ts b/frontend/src/app/pages/AgentChat/parsing/isNarration.test.ts
new file mode 100644
index 00000000..dcb807d4
--- /dev/null
+++ b/frontend/src/app/pages/AgentChat/parsing/isNarration.test.ts
@@ -0,0 +1,70 @@
+// The answer must never be filed as tool chrome.
+//
+// Live case this exists for: an agent wrote a 1,060-word decision memo, then saved a memory. That
+// one trailing tool call reclassified the memo as narration, so the card showed the user's question,
+// a grey "3 tool calls" row, and nothing else. 0 of 1,060 words in the DOM. The run was marked done
+// and charged $0.22. Expanding the row showed the memo as raw markdown in 12px grey, labelled with
+// the file the agent had read.
+//
+// Run: cd frontend && npx tsx --test src/app/pages/AgentChat/parsing/isNarration.test.ts
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { isNarration } from './isNarration.js';
+
+test('short passing remarks are narration', () => {
+  for (const s of [
+    'Let me check that.',
+    'Found the session log. Setting up the monitor now.',
+    'Good question, let me look at what the workflow actually does rather than answer from memory.',
+    'One moment.',
+  ]) {
+    assert.equal(isNarration(s), true, `should absorb: ${s}`);
+  }
+});
+
+test('a long answer is never narration', () => {
+  const memo = 'The recommendation is to use a managed platform. '.repeat(12);
+  assert.ok(memo.length > 240);
+  assert.equal(isNarration(memo), false);
+});
+
+test('structure means it is a deliverable, however short', () => {
+  for (const s of [
+    '# Decision Memo',
+    '## Bottom line\nManaged, not self-hosted.',
+    '- Docusaurus\n- Astro Starlight',
+    '1. First\n2. Second',
+    '> A quoted conclusion.',
+    '```\nkubectl apply -f .\n```',
+    '| Platform | Cost |\n| --- | --- |',
+  ]) {
+    assert.equal(isNarration(s), false, `should stay visible: ${s.slice(0, 24)}`);
+  }
+});
+
+test('the real memo opening is not narration', () => {
+  const opening = '# Decision Memo: Kubernetes Hosting for a 12-Person Company\n\n'
+    + '**Recommendation: use a managed platform. Do not self-host.**';
+  assert.equal(isNarration(opening), false);
+});
+
+test('a bare sentence mentioning a dash is still narration', () => {
+  // The structure test anchors to line starts, so prose containing a hyphen must not trip it.
+  assert.equal(isNarration('Checking the well-known ports first.'), true);
+});
+
+test('empty and non-string content absorb rather than render an empty bubble', () => {
+  assert.equal(isNarration(''), true);
+  assert.equal(isNarration('   '), true);
+  assert.equal(isNarration(null), true);
+  assert.equal(isNarration(undefined), true);
+  assert.equal(isNarration(42), true);
+});
+
+test('the asymmetry is respected at the boundary', () => {
+  // Bias is deliberate: a redundant line costs noise, a hidden answer costs the whole run.
+  assert.equal(isNarration('x'.repeat(240)), true);
+  assert.equal(isNarration('x'.repeat(241)), false);
+});
diff --git a/frontend/src/app/pages/AgentChat/parsing/isNarration.ts b/frontend/src/app/pages/AgentChat/parsing/isNarration.ts
new file mode 100644
index 00000000..3ff18921
--- /dev/null
+++ b/frontend/src/app/pages/AgentChat/parsing/isNarration.ts
@@ -0,0 +1,26 @@
+// Is this assistant message throwaway narration, or is it the answer?
+//
+// The transcript folds narration that sits between two tool runs into the grey tool group, which is
+// right for "Let me check that" and catastrophic for a 1,060-word memo: the deliverable vanishes
+// from the card entirely, and expanding the group renders it as raw markdown source in tertiary
+// grey inside a row labelled with whatever file the agent happened to read. Observed live on a real
+// run, with the answer streaming in and then disappearing the instant the run completed.
+//
+// The two mistakes are not symmetric. Showing one redundant sentence inline costs a line of noise.
+// Hiding the answer costs the user the entire run, silently, while it is marked done and billed.
+// So this is deliberately biased toward "that is the answer, show it".
+
+/** Past this, it is not a passing remark. Real narration in practice is a short sentence or two. */
+const NARRATION_MAX_CHARS = 240;
+
+// Structure means someone is presenting, not muttering: a heading, a list, a table, a code fence, a
+// quote, or a horizontal rule. Any of these makes the message a deliverable regardless of length.
+const STRUCTURE = /(^|\n)\s*(#{1,6}\s|[-*+]\s|\d+\.\s|>\s|\||```|---)/;
+
+export function isNarration(content: unknown): boolean {
+  if (typeof content !== 'string') return true;
+  const text = content.trim();
+  if (text.length === 0) return true;
+  if (text.length > NARRATION_MAX_CHARS) return false;
+  return !STRUCTURE.test(text);
+}
diff --git a/frontend/src/app/pages/Dashboard/DashboardToolbar.tsx b/frontend/src/app/pages/Dashboard/DashboardToolbar.tsx
index 6d12db4c..61b45fee 100644
--- a/frontend/src/app/pages/Dashboard/DashboardToolbar.tsx
+++ b/frontend/src/app/pages/Dashboard/DashboardToolbar.tsx
@@ -10,14 +10,17 @@ import DesktopSpawnPill from './desktop/DesktopSpawnPill';
 import SearchIcon from '@mui/icons-material/Search';
 import { motion } from 'framer-motion';
 import ChatInput from '@/app/pages/AgentChat/ChatInput';
+import { EmptyState } from '@/app/components/feedback/Loading';
 import type { ContextPath } from '@/app/components/editor/DirectoryBrowser';
 import SchedulePopover from '@/app/pages/Workflows/SchedulePopover';
 import { openWorkflowCard, fetchAllRuns, upsertRun } from '@/shared/state/workflowsSlice';
-import { addWorkflowCard, openWorkflowsApp, closeWorkflowsApp } from '@/shared/state/dashboardLayoutSlice';
+import { addWorkflowCard, openWorkflowsApp, closeWorkflowsApp, WORKFLOWS_HUB_ID } from '@/shared/state/dashboardLayoutSlice';
 import { useElementSelection } from '@/app/components/editor/ElementSelectionContext';
 import { useClaudeTokens, DarkTokensScope } from '@/shared/styles/ThemeContext';
 import { useAppDispatch, useAppSelector } from '@/shared/hooks';
-import { searchHistory, clearHistorySearch } from '@/shared/state/agentsSlice';
+import { searchHistory, clearHistorySearch, deleteSession, renameSession } from '@/shared/state/agentsSlice';
+import { openCardContextMenu } from './desktop/openCardContextMenu';
+import { displaySessionName } from '@/shared/state/sessionDisplay';
 import { updateSettingsPatch, AppSettings } from '@/shared/state/settingsSlice';
 import { store } from '@/shared/state/store';
 import { API_BASE, getAuthToken } from '@/shared/config';
@@ -169,7 +172,8 @@ const DashboardToolbar = React.forwardRef<HTMLDivElement, Props>(
     const allRuns = useAppSelector((s) => s.workflows.allRuns);
     const allRunsLoading = useAppSelector((s) => s.workflows.allRunsLoading);
     const workflowItems = useAppSelector((s) => s.workflows.items);
-    const workflowsHubOpen = useAppSelector((s) => Boolean(s.dashboardLayout.workflowsHub));
+    // Parked counts as not-showing, so the pill restores the window instead of throwing its state away.
+    const workflowsHubOpen = useAppSelector((s) => Boolean(s.dashboardLayout.workflowsHub) && !s.dashboardLayout.minimizedCards[WORKFLOWS_HUB_ID]);
 
     const outputList = useMemo(() => Object.values(outputs), [outputs]);
     const filteredOutputs = useMemo(() => {
@@ -252,6 +256,25 @@ const DashboardToolbar = React.forwardRef<HTMLDivElement, Props>(
       handleCloseHistory();
     }, [onHistoryResume, handleCloseHistory]);
 
+    const handleHistoryContextMenu = useCallback((e: React.MouseEvent, entry: { id: string; name: string }) => {
+      openCardContextMenu(e, {
+        rename: { value: displaySessionName(entry.name), onCommit: (name) => { void dispatch(renameSession({ sessionId: entry.id, name })); } },
+        items: [
+          { label: 'Resume chat', onClick: () => handleHistorySelect(entry.id) },
+          { kind: 'separator' },
+          {
+            label: 'Delete chat',
+            danger: true,
+            onClick: () => {
+              void dispatch(deleteSession({ sessionId: entry.id })).then(() => {
+                dispatch(searchHistory({ q: historyQuery, limit: HISTORY_PAGE_SIZE, offset: 0 }));
+              });
+            },
+          },
+        ],
+      });
+    }, [dispatch, handleHistorySelect, historyQuery]);
+
     const handleHistoryLoadMore = useCallback(() => {
       if (historySearch.loading || !historySearch.hasMore) return;
       dispatch(searchHistory({
@@ -460,6 +483,7 @@ const DashboardToolbar = React.forwardRef<HTMLDivElement, Props>(
               historyQuery={historyQuery}
               onHistoryQueryChange={setHistoryQuery}
               onHistorySelect={handleHistorySelect}
+              onHistoryContextMenu={handleHistoryContextMenu}
               onNewChat={() => { handleCloseHistory(); onNewAgent(); }}
               onWorkflowSelect={(wid) => {
                 dispatch(openWorkflowsApp({ workflowId: wid }));
@@ -514,11 +538,7 @@ const DashboardToolbar = React.forwardRef<HTMLDivElement, Props>(
               }}
             >
               {filteredOutputs.length === 0 ? (
-                <Box sx={{ px: 2, py: 3, textAlign: 'center' }}>
-                  <Typography sx={{ fontSize: '0.8125rem', color: c.text.muted }}>
-                    {outputList.length === 0 ? 'No apps created yet' : 'No matching apps'}
-                  </Typography>
-                </Box>
+                <EmptyState title={outputList.length === 0 ? 'No apps created yet' : 'No matching apps'} />
               ) : (
                 filteredOutputs.map((output) => (
                   <Box
diff --git a/frontend/src/app/pages/Dashboard/canvas/DashboardCanvas.tsx b/frontend/src/app/pages/Dashboard/canvas/DashboardCanvas.tsx
index 27cb646c..032e51b1 100644
--- a/frontend/src/app/pages/Dashboard/canvas/DashboardCanvas.tsx
+++ b/frontend/src/app/pages/Dashboard/canvas/DashboardCanvas.tsx
@@ -1,11 +1,13 @@
 import React, { useEffect, type RefObject } from 'react';
 import Box from '@mui/material/Box';
 import { useAppDispatch, useAppSelector } from '@/shared/hooks';
-import { addViewCard, clearTiledCard, selectFullscreenCardId } from '@/shared/state/dashboardLayoutSlice';
+import { addViewCard, clearTiledCard, toggleMinimizeCard, selectFullscreenCardId } from '@/shared/state/dashboardLayoutSlice';
 import DashboardHeader from './DashboardHeader';
 import TetherLayer from './TetherLayer';
 import DashboardCardLayer from './DashboardCardLayer';
 import DashboardOverlays from './DashboardOverlays';
+import CardContextMenu from '../desktop/CardContextMenu';
+import { useCanvasContextMenu } from './useCanvasContextMenu';
 import DashboardEmptyState from './DashboardEmptyState';
 import '../desktop/desktop.css';
 import DesktopDock from '../desktop/DesktopDock';
@@ -72,7 +74,8 @@ interface DashboardCanvasProps {
   getCanvasState: () => { panX: number; panY: number; zoom: number };
   onViewportMouseDown: (e: React.MouseEvent) => void;
   onViewportMouseMove: (e: React.MouseEvent) => void;
-  onViewportMouseUp: (e: React.MouseEvent) => void;
+  /** Returns true when the release ended a marquee drag rather than a plain click. */
+  onViewportMouseUp: (e: React.MouseEvent) => boolean;
   onViewportDoubleClick: (e: React.MouseEvent) => void;
   onCardSelect: (id: string, type: CardType, shiftKey: boolean, originTarget?: EventTarget | null) => void;
   onDragStart: (id: string, type: CardType) => void;
@@ -170,11 +173,15 @@ const DashboardCanvas: React.FC<DashboardCanvasProps> = ({
   // macOS full screen: one card owns the whole window, every piece of chrome steps aside; Esc exits.
   const dispatch = useAppDispatch();
   const fullscreenCardId = useAppSelector(selectFullscreenCardId);
-  // The singleton app windows (Workflows, Settings) carry their own fullscreen flag, not a tiledCard; their fill also hides the dock.
-  const settingsFullscreen = useAppSelector((s) => !!s.dashboardLayout.settingsCard?.fullscreen);
-  const anyFullscreen = !!fullscreenCardId || !!workflowsHub?.fullscreen || settingsFullscreen;
+  const minimizedCards = useAppSelector((s) => s.dashboardLayout.minimizedCards);
+  const anyFullscreen = !!fullscreenCardId;
   const [headerRevealed, setHeaderRevealed] = React.useState(false);
   const [appsWindowOpen, setAppsWindowOpen] = React.useState(false);
+  const openCanvasMenu = useCanvasContextMenu({
+    dispatch, dashboardId, expandedSessionIds, selection, canvasEmpty,
+    viewportRef: canvas.viewportRef, getCamera: canvas.actions.getLiveState,
+    onNewAgent, onAddBrowser, onApplications: () => setAppsWindowOpen(true), onTidy, onFitToView,
+  });
   useEffect(() => {
     if (!fullscreenCardId) return undefined;
     const onKey = (e: KeyboardEvent): void => {
@@ -246,7 +253,8 @@ const DashboardCanvas: React.FC<DashboardCanvasProps> = ({
           // page->transparent fade here just read as a light-leak band over the themed canvas.
         }}
       >
-        <Box sx={{ display: 'flex', alignItems: 'center', pointerEvents: 'auto' }}>
+        {/* Must follow the reveal: an always-auto child overrides the hidden overlay's pointer-events:none and swallowed the whole top strip, so a top/left-tiled window's traffic lights were unclickable. */}
+        <Box sx={{ display: 'flex', alignItems: 'center', pointerEvents: headerRevealed ? 'auto' : 'none' }}>
           <DashboardHeader
             dashboardName={dashboardName}
             sessions={sessions}
@@ -268,6 +276,9 @@ const DashboardCanvas: React.FC<DashboardCanvasProps> = ({
       {!anyFullscreen && (
         <MinimizedStack
           browserCards={browserCards}
+          viewCards={viewCards}
+          outputs={outputs}
+          selectedIds={Array.from(selection.selectedIds.keys())}
           onRestore={(cardId, rect) => {
             canvas.actions.fitToCards([rect], 1.15, true);
             onHighlightCard?.(cardId);
@@ -285,6 +296,8 @@ const DashboardCanvas: React.FC<DashboardCanvasProps> = ({
           outputs={outputs}
           selectedIds={Array.from(selection.selectedIds.keys())}
           onFocusCard={(cardId, rect) => {
+            // A parked card sits off-canvas, so flying to its stored rect would land on empty space; unpark it first.
+            if (minimizedCards[cardId]) dispatch(toggleMinimizeCard({ cardId }));
             canvas.actions.fitToCards([rect], 1.15, true);
             onHighlightCard?.(cardId);
           }}
@@ -307,16 +320,17 @@ const DashboardCanvas: React.FC<DashboardCanvasProps> = ({
         data-canvas-viewport
         onMouseDown={onViewportMouseDown}
         onMouseMove={onViewportMouseMove}
-        onMouseUp={onViewportMouseUp}
+        onMouseUp={(e) => {
+          const marqueed = onViewportMouseUp(e);
+          // The right button belongs to the marquee, so the canvas menu waits for the release and
+          // only opens when nothing was rubber-banded. Opening on press stole the drag.
+          if (e.button === 2 && !marqueed) openCanvasMenu(e);
+        }}
         onDoubleClick={onViewportDoubleClick}
-        onContextMenu={(e) => {
-          // Right-drag is the canvas marquee-select (Google-Maps style), so the native menu (Inspect
-          // Element in dev) shouldn't pop over it. Suppress only on the bare canvas; cards, inputs, and
-          // webviews keep their own menus.
+        onContextMenu={(e: React.MouseEvent) => {
+          // Bare canvas: kill the native menu (Inspect Element in dev) so the right-drag stays clean.
           const t = e.target as HTMLElement;
-          if (!t.closest('[data-select-id]') && !t.closest('input, textarea, [contenteditable]')) {
-            e.preventDefault();
-          }
+          if (!t.closest('[data-select-id]') && !t.closest('input, textarea, [contenteditable]')) e.preventDefault();
         }}
         sx={{
           position: 'absolute',
@@ -462,6 +476,10 @@ const DashboardCanvas: React.FC<DashboardCanvasProps> = ({
         toolbarPrefillMode={toolbarPrefillMode}
       />
       </Box>
+
+      {/* Sibling of everything: the menu used to live inside the help pill's z:10 box (so any card
+          brought to front painted over it) and inside the fullscreen display:none wrapper. */}
+      <CardContextMenu />
     </Box>
     </>
   );
diff --git a/frontend/src/app/pages/Dashboard/canvas/DashboardEmptyState.tsx b/frontend/src/app/pages/Dashboard/canvas/DashboardEmptyState.tsx
index 93bf2374..b44b8a8e 100644
--- a/frontend/src/app/pages/Dashboard/canvas/DashboardEmptyState.tsx
+++ b/frontend/src/app/pages/Dashboard/canvas/DashboardEmptyState.tsx
@@ -30,6 +30,9 @@ function iconForStarter(text: string): LucideIcon {
 
 // The placeholder cycles agentic invitations with a typewriter feel (only while the field is empty),
 // so the hero reads like an agent offering to go DO things, not a search box waiting for keywords.
+// Seven lines of prompt, then it scrolls: enough to see a whole paragraph without the hero eating the starters below it.
+const COMPOSER_MAX_H = 176;
+
 const GHOST_DEFAULTS = [
   'Send an agent to find me something great...',
   'Build me a tool I can use right now...',
@@ -66,11 +69,13 @@ const DashboardEmptyState: React.FC<{
   const model = useAppSelector((s) => s.settings.data.default_model);
   const mode = useAppSelector((s) => s.settings.data.default_mode);
   const canRun = useAppSelector((s) => hasFreeTrialActive(s) || hasModelConnected(s));
+  const settingsKnown = useAppSelector((s) => s.settings.loaded);
   const personalized = useAppSelector((s) => s.settings.data.personalized_starters ?? []);
   const personalizedMenu = useAppSelector((s) => s.settings.data.personalized_menu ?? null);
   const userName = useAppSelector((s) => s.settings.data.user_name ?? null);
   const [text, setText] = React.useState('');
   const [launching, setLaunching] = React.useState(false);
+  const fieldRef = React.useRef<HTMLTextAreaElement>(null);
   const [openCat, setOpenCat] = React.useState<HeroCategoryId | null>(null);
   const menu = React.useMemo(() => heroMenuFor(personalizedMenu, personalized), [personalizedMenu, personalized]);
   const firstName = (userName ?? '').trim().split(/\s+/)[0] || null;
@@ -80,6 +85,14 @@ const DashboardEmptyState: React.FC<{
     [personalized],
   );
   const ghost = useTypedGhost(ghostLines, text.length === 0 && canRun);
+  // Height follows the value, so a long prompt wraps into view instead of scrolling sideways, and
+  // clearing on send snaps it back to one line. Past the cap it scrolls, like every other composer.
+  React.useLayoutEffect(() => {
+    const el = fieldRef.current;
+    if (!el) return;
+    el.style.height = 'auto';
+    el.style.height = `${Math.min(el.scrollHeight, COMPOSER_MAX_H)}px`;
+  }, [text]);
 
   const launch = (prompt: string) => {
     const p = prompt.trim();
@@ -115,7 +128,7 @@ const DashboardEmptyState: React.FC<{
                 floating chrome (sidebar, pills, chat cards), not a stark white box that fights the canvas. */}
             <Box
               sx={{
-                display: 'flex', alignItems: 'center', gap: 1,
+                display: 'flex', alignItems: 'flex-end', gap: 1,
                 background: 'rgba(22,12,34,0.72)',
                 backdropFilter: 'blur(20px) saturate(160%)',
                 WebkitBackdropFilter: 'blur(20px) saturate(160%)',
@@ -126,18 +139,21 @@ const DashboardEmptyState: React.FC<{
               }}
             >
               <Box
-                component="input"
+                component="textarea"
+                ref={fieldRef}
+                rows={1}
                 value={text}
                 autoFocus
-                onChange={(e: React.ChangeEvent<HTMLInputElement>) => setText(e.target.value)}
-                onKeyDown={(e: React.KeyboardEvent<HTMLInputElement>) => {
+                onChange={(e: React.ChangeEvent<HTMLTextAreaElement>) => setText(e.target.value)}
+                onKeyDown={(e: React.KeyboardEvent<HTMLTextAreaElement>) => {
                   if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); launch(text); setText(''); }
                 }}
                 placeholder={ghost || "Ask me anything..."}
                 disabled={launching}
                 sx={{
-                  flex: 1, border: 'none', outline: 'none', bgcolor: 'transparent',
+                  flex: 1, border: 'none', outline: 'none', bgcolor: 'transparent', resize: 'none',
                   color: 'rgba(255,255,255,0.92)', fontFamily: 'inherit', fontSize: c.font.size.md,
+                  lineHeight: '24px', py: '4px', maxHeight: `${COMPOSER_MAX_H}px`, overflowY: 'auto',
                   '&::placeholder': { color: 'rgba(255,255,255,0.45)' },
                 }}
               />
@@ -248,7 +264,8 @@ const DashboardEmptyState: React.FC<{
           </>
         ) : (
           <Typography sx={{ color: c.text.ghost, fontSize: c.font.size.base, textAlign: 'center' }}>
-            Connect a model in Settings to get started.
+            {/* With the backend down we don't know what the user has connected, so don't tell them they have nothing. */}
+            {settingsKnown ? 'Connect a model in Settings to get started.' : 'Waiting for the OpenSwarm backend...'}
           </Typography>
         )}
       </Box>
diff --git a/frontend/src/app/pages/Dashboard/canvas/DashboardOverlays.tsx b/frontend/src/app/pages/Dashboard/canvas/DashboardOverlays.tsx
index 868bb33f..4302182c 100644
--- a/frontend/src/app/pages/Dashboard/canvas/DashboardOverlays.tsx
+++ b/frontend/src/app/pages/Dashboard/canvas/DashboardOverlays.tsx
@@ -3,10 +3,10 @@ import Box from '@mui/material/Box';
 import DashboardToolbar from '../DashboardToolbar';
 import CanvasControls from '../controls/CanvasControls';
 import HelpPill from '../desktop/HelpPill';
-import CardContextMenu from '../desktop/CardContextMenu';
 import CardSearchPalette from '../controls/CardSearchPalette';
 import DirectionHints from '../controls/DirectionHints';
 import WorkflowRunningToast from '@/app/pages/Workflows/WorkflowRunningToast';
+import WorkflowNoticeToast from '@/app/pages/Workflows/WorkflowNoticeToast';
 import MissedRunsToast from '@/app/pages/Workflows/MissedRunsToast';
 import ProviderHealthToast from '@/app/components/overlays/ProviderHealthToast';
 import ScheduleOfferToast from '@/app/components/nudges/ScheduleOfferToast';
@@ -120,7 +120,6 @@ const DashboardOverlays: React.FC<DashboardOverlaysProps> = ({
       {!anyFullscreen && (
       <Box sx={{ position: 'absolute', top: 14, right: 16, zIndex: 10 }}>
         <HelpPill />
-      <CardContextMenu />
       </Box>
       )}
 
@@ -174,6 +173,7 @@ const DashboardOverlays: React.FC<DashboardOverlaysProps> = ({
 
       {/* Scheduled-run nudge: "your {workflow} is running now" + jump-to-canvas */}
       <WorkflowRunningToast />
+      <WorkflowNoticeToast />
 
       {/* Launch nudge when scheduled runs elapsed while the app was closed */}
       <MissedRunsToast />
diff --git a/frontend/src/app/pages/Dashboard/canvas/canvasMenuRows.ts b/frontend/src/app/pages/Dashboard/canvas/canvasMenuRows.ts
new file mode 100644
index 00000000..fedb5a43
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/canvas/canvasMenuRows.ts
@@ -0,0 +1,36 @@
+import { reopenLastClosed } from '@/shared/state/dashboardLayoutSlice';
+import { getClipboardCards } from '@/shared/dashboardClipboard';
+import type { AppDispatch } from '@/shared/state/store';
+import type { CardMenuRow } from '../desktop/openCardContextMenu';
+import { chord } from '../desktop/chord';
+
+interface CanvasMenuArgs {
+  dispatch: AppDispatch;
+  hasCards: boolean;
+  onNewAgent: () => void;
+  onAddBrowser: () => void;
+  onApplications: () => void;
+  onPaste: () => void;
+  onSelectAll: () => void;
+  onTidy: () => void;
+  onFitToView: () => void;
+}
+
+export function canvasMenuRows({
+  dispatch, hasCards, onNewAgent, onAddBrowser, onApplications, onPaste, onSelectAll, onTidy, onFitToView,
+}: CanvasMenuArgs): CardMenuRow[] {
+  return [
+    { kind: 'header', label: 'New' },
+    { label: 'New chat', onClick: onNewAgent },
+    { label: 'New browser', shortcut: chord('mod', 'N'), onClick: onAddBrowser },
+    { label: 'Add app', shortcut: chord('mod', 'M'), onClick: onApplications },
+    { kind: 'separator' },
+    { label: 'Paste', shortcut: chord('mod', 'V'), disabled: getClipboardCards().length === 0, onClick: onPaste },
+    { label: 'Reopen last closed', shortcut: chord('mod', 'shift', 'T'), onClick: () => { void dispatch(reopenLastClosed()); } },
+    { kind: 'separator' },
+    { kind: 'header', label: 'Canvas' },
+    { label: 'Select all', shortcut: chord('mod', 'A'), disabled: !hasCards, onClick: onSelectAll },
+    { label: 'Tidy layout', disabled: !hasCards, onClick: onTidy },
+    { label: 'Fit to view', disabled: !hasCards, onClick: onFitToView },
+  ];
+}
diff --git a/frontend/src/app/pages/Dashboard/canvas/revealZoom.test.ts b/frontend/src/app/pages/Dashboard/canvas/revealZoom.test.ts
new file mode 100644
index 00000000..8627671d
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/canvas/revealZoom.test.ts
@@ -0,0 +1,36 @@
+// Run: cd frontend && npx tsx --test src/app/pages/Dashboard/canvas/revealZoom.test.ts
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { revealZoom, REVEAL_MIN_ZOOM } from './revealZoom.js';
+
+const MIN = 0.15, MAX = 3.0;
+
+test('a spawn never zooms IN, which is the behaviour worth keeping', () => {
+  assert.equal(revealZoom(0.8, 2.0, MIN, MAX), 0.8);
+});
+
+test('it still zooms out when the card genuinely does not fit', () => {
+  assert.equal(revealZoom(1.0, 0.7, MIN, MAX), 0.7);
+});
+
+test('but never below readable, which is the bug', () => {
+  assert.equal(revealZoom(1.0, 0.05, MIN, MAX), REVEAL_MIN_ZOOM);
+  assert.equal(revealZoom(0.6, 0.18, MIN, MAX), REVEAL_MIN_ZOOM);
+});
+
+test('the measured death spiral bottoms out instead of reaching 18%', () => {
+  // Replays the real session: each step is a reveal whose fit was tighter than the last.
+  let z = 1.0;
+  for (const fit of [0.88, 0.79, 0.76, 0.61, 0.36, 0.34, 0.18]) z = revealZoom(z, fit, MIN, MAX);
+  assert.equal(z, REVEAL_MIN_ZOOM);
+  assert.ok(z >= REVEAL_MIN_ZOOM, 'must not ratchet past the floor no matter how many spawns');
+});
+
+test('a camera the user already zoomed out by hand is left alone', () => {
+  // Below the floor already: the reveal must not yank them back IN, that would fight the user.
+  assert.equal(revealZoom(0.2, 0.9, MIN, MAX), 0.2);
+});
+
+test('it respects the hard bounds', () => {
+  assert.equal(revealZoom(5.0, 9.0, MIN, MAX), MAX);
+});
diff --git a/frontend/src/app/pages/Dashboard/canvas/revealZoom.ts b/frontend/src/app/pages/Dashboard/canvas/revealZoom.ts
new file mode 100644
index 00000000..8e927294
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/canvas/revealZoom.ts
@@ -0,0 +1,18 @@
+// How far the camera is allowed to pull back when a new card appears.
+//
+// The reveal takes min(current, fit) so a spawn never zooms IN, which is right. But that made the
+// camera monotonically decreasing: every spawn that did not fit ratcheted it out and nothing ever
+// brought it back. Measured over one ordinary session: 100% -> 88% -> 79% -> 61% -> 36% -> 18%, at
+// which point the workspace is a fifth of the viewport and not one word is readable.
+//
+// So the reveal gets a floor. Fitting every card on screen is not the goal; seeing the new one is.
+// A hand-driven zoom is untouched and can still go to the hard minimum.
+
+export const REVEAL_MIN_ZOOM = 0.5;
+
+export function revealZoom(currentZoom: number, fitZoom: number, minZoom: number, maxZoom: number): number {
+  // Floor the FIT, not the result. Flooring the result would drag a user who had deliberately zoomed
+  // out back IN, which breaks the one rule this function already had: a reveal never zooms in.
+  const floor = Math.max(minZoom, REVEAL_MIN_ZOOM);
+  return Math.min(Math.min(currentZoom, Math.max(fitZoom, floor)), maxZoom);
+}
diff --git a/frontend/src/app/pages/Dashboard/canvas/tiledGeometry.ts b/frontend/src/app/pages/Dashboard/canvas/tiledGeometry.ts
new file mode 100644
index 00000000..c5d0307a
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/canvas/tiledGeometry.ts
@@ -0,0 +1,192 @@
+// The ONE writer of a tiled card's on-screen rect. A tiled card lives INSIDE the pan/zoom layer (so
+// its webview is never remounted, which would log the user out) yet has to hold still against the
+// viewport, so something must undo the camera on every frame. That job used to be split between
+// React, framer-motion and an imperative !important writer, and any frame where they disagreed left
+// the tile frozen at a stale camera. Now React owns only the card's SIZE, which no camera can
+// change, and this module owns exactly one property, `transform`, written in the same task that
+// paints the canvas itself. Two sources can no longer hold two different cameras.
+
+export interface Camera {
+  panX: number;
+  panY: number;
+  zoom: number;
+}
+
+export const TILE_ZONES: Record<string, { x: number; y: number; w: number; h: number }> = {
+  fill:   { x: 0,     y: 0,   w: 1,     h: 1 },
+  left:   { x: 0,     y: 0,   w: 0.5,   h: 1 },
+  right:  { x: 0.5,   y: 0,   w: 0.5,   h: 1 },
+  top:    { x: 0,     y: 0,   w: 1,     h: 0.5 },
+  bottom: { x: 0,     y: 0.5, w: 1,     h: 0.5 },
+  tl:     { x: 0,     y: 0,   w: 0.5,   h: 0.5 },
+  tr:     { x: 0.5,   y: 0,   w: 0.5,   h: 0.5 },
+  bl:     { x: 0,     y: 0.5, w: 0.5,   h: 0.5 },
+  br:     { x: 0.5,   y: 0.5, w: 0.5,   h: 0.5 },
+  t3l:    { x: 0,     y: 0,   w: 1 / 3, h: 1 },
+  t3c:    { x: 1 / 3, y: 0,   w: 1 / 3, h: 1 },
+  t3r:    { x: 2 / 3, y: 0,   w: 1 / 3, h: 1 },
+};
+
+// macOS Sequoia leaves a small gap between tiled windows; we match it.
+const GAP = 8;
+
+export interface ZoneRect {
+  x: number;
+  y: number;
+  w: number;
+  h: number;
+}
+
+interface Workspace {
+  x0: number;
+  x1: number;
+  w: number;
+  h: number;
+}
+
+// Pure layout, never the camera, so a pan/zoom frame reads nothing back out of the DOM.
+let workspace: Workspace | null = null;
+
+const CHROME_SELECTORS = ['[data-canvas-viewport]', '[data-desktop-dock]', '[data-minimized-rail]'];
+
+// How much of one edge a chrome strip claims. It only counts when it is real, overlaps the viewport,
+// and actually hugs the edge it claims, so an absent or collapsed strip yields 0, never a bogus inset.
+function edgeInset(selector: string, vp: DOMRect, side: 'left' | 'right'): number {
+  const r = document.querySelector(selector)?.getBoundingClientRect();
+  if (!r || !(r.width > 0)) return 0;
+  if (side === 'left') {
+    return r.right > vp.left && r.left < vp.left + vp.width * 0.25 ? r.right - vp.left + GAP : 0;
+  }
+  return r.left < vp.right && r.right > vp.left + vp.width * 0.75 ? vp.right - r.left + GAP : 0;
+}
+
+function measureWorkspace(): Workspace {
+  const el = document.querySelector('[data-canvas-viewport]');
+  const r = el?.getBoundingClientRect();
+  if (!r || !(r.width > 0 && r.height > 0)) return { x0: 0, x1: 0, w: window.innerWidth, h: window.innerHeight };
+  // macOS model: a tiled window sits BESIDE the Dock and beside the minimized rail, never under either.
+  return {
+    x0: edgeInset('[data-desktop-dock]', r, 'left'),
+    x1: edgeInset('[data-minimized-rail]', r, 'right'),
+    w: r.width,
+    h: r.height,
+  };
+}
+
+// Screen-space rect (relative to the canvas viewport) that a zone occupies.
+export function zoneRect(zone: string): ZoneRect | null {
+  const ws = workspace ?? (workspace = measureWorkspace());
+  const usableW = ws.w - ws.x0 - ws.x1;
+  if (zone === 'fullscreen') {
+    return { x: ws.x0 + GAP, y: GAP, w: usableW - GAP * 2, h: ws.h - GAP * 2 };
+  }
+  const z = TILE_ZONES[zone];
+  if (!z) return null;
+  return {
+    x: ws.x0 + z.x * usableW + GAP,
+    y: z.y * ws.h + GAP,
+    w: z.w * usableW - GAP * 2,
+    h: z.h * ws.h - GAP * 2,
+  };
+}
+
+interface TiledEntry {
+  el: HTMLElement;
+  zone: string;
+  // The card's own canvas-space origin, which React keeps owning. The transform below is only the
+  // delta from there to the zone, so tiling never rewrites a stored position and untiling never jumps.
+  originX: number;
+  originY: number;
+}
+
+const entries = new Map<string, TiledEntry>();
+const workspaceListeners = new Set<() => void>();
+let lastCamera: Camera = { panX: 0, panY: 0, zoom: 1 };
+let observer: ResizeObserver | null = null;
+let chromeMounts: MutationObserver | null = null;
+const observed = new Set<Element>();
+
+function applyEntry(entry: TiledEntry, cam: Camera): void {
+  const r = zoneRect(entry.zone);
+  if (!r) return;
+  const s = 1 / cam.zoom;
+  const tx = (r.x - cam.panX) * s - entry.originX;
+  const ty = (r.y - cam.panY) * s - entry.originY;
+  entry.el.style.transform = `translate(${tx}px, ${ty}px) scale(${s})`;
+}
+
+// Called by the canvas's one camera-to-DOM writer, in the same task as the canvas transform.
+export function syncTiledGeometry(cam: Camera): void {
+  lastCamera = cam;
+  for (const entry of entries.values()) applyEntry(entry, cam);
+}
+
+function onWorkspaceChanged(): void {
+  workspace = null;
+  observeChrome();
+  for (const entry of entries.values()) applyEntry(entry, lastCamera);
+  workspaceListeners.forEach((fn) => fn());
+}
+
+// Lets a tiled card re-render for its new SIZE when the workspace changes shape.
+export function subscribeTiledWorkspace(fn: () => void): () => void {
+  workspaceListeners.add(fn);
+  return () => { workspaceListeners.delete(fn); };
+}
+
+// Re-queried, never cached: the rail unmounts whenever nothing is parked. Re-observing an element the
+// ResizeObserver already holds would re-fire it, so each one is only ever handed over once.
+function observeChrome(): void {
+  if (!observer) return;
+  for (const selector of CHROME_SELECTORS) {
+    const el = document.querySelector(selector);
+    if (el && !observed.has(el)) {
+      observed.add(el);
+      observer.observe(el);
+    }
+  }
+  const strip = document.querySelector('[data-canvas-viewport]')?.parentElement;
+  // A ResizeObserver can't see the rail APPEAR, so watch the row it mounts into; without this a tile
+  // measured on a bare canvas keeps its width and slides under the rail the first card parks in.
+  if (strip && !chromeMounts) {
+    chromeMounts = new MutationObserver(onWorkspaceChanged);
+    chromeMounts.observe(strip, { childList: true });
+  }
+}
+
+function startObserving(): void {
+  if (observer) return;
+  observer = new ResizeObserver(onWorkspaceChanged);
+  observeChrome();
+  window.addEventListener('resize', onWorkspaceChanged);
+}
+
+function stopObserving(): void {
+  observer?.disconnect();
+  observer = null;
+  chromeMounts?.disconnect();
+  chromeMounts = null;
+  observed.clear();
+  window.removeEventListener('resize', onWorkspaceChanged);
+}
+
+export function registerTiledCard(id: string, zone: string, origin: { x: number; y: number }, cam: Camera): void {
+  const el = document.querySelector<HTMLElement>(`[data-select-id="${CSS.escape(id)}"]`);
+  if (!el) return;
+  const entry: TiledEntry = { el, zone, originX: origin.x, originY: origin.y };
+  entries.set(id, entry);
+  startObserving();
+  // Tiling usually commits alongside chrome collapsing, so a cached workspace is untrustworthy here.
+  workspace = null;
+  lastCamera = cam;
+  applyEntry(entry, cam);
+}
+
+export function unregisterTiledCard(id: string): void {
+  const entry = entries.get(id);
+  if (!entry) return;
+  // Hand the property straight back to React's styles; nothing else ever wrote it.
+  entry.el.style.transform = '';
+  entries.delete(id);
+  if (entries.size === 0) stopObserving();
+}
diff --git a/frontend/src/app/pages/Dashboard/canvas/useCanvasContextMenu.ts b/frontend/src/app/pages/Dashboard/canvas/useCanvasContextMenu.ts
new file mode 100644
index 00000000..bce49751
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/canvas/useCanvasContextMenu.ts
@@ -0,0 +1,52 @@
+import { useCallback } from 'react';
+import type React from 'react';
+import type { AppDispatch } from '@/shared/state/store';
+import { openCardContextMenu } from '../desktop/openCardContextMenu';
+import { pasteClipboardCards } from '../hooks/interaction/pasteClipboardCards';
+import { canvasMenuRows } from './canvasMenuRows';
+import type { useDashboardSelection } from '../hooks/state/useDashboardSelection';
+
+interface CanvasContextMenuArgs {
+  dispatch: AppDispatch;
+  dashboardId: string;
+  expandedSessionIds: string[];
+  selection: ReturnType<typeof useDashboardSelection>;
+  canvasEmpty: boolean;
+  viewportRef: React.RefObject<HTMLDivElement>;
+  getCamera: () => { panX: number; panY: number; zoom: number };
+  onNewAgent: () => void;
+  onAddBrowser: () => void;
+  onApplications: () => void;
+  onTidy: () => void;
+  onFitToView: () => void;
+}
+
+export function useCanvasContextMenu(args: CanvasContextMenuArgs): (e: React.MouseEvent) => void {
+  const { dispatch, dashboardId, expandedSessionIds, selection, canvasEmpty, viewportRef, getCamera } = args;
+  const { onNewAgent, onAddBrowser, onApplications, onTidy, onFitToView } = args;
+  // Fired from the viewport's mouseUP (never contextmenu): the right button starts the marquee, so the
+  // menu may only appear once the release proves the gesture was a click.
+  return useCallback((e: React.MouseEvent) => {
+    // Bare canvas only; cards own their own menus and inputs/webviews keep the native one.
+    const t = e.target as HTMLElement;
+    if (t.closest('[data-select-id]') || t.closest('input, textarea, [contenteditable]')) return;
+    const rect = viewportRef.current?.getBoundingClientRect();
+    const cam = getCamera();
+    const at = rect
+      ? { x: (e.clientX - rect.left - cam.panX) / cam.zoom, y: (e.clientY - rect.top - cam.panY) / cam.zoom }
+      : undefined;
+    openCardContextMenu(e, {
+      items: canvasMenuRows({
+        dispatch,
+        hasCards: !canvasEmpty,
+        onNewAgent,
+        onAddBrowser,
+        onApplications,
+        onPaste: () => { void pasteClipboardCards({ dispatch, dashboardId, expandedSessionIds, selection, at }); },
+        onSelectAll: selection.selectAll,
+        onTidy,
+        onFitToView,
+      }),
+    });
+  }, [dispatch, dashboardId, expandedSessionIds, selection, canvasEmpty, viewportRef, getCamera, onNewAgent, onAddBrowser, onApplications, onTidy, onFitToView]);
+}
diff --git a/frontend/src/app/pages/Dashboard/cards/AgentCard.tsx b/frontend/src/app/pages/Dashboard/cards/AgentCard.tsx
index b837d692..b881350a 100644
--- a/frontend/src/app/pages/Dashboard/cards/AgentCard.tsx
+++ b/frontend/src/app/pages/Dashboard/cards/AgentCard.tsx
@@ -19,7 +19,6 @@ import {
   collapseSession,
   expandSession,
   closeSession,
-  deleteSession,
   fetchSession,
   renameSession,
 } from '@/shared/state/agentsSlice';
@@ -33,17 +32,17 @@ import {
   clearGlowingAgentCard,
   removeCard,
   recordClosedCard,
-  setTiledCard,
-  clearTiledCard,
 } from '@/shared/state/dashboardLayoutSlice';
 import WindowControls, { ARC_CHIP_SX } from './WindowControls';
-import { useTiledStyle, computeTiledStyle } from './tileZones';
+import { useTiledCard } from './useTiledCard';
+import { useCardTiling } from './useCardTiling';
 import AgentNarratorPill from '../desktop/AgentNarratorPill';
-import { openCardContextMenu } from '../desktop/CardContextMenu';
+import { openCardContextMenu, isNativeMenuTarget } from '../desktop/openCardContextMenu';
+import { agentCardMenuRows } from './agentCardMenuRows';
 import { extractLatestTodos } from '../desktop/agentTodos';
 import { extractLatestShowUi, extractPendingAskUi, freezeIfDone } from '@/app/pages/AgentChat/tool-ui/showUiPayload';
 import { useDragEndBackstops } from '../hooks/interaction/useDragEndBackstops';
-import { captureBrowserShot } from '@/shared/captureBrowserShot';
+import { useBrowserPillShot } from '../desktop/useBrowserPillShot';
 import { useAppDispatch, useAppSelector } from '@/shared/hooks';
 import { QuestionForm } from '@/app/pages/AgentChat/shell/ApprovalBar';
 import AgentChat from '@/app/pages/AgentChat/AgentChat';
@@ -301,13 +300,23 @@ const GLOW_FADE_MS = 2500;
 const SNAP_THRESHOLD = 60;
 
 const AgentCard: React.FC<Props> = ({
-  session, expanded, cardX, cardY, cardWidth, cardHeight, getCanvasState, spawnFrom, exitTarget,
+  session, expanded: expandedInStore, cardX, cardY, cardWidth, cardHeight, getCanvasState, spawnFrom, exitTarget,
   isSelected = false, isHighlighted = false, multiDragDelta, onCardSelect, onDragStart, onDragMove, onDragEnd,
   onBranch, onMeasuredHeight, snapColumn, autoFocusInput, cardZOrder = 0, onDoubleClick, onBringToFront,
   shakeDirection,
 }) => {
   const c = useClaudeTokens();
   const dispatch = useAppDispatch();
+  const commitPosition = useCallback((x: number, y: number) => {
+    dispatch(setCardPosition({ sessionId: session.id, x, y }));
+  }, [dispatch, session.id]);
+  const tiling = useCardTiling({ cardId: session.id, getCanvasState, commitPosition });
+  const tileZone = tiling.zone;
+  const isTiled = !!tileZone;
+  const isFullscreen = tileZone === 'fullscreen';
+  // A tiled chat IS an open chat. One flag drives the window's SIZE and its SKIN together, so a tile
+  // can never wear the collapsed card's light surface (that was "fullscreen turns white").
+  const expanded = expandedInStore || isTiled;
   const isDashboardActive = useDashboardActive();
   const hasApiKey = !!useAppSelector((s) => s.settings.data.anthropic_api_key);
   const expandedSessionIds = useAppSelector((s) => s.agents.expandedSessionIds);
@@ -446,20 +455,24 @@ const AgentCard: React.FC<Props> = ({
   const justDraggedRef = useRef(false);
   const lastPointerRef = useRef<{ clientX: number; clientY: number }>({ clientX: 0, clientY: 0 });
 
-  const tileZone = useAppSelector((s) => s.dashboardLayout.tiledCards[session.id]);
   const handleDragPointerDown = useCallback((e: React.PointerEvent) => {
     if (e.button !== 0) return;
-    if (tileZone) return;
     e.preventDefault();
     e.stopPropagation();
     const cs = getCanvasState();
-    dragState.current = { startX: e.clientX, startY: e.clientY, origX: cardX, origY: cardY, startPanX: cs.panX, startPanY: cs.panY };
+    const popped = tiling.untileForDrag(e.clientX, e.clientY, cardWidth);
+    dragState.current = {
+      startX: e.clientX, startY: e.clientY,
+      origX: popped?.x ?? cardX, origY: popped?.y ?? cardY,
+      startPanX: cs.panX, startPanY: cs.panY,
+    };
+    if (popped) setLocalDragPos(popped);
     lastPointerRef.current = { clientX: e.clientX, clientY: e.clientY };
     didDrag.current = false;
     setIsDragging(true);
     try { (e.currentTarget as HTMLElement).setPointerCapture(e.pointerId); } catch { /* pointer already gone */ }
     onDragStart?.(session.id, 'agent');
-  }, [cardX, cardY, onDragStart, session.id, getCanvasState, tileZone]);
+  }, [cardX, cardY, cardWidth, onDragStart, session.id, getCanvasState, tiling]);
 
   const recomputeDragPos = useCallback(() => {
     const ds = dragState.current;
@@ -564,17 +577,10 @@ const AgentCard: React.FC<Props> = ({
       let effectiveY = cardY;
       let effectiveW = Math.max(cardWidth, MIN_W);
       let effectiveH = expanded ? Math.max(EXPANDED_OVERLAY_H, cardHeight) : cardHeight;
-      // Grabbing an edge of a TILED chat exits the tile and resizes from exactly where it sat,
-      // macOS-style; without this the handles resized the stale free-position geometry.
-      if (tileZone) {
-        const cam = getCanvasState();
-        const ts = computeTiledStyle(tileZone, cam.panX, cam.panY, cam.zoom);
-        if (ts) {
-          effectiveX = ts.left; effectiveY = ts.top;
-          effectiveW = ts.width / cam.zoom; effectiveH = ts.height / cam.zoom;
-          setLocalResize({ x: effectiveX, y: effectiveY, w: effectiveW, h: effectiveH });
-          dispatch(clearTiledCard(session.id));
-        }
+      const popped = tiling.untileForResize();
+      if (popped) {
+        effectiveX = popped.x; effectiveY = popped.y; effectiveW = popped.w; effectiveH = popped.h;
+        setLocalResize({ x: effectiveX, y: effectiveY, w: effectiveW, h: effectiveH });
       }
       resizeRef.current = {
         dir,
@@ -588,7 +594,7 @@ const AgentCard: React.FC<Props> = ({
       setIsResizing(true);
       (e.target as HTMLElement).setPointerCapture(e.pointerId);
     },
-    [cardX, cardY, cardWidth, cardHeight, expanded, tileZone, dispatch, session.id],
+    [cardX, cardY, cardWidth, cardHeight, expanded, tiling],
   );
 
   const computeResize = useCallback(
@@ -657,35 +663,13 @@ const AgentCard: React.FC<Props> = ({
     }
   };
 
-  const isFullscreen = tileZone === 'fullscreen';
-  // Fullscreen pins the card to the viewport, so while tiled the geometry must track canvas pan/zoom.
-  // Chat cards read the camera via a getter (not props) to avoid re-rendering on every pan tick, so
-  // we subscribe to the pan event ONLY while tiled (one card at most), and read fresh camera then.
-  const [tileTick, setTileTick] = useState(0);
-  useEffect(() => {
-    if (!tileZone) return undefined;
-    const onPan = (): void => setTileTick((t) => t + 1);
-    window.addEventListener('openswarm:canvas-pan-changed', onPan);
-    return () => window.removeEventListener('openswarm:canvas-pan-changed', onPan);
-  }, [tileZone]);
-  void tileTick;
-  const cam = getCanvasState();
-  const tiledStyle = useTiledStyle(tileZone, cam.panX, cam.panY, cam.zoom, getCanvasState, session.id);
-  // A collapsed chat can never stay tiled: collapsing while fullscreen left a white full-window shell
-  // (the header collapse control still fires in full size view). Seal the state instead of the path.
-  useEffect(() => {
-    if (tileZone && !expanded) dispatch(clearTiledCard(session.id));
-  }, [tileZone, expanded, dispatch, session.id]);
   const onMinimize = (): void => { dispatch(collapseSession(session.id)); };
   const onTile = (zone: string): void => {
-    if (zone === 'restore') dispatch(clearTiledCard(session.id));
-    else {
-      if (!expanded) dispatch(expandSession(session.id));
-      dispatch(setTiledCard({ cardId: session.id, zone }));
-    }
+    // A collapsed chat has nothing to fill a zone with, so tiling one opens it first.
+    if (zone !== 'restore') dispatch(expandSession(session.id));
+    tiling.applyZone(zone);
   };
 
-
   const lastMessage = session.messages[session.messages.length - 1];
   // Subscribe to this card's own streaming entry so per-character mutations don't churn other cards.
   const streamingMessage = useStreamingMessage(session.id);
@@ -712,7 +696,8 @@ const AgentCard: React.FC<Props> = ({
     () => (session.status === 'running' ? extractPendingAskUi(session.messages || []) : null),
     [session.messages, session.status],
   );
-  const pillMode = !expanded && !hasPending && !isDraft && !tileZone;
+  // Drafts collapse to the pill like everything else; only a pending approval keeps the full card, since you have to see what you are approving.
+  const pillMode = !expanded && !hasPending && !tileZone;
   // Glass bubble + fullscreen scrim are both dark in either theme, so the title goes light on them.
   const titleColor = expanded ? GLASS_SURFACE_TEXT : c.text.primary;
   // The answer a finished turn actually spoke, for pills with no widget/plan to show. Only the last assistant say, never a tool line.
@@ -740,29 +725,7 @@ const AgentCard: React.FC<Props> = ({
   }, [pillMode, session.messages, session.id, dispatch]);
 
   // f7's collapsed state: a session's browser (spawned by it or docked into it) shows under the pill.
-  const spawnedBrowserId = useAppSelector((s) => {
-    for (const bc of Object.values(s.dashboardLayout.browserCards)) {
-      if (bc.spawned_by === session.id || bc.docked_to === session.id) return bc.browser_id;
-    }
-    return null;
-  });
-  const [browserShot, setBrowserShot] = useState<string | null>(null);
-  useEffect(() => {
-    if (!pillMode || pillArtifact || !spawnedBrowserId) {
-      setBrowserShot(null);
-      return undefined;
-    }
-    let cancelled = false;
-    const capture = (): void => {
-      void captureBrowserShot(spawnedBrowserId).then((shot) => {
-        if (!cancelled && shot) setBrowserShot(shot);
-      });
-    };
-    capture();
-    // Refresh while the agent is driving so the shot tracks the page; parked cards keep the last frame.
-    const timer = pillRunning ? window.setInterval(capture, 5000) : null;
-    return () => { cancelled = true; if (timer) window.clearInterval(timer); };
-  }, [pillMode, pillArtifact, spawnedBrowserId, pillRunning]);
+  const browserShot = useBrowserPillShot(session.id, pillMode && !pillArtifact);
 
   const noTransition = isDragging || isResizing || (isSelected && !!multiDragDelta);
 
@@ -772,6 +735,7 @@ const AgentCard: React.FC<Props> = ({
   const activeY = localResize?.y ?? localDragPos?.y ?? (cardY + mdDy);
   const activeW = localResize?.w ?? cardWidth;
   const activeH = localResize?.h ?? cardHeight;
+  const tiledSize = useTiledCard({ cardId: session.id, zone: tileZone, active: true, originX: activeX, originY: activeY, getCamera: getCanvasState });
 
   const isBranchSpawn = spawnFrom?.type === 'branch';
   const spawnInitial = spawnFrom
@@ -799,14 +763,14 @@ const AgentCard: React.FC<Props> = ({
     <motion.div
       layout={false}
       initial={spawnInitial}
-      animate={{ opacity: 1, scale: 1, left: tiledStyle ? tiledStyle.left : activeX, top: tiledStyle ? tiledStyle.top : activeY }}
+      animate={{ opacity: 1, scale: 1, left: activeX, top: activeY }}
       exit={exitAnimation}
       // While tiled the card is pinned to the viewport: position must track pan instantly, never spring.
-      transition={tiledStyle ? { ...spawnTransition, left: { duration: 0 }, top: { duration: 0 } } : spawnTransition}
+      transition={isTiled ? { ...spawnTransition, left: { duration: 0 }, top: { duration: 0 } } : spawnTransition}
       onPointerDownCapture={() => onBringToFront?.(session.id, 'agent')}
       style={{
         position: 'absolute',
-        zIndex: tiledStyle ? 999990 : isDragging || isResizing ? 999999 : cardZOrder,
+        zIndex: isTiled ? 999990 : isDragging || isResizing ? 999999 : cardZOrder,
       }}
     >
     <Box
@@ -829,21 +793,20 @@ const AgentCard: React.FC<Props> = ({
         e.stopPropagation();
         onDoubleClick?.(session.id, 'agent');
       }}
-      onContextMenu={(e: React.MouseEvent) => openCardContextMenu(e, {
+      onContextMenu={(e: React.MouseEvent) => { if (isNativeMenuTarget(e)) return; openCardContextMenu(e, {
         rename: { value: displayChatTitle(session), onCommit: (name) => dispatch(renameSession({ sessionId: session.id, name })) },
-        items: [
-          { label: expanded ? 'Collapse' : 'Open', onClick: () => dispatch(expanded ? collapseSession(session.id) : expandSession(session.id)) },
-          { label: 'Full Screen', onClick: () => onTile('fullscreen') },
-          { label: 'Close', onClick: () => handleRemove() },
-          { label: 'Delete chat', danger: true, onClick: () => { void dispatch(deleteSession({ sessionId: session.id })); } },
-        ],
-      })}
+        items: agentCardMenuRows({
+          session, dispatch, expanded, tileZone, expandedSessionIds,
+          card: { x: cardX, y: cardY, width: cardWidth, height: cardHeight },
+          onTile, onClose: () => handleRemove(),
+        }),
+      }); }}
       sx={{
         position: 'relative',
         // Hover runway for the pop-above header: the header is pointer-events:none until the CARD
         // is hovered, but it floats ABOVE the card's box, so without this strip the pointer leaving
         // the card to reach it dropped :hover and the header died mid-approach (chats ungrabbable).
-        ...(expanded && !tiledStyle && !pillMode && {
+        ...(expanded && !isTiled && !pillMode && {
           '&::before': {
             content: '""',
             position: 'absolute',
@@ -857,10 +820,9 @@ const AgentCard: React.FC<Props> = ({
         contain: 'layout style',
         // Each card gets its own compositor layer; hover-cross used to cost 100-200ms PRESENTATION by re-painting the whole canvas.
         willChange: 'transform',
-        width: pillMode ? 'fit-content' : tiledStyle ? tiledStyle.width : (localResize ? activeW : Math.max(cardWidth, MIN_W)),
-        height: tiledStyle ? tiledStyle.height : (localResize ? activeH : (expanded ? Math.max(EXPANDED_OVERLAY_H, cardHeight) : 'auto')),
-        transform: tiledStyle ? tiledStyle.transform : undefined,
-        transformOrigin: tiledStyle ? tiledStyle.transformOrigin : undefined,
+        width: pillMode ? 'fit-content' : tiledSize ? tiledSize.width : (localResize ? activeW : Math.max(cardWidth, MIN_W)),
+        height: tiledSize ? tiledSize.height : (localResize ? activeH : (expanded ? Math.max(EXPANDED_OVERLAY_H, cardHeight) : 'auto')),
+        transformOrigin: tiledSize ? '0 0' : undefined,
         bgcolor: c.bg.surface,
         border: isHighlighted
           ? `2px solid ${c.accent.primary}`
@@ -963,16 +925,16 @@ const AgentCard: React.FC<Props> = ({
         ...(expanded && {
           // Warm near-neutral dark (the Claude/ChatGPT family) instead of the saturated plum: long
           // reading sessions want a quiet ground; the accent system carries the brand color.
-          bgcolor: tiledStyle ? 'rgb(33,31,36)' : 'rgba(33,31,36,0.88)',
-          ...(tiledStyle ? {} : {
+          bgcolor: isTiled ? 'rgb(33,31,36)' : 'rgba(33,31,36,0.88)',
+          ...(isTiled ? {} : {
             backdropFilter: 'blur(24px) saturate(150%)',
             WebkitBackdropFilter: 'blur(24px) saturate(150%)',
           }),
           border: isFullscreen ? 'none' : isSelected ? '2px solid #3b82f6' : '1px solid rgba(255,255,255,0.08)',
-          borderRadius: tiledStyle ? '12px' : '20px',
+          borderRadius: isTiled ? '12px' : '20px',
           boxShadow: '0 18px 48px rgba(0,0,0,0.4)',
           // The hover header floats ABOVE the card; the root must not clip it (the chat body clips itself).
-          ...(tiledStyle ? {} : { overflow: 'visible' }),
+          ...(isTiled ? {} : { overflow: 'visible' }),
         }),
       }}
     >
@@ -1017,7 +979,7 @@ const AgentCard: React.FC<Props> = ({
 
       {/* Grab band: the top sliver of an expanded card drags it, matching the "grab the window by
           its top edge" instinct; the pop-above header remains the labeled handle. */}
-      {expanded && !tiledStyle && !pillMode && (
+      {expanded && !isTiled && !pillMode && (
         <Box
           onPointerDown={handleDragPointerDown}
           onPointerMove={handleDragPointerMove}
@@ -1048,7 +1010,7 @@ const AgentCard: React.FC<Props> = ({
             <WindowControls
               onClose={() => handleRemove()}
               onMinimize={() => dispatch(expandSession(session.id))}
-              onTile={(zone: string) => { dispatch(expandSession(session.id)); onTile(zone); }}
+              onTile={onTile}
               tiled={false}
             />
           </Box>
@@ -1078,7 +1040,7 @@ const AgentCard: React.FC<Props> = ({
         onLostPointerCapture={abortDrag}
         sx={{
           ...(expanded
-            ? tiledStyle
+            ? isTiled
               ? {
                   // Fullscreen/tiled: no room above the card, so the scrim rides on top. Never hidden: in fullscreen the title and the lights are the only way out.
                   position: 'absolute',
@@ -1136,7 +1098,7 @@ const AgentCard: React.FC<Props> = ({
             onPointerDown={(e) => e.stopPropagation()}
             sx={{ display: 'flex', alignItems: 'center', mr: 0.75, flexShrink: 0 }}
           >
-            <WindowControls onClose={() => handleRemove()} onMinimize={onMinimize} onTile={onTile} tiled={!!tileZone} noTileMenu={tileZone === 'fullscreen'} />
+            <WindowControls onClose={() => handleRemove()} onMinimize={onMinimize} onTile={onTile} tiled={!!tileZone} />
           </Box>
           <Box
             sx={{
@@ -1146,7 +1108,7 @@ const AgentCard: React.FC<Props> = ({
               alignItems: 'center',
               gap: 1,
               // Expanded titles wear the same glass bubble as the collapsed pill; a bare label floating over the canvas read as a stray caption.
-              ...(expanded && !tiledStyle && {
+              ...(expanded && !isTiled && {
                 alignSelf: 'flex-start',
                 flex: '0 1 auto',
                 // mr auto or the row's space-between flings the bubble to the far edge, away from the lights.
@@ -1160,7 +1122,7 @@ const AgentCard: React.FC<Props> = ({
                 WebkitBackdropFilter: GLASS_SURFACE_BLUR,
                 boxShadow: '0 6px 20px rgba(0,0,0,0.3)',
               }),
-              ...(!(expanded && !tiledStyle) && { borderRadius: 1 }),
+              ...(!(expanded && !isTiled) && { borderRadius: 1 }),
             }}
           >
             <InlineEditableTitle
@@ -1179,8 +1141,7 @@ const AgentCard: React.FC<Props> = ({
                 )}
               </Typewriter>
             </InlineEditableTitle>
-            {/* Status speaks only when it needs the user; finished work sits quiet. The welcome
-                chat hides its 'draft' label so the title reads clean. */}
+            {/* The welcome chat hides its 'draft' label so the title reads clean. */}
             {session.status !== 'completed' && session.status !== 'stopped' && !session.is_welcome_draft && (
               <Box sx={{ display: 'flex', alignItems: 'center', flexShrink: 0 }}>
                 <Typography sx={{ fontSize: '0.75rem', fontWeight: 500, color: c.text.tertiary, whiteSpace: 'nowrap' }}>
@@ -1188,6 +1149,24 @@ const AgentCard: React.FC<Props> = ({
                 </Typography>
               </Box>
             )}
+            {/* Finishing used to be signalled by the word 'working' DISAPPEARING, which is not a signal. */}
+            <Fade in={session.status === 'completed' && !session.is_welcome_draft} timeout={{ enter: 260, exit: 160 }} unmountOnExit>
+              <Chip
+                icon={<CheckIcon sx={{ fontSize: 13, color: `${c.status.success} !important` }} />}
+                label="Done"
+                size="small"
+                sx={{
+                  bgcolor: c.status.successBg,
+                  color: c.status.success,
+                  border: `1px solid ${c.status.success}33`,
+                  fontWeight: 600,
+                  fontSize: '0.6875rem',
+                  height: 22,
+                  flexShrink: 0,
+                  '& .MuiChip-icon': { ml: '4px' },
+                }}
+              />
+            </Fade>
             {/* Calm, zero-click signal: the agent recalled or built up memory of
                 this site, so the user feels it getting smarter on its own. */}
             <Fade in={session.memory_recalled || session.memory_learned} timeout={{ enter: 200, exit: 220 }} unmountOnExit>
@@ -1227,9 +1206,12 @@ const AgentCard: React.FC<Props> = ({
         >
           <Box sx={{ display: 'flex', gap: 1.5, minWidth: 0, overflow: 'hidden' }}>
             {session.cost_usd > 0 && hasApiKey && (
-              <Typography variant="caption" sx={{ color: c.accent.primary, whiteSpace: 'nowrap' }}>
-                ${session.cost_usd.toFixed(4)}
-              </Typography>
+              // Accent orange on a bare number read as a warning; it is just what the run cost.
+              <Tooltip title="What this run has cost so far" placement="bottom-start">
+                <Typography variant="caption" sx={{ color: c.text.tertiary, whiteSpace: 'nowrap' }}>
+                  ${session.cost_usd.toFixed(4)}
+                </Typography>
+              </Tooltip>
             )}
           </Box>
         </Box>
@@ -1248,7 +1230,7 @@ const AgentCard: React.FC<Props> = ({
             display: 'flex',
             flexDirection: 'column',
             overflow: 'hidden',
-            borderRadius: tiledStyle ? undefined : '20px',
+            borderRadius: isTiled ? undefined : '20px',
           }}
         >
           <DarkTokensScope>
diff --git a/frontend/src/app/pages/Dashboard/cards/BrowserCard.tsx b/frontend/src/app/pages/Dashboard/cards/BrowserCard.tsx
index f3eaf2df..ae79b3c0 100644
--- a/frontend/src/app/pages/Dashboard/cards/BrowserCard.tsx
+++ b/frontend/src/app/pages/Dashboard/cards/BrowserCard.tsx
@@ -1,5 +1,4 @@
 import React, { useState, useRef, useCallback, useEffect } from 'react';
-import { store } from '@/shared/state/store';
 import { createPortal } from 'react-dom';
 import Box from '@mui/material/Box';
 import Typography from '@mui/material/Typography';
@@ -39,14 +38,13 @@ import {
   moveBrowserTab,
   recordClosedCard,
   toggleMinimizeCard,
-  setTiledCard,
-  clearTiledCard,
   setBrowserDocked,
   type BrowserTab,
 } from '@/shared/state/dashboardLayoutSlice';
 import WindowControls from './WindowControls';
-import { useTiledStyle, computeTiledStyle } from './tileZones';
-import { saveMinimizedShot } from '../desktop/minimizedShots';
+import { useTiledCard } from './useTiledCard';
+import { useCardTiling } from './useCardTiling';
+import { getMinimizedShot, saveMinimizedShot } from '../desktop/minimizedShots';
 import { removeBrowserCardCleanly } from '@/shared/browserTeardown';
 import { createSelector } from '@reduxjs/toolkit';
 import { useAppDispatch, useAppSelector } from '@/shared/hooks';
@@ -58,16 +56,19 @@ import {
   setActiveTab as setRegistryActiveTab,
   registerPendingLoad,
   wakePendingLoad,
+  hasDomReady,
   type BrowserWebview,
-  getWebview,
 } from '@/shared/browserRegistry';
 import { captureBrowserShot } from '@/shared/captureBrowserShot';
 import { setLastInteractedBrowser } from '@/shared/browserFocus';
 import { registerCapsuleForRestore } from '@/shared/browserStateCapsule';
 import BrowserFindBar from './BrowserFindBar';
-import { openCardContextMenu } from '../desktop/CardContextMenu';
+import { openCardContextMenu, isNativeMenuTarget } from '../desktop/openCardContextMenu';
+import { browserCardMenuRows, browserTabMenuRows } from './browserCardMenuRows';
 import { useBrowserActivity } from '@/shared/useBrowserActivity';
-import { getActionLabel, readDataDocument, recoverCardOffDataWall } from '@/shared/browserCommandHandler';
+import {
+  getActionLabel, readDataDocument, recoverCardOffDataWall, isAnyBrowserBusy,
+} from '@/shared/browserCommandHandler';
 import { resolveInput, isGoogleSearch } from '@/shared/resolveUrl';
 import BrowserAgentOverlay from './BrowserAgentOverlay';
 import { useOverlayScrollPassthrough } from '../hooks/interaction/useOverlayScrollPassthrough';
@@ -84,6 +85,10 @@ import { useElementSelection } from '@/app/components/editor/ElementSelectionCon
 
 type ResizeDir = 'n' | 's' | 'e' | 'w' | 'ne' | 'nw' | 'se' | 'sw';
 
+// Pill-preview capture cadence: fast until the card has handed the pill a frame, slow upkeep after.
+const PILL_SHOT_WARMUP_MS = 800;
+const PILL_SHOT_REFRESH_MS = 5000;
+const PILL_SHOT_WARMUP_MAX_MS = 8000;
 const EDGE_THICKNESS = 6;
 const CORNER_SIZE = 14;
 const MIN_W = 400;
@@ -227,22 +232,13 @@ const BrowserCard: React.FC<Props> = ({
   );
   const browserAgentSession = useAppSelector(selectBrowserAgentSession);
   const isMinimized = useAppSelector((s) => Boolean(s.dashboardLayout.minimizedCards[browserId]));
-  const tileZone = useAppSelector((s) => s.dashboardLayout.tiledCards[browserId]);
-  // Tiled geometry must track pan/zoom, but the camera lives outside React now; subscribe to the pan event ONLY while tiled and read the live getter.
-  const [tileTick, setTileTick] = useState(0);
-  useEffect(() => {
-    if (!tileZone) return undefined;
-    const onPan = (): void => setTileTick((t) => t + 1);
-    window.addEventListener('openswarm:canvas-pan-changed', onPan);
-    return () => window.removeEventListener('openswarm:canvas-pan-changed', onPan);
-  }, [tileZone]);
-  void tileTick;
-  const cam = getCanvasState();
-  const tiledStyle = useTiledStyle(tileZone, cam.panX, cam.panY, cam.zoom, getCanvasState, browserId);
-  const onTile = useCallback((zone: string): void => {
-    if (zone === 'restore') dispatch(clearTiledCard(browserId));
-    else dispatch(setTiledCard({ cardId: browserId, zone }));
+  const commitCardPosition = useCallback((x: number, y: number) => {
+    dispatch(setBrowserCardPosition({ browserId, x, y }));
   }, [dispatch, browserId]);
+  const tiling = useCardTiling({ cardId: browserId, getCanvasState, commitPosition: commitCardPosition });
+  const tileZone = tiling.zone;
+  const isTiled = !!tileZone;
+  const onTile = tiling.applyZone;
 
   // ---- In-chat dock: while docked to an expanded chat, the card overlays the chat's slot rect.
   // Pure geometry in the shared canvas layer (same DOM node), so the webview never remounts.
@@ -289,6 +285,13 @@ const BrowserCard: React.FC<Props> = ({
   const suspendedSnap = useAppSelector((state) => state.dashboardLayout.suspendedBrowserCards[browserId]);
   const endingState = useAppSelector((state) => state.dashboardLayout.endingBrowserCards[browserId]);
 
+  // An agent's browser is what its collapsed chat shows as a pill preview, so this card owes the pill a frozen frame.
+  const pillShotOwner = useAppSelector((state) => {
+    const card = state.dashboardLayout.browserCards[browserId];
+    return card?.docked_to ?? card?.spawned_by ?? null;
+  });
+  const [pillShotSettled, setPillShotSettled] = useState(() => !!getMinimizedShot(browserId));
+
   // Arm the Windows webview crash-safety marker synchronously, before React commits the <webview> below. Cleared on dom-ready; a leftover marker next launch tells windowsWebviewEnabled() the mount crashed, so it falls back to the iframe. MUST skip parked cards: they render no webview, so dom-ready never fires and a stale marker reads as a phantom crash that locks Windows out of webviews.
   if (isElectron && isWindows && !suspendedSnap) armWindowsWebviewPending();
 
@@ -425,7 +428,14 @@ const BrowserCard: React.FC<Props> = ({
         cleanups.push(() => wv.removeEventListener('dom-ready', onReady));
       }
 
-      const mirrorUrl = () => dispatch(updateBrowserTabUrl({ browserId, tabId, url: wv.getURL() }));
+      // Every guest sits at about:blank before its real load (lazy tabs never leave it); mirroring
+      // that would overwrite the tab's actual url, and a tab dragged into a fresh card then loads
+      // blank and stops looking like the page it is.
+      const mirrorUrl = () => {
+        const live = wv.getURL();
+        if (!live || live === 'about:blank') return;
+        dispatch(updateBrowserTabUrl({ browserId, tabId, url: live }));
+      };
       const onNavigate = () => {
         updateTabLocal(tabId, {
           canGoBack: wv.canGoBack(),
@@ -642,6 +652,8 @@ const BrowserCard: React.FC<Props> = ({
 
   const handleTabPointerDown = useCallback((e: React.PointerEvent) => {
     e.stopPropagation();
+    // A right-click still fires pointerdown; arming the drag here would capture the pointer under the menu.
+    if (e.button !== 0) return;
     const tabId = (e.currentTarget as HTMLElement).getAttribute('data-tab-id');
     if (!tabId) return;
     tabDragRef.current = { tabId, startX: e.clientX, startY: e.clientY, isDragging: false, detached: false };
@@ -757,17 +769,22 @@ const BrowserCard: React.FC<Props> = ({
 
   const handleDragPointerDown = useCallback((e: React.PointerEvent) => {
     if (e.button !== 0) return;
-    if (tileZone) return;
     e.preventDefault();
     e.stopPropagation();
     const cs = getCanvasState();
-    dragState.current = { startX: e.clientX, startY: e.clientY, origX: dockRect?.x ?? cardX, origY: dockRect?.y ?? cardY, startPanX: cs.panX, startPanY: cs.panY };
+    const popped = tiling.untileForDrag(e.clientX, e.clientY, cardWidth);
+    dragState.current = {
+      startX: e.clientX, startY: e.clientY,
+      origX: popped?.x ?? dockRect?.x ?? cardX, origY: popped?.y ?? dockRect?.y ?? cardY,
+      startPanX: cs.panX, startPanY: cs.panY,
+    };
+    if (popped) setLocalDragPos(popped);
     lastPointerRef.current = { clientX: e.clientX, clientY: e.clientY };
     didDrag.current = false;
     setIsDragging(true);
     try { (e.currentTarget as HTMLElement).setPointerCapture(e.pointerId); } catch { /* pointer already gone */ }
     onDragStart?.(browserId, 'browser');
-  }, [cardX, cardY, onDragStart, browserId, getCanvasState, tileZone, dockRect]);
+  }, [cardX, cardY, cardWidth, onDragStart, browserId, getCanvasState, tiling, dockRect]);
 
   const recomputeDragPos = useCallback(() => {
     const ds = dragState.current;
@@ -889,27 +906,16 @@ const BrowserCard: React.FC<Props> = ({
       if (e.button !== 0) return;
       e.preventDefault();
       e.stopPropagation();
-      // Grabbing an edge of a TILED card exits the tile and resizes from exactly where it sat,
-      // macOS-style; without this the handles resized the stale free-position geometry.
-      let origX = cardX, origY = cardY, origW = cardWidth, origH = cardHeight;
-      const zone = store.getState().dashboardLayout.tiledCards[browserId];
-      if (zone) {
-        const cam = getCanvasState();
-        const ts = computeTiledStyle(zone, cam.panX, cam.panY, cam.zoom);
-        if (ts) {
-          origX = ts.left; origY = ts.top; origW = ts.width / cam.zoom; origH = ts.height / cam.zoom;
-          setLocalResize({ x: origX, y: origY, w: origW, h: origH });
-          dispatch(clearTiledCard(browserId));
-        }
-      }
+      const popped = tiling.untileForResize();
+      if (popped) setLocalResize(popped);
       resizeRef.current = {
         dir, startX: e.clientX, startY: e.clientY,
-        origX, origY, origW, origH,
+        origX: popped?.x ?? cardX, origY: popped?.y ?? cardY, origW: popped?.w ?? cardWidth, origH: popped?.h ?? cardHeight,
       };
       setIsResizing(true);
       (e.target as HTMLElement).setPointerCapture(e.pointerId);
     },
-    [cardX, cardY, cardWidth, cardHeight, getCanvasState, dispatch],
+    [cardX, cardY, cardWidth, cardHeight, tiling],
   );
 
   const computeResize = useCallback(
@@ -999,16 +1005,47 @@ const BrowserCard: React.FC<Props> = ({
             ? `0 0 0 1px #3b82f6, ${c.shadow.md}`
             : c.shadow.md;
 
-  const dockActive = !!dockRect && !dragging && !localResize && !tiledStyle && !keepAliveHidden && !isMinimized;
+  const dockActive = !!dockRect && !dragging && !localResize && !isTiled && !keepAliveHidden && !isMinimized;
   // An agent can only SEE a page the compositor is drawing, and Chromium draws nothing at all for a
   // guest parked at left:-100000. Measured in one window: a card on screen captured in 58ms while
   // the same card parked timed out on guest capturePage, on host capturePage AND on CDP
   // captureScreenshot. So a browser its agent is still working stays on the canvas, collapsed
   // parent or not, and re-parks when the run ends. Watching it work is the point of the canvas.
   const agentDriving = browserAgentSession?.status === 'running' || browserAgentSession?.status === 'waiting_approval';
-  // Chat collapsed: its docked browser parks off-screen and lives on as the pill's live shot,
-  // instead of teleporting back to wherever it sat before docking.
-  const dockParked = !!dockedTo && !!dockParentCard && !dockParentExpanded && !agentDriving && !dragging && !tiledStyle && !isMinimized && !keepAliveHidden;
+  // Chat collapsed: its docked browser parks off-screen and lives on as the pill's frozen shot,
+  // instead of teleporting back to wherever it sat before docking. The park waits for that shot:
+  // an off-screen guest never paints again, and capturePage on one never settles (Electron 42).
+  const wantsDockPark = !!dockedTo && !!dockParentCard && !dockParentExpanded && !agentDriving && !dragging && !isTiled && !isMinimized && !keepAliveHidden;
+  const dockParked = wantsDockPark && pillShotSettled;
+  const tiledSize = useTiledCard({ cardId: browserId, zone: tileZone, active: !keepAliveHidden && !isMinimized && !dockParked, originX: displayX, originY: displayY, getCamera: getCanvasState });
+  const pillShotPaintable = !!pillShotOwner && !dockParked && !isMinimized && !keepAliveHidden && !suspendedSnap;
+  useEffect(() => {
+    if (!pillShotPaintable) return undefined;
+    let cancelled = false;
+    let inFlight = false;
+    const freeze = (): void => {
+      // Capturing a webview an agent is mid-command on is the SharedImage-mailbox renderer crash.
+      if (inFlight || isAnyBrowserBusy()) return;
+      const wv = webviewMap.current.get(activeTabId);
+      // capturePage THROWS on a guest that hasn't reached dom-ready yet, and an uncaught one here kills the whole card tree.
+      if (!wv || !hasDomReady(wv)) return;
+      let shot: Promise<{ isEmpty: () => boolean; toDataURL: () => string }> | undefined;
+      try { shot = wv.capturePage(); } catch { return; }
+      if (!shot) return;
+      inFlight = true;
+      shot.then((img) => {
+        inFlight = false;
+        if (cancelled || img.isEmpty()) return;
+        saveMinimizedShot(browserId, img.toDataURL());
+        setPillShotSettled(true);
+      }, () => { inFlight = false; });
+    };
+    freeze();
+    const timer = window.setInterval(freeze, pillShotSettled ? PILL_SHOT_REFRESH_MS : PILL_SHOT_WARMUP_MS);
+    // A page that can never paint (dead guest, about:blank) must not camp on the canvas forever.
+    const giveUp = window.setTimeout(() => setPillShotSettled(true), PILL_SHOT_WARMUP_MAX_MS);
+    return () => { cancelled = true; window.clearInterval(timer); window.clearTimeout(giveUp); };
+  }, [pillShotPaintable, pillShotSettled, browserId, activeTabId]);
 
   return (
     <Box
@@ -1019,16 +1056,22 @@ const BrowserCard: React.FC<Props> = ({
       data-select-meta={JSON.stringify({ name: activeTitle || 'Browser', url: activeUrl })}
       // Marks a kept-alive card parked off-screen (it belongs to another dashboard); fit-to-view must skip it or it pans the canvas to chase it and the card bleeds onto the dashboard you're viewing.
       data-keepalive-hidden={keepAliveHidden || isMinimized || dockParked ? '1' : undefined}
-      onContextMenu={(e: React.MouseEvent) => openCardContextMenu(e, {
-        items: [
-          { label: 'New Tab', onClick: () => dispatch(addBrowserTab({ browserId, url: browserHomepage })) },
-          { label: 'Reload', onClick: () => { try { (getWebview(browserId) as { reload?: () => void } | undefined)?.reload?.(); } catch { /* webview gone */ } } },
-          { label: 'Copy URL', onClick: () => { void navigator.clipboard.writeText(activeUrl); } },
-          { label: 'Full Screen', onClick: () => onTile('fullscreen') },
-          { label: 'Minimize', onClick: handleMinimize },
-          { label: 'Close', danger: true, onClick: () => { dispatch(recordClosedCard({ kind: 'browser', id: browserId })); removeBrowserCardCleanly(browserId, dispatch); } },
-        ],
-      })}
+      onContextMenu={(e: React.MouseEvent) => { if (isNativeMenuTarget(e)) return; openCardContextMenu(e, {
+        items: browserCardMenuRows({
+          browserId, dispatch, tabs, activeUrl, activeTitle, homepage: browserHomepage, tileZone, isMinimized,
+          card: { x: cardX, y: cardY, width: cardWidth, height: cardHeight },
+          nav: {
+            reload: () => { try { webviewMap.current.get(activeTabId)?.reload(); } catch { /* webview gone */ } },
+            back: () => { try { webviewMap.current.get(activeTabId)?.goBack(); } catch { /* webview gone */ } },
+            forward: () => { try { webviewMap.current.get(activeTabId)?.goForward(); } catch { /* webview gone */ } },
+            canGoBack: activeLocal.canGoBack,
+            canGoForward: activeLocal.canGoForward,
+          },
+          onTile,
+          onMinimize: () => (isMinimized ? dispatch(toggleMinimizeCard({ cardId: browserId })) : handleMinimize()),
+          onFind: () => { setFindOpen(true); setFindFocusSignal((n) => n + 1); },
+        }),
+      }); }}
       onPointerDownCapture={(e: React.PointerEvent) => {
         onBringToFront?.(browserId, 'browser');
         // Capture-phase so chrome clicks (tab strip, URL bar) the children swallow still select the card; clicks inside the guest page never reach the host at all. Shift keeps the bubbled toggle path. Pass the target so URL-bar/tab presses select without yanking the camera.
@@ -1052,12 +1095,12 @@ const BrowserCard: React.FC<Props> = ({
         contain: 'layout style',
         // Own compositor layer so hover/paint invalidations stay contained to this card. See AgentCard for full rationale.
         willChange: 'transform',
-        left: keepAliveHidden || isMinimized || dockParked ? -100000 : (tiledStyle ? tiledStyle.left : dockActive ? dockRect!.x : (dragging ? cardX : displayX)),
-        top: tiledStyle && !(keepAliveHidden || isMinimized || dockParked) ? tiledStyle.top : dockActive ? dockRect!.y : (dragging ? cardY : displayY),
-        transform: tiledStyle ? tiledStyle.transform : (dragging ? `translate3d(${dragTx}px, ${dragTy}px, 0)` : undefined),
-        transformOrigin: tiledStyle ? tiledStyle.transformOrigin : undefined,
-        width: tiledStyle ? tiledStyle.width : dockActive ? dockRect!.w : displayW,
-        height: tiledStyle ? tiledStyle.height : dockActive ? dockRect!.h : displayH,
+        left: keepAliveHidden || isMinimized || dockParked ? -100000 : (dockActive ? dockRect!.x : (dragging ? cardX : displayX)),
+        top: dockActive ? dockRect!.y : (dragging ? cardY : displayY),
+        transform: tiledSize ? undefined : (dragging ? `translate3d(${dragTx}px, ${dragTy}px, 0)` : undefined),
+        transformOrigin: tiledSize ? '0 0' : undefined,
+        width: tiledSize ? tiledSize.width : dockActive ? dockRect!.w : displayW,
+        height: tiledSize ? tiledSize.height : dockActive ? dockRect!.h : displayH,
         borderRadius: tileZone === 'fullscreen' ? '12px' : dockActive ? '10px' : `${c.radius.lg}px`,
         border: agentBorder,
         bgcolor: c.bg.surface,
@@ -1065,7 +1108,7 @@ const BrowserCard: React.FC<Props> = ({
         overflow: 'hidden',
         display: 'flex',
         flexDirection: 'column',
-        zIndex: tiledStyle ? 999990 : (isDragging || isResizing) ? 999999 : dockActive ? (dockParentTiled ? 999991 : dockParentZ + 1) : cardZOrder,
+        zIndex: isTiled ? 999990 : (isDragging || isResizing) ? 999999 : dockActive ? (dockParentTiled ? 999991 : dockParentZ + 1) : cardZOrder,
         transition: noTransition ? 'none' : 'box-shadow 0.4s ease, border 0.3s ease',
         '&:hover .resize-handle': { opacity: 1 },
         ...(isHighlighted && {
@@ -1124,7 +1167,7 @@ const BrowserCard: React.FC<Props> = ({
             onMinimize={handleMinimize}
             onTile={onTile}
             tiled={!!tileZone}
-            noTileMenu={tileZone === 'fullscreen'}
+           
           />
         </Box>
         <Box
@@ -1148,6 +1191,9 @@ const BrowserCard: React.FC<Props> = ({
               <Box
                 key={tab.id}
                 data-tab-id={tab.id}
+                onContextMenu={(e: React.MouseEvent) => openCardContextMenu(e, {
+                  items: browserTabMenuRows({ browserId, dispatch, tab, tabCount: tabs.length, homepage: browserHomepage }),
+                })}
                 onPointerDown={handleTabPointerDown}
                 onPointerMove={handleTabPointerMove}
                 onPointerUp={handleTabPointerUp}
diff --git a/frontend/src/app/pages/Dashboard/cards/CanvasWindowCard.tsx b/frontend/src/app/pages/Dashboard/cards/CanvasWindowCard.tsx
index 08ed73d1..5ccd90d4 100644
--- a/frontend/src/app/pages/Dashboard/cards/CanvasWindowCard.tsx
+++ b/frontend/src/app/pages/Dashboard/cards/CanvasWindowCard.tsx
@@ -1,31 +1,13 @@
-import React, { useCallback, useEffect, useRef, useState } from 'react';
+import React, { useCallback, useRef, useState } from 'react';
 import { useClaudeTokens } from '@/shared/styles/ThemeContext';
-import { TILE_ZONES, useTiledStyle } from './tileZones';
+import { useTiledCard } from './useTiledCard';
+import { useCardTiling } from './useCardTiling';
+import { useCanvasWindowResize } from './useCanvasWindowResize';
 import { useDragEndBackstops } from '../hooks/interaction/useDragEndBackstops';
 import type { CardType } from '@/shared/state/dashboardLayoutSlice';
 
-type ResizeDir = 'n' | 's' | 'e' | 'w' | 'ne' | 'nw' | 'se' | 'sw';
-
-const EDGE = 6;
-const CORNER = 14;
 const DRAG_THRESHOLD = 3;
 const SNAP_GRID = 24;
-const TILE_GAP = 8;
-
-const CURSOR_MAP: Record<ResizeDir, string> = {
-  n: 'ns-resize', s: 'ns-resize', e: 'ew-resize', w: 'ew-resize',
-  nw: 'nwse-resize', se: 'nwse-resize', ne: 'nesw-resize', sw: 'nesw-resize',
-};
-const HANDLE_DEFS: { dir: ResizeDir; css: React.CSSProperties }[] = [
-  { dir: 'n', css: { top: -EDGE / 2, left: CORNER, right: CORNER, height: EDGE } },
-  { dir: 's', css: { bottom: -EDGE / 2, left: CORNER, right: CORNER, height: EDGE } },
-  { dir: 'w', css: { left: -EDGE / 2, top: CORNER, bottom: CORNER, width: EDGE } },
-  { dir: 'e', css: { right: -EDGE / 2, top: CORNER, bottom: CORNER, width: EDGE } },
-  { dir: 'nw', css: { top: -EDGE / 2, left: -EDGE / 2, width: CORNER, height: CORNER } },
-  { dir: 'ne', css: { top: -EDGE / 2, right: -EDGE / 2, width: CORNER, height: CORNER } },
-  { dir: 'sw', css: { bottom: -EDGE / 2, left: -EDGE / 2, width: CORNER, height: CORNER } },
-  { dir: 'se', css: { bottom: -EDGE / 2, right: -EDGE / 2, width: CORNER, height: CORNER } },
-];
 
 /** Drag handlers the window hands down to whatever renders its title bar. */
 export interface CanvasWindowHeader {
@@ -39,6 +21,9 @@ export interface CanvasWindowHeader {
 
 export interface CanvasWindowChrome {
   header: CanvasWindowHeader;
+  /** The window's current tile zone, or undefined while it floats free. */
+  tileZone: string | undefined;
+  /** A TILE_ZONES key, 'fullscreen', or 'restore'. */
   onTileZone: (zone: string) => void;
 }
 
@@ -49,7 +34,8 @@ interface CanvasWindowCardProps {
   selectType: string;
   selectName: string;
   cardX: number; cardY: number; cardWidth: number; cardHeight: number; cardZOrder?: number;
-  fullscreen?: boolean;
+  /** Parked in the minimized rail: stays mounted (and keeps its state) off-canvas instead of unmounting. */
+  minimized?: boolean;
   minWidth: number; minHeight: number;
   background: string; highlightColor: string;
   getCanvasState: () => { panX: number; panY: number; zoom: number };
@@ -71,7 +57,7 @@ interface CanvasWindowCardProps {
 const CanvasWindowCard: React.FC<CanvasWindowCardProps> = ({
   cardId, cardType, selectType, selectName,
   cardX, cardY, cardWidth, cardHeight, cardZOrder = 0,
-  fullscreen = false, minWidth, minHeight, background, highlightColor,
+  minimized = false, minWidth, minHeight, background, highlightColor,
   getCanvasState,
   isSelected = false, isHighlighted = false, multiDragDelta = null,
   onCardSelect, onDragStart, onDragMove, onDragEnd, onBringToFront,
@@ -79,17 +65,7 @@ const CanvasWindowCard: React.FC<CanvasWindowCardProps> = ({
   children,
 }) => {
   const c = useClaudeTokens();
-  // Fullscreen pins the card to the viewport, so its geometry must track pan/zoom like the tiled
-  // agent/browser cards; reuse the exact same helper. Subscribe to pan only while fullscreen.
-  const [, forceTick] = useState(0);
-  useEffect(() => {
-    if (!fullscreen) return undefined;
-    const onPan = (): void => forceTick((t) => t + 1);
-    window.addEventListener('openswarm:canvas-pan-changed', onPan);
-    return () => window.removeEventListener('openswarm:canvas-pan-changed', onPan);
-  }, [fullscreen]);
-  const cam = getCanvasState();
-  const fsStyle = useTiledStyle(fullscreen ? 'fullscreen' : undefined, cam.panX, cam.panY, cam.zoom, getCanvasState, cardId);
+  const tiling = useCardTiling({ cardId, getCanvasState, commitPosition: onCommitPosition });
 
   // ---- Drag (title bar is the handle) ----
   const dragState = useRef<{ startX: number; startY: number; origX: number; origY: number; startPanX: number; startPanY: number } | null>(null);
@@ -101,18 +77,23 @@ const CanvasWindowCard: React.FC<CanvasWindowCardProps> = ({
 
   const onHeaderPointerDown = useCallback((e: React.PointerEvent) => {
     if (e.button !== 0) return;
-    if (fullscreen) return;  // pinned to the viewport, no drag until restored
     const target = e.target as HTMLElement;
     if (target.closest('[data-no-drag], button, [role="button"], input, textarea, select')) return;
     e.preventDefault();
     e.stopPropagation();
     const cs = getCanvasState();
-    dragState.current = { startX: e.clientX, startY: e.clientY, origX: cardX, origY: cardY, startPanX: cs.panX, startPanY: cs.panY };
+    const popped = tiling.untileForDrag(e.clientX, e.clientY, cardWidth);
+    dragState.current = {
+      startX: e.clientX, startY: e.clientY,
+      origX: popped?.x ?? cardX, origY: popped?.y ?? cardY,
+      startPanX: cs.panX, startPanY: cs.panY,
+    };
+    if (popped) setLocalDragPos(popped);
     didDrag.current = false;
     setIsDragging(true);
     onDragStart?.(cardId, cardType);
     (e.currentTarget as HTMLElement).setPointerCapture(e.pointerId);
-  }, [cardId, cardType, cardX, cardY, fullscreen, onDragStart, getCanvasState]);
+  }, [cardId, cardType, cardX, cardY, cardWidth, tiling, onDragStart, getCanvasState]);
 
   const onHeaderPointerMove = useCallback((e: React.PointerEvent) => {
     if (!dragState.current) return;
@@ -166,62 +147,10 @@ const CanvasWindowCard: React.FC<CanvasWindowCardProps> = ({
   }, [finalizeDrag]);
   useDragEndBackstops(isDragging, finalizeDrag, abortDrag);
 
-  // ---- Resize ----
-  const resizeRef = useRef<{ dir: ResizeDir; sx0: number; sy0: number; ox: number; oy: number; ow: number; oh: number } | null>(null);
-  const [isResizing, setIsResizing] = useState(false);
-  const [localResize, setLocalResize] = useState<{ x: number; y: number; w: number; h: number } | null>(null);
-
-  const onResizeDown = useCallback((dir: ResizeDir) => (e: React.PointerEvent) => {
-    if (e.button !== 0) return;
-    e.preventDefault();
-    e.stopPropagation();
-    resizeRef.current = { dir, sx0: e.clientX, sy0: e.clientY, ox: cardX, oy: cardY, ow: cardWidth, oh: cardHeight };
-    setIsResizing(true);
-    (e.target as HTMLElement).setPointerCapture(e.pointerId);
-  }, [cardX, cardY, cardWidth, cardHeight]);
-
-  const compute = useCallback((e: React.PointerEvent) => {
-    if (!resizeRef.current) return null;
-    const { dir, sx0, sy0, ox, oy, ow, oh } = resizeRef.current;
-    const z2 = getCanvasState().zoom;
-    const dx = (e.clientX - sx0) / z2;
-    const dy = (e.clientY - sy0) / z2;
-    let nx = ox, ny = oy, nw = ow, nh = oh;
-    if (dir.includes('e')) nw = ow + dx;
-    if (dir.includes('w')) { nw = ow - dx; nx = ox + dx; }
-    if (dir.includes('s')) nh = oh + dy;
-    if (dir.includes('n')) { nh = oh - dy; ny = oy + dy; }
-    if (nw < minWidth) { if (dir.includes('w')) nx = ox + ow - minWidth; nw = minWidth; }
-    if (nh < minHeight) { if (dir.includes('n')) ny = oy + oh - minHeight; nh = minHeight; }
-    return { x: nx, y: ny, w: nw, h: nh };
-  }, [getCanvasState, minWidth, minHeight]);
-
-  const onResizeMove = useCallback((e: React.PointerEvent) => {
-    const r = compute(e);
-    if (r) setLocalResize(r);
-  }, [compute]);
-
-  const onResizeUp = useCallback((e: React.PointerEvent) => {
-    if (!resizeRef.current) return;
-    const r = compute(e);
-    if (r) {
-      onCommitPosition(r.x, r.y);
-      onCommitSize(r.w, r.h);
-    }
-    resizeRef.current = null;
-    setLocalResize(null);
-    setIsResizing(false);
-    (e.target as HTMLElement).releasePointerCapture(e.pointerId);
-  }, [compute, onCommitPosition, onCommitSize]);
-
-  const onTileZone = useCallback((zone: string) => {
-    const z = TILE_ZONES[zone];
-    const vp = document.querySelector('[data-canvas-viewport]')?.getBoundingClientRect();
-    if (!z || !vp) return;
-    const camera = getCanvasState();
-    onCommitPosition((z.x * vp.width + TILE_GAP - camera.panX) / camera.zoom, (z.y * vp.height + TILE_GAP - camera.panY) / camera.zoom);
-    onCommitSize((z.w * vp.width - TILE_GAP * 2) / camera.zoom, (z.h * vp.height - TILE_GAP * 2) / camera.zoom);
-  }, [getCanvasState, onCommitPosition, onCommitSize]);
+  const { isResizing, live: localResize, handles } = useCanvasWindowResize({
+    cardX, cardY, cardWidth, cardHeight, minWidth, minHeight,
+    getCanvasState, onCommitPosition, onCommitSize, untileForResize: tiling.untileForResize,
+  });
 
   const mdDx = (!isDragging && !isResizing && isSelected && multiDragDelta) ? multiDragDelta.dx : 0;
   const mdDy = (!isDragging && !isResizing && isSelected && multiDragDelta) ? multiDragDelta.dy : 0;
@@ -229,6 +158,7 @@ const CanvasWindowCard: React.FC<CanvasWindowCardProps> = ({
   const dy = (localResize?.y ?? localDragPos?.y ?? cardY) + mdDy;
   const dw = localResize?.w ?? cardWidth;
   const dh = localResize?.h ?? cardHeight;
+  const tiledSize = useTiledCard({ cardId, zone: tiling.zone, active: !minimized, originX: dx, originY: dy, getCamera: getCanvasState });
 
   const border = isHighlighted ? `2px solid ${highlightColor}` : isSelected ? '2px solid #3b82f6' : `1px solid ${c.border.subtle}`;
   const noTransition = isDragging || isResizing || (isSelected && !!multiDragDelta);
@@ -249,24 +179,27 @@ const CanvasWindowCard: React.FC<CanvasWindowCardProps> = ({
         if (target.closest('[data-no-drag]')) return;
         onCardSelect?.(cardId, cardType, e.shiftKey);
       }}
+      data-keepalive-hidden={minimized ? '1' : undefined}
       style={{
         position: 'absolute',
         contain: 'layout style',
         willChange: 'transform',
-        left: fsStyle ? fsStyle.left : dx,
-        top: fsStyle ? fsStyle.top : dy,
-        width: fsStyle ? fsStyle.width : dw,
-        height: fsStyle ? fsStyle.height : dh,
-        transform: fsStyle ? fsStyle.transform : undefined,
-        transformOrigin: fsStyle ? fsStyle.transformOrigin : undefined,
+        // Parked windows go off-canvas rather than unmounting, so Settings keeps its form and Workflows its view state.
+        pointerEvents: minimized ? 'none' : undefined,
+        visibility: minimized ? 'hidden' : undefined,
+        left: minimized ? -100000 : dx,
+        top: minimized ? -100000 : dy,
+        width: tiledSize ? tiledSize.width : dw,
+        height: tiledSize ? tiledSize.height : dh,
+        transformOrigin: tiledSize ? '0 0' : undefined,
         background,
-        border: fsStyle ? 'none' : border,
+        border: tiling.isFullscreen ? 'none' : border,
         borderRadius: c.radius.lg,
         boxShadow: (isDragging || isResizing) ? c.shadow.lg : c.shadow.md,
         overflow: 'hidden',
         display: 'flex',
         flexDirection: 'column',
-        zIndex: fsStyle ? 999990 : (isDragging || isResizing) ? 999999 : cardZOrder,
+        zIndex: tiledSize ? 999990 : (isDragging || isResizing) ? 999999 : cardZOrder,
         transition: noTransition ? 'none' : 'box-shadow 0.3s ease, border-color 0.2s ease',
       }}
     >
@@ -279,17 +212,18 @@ const CanvasWindowCard: React.FC<CanvasWindowCardProps> = ({
           onLostPointerCapture: abortDrag,
           dragging: isDragging,
         },
-        onTileZone,
+        tileZone: tiling.zone,
+        onTileZone: tiling.applyZone,
       })}
 
-      {!fullscreen && HANDLE_DEFS.map(({ dir, css }) => (
+      {!minimized && handles.map((h) => (
         <div
-          key={dir}
+          key={h.dir}
           data-no-drag
-          onPointerDown={onResizeDown(dir)}
-          onPointerMove={onResizeMove}
-          onPointerUp={onResizeUp}
-          style={{ position: 'absolute', cursor: CURSOR_MAP[dir], zIndex: 25, ...css }}
+          onPointerDown={h.onPointerDown}
+          onPointerMove={h.onPointerMove}
+          onPointerUp={h.onPointerUp}
+          style={h.style}
         />
       ))}
     </div>
diff --git a/frontend/src/app/pages/Dashboard/cards/DashboardViewCard.tsx b/frontend/src/app/pages/Dashboard/cards/DashboardViewCard.tsx
index cf4a7fad..c817ef38 100644
--- a/frontend/src/app/pages/Dashboard/cards/DashboardViewCard.tsx
+++ b/frontend/src/app/pages/Dashboard/cards/DashboardViewCard.tsx
@@ -1,5 +1,4 @@
 import React, { useState, useRef, useCallback, useEffect } from 'react';
-import { store } from '@/shared/state/store';
 import { createPortal } from 'react-dom';
 import Box from '@mui/material/Box';
 import Fade from '@mui/material/Fade';
@@ -15,15 +14,18 @@ import TerminalRoundedIcon from '@mui/icons-material/TerminalRounded';
 import HistoryRoundedIcon from '@mui/icons-material/HistoryRounded';
 import AddIcon from '@mui/icons-material/Add';
 import KeyboardArrowUpRounded from '@mui/icons-material/KeyboardArrowUpRounded';
-import { Output, SERVE_BASE } from '@/shared/state/outputsSlice';
-import { setViewCardPosition, setViewDocked, setViewCardSize, setActiveViewCardId, recordClosedCard, addViewCard, setTiledCard, clearTiledCard, toggleMinimizeCard, activateViewCardPreview } from '@/shared/state/dashboardLayoutSlice';
+import { Output, SERVE_BASE, updateOutput } from '@/shared/state/outputsSlice';
+import { setViewCardPosition, setViewDocked, setViewCardSize, setActiveViewCardId, recordClosedCard, addViewCard, toggleMinimizeCard, activateViewCardPreview } from '@/shared/state/dashboardLayoutSlice';
 import { removeViewCardCleanly } from '@/shared/viewTeardown';
+import { saveMinimizedShot } from '../desktop/minimizedShots';
 import { requestAppSlot, releaseAppSlot, subscribeAppBudget } from '@/shared/appWebviewBudget';
 import { expandSession } from '@/shared/state/agentsSlice';
 import WindowControls from './WindowControls';
-import { openCardContextMenu } from '../desktop/CardContextMenu';
+import { openCardContextMenu, isNativeMenuTarget } from '../desktop/openCardContextMenu';
+import { viewCardMenuRows } from './viewCardMenuRows';
 import { useDragEndBackstops } from '../hooks/interaction/useDragEndBackstops';
-import { useTiledStyle, computeTiledStyle } from './tileZones';
+import { useTiledCard } from './useTiledCard';
+import { useCardTiling } from './useCardTiling';
 import { useAppDispatch, useAppSelector } from '@/shared/hooks';
 import { API_BASE, getAuthToken } from '@/shared/config';
 import { useClaudeTokens } from '@/shared/styles/ThemeContext';
@@ -32,6 +34,7 @@ import TerminalPanel, { TerminalLine } from '@/app/pages/Views/TerminalPanel';
 import AppCodePanel from '@/app/pages/Views/AppCodePanel';
 import HistoryPanel from '@/app/pages/Views/HistoryPanel';
 import ShareButton from '@/app/components/share/ShareButton';
+import ShareModal from '@/app/components/share/ShareModal';
 import { getDefault } from '@/shared/inputSchemaDefaults';
 import { useOverlayScrollPassthrough } from '../hooks/interaction/useOverlayScrollPassthrough';
 import {
@@ -152,7 +155,11 @@ const DashboardViewCard: React.FC<Props> = ({
   const appGlow = useAppSelector((s) => s.dashboardLayout.glowingBrowserCards[`app:${cardKeyProp ?? output.id}`]);
   const showAgentGlow = !!appGlow && !appGlow.fading;
   const interactive = activeViewCardId === cardKey;
-  const tileZone = useAppSelector((s) => s.dashboardLayout.tiledCards[cardKey]);
+  const commitCardPosition = useCallback((x: number, y: number) => {
+    dispatch(setViewCardPosition({ outputId: cardKey, x, y }));
+  }, [dispatch, cardKey]);
+  const tiling = useCardTiling({ cardId: cardKey, getCanvasState, commitPosition: commitCardPosition });
+  const tileZone = tiling.zone;
   const isMinimized = useAppSelector((s) => !!s.dashboardLayout.minimizedCards[cardKey]);
   // Reveal-born apps stay a light "click to open" card until the first click, so the onboarding curtain
   // lifts instantly instead of behind an in-frame live Vite boot. The click (selecting it) clears the flag.
@@ -160,17 +167,7 @@ const DashboardViewCard: React.FC<Props> = ({
   useEffect(() => {
     if (previewDeferred && (isSelected || interactive)) dispatch(activateViewCardPreview(cardKey));
   }, [previewDeferred, isSelected, interactive, cardKey, dispatch]);
-  // Tiled geometry must track pan/zoom, but the camera lives outside React now; subscribe to the pan event ONLY while tiled and read the live getter.
-  const [tileTick, setTileTick] = useState(0);
-  useEffect(() => {
-    if (!tileZone) return undefined;
-    const onPan = (): void => setTileTick((t) => t + 1);
-    window.addEventListener('openswarm:canvas-pan-changed', onPan);
-    return () => window.removeEventListener('openswarm:canvas-pan-changed', onPan);
-  }, [tileZone]);
-  void tileTick;
-  const cam = getCanvasState();
-  const tiledStyle = useTiledStyle(tileZone, cam.panX, cam.panY, cam.zoom, getCanvasState, cardKey);
+  const isTiled = !!tileZone;
   const isFullscreen = tileZone === 'fullscreen';
 
   // ---- In-chat dock (mirrors BrowserCard): while docked to an expanded chat, overlay its slot rect.
@@ -223,7 +220,9 @@ const DashboardViewCard: React.FC<Props> = ({
   useEffect(() => {
     const evaluate = (): void => {
       let want: boolean;
-      if (previewDeferred) {
+      if (isMinimized) {
+        want = false; // parked in the rail as a still, so a live renderer behind it is pure waste
+      } else if (previewDeferred) {
         want = false; // reveal-parked: never boot until the first click clears the defer
       } else if (alwaysLive) {
         // Actively used (selected, interacting, agent-driven, tiled, fullscreen): pinned, never capped.
@@ -263,8 +262,8 @@ const DashboardViewCard: React.FC<Props> = ({
         previewLiveRef.current = true;
         setSuspendSnapshot(null);
         setPreviewLive(true);
-      } else if (previewDeferred) {
-        // Reveal-parked from birth: never booted, so no settle + no frame to capture, just stay light.
+      } else if (isMinimized || previewDeferred) {
+        // Parked (minimize already froze its own frame) or never booted: drop it now, no settle beat.
         if (suspendTimerRef.current) { clearTimeout(suspendTimerRef.current); suspendTimerRef.current = null; }
         previewLiveRef.current = false;
         setPreviewLive(false);
@@ -290,7 +289,7 @@ const DashboardViewCard: React.FC<Props> = ({
       window.removeEventListener('resize', evaluate);
       if (suspendTimerRef.current) { clearTimeout(suspendTimerRef.current); suspendTimerRef.current = null; }
     };
-  }, [alwaysLive, previewDeferred, cardX, cardY, cardWidth, cardHeight, getCanvasState, cardKey]);
+  }, [alwaysLive, previewDeferred, isMinimized, cardX, cardY, cardWidth, cardHeight, getCanvasState, cardKey]);
 
   // Free the cap slot on unmount (card deleted, dashboard switch) so a slot is never leaked.
   useEffect(() => () => releaseAppSlot(cardKey), [cardKey]);
@@ -385,17 +384,22 @@ const DashboardViewCard: React.FC<Props> = ({
 
   const handleDragPointerDown = useCallback((e: React.PointerEvent) => {
     if (e.button !== 0) return;
-    if (tileZone) return;
     e.preventDefault();
     e.stopPropagation();
     const cs = getCanvasState();
-    dragState.current = { startX: e.clientX, startY: e.clientY, origX: dockRect?.x ?? cardX, origY: dockRect?.y ?? cardY, startPanX: cs.panX, startPanY: cs.panY };
+    const popped = tiling.untileForDrag(e.clientX, e.clientY, cardWidth);
+    dragState.current = {
+      startX: e.clientX, startY: e.clientY,
+      origX: popped?.x ?? dockRect?.x ?? cardX, origY: popped?.y ?? dockRect?.y ?? cardY,
+      startPanX: cs.panX, startPanY: cs.panY,
+    };
+    if (popped) setLocalDragPos(popped);
     lastPointerRef.current = { clientX: e.clientX, clientY: e.clientY };
     didDrag.current = false;
     setIsDragging(true);
     try { (e.currentTarget as HTMLElement).setPointerCapture(e.pointerId); } catch { /* pointer already gone */ }
     onDragStart?.(cardKey, 'view');
-  }, [cardX, cardY, onDragStart, cardKey, getCanvasState, tileZone]);
+  }, [cardX, cardY, cardWidth, onDragStart, cardKey, getCanvasState, tiling, dockRect]);
 
   const recomputeDragPos = useCallback(() => {
     const ds = dragState.current;
@@ -500,27 +504,16 @@ const DashboardViewCard: React.FC<Props> = ({
       if (e.button !== 0) return;
       e.preventDefault();
       e.stopPropagation();
-      // Grabbing an edge of a TILED card exits the tile and resizes from exactly where it sat,
-      // macOS-style; without this the handles resized the stale free-position geometry.
-      let origX = cardX, origY = cardY, origW = cardWidth, origH = cardHeight;
-      const zone = store.getState().dashboardLayout.tiledCards[cardKey];
-      if (zone) {
-        const cam = getCanvasState();
-        const ts = computeTiledStyle(zone, cam.panX, cam.panY, cam.zoom);
-        if (ts) {
-          origX = ts.left; origY = ts.top; origW = ts.width / cam.zoom; origH = ts.height / cam.zoom;
-          setLocalResize({ x: origX, y: origY, w: origW, h: origH });
-          dispatch(clearTiledCard(cardKey));
-        }
-      }
+      const popped = tiling.untileForResize();
+      if (popped) setLocalResize(popped);
       resizeRef.current = {
         dir, startX: e.clientX, startY: e.clientY,
-        origX, origY, origW, origH,
+        origX: popped?.x ?? cardX, origY: popped?.y ?? cardY, origW: popped?.w ?? cardWidth, origH: popped?.h ?? cardHeight,
       };
       setIsResizing(true);
       (e.target as HTMLElement).setPointerCapture(e.pointerId);
     },
-    [cardX, cardY, cardWidth, cardHeight, getCanvasState, dispatch],
+    [cardX, cardY, cardWidth, cardHeight, tiling],
   );
 
   const computeResize = useCallback(
@@ -568,11 +561,21 @@ const DashboardViewCard: React.FC<Props> = ({
     dispatch(recordClosedCard({ kind: 'view', id: cardKey }));
     void removeViewCardCleanly(cardKey, dispatch);
   };
-  const onMinimize = () => dispatch(toggleMinimizeCard({ cardId: cardKey }));
-  const onTile = (zone: string) => {
-    if (zone === 'restore') dispatch(clearTiledCard(cardKey));
-    else dispatch(setTiledCard({ cardId: cardKey, zone }));
-  };
+  // Freeze the app's last frame first so the rail tile shows the real app, then park the card.
+  const onMinimize = useCallback(() => {
+    let parked = false;
+    const park = (): void => { if (parked) return; parked = true; dispatch(toggleMinimizeCard({ cardId: cardKey })); };
+    // capturePage can hang forever on a guest that stopped painting (Electron 42); the timer guarantees the park.
+    window.setTimeout(park, 250);
+    void (async () => {
+      try {
+        const snap = await previewRef.current?.capture?.();
+        if (snap) saveMinimizedShot(cardKey, snap);
+      } catch { /* no frame, the tile falls back to the app's stored thumbnail */ }
+      park();
+    })();
+  }, [dispatch, cardKey]);
+  const onTile = tiling.applyZone;
 
   // Spawn ANOTHER independent instance of this app (own runtime + ports); the reducer picks the next #N and the lifecycle hook fits + highlights it.
   const handleOpenAnother = (e: React.MouseEvent) => {
@@ -581,8 +584,9 @@ const DashboardViewCard: React.FC<Props> = ({
   };
 
   const [reloadMenuRect, setReloadMenuRect] = useState<DOMRect | null>(null);
-  const handleHardReload = useCallback(async (e: React.MouseEvent) => {
-    e.stopPropagation();
+  const [shareOpen, setShareOpen] = useState(false);
+  const handleHardReload = useCallback(async (e?: React.MouseEvent) => {
+    e?.stopPropagation();
     setReloadMenuRect(null);
     const wsId = output.workspace_id;
     if (wsId) {
@@ -621,20 +625,28 @@ const DashboardViewCard: React.FC<Props> = ({
   const dragTx = dragging ? displayX - cardX : 0;
   const dragTy = dragging ? displayY - cardY : 0;
 
-  const dockActive = !!dockRect && !dragging && !localResize && !tiledStyle && !isMinimized;
+  const dockActive = !!dockRect && !dragging && !localResize && !isTiled && !isMinimized;
+  const tiledSize = useTiledCard({ cardId: cardKey, zone: tileZone, active: !isMinimized, originX: displayX, originY: displayY, getCamera: getCanvasState });
 
   return (
     <Box
       ref={dockRootRef}
       data-select-type="view-card"
       data-select-id={cardKey}
-      onContextMenu={(e: React.MouseEvent) => openCardContextMenu(e, {
-        items: [
-          { label: 'Full Screen', onClick: () => onTile('fullscreen') },
-          { label: 'Minimize', onClick: onMinimize },
-          { label: 'Close', danger: true, onClick: () => handleRemove() },
-        ],
-      })}
+      data-keepalive-hidden={isMinimized ? '1' : undefined}
+      onContextMenu={(e: React.MouseEvent) => { if (isNativeMenuTarget(e)) return; openCardContextMenu(e, {
+        rename: { value: output.name, onCommit: (name) => { void dispatch(updateOutput({ id: output.id, name })); } },
+        items: viewCardMenuRows({
+          output, cardKey, dispatch, tileZone, isMinimized,
+          card: { x: cardX, y: cardY, width: cardWidth, height: cardHeight },
+          onTile,
+          onMinimize: () => (isMinimized ? dispatch(toggleMinimizeCard({ cardId: cardKey })) : onMinimize()),
+          onReload: () => previewRef.current?.reload(),
+          onHardReload: () => { void handleHardReload(); },
+          onShare: () => setShareOpen(true),
+          onClose: () => handleRemove(),
+        }),
+      }); }}
       data-select-meta={JSON.stringify({ name: output.name, description: output.description, path: output.workspace_path })}
       className="osw-card"
       onPointerDownCapture={() => onBringToFront?.(cardKey, 'view')}
@@ -651,12 +663,15 @@ const DashboardViewCard: React.FC<Props> = ({
         // contain + willChange: own compositor layer so paint stays scoped (see AgentCard for full rationale).
         contain: 'layout style',
         willChange: 'transform',
-        left: tiledStyle ? tiledStyle.left : dockActive ? dockRect!.x : (dragging ? cardX : displayX),
-        top: tiledStyle ? tiledStyle.top : (dragging ? cardY : displayY),
-        width: tiledStyle ? tiledStyle.width : (isMinimized ? 220 : displayW),
-        height: tiledStyle ? tiledStyle.height : (isMinimized ? 44 : displayH),
-        transform: tiledStyle ? tiledStyle.transform : (dragging ? `translate3d(${dragTx}px, ${dragTy}px, 0)` : undefined),
-        transformOrigin: tiledStyle ? tiledStyle.transformOrigin : undefined,
+        // Minimized apps live in the right-edge rail, so the card itself parks off-canvas at full size
+        // (same trick as browser cards) and restores to exactly the geometry it left.
+        pointerEvents: isMinimized ? 'none' : undefined,
+        left: isMinimized ? -100000 : (dockActive ? dockRect!.x : (dragging ? cardX : displayX)),
+        top: isMinimized ? -100000 : (dragging ? cardY : displayY),
+        width: tiledSize ? tiledSize.width : displayW,
+        height: tiledSize ? tiledSize.height : displayH,
+        transform: tiledSize ? undefined : (dragging ? `translate3d(${dragTx}px, ${dragTy}px, 0)` : undefined),
+        transformOrigin: tiledSize ? '0 0' : undefined,
         borderRadius: isFullscreen ? '12px' : `${c.radius.lg}px`,
         border: isHighlighted
           ? `2px solid ${c.accent.primary}`
@@ -678,7 +693,7 @@ const DashboardViewCard: React.FC<Props> = ({
         overflow: 'hidden',
         display: 'flex',
         flexDirection: 'column',
-        zIndex: tiledStyle ? 999990 : (isDragging || isResizing) ? 999999 : dockActive ? (dockParentTiled ? 999991 : dockParentZ + 1) : cardZOrder,
+        zIndex: isTiled ? 999990 : (isDragging || isResizing) ? 999999 : dockActive ? (dockParentTiled ? 999991 : dockParentZ + 1) : cardZOrder,
         transition: noTransition ? 'none' : 'box-shadow 0.4s ease, border 0.3s ease',
         '&:hover .resize-handle': { opacity: 1 },
         ...(isHighlighted && {
@@ -748,9 +763,9 @@ const DashboardViewCard: React.FC<Props> = ({
         }}
       >
         <Box onPointerDown={(e) => e.stopPropagation()} sx={{ display: 'flex', alignItems: 'center', flexShrink: 0, mr: 0.25 }}>
-          <WindowControls onClose={() => handleRemove()} onMinimize={onMinimize} onTile={onTile} tiled={!!tileZone} noTileMenu={tileZone === 'fullscreen'} />
+          <WindowControls onClose={() => handleRemove()} onMinimize={onMinimize} onTile={onTile} tiled={!!tileZone} />
         </Box>
-        {!isMinimized && <GridViewRoundedIcon sx={{ fontSize: 16, color: c.accent.primary, flexShrink: 0 }} />}
+        <GridViewRoundedIcon sx={{ fontSize: 16, color: c.accent.primary, flexShrink: 0 }} />
         <Typography
           sx={{
             flex: 1,
@@ -770,7 +785,7 @@ const DashboardViewCard: React.FC<Props> = ({
           </Typography>
         )}
 
-        {showControls && !isMinimized && (
+        {showControls && (
           <>
             {hasWorkspace && (
               <Box
@@ -849,18 +864,16 @@ const DashboardViewCard: React.FC<Props> = ({
           </>
         )}
 
-        {!isMinimized && (
-          <Tooltip title={headerCollapsed ? 'Show toolbar' : 'Hide toolbar'} placement="top">
-            <IconButton
-              size="small"
-              onClick={(e) => { e.stopPropagation(); setHeaderPeek(false); setHeaderCollapsed((v) => !v); }}
-              onPointerDown={(e) => e.stopPropagation()}
-              sx={{ color: c.text.ghost, p: 0.5, '&:hover': { color: c.text.primary } }}
-            >
-              <KeyboardArrowUpRounded sx={{ fontSize: 18, transition: 'transform 0.15s', transform: headerCollapsed ? 'rotate(180deg)' : 'none' }} />
-            </IconButton>
-          </Tooltip>
-        )}
+        <Tooltip title={headerCollapsed ? 'Show toolbar' : 'Hide toolbar'} placement="top">
+          <IconButton
+            size="small"
+            onClick={(e) => { e.stopPropagation(); setHeaderPeek(false); setHeaderCollapsed((v) => !v); }}
+            onPointerDown={(e) => e.stopPropagation()}
+            sx={{ color: c.text.ghost, p: 0.5, '&:hover': { color: c.text.primary } }}
+          >
+            <KeyboardArrowUpRounded sx={{ fontSize: 18, transition: 'transform 0.15s', transform: headerCollapsed ? 'rotate(180deg)' : 'none' }} />
+          </IconButton>
+        </Tooltip>
       </Box>
 
       {/* Preview body */}
@@ -969,6 +982,8 @@ const DashboardViewCard: React.FC<Props> = ({
         </>,
         document.body,
       )}
+
+      {shareOpen && <ShareModal target={{ kind: 'app', id: output.id, name: output.name }} open onClose={() => setShareOpen(false)} />}
     </Box>
   );
 };
diff --git a/frontend/src/app/pages/Dashboard/cards/WindowControls.tsx b/frontend/src/app/pages/Dashboard/cards/WindowControls.tsx
index 03fc8606..3d0f2462 100644
--- a/frontend/src/app/pages/Dashboard/cards/WindowControls.tsx
+++ b/frontend/src/app/pages/Dashboard/cards/WindowControls.tsx
@@ -1,15 +1,13 @@
 import React, { useRef, useState } from 'react';
 import Box from '@mui/material/Box';
-import { TILE_ZONES } from './tileZones';
+import { TILE_ZONES } from '../canvas/tiledGeometry';
+import { TILE_GROUPS, ZONE_LABELS } from './tileZones';
 
 interface WindowControlsProps {
   onClose: () => void;
   onMinimize: () => void;
-  onTile: (zone: string) => void; // a TILE_ZONES key, or 'restore'
+  onTile: (zone: string) => void; // a TILE_ZONES key, 'fullscreen', or 'restore'
   tiled?: boolean;
-  // Green = direct fullscreen toggle, no Fill/Halves/Quarters submenu (for surfaces that only
-  // support fullscreen, like the Workflows window, where half-tiling has nowhere to land).
-  noTileMenu?: boolean;
 }
 
 // macOS-style traffic lights on every card = the "AI OS" window feel. Grey at rest so a canvas
@@ -20,11 +18,6 @@ const RED = '#ff5f57';
 const YELLOW = '#febc2e';
 const GREEN = '#28c840';
 
-const GROUPS: { label: string; zones: string[] }[] = [
-  { label: 'Fill & Halves', zones: ['fill', 'left', 'right', 'top', 'bottom'] },
-  { label: 'Quarters', zones: ['tl', 'tr', 'bl', 'br'] },
-];
-
 const dotSx = (color: string): Record<string, unknown> => ({
   width: 12, height: 12, p: 0, m: 0, borderRadius: '50%', border: '0.5px solid rgba(0,0,0,0.06)',
   background: '#cccac4', cursor: 'pointer', position: 'relative', display: 'flex', alignItems: 'center',
@@ -47,12 +40,14 @@ export const ARC_CHIP_SX: Record<string, unknown> = {
   },
   // red / yellow / green land at 150deg / 90deg / 30deg on a 12px arc over the chip's crown.
   // Keyed off the HOST (whole pill/thumb) hover, so grazing any part of it fans the dots out.
-  '.osw-pill-host:hover & .osw-window-lights > :nth-of-type(1)': { transform: 'translate(calc(-50% - 11px), calc(-50% + 5px)) scale(1)', opacity: 1 },
-  '.osw-pill-host:hover & .osw-window-lights > :nth-of-type(2)': { transform: 'translate(-50%, calc(-50% - 7px)) scale(1)', opacity: 1, transitionDelay: '40ms' },
-  '.osw-pill-host:hover & .osw-window-lights > :nth-of-type(3)': { transform: 'translate(calc(-50% + 11px), calc(-50% + 5px)) scale(1)', opacity: 1, transitionDelay: '80ms' },
+  // Addressed by data-light, never by position: green is a wrapper DIV among two BUTTONs, and the
+  // old nth-of-type counted per tag, so it dealt green the red slot and parked it on top of Close.
+  '.osw-pill-host:hover & .osw-window-lights > [data-light="close"]': { transform: 'translate(calc(-50% - 11px), calc(-50% + 5px)) scale(1)', opacity: 1 },
+  '.osw-pill-host:hover & .osw-window-lights > [data-light="minimize"]': { transform: 'translate(-50%, calc(-50% - 7px)) scale(1)', opacity: 1, transitionDelay: '40ms' },
+  '.osw-pill-host:hover & .osw-window-lights > [data-light="zoom"]': { transform: 'translate(calc(-50% + 11px), calc(-50% + 5px)) scale(1)', opacity: 1, transitionDelay: '80ms' },
 };
 
-function WindowControls({ onClose, onMinimize, onTile, tiled, noTileMenu }: WindowControlsProps): React.ReactElement {
+function WindowControls({ onClose, onMinimize, onTile, tiled }: WindowControlsProps): React.ReactElement {
   const [menuOpen, setMenuOpen] = useState(false);
   // Menu DOM (12 tiles + labels, ~30 nodes) mounts on first green-dot hover, not per card at boot.
   const [menuHot, setMenuHot] = useState(false);
@@ -61,7 +56,6 @@ function WindowControls({ onClose, onMinimize, onTile, tiled, noTileMenu }: Wind
   const greenRef = useRef<HTMLDivElement | null>(null);
   const closeTimer = useRef<number | null>(null);
   const openMenu = (): void => {
-    if (noTileMenu) return;
     if (closeTimer.current) window.clearTimeout(closeTimer.current);
     const rect = greenRef.current?.getBoundingClientRect();
     if (rect) setAlignRight(rect.left + 224 > window.innerWidth);
@@ -71,8 +65,8 @@ function WindowControls({ onClose, onMinimize, onTile, tiled, noTileMenu }: Wind
   const scheduleClose = (): void => { closeTimer.current = window.setTimeout(() => setMenuOpen(false), 550); };
   const stop = (e: React.PointerEvent | React.MouseEvent): void => { e.stopPropagation(); };
 
-  const btn = (color: string, symbol: string, onClick: () => void, label: string): React.ReactElement => (
-    <Box component="button" type="button" aria-label={label}
+  const btn = (color: string, symbol: string, onClick: () => void, label: string, slot: string): React.ReactElement => (
+    <Box component="button" type="button" aria-label={label} data-light={slot}
       onClick={(e: React.MouseEvent) => { e.stopPropagation(); onClick(); }} onPointerDown={stop} sx={dotSx(color)}>
       <span>{symbol}</span>
     </Box>
@@ -86,9 +80,9 @@ function WindowControls({ onClose, onMinimize, onTile, tiled, noTileMenu }: Wind
         // through the dots, and you can't aim at a dot without hovering its card first anyway.
         pointerEvents: 'none', '.osw-card:hover &': { pointerEvents: 'auto' },
       }}>
-      {btn(RED, '×', onClose, 'Close')}
-      {btn(YELLOW, '−', onMinimize, 'Minimize')}
-      <Box ref={greenRef} sx={{ position: 'relative', display: 'flex', alignItems: 'center' }}
+      {btn(RED, '×', onClose, 'Close', 'close')}
+      {btn(YELLOW, '−', onMinimize, 'Minimize', 'minimize')}
+      <Box ref={greenRef} data-light="zoom" sx={{ position: 'relative', display: 'flex', alignItems: 'center' }}
         onMouseEnter={openMenu} onMouseLeave={scheduleClose}>
         <Box component="button" type="button" aria-label={tiled ? 'Exit Full Screen' : 'Full Screen'}
           onClick={(e: React.MouseEvent) => { e.stopPropagation(); onTile(tiled ? 'restore' : 'fullscreen'); }}
@@ -108,14 +102,14 @@ function WindowControls({ onClose, onMinimize, onTile, tiled, noTileMenu }: Wind
             opacity: menuOpen ? 1 : 0, transform: menuOpen ? 'none' : 'translateY(-6px) scale(0.96)',
             pointerEvents: menuOpen ? 'auto' : 'none', transition: 'opacity .16s, transform .18s cubic-bezier(.3,.9,.3,1)',
           }}>
-          {GROUPS.map((g) => (
+          {TILE_GROUPS.map((g) => (
             <Box key={g.label} sx={{ mb: 0.75, '&:last-of-type': { mb: 0 } }}>
               <Box sx={{ fontSize: '0.625rem', fontWeight: 700, letterSpacing: '0.08em', color: 'rgba(115,114,108,0.65)', textTransform: 'uppercase', mb: 0.5 }}>{g.label}</Box>
               <Box sx={{ display: 'flex', gap: '7px' }}>
                 {g.zones.map((zone) => {
                   const z = TILE_ZONES[zone];
                   return (
-                    <Box key={zone} role="button" aria-label={zone}
+                    <Box key={zone} role="button" aria-label={ZONE_LABELS[zone]}
                       onClick={(e: React.MouseEvent) => { e.stopPropagation(); setMenuOpen(false); onTile(zone); }}
                       sx={{ position: 'relative', flex: 1, height: 32, border: '1px solid rgba(0,0,0,0.08)', borderRadius: '6px', background: '#F5F4ED', cursor: 'pointer', overflow: 'hidden', transition: 'border-color .12s, background .12s', '&:hover': { borderColor: '#ae5630', background: '#ae56300d' } }}>
                       <Box sx={{ position: 'absolute', left: `${z.x * 100 + 8}%`, top: `${z.y * 100 + 14}%`, width: `${z.w * 100 - 16}%`, height: `${z.h * 100 - 28}%`, background: '#ae5630', opacity: 0.8, borderRadius: '2px' }} />
diff --git a/frontend/src/app/pages/Dashboard/cards/agentCardMenuRows.ts b/frontend/src/app/pages/Dashboard/cards/agentCardMenuRows.ts
new file mode 100644
index 00000000..c34e591a
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/cards/agentCardMenuRows.ts
@@ -0,0 +1,59 @@
+import { clearSessionMessages, deleteSession, duplicateSession, expandSession, collapseSession, stopAgent, fetchSession, type AgentSession } from '@/shared/state/agentsSlice';
+import { placeCard, bringToFront } from '@/shared/state/dashboardLayoutSlice';
+import { setClipboardCards } from '@/shared/dashboardClipboard';
+import { handleSlashCommand } from '@/app/pages/AgentChat/ChatInput/hooks/slashCommands';
+import type { AppDispatch } from '@/shared/state/store';
+import type { CardMenuRow } from '../desktop/openCardContextMenu';
+import { chord } from '../desktop/chord';
+import { tileMenuRows } from './tileMenuRows';
+
+interface AgentMenuArgs {
+  session: AgentSession;
+  dispatch: AppDispatch;
+  expanded: boolean;
+  tileZone?: string;
+  expandedSessionIds: string[];
+  card: { x: number; y: number; width: number; height: number };
+  onTile: (zone: string) => void;
+  onClose: () => void;
+}
+
+export function agentCardMenuRows({ session, dispatch, expanded, tileZone, expandedSessionIds, card, onTile, onClose }: AgentMenuArgs): CardMenuRow[] {
+  const running = session.status === 'running';
+  return [
+    { label: expanded ? 'Collapse' : 'Open', shortcut: chord('enter'), onClick: () => dispatch(expanded ? collapseSession(session.id) : expandSession(session.id)) },
+    { label: tileZone === 'fullscreen' ? 'Exit Full Screen' : 'Full Screen', onClick: () => onTile(tileZone === 'fullscreen' ? 'restore' : 'fullscreen') },
+    { label: 'Tile to zone', submenu: tileMenuRows(onTile, tileZone) },
+    { label: 'Bring to front', onClick: () => dispatch(bringToFront({ id: session.id, type: 'agent' })) },
+    { kind: 'separator' },
+    {
+      label: 'Duplicate',
+      onClick: () => {
+        void dispatch(duplicateSession({ sessionId: session.id, dashboardId: session.dashboard_id })).then((action) => {
+          if (duplicateSession.fulfilled.match(action)) {
+            dispatch(placeCard({ sessionId: action.payload.id, x: card.x + 40, y: card.y - 40, width: card.width, height: card.height, expandedSessionIds }));
+            if (expanded) dispatch(expandSession(action.payload.id));
+          }
+        });
+      },
+    },
+    {
+      label: 'Copy',
+      shortcut: chord('mod', 'C'),
+      onClick: () => setClipboardCards([{
+        type: 'agent', id: session.id, name: session.name || session.id,
+        meta: { name: session.name, status: session.status, model: session.model, mode: session.mode },
+        x: card.x, y: card.y, width: card.width, height: card.height, expanded,
+      }]),
+    },
+    { kind: 'separator' },
+    { kind: 'header', label: 'Session' },
+    { label: 'Stop turn', disabled: !running, onClick: () => { void dispatch(stopAgent({ sessionId: session.id })); } },
+    // Clear the server transcript first, then the local one: the reducer alone would leave the backend holding history.
+    { label: 'Clear messages', disabled: running, onClick: () => { void handleSlashCommand('/clear', session.id).then(() => dispatch(clearSessionMessages(session.id))); } },
+    { label: 'Compact context', disabled: running, onClick: () => { void handleSlashCommand('/compact', session.id).then(() => dispatch(fetchSession(session.id))); } },
+    { kind: 'separator' },
+    { label: 'Close', onClick: onClose },
+    { label: 'Delete chat', shortcut: chord('del'), danger: true, onClick: () => { void dispatch(deleteSession({ sessionId: session.id })); } },
+  ];
+}
diff --git a/frontend/src/app/pages/Dashboard/cards/browserCardMenuRows.ts b/frontend/src/app/pages/Dashboard/cards/browserCardMenuRows.ts
new file mode 100644
index 00000000..385d332e
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/cards/browserCardMenuRows.ts
@@ -0,0 +1,97 @@
+import { addBrowserTab, bringToFront, recordClosedCard, removeBrowserTab, reopenLastClosed, setActiveBrowserTab, type BrowserTab } from '@/shared/state/dashboardLayoutSlice';
+import { removeBrowserCardCleanly } from '@/shared/browserTeardown';
+import { setClipboardCards } from '@/shared/dashboardClipboard';
+import type { AppDispatch } from '@/shared/state/store';
+import type { CardMenuRow } from '../desktop/openCardContextMenu';
+import { chord } from '../desktop/chord';
+import { tileMenuRows } from './tileMenuRows';
+
+interface BrowserNav {
+  reload: () => void;
+  back: () => void;
+  forward: () => void;
+  canGoBack: boolean;
+  canGoForward: boolean;
+}
+
+interface BrowserMenuArgs {
+  browserId: string;
+  dispatch: AppDispatch;
+  tabs: BrowserTab[];
+  activeUrl: string;
+  activeTitle: string;
+  homepage: string;
+  tileZone?: string;
+  isMinimized: boolean;
+  card: { x: number; y: number; width: number; height: number };
+  nav: BrowserNav;
+  onTile: (zone: string) => void;
+  onMinimize: () => void;
+  onFind: () => void;
+}
+
+export function closeBrowserCard(browserId: string, dispatch: AppDispatch): void {
+  dispatch(recordClosedCard({ kind: 'browser', id: browserId }));
+  void removeBrowserCardCleanly(browserId, dispatch);
+}
+
+export function browserCardMenuRows({
+  browserId, dispatch, tabs, activeUrl, activeTitle, homepage, tileZone, isMinimized, card, nav, onTile, onMinimize, onFind,
+}: BrowserMenuArgs): CardMenuRow[] {
+  return [
+    { label: 'New tab', onClick: () => dispatch(addBrowserTab({ browserId, url: homepage })) },
+    { label: 'Reopen closed tab', shortcut: chord('mod', 'shift', 'T'), onClick: () => { void dispatch(reopenLastClosed()); } },
+    { kind: 'separator' },
+    { label: 'Back', disabled: !nav.canGoBack, onClick: nav.back },
+    { label: 'Forward', disabled: !nav.canGoForward, onClick: nav.forward },
+    { label: 'Reload', onClick: nav.reload },
+    { label: 'Find in page', shortcut: chord('mod', 'F'), onClick: onFind },
+    { label: 'Copy URL', disabled: !activeUrl, onClick: () => { void navigator.clipboard.writeText(activeUrl); } },
+    { kind: 'separator' },
+    { label: tileZone === 'fullscreen' ? 'Exit Full Screen' : 'Full Screen', onClick: () => onTile(tileZone === 'fullscreen' ? 'restore' : 'fullscreen') },
+    { label: 'Tile to zone', submenu: tileMenuRows(onTile, tileZone) },
+    { label: isMinimized ? 'Restore' : 'Minimize', onClick: onMinimize },
+    { label: 'Bring to front', onClick: () => dispatch(bringToFront({ id: browserId, type: 'browser' })) },
+    {
+      label: 'Copy',
+      shortcut: chord('mod', 'C'),
+      onClick: () => setClipboardCards([{
+        type: 'browser', id: browserId, name: activeTitle || 'Browser',
+        meta: { name: activeTitle || 'Browser', url: activeUrl, tabs },
+        x: card.x, y: card.y, width: card.width, height: card.height,
+      }]),
+    },
+    { kind: 'separator' },
+    { label: 'Close', danger: true, onClick: () => closeBrowserCard(browserId, dispatch) },
+  ];
+}
+
+interface TabMenuArgs {
+  browserId: string;
+  dispatch: AppDispatch;
+  tab: BrowserTab;
+  tabCount: number;
+  homepage: string;
+}
+
+export function browserTabMenuRows({ browserId, dispatch, tab, tabCount, homepage }: TabMenuArgs): CardMenuRow[] {
+  return [
+    { label: 'New tab', onClick: () => dispatch(addBrowserTab({ browserId, url: homepage })) },
+    { label: 'Duplicate tab', onClick: () => dispatch(addBrowserTab({ browserId, url: tab.url })) },
+    { label: 'Reopen closed tab', shortcut: chord('mod', 'shift', 'T'), onClick: () => { void dispatch(reopenLastClosed()); } },
+    { kind: 'separator' },
+    { label: 'Copy tab URL', disabled: !tab.url, onClick: () => { void navigator.clipboard.writeText(tab.url); } },
+    { label: 'Focus tab', onClick: () => dispatch(setActiveBrowserTab({ browserId, tabId: tab.id })) },
+    { kind: 'separator' },
+    {
+      label: 'Close tab',
+      danger: true,
+      onClick: () => {
+        // Record BEFORE removing: the reducer drops a tab record once the card is down to its last tab.
+        if (tabCount <= 1) { closeBrowserCard(browserId, dispatch); return; }
+        dispatch(recordClosedCard({ kind: 'tab', id: tab.id, browserId }));
+        dispatch(removeBrowserTab({ browserId, tabId: tab.id }));
+      },
+    },
+  ];
+}
diff --git a/frontend/src/app/pages/Dashboard/cards/tileMenuRows.ts b/frontend/src/app/pages/Dashboard/cards/tileMenuRows.ts
new file mode 100644
index 00000000..d981538e
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/cards/tileMenuRows.ts
@@ -0,0 +1,15 @@
+import type { CardMenuRow } from '../desktop/openCardContextMenu';
+import { TILE_GROUPS, ZONE_LABELS } from './tileZones';
+
+// The green-dot tiling grid, spelled out as words for the right-click path. Same catalog, so the two
+// surfaces always offer the same zones.
+export function tileMenuRows(onTile: (zone: string) => void, currentZone?: string): CardMenuRow[] {
+  const rows: CardMenuRow[] = [];
+  for (const group of TILE_GROUPS) {
+    rows.push({ kind: 'header', label: group.label });
+    for (const zone of group.zones) {
+      rows.push({ label: ZONE_LABELS[zone], checked: currentZone === zone, onClick: () => onTile(zone) });
+    }
+  }
+  return rows;
+}
diff --git a/frontend/src/app/pages/Dashboard/cards/tileZones.ts b/frontend/src/app/pages/Dashboard/cards/tileZones.ts
index 669d0ea6..a09979a4 100644
--- a/frontend/src/app/pages/Dashboard/cards/tileZones.ts
+++ b/frontend/src/app/pages/Dashboard/cards/tileZones.ts
@@ -1,190 +1,15 @@
-import React from 'react';
+// The zone catalog the tiling MENUS render. The geometry itself lives in canvas/tiledGeometry.
 
-// macOS-style tiling zones (fractions of the workspace) + the math to render a tiled card at a
-// screen-space viewport region WITHOUT leaving the transformed canvas layer, so a browser/app
-// card's webview is never remounted (which would log the user out). The card stays a child of the
-// pan/zoom layer; we counter-transform (scale 1/zoom) and place it in canvas coords so it lands
-// pixel-exact at the viewport region at 100% content scale. Recompute on pan/zoom to stay put.
-
-export const TILE_ZONES: Record<string, { x: number; y: number; w: number; h: number }> = {
-  fill:   { x: 0,     y: 0,   w: 1,     h: 1 },
-  left:   { x: 0,     y: 0,   w: 0.5,   h: 1 },
-  right:  { x: 0.5,   y: 0,   w: 0.5,   h: 1 },
-  top:    { x: 0,     y: 0,   w: 1,     h: 0.5 },
-  bottom: { x: 0,     y: 0.5, w: 1,     h: 0.5 },
-  tl:     { x: 0,     y: 0,   w: 0.5,   h: 0.5 },
-  tr:     { x: 0.5,   y: 0,   w: 0.5,   h: 0.5 },
-  bl:     { x: 0,     y: 0.5, w: 0.5,   h: 0.5 },
-  br:     { x: 0.5,   y: 0.5, w: 0.5,   h: 0.5 },
-  t3l:    { x: 0,     y: 0,   w: 1 / 3, h: 1 },
-  t3c:    { x: 1 / 3, y: 0,   w: 1 / 3, h: 1 },
-  t3r:    { x: 2 / 3, y: 0,   w: 1 / 3, h: 1 },
+export const ZONE_LABELS: Record<string, string> = {
+  fill: 'Fill', left: 'Left half', right: 'Right half', top: 'Top half', bottom: 'Bottom half',
+  tl: 'Top left', tr: 'Top right', bl: 'Bottom left', br: 'Bottom right',
+  t3l: 'Left third', t3c: 'Center third', t3r: 'Right third',
 };
 
-// macOS Sequoia leaves a small gap between tiled windows; we match it.
-const GAP = 8;
-
-export interface TiledStyle {
-  left: number;
-  top: number;
-  width: number;
-  height: number;
-  transform: string;
-  transformOrigin: string;
-}
-
-// The workspace = the canvas viewport element (already below the app header), measured live so we
-// never hardcode chrome sizes that drift. Its screen origin cancels out of the math below because
-// the card shares the viewport's coordinate system. x0 insets the LEFT edge past the floating dock
-// rail (macOS model: tiled windows start beside the Dock, never under it), which is what keeps
-// fullscreen AND half/quarter tiles clear of it.
-function workspaceRect(): { x0: number; w: number; h: number } {
-  const el = document.querySelector('[data-canvas-viewport]');
-  const r = el?.getBoundingClientRect();
-  if (!r || !(r.width > 0 && r.height > 0)) return { x0: 0, w: window.innerWidth, h: window.innerHeight };
-  let x0 = 0;
-  const dock = document.querySelector('[data-desktop-dock]');
-  if (dock) {
-    const dr = dock.getBoundingClientRect();
-    if (dr.width > 0 && dr.right > r.left && dr.left < r.left + r.width * 0.25) x0 = dr.right - r.left + GAP;
-  }
-  return { x0, w: r.width, h: r.height };
-}
-
-export function computeTiledStyle(zone: string, panX: number, panY: number, zoom: number): TiledStyle | null {
-  // 'fullscreen' = the card expands into the ENTIRE dashboard, floating on the same gap the tile
-  // zones use. Anchored to the VIEWPORT (not the window) so docked chrome, like the pinned sidebar,
-  // squeezes the card instead of being covered by it (the canvas viewport shrinks with the sidebar).
-  if (zone === 'fullscreen') {
-    const { x0, w: vpW, h: vpH } = workspaceRect();
-    return {
-      left: (x0 + GAP - panX) / zoom,
-      top: (GAP - panY) / zoom,
-      width: vpW - x0 - GAP * 2,
-      height: vpH - GAP * 2,
-      transform: `scale(${1 / zoom})`,
-      transformOrigin: 'top left',
-    };
-  }
-  const z = TILE_ZONES[zone];
-  if (!z) return null;
-  const { x0, w: vpW, h: vpH } = workspaceRect();
-  const usableW = vpW - x0;
-  // Screen region (vpX + GAP, vpY + GAP, ...) converted to canvas coords: card lives inside the
-  // pan/zoom layer, so screen = viewportOrigin + pan + canvasPos*zoom, and viewportOrigin cancels.
-  return {
-    left: (x0 + z.x * usableW + GAP - panX) / zoom,
-    top: (z.y * vpH + GAP - panY) / zoom,
-    width: z.w * usableW - GAP * 2,
-    height: z.h * vpH - GAP * 2,
-    transform: `scale(${1 / zoom})`,
-    transformOrigin: 'top left',
-  };
-}
-
-// Tiled geometry depends on live DOM measurements, so re-render when the workspace resizes:
-// the chrome collapsing on fullscreen-enter, a window resize, a banner appearing. The initial
-// ResizeObserver fire also re-measures right after the same-commit layout change that set the zone.
-export function useTiledStyle(
-  zone: string | undefined,
-  panX: number,
-  panY: number,
-  zoom: number,
-  // Live sync: with these, every camera write restyles the card element IN THE SAME TASK as the
-  // canvas transform. The React path alone lands a commit behind the compositor, so tiled cards
-  // visibly wobbled against the viewport on every zoom/pan frame.
-  getLive?: () => { panX: number; panY: number; zoom: number },
-  selectId?: string,
-): TiledStyle | null {
-  const [, bump] = React.useReducer((n: number) => n + 1, 0);
-  React.useEffect(() => {
-    if (!zone) return undefined;
-    const el = document.querySelector('[data-canvas-viewport]');
-    const ro = new ResizeObserver(() => bump());
-    if (el) ro.observe(el);
-    const onResize = (): void => bump();
-    window.addEventListener('resize', onResize);
-    // The chrome collapse commits in the same flush that set the zone, so the first compute
-    // measures the pre-collapse viewport; re-measure after layout settles. Timeouts, not rAF:
-    // rAF (and ResizeObserver delivery, which rides it) freezes in non-focused tabs.
-    // 700ms outlives the banner Collapse (350ms) plus easing tail; RO covers focused tabs live.
-    const timers = [60, 250, 700].map((ms) => window.setTimeout(() => bump(), ms));
-    return () => { ro.disconnect(); window.removeEventListener('resize', onResize); timers.forEach((t) => window.clearTimeout(t)); };
-  }, [zone]);
-  React.useEffect(() => {
-    if (!zone || !getLive || !selectId) return undefined;
-    const el = document.querySelector(`[data-select-id="${CSS.escape(selectId)}"]`) as HTMLElement | null;
-    if (!el) return undefined;
-    // left/top belong on whichever element OWNS position: AgentCard splits into a position:absolute
-    // motion wrapper around a position:relative inner Box (writing left/top on the inner Box ADDS to
-    // the wrapper's, rendering the tile at exactly double the offset); Browser/View cards are one
-    // element. Size + counter-scale always live on the select-id element, mirroring the sx path.
-    const posEl = getComputedStyle(el).position === 'absolute' || getComputedStyle(el).position === 'fixed'
-      ? el
-      : (el.parentElement as HTMLElement | null) ?? el;
-    const posProps = ['left', 'top'];
-    const sizeProps = ['width', 'height', 'transform', 'transform-origin', 'transition'];
-    const clearAll = (): void => {
-      posProps.forEach((pr) => posEl.style.removeProperty(pr));
-      sizeProps.forEach((pr) => el.style.removeProperty(pr));
-    };
-    const apply = (): void => {
-      // A parked card (kept alive off-screen / minimized) must keep its sx parking position.
-      if (el.getAttribute('data-keepalive-hidden') === '1') { clearAll(); return; }
-      const cam = getLive();
-      const s = computeTiledStyle(zone, cam.panX, cam.panY, cam.zoom);
-      if (!s) return;
-      // 'important' so framer-motion's own left/top writes (computed off the LAGGING React-committed
-      // camera) can't land after us and shift the tile by the stale-camera delta.
-      posEl.style.setProperty('left', `${s.left}px`, 'important');
-      posEl.style.setProperty('top', `${s.top}px`, 'important');
-      el.style.setProperty('width', `${s.width}px`, 'important');
-      el.style.setProperty('height', `${s.height}px`, 'important');
-      el.style.setProperty('transform', s.transform, 'important');
-      el.style.setProperty('transform-origin', s.transformOrigin, 'important');
-      // Transitions OUTRANK inline important in the cascade, and in an occluded window they pin at
-      // t=0 forever, freezing the tile at stale geometry. Tiled cards track the camera instantly
-      // by design, so geometry must never animate here.
-      el.style.setProperty('transition', 'none', 'important');
-    };
-    apply();
-    window.addEventListener('openswarm:canvas-pan-changed', apply);
-    window.addEventListener('resize', apply);
-    // An occluded window freezes rAF (framer, the tracker below), so geometry set while hidden can
-    // land stale; re-apply the moment the window is visible again.
-    document.addEventListener('visibilitychange', apply);
-    window.addEventListener('focus', apply);
-    // The workspace can change size WITHOUT a window resize (chrome collapsing on fullscreen-enter,
-    // a banner appearing). These inline writes OVERRIDE the class styles, so they must re-measure on
-    // the same signals the React path uses or the tile keeps the pre-collapse viewport (the
-    // fullscreen card that stopped short of the bottom edge).
-    const vp = document.querySelector('[data-canvas-viewport]');
-    const ro = new ResizeObserver(apply);
-    if (vp) ro.observe(vp);
-    const timers = [60, 250, 700].map((ms) => window.setTimeout(apply, ms));
-    // animateTo moves the camera WITHOUT emitting pan-changed, and the important-priority writes
-    // above block React's late self-heal, so a tiled card must track the live camera itself:
-    // a write-on-change rAF loop (frozen while hidden is fine; nothing moves visually then).
-    let raf = 0;
-    let lastKey = '';
-    const tick = (): void => {
-      const cam = getLive();
-      const size = workspaceRect();
-      const key = `${cam.panX}:${cam.panY}:${cam.zoom}:${size.x0}:${size.w}:${size.h}`;
-      if (key !== lastKey) { lastKey = key; apply(); }
-      raf = window.requestAnimationFrame(tick);
-    };
-    raf = window.requestAnimationFrame(tick);
-    return () => {
-      window.removeEventListener('openswarm:canvas-pan-changed', apply);
-      window.removeEventListener('resize', apply);
-      document.removeEventListener('visibilitychange', apply);
-      window.removeEventListener('focus', apply);
-      ro.disconnect();
-      timers.forEach((tm) => window.clearTimeout(tm));
-      window.cancelAnimationFrame(raf);
-      clearAll();
-    };
-  }, [zone, getLive, selectId]);
-  return zone ? computeTiledStyle(zone, panX, panY, zoom) : null;
-}
+// The one grid every tiling surface renders: the green-dot hover menu and the right-click "Tile to
+// zone" submenu both map this, so they can never drift apart on which zones exist.
+export const TILE_GROUPS: { label: string; zones: string[] }[] = [
+  { label: 'Fill and halves', zones: ['fill', 'left', 'right', 'top', 'bottom'] },
+  { label: 'Quarters', zones: ['tl', 'tr', 'bl', 'br'] },
+  { label: 'Thirds', zones: ['t3l', 't3c', 't3r'] },
+];
diff --git a/frontend/src/app/pages/Dashboard/cards/useCanvasWindowResize.ts b/frontend/src/app/pages/Dashboard/cards/useCanvasWindowResize.ts
new file mode 100644
index 00000000..b4d5dc67
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/cards/useCanvasWindowResize.ts
@@ -0,0 +1,114 @@
+import React, { useCallback, useRef, useState } from 'react';
+
+type ResizeDir = 'n' | 's' | 'e' | 'w' | 'ne' | 'nw' | 'se' | 'sw';
+
+const EDGE = 6;
+const CORNER = 14;
+
+const CURSOR_MAP: Record<ResizeDir, string> = {
+  n: 'ns-resize', s: 'ns-resize', e: 'ew-resize', w: 'ew-resize',
+  nw: 'nwse-resize', se: 'nwse-resize', ne: 'nesw-resize', sw: 'nesw-resize',
+};
+const HANDLE_DEFS: { dir: ResizeDir; css: React.CSSProperties }[] = [
+  { dir: 'n', css: { top: -EDGE / 2, left: CORNER, right: CORNER, height: EDGE } },
+  { dir: 's', css: { bottom: -EDGE / 2, left: CORNER, right: CORNER, height: EDGE } },
+  { dir: 'w', css: { left: -EDGE / 2, top: CORNER, bottom: CORNER, width: EDGE } },
+  { dir: 'e', css: { right: -EDGE / 2, top: CORNER, bottom: CORNER, width: EDGE } },
+  { dir: 'nw', css: { top: -EDGE / 2, left: -EDGE / 2, width: CORNER, height: CORNER } },
+  { dir: 'ne', css: { top: -EDGE / 2, right: -EDGE / 2, width: CORNER, height: CORNER } },
+  { dir: 'sw', css: { bottom: -EDGE / 2, left: -EDGE / 2, width: CORNER, height: CORNER } },
+  { dir: 'se', css: { bottom: -EDGE / 2, right: -EDGE / 2, width: CORNER, height: CORNER } },
+];
+
+export interface CanvasWindowResizeHandle {
+  dir: string;
+  style: React.CSSProperties;
+  onPointerDown: (e: React.PointerEvent) => void;
+  onPointerMove: (e: React.PointerEvent) => void;
+  onPointerUp: (e: React.PointerEvent) => void;
+}
+
+export interface CanvasWindowResizeState {
+  isResizing: boolean;
+  /** Live geometry while the pointer is down; null once committed to the slice. */
+  live: { x: number; y: number; w: number; h: number } | null;
+  handles: CanvasWindowResizeHandle[];
+}
+
+interface CanvasWindowResizeArgs {
+  cardX: number; cardY: number; cardWidth: number; cardHeight: number;
+  minWidth: number; minHeight: number;
+  getCanvasState: () => { panX: number; panY: number; zoom: number };
+  onCommitPosition: (x: number, y: number) => void;
+  onCommitSize: (width: number, height: number) => void;
+  /** Tiling rule 5: grabbing a grip breaks the tile and resizes from the rect the card was filling. */
+  untileForResize?: () => { x: number; y: number; w: number; h: number } | null;
+}
+
+/** The 8 edge/corner grips of a canvas window: preview the new rect locally, commit it on release. */
+export function useCanvasWindowResize({
+  cardX, cardY, cardWidth, cardHeight, minWidth, minHeight,
+  getCanvasState, onCommitPosition, onCommitSize, untileForResize,
+}: CanvasWindowResizeArgs): CanvasWindowResizeState {
+  const resizeRef = useRef<{ dir: ResizeDir; sx0: number; sy0: number; ox: number; oy: number; ow: number; oh: number } | null>(null);
+  const [isResizing, setIsResizing] = useState(false);
+  const [live, setLive] = useState<{ x: number; y: number; w: number; h: number } | null>(null);
+
+  const onResizeDown = useCallback((dir: ResizeDir) => (e: React.PointerEvent) => {
+    if (e.button !== 0) return;
+    e.preventDefault();
+    e.stopPropagation();
+    const popped = untileForResize?.() ?? null;
+    if (popped) setLive(popped);
+    resizeRef.current = {
+      dir, sx0: e.clientX, sy0: e.clientY,
+      ox: popped?.x ?? cardX, oy: popped?.y ?? cardY, ow: popped?.w ?? cardWidth, oh: popped?.h ?? cardHeight,
+    };
+    setIsResizing(true);
+    (e.target as HTMLElement).setPointerCapture(e.pointerId);
+  }, [cardX, cardY, cardWidth, cardHeight, untileForResize]);
+
+  const compute = useCallback((e: React.PointerEvent) => {
+    if (!resizeRef.current) return null;
+    const { dir, sx0, sy0, ox, oy, ow, oh } = resizeRef.current;
+    const zoom = getCanvasState().zoom;
+    const dx = (e.clientX - sx0) / zoom;
+    const dy = (e.clientY - sy0) / zoom;
+    let nx = ox, ny = oy, nw = ow, nh = oh;
+    if (dir.includes('e')) nw = ow + dx;
+    if (dir.includes('w')) { nw = ow - dx; nx = ox + dx; }
+    if (dir.includes('s')) nh = oh + dy;
+    if (dir.includes('n')) { nh = oh - dy; ny = oy + dy; }
+    if (nw < minWidth) { if (dir.includes('w')) nx = ox + ow - minWidth; nw = minWidth; }
+    if (nh < minHeight) { if (dir.includes('n')) ny = oy + oh - minHeight; nh = minHeight; }
+    return { x: nx, y: ny, w: nw, h: nh };
+  }, [getCanvasState, minWidth, minHeight]);
+
+  const onResizeMove = useCallback((e: React.PointerEvent) => {
+    const r = compute(e);
+    if (r) setLive(r);
+  }, [compute]);
+
+  const onResizeUp = useCallback((e: React.PointerEvent) => {
+    if (!resizeRef.current) return;
+    const r = compute(e);
+    if (r) {
+      onCommitPosition(r.x, r.y);
+      onCommitSize(r.w, r.h);
+    }
+    resizeRef.current = null;
+    setLive(null);
+    setIsResizing(false);
+    (e.target as HTMLElement).releasePointerCapture(e.pointerId);
+  }, [compute, onCommitPosition, onCommitSize]);
+
+  const handles = HANDLE_DEFS.map(({ dir, css }) => ({
+    dir,
+    style: { position: 'absolute' as const, cursor: CURSOR_MAP[dir], zIndex: 25, ...css },
+    onPointerDown: onResizeDown(dir),
+    onPointerMove: onResizeMove,
+    onPointerUp: onResizeUp,
+  }));
+
+  return { isResizing, live, handles };
+}
diff --git a/frontend/src/app/pages/Dashboard/cards/useCardTiling.ts b/frontend/src/app/pages/Dashboard/cards/useCardTiling.ts
new file mode 100644
index 00000000..705d3158
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/cards/useCardTiling.ts
@@ -0,0 +1,89 @@
+import { useCallback } from 'react';
+import { useAppDispatch, useAppSelector } from '@/shared/hooks';
+import { setTiledCard, clearTiledCard } from '@/shared/state/dashboardLayoutSlice';
+import { zoneRect } from '../canvas/tiledGeometry';
+
+// THE tiling rule set. Every card that can sit on the canvas (chat, app, browser, workflow, the
+// Settings window, the Workflows window) routes through this hook, so tiling behaves identically
+// everywhere. Modelled on macOS Sequoia window tiling / Rectangle / Magnet:
+//   1. `tiledCards[cardId]` is the ONLY tiling state: one zone per card, 'fullscreen' included.
+//   2. Tiling never writes card geometry, so leaving a tile always lands back on the pre-tile frame.
+//   3. A tiled card re-tiles straight to another zone; there is no restore step in between.
+//   4. Dragging a tiled card untiles it at its pre-tile SIZE and keeps the pointer's grip on it.
+//   5. Resizing a tiled card untiles it and continues from the tiled rect, so the new size sticks.
+//   6. Minimizing keeps the zone (the rail puts you back in it); only 'fullscreen' is dropped, since
+//      a parked card must not keep hiding the whole shell.
+//   7. Closing a card drops its zone (the reducers own that; an orphan entry poisons every reader).
+//   8. A chat's zone is bound to its OPEN state: collapsing a chat untiles it in the SAME dispatch
+//      (dashboardLayoutSlice extraReducers), and a tiled chat renders as an open one either way.
+
+export interface CardFrame {
+  x: number;
+  y: number;
+  w: number;
+  h: number;
+}
+
+interface CardTilingArgs {
+  cardId: string;
+  getCanvasState: () => { panX: number; panY: number; zoom: number };
+  /** The card's own position reducer; a drag-untile writes the popped-out origin through it. */
+  commitPosition: (x: number, y: number) => void;
+}
+
+export interface CardTiling {
+  zone: string | undefined;
+  isTiled: boolean;
+  isFullscreen: boolean;
+  /** A TILE_ZONES key, 'fullscreen', or 'restore'. */
+  applyZone: (zone: string) => void;
+  /** Title-bar press: pops a tiled card out under the cursor at its pre-tile size. Null if untiled. */
+  untileForDrag: (clientX: number, clientY: number, preTileWidth: number) => { x: number; y: number } | null;
+  /** Resize-handle press: breaks the tile, handing back the rect the card was occupying. Null if untiled. */
+  untileForResize: () => CardFrame | null;
+}
+
+export function useCardTiling({ cardId, getCanvasState, commitPosition }: CardTilingArgs): CardTiling {
+  const dispatch = useAppDispatch();
+  const zone = useAppSelector((s) => s.dashboardLayout.tiledCards[cardId]);
+
+  const applyZone = useCallback((next: string): void => {
+    if (next === 'restore') dispatch(clearTiledCard(cardId));
+    else dispatch(setTiledCard({ cardId, zone: next }));
+  }, [dispatch, cardId]);
+
+  // The rect a tiled card occupies, in canvas coords. zoneRect is in SCREEN px (the card is
+  // counter-scaled by 1/zoom), so the footprint has to come back through the zoom.
+  const tiledFrame = useCallback((): CardFrame | null => {
+    if (!zone) return null;
+    const cam = getCanvasState();
+    const r = zoneRect(zone);
+    if (!r) return null;
+    return { x: (r.x - cam.panX) / cam.zoom, y: (r.y - cam.panY) / cam.zoom, w: r.w / cam.zoom, h: r.h / cam.zoom };
+  }, [zone, getCanvasState]);
+
+  const untileForResize = useCallback((): CardFrame | null => {
+    const frame = tiledFrame();
+    if (!frame) return null;
+    dispatch(clearTiledCard(cardId));
+    return frame;
+  }, [tiledFrame, dispatch, cardId]);
+
+  const untileForDrag = useCallback((clientX: number, clientY: number, preTileWidth: number): { x: number; y: number } | null => {
+    const frame = tiledFrame();
+    if (!frame) return null;
+    const cam = getCanvasState();
+    const vp = document.querySelector('[data-canvas-viewport]')?.getBoundingClientRect();
+    const pointerX = (clientX - (vp?.left ?? 0) - cam.panX) / cam.zoom;
+    // macOS: the window snaps back to its pre-tile width but stays glued to where you grabbed it.
+    const grip = frame.w > 0 ? Math.min(Math.max((pointerX - frame.x) / frame.w, 0), 1) : 0;
+    const x = pointerX - grip * preTileWidth;
+    dispatch(clearTiledCard(cardId));
+    // Commit before the drag starts, so a press-and-release with no movement leaves the card popped
+    // out where it appeared instead of teleporting back to its stored spot.
+    commitPosition(x, frame.y);
+    return { x, y: frame.y };
+  }, [tiledFrame, getCanvasState, dispatch, cardId, commitPosition]);
+
+  return { zone, isTiled: !!zone, isFullscreen: zone === 'fullscreen', applyZone, untileForDrag, untileForResize };
+}
diff --git a/frontend/src/app/pages/Dashboard/cards/useTiledCard.ts b/frontend/src/app/pages/Dashboard/cards/useTiledCard.ts
new file mode 100644
index 00000000..65926bfb
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/cards/useTiledCard.ts
@@ -0,0 +1,40 @@
+import { useEffect, useLayoutEffect, useReducer, useRef } from 'react';
+import { registerTiledCard, subscribeTiledWorkspace, unregisterTiledCard, zoneRect, type Camera } from '../canvas/tiledGeometry';
+
+export interface TiledSize {
+  width: number;
+  height: number;
+}
+
+interface TiledCardArgs {
+  cardId: string;
+  zone: string | undefined;
+  /** False while the card is parked (minimized, docked, kept alive off-screen), where React owns geometry outright. */
+  active: boolean;
+  /** The card's canvas-space left/top exactly as React renders it, tiled or not. */
+  originX: number;
+  originY: number;
+  getCamera: () => Camera;
+}
+
+// Hands back the card's tiled SIZE and nothing else. The camera-dependent half of the rect is
+// written by canvas/tiledGeometry alone, so a tile can never be pinned to one camera while the
+// canvas paints another.
+export function useTiledCard({ cardId, zone, active, originX, originY, getCamera }: TiledCardArgs): TiledSize | null {
+  const [, bump] = useReducer((n: number) => n + 1, 0);
+  const cameraRef = useRef(getCamera);
+  cameraRef.current = getCamera;
+  const on = !!zone && active;
+
+  useEffect(() => (on ? subscribeTiledWorkspace(bump) : undefined), [on]);
+
+  useLayoutEffect(() => {
+    if (!on || !zone) return undefined;
+    registerTiledCard(cardId, zone, { x: originX, y: originY }, cameraRef.current());
+    return () => unregisterTiledCard(cardId);
+  }, [on, zone, cardId, originX, originY]);
+
+  if (!on || !zone) return null;
+  const r = zoneRect(zone);
+  return r ? { width: r.w, height: r.h } : null;
+}
diff --git a/frontend/src/app/pages/Dashboard/cards/viewCardMenuRows.ts b/frontend/src/app/pages/Dashboard/cards/viewCardMenuRows.ts
new file mode 100644
index 00000000..9cc7f8d9
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/cards/viewCardMenuRows.ts
@@ -0,0 +1,61 @@
+import { addViewCard, bringToFront } from '@/shared/state/dashboardLayoutSlice';
+import { deleteOutput, type Output } from '@/shared/state/outputsSlice';
+import { removeViewCardCleanly } from '@/shared/viewTeardown';
+import { setClipboardCards } from '@/shared/dashboardClipboard';
+import type { AppDispatch } from '@/shared/state/store';
+import type { CardMenuRow } from '../desktop/openCardContextMenu';
+import { chord } from '../desktop/chord';
+import { tileMenuRows } from './tileMenuRows';
+
+interface ViewMenuArgs {
+  output: Output;
+  cardKey: string;
+  dispatch: AppDispatch;
+  tileZone?: string;
+  isMinimized: boolean;
+  card: { x: number; y: number; width: number; height: number };
+  onTile: (zone: string) => void;
+  onMinimize: () => void;
+  onReload: () => void;
+  onHardReload: () => void;
+  onShare: () => void;
+  onClose: () => void;
+}
+
+export function viewCardMenuRows({
+  output, cardKey, dispatch, tileZone, isMinimized, card,
+  onTile, onMinimize, onReload, onHardReload, onShare, onClose,
+}: ViewMenuArgs): CardMenuRow[] {
+  return [
+    { label: 'Open another instance', onClick: () => dispatch(addViewCard({ outputId: output.id, newInstance: true })) },
+    { kind: 'separator' },
+    { label: tileZone === 'fullscreen' ? 'Exit Full Screen' : 'Full Screen', onClick: () => onTile(tileZone === 'fullscreen' ? 'restore' : 'fullscreen') },
+    { label: 'Tile to zone', submenu: tileMenuRows(onTile, tileZone) },
+    { label: isMinimized ? 'Restore' : 'Minimize', onClick: onMinimize },
+    { label: 'Bring to front', onClick: () => dispatch(bringToFront({ id: cardKey, type: 'view' })) },
+    { kind: 'separator' },
+    { label: 'Reload', onClick: onReload },
+    { label: 'Restart and hard reload', onClick: onHardReload },
+    { kind: 'separator' },
+    {
+      label: 'Copy',
+      shortcut: chord('mod', 'C'),
+      onClick: () => setClipboardCards([{
+        type: 'view', id: cardKey, name: output.name,
+        meta: { name: output.name, description: output.description },
+        x: card.x, y: card.y, width: card.width, height: card.height,
+      }]),
+    },
+    { label: 'Share or publish...', onClick: onShare },
+    { kind: 'separator' },
+    { label: 'Close', onClick: onClose },
+    {
+      label: 'Delete app',
+      danger: true,
+      onClick: () => {
+        // The card has to go first: deleting the output alone leaves a card pointing at nothing.
+        void removeViewCardCleanly(cardKey, dispatch).then(() => dispatch(deleteOutput(output.id)));
+      },
+    },
+  ];
+}
diff --git a/frontend/src/app/pages/Dashboard/controls/CardSearchPalette.tsx b/frontend/src/app/pages/Dashboard/controls/CardSearchPalette.tsx
index 2445e758..19dbfd97 100644
--- a/frontend/src/app/pages/Dashboard/controls/CardSearchPalette.tsx
+++ b/frontend/src/app/pages/Dashboard/controls/CardSearchPalette.tsx
@@ -4,6 +4,7 @@ import InputBase from '@mui/material/InputBase';
 import Typography from '@mui/material/Typography';
 import SearchIcon from '@mui/icons-material/Search';
 import { useClaudeTokens } from '@/shared/styles/ThemeContext';
+import TopLayerPortal from '@/shared/TopLayerPortal';
 import type { CardPosition, ViewCardPosition, BrowserCardPosition } from '@/shared/state/dashboardLayoutSlice';
 import type { AgentSession } from '@/shared/state/agentsSlice';
 
@@ -125,7 +126,7 @@ const CardSearchPalette: React.FC<Props> = ({
   };
 
   return (
-    <>
+    <TopLayerPortal>
       {/* Backdrop */}
       <Box
         onClick={onClose}
@@ -228,7 +229,7 @@ const CardSearchPalette: React.FC<Props> = ({
           )}
         </Box>
       </Box>
-    </>
+    </TopLayerPortal>
   );
 };
 
diff --git a/frontend/src/app/pages/Dashboard/desktop/ApplicationsWindow.tsx b/frontend/src/app/pages/Dashboard/desktop/ApplicationsWindow.tsx
index ee691fb2..758f29bb 100644
--- a/frontend/src/app/pages/Dashboard/desktop/ApplicationsWindow.tsx
+++ b/frontend/src/app/pages/Dashboard/desktop/ApplicationsWindow.tsx
@@ -2,6 +2,8 @@ import React, { useMemo, useState } from 'react';
 import Box from '@mui/material/Box';
 import Typography from '@mui/material/Typography';
 import GridViewRoundedIcon from '@mui/icons-material/GridViewRounded';
+import { EmptyState } from '@/app/components/feedback/Loading';
+import { DarkTokensScope } from '@/shared/styles/ThemeContext';
 import type { Output } from '@/shared/state/outputsSlice';
 
 interface ApplicationsWindowProps {
@@ -100,11 +102,18 @@ function ApplicationsWindow({ outputs, onOpenApp, onClose }: ApplicationsWindowP
 
         <Box sx={{ overflowY: 'auto', flex: 1, minHeight: 120 }}>
           {apps.length === 0 && (
-            <Typography sx={{ color: 'rgba(255,255,255,0.55)', fontSize: '0.875rem', textAlign: 'center', py: 5 }}>
-              {Object.keys(outputs).length === 0
-                ? 'No apps yet. Ask an agent to build one and it lands here.'
-                : 'No apps match that search.'}
-            </Typography>
+            // The window is glass over the canvas, so the shared empty state needs dark-surface tokens to be readable.
+            <DarkTokensScope>
+              {Object.keys(outputs).length === 0 ? (
+                <EmptyState
+                  icon={<GridViewRoundedIcon sx={{ fontSize: 32 }} />}
+                  title="No apps yet"
+                  hint="Ask an agent to build one and it lands here."
+                />
+              ) : (
+                <EmptyState title="No apps match that search." />
+              )}
+            </DarkTokensScope>
           )}
           {apps.length > 0 && (
             <Box sx={{ display: 'grid', gridTemplateColumns: 'repeat(auto-fill, minmax(78px, 1fr))', gap: 1.5 }}>
diff --git a/frontend/src/app/pages/Dashboard/desktop/CardContextMenu.tsx b/frontend/src/app/pages/Dashboard/desktop/CardContextMenu.tsx
index 6e73b91b..13ff4845 100644
--- a/frontend/src/app/pages/Dashboard/desktop/CardContextMenu.tsx
+++ b/frontend/src/app/pages/Dashboard/desktop/CardContextMenu.tsx
@@ -1,138 +1,274 @@
-import React, { useEffect, useState } from 'react';
+import React, { useCallback, useEffect, useLayoutEffect, useRef, useState } from 'react';
+import { createPortal } from 'react-dom';
 import Box from '@mui/material/Box';
+import CardMenuPanel, { MENU_WIDTH } from './CardMenuPanel';
+import { CARD_MENU_EVENT, isMenuAction, type CardMenuAction, type CardMenuRequest, type CardMenuRow } from './openCardContextMenu';
 
-// One right-click menu for every canvas entity (chats, browsers, apps, workflow cards,
-// minimized pills). Cards call openCardContextMenu with their items; this overlay renders the
-// native-feeling glass menu (SpacesStrip grammar) and closes on outside press / Esc / item click.
-export interface CardMenuItem {
-  label: string;
-  danger?: boolean;
-  disabled?: boolean;
-  onClick: () => void;
-}
+// INVARIANT: the canvas pans/zooms via a CSS transform, and a transformed ancestor becomes the
+// containing block for position:fixed, so this menu portals to document.body and never mounts inside
+// the canvas subtree. A DOM menu also cannot cover an Electron <webview>: guest pages get Electron's
+// own native menu, and a page that preventDefaults its contextmenu gets neither. That is expected.
+const EDGE = 8;
+const TOP_LAYER = 2147483647;
 
-export interface CardMenuRequest {
+interface Placement {
   x: number;
   y: number;
-  items: CardMenuItem[];
-  /** Optional inline-rename affordance: shown as the first row with an editable input. */
-  rename?: { value: string; onCommit: (next: string) => void };
+  origin: string;
+  nudgeX: number;
+  nudgeY: number;
 }
 
-const EVENT = 'openswarm:card-context-menu';
-
-export function openCardContextMenu(e: { clientX: number; clientY: number; preventDefault: () => void; stopPropagation: () => void }, req: Omit<CardMenuRequest, 'x' | 'y'>): void {
-  e.preventDefault();
-  e.stopPropagation();
-  window.dispatchEvent(new CustomEvent(EVENT, { detail: { ...req, x: e.clientX, y: e.clientY } }));
+function place(x: number, y: number, w: number, h: number): Placement {
+  const flipX = x + w > window.innerWidth - EDGE && x - w >= EDGE;
+  const flipY = y + h > window.innerHeight - EDGE && y - h >= EDGE;
+  const rawX = flipX ? x - w : x;
+  const rawY = flipY ? y - h : y + 2;
+  return {
+    x: Math.max(EDGE, Math.min(rawX, window.innerWidth - w - EDGE)),
+    y: Math.max(EDGE, Math.min(rawY, window.innerHeight - h - EDGE)),
+    origin: `${flipX ? 'right' : 'left'} ${flipY ? 'bottom' : 'top'}`,
+    nudgeX: flipX ? 4 : -4,
+    nudgeY: flipY ? 4 : -4,
+  };
 }
 
-const MENU_W = 208;
+function step(items: CardMenuRow[], from: number | null, dir: 1 | -1): number | null {
+  const n = items.length;
+  if (n === 0) return null;
+  for (let hop = 1; hop <= n; hop += 1) {
+    const i = ((from ?? (dir === 1 ? -1 : 0)) + dir * hop + n * 2) % n;
+    const row = items[i];
+    if (isMenuAction(row) && !row.disabled) return i;
+  }
+  return null;
+}
 
 function CardContextMenu(): React.ReactElement | null {
   const [menu, setMenu] = useState<CardMenuRequest | null>(null);
   const [renaming, setRenaming] = useState(false);
   const [renameValue, setRenameValue] = useState('');
+  const [rootPlacement, setRootPlacement] = useState<Placement | null>(null);
+  const [shown, setShown] = useState(false);
+  const [activeIndex, setActiveIndex] = useState<number | null>(null);
+  const [openIndex, setOpenIndex] = useState<number | null>(null);
+  const [subActiveIndex, setSubActiveIndex] = useState<number | null>(null);
+  const [subPlacement, setSubPlacement] = useState<Placement | null>(null);
+  const rootRef = useRef<HTMLDivElement | null>(null);
+  const subRef = useRef<HTMLDivElement | null>(null);
+  const returnFocusTo = useRef<HTMLElement | null>(null);
+
+  const close = useCallback((): void => {
+    setMenu(null);
+    setRootPlacement(null);
+    setSubPlacement(null);
+    setShown(false);
+    setOpenIndex(null);
+    setActiveIndex(null);
+    setSubActiveIndex(null);
+    const back = returnFocusTo.current;
+    returnFocusTo.current = null;
+    if (back && back.isConnected) back.focus?.();
+  }, []);
 
   useEffect(() => {
     const onOpen = (e: Event): void => {
       const req = (e as CustomEvent).detail as CardMenuRequest;
+      returnFocusTo.current = document.activeElement as HTMLElement | null;
       setMenu(req);
+      setRootPlacement(null);
+      setSubPlacement(null);
+      setShown(false);
+      setOpenIndex(null);
+      setActiveIndex(null);
+      setSubActiveIndex(null);
       setRenaming(false);
       setRenameValue(req.rename?.value ?? '');
     };
-    window.addEventListener(EVENT, onOpen);
-    return () => window.removeEventListener(EVENT, onOpen);
+    window.addEventListener(CARD_MENU_EVENT, onOpen);
+    return () => window.removeEventListener(CARD_MENU_EVENT, onOpen);
   }, []);
 
+  // Measured, never guessed: rows render ~30px, so a hardcoded row height over-corrects long menus.
+  useLayoutEffect(() => {
+    if (!menu || !rootRef.current) return;
+    const r = rootRef.current.getBoundingClientRect();
+    setRootPlacement(place(menu.x, menu.y, r.width || MENU_WIDTH, r.height));
+  }, [menu]);
+
+  // One frame at the pre-entry style, otherwise there is no start value for the transition to run from.
+  useEffect(() => {
+    if (!rootPlacement || shown) return undefined;
+    const raf = requestAnimationFrame(() => setShown(true));
+    return () => cancelAnimationFrame(raf);
+  }, [rootPlacement, shown]);
+
+  const openRow = menu && openIndex !== null ? menu.items[openIndex] : undefined;
+  const submenu = openRow && isMenuAction(openRow) ? (openRow as CardMenuAction).submenu : undefined;
+
+  useLayoutEffect(() => {
+    if (!submenu || !subRef.current || !rootRef.current || openIndex === null) return;
+    const r = subRef.current.getBoundingClientRect();
+    const panel = rootRef.current.getBoundingClientRect();
+    const rowEl = rootRef.current.querySelector(`[data-menu-row="${openIndex}"]`);
+    const anchorY = (rowEl?.getBoundingClientRect().top ?? panel.top) - 6;
+    const toRight = panel.right - 4;
+    const fits = toRight + r.width <= window.innerWidth - EDGE;
+    const x = fits ? toRight : panel.left - r.width + 4;
+    setSubPlacement({
+      x: Math.max(EDGE, Math.min(x, window.innerWidth - r.width - EDGE)),
+      y: Math.max(EDGE, Math.min(anchorY, window.innerHeight - r.height - EDGE)),
+      origin: `${fits ? 'left' : 'right'} top`,
+      nudgeX: fits ? -4 : 4,
+      nudgeY: 0,
+    });
+  }, [submenu, openIndex]);
+
+  const runRow = useCallback((row: CardMenuRow | undefined): void => {
+    if (!row || !isMenuAction(row) || row.disabled || row.submenu) return;
+    close();
+    row.onClick?.();
+  }, [close]);
+
   useEffect(() => {
     if (!menu) return undefined;
-    const onDown = (): void => setMenu(null);
-    const onKey = (e: KeyboardEvent): void => { if (e.key === 'Escape') setMenu(null); };
+    const onDown = (e: Event): void => {
+      const t = e.target as Node | null;
+      if (t && (rootRef.current?.contains(t) || subRef.current?.contains(t))) return;
+      close();
+    };
+    const onKey = (e: KeyboardEvent): void => {
+      const items = menu.items;
+      if (e.key === 'Escape') {
+        e.preventDefault();
+        if (openIndex !== null) { setOpenIndex(null); setSubActiveIndex(null); return; }
+        close();
+        return;
+      }
+      if (submenu && openIndex !== null) {
+        if (e.key === 'ArrowDown' || e.key === 'ArrowUp') {
+          e.preventDefault();
+          setSubActiveIndex(step(submenu, subActiveIndex, e.key === 'ArrowDown' ? 1 : -1));
+          return;
+        }
+        if (e.key === 'ArrowLeft') { e.preventDefault(); setOpenIndex(null); setSubActiveIndex(null); return; }
+        if (e.key === 'Enter' && subActiveIndex !== null) { e.preventDefault(); runRow(submenu[subActiveIndex]); }
+        return;
+      }
+      if (e.key === 'ArrowDown' || e.key === 'ArrowUp') {
+        e.preventDefault();
+        setActiveIndex(step(items, activeIndex, e.key === 'ArrowDown' ? 1 : -1));
+        return;
+      }
+      const active = activeIndex !== null ? items[activeIndex] : undefined;
+      if (e.key === 'ArrowRight' && active && isMenuAction(active) && active.submenu) {
+        e.preventDefault();
+        setOpenIndex(activeIndex);
+        setSubActiveIndex(step(active.submenu, null, 1));
+        return;
+      }
+      if (e.key === 'Enter' && active) {
+        e.preventDefault();
+        if (isMenuAction(active) && active.submenu) { setOpenIndex(activeIndex); setSubActiveIndex(step(active.submenu, null, 1)); return; }
+        runRow(active);
+      }
+    };
     window.addEventListener('mousedown', onDown);
     window.addEventListener('keydown', onKey);
     window.addEventListener('wheel', onDown, { passive: true });
+    window.addEventListener('resize', close);
     return () => {
       window.removeEventListener('mousedown', onDown);
       window.removeEventListener('keydown', onKey);
       window.removeEventListener('wheel', onDown);
+      window.removeEventListener('resize', close);
     };
-  }, [menu]);
+  }, [menu, activeIndex, openIndex, subActiveIndex, submenu, close, runRow]);
 
   if (!menu) return null;
 
-  const itemSx = {
-    display: 'flex', alignItems: 'center', width: '100%', px: 1.5, py: 0.75,
-    border: 'none', background: 'transparent', borderRadius: '7px',
-    color: 'rgba(255,255,255,0.9)', fontFamily: 'inherit', fontSize: '0.8125rem',
-    cursor: 'pointer', textAlign: 'left' as const,
-    '&:hover': { background: 'rgba(255,255,255,0.1)' },
-    '&:disabled': { color: 'rgba(255,255,255,0.35)', cursor: 'default', '&:hover': { background: 'transparent' } },
-  };
-
   const commitRename = (): void => {
     const trimmed = renameValue.trim();
     if (trimmed && menu.rename && trimmed !== menu.rename.value) menu.rename.onCommit(trimmed);
-    setMenu(null);
+    close();
   };
 
-  return (
-    <Box
-      onMouseDown={(e: React.MouseEvent) => e.stopPropagation()}
-      onContextMenu={(e: React.MouseEvent) => e.preventDefault()}
-      sx={{
-        position: 'fixed',
-        top: Math.min(menu.y + 2, window.innerHeight - 44 * (menu.items.length + 1) - 16),
-        left: Math.min(menu.x, window.innerWidth - MENU_W - 12),
-        zIndex: 100001,
-        width: MENU_W, p: 0.5, borderRadius: '10px',
-        background: 'rgba(28,25,33,0.96)',
-        backdropFilter: 'blur(24px)', WebkitBackdropFilter: 'blur(24px)',
-        border: '1px solid rgba(255,255,255,0.12)',
-        boxShadow: '0 18px 44px rgba(0,0,0,0.5)',
-      }}
-    >
-      {menu.rename && (
-        renaming ? (
-          <Box
-            component="input"
-            autoFocus
-            value={renameValue}
-            onChange={(e: React.ChangeEvent<HTMLInputElement>) => setRenameValue(e.target.value)}
-            onKeyDown={(e: React.KeyboardEvent) => {
-              e.stopPropagation();
-              if (e.key === 'Enter') commitRename();
-              if (e.key === 'Escape') setMenu(null);
-            }}
-            onBlur={commitRename}
-            sx={{
-              width: '100%', boxSizing: 'border-box', mb: 0.25, px: 1.25, py: 0.6,
-              border: '1px solid rgba(255,255,255,0.35)', borderRadius: '7px',
-              background: 'rgba(0,0,0,0.35)', outline: 'none',
-              color: 'rgba(255,255,255,0.95)', fontFamily: 'inherit', fontSize: '0.8125rem',
-            }}
-          />
-        ) : (
-          <Box component="button" sx={itemSx} onClick={() => setRenaming(true)}>
-            Rename
-          </Box>
-        )
-      )}
-      {menu.items.map((item) => (
-        <Box
-          key={item.label}
-          component="button"
-          disabled={item.disabled}
-          sx={{
-            ...itemSx,
-            ...(item.danger && { color: '#ff7b72', '&:hover': { background: 'rgba(255,123,114,0.12)' } }),
+  const entry = (p: Placement | null, visible: boolean): Record<string, unknown> => ({
+    position: 'fixed' as const,
+    left: p?.x ?? -9999,
+    top: p?.y ?? -9999,
+    pointerEvents: 'auto' as const,
+    opacity: visible ? 1 : 0,
+    transform: visible ? 'none' : `translate(${p?.nudgeX ?? 0}px, ${p?.nudgeY ?? 4}px) scale(0.97)`,
+    transformOrigin: p?.origin ?? 'left top',
+    transition: 'opacity 140ms cubic-bezier(0.25,0.46,0.45,0.94), transform 170ms cubic-bezier(0.25,0.46,0.45,0.94)',
+    '@media (prefers-reduced-motion: reduce)': { transition: 'none', transform: 'none' },
+  });
+
+  return createPortal(
+    <Box role="menu" onContextMenu={(e: React.MouseEvent) => e.preventDefault()} sx={{ position: 'fixed', inset: 0, zIndex: TOP_LAYER, pointerEvents: 'none' }}>
+      <Box data-card-context-menu sx={entry(rootPlacement, shown)}>
+        <CardMenuPanel
+          ref={rootRef}
+          items={menu.items}
+          activeIndex={activeIndex}
+          openIndex={openIndex}
+          onActivate={(i) => {
+            const row = menu.items[i];
+            if (isMenuAction(row) && row.submenu) { setOpenIndex(i); setActiveIndex(i); setSubActiveIndex(null); return; }
+            runRow(row);
+          }}
+          onHover={(i) => {
+            setActiveIndex(i);
+            const row = menu.items[i];
+            if (isMenuAction(row) && row.submenu) { setOpenIndex(i); setSubActiveIndex(null); } else setOpenIndex(null);
           }}
-          onClick={() => { setMenu(null); item.onClick(); }}
         >
-          {item.label}
+          {menu.rename && (renaming ? (
+            <Box
+              component="input"
+              autoFocus
+              value={renameValue}
+              onChange={(e: React.ChangeEvent<HTMLInputElement>) => setRenameValue(e.target.value)}
+              onKeyDown={(e: React.KeyboardEvent) => {
+                e.stopPropagation();
+                if (e.key === 'Enter') commitRename();
+                if (e.key === 'Escape') close();
+              }}
+              onBlur={commitRename}
+              sx={{
+                width: '100%', boxSizing: 'border-box', mb: '2px', px: '9px', py: '6px',
+                border: '1px solid rgba(255,255,255,0.35)', borderRadius: '8px',
+                background: 'rgba(0,0,0,0.35)', outline: 'none',
+                color: 'rgba(255,255,255,0.95)', fontFamily: 'inherit', fontSize: '0.8125rem',
+              }}
+            />
+          ) : (
+            <Box
+              component="button"
+              type="button"
+              onMouseEnter={() => { setActiveIndex(null); setOpenIndex(null); }}
+              onClick={() => setRenaming(true)}
+              sx={{
+                display: 'flex', alignItems: 'center', width: '100%', boxSizing: 'border-box',
+                px: '9px', py: '5px', minHeight: 30, border: 'none', background: 'transparent',
+                borderRadius: '8px', color: 'rgba(255,255,255,0.9)', fontFamily: 'inherit',
+                fontSize: '0.8125rem', cursor: 'pointer', textAlign: 'left',
+                '&:hover': { background: 'rgba(255,255,255,0.10)' },
+              }}
+            >
+              Rename
+            </Box>
+          ))}
+        </CardMenuPanel>
+      </Box>
+      {submenu && (
+        <Box sx={entry(subPlacement, shown && !!subPlacement)}>
+          <CardMenuPanel ref={subRef} items={submenu} activeIndex={subActiveIndex} openIndex={null} onActivate={(i) => runRow(submenu[i])} onHover={setSubActiveIndex} />
         </Box>
-      ))}
-    </Box>
+      )}
+    </Box>,
+    document.body,
   );
 }
 
diff --git a/frontend/src/app/pages/Dashboard/desktop/CardMenuPanel.tsx b/frontend/src/app/pages/Dashboard/desktop/CardMenuPanel.tsx
new file mode 100644
index 00000000..f8f1de38
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/CardMenuPanel.tsx
@@ -0,0 +1,130 @@
+import React from 'react';
+import Box from '@mui/material/Box';
+import CheckRoundedIcon from '@mui/icons-material/CheckRounded';
+import ChevronRightRoundedIcon from '@mui/icons-material/ChevronRightRounded';
+import { isMenuAction, type CardMenuRow } from './openCardContextMenu';
+
+export const MENU_WIDTH = 236;
+const ROW_RADIUS = 8;
+
+interface CardMenuPanelProps {
+  items: CardMenuRow[];
+  /** Index into `items` of the keyboard-active row, or null. */
+  activeIndex: number | null;
+  /** Index into `items` of the row whose submenu is open, or null. */
+  openIndex: number | null;
+  onActivate: (index: number) => void;
+  onHover: (index: number) => void;
+  width?: number;
+  children?: React.ReactNode;
+}
+
+const rowSx = {
+  display: 'flex',
+  alignItems: 'center',
+  gap: '9px',
+  width: '100%',
+  boxSizing: 'border-box' as const,
+  px: '9px',
+  py: '5px',
+  minHeight: 30,
+  border: 'none',
+  background: 'transparent',
+  borderRadius: `${ROW_RADIUS}px`,
+  color: 'rgba(255,255,255,0.9)',
+  fontFamily: 'inherit',
+  fontSize: '0.8125rem',
+  lineHeight: 1.35,
+  cursor: 'pointer',
+  textAlign: 'left' as const,
+};
+
+// Panel radius stays 12 while rows sit at 8: the inner corner must always be the smaller one.
+export const PANEL_SX = {
+  width: MENU_WIDTH,
+  p: '6px',
+  boxSizing: 'border-box' as const,
+  borderRadius: '12px',
+  background: 'rgba(28,25,33,0.94)',
+  backdropFilter: 'blur(24px) saturate(150%)',
+  WebkitBackdropFilter: 'blur(24px) saturate(150%)',
+  border: '1px solid rgba(255,255,255,0.12)',
+  boxShadow: '0 18px 44px rgba(0,0,0,0.5)',
+};
+
+const CardMenuPanel = React.forwardRef<HTMLDivElement, CardMenuPanelProps>(function CardMenuPanel(
+  { items, activeIndex, openIndex, onActivate, onHover, width, children },
+  ref,
+) {
+  return (
+    <Box ref={ref} sx={{ ...PANEL_SX, ...(width ? { width } : {}) }}>
+      {children}
+      {items.map((row, index) => {
+        if (row.kind === 'separator') {
+          return <Box key={`sep-${index}`} sx={{ height: '1px', mx: '7px', my: '5px', background: 'rgba(255,255,255,0.09)' }} />;
+        }
+        if (row.kind === 'header') {
+          return (
+            <Box
+              key={`hdr-${index}`}
+              sx={{ px: '9px', pt: '7px', pb: '3px', fontSize: '0.6875rem', fontWeight: 600, color: 'rgba(255,255,255,0.42)', letterSpacing: '0.01em' }}
+            >
+              {row.label}
+            </Box>
+          );
+        }
+        if (!isMenuAction(row)) return null;
+        const active = activeIndex === index && !row.disabled;
+        const highlighted = active || openIndex === index;
+        const tone = row.danger ? '#ff7b72' : 'rgba(255,255,255,0.9)';
+        const hoverBg = row.danger ? 'rgba(255,123,114,0.14)' : 'rgba(255,255,255,0.10)';
+        return (
+          <Box
+            key={`${row.label}-${index}`}
+            component="button"
+            type="button"
+            role="menuitem"
+            aria-disabled={row.disabled || undefined}
+            aria-haspopup={row.submenu ? 'menu' : undefined}
+            disabled={row.disabled}
+            data-menu-row={index}
+            onMouseEnter={() => onHover(index)}
+            onClick={() => onActivate(index)}
+            sx={{
+              ...rowSx,
+              color: tone,
+              background: highlighted ? hoverBg : 'transparent',
+              '&:hover': { background: hoverBg },
+              '&:disabled': { color: 'rgba(255,255,255,0.32)', cursor: 'default', background: 'transparent' },
+            }}
+          >
+            {row.checked !== undefined && (
+              <CheckRoundedIcon sx={{ fontSize: 15, flexShrink: 0, opacity: row.checked ? 1 : 0, color: 'rgba(255,255,255,0.75)' }} />
+            )}
+            {row.icon !== undefined && (
+              <Box sx={{ display: 'flex', flexShrink: 0, color: row.danger ? tone : 'rgba(255,255,255,0.6)', '& svg': { fontSize: 16 } }}>{row.icon}</Box>
+            )}
+            <Box component="span" sx={{ flex: 1, minWidth: 0, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>
+              {row.label}
+            </Box>
+            {row.shortcut && (
+              <Box
+                component="span"
+                sx={{
+                  flexShrink: 0, px: '5px', py: '1px', borderRadius: '5px',
+                  background: 'rgba(255,255,255,0.08)', color: 'rgba(255,255,255,0.55)',
+                  fontSize: '0.6875rem', letterSpacing: '0.02em',
+                }}
+              >
+                {row.shortcut}
+              </Box>
+            )}
+            {row.submenu && <ChevronRightRoundedIcon sx={{ fontSize: 16, flexShrink: 0, color: 'rgba(255,255,255,0.45)' }} />}
+          </Box>
+        );
+      })}
+    </Box>
+  );
+});
+
+export default CardMenuPanel;
diff --git a/frontend/src/app/pages/Dashboard/desktop/DesktopDock.tsx b/frontend/src/app/pages/Dashboard/desktop/DesktopDock.tsx
index 3930c925..ed7dbbd7 100644
--- a/frontend/src/app/pages/Dashboard/desktop/DesktopDock.tsx
+++ b/frontend/src/app/pages/Dashboard/desktop/DesktopDock.tsx
@@ -1,15 +1,18 @@
-import React, { useCallback, useMemo, useRef, useState } from 'react';
+import React, { useCallback, useLayoutEffect, useMemo, useRef, useState } from 'react';
 import Box from '@mui/material/Box';
-import Tooltip from '@mui/material/Tooltip';
-import Typography from '@mui/material/Typography';
-import LanguageIcon from '@mui/icons-material/Language';
-import EventRepeatIcon from '@mui/icons-material/EventRepeat';
-import { openSettingsCard, openWorkflowsApp } from '@/shared/state/dashboardLayoutSlice';
-import SettingsIcon from '@mui/icons-material/Settings';
-import AppsRoundedIcon from '@mui/icons-material/AppsRounded';
+import KeyboardArrowUpRoundedIcon from '@mui/icons-material/KeyboardArrowUpRounded';
+import KeyboardArrowDownRoundedIcon from '@mui/icons-material/KeyboardArrowDownRounded';
 import { useAppDispatch } from '@/shared/hooks';
 import { captureBrowserShot } from '@/shared/captureBrowserShot';
+import { useClaudeTokens } from '@/shared/styles/ThemeContext';
+import { getWebview } from '@/shared/browserRegistry';
 import { buildDockEntries, CardRect, DockEntry } from './dockEntries';
+import { openCardContextMenu } from './openCardContextMenu';
+import { dockTileMenuRows } from './dockTileMenuRows';
+import { useDockLayout } from './useDockLayout';
+import { DockTileIcon } from './DockTileIcon';
+import DockActionTiles, { DOCK_ACTION_COUNT } from './DockActionTiles';
+import DockHoverPreview from './DockHoverPreview';
 import type { AgentSession } from '@/shared/state/agentsSlice';
 import type {
   CardPosition,
@@ -32,23 +35,7 @@ interface DesktopDockProps {
   onAddBrowser: () => void;
 }
 
-const TILE = 30;
-const PREVIEW_W = 190;
-
-/** A tile shows its site favicon OR the generic glyph, never the glyph peeking out from behind the favicon. */
-function DockTileIcon({ entry }: { entry: DockEntry }): React.ReactElement {
-  const [faviconFailed, setFaviconFailed] = useState(false);
-  if (!entry.faviconUrl || faviconFailed) return <>{entry.icon}</>;
-  return (
-    <Box
-      component="img"
-      src={entry.faviconUrl}
-      alt=""
-      onError={() => setFaviconFailed(true)}
-      sx={{ width: 18, height: 18, borderRadius: '6px' }}
-    />
-  );
-}
+const CARET_H = 13;
 
 /** Left-edge desktop dock: one tile per open card, hover previews, click focuses the window. */
 function DesktopDock({
@@ -64,39 +51,10 @@ function DesktopDock({
   onAddBrowser,
 }: DesktopDockProps): React.ReactElement | null {
   const dispatch = useAppDispatch();
-  const dockBodyRef = useRef<HTMLDivElement | null>(null);
-  // macOS Dock magnification: the tile under the cursor grows on a bell curve and its neighbors
-  // SLIDE AWAY to make room (no horizontal pop-out, the part that read as wobble). Each tile that
-  // grows by `extra` pushes every tile past it by extra/2, so the column opens up smoothly.
-  const applyDockMagnify = useCallback((clientY: number | null) => {
-    const root = dockBodyRef.current;
-    if (!root) return;
-    const tiles = Array.from(root.querySelectorAll<HTMLElement>('.osw-dock-tile'));
-    if (tiles.length === 0) return;
-    if (clientY == null) {
-      tiles.forEach((t) => { t.style.transform = ''; t.style.zIndex = ''; });
-      return;
-    }
-    const rootTop = root.getBoundingClientRect().top;
-    const cy = clientY - rootTop;
-    const BOOST = 0.5;   // hovered tile grows to 1.5x
-    const FALLOFF = 44;  // px spread of the bell curve (how many neighbors react)
-    const bases = tiles.map((t) => t.offsetTop + t.offsetHeight / 2);
-    const scales = bases.map((b) => 1 + BOOST * Math.exp(-(((cy - b) / FALLOFF) ** 2)));
-    const extra = scales.map((s) => TILE * (s - 1));
-    tiles.forEach((t, i) => {
-      let shift = 0;
-      for (let j = 0; j < tiles.length; j++) {
-        if (j === i) continue;
-        shift += (extra[j] / 2) * Math.sign(bases[i] - bases[j]);
-      }
-      t.style.transform = `translateY(${shift.toFixed(1)}px) scale(${scales[i].toFixed(3)})`;
-      t.style.transformOrigin = 'left center';
-      t.style.zIndex = String(10 + Math.round((scales[i] - 1) * 100));
-    });
-  }, []);
+  const accent = useClaudeTokens().accent.primary;
   const [hovered, setHovered] = useState<{ id: string; top: number } | null>(null);
   const [liveShot, setLiveShot] = useState<{ id: string; dataUrl: string } | null>(null);
+  const [edges, setEdges] = useState<{ top: boolean; bottom: boolean }>({ top: false, bottom: false });
   const hoverTimer = useRef<number | null>(null);
 
   const entries = useMemo<DockEntry[]>(
@@ -104,10 +62,23 @@ function DesktopDock({
     [sessions, cards, viewCards, browserCards, workflowCards, outputs],
   );
 
+  const { dockRef, scrollRef, tile, gap, iconSize, scrolls, scrollHeight, bleed, applyMagnify } = useDockLayout({
+    cardCount: entries.length,
+    actionCount: DOCK_ACTION_COUNT,
+    dividerCount: entries.length > 0 ? 2 : 1,
+  });
+
+  const endHover = useCallback(() => {
+    if (hoverTimer.current) window.clearTimeout(hoverTimer.current);
+    setHovered(null);
+    setLiveShot(null);
+  }, []);
+
   const beginHover = useCallback(
     (entry: DockEntry, target: HTMLElement) => {
       if (hoverTimer.current) window.clearTimeout(hoverTimer.current);
-      const top = target.offsetTop;
+      const box = scrollRef.current;
+      const top = target.offsetTop + (box?.contains(target) ? box.offsetTop - box.scrollTop : 0);
       hoverTimer.current = window.setTimeout(() => {
         setHovered({ id: entry.id, top });
         if (entry.browserId) {
@@ -118,26 +89,43 @@ function DesktopDock({
         }
       }, 220);
     },
-    [],
+    [scrollRef],
   );
 
-  const endHover = useCallback(() => {
-    if (hoverTimer.current) window.clearTimeout(hoverTimer.current);
-    setHovered(null);
-    setLiveShot(null);
+  const readEdges = useCallback((el: HTMLDivElement) => {
+    const top = el.scrollTop > 1;
+    const bottom = el.scrollTop + el.clientHeight < el.scrollHeight - 1;
+    setEdges((prev) => (prev.top === top && prev.bottom === bottom ? prev : { top, bottom }));
   }, []);
 
+  useLayoutEffect(() => {
+    const el = scrollRef.current;
+    if (el && scrolls) readEdges(el);
+    else setEdges((prev) => (prev.top || prev.bottom ? { top: false, bottom: false } : prev));
+  }, [scrolls, scrollHeight, entries.length, readEdges, scrollRef]);
+
+  // The fade is exactly the bleed band, which (since scrolling only happens at the tile floor, where bleed > tile)
+  // is the only place a partly-scrolled tile can ever show: so a cut icon always fades out, never hard-clips.
+  const mask = scrolls
+    ? `linear-gradient(to bottom, rgba(0,0,0,${edges.top ? 0 : 1}) 0px, #000 ${bleed}px, #000 calc(100% - ${bleed}px), rgba(0,0,0,${edges.bottom ? 0 : 1}) 100%)`
+    : undefined;
+
   const hoveredEntry = hovered ? entries.find((e) => e.id === hovered.id) : undefined;
   const previewImage = hoveredEntry
     ? (liveShot?.id === hoveredEntry.id ? liveShot.dataUrl : hoveredEntry.thumbnail || undefined)
     : undefined;
 
+  // Past the shrink floor the column scrolls, and a hidden scrollbar with no caret reads as "the rest is gone".
+  const carets: { key: string; top: number; icon: React.ReactNode }[] = [];
+  if (scrolls && edges.top) carets.push({ key: 'up', top: 0, icon: <KeyboardArrowUpRoundedIcon sx={{ fontSize: '0.75rem' }} /> });
+  if (scrolls && edges.bottom) carets.push({ key: 'down', top: scrollHeight - CARET_H, icon: <KeyboardArrowDownRoundedIcon sx={{ fontSize: '0.75rem' }} /> });
+
   return (
     <Box
-      ref={dockBodyRef}
+      ref={dockRef}
       data-desktop-dock
-      onMouseMove={(e: React.MouseEvent) => applyDockMagnify(e.clientY)}
-      onMouseLeave={() => { endHover(); applyDockMagnify(null); }}
+      onMouseMove={(e: React.MouseEvent) => applyMagnify(e.clientY)}
+      onMouseLeave={() => { endHover(); applyMagnify(null); }}
       sx={{
         position: 'absolute',
         left: 12,
@@ -147,7 +135,7 @@ function DesktopDock({
         display: 'flex',
         flexDirection: 'column',
         alignItems: 'center',
-        gap: '9px',
+        gap: `${gap}px`,
         p: '7px',
         borderRadius: '16px',
         background: 'rgba(22,12,34,0.66)',
@@ -155,111 +143,120 @@ function DesktopDock({
         WebkitBackdropFilter: 'blur(20px) saturate(160%)',
         boxShadow: '0 8px 28px rgba(0,0,0,0.35)',
         // Rounder squircle tiles (real app icons, not lame squares). The magnify transform is set
-        // imperatively per-frame by applyDockMagnify; a short ease smooths the chase + the reset.
+        // imperatively per-frame by applyMagnify; a short ease smooths the chase + the reset.
         '& .osw-dock-tile': {
           borderRadius: '12px',
           transition: 'transform 0.12s ease-out',
+          transformOrigin: 'left center',
           willChange: 'transform',
         },
+        // One source of truth for glyph size, so favicons and every icon pack shrink with the tile.
+        '& .osw-dock-tile svg, & .osw-dock-tile img': { width: iconSize, height: iconSize },
       }}
     >
-      {entries.map((entry) => {
-        const isActive = selectedIds.includes(entry.id);
-        return (
-          <Box
-            key={entry.id}
-            className="osw-dock-tile"
-            onMouseEnter={(e) => beginHover(entry, e.currentTarget as HTMLElement)}
-            onClick={() => {
-              endHover();
-              onFocusCard(entry.id, entry.rect);
-            }}
-            sx={{
-              position: 'relative',
-              width: TILE,
-              height: TILE,
-              borderRadius: '12px',
-              background: entry.tileBg,
-              display: 'flex',
-              alignItems: 'center',
-              justifyContent: 'center',
-              cursor: 'pointer',
-              overflow: 'hidden',
-              flexShrink: 0,
-              ...(isActive && { outline: '2px solid #6aa2ff', outlineOffset: '2px' }),
-            }}
-          >
-            {/* Keyed by url so navigating to a new site re-arms the favicon after a previous one failed. */}
-            <DockTileIcon key={entry.faviconUrl || 'glyph'} entry={entry} />
-          </Box>
-        );
-      })}
-
       {entries.length > 0 && (
-        <Box sx={{ width: TILE - 8, height: '1px', background: 'rgba(255,255,255,0.14)' }} />
-      )}
-      {/* The og toolbar's actions, dock-resident: browser, workflow, then settings + apps below their own divider. New-chat lives in the spawn pill, history on the top island. */}
-      {([
-        { label: 'New browser', icon: <LanguageIcon sx={{ fontSize: 17, color: '#e8e8ee' }} />, act: onAddBrowser },
-        { label: 'Workflows', icon: <EventRepeatIcon sx={{ fontSize: 16, color: '#e8e8ee' }} />, act: () => dispatch(openWorkflowsApp()) },
-        { label: 'Settings', icon: <SettingsIcon sx={{ fontSize: 18, color: '#e8e8ee' }} />, act: () => dispatch(openSettingsCard()), divider: true },
-        { label: 'Applications', icon: <AppsRoundedIcon sx={{ fontSize: 18, color: '#e8e8ee' }} />, act: onApplications, bg: 'linear-gradient(135deg, #3d3d46, #232329)' },
-      ] as { label: string; icon: React.ReactNode; act: () => void; divider?: boolean; bg?: string }[]).map((a) => (
-        <React.Fragment key={a.label}>
-          {a.divider && <Box sx={{ width: TILE - 8, height: '1px', background: 'rgba(255,255,255,0.14)' }} />}
-          <Tooltip title={a.label} placement="right">
-            <Box
-              className="osw-dock-tile"
-              onClick={a.act}
-              onMouseEnter={endHover}
-              sx={{
-                width: TILE,
-                height: TILE,
-                borderRadius: '12px',
-                background: a.bg ?? 'linear-gradient(135deg, #5a5a62, #34343c)',
-                display: 'flex',
-                alignItems: 'center',
-                justifyContent: 'center',
-                cursor: 'pointer',
-                flexShrink: 0,
-              }}
-            >
-              {a.icon}
-            </Box>
-          </Tooltip>
-        </React.Fragment>
-      ))}
-
-      {hoveredEntry && (
         <Box
+          ref={scrollRef}
+          data-dock-scroll
+          onScroll={scrolls ? (e: React.UIEvent<HTMLDivElement>) => { readEdges(e.currentTarget); endHover(); } : undefined}
+          // The canvas zooms on wheel; a wheel we consume here must never reach it.
+          onWheel={scrolls ? (e: React.WheelEvent) => e.stopPropagation() : undefined}
           sx={{
-            position: 'absolute',
-            left: 'calc(100% + 10px)',
-            top: Math.max(0, hovered!.top - 34),
-            width: PREVIEW_W,
-            borderRadius: '10px',
-            overflow: 'hidden',
-            background: previewImage ? '#fff' : 'rgba(22,12,34,0.9)',
-            boxShadow: '0 12px 32px rgba(0,0,0,0.4)',
-            pointerEvents: 'none',
+            position: 'relative',
+            display: 'flex',
+            flexDirection: 'column',
+            alignItems: 'center',
+            gap: `${gap}px`,
+            ...(scrolls && {
+              height: `${scrollHeight}px`,
+              overflowY: 'auto',
+              overscrollBehavior: 'contain',
+              // Bleed the clip box past the column so scrolling doesn't crop the magnified tiles.
+              width: `${tile + bleed * 2}px`,
+              mx: `${-bleed}px`,
+              py: `${bleed}px`,
+              scrollbarWidth: 'none',
+              '&::-webkit-scrollbar': { display: 'none' },
+              maskImage: mask,
+              WebkitMaskImage: mask,
+            }),
           }}
         >
-          {previewImage ? (
-            <Box component="img" src={previewImage} alt="" sx={{ width: '100%', display: 'block' }} />
-          ) : (
-            <Box sx={{ p: 1.25 }}>
-              <Typography sx={{ color: '#fff', fontSize: '0.75rem', fontWeight: 600, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>
-                {hoveredEntry.label}
-              </Typography>
-              {hoveredEntry.snippet && (
-                <Typography sx={{ color: 'rgba(255,255,255,0.6)', fontSize: '0.6875rem', mt: 0.25, display: '-webkit-box', WebkitLineClamp: 2, WebkitBoxOrient: 'vertical', overflow: 'hidden' }}>
-                  {hoveredEntry.snippet}
-                </Typography>
-              )}
-            </Box>
-          )}
+          {entries.map((entry) => {
+            const isActive = selectedIds.includes(entry.id);
+            return (
+              <Box
+                key={entry.id}
+                className="osw-dock-tile"
+                role="button"
+                // The hover card carries the name for the eye; this carries it for everything else (screen readers, tests).
+                aria-label={entry.label}
+                onMouseEnter={(e) => beginHover(entry, e.currentTarget as HTMLElement)}
+                onClick={() => {
+                  endHover();
+                  onFocusCard(entry.id, entry.rect);
+                }}
+                onContextMenu={(e: React.MouseEvent) => {
+                  endHover();
+                  openCardContextMenu(e, { items: dockTileMenuRows(entry, dispatch, () => onFocusCard(entry.id, entry.rect)) });
+                }}
+                sx={{
+                  position: 'relative',
+                  width: tile,
+                  height: tile,
+                  borderRadius: '12px',
+                  background: entry.tileBg,
+                  display: 'flex',
+                  alignItems: 'center',
+                  justifyContent: 'center',
+                  cursor: 'pointer',
+                  overflow: 'hidden',
+                  flexShrink: 0,
+                  transition: 'box-shadow 140ms ease, background 140ms ease',
+                  // Same grammar as the minimized rail: soft accent tint, ONE accent inner ring as the carrier, and the icon lifts. The outer glow is decoration, never the signal.
+                  ...(isActive && {
+                    background: `linear-gradient(0deg, ${accent}1f, ${accent}1f), ${entry.tileBg}`,
+                    boxShadow: `inset 0 0 0 1px ${accent}, 0 0 24px ${accent}26`,
+                    '& > *': { filter: 'brightness(1.25)' },
+                  }),
+                }}
+              >
+                {/* Keyed by url so navigating to a new site re-arms the favicon after a previous one failed. */}
+                <DockTileIcon key={entry.faviconUrl || 'glyph'} entry={entry} />
+              </Box>
+            );
+          })}
         </Box>
       )}
+
+      {entries.length > 0 && (
+        <Box sx={{ width: tile - 8, height: '1px', background: 'rgba(255,255,255,0.14)' }} />
+      )}
+      <DockActionTiles tile={tile} onAddBrowser={onAddBrowser} onApplications={onApplications} onHoverAway={endHover} />
+
+      {/* Anchored to the root's padding box, whose top edge IS the scroll box's top edge. */}
+      {carets.map((c) => (
+        <Box
+          key={c.key}
+          sx={{
+            position: 'absolute',
+            left: 0,
+            right: 0,
+            top: `${c.top}px`,
+            height: `${CARET_H}px`,
+            display: 'flex',
+            alignItems: 'center',
+            justifyContent: 'center',
+            color: 'rgba(255,255,255,0.72)',
+            pointerEvents: 'none',
+            zIndex: 40,
+          }}
+        >
+          {c.icon}
+        </Box>
+      ))}
+
+      {hoveredEntry && <DockHoverPreview entry={hoveredEntry} top={hovered!.top} image={previewImage} />}
     </Box>
   );
 }
diff --git a/frontend/src/app/pages/Dashboard/desktop/DockActionTiles.tsx b/frontend/src/app/pages/Dashboard/desktop/DockActionTiles.tsx
new file mode 100644
index 00000000..c553a23d
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/DockActionTiles.tsx
@@ -0,0 +1,62 @@
+import React from 'react';
+import Box from '@mui/material/Box';
+import Tooltip from '@mui/material/Tooltip';
+import LanguageIcon from '@mui/icons-material/Language';
+import EventRepeatIcon from '@mui/icons-material/EventRepeat';
+import SettingsIcon from '@mui/icons-material/Settings';
+import AppsRoundedIcon from '@mui/icons-material/AppsRounded';
+import { useAppDispatch } from '@/shared/hooks';
+import { openSettingsCard, openWorkflowsApp } from '@/shared/state/dashboardLayoutSlice';
+
+// The dock reserves room for these before it knows what they are, so the count lives with the list.
+export const DOCK_ACTION_COUNT = 4;
+
+interface DockActionTilesProps {
+  tile: number;
+  onAddBrowser: () => void;
+  onApplications: () => void;
+  onHoverAway: () => void;
+}
+
+/** The dock's fixed group: browser, workflows, then settings + applications under their own divider. */
+function DockActionTiles({ tile, onAddBrowser, onApplications, onHoverAway }: DockActionTilesProps): React.ReactElement {
+  const dispatch = useAppDispatch();
+  const actions: { label: string; icon: React.ReactNode; act: () => void; divider?: boolean; bg?: string }[] = [
+    { label: 'New browser', icon: <LanguageIcon sx={{ color: '#e8e8ee' }} />, act: onAddBrowser },
+    { label: 'Workflows', icon: <EventRepeatIcon sx={{ color: '#e8e8ee' }} />, act: () => dispatch(openWorkflowsApp()) },
+    { label: 'Settings', icon: <SettingsIcon sx={{ color: '#e8e8ee' }} />, act: () => dispatch(openSettingsCard()), divider: true },
+    { label: 'Applications', icon: <AppsRoundedIcon sx={{ color: '#e8e8ee' }} />, act: onApplications, bg: 'linear-gradient(135deg, #3d3d46, #232329)' },
+  ];
+
+  return (
+    <>
+      {actions.map((a) => (
+        <React.Fragment key={a.label}>
+          {a.divider && <Box sx={{ width: tile - 8, height: '1px', background: 'rgba(255,255,255,0.14)' }} />}
+          <Tooltip title={a.label} placement="right">
+            <Box
+              className="osw-dock-tile"
+              onClick={a.act}
+              onMouseEnter={onHoverAway}
+              sx={{
+                width: tile,
+                height: tile,
+                borderRadius: '12px',
+                background: a.bg ?? 'linear-gradient(135deg, #5a5a62, #34343c)',
+                display: 'flex',
+                alignItems: 'center',
+                justifyContent: 'center',
+                cursor: 'pointer',
+                flexShrink: 0,
+              }}
+            >
+              {a.icon}
+            </Box>
+          </Tooltip>
+        </React.Fragment>
+      ))}
+    </>
+  );
+}
+
+export default DockActionTiles;
diff --git a/frontend/src/app/pages/Dashboard/desktop/DockHoverPreview.tsx b/frontend/src/app/pages/Dashboard/desktop/DockHoverPreview.tsx
new file mode 100644
index 00000000..e1c70104
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/DockHoverPreview.tsx
@@ -0,0 +1,46 @@
+import React from 'react';
+import Box from '@mui/material/Box';
+import Typography from '@mui/material/Typography';
+import type { DockEntry } from './dockEntries';
+
+const PREVIEW_W = 190;
+
+interface DockHoverPreviewProps {
+  entry: DockEntry;
+  top: number;
+  image?: string;
+}
+
+/** The card that floats beside a hovered dock tile: a live shot when we have one, title + snippet otherwise. */
+function DockHoverPreview({ entry, top, image }: DockHoverPreviewProps): React.ReactElement {
+  return (
+    <Box
+      sx={{
+        position: 'absolute',
+        left: 'calc(100% + 10px)',
+        top: Math.max(0, top - 34),
+        width: PREVIEW_W,
+        borderRadius: '10px',
+        overflow: 'hidden',
+        background: image ? '#fff' : 'rgba(22,12,34,0.9)',
+        boxShadow: '0 12px 32px rgba(0,0,0,0.4)',
+        pointerEvents: 'none',
+      }}
+    >
+      {image && <Box component="img" src={image} alt="" sx={{ width: '100%', display: 'block' }} />}
+      {/* The name rides along even under a live shot: a thumbnail of a page is not its title, and three identical glyphs need one. */}
+      <Box sx={{ p: 1.25, ...(image && { background: 'rgba(22,12,34,0.9)' }) }}>
+        <Typography sx={{ color: '#fff', fontSize: '0.75rem', fontWeight: 600, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>
+          {entry.label}
+        </Typography>
+        {!image && entry.snippet && (
+          <Typography sx={{ color: 'rgba(255,255,255,0.6)', fontSize: '0.6875rem', mt: 0.25, display: '-webkit-box', WebkitLineClamp: 2, WebkitBoxOrient: 'vertical', overflow: 'hidden' }}>
+            {entry.snippet}
+          </Typography>
+        )}
+      </Box>
+    </Box>
+  );
+}
+
+export default DockHoverPreview;
diff --git a/frontend/src/app/pages/Dashboard/desktop/DockTileIcon.tsx b/frontend/src/app/pages/Dashboard/desktop/DockTileIcon.tsx
new file mode 100644
index 00000000..c1453376
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/DockTileIcon.tsx
@@ -0,0 +1,12 @@
+import React, { useState } from 'react';
+import Box from '@mui/material/Box';
+import type { DockEntry } from './dockEntries';
+
+/** A tile shows its site favicon OR the generic glyph, never the glyph peeking out from behind the favicon. */
+export function DockTileIcon({ entry }: { entry: DockEntry }): React.ReactElement {
+  const [faviconFailed, setFaviconFailed] = useState(false);
+  if (!entry.faviconUrl || faviconFailed) return <>{entry.icon}</>;
+  return (
+    <Box component="img" src={entry.faviconUrl} alt="" onError={() => setFaviconFailed(true)} sx={{ borderRadius: '6px' }} />
+  );
+}
diff --git a/frontend/src/app/pages/Dashboard/desktop/HelpAskBox.tsx b/frontend/src/app/pages/Dashboard/desktop/HelpAskBox.tsx
new file mode 100644
index 00000000..20c6d384
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/HelpAskBox.tsx
@@ -0,0 +1,61 @@
+import React, { useMemo } from 'react';
+import Box from '@mui/material/Box';
+import Typography from '@mui/material/Typography';
+import AutoAwesomeRoundedIcon from '@mui/icons-material/AutoAwesomeRounded';
+import ArrowUpwardRoundedIcon from '@mui/icons-material/ArrowUpwardRounded';
+import { searchHelp, type HelpKnowledge } from './helpSearch';
+
+interface HelpAskBoxProps {
+  value: string;
+  knowledge: HelpKnowledge | null;
+  onChange: (v: string) => void;
+  onAsk: () => void;
+}
+
+/**
+ * Search first, chat second (the Raycast/Linear shape): the top questions are answered from facts
+ * that shipped with the build, instantly, with no model call and no network. That also makes this
+ * the one part of Help that still works when the user's provider is the thing that's broken.
+ */
+const HelpAskBox: React.FC<HelpAskBoxProps> = ({ value, knowledge, onChange, onAsk }) => {
+  const matches = useMemo(() => searchHelp(knowledge, value), [knowledge, value]);
+
+  return (
+    <Box>
+      <Box sx={{ display: 'flex', alignItems: 'center', gap: 1, mx: 1, my: 0.75, px: 1.25, py: 0.75, background: 'rgba(255,255,255,0.06)', border: '1px solid rgba(255,255,255,0.12)', borderRadius: '10px' }}>
+        <AutoAwesomeRoundedIcon sx={{ fontSize: 15, color: 'rgba(255,255,255,0.5)' }} />
+        <Box
+          component="input"
+          value={value}
+          onChange={(e: React.ChangeEvent<HTMLInputElement>) => onChange(e.target.value)}
+          onKeyDown={(e: React.KeyboardEvent) => { if (e.key === 'Enter') onAsk(); e.stopPropagation(); }}
+          placeholder="Ask OpenSwarm anything..."
+          sx={{ flex: 1, border: 'none', outline: 'none', background: 'transparent', color: 'rgba(255,255,255,0.92)', fontFamily: 'inherit', fontSize: '0.8125rem', '&::placeholder': { color: 'rgba(255,255,255,0.4)' } }}
+        />
+        {value.trim() && (
+          <Box component="button" onClick={onAsk} sx={{ display: 'flex', border: 'none', background: 'transparent', color: 'rgba(255,255,255,0.8)', cursor: 'pointer', p: 0 }}>
+            <ArrowUpwardRoundedIcon sx={{ fontSize: 16 }} />
+          </Box>
+        )}
+      </Box>
+      {matches.length > 0 && (
+        <Box sx={{ mx: 1, mb: 0.75, px: 1.25, py: 0.75, background: 'rgba(255,255,255,0.035)', border: '1px solid rgba(255,255,255,0.07)', borderRadius: '10px' }}>
+          <Typography sx={{ fontSize: '0.625rem', letterSpacing: '0.08em', textTransform: 'uppercase', color: 'rgba(255,255,255,0.38)', mb: 0.5 }}>
+            From the docs
+          </Typography>
+          {matches.map((m) => (
+            <Box key={m.id} sx={{ mb: 0.75, '&:last-of-type': { mb: 0 } }}>
+              <Typography sx={{ fontSize: '0.75rem', fontWeight: 600, color: 'rgba(255,255,255,0.88)' }}>{m.title}</Typography>
+              <Typography sx={{ fontSize: '0.6875rem', color: 'rgba(255,255,255,0.6)', lineHeight: 1.45 }}>{m.detail}</Typography>
+            </Box>
+          ))}
+          <Typography sx={{ fontSize: '0.625rem', color: 'rgba(255,255,255,0.35)', mt: 0.75 }}>
+            Press Enter to ask the help chat instead.
+          </Typography>
+        </Box>
+      )}
+    </Box>
+  );
+};
+
+export default HelpAskBox;
diff --git a/frontend/src/app/pages/Dashboard/desktop/HelpPanel.tsx b/frontend/src/app/pages/Dashboard/desktop/HelpPanel.tsx
index 62aa072f..afcb5600 100644
--- a/frontend/src/app/pages/Dashboard/desktop/HelpPanel.tsx
+++ b/frontend/src/app/pages/Dashboard/desktop/HelpPanel.tsx
@@ -1,9 +1,8 @@
-import React, { useCallback, useRef, useState } from 'react';
+import React, { useCallback, useEffect, useRef, useState } from 'react';
 import Box from '@mui/material/Box';
 import Typography from '@mui/material/Typography';
 import CircularProgress from '@mui/material/CircularProgress';
 import { AnimatePresence, motion } from 'framer-motion';
-import AutoAwesomeRoundedIcon from '@mui/icons-material/AutoAwesomeRounded';
 import BugReportOutlinedIcon from '@mui/icons-material/BugReportOutlined';
 import LightbulbOutlinedIcon from '@mui/icons-material/LightbulbOutlined';
 import MenuBookOutlinedIcon from '@mui/icons-material/MenuBookOutlined';
@@ -12,32 +11,15 @@ import AttachFileRoundedIcon from '@mui/icons-material/AttachFileRounded';
 import ArrowOutwardRoundedIcon from '@mui/icons-material/ArrowOutwardRounded';
 import ChevronRightRoundedIcon from '@mui/icons-material/ChevronRightRounded';
 import ArrowBackRoundedIcon from '@mui/icons-material/ArrowBackRounded';
-import ArrowUpwardRoundedIcon from '@mui/icons-material/ArrowUpwardRounded';
+import HelpAskBox from './HelpAskBox';
+import { FALLBACK_HELP_PROMPT, loadHelpKnowledge } from './helpKnowledge';
+import type { HelpKnowledge } from './helpSearch';
 import { useAppDispatch, useAppSelector } from '@/shared/hooks';
 import { createDraftSession, launchAndSendFirstMessage, type AgentConfig } from '@/shared/state/agentsSlice';
 import { addBrowserCard } from '@/shared/state/dashboardLayoutSlice';
 import { getLastDashboardId } from '@/shared/lastDashboardId';
 import { API_BASE } from '@/shared/config';
 
-// The Ask chat is a DEDICATED help chat, not a general agent: it knows the app's surfaces and stays
-// in support mode instead of launching into open-ended work.
-const HELP_SYSTEM_PROMPT = [
-  "You are OpenSwarm's help assistant, a dedicated support chat inside the app.",
-  'Answer questions about using OpenSwarm clearly and briefly, with the exact clicks or keys.',
-  'What you know about the app:',
-  '- Dashboards work like macOS Spaces: resting the cursor on the very top edge of the window reveals the spaces bar to switch dashboards or add one with +.',
-  '- The canvas holds cards: agent chats, browsers, built apps, and workflows. Cards have mac-style traffic lights; the green dot goes full screen, hovering it offers halves, quarters, and thirds.',
-  '- The dark dock on the left creates chats, browsers, and workflows, and opens History, Settings, and Apps.',
-  '- Cmd+K searches everything. Dictation: hold the mic in the Help pill (or the mic key) to talk; the words land where the cursor is.',
-  '- Settings (gear in the dock): Account, General (agent defaults), Appearance (theme, accent colors, text size), Privacy, Advanced, plus Models (connect Claude, ChatGPT, or Gemini subscriptions or API keys), Skills, Tools, Commands, and Usage.',
-  '- Workflows run agents on a schedule; open them from the dock calendar icon.',
-  'Behavior rules:',
-  '- Stay a help chat. Never start unrelated agent work or long tasks from here.',
-  '- You may read settings with the settings tools to answer questions about their setup; ask before changing anything.',
-  '- If something sounds like a bug, point them to Help then Report a bug, which packages diagnostics automatically.',
-  '- If they want real work done, tell them to start a regular chat from the dock or by typing on the canvas.',
-].join('\n');
-
 const REPO_ISSUES_URL = 'https://github.com/openswarm-ai/openswarm/issues/new';
 const DOCS_URL = 'https://docs.openswarm.com';
 const DISCORD_URL = 'https://discord.com/channels/1486442924391796896/1486442927554170892';
@@ -78,17 +60,25 @@ const HelpPanel: React.FC<{ onClose: () => void }> = ({ onClose }) => {
   const [reportText, setReportText] = useState('');
   const [files, setFiles] = useState<File[]>([]);
   const [sending, setSending] = useState(false);
+  const [knowledge, setKnowledge] = useState<HelpKnowledge | null>(null);
   const fileInputRef = useRef<HTMLInputElement | null>(null);
 
+  // Fetched on open so the instant answers are ready before the user finishes typing; cached across opens.
+  useEffect(() => {
+    let live = true;
+    void loadHelpKnowledge().then((k) => { if (live) setKnowledge(k); });
+    return () => { live = false; };
+  }, []);
+
   const startChat = useCallback((prompt: string): void => {
     const p = prompt.trim();
     if (!p) return;
     const dashboardId = getLastDashboardId() ?? undefined;
-    const config: AgentConfig = { name: 'Help', model, mode: 'agent', dashboard_id: dashboardId, system_prompt: HELP_SYSTEM_PROMPT };
+    const config: AgentConfig = { name: 'Help', model, mode: 'agent', dashboard_id: dashboardId, system_prompt: knowledge?.system_prompt || FALLBACK_HELP_PROMPT };
     const draftId = dispatch(createDraftSession({ mode: 'agent', model, dashboardId: dashboardId ?? '', setActive: true })).payload.draftId;
     void dispatch(launchAndSendFirstMessage({ draftId, config, prompt: p, mode: 'agent', model, expand: true }));
     onClose();
-  }, [dispatch, model, onClose]);
+  }, [dispatch, model, onClose, knowledge]);
 
   const submitReport = useCallback(async (kind: 'bug' | 'idea'): Promise<void> => {
     if (sending) return;
@@ -167,22 +157,7 @@ const HelpPanel: React.FC<{ onClose: () => void }> = ({ onClose }) => {
             <Box sx={{ px: 1.25, pt: 0.75, pb: 0.5 }}>
               <Typography sx={{ fontSize: '0.875rem', fontWeight: 600, color: 'rgba(255,255,255,0.95)' }}>How can we help?</Typography>
             </Box>
-            <Box sx={{ display: 'flex', alignItems: 'center', gap: 1, mx: 1, my: 0.75, px: 1.25, py: 0.75, background: 'rgba(255,255,255,0.06)', border: '1px solid rgba(255,255,255,0.12)', borderRadius: '10px' }}>
-              <AutoAwesomeRoundedIcon sx={{ fontSize: 15, color: 'rgba(255,255,255,0.5)' }} />
-              <Box
-                component="input"
-                value={ask}
-                onChange={(e: React.ChangeEvent<HTMLInputElement>) => setAsk(e.target.value)}
-                onKeyDown={(e: React.KeyboardEvent) => { if (e.key === 'Enter') startChat(ask); e.stopPropagation(); }}
-                placeholder="Ask OpenSwarm anything..."
-                sx={{ flex: 1, border: 'none', outline: 'none', background: 'transparent', color: 'rgba(255,255,255,0.92)', fontFamily: 'inherit', fontSize: '0.8125rem', '&::placeholder': { color: 'rgba(255,255,255,0.4)' } }}
-              />
-              {ask.trim() && (
-                <Box component="button" onClick={() => startChat(ask)} sx={{ display: 'flex', border: 'none', background: 'transparent', color: 'rgba(255,255,255,0.8)', cursor: 'pointer', p: 0 }}>
-                  <ArrowUpwardRoundedIcon sx={{ fontSize: 16 }} />
-                </Box>
-              )}
-            </Box>
+            <HelpAskBox value={ask} knowledge={knowledge} onChange={setAsk} onAsk={() => startChat(ask)} />
             <Box component="button" onClick={() => { setReportText(''); setFiles([]); setPane('bug'); }} sx={rowSx}>
               <BugReportOutlinedIcon sx={iconSx} />
               <Box sx={{ flex: 1, minWidth: 0 }}>
diff --git a/frontend/src/app/pages/Dashboard/desktop/MinimizedStack.tsx b/frontend/src/app/pages/Dashboard/desktop/MinimizedStack.tsx
index f19f866e..7d4c7fa4 100644
--- a/frontend/src/app/pages/Dashboard/desktop/MinimizedStack.tsx
+++ b/frontend/src/app/pages/Dashboard/desktop/MinimizedStack.tsx
@@ -1,37 +1,70 @@
 import React from 'react';
 import Box from '@mui/material/Box';
-import Typography from '@mui/material/Typography';
-import LanguageIcon from '@mui/icons-material/Language';
 import { useAppDispatch, useAppSelector } from '@/shared/hooks';
-import { toggleMinimizeCard, setTiledCard, recordClosedCard } from '@/shared/state/dashboardLayoutSlice';
+import {
+  toggleMinimizeCard, setTiledCard, recordClosedCard, closeSettingsCard, closeWorkflowsApp,
+} from '@/shared/state/dashboardLayoutSlice';
 import { removeBrowserCardCleanly } from '@/shared/browserTeardown';
-import WindowControls, { ARC_CHIP_SX } from '../cards/WindowControls';
-import { getMinimizedShot, dropMinimizedShot } from './minimizedShots';
-import type { BrowserCardPosition } from '@/shared/state/dashboardLayoutSlice';
-
-interface CardRect {
-  x: number;
-  y: number;
-  width: number;
-  height: number;
-}
+import { removeViewCardCleanly } from '@/shared/viewTeardown';
+import { useClaudeTokens } from '@/shared/styles/ThemeContext';
+import { GLASS_SURFACE, GLASS_SURFACE_BLUR } from '@/shared/styles/glassSurface';
+import { dropMinimizedShot } from './minimizedShots';
+import { buildMinimizedEntries, MinimizedEntry, MinimizedRect } from './minimizedEntries';
+import MinimizedTile, { MINIMIZED_TILE_W } from './MinimizedTile';
+import { openCardContextMenu } from './openCardContextMenu';
+import { tileMenuRows } from '../cards/tileMenuRows';
+import type { BrowserCardPosition, ViewCardPosition } from '@/shared/state/dashboardLayoutSlice';
+import type { Output } from '@/shared/state/outputsSlice';
 
 interface MinimizedStackProps {
   browserCards: Record<string, BrowserCardPosition>;
-  onRestore: (id: string, rect: CardRect) => void;
+  viewCards: Record<string, ViewCardPosition>;
+  outputs: Record<string, Output>;
+  selectedIds: string[];
+  onRestore: (id: string, rect: MinimizedRect) => void;
 }
 
-const THUMB_W = 96;
-
-/** Right-edge stack of minimized browser windows; click restores the card where it was. */
-function MinimizedStack({ browserCards, onRestore }: MinimizedStackProps): React.ReactElement | null {
+/** Right-edge rail of parked windows, browsers and apps alike; click a tile to put it back. */
+function MinimizedStack({ browserCards, viewCards, outputs, selectedIds, onRestore }: MinimizedStackProps): React.ReactElement | null {
   const dispatch = useAppDispatch();
-  const minimized = useAppSelector((s) => s.dashboardLayout.minimizedCards);
-  const entries = Object.values(browserCards).filter((bc) => minimized[bc.browser_id]);
+  const c = useClaudeTokens();
+  const minimizedCards = useAppSelector((s) => s.dashboardLayout.minimizedCards);
+  const tiledCards = useAppSelector((s) => s.dashboardLayout.tiledCards);
+  const workflowsHub = useAppSelector((s) => s.dashboardLayout.workflowsHub);
+  const settingsCard = useAppSelector((s) => s.dashboardLayout.settingsCard);
+  const entries = buildMinimizedEntries({ browserCards, viewCards, outputs, workflowsHub, settingsCard, minimizedCards });
   if (entries.length === 0) return null;
 
+  const restore = (entry: MinimizedEntry): void => {
+    dropMinimizedShot(entry.id);
+    dispatch(toggleMinimizeCard({ cardId: entry.id }));
+    // A card that kept its tile comes back pinned to the viewport, so flying the camera to its stored
+    // free-floating rect would just wander off to empty canvas.
+    if (!tiledCards[entry.id]) onRestore(entry.id, entry.rect);
+  };
+  const close = (entry: MinimizedEntry): void => {
+    dropMinimizedShot(entry.id);
+    if (entry.kind === 'browser') {
+      dispatch(recordClosedCard({ kind: 'browser', id: entry.id }));
+      void removeBrowserCardCleanly(entry.id, dispatch);
+    } else if (entry.kind === 'view') {
+      dispatch(recordClosedCard({ kind: 'view', id: entry.id }));
+      void removeViewCardCleanly(entry.id, dispatch);
+    } else if (entry.kind === 'workflows') {
+      dispatch(closeWorkflowsApp());
+    } else {
+      dispatch(closeSettingsCard());
+    }
+  };
+  const tile = (entry: MinimizedEntry, zone: string): void => {
+    restore(entry);
+    if (zone !== 'restore') dispatch(setTiledCard({ cardId: entry.id, zone }));
+  };
+
   return (
     <Box
+      data-minimized-rail
+      // Must stay OUTSIDE the canvas transform: a transformed ancestor becomes the containing block, so a rail nested in there would ride the camera.
       sx={{
         position: 'absolute',
         right: 14,
@@ -39,70 +72,52 @@ function MinimizedStack({ browserCards, onRestore }: MinimizedStackProps): React
         zIndex: 11,
         display: 'flex',
         flexDirection: 'column',
-        gap: 1.5,
-        alignItems: 'flex-end',
+        gap: '6px',
+        p: '6px',
+        borderRadius: '16px',
+        width: MINIMIZED_TILE_W + 12,
+        maxHeight: 'calc(100% - 220px)',
+        overflowY: 'auto',
+        scrollbarWidth: 'none',
+        '&::-webkit-scrollbar': { display: 'none' },
+        background: GLASS_SURFACE,
+        backdropFilter: GLASS_SURFACE_BLUR,
+        WebkitBackdropFilter: GLASS_SURFACE_BLUR,
+        border: '1px solid rgba(255,255,255,0.10)',
+        boxShadow: '0 8px 28px rgba(0,0,0,0.35)',
+        '@keyframes osw-min-tile-in': {
+          from: { opacity: 0, transform: 'scale(0.96)' },
+          to: { opacity: 1, transform: 'scale(1)' },
+        },
+        // A minimize is a physical snap, so the aggressive out-ease; nothing here loops.
+        '& .osw-min-tile': { animation: 'osw-min-tile-in 180ms cubic-bezier(0.16, 1, 0.3, 1) both' },
+        '@media (prefers-reduced-motion: reduce)': {
+          '& .osw-min-tile': { animation: 'none' },
+        },
       }}
     >
-      {entries.map((bc) => {
-        const activeTab = bc.tabs.find((t) => t.id === bc.activeTabId) || bc.tabs[0];
-        const shot = getMinimizedShot(bc.browser_id);
-        const restore = (): void => {
-          dropMinimizedShot(bc.browser_id);
-          dispatch(toggleMinimizeCard({ cardId: bc.browser_id }));
-          onRestore(bc.browser_id, bc);
-        };
-        return (
-          <Box
-            key={bc.browser_id}
-            onClick={restore}
-            title={activeTab?.title || 'Browser'}
-            className="osw-card osw-pill-host"
-            sx={{
-              position: 'relative',
-              width: THUMB_W,
-              borderRadius: '8px',
-              cursor: 'pointer',
-              boxShadow: '0 6px 20px rgba(0,0,0,0.3)',
-              background: '#fff',
-              transition: 'transform 0.15s ease, box-shadow 0.15s ease',
-              '&:hover': { transform: 'scale(1.06)', boxShadow: '0 10px 28px rgba(0,0,0,0.4)' },
-              '&:hover .osw-pill-lights': { opacity: 1, pointerEvents: 'auto' },
-            }}
-          >
-            <Box
-              className="osw-pill-lights"
-              onClick={(e: React.MouseEvent) => e.stopPropagation()}
-              sx={{
-                ...ARC_CHIP_SX,
-                position: 'absolute', top: 2, left: 2, zIndex: 2, background: 'rgba(24,14,32,0.85)',
-                backdropFilter: 'blur(12px)', WebkitBackdropFilter: 'blur(12px)',
-                opacity: 0, pointerEvents: 'none', transition: 'opacity 140ms ease',
-              }}
-            >
-              <WindowControls
-                onClose={() => { dispatch(recordClosedCard({ kind: 'browser', id: bc.browser_id })); removeBrowserCardCleanly(bc.browser_id, dispatch); }}
-                onMinimize={restore}
-                onTile={(zone: string) => { restore(); if (zone !== 'restore') dispatch(setTiledCard({ cardId: bc.browser_id, zone })); }}
-                tiled={false}
-              />
-            </Box>
-            {shot ? (
-              <Box component="img" src={shot} alt="" sx={{ width: '100%', display: 'block', borderRadius: '8px' }} />
-            ) : (
-              <Box sx={{ display: 'flex', flexDirection: 'column', alignItems: 'center', gap: 0.5, py: 1.5, px: 1 }}>
-                {activeTab?.favicon ? (
-                  <Box component="img" src={activeTab.favicon} alt="" sx={{ width: 20, height: 20, borderRadius: '4px' }} />
-                ) : (
-                  <LanguageIcon sx={{ fontSize: 20, color: '#8a8494' }} />
-                )}
-                <Typography sx={{ fontSize: '0.625rem', color: '#3c3744', textAlign: 'center', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', maxWidth: '100%' }}>
-                  {activeTab?.title || 'Browser'}
-                </Typography>
-              </Box>
-            )}
-          </Box>
-        );
-      })}
+      {entries.map((entry) => (
+        <MinimizedTile
+          key={entry.id}
+          entry={entry}
+          accent={c.accent.primary}
+          selected={selectedIds.includes(entry.id)}
+          onRestore={() => restore(entry)}
+          onClose={() => close(entry)}
+          onTile={(zone: string) => tile(entry, zone)}
+          onContextMenu={(e: React.MouseEvent) => openCardContextMenu(e, {
+            items: [
+              { label: 'Restore', onClick: () => restore(entry) },
+              { label: 'Restore full screen', onClick: () => tile(entry, 'fullscreen') },
+              ...(entry.kind === 'browser' || entry.kind === 'view'
+                ? [{ label: 'Tile to zone', submenu: tileMenuRows((zone) => tile(entry, zone)) }]
+                : []),
+              { kind: 'separator' },
+              { label: 'Close', danger: true, onClick: () => close(entry) },
+            ],
+          })}
+        />
+      ))}
     </Box>
   );
 }
diff --git a/frontend/src/app/pages/Dashboard/desktop/MinimizedTile.tsx b/frontend/src/app/pages/Dashboard/desktop/MinimizedTile.tsx
new file mode 100644
index 00000000..2e39b34f
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/MinimizedTile.tsx
@@ -0,0 +1,147 @@
+import React, { useState } from 'react';
+import Box from '@mui/material/Box';
+import Typography from '@mui/material/Typography';
+import LanguageIcon from '@mui/icons-material/Language';
+import GridViewRoundedIcon from '@mui/icons-material/GridViewRounded';
+import EventRepeatIcon from '@mui/icons-material/EventRepeat';
+import SettingsIcon from '@mui/icons-material/Settings';
+import { pickIcon } from '../canvas/DashboardGlyph';
+import WindowControls, { ARC_CHIP_SX } from '../cards/WindowControls';
+import { getMinimizedShot } from './minimizedShots';
+import type { MinimizedEntry } from './minimizedEntries';
+
+interface MinimizedTileProps {
+  entry: MinimizedEntry;
+  accent: string;
+  selected: boolean;
+  onRestore: () => void;
+  onClose: () => void;
+  onTile: (zone: string) => void;
+  onContextMenu: (e: React.MouseEvent) => void;
+}
+
+export const MINIMIZED_TILE_W = 132;
+
+// Opaque interior: the rail above is the one glass layer, so stacking more alpha in here just muddies
+// the text. Chromium also does a backdrop readback per blurred element, so N blurred tiles is N passes.
+const TILE_BODY = '#262624';
+const TILE_WELL = '#1b1b19';
+const REST_EDGE = 'rgba(255,255,255,0.10)';
+const HOVER_EDGE = 'rgba(255,255,255,0.16)';
+
+/** One parked window: its own last frame, a favicon or glyph, and the title. Hover reveals the lights. */
+function MinimizedTile({ entry, accent, selected, onRestore, onClose, onTile, onContextMenu }: MinimizedTileProps): React.ReactElement {
+  const [faviconFailed, setFaviconFailed] = useState(false);
+  const preview = getMinimizedShot(entry.id) || entry.thumbnail || null;
+  const showFavicon = entry.kind === 'browser' && !!entry.faviconUrl && !faviconFailed;
+
+  const mark = (size: number): React.ReactElement => {
+    if (showFavicon) {
+      return (
+        <Box
+          component="img"
+          src={entry.faviconUrl}
+          alt=""
+          onError={() => setFaviconFailed(true)}
+          sx={{ width: size, height: size, borderRadius: `${Math.round(size / 4)}px`, display: 'block' }}
+        />
+      );
+    }
+    if (entry.kind === 'browser') return <LanguageIcon sx={{ fontSize: size, color: 'rgba(255,255,255,0.55)', display: 'block' }} />;
+    // The singleton windows never have a thumbnail, so their own app glyph is the whole identity of the tile.
+    if (entry.kind === 'workflows') return <EventRepeatIcon sx={{ fontSize: size, color: 'rgba(255,255,255,0.55)', display: 'block' }} />;
+    if (entry.kind === 'settings') return <SettingsIcon sx={{ fontSize: size, color: 'rgba(255,255,255,0.55)', display: 'block' }} />;
+    // Never a letter here: a glyph initial reads as a bug, so an unmatched name falls back to a real symbol.
+    const AppIcon = pickIcon(entry.label);
+    if (AppIcon) return <AppIcon size={size} strokeWidth={1.75} color="rgba(255,255,255,0.6)" />;
+    return <GridViewRoundedIcon sx={{ fontSize: size, color: 'rgba(255,255,255,0.55)', display: 'block' }} />;
+  };
+
+  return (
+    <Box
+      className="osw-card osw-pill-host osw-min-tile"
+      onClick={onRestore}
+      onContextMenu={onContextMenu}
+      title={entry.label}
+      sx={{
+        position: 'relative',
+        width: MINIMIZED_TILE_W,
+        flexShrink: 0,
+        p: '4px',
+        display: 'flex',
+        flexDirection: 'column',
+        gap: '4px',
+        borderRadius: '12px',
+        cursor: 'pointer',
+        border: `1px solid ${REST_EDGE}`,
+        // Selection reads as a soft tint plus ONE accent inner edge; the outer glow is decoration only.
+        background: selected ? `linear-gradient(0deg, ${accent}1f, ${accent}1f), ${TILE_BODY}` : TILE_BODY,
+        boxShadow: selected ? `inset 0 0 0 1px ${accent}, 0 0 24px ${accent}26` : 'none',
+        transition: 'border-color 140ms ease, background 140ms ease',
+        '&:hover': { borderColor: HOVER_EDGE },
+        '&:hover .osw-pill-lights': { opacity: 1, pointerEvents: 'auto' },
+        '&:hover .osw-min-well': { filter: 'brightness(1.08)' },
+      }}
+    >
+      <Box
+        className="osw-min-well"
+        sx={{
+          position: 'relative',
+          width: '100%',
+          aspectRatio: '16 / 10',
+          borderRadius: '8px',
+          overflow: 'hidden',
+          background: preview ? TILE_WELL : `linear-gradient(135deg, #302f2c, ${TILE_WELL})`,
+          display: 'flex',
+          alignItems: 'center',
+          justifyContent: 'center',
+          transition: 'filter 140ms ease',
+        }}
+      >
+        {preview ? (
+          <Box component="img" src={preview} alt="" sx={{ width: '100%', height: '100%', objectFit: 'cover', objectPosition: 'top center', display: 'block' }} />
+        ) : (
+          mark(26)
+        )}
+        <Box
+          className="osw-pill-lights"
+          onClick={(e: React.MouseEvent) => e.stopPropagation()}
+          sx={{
+            ...ARC_CHIP_SX,
+            position: 'absolute', top: 4, left: 4, zIndex: 2, background: 'rgba(24,14,32,0.85)',
+            backdropFilter: 'blur(12px)', WebkitBackdropFilter: 'blur(12px)',
+            opacity: 0, pointerEvents: 'none', transition: 'opacity 140ms ease',
+          }}
+        >
+          <WindowControls onClose={onClose} onMinimize={onRestore} onTile={onTile} tiled={false} />
+        </Box>
+      </Box>
+
+      <Box sx={{ display: 'flex', alignItems: 'center', gap: '6px', px: '2px', height: 22 }}>
+        <Box
+          sx={{
+            width: 5, height: 5, borderRadius: '50%', flexShrink: 0,
+            background: selected ? accent : 'rgba(255,255,255,0.26)',
+            transition: 'background 140ms ease',
+          }}
+        />
+        <Box sx={{ display: 'flex', alignItems: 'center', flexShrink: 0 }}>{mark(13)}</Box>
+        <Typography
+          sx={{
+            fontSize: '0.6875rem',
+            fontWeight: selected ? 600 : 500,
+            color: selected ? '#FAF9F5' : 'rgba(255,255,255,0.62)',
+            overflow: 'hidden',
+            textOverflow: 'ellipsis',
+            whiteSpace: 'nowrap',
+            transition: 'color 140ms ease',
+          }}
+        >
+          {entry.label}
+        </Typography>
+      </Box>
+    </Box>
+  );
+}
+
+export default MinimizedTile;
diff --git a/frontend/src/app/pages/Dashboard/desktop/SpacesStrip.tsx b/frontend/src/app/pages/Dashboard/desktop/SpacesStrip.tsx
index 8c4c9c69..73c814d6 100644
--- a/frontend/src/app/pages/Dashboard/desktop/SpacesStrip.tsx
+++ b/frontend/src/app/pages/Dashboard/desktop/SpacesStrip.tsx
@@ -1,10 +1,11 @@
 import React from 'react';
 import Box from '@mui/material/Box';
 import Typography from '@mui/material/Typography';
-import { Plus } from 'lucide-react';
+import { ChevronLeft, ChevronRight, Plus } from 'lucide-react';
 import { useNavigate, useLocation } from 'react-router-dom';
 import { useAppDispatch, useAppSelector } from '@/shared/hooks';
 import { createDashboard, deleteDashboard, duplicateDashboard, renameDashboard } from '@/shared/state/dashboardsSlice';
+import { ACTIVE_TILE_ATTR, useStripScroll } from './useStripScroll';
 
 // macOS Spaces, one for one: rest the cursor on the top edge and the spaces bar slides down,
 // full-size thumbnail tiles with the name beneath, + at the right end to add a space. It stays
@@ -15,6 +16,7 @@ const HOT_ZONE_PX = 3;
 const TILE_W = 176;
 const TILE_H = 104;
 const DISMISS_BELOW_PX = 72;
+const EDGE_W = 76;
 
 interface TileMenu {
   id: string;
@@ -23,6 +25,41 @@ interface TileMenu {
   y: number;
 }
 
+interface StripEdgeProps {
+  side: 'left' | 'right';
+  visible: boolean;
+  onNudge: () => void;
+}
+
+// The fade says "there is more this way"; the chevron makes it clickable for anyone without a trackpad.
+const StripEdge: React.FC<StripEdgeProps> = ({ side, visible, onNudge }) => (
+  <Box
+    sx={{
+      position: 'absolute', top: 0, bottom: 0, [side]: 0, width: EDGE_W,
+      display: 'flex', alignItems: 'center', justifyContent: side === 'left' ? 'flex-start' : 'flex-end',
+      px: 0.75, pointerEvents: 'none', zIndex: 1,
+      opacity: visible ? 1 : 0, transition: 'opacity 180ms ease',
+      background: `linear-gradient(to ${side === 'left' ? 'right' : 'left'}, rgba(20,18,24,0.9), rgba(20,18,24,0))`,
+    }}
+  >
+    <Box
+      component="button"
+      aria-label={side === 'left' ? 'Scroll spaces left' : 'Scroll spaces right'}
+      onClick={onNudge}
+      sx={{
+        display: 'flex', alignItems: 'center', justifyContent: 'center',
+        width: 28, height: 28, borderRadius: '50%', cursor: 'pointer',
+        pointerEvents: visible ? 'auto' : 'none',
+        border: '1px solid rgba(255,255,255,0.18)', background: 'rgba(255,255,255,0.12)',
+        color: 'rgba(255,255,255,0.92)', transition: 'background 140ms',
+        '&:hover': { background: 'rgba(255,255,255,0.26)' },
+      }}
+    >
+      {side === 'left' ? <ChevronLeft size={17} /> : <ChevronRight size={17} />}
+    </Box>
+  </Box>
+);
+
 const SpacesStrip: React.FC = () => {
   const dispatch = useAppDispatch();
   const navigate = useNavigate();
@@ -44,18 +81,20 @@ const SpacesStrip: React.FC = () => {
     [dashboards],
   );
 
+  const strip = useStripScroll(activeId, list.length, open);
+
   // Mission Control dismissal: while open, watch the cursor globally and close only once it has
   // moved a comfortable distance BELOW the bar; hovering within or near the bar never flickers.
-  // The watcher pauses while a context menu or rename is live, so those can extend below the bar.
+  // The watcher pauses while a context menu, rename or drag-pan is live, so those can wander below the bar.
   React.useEffect(() => {
-    if (!open || menu || renamingId) return undefined;
+    if (!open || menu || renamingId || strip.dragging) return undefined;
     const onMove = (e: MouseEvent): void => {
       const barBottom = barRef.current?.getBoundingClientRect().bottom ?? 0;
       if (e.clientY > barBottom + DISMISS_BELOW_PX) setOpen(false);
     };
     window.addEventListener('mousemove', onMove);
     return () => window.removeEventListener('mousemove', onMove);
-  }, [open, menu, renamingId]);
+  }, [open, menu, renamingId, strip.dragging]);
 
   // The context menu closes on any outside press or Esc, like a native menu.
   React.useEffect(() => {
@@ -114,8 +153,7 @@ const SpacesStrip: React.FC = () => {
         ref={barRef}
         sx={{
           position: 'fixed', top: 0, left: 0, right: 0, zIndex: 99999,
-          display: 'flex', alignItems: 'flex-start', justifyContent: 'center', gap: 2.25,
-          px: 3, pt: 2, pb: 1.75,
+          pt: 2, pb: 1.75,
           background: 'rgba(22,20,26,0.45)',
           backdropFilter: 'blur(30px) saturate(150%)',
           WebkitBackdropFilter: 'blur(30px) saturate(150%)',
@@ -125,80 +163,97 @@ const SpacesStrip: React.FC = () => {
           pointerEvents: open ? 'auto' : 'none',
         }}
       >
-        {list.map((d) => {
-          const active = d.id === activeId;
-          const renaming = renamingId === d.id;
-          return (
-            <Box
-              key={d.id}
-              component="button"
-              onClick={() => { if (!renaming) { navigate(`/dashboard/${d.id}`); setOpen(false); } }}
-              onContextMenu={(e: React.MouseEvent) => { e.preventDefault(); setMenu({ id: d.id, name: d.name || 'Untitled', x: e.clientX, y: e.clientY }); }}
-              sx={{
-                display: 'flex', flexDirection: 'column', alignItems: 'center', gap: 0.75,
-                p: 0, border: 'none', background: 'transparent', cursor: 'pointer', fontFamily: 'inherit',
-                '&:hover .osw-space-tile': { boxShadow: '0 0 0 3px rgba(255,255,255,0.65), 0 10px 26px rgba(0,0,0,0.4)' },
-              }}
-            >
-              <Box
-                className="osw-space-tile"
-                sx={{
-                  width: TILE_W, height: TILE_H, borderRadius: '10px', overflow: 'hidden',
-                  background: 'rgba(255,255,255,0.08)',
-                  boxShadow: active
-                    ? '0 0 0 3px rgba(255,255,255,0.9), 0 10px 26px rgba(0,0,0,0.4)'
-                    : '0 0 0 1px rgba(255,255,255,0.14), 0 8px 20px rgba(0,0,0,0.35)',
-                  transition: 'box-shadow 140ms',
-                }}
-              >
-                {d.thumbnail ? (
-                  <Box component="img" src={d.thumbnail} alt="" sx={{ width: '100%', height: '100%', objectFit: 'cover', display: 'block' }} />
-                ) : (
-                  <Box sx={{ width: '100%', height: '100%', background: 'linear-gradient(135deg, rgba(255,255,255,0.16), rgba(255,255,255,0.05))' }} />
-                )}
-              </Box>
-              {renaming ? (
-                <Box
-                  component="input"
-                  autoFocus
-                  value={renameValue}
-                  onChange={(e: React.ChangeEvent<HTMLInputElement>) => setRenameValue(e.target.value)}
-                  onClick={(e: React.MouseEvent) => e.stopPropagation()}
-                  onKeyDown={(e: React.KeyboardEvent) => {
-                    e.stopPropagation();
-                    if (e.key === 'Enter') commitRename(d.id);
-                    if (e.key === 'Escape') setRenamingId(null);
-                  }}
-                  onBlur={() => commitRename(d.id)}
-                  sx={{
-                    width: TILE_W - 24, textAlign: 'center', border: '1px solid rgba(255,255,255,0.35)',
-                    borderRadius: '6px', background: 'rgba(0,0,0,0.35)', outline: 'none',
-                    color: 'rgba(255,255,255,0.95)', fontFamily: 'inherit', fontSize: '0.8125rem', py: 0.2,
-                  }}
-                />
-              ) : (
-                <Typography sx={{ color: 'rgba(255,255,255,0.92)', fontSize: '0.8125rem', fontWeight: active ? 600 : 500, maxWidth: TILE_W, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>
-                  {d.name || 'Untitled'}
-                </Typography>
-              )}
-            </Box>
-          );
-        })}
         <Box
-          component="button"
-          aria-label="New dashboard"
-          onClick={addSpace}
+          ref={strip.scrollRef}
+          data-spaces-rail
           sx={{
-            display: 'flex', alignItems: 'center', justifyContent: 'center',
-            width: 64, height: TILE_H, borderRadius: '10px', cursor: 'pointer',
-            border: '1.5px dashed rgba(255,255,255,0.35)', background: 'rgba(255,255,255,0.05)',
-            color: 'rgba(255,255,255,0.85)', flexShrink: 0,
-            transition: 'background 140ms, border-color 140ms',
-            '&:hover': { background: 'rgba(255,255,255,0.14)', borderColor: 'rgba(255,255,255,0.6)' },
+            position: 'relative',
+            display: 'flex', alignItems: 'flex-start', gap: 2.25, px: 3,
+            // "safe center" centers a short row but falls back to start-aligned once it overflows, so tile one is never clipped out of reach.
+            justifyContent: 'safe center',
+            overflowX: 'auto', overflowY: 'hidden', userSelect: 'none',
+            cursor: strip.dragging ? 'grabbing' : 'default',
+            scrollbarWidth: 'none', '&::-webkit-scrollbar': { display: 'none' },
           }}
         >
-          <Plus size={22} />
+          {list.map((d) => {
+            const active = d.id === activeId;
+            const renaming = renamingId === d.id;
+            return (
+              <Box
+                key={d.id}
+                component="button"
+                {...{ [ACTIVE_TILE_ATTR]: active ? 'true' : 'false' }}
+                onClick={() => { if (!renaming) { navigate(`/dashboard/${d.id}`); setOpen(false); } }}
+                onContextMenu={(e: React.MouseEvent) => { e.preventDefault(); setMenu({ id: d.id, name: d.name || 'Untitled', x: e.clientX, y: e.clientY }); }}
+                sx={{
+                  display: 'flex', flexDirection: 'column', alignItems: 'center', gap: 0.75, flexShrink: 0,
+                  p: 0, border: 'none', background: 'transparent', cursor: 'pointer', fontFamily: 'inherit',
+                  '&:hover .osw-space-tile': { boxShadow: '0 0 0 3px rgba(255,255,255,0.65), 0 10px 26px rgba(0,0,0,0.4)' },
+                }}
+              >
+                <Box
+                  className="osw-space-tile"
+                  sx={{
+                    width: TILE_W, height: TILE_H, borderRadius: '10px', overflow: 'hidden',
+                    background: 'rgba(255,255,255,0.08)',
+                    boxShadow: active
+                      ? '0 0 0 3px rgba(255,255,255,0.9), 0 10px 26px rgba(0,0,0,0.4)'
+                      : '0 0 0 1px rgba(255,255,255,0.14), 0 8px 20px rgba(0,0,0,0.35)',
+                    transition: 'box-shadow 140ms',
+                  }}
+                >
+                  {d.thumbnail ? (
+                    <Box component="img" src={d.thumbnail} alt="" draggable={false} sx={{ width: '100%', height: '100%', objectFit: 'cover', display: 'block' }} />
+                  ) : (
+                    <Box sx={{ width: '100%', height: '100%', background: 'linear-gradient(135deg, rgba(255,255,255,0.16), rgba(255,255,255,0.05))' }} />
+                  )}
+                </Box>
+                {renaming ? (
+                  <Box
+                    component="input"
+                    autoFocus
+                    value={renameValue}
+                    onChange={(e: React.ChangeEvent<HTMLInputElement>) => setRenameValue(e.target.value)}
+                    onClick={(e: React.MouseEvent) => e.stopPropagation()}
+                    onKeyDown={(e: React.KeyboardEvent) => {
+                      e.stopPropagation();
+                      if (e.key === 'Enter') commitRename(d.id);
+                      if (e.key === 'Escape') setRenamingId(null);
+                    }}
+                    onBlur={() => commitRename(d.id)}
+                    sx={{
+                      width: TILE_W - 24, textAlign: 'center', border: '1px solid rgba(255,255,255,0.35)',
+                      borderRadius: '6px', background: 'rgba(0,0,0,0.35)', outline: 'none', userSelect: 'text',
+                      color: 'rgba(255,255,255,0.95)', fontFamily: 'inherit', fontSize: '0.8125rem', py: 0.2,
+                    }}
+                  />
+                ) : (
+                  <Typography sx={{ color: 'rgba(255,255,255,0.92)', fontSize: '0.8125rem', fontWeight: active ? 600 : 500, maxWidth: TILE_W, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>
+                    {d.name || 'Untitled'}
+                  </Typography>
+                )}
+              </Box>
+            );
+          })}
+          <Box
+            component="button"
+            aria-label="New dashboard"
+            onClick={addSpace}
+            sx={{
+              display: 'flex', alignItems: 'center', justifyContent: 'center',
+              width: 64, height: TILE_H, borderRadius: '10px', cursor: 'pointer',
+              border: '1.5px dashed rgba(255,255,255,0.35)', background: 'rgba(255,255,255,0.05)',
+              color: 'rgba(255,255,255,0.85)', flexShrink: 0,
+              transition: 'background 140ms, border-color 140ms',
+              '&:hover': { background: 'rgba(255,255,255,0.14)', borderColor: 'rgba(255,255,255,0.6)' },
+            }}
+          >
+            <Plus size={22} />
+          </Box>
         </Box>
+        <StripEdge side="left" visible={strip.overflowing && !strip.atStart} onNudge={() => strip.scrollByPage(-1)} />
+        <StripEdge side="right" visible={strip.overflowing && !strip.atEnd} onNudge={() => strip.scrollByPage(1)} />
       </Box>
       {menu && (
         <Box
diff --git a/frontend/src/app/pages/Dashboard/desktop/chord.ts b/frontend/src/app/pages/Dashboard/desktop/chord.ts
new file mode 100644
index 00000000..4a6892a2
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/chord.ts
@@ -0,0 +1,16 @@
+// Renders a shortcut the way the platform writes it: mac glyphs run together, Windows spells them with +.
+const IS_MAC = typeof navigator !== 'undefined' && /Mac|iPhone|iPad/i.test(navigator.platform);
+
+const GLYPH: Record<string, string> = {
+  mod: IS_MAC ? '⌘' : 'Ctrl',
+  ctrl: IS_MAC ? '⌃' : 'Ctrl',
+  shift: IS_MAC ? '⇧' : 'Shift',
+  alt: IS_MAC ? '⌥' : 'Alt',
+  enter: IS_MAC ? '↩' : 'Enter',
+  del: IS_MAC ? '⌫' : 'Del',
+  tab: IS_MAC ? '⇥' : 'Tab',
+};
+
+export function chord(...keys: string[]): string {
+  return keys.map((k) => GLYPH[k] ?? k).join(IS_MAC ? '' : '+');
+}
diff --git a/frontend/src/app/pages/Dashboard/desktop/dockEntries.tsx b/frontend/src/app/pages/Dashboard/desktop/dockEntries.tsx
index 7e6887ef..c8b05d07 100644
--- a/frontend/src/app/pages/Dashboard/desktop/dockEntries.tsx
+++ b/frontend/src/app/pages/Dashboard/desktop/dockEntries.tsx
@@ -21,8 +21,11 @@ export interface CardRect {
   height: number;
 }
 
+export type DockEntryKind = 'agent' | 'browser' | 'view' | 'workflow';
+
 export interface DockEntry {
   id: string;
+  kind: DockEntryKind;
   label: string;
   rect: CardRect;
   tileBg: string;
@@ -66,6 +69,7 @@ export function buildDockEntries({ sessions, cards, viewCards, browserCards, wor
     const ChatIcon = pickIcon(title) || MessageCircle;
     list.push({
       id: card.session_id,
+      kind: 'agent',
       label: title,
       rect: card,
       tileBg: hueFor(title),
@@ -77,6 +81,7 @@ export function buildDockEntries({ sessions, cards, viewCards, browserCards, wor
     const activeTab = bc.tabs.find((t) => t.id === bc.activeTabId) || bc.tabs[0];
     list.push({
       id: bc.browser_id,
+      kind: 'browser',
       label: activeTab?.title || 'Browser',
       rect: bc,
       tileBg: 'linear-gradient(135deg, #4f9fe8, #2f6ed4)',
@@ -90,6 +95,7 @@ export function buildDockEntries({ sessions, cards, viewCards, browserCards, wor
     const appName = output?.name || 'App';
     list.push({
       id: cardKey,
+      kind: 'view',
       label: appName,
       rect: vc,
       tileBg: 'linear-gradient(135deg, #ef9552, #d96a2b)',
@@ -101,6 +107,7 @@ export function buildDockEntries({ sessions, cards, viewCards, browserCards, wor
   for (const [cardKey, wf] of Object.entries(workflowCards)) {
     list.push({
       id: cardKey,
+      kind: 'workflow',
       label: 'Workflow',
       rect: wf,
       tileBg: 'linear-gradient(135deg, #ef7a70, #d94f45)',
diff --git a/frontend/src/app/pages/Dashboard/desktop/dockTileMenuRows.ts b/frontend/src/app/pages/Dashboard/desktop/dockTileMenuRows.ts
new file mode 100644
index 00000000..b81bf079
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/dockTileMenuRows.ts
@@ -0,0 +1,27 @@
+import { bringToFront, recordClosedCard, removeCard, removeWorkflowCard } from '@/shared/state/dashboardLayoutSlice';
+import { closeSession } from '@/shared/state/agentsSlice';
+import { removeBrowserCardCleanly } from '@/shared/browserTeardown';
+import { removeViewCardCleanly } from '@/shared/viewTeardown';
+import type { AppDispatch } from '@/shared/state/store';
+import type { CardMenuRow } from './openCardContextMenu';
+import type { DockEntry } from './dockEntries';
+
+export function dockTileMenuRows(entry: DockEntry, dispatch: AppDispatch, onFocus: () => void): CardMenuRow[] {
+  return [
+    { label: 'Show on canvas', onClick: onFocus },
+    { label: 'Bring to front', onClick: () => dispatch(bringToFront({ id: entry.id, type: entry.kind })) },
+    { kind: 'separator' },
+    {
+      label: 'Close',
+      danger: true,
+      onClick: () => {
+        if (entry.kind === 'browser') { dispatch(recordClosedCard({ kind: 'browser', id: entry.id })); void removeBrowserCardCleanly(entry.id, dispatch); return; }
+        if (entry.kind === 'view') { dispatch(recordClosedCard({ kind: 'view', id: entry.id })); void removeViewCardCleanly(entry.id, dispatch); return; }
+        if (entry.kind === 'workflow') { dispatch(recordClosedCard({ kind: 'workflow', id: entry.id })); dispatch(removeWorkflowCard(entry.id)); return; }
+        dispatch(recordClosedCard({ kind: 'agent', id: entry.id }));
+        dispatch(removeCard(entry.id));
+        void dispatch(closeSession({ sessionId: entry.id }));
+      },
+    },
+  ];
+}
diff --git a/frontend/src/app/pages/Dashboard/desktop/helpKnowledge.ts b/frontend/src/app/pages/Dashboard/desktop/helpKnowledge.ts
new file mode 100644
index 00000000..e43295aa
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/helpKnowledge.ts
@@ -0,0 +1,43 @@
+/**
+ * Product knowledge for the Help panel. The backend assembles it from facts that ship with the
+ * build plus live facts about this install, so it can't drift the way a hardcoded prompt does.
+ *
+ * Two consumers, one fetch: the Ask box searches topics locally (instant, no model, works with no
+ * provider connected) and the help chat gets the assembled system prompt.
+ */
+import { API_BASE } from '@/shared/config';
+import type { HelpKnowledge } from './helpSearch';
+
+// If the backend can't answer, the chat still has to know it is a help chat and still has to refuse
+// to guess. Deliberately thin: the real facts live in the build, and claiming them from memory here
+// is exactly the staleness this feature exists to kill.
+export const FALLBACK_HELP_PROMPT = [
+  "You are OpenSwarm's help assistant, a support chat inside the app.",
+  'Your product knowledge feed is unavailable right now, so you are working without verified facts',
+  'about this build. Do not guess where things are, do not invent buttons, menus, or shortcuts, and',
+  'do not claim anything about known bugs.',
+  'Say plainly what you cannot verify, then point the user at the Help pill (top right) for Docs and',
+  'shortcuts, Talk to the team, or Report a bug. Keep answers to a couple of sentences.',
+].join('\n');
+
+let cached: HelpKnowledge | null = null;
+let inFlight: Promise<HelpKnowledge | null> | null = null;
+
+export async function loadHelpKnowledge(): Promise<HelpKnowledge | null> {
+  if (cached) return cached;
+  if (inFlight) return inFlight;
+  inFlight = (async () => {
+    try {
+      const res = await fetch(`${API_BASE}/help/knowledge`);
+      if (!res.ok) return null;
+      cached = (await res.json()) as HelpKnowledge;
+      return cached;
+    } catch {
+      return null;
+    } finally {
+      inFlight = null;
+    }
+  })();
+  return inFlight;
+}
+
diff --git a/frontend/src/app/pages/Dashboard/desktop/helpSearch.test.ts b/frontend/src/app/pages/Dashboard/desktop/helpSearch.test.ts
new file mode 100644
index 00000000..ca5c9a8c
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/helpSearch.test.ts
@@ -0,0 +1,86 @@
+/**
+ * Run: node --test frontend/src/app/pages/Dashboard/desktop/helpSearch.test.ts
+ *
+ * The offline answer path. Every case below is a ranking bug caught live in the real panel: a
+ * help answer that is confidently the WRONG surface is worse than no answer, so they stay pinned.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { searchHelp, type HelpKnowledge } from './helpSearch.ts';
+
+const KNOWLEDGE: HelpKnowledge = {
+  system_prompt: 'x',
+  app_version: '1.6.0',
+  known_issues: [],
+  shortcuts: [
+    { keys: '⌘L', action: 'Open the new-chat composer' },
+    { keys: '⌘⇧D', action: 'Start or stop voice dictation' },
+    { keys: '⌘K', action: 'Search everything, across all dashboards' },
+    { keys: '⌘F', action: 'Find cards on this canvas; inside a browser card it finds text on the page' },
+    { keys: '⌘⇧T', action: 'Reopen the card you just closed' },
+  ],
+  topics: [
+    {
+      id: 'applications',
+      title: 'Applications, your app library',
+      where: 'The grid icon at the very bottom of the left dock.',
+      body: 'Lists every app you have built or imported.',
+      keywords: ['applications', 'apps', 'library', 'grid'],
+    },
+    {
+      id: 'apps',
+      title: 'Building apps',
+      where: 'Ask any agent chat.',
+      body: 'Ask an agent for a tool and it calls CreateApp.',
+      keywords: ['app', 'build', 'create'],
+    },
+    {
+      id: 'workflows',
+      title: 'Workflows and scheduled tasks',
+      where: 'The repeating-calendar icon in the left dock.',
+      body: 'Runs agent steps on a schedule, for example every weekday at 9am.',
+      keywords: ['workflow', 'schedule', 'task', 'recurring'],
+    },
+    {
+      id: 'settings',
+      title: 'Settings',
+      where: 'The gear icon in the left dock.',
+      body: 'Theme, accent color, and text size live under Appearance.',
+      keywords: ['settings', 'theme', 'appearance'],
+    },
+  ],
+};
+
+const top = (q: string): string => searchHelp(KNOWLEDGE, q)[0]?.title ?? '(none)';
+
+test('"where are my apps" leads with the app library, not the app builder', () => {
+  assert.equal(top('where are my apps'), 'Applications, your app library');
+});
+
+test('a shortcut question leads with the right key', () => {
+  assert.equal(top('reopen a closed card'), '⌘⇧T');
+});
+
+test('stopwords never pull in a shortcut: "the" must not match "Open the new-chat composer"', () => {
+  assert.equal(top('change the theme'), 'Settings');
+  assert.ok(!searchHelp(KNOWLEDGE, 'change the theme').some((m) => m.title === '⌘L'));
+});
+
+test('partial words never match: "every" must not hit "Search everything"', () => {
+  assert.equal(top('schedule a task every weekday'), 'Workflows and scheduled tasks');
+  assert.ok(!searchHelp(KNOWLEDGE, 'schedule a task every weekday').some((m) => m.title === '⌘K'));
+});
+
+test('plurals still match their singular keyword', () => {
+  assert.equal(top('cards'), '⌘F');
+});
+
+test('no knowledge, an empty query, or pure stopwords return nothing rather than noise', () => {
+  assert.deepEqual(searchHelp(null, 'apps'), []);
+  assert.deepEqual(searchHelp(KNOWLEDGE, ''), []);
+  assert.deepEqual(searchHelp(KNOWLEDGE, 'how do i'), []);
+});
+
+test('a question we have no answer for returns nothing, never a bad guess', () => {
+  assert.deepEqual(searchHelp(KNOWLEDGE, 'kubernetes ingress'), []);
+});
diff --git a/frontend/src/app/pages/Dashboard/desktop/helpSearch.ts b/frontend/src/app/pages/Dashboard/desktop/helpSearch.ts
new file mode 100644
index 00000000..523770d7
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/helpSearch.ts
@@ -0,0 +1,94 @@
+/**
+ * Ranking for the Help panel's offline answers: pure functions over the knowledge payload, no
+ * imports, so the app, the tests, and any future surface all score a query identically.
+ */
+
+export interface HelpTopic {
+  id: string;
+  title: string;
+  where: string;
+  body: string;
+  keywords: string[];
+}
+
+export interface HelpKnownIssue {
+  id: string;
+  title: string;
+  status: 'known' | 'mitigated' | 'fixed';
+  detail: string;
+  workaround?: string | null;
+}
+
+export interface HelpShortcut {
+  keys: string;
+  action: string;
+}
+
+export interface HelpKnowledge {
+  system_prompt: string;
+  topics: HelpTopic[];
+  known_issues: HelpKnownIssue[];
+  shortcuts: HelpShortcut[];
+  app_version: string;
+}
+
+export interface HelpMatch {
+  id: string;
+  title: string;
+  detail: string;
+}
+
+// Words that match everything and so mean nothing; without them "change the theme" hits every entry.
+const STOPWORDS = new Set([
+  'the', 'a', 'an', 'and', 'or', 'of', 'in', 'on', 'for', 'to', 'is', 'are', 'was', 'be', 'it',
+  'my', 'me', 'i', 'you', 'your', 'do', 'does', 'did', 'how', 'what', 'where', 'when', 'why',
+  'can', 'get', 'got', 'with', 'from', 'that', 'this', 'any', 'all', 'use', 'using',
+]);
+
+function stem(word: string): string {
+  return word.length > 3 && word.endsWith('s') ? word.slice(0, -1) : word;
+}
+
+// Whole-word matching on stems, so "card" still finds "cards" but "every" stops matching "everything".
+function wordSet(text: string): Set<string> {
+  const out = new Set<string>();
+  for (const w of text.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (w) out.add(stem(w));
+  }
+  return out;
+}
+
+function hits(words: Set<string>, terms: string[]): number {
+  let n = 0;
+  for (const t of terms) if (words.has(t)) n += 1;
+  return n;
+}
+
+/** Instant local answers: no model, no network, still works when no provider is connected. */
+export function searchHelp(knowledge: HelpKnowledge | null, query: string, limit = 3): HelpMatch[] {
+  if (!knowledge || query.trim().length < 2) return [];
+  const terms = [...wordSet(query)].filter((t) => t.length > 1 && !STOPWORDS.has(t));
+  if (terms.length === 0) return [];
+
+  const scored: Array<{ score: number; match: HelpMatch }> = [];
+  for (const topic of knowledge.topics) {
+    const score =
+      hits(wordSet(topic.title), terms) * 6 +
+      hits(wordSet(topic.keywords.join(' ')), terms) * 4 +
+      hits(wordSet(`${topic.body} ${topic.where}`), terms);
+    if (score > 0) {
+      scored.push({
+        score,
+        match: { id: topic.id, title: topic.title, detail: topic.where ? `${topic.where} ${topic.body}` : topic.body },
+      });
+    }
+  }
+  // Shortcuts rank in the same list rather than jumping the queue, so a key only leads when the
+  // question is actually about that key.
+  for (const s of knowledge.shortcuts) {
+    const score = hits(wordSet(s.action), terms) * 5;
+    if (score > 0) scored.push({ score, match: { id: `shortcut-${s.keys}`, title: s.keys, detail: s.action } });
+  }
+
+  return scored.sort((a, b) => b.score - a.score).slice(0, limit).map((s) => s.match);
+}
diff --git a/frontend/src/app/pages/Dashboard/desktop/minimizedEntries.ts b/frontend/src/app/pages/Dashboard/desktop/minimizedEntries.ts
new file mode 100644
index 00000000..30711ab4
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/minimizedEntries.ts
@@ -0,0 +1,74 @@
+import { SETTINGS_CARD_ID, WORKFLOWS_HUB_ID } from '@/shared/state/dashboardLayoutSlice';
+import type { BrowserCardPosition, ViewCardPosition, WorkflowsHubPosition } from '@/shared/state/dashboardLayoutSlice';
+import type { Output } from '@/shared/state/outputsSlice';
+
+export interface MinimizedRect {
+  x: number;
+  y: number;
+  width: number;
+  height: number;
+}
+
+export type MinimizedKind = 'browser' | 'view' | 'workflows' | 'settings';
+
+export interface MinimizedEntry {
+  id: string;
+  kind: MinimizedKind;
+  label: string;
+  /** Geometry the card is restored to, so the camera can fly back to exactly where it was. */
+  rect: MinimizedRect;
+  faviconUrl?: string;
+  /** Stored still for the window; the fresh minimize-time shot wins over this when there is one. */
+  thumbnail?: string | null;
+}
+
+export interface MinimizedSlices {
+  browserCards: Record<string, BrowserCardPosition>;
+  viewCards: Record<string, ViewCardPosition>;
+  outputs: Record<string, Output>;
+  workflowsHub: WorkflowsHubPosition | null;
+  settingsCard: WorkflowsHubPosition | null;
+  minimizedCards: Record<string, boolean>;
+}
+
+/** Every window parked in the minimized rail, browsers, apps and the singleton windows in one list so they all share a small state. */
+export function buildMinimizedEntries({
+  browserCards,
+  viewCards,
+  outputs,
+  workflowsHub,
+  settingsCard,
+  minimizedCards,
+}: MinimizedSlices): MinimizedEntry[] {
+  const list: MinimizedEntry[] = [];
+  for (const bc of Object.values(browserCards)) {
+    if (!minimizedCards[bc.browser_id]) continue;
+    const activeTab = bc.tabs.find((t) => t.id === bc.activeTabId) || bc.tabs[0];
+    list.push({
+      id: bc.browser_id,
+      kind: 'browser',
+      label: activeTab?.title || 'Browser',
+      rect: bc,
+      faviconUrl: activeTab?.favicon,
+    });
+  }
+  for (const [cardKey, vc] of Object.entries(viewCards)) {
+    if (!minimizedCards[cardKey]) continue;
+    const name = outputs[vc.output_id]?.name || 'App';
+    const instance = vc.instance ?? 1;
+    list.push({
+      id: cardKey,
+      kind: 'view',
+      label: instance > 1 ? `${name} #${instance}` : name,
+      rect: vc,
+      thumbnail: outputs[vc.output_id]?.thumbnail,
+    });
+  }
+  if (workflowsHub && minimizedCards[WORKFLOWS_HUB_ID]) {
+    list.push({ id: WORKFLOWS_HUB_ID, kind: 'workflows', label: 'Workflows', rect: workflowsHub });
+  }
+  if (settingsCard && minimizedCards[SETTINGS_CARD_ID]) {
+    list.push({ id: SETTINGS_CARD_ID, kind: 'settings', label: 'Settings', rect: settingsCard });
+  }
+  return list;
+}
diff --git a/frontend/src/app/pages/Dashboard/desktop/minimizedShots.ts b/frontend/src/app/pages/Dashboard/desktop/minimizedShots.ts
index 8a086620..cbc81956 100644
--- a/frontend/src/app/pages/Dashboard/desktop/minimizedShots.ts
+++ b/frontend/src/app/pages/Dashboard/desktop/minimizedShots.ts
@@ -1,6 +1,13 @@
-/** Last visual of a card captured at minimize time; in-memory only, keyed by card id. */
+/** Last visual of a card, frozen while it could still paint; in-memory only, keyed by card id. */
 const shots = new Map<string, string>();
 const CAP = 40;
+const listeners = new Set<() => void>();
+
+/** Readers that render a frozen shot subscribe here; a saved frame is otherwise invisible to them. */
+export function subscribeMinimizedShots(fn: () => void): () => void {
+  listeners.add(fn);
+  return () => { listeners.delete(fn); };
+}
 
 export function saveMinimizedShot(cardId: string, dataUrl: string): void {
   if (shots.size >= CAP && !shots.has(cardId)) {
@@ -8,6 +15,7 @@ export function saveMinimizedShot(cardId: string, dataUrl: string): void {
     if (oldest) shots.delete(oldest);
   }
   shots.set(cardId, dataUrl);
+  listeners.forEach((fn) => fn());
 }
 
 export function getMinimizedShot(cardId: string): string | undefined {
@@ -15,5 +23,6 @@ export function getMinimizedShot(cardId: string): string | undefined {
 }
 
 export function dropMinimizedShot(cardId: string): void {
-  shots.delete(cardId);
+  if (!shots.delete(cardId)) return;
+  listeners.forEach((fn) => fn());
 }
diff --git a/frontend/src/app/pages/Dashboard/desktop/openCardContextMenu.ts b/frontend/src/app/pages/Dashboard/desktop/openCardContextMenu.ts
new file mode 100644
index 00000000..3c5713dc
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/openCardContextMenu.ts
@@ -0,0 +1,64 @@
+import type React from 'react';
+
+// The one right-click grammar for the whole shell (cards, tab strip, dock, minimized rail, empty
+// canvas). Surfaces describe rows; CardContextMenu owns rendering, placement, and keyboard nav.
+
+export interface CardMenuAction {
+  kind?: 'action';
+  label: string;
+  /** Right-aligned chip. Build it with chord() so it matches the platform; never invent unbound keys. */
+  shortcut?: string;
+  icon?: React.ReactNode;
+  danger?: boolean;
+  disabled?: boolean;
+  /** Renders a leading check; use for toggles that are currently on. */
+  checked?: boolean;
+  /** One level only. Deep nesting is a menu smell. */
+  submenu?: CardMenuRow[];
+  onClick?: () => void;
+}
+
+export interface CardMenuSeparator {
+  kind: 'separator';
+}
+
+export interface CardMenuHeader {
+  kind: 'header';
+  /** Sentence case, never uppercase. */
+  label: string;
+}
+
+export type CardMenuRow = CardMenuAction | CardMenuSeparator | CardMenuHeader;
+
+export interface CardMenuRequest {
+  x: number;
+  y: number;
+  items: CardMenuRow[];
+  /** Optional inline-rename affordance: shown as the first row with an editable input. */
+  rename?: { value: string; onCommit: (next: string) => void };
+}
+
+export const CARD_MENU_EVENT = 'openswarm:card-context-menu';
+
+export function isMenuAction(row: CardMenuRow): row is CardMenuAction {
+  return row.kind === undefined || row.kind === 'action';
+}
+
+/** Text fields keep the OS menu: right-clicking a URL bar or composer is how you paste. */
+export function isNativeMenuTarget(e: { target: EventTarget | null }): boolean {
+  const t = e.target as HTMLElement | null;
+  return !!t?.closest?.('input, textarea, [contenteditable="true"]');
+}
+
+interface MenuTriggerEvent {
+  clientX: number;
+  clientY: number;
+  preventDefault: () => void;
+  stopPropagation: () => void;
+}
+
+export function openCardContextMenu(e: MenuTriggerEvent, req: Omit<CardMenuRequest, 'x' | 'y'>): void {
+  e.preventDefault();
+  e.stopPropagation();
+  window.dispatchEvent(new CustomEvent(CARD_MENU_EVENT, { detail: { ...req, x: e.clientX, y: e.clientY } }));
+}
diff --git a/frontend/src/app/pages/Dashboard/desktop/useBrowserPillShot.ts b/frontend/src/app/pages/Dashboard/desktop/useBrowserPillShot.ts
new file mode 100644
index 00000000..1f9442ee
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/useBrowserPillShot.ts
@@ -0,0 +1,27 @@
+import { useSyncExternalStore } from 'react';
+import { useAppSelector } from '@/shared/hooks';
+import { getMinimizedShot, subscribeMinimizedShots } from './minimizedShots';
+
+/**
+ * The browser preview under a collapsed agent pill: the session's browser (spawned by it or docked
+ * into it) as the frame BrowserCard froze while that card could still paint. Never captures here:
+ * a docked card parks off-screen the moment its chat collapses, and capturePage on an unpainted
+ * guest never settles (Electron 42), which is what used to leave the pill permanently blank.
+ */
+export function useBrowserPillShot(sessionId: string, active: boolean): string | null {
+  const browserId = useAppSelector((s) => {
+    for (const bc of Object.values(s.dashboardLayout.browserCards)) {
+      if (bc.spawned_by === sessionId || bc.docked_to === sessionId) return bc.browser_id;
+    }
+    return null;
+  });
+  const suspendedShot = useAppSelector(
+    (s) => (browserId ? s.dashboardLayout.suspendedBrowserCards[browserId]?.dataUrl || null : null),
+  );
+  const frozenShot = useSyncExternalStore(
+    subscribeMinimizedShots,
+    () => (browserId ? getMinimizedShot(browserId) ?? null : null),
+  );
+  if (!active || !browserId) return null;
+  return frozenShot ?? suspendedShot;
+}
diff --git a/frontend/src/app/pages/Dashboard/desktop/useDockLayout.ts b/frontend/src/app/pages/Dashboard/desktop/useDockLayout.ts
new file mode 100644
index 00000000..e0121498
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/useDockLayout.ts
@@ -0,0 +1,173 @@
+import React, { useCallback, useEffect, useRef, useState } from 'react';
+
+const TILE_MAX = 30;
+// Apple's floor is deliberately tiny: magnification, not tile size, is what keeps a small tile hittable.
+const TILE_MIN = 14;
+const ROOT_PAD = 7;
+const GAP_RATIO = 0.3;
+const GAP_MIN = 3;
+const ICON_RATIO = 0.58;
+// Breathing room above and below the dock; the canvas root clips overflow, so this is also the magnify headroom.
+const EDGE_MARGIN = 16;
+// macOS magnifies to an ABSOLUTE size, not a fixed ratio, so a 14px tile still grows to something you can hit.
+const MAGNIFY_TARGET = 44;
+// The bell curve was hand-tuned as 44px against a 30px tile; keep that ratio so it narrows as tiles shrink.
+const FALLOFF_RATIO = 44 / 30;
+
+export interface DockLayoutInput {
+  cardCount: number;
+  actionCount: number;
+  dividerCount: number;
+}
+
+export interface DockLayout {
+  dockRef: React.MutableRefObject<HTMLDivElement | null>;
+  scrollRef: React.MutableRefObject<HTMLDivElement | null>;
+  tile: number;
+  gap: number;
+  iconSize: number;
+  scrolls: boolean;
+  scrollHeight: number;
+  bleed: number;
+  applyMagnify: (clientY: number | null) => void;
+}
+
+function gapFor(tile: number): number {
+  return Math.max(GAP_MIN, Math.round(tile * GAP_RATIO));
+}
+
+function columnHeight(tile: number, tiles: number, dividers: number): number {
+  const gaps = Math.max(0, tiles + dividers - 1);
+  return ROOT_PAD * 2 + tiles * tile + dividers + gaps * gapFor(tile);
+}
+
+interface DockGeom {
+  els: HTMLElement[];
+  bases: number[];
+  rootTop: number;
+  written: string[];
+}
+
+function beginGesture(root: HTMLElement, box: HTMLDivElement | null): DockGeom {
+  const els = Array.from(root.querySelectorAll<HTMLElement>('.osw-dock-tile'));
+  const boxShift = box ? box.offsetTop - box.scrollTop : 0;
+  // The curve already tracks the cursor frame by frame; easing every tile on top of that is a tax, not motion.
+  els.forEach((t) => { t.style.transition = 'none'; });
+  return {
+    els,
+    bases: els.map((t) => (box?.contains(t) ? boxShift : 0) + t.offsetTop + t.offsetHeight / 2),
+    rootTop: root.getBoundingClientRect().top,
+    written: els.map(() => ''),
+  };
+}
+
+/** macOS Dock sizing: tiles shrink to fit the column and only scroll once they hit the floor. */
+export function useDockLayout({ cardCount, actionCount, dividerCount }: DockLayoutInput): DockLayout {
+  const dockRef = useRef<HTMLDivElement | null>(null);
+  const scrollRef = useRef<HTMLDivElement | null>(null);
+  const [containerH, setContainerH] = useState<number>(() => window.innerHeight);
+
+  useEffect(() => {
+    const host = dockRef.current?.parentElement;
+    if (!host) return undefined;
+    const measure = (): void => setContainerH(host.clientHeight || window.innerHeight);
+    measure();
+    const observer = new ResizeObserver(measure);
+    observer.observe(host);
+    return () => observer.disconnect();
+  }, []);
+
+  const tileCount = cardCount + actionCount;
+  const budget = Math.max(TILE_MIN * 6, containerH - EDGE_MARGIN * 2);
+  const guess = Math.floor(
+    (budget - ROOT_PAD * 2 - dividerCount) /
+      (tileCount + GAP_RATIO * Math.max(0, tileCount + dividerCount - 1)),
+  );
+  let tile = Math.min(TILE_MAX, Math.max(TILE_MIN, Number.isFinite(guess) ? guess : TILE_MAX));
+  while (tile > TILE_MIN && columnHeight(tile, tileCount, dividerCount) > budget) tile -= 1;
+  const gap = gapFor(tile);
+  const scrolls = columnHeight(tile, tileCount, dividerCount) > budget;
+  // Slack inside the scroll box so a magnified tile grows past the column without the scroll clip cutting it.
+  const bleed = Math.ceil((MAGNIFY_TARGET - tile) / 2) + 2;
+
+  // Pinned rows keep their full height; whatever is left is what the card column may occupy.
+  const pinned = ROOT_PAD * 2 + dividerCount + actionCount * tile + (dividerCount + actionCount) * gap;
+  const step = tile + gap;
+  // Whole tile steps only, so the clip edge always lands in a gap instead of bisecting an icon.
+  const rows = Math.max(1, Math.floor((budget - pinned - bleed * 2 + gap) / step));
+  const scrollHeight = rows * step - gap + bleed * 2;
+
+  const tileRef = useRef(tile);
+  tileRef.current = tile;
+  const geomRef = useRef<DockGeom | null>(null);
+  const dropGeom = useCallback((): void => { geomRef.current = null; }, []);
+
+  // Tiles cannot move mid-hover, so re-measuring them per mousemove was pure style-recalc tax; these are
+  // every signal that CAN move them.
+  useEffect(dropGeom, [dropGeom, tile, gap, scrollHeight, scrolls, containerH, cardCount, actionCount]);
+
+  useEffect(() => {
+    const box = scrollRef.current;
+    if (!box) return undefined;
+    box.addEventListener('scroll', dropGeom, { passive: true });
+    return () => box.removeEventListener('scroll', dropGeom);
+  }, [dropGeom, scrolls, cardCount]);
+
+  // macOS Dock magnification: the tile under the cursor grows on a bell curve and its neighbors SLIDE
+  // AWAY to make room. Each tile that grows by `extra` pushes every tile past it by extra/2.
+  const applyMagnify = useCallback((clientY: number | null) => {
+    const root = dockRef.current;
+    if (!root) return;
+    if (clientY == null) {
+      // Handing the transition back before clearing the transform is what makes the settle glide instead of snap.
+      root.querySelectorAll<HTMLElement>('.osw-dock-tile').forEach((t) => {
+        t.style.transition = '';
+        t.style.transform = '';
+        t.style.zIndex = '';
+      });
+      geomRef.current = null;
+      return;
+    }
+    const geom = geomRef.current ?? beginGesture(root, scrollRef.current);
+    geomRef.current = geom;
+    const { els, bases } = geom;
+    if (els.length === 0) return;
+    const size = tileRef.current;
+    const boost = MAGNIFY_TARGET / size - 1;
+    const falloff = size * FALLOFF_RATIO;
+    const cy = clientY - geom.rootTop;
+    const scales = bases.map((b) => 1 + boost * Math.exp(-(((cy - b) / falloff) ** 2)));
+    const extra = scales.map((s) => size * (s - 1));
+    const total = extra.reduce((a, b) => a + b, 0);
+    // Bases run in DOM order, top to bottom, so "everything before me" is a running sum, not an inner loop.
+    const head = (extra[0] - total) / 2;
+    const tail = (total - extra[els.length - 1]) / 2;
+    const span = bases[els.length - 1] - bases[0];
+    // Apple's Dock never grows longer than its rail: pin both ends and let the spread squeeze the middle.
+    const slope = span > 0 ? (tail - head) / span : 0;
+    let before = 0;
+    els.forEach((t, i) => {
+      const raw = before - (total - before - extra[i]);
+      const shift = raw / 2 - head - slope * (bases[i] - bases[0]);
+      before += extra[i];
+      const next = `translateY(${shift.toFixed(1)}px) scale(${scales[i].toFixed(3)})`;
+      // Tiles outside the bell curve land on the same transform move after move, and a no-op style write is not free.
+      if (geom.written[i] === next) return;
+      geom.written[i] = next;
+      t.style.transform = next;
+      t.style.zIndex = String(10 + Math.round((scales[i] - 1) * 100));
+    });
+  }, []);
+
+  return {
+    dockRef,
+    scrollRef,
+    tile,
+    gap,
+    iconSize: Math.round(tile * ICON_RATIO),
+    scrolls,
+    scrollHeight,
+    bleed,
+    applyMagnify,
+  };
+}
diff --git a/frontend/src/app/pages/Dashboard/desktop/useStripScroll.ts b/frontend/src/app/pages/Dashboard/desktop/useStripScroll.ts
new file mode 100644
index 00000000..213ba0bd
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/desktop/useStripScroll.ts
@@ -0,0 +1,143 @@
+import React from 'react';
+
+// Mission Control's spaces rail: a vertical wheel scrolls it sideways, a press-drag pans it, and the
+// active space is always kept in view. Lives apart from SpacesStrip so the strip stays about tiles.
+const DRAG_THRESHOLD_PX = 4;
+const EDGE_EPSILON_PX = 2;
+const MIN_PAGE_PX = 220;
+
+export const ACTIVE_TILE_ATTR = 'data-space-active';
+
+export interface StripScroll {
+  scrollRef: React.MutableRefObject<HTMLDivElement | null>;
+  atStart: boolean;
+  atEnd: boolean;
+  overflowing: boolean;
+  dragging: boolean;
+  scrollByPage: (dir: -1 | 1) => void;
+}
+
+const wantsMotion = (): boolean => !window.matchMedia?.('(prefers-reduced-motion: reduce)').matches;
+
+export function useStripScroll(activeId: string | null, itemCount: number, animate: boolean): StripScroll {
+  const scrollRef = React.useRef<HTMLDivElement | null>(null);
+  const [edges, setEdges] = React.useState({ atStart: true, atEnd: true, overflowing: false });
+  const [dragging, setDragging] = React.useState(false);
+
+  const syncEdges = React.useCallback((): void => {
+    const el = scrollRef.current;
+    if (!el) return;
+    const max = el.scrollWidth - el.clientWidth;
+    const next = {
+      atStart: el.scrollLeft <= EDGE_EPSILON_PX,
+      atEnd: el.scrollLeft >= max - EDGE_EPSILON_PX,
+      overflowing: max > EDGE_EPSILON_PX,
+    };
+    setEdges((prev) => (
+      prev.atStart === next.atStart && prev.atEnd === next.atEnd && prev.overflowing === next.overflowing ? prev : next
+    ));
+  }, []);
+
+  React.useEffect(() => {
+    const el = scrollRef.current;
+    if (!el) return undefined;
+    // The canvas zooms on wheel, so anything this rail consumes must stop here and never bubble onward.
+    const onWheel = (e: WheelEvent): void => {
+      if (el.scrollWidth - el.clientWidth <= EDGE_EPSILON_PX) return;
+      const delta = Math.abs(e.deltaX) > Math.abs(e.deltaY) ? e.deltaX : e.deltaY;
+      if (delta === 0) return;
+      el.scrollLeft += delta;
+      e.preventDefault();
+      e.stopPropagation();
+    };
+    el.addEventListener('wheel', onWheel, { passive: false });
+    el.addEventListener('scroll', syncEdges, { passive: true });
+    const ro = new ResizeObserver(syncEdges);
+    ro.observe(el);
+    return () => {
+      el.removeEventListener('wheel', onWheel);
+      el.removeEventListener('scroll', syncEdges);
+      ro.disconnect();
+    };
+  }, [syncEdges]);
+
+  React.useEffect(() => { syncEdges(); }, [syncEdges, itemCount]);
+
+  React.useEffect(() => {
+    const el = scrollRef.current;
+    if (!el) return undefined;
+    let startX = 0;
+    let startLeft = 0;
+    let moved = false;
+    let swallowClick = false;
+
+    const onMove = (e: PointerEvent): void => {
+      const dx = e.clientX - startX;
+      if (!moved) {
+        if (Math.abs(dx) < DRAG_THRESHOLD_PX) return;
+        moved = true;
+        setDragging(true);
+      }
+      el.scrollLeft = startLeft - dx;
+      e.preventDefault();
+    };
+    const onUp = (): void => {
+      window.removeEventListener('pointermove', onMove);
+      window.removeEventListener('pointerup', onUp);
+      window.removeEventListener('pointercancel', onUp);
+      if (!moved) return;
+      swallowClick = true;
+      setDragging(false);
+    };
+    const onDown = (e: PointerEvent): void => {
+      if (e.button !== 0) return;  // right-click belongs to the tile context menu
+      if ((e.target as HTMLElement).closest('input')) return;  // the inline rename field keeps its own caret
+      swallowClick = false;
+      startX = e.clientX;
+      startLeft = el.scrollLeft;
+      moved = false;
+      window.addEventListener('pointermove', onMove);
+      window.addEventListener('pointerup', onUp);
+      window.addEventListener('pointercancel', onUp);
+    };
+    // A pan that ends on a tile still fires a click, so eat exactly that one and let real clicks through.
+    const onClickCapture = (e: MouseEvent): void => {
+      if (!swallowClick) return;
+      swallowClick = false;
+      e.preventDefault();
+      e.stopPropagation();
+    };
+
+    el.addEventListener('pointerdown', onDown);
+    el.addEventListener('click', onClickCapture, true);
+    return () => {
+      el.removeEventListener('pointerdown', onDown);
+      el.removeEventListener('click', onClickCapture, true);
+      window.removeEventListener('pointermove', onMove);
+      window.removeEventListener('pointerup', onUp);
+      window.removeEventListener('pointercancel', onUp);
+    };
+  }, []);
+
+  React.useEffect(() => {
+    const el = scrollRef.current;
+    if (!el || !activeId) return;
+    const target = el.querySelector<HTMLElement>(`[${ACTIVE_TILE_ATTR}="true"]`);
+    if (!target) return;
+    const max = el.scrollWidth - el.clientWidth;
+    if (max <= EDGE_EPSILON_PX) return;
+    const left = target.offsetLeft;
+    if (left >= el.scrollLeft && left + target.offsetWidth <= el.scrollLeft + el.clientWidth) return;
+    const centered = Math.max(0, Math.min(max, left - (el.clientWidth - target.offsetWidth) / 2));
+    el.scrollTo({ left: centered, behavior: animate && wantsMotion() ? 'smooth' : 'auto' });
+  }, [activeId, itemCount, animate]);
+
+  const scrollByPage = React.useCallback((dir: -1 | 1): void => {
+    const el = scrollRef.current;
+    if (!el) return;
+    const step = Math.max(MIN_PAGE_PX, el.clientWidth * 0.8);
+    el.scrollBy({ left: dir * step, behavior: wantsMotion() ? 'smooth' : 'auto' });
+  }, []);
+
+  return { scrollRef, ...edges, dragging, scrollByPage };
+}
diff --git a/frontend/src/app/pages/Dashboard/hooks/interaction/pasteClipboardCards.ts b/frontend/src/app/pages/Dashboard/hooks/interaction/pasteClipboardCards.ts
new file mode 100644
index 00000000..1123db2f
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/hooks/interaction/pasteClipboardCards.ts
@@ -0,0 +1,67 @@
+import { duplicateSession, expandSession } from '@/shared/state/agentsSlice';
+import { addViewCard, pasteBrowserCard, placeCard } from '@/shared/state/dashboardLayoutSlice';
+import { store, type AppDispatch } from '@/shared/state/store';
+import { getClipboardCards } from '@/shared/dashboardClipboard';
+import type { CardType } from '../state/useDashboardSelection';
+
+const PASTE_OFFSET = 40;
+
+interface PasteTargets {
+  selectCard: (id: string, type: CardType, additive: boolean) => void;
+  deselectAll: () => void;
+}
+
+interface PasteArgs {
+  dispatch: AppDispatch;
+  dashboardId: string;
+  expandedSessionIds: string[];
+  selection: PasteTargets;
+  /** Canvas-space drop point; without it the copies land offset from their originals. */
+  at?: { x: number; y: number };
+}
+
+export async function pasteClipboardCards({ dispatch, dashboardId, expandedSessionIds, selection, at }: PasteArgs): Promise<void> {
+  const copied = getClipboardCards();
+  if (copied.length === 0) return;
+
+  // Right-click paste anchors the whole group at the cursor by shifting off the first card's corner.
+  const anchorX = copied[0].x;
+  const anchorY = copied[0].y;
+
+  selection.deselectAll();
+  const newSelection = new Map<string, CardType>();
+
+  for (const card of copied) {
+    const px = at ? at.x + (card.x - anchorX) : card.x + PASTE_OFFSET;
+    const py = at ? at.y + (card.y - anchorY) : card.y - PASTE_OFFSET;
+
+    if (card.type === 'agent') {
+      const action = await dispatch(duplicateSession({ sessionId: card.id, dashboardId }));
+      if (duplicateSession.fulfilled.match(action)) {
+        const newId = action.payload.id;
+        dispatch(placeCard({ sessionId: newId, x: px, y: py, width: card.width, height: card.height, expandedSessionIds }));
+        if (card.expanded) dispatch(expandSession(newId));
+        newSelection.set(newId, 'agent');
+      }
+    } else if (card.type === 'view') {
+      // Pasting an app whose card is already open creates a NEW independent instance (own runtime + ports) instead of no-op'ing.
+      const outputId = card.id.split('#')[0];
+      dispatch(addViewCard({ outputId, expandedSessionIds, x: px, y: py, width: card.width, height: card.height, newInstance: true }));
+      const viewCards = store.getState().dashboardLayout.viewCards;
+      let pastedKey = outputId;
+      for (const [key, vc] of Object.entries(viewCards)) {
+        if (vc.output_id === outputId && (vc.instance ?? 1) >= (viewCards[pastedKey]?.instance ?? 1)) pastedKey = key;
+      }
+      newSelection.set(pastedKey, 'view');
+    } else if (card.type === 'browser') {
+      const browserId = `browser-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
+      dispatch(pasteBrowserCard({
+        id: browserId, tabs: card.meta.tabs || [], url: card.meta.url || '',
+        x: px, y: py, width: card.width, height: card.height,
+      }));
+      newSelection.set(browserId, 'browser');
+    }
+  }
+
+  for (const [id, type] of newSelection) selection.selectCard(id, type, true);
+}
diff --git a/frontend/src/app/pages/Dashboard/hooks/interaction/useCanvasControls.ts b/frontend/src/app/pages/Dashboard/hooks/interaction/useCanvasControls.ts
index b41d3f8a..41947f14 100644
--- a/frontend/src/app/pages/Dashboard/hooks/interaction/useCanvasControls.ts
+++ b/frontend/src/app/pages/Dashboard/hooks/interaction/useCanvasControls.ts
@@ -1,16 +1,28 @@
-import { useState, useCallback, useRef, useEffect, useMemo, RefObject } from 'react';
+import { useState, useCallback, useRef, useEffect, useMemo } from 'react';
 import { store } from '@/shared/state/store';
+import { selectFullscreenCardId } from '@/shared/state/dashboardLayoutSlice';
 import { setCanvasInteractionActive } from '@/shared/canvasInteractionState';
 import { getLastInteractedBrowser } from '@/shared/browserFocus';
 import { getScrollFocusedCard } from '@/shared/cardScrollFocus';
 import { getWebview } from '@/shared/browserRegistry';
 import { applyBrowserZoom } from '@/shared/browserZoom';
+import { syncTiledGeometry } from '../../canvas/tiledGeometry';
+import { revealZoom, REVEAL_MIN_ZOOM } from '../../canvas/revealZoom';
 
 const MIN_ZOOM = 0.15;
+// The floor for AUTOMATIC reveals only. revealCards takes min(current, fit), which can only ever go
+// down, so every spawn that did not fit ratcheted the camera out and nothing ever brought it back:
+// measured 100% -> 88% -> 79% -> 61% -> 36% -> 18% over one ordinary session, at which point no word
+// on the canvas is readable. A hand-driven zoom can still go all the way to MIN_ZOOM.
+
 const MAX_ZOOM = 3.0;
 const ZOOM_IN_FACTOR = 1.1;
 const ZOOM_OUT_FACTOR = 1 / ZOOM_IN_FACTOR;
 const FIT_PADDING = 200;
+// Tidy frames everything at once, so it gets its own tighter margin than a single-card fit. The wider
+// x inset is the left dock, which floats over the canvas and would otherwise sit on the first column.
+const TIDY_PADDING = { x: 120, y: 56 };
+const TIDY_MIN_ZOOM = REVEAL_MIN_ZOOM;
 // Card-framing (spawn, click-to-focus, arrow-nav) snaps as fast as the zoom buttons so a new card lands under you now, not after a lazy glide.
 const FIT_DURATION = 150;
 // Must outlast FIT_DURATION so the drift re-snap lands after the glide, never mid-flight.
@@ -63,7 +75,6 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
   const stateRef = useRef(state);
   const liveDirtyRef = useRef(false);
   const spaceRef = useRef(false);
-  const cmdRef = useRef(false);
   const sensitivityRef = useRef(zoomSensitivity);
   sensitivityRef.current = zoomSensitivity;
   const contentBoundsRef = useRef(contentBounds);
@@ -89,6 +100,9 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
       // Dot RADIUS lives in the committed backgroundImage and lags to gesture-end; at 1-4px dots the mid-pinch error is invisible and skipping the per-frame gradient rebuild keeps this handler pure style writes.
       grid.style.backgroundSize = `${spacing}px ${spacing}px`;
     }
+    // Tiled cards are counter-transformed against this exact camera, in this exact task: same write,
+    // same frame, so the tile and the canvas can never be painted from two different cameras.
+    syncTiledGeometry(stateRef.current);
   }, []);
 
   // Per-frame camera write during a gesture: DOM + live ref only, NO React commit. Dragging cards re-pin to the cursor off the pan-changed event, same signal the old per-frame commit produced.
@@ -302,12 +316,10 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
     const onWheel = (e: WheelEvent) => {
       // Full size view owns the whole surface: any wheel that escapes the chat's scroll container
       // (side gutters, header) must NOT zoom/pan the hidden canvas underneath, that read as a
-      // glitchy zoom while scrolling the chat. Fullscreen has no canvas nav, period.
-      const tiledCards = store.getState().dashboardLayout.tiledCards;
-      for (const z of Object.values(tiledCards)) {
-        if (z === 'fullscreen') return;
-      }
-      // ctrl/cmd wheel is a modifier gesture: a real held key (cmd/ctrl + scroll → vertical pan) or a trackpad pinch, which also sets ctrlKey (→ zoom at cursor). Either way it bypasses scrollable children and acts on the canvas.
+      // glitchy zoom while scrolling the chat. Fullscreen has no canvas nav, period. The selector's
+      // existence check matters: a stale tile entry for a removed card would wedge the wheel forever.
+      if (selectFullscreenCardId(store.getState())) return;
+      // ctrl/cmd wheel is the zoom gesture on every surface: a physically held key or a trackpad pinch (which also sets ctrlKey). It bypasses scrollable children so zoom is always reachable, even over a chat you're typing in.
       const isModifierWheel = e.ctrlKey || e.metaKey;
 
       // Let scrollable children handle the event when appropriate, but fall through to canvas pan if the child is at its scroll boundary.
@@ -375,14 +387,10 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
         inertiaFrameRef.current = null;
       }
 
-      if (isModifierWheel && cmdRef.current) {
-        // Real cmd/ctrl physically held + scroll → vertical pan. cmdRef is set from a keydown; a trackpad pinch sets ctrlKey with no keydown, so it falls through to the zoom branch below and pinch-to-zoom survives.
-        pendingPanDy += dy;
-        scheduleWheelFlush();
-      } else if (isModifierWheel) {
-        // Trackpad pinch → accumulate zoom deltas + last cursor position. factor = 2^(-Σdy·s) which equals the product of per-event factors, so accumulating dy is mathematically identical to applying each event one at a time.
+      if (isModifierWheel) {
+        // Pinch or held cmd/ctrl → accumulate zoom deltas + last cursor position. factor = 2^(-Σdy·s) which equals the product of per-event factors, so accumulating dy is mathematically identical to applying each event one at a time.
         const rect = el.getBoundingClientRect();
-        pendingZoomDy += dy;
+        pendingZoomDy += clamp(dy, -WHEEL_ZOOM_DELTA_CAP, WHEEL_ZOOM_DELTA_CAP);
         pendingZoomCenter = { cx: e.clientX - rect.left, cy: e.clientY - rect.top };
         scheduleWheelFlush();
       } else if (isTrackpadScroll) {
@@ -413,7 +421,8 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
         cancelAnimationFrame(inertiaFrameRef.current);
         inertiaFrameRef.current = null;
       }
-      pendingZoomDy += dy;
+      // Same per-event cap as a host-side notch, so one wheel click inside a guest page is a step, not a lurch.
+      pendingZoomDy += clamp(dy, -WHEEL_ZOOM_DELTA_CAP, WHEEL_ZOOM_DELTA_CAP);
       pendingZoomCenter = {
         cx: (detail.clientX ?? 0) - rect.left,
         cy: (detail.clientY ?? 0) - rect.top,
@@ -599,7 +608,6 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
         setSpaceHeld(true);
       }
       if ((e.key === 'Meta' || e.key === 'Control') && !e.repeat) {
-        cmdRef.current = true;
         setCmdHeld(true);
       }
       if (e.ctrlKey || e.metaKey) {
@@ -627,7 +635,6 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
         setSpaceHeld(false);
       }
       if (e.key === 'Meta' || e.key === 'Control') {
-        cmdRef.current = false;
         setCmdHeld(false);
       }
     };
@@ -640,7 +647,10 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
     };
   }, []);
 
-  const fitToView = useCallback(() => {
+  // minZoom is for the AUTOMATIC boot fit only: restoring a dashboard that had grown tall used to land
+  // at 29% with nothing readable, the same illness revealZoom cured on spawn. The toolbar's own Fit
+  // button passes nothing and still fits everything, however far out that is.
+  const fitToView = useCallback((minZoom?: number) => {
     const viewport = viewportRef.current;
     const content = contentRef.current;
     if (!viewport || !content) return;
@@ -674,7 +684,7 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
     const contentHeight = maxY - minY;
     const availW = vRect.width - FIT_PADDING * 2;
     const availH = vRect.height - FIT_PADDING * 2;
-    const newZoom = clamp(Math.min(availW / contentWidth, availH / contentHeight), MIN_ZOOM, MAX_ZOOM);
+    const newZoom = clamp(Math.min(availW / contentWidth, availH / contentHeight), Math.max(MIN_ZOOM, minZoom ?? MIN_ZOOM), MAX_ZOOM);
     const newPanX = (vRect.width - contentWidth * newZoom) / 2 - minX * newZoom;
     const newPanY = (vRect.height - contentHeight * newZoom) / 2 - minY * newZoom;
 
@@ -688,6 +698,7 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
       maxZoom?: number,
       minZoom?: number,
       centered?: boolean,
+      padding?: { x: number; y: number },
     ): { panX: number; panY: number; zoom: number } | null => {
       const viewport = viewportRef.current;
       if (!viewport || cardRects.length === 0) return null;
@@ -708,8 +719,10 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
 
       const contentWidth = maxX - minX;
       const contentHeight = maxY - minY;
-      const availW = vRect.width - FIT_PADDING * 2;
-      const availH = vRect.height - FIT_PADDING * 2;
+      const padX = padding?.x ?? FIT_PADDING;
+      const padY = padding?.y ?? FIT_PADDING;
+      const availW = vRect.width - padX * 2;
+      const availH = vRect.height - padY * 2;
       const ceiling = maxZoom ?? MAX_ZOOM;
       const floor = minZoom ?? MIN_ZOOM;
       const targetZoom = clamp(
@@ -717,12 +730,16 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
         floor,
         ceiling,
       );
-      const targetPanX =
-        (vRect.width - contentWidth * targetZoom) / 2 - minX * targetZoom;
+      // Centering is right until the zoom floor bites and the content outgrows its margins: then the left
+      // edge slides under the dock (or off screen), so never let it start left of the inset.
+      const targetPanX = Math.max(
+        (vRect.width - contentWidth * targetZoom) / 2 - minX * targetZoom,
+        padX - minX * targetZoom,
+      );
       // A single card normally top-biases (header up top, no dead space below). On creation we want the opposite: the new card dead-centered "in front of you", so `centered` forces true vertical centering.
       const topBiased = cardRects.length === 1 && !centered;
-      const targetPanY = topBiased
-        ? FIT_PADDING * 0.4 - minY * targetZoom
+      const targetPanY = topBiased || contentHeight * targetZoom > vRect.height
+        ? padY * 0.4 - minY * targetZoom
         : (vRect.height - contentHeight * targetZoom) / 2 -
           minY * targetZoom;
       return { panX: targetPanX, panY: targetPanY, zoom: targetZoom };
@@ -737,10 +754,11 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
       animate?: boolean,
       minZoom?: number,
       centered?: boolean,
+      padding?: { x: number; y: number },
     ) => {
       cancelAnimation();
 
-      const target = computeFitTarget(cardRects, maxZoom, minZoom, centered);
+      const target = computeFitTarget(cardRects, maxZoom, minZoom, centered, padding);
       if (!target) {
         // Keep current camera; snapping to (0,0,1) used to desync the minimap.
         if (cardRects.length === 0 || !viewportRef.current) {
@@ -758,7 +776,7 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
         // Settle pass: cancelAnimation() must be able to cancel it, else back-to-back fitToCards races and the first settle overwrites the second target.
         settleTimerRef.current = window.setTimeout(() => {
           settleTimerRef.current = null;
-          const fresh = computeFitTarget(cardRects, maxZoom, minZoom, centered);
+          const fresh = computeFitTarget(cardRects, maxZoom, minZoom, centered, padding);
           if (!fresh) return;
           const cur2 = stateRef.current;
           const drift =
@@ -774,6 +792,15 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
     [cancelAnimation, animateTo, computeFitTarget, setCanvasState],
   );
 
+  // The camera half of Tidy: frame the freshly gridded cards close in (the 200px fit padding was
+  // eating a third of the viewport), never below readable, and never magnified past life size.
+  const fitTidy = useCallback(
+    (cardRects: Array<{ x: number; y: number; width: number; height: number }>) => {
+      fitToCards(cardRects, 1, true, TIDY_MIN_ZOOM, false, TIDY_PADDING);
+    },
+    [fitToCards],
+  );
+
   // Figma-style spawn camera: never zoom IN, never move if the cards are already on screen; otherwise the minimal pan that reveals them, zooming out only when they cannot fit at the current zoom.
   const revealCards = useCallback(
     (cardRects: Array<{ x: number; y: number; width: number; height: number }>) => {
@@ -795,7 +822,8 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
         (v.width - REVEAL_MARGIN * 2) / (maxX - minX),
         (v.height - REVEAL_MARGIN * 2) / (maxY - minY),
       );
-      const zoom = clamp(Math.min(cur.zoom, fitZoom), MIN_ZOOM, MAX_ZOOM);
+      // Never auto-zoom below readable: showing every card at 18% is worse than showing the new one at 50%, and the pan below still brings it into view.
+      const zoom = clamp(revealZoom(cur.zoom, fitZoom, MIN_ZOOM, MAX_ZOOM), MIN_ZOOM, MAX_ZOOM);
       // If zooming out, keep the viewport-center world point fixed first, then clamp.
       const ratio = zoom / cur.zoom;
       let panX = v.width / 2 - (v.width / 2 - cur.panX) * ratio;
@@ -829,9 +857,9 @@ export function useCanvasControls(zoomSensitivity: number = 50, contentBounds?:
   const getLiveState = useCallback((): CanvasState => stateRef.current, []);
 
   const actions = useMemo(() => ({
-    zoomIn, zoomOut, resetZoom, fitToView, fitToCards, revealCards, animateTo, cancelAnimation,
+    zoomIn, zoomOut, resetZoom, fitToView, fitToCards, fitTidy, revealCards, animateTo, cancelAnimation,
     setState: setCanvasState, panBy, commit: commitLive, syncTransform: applyLiveToDom, getLiveState,
-  }), [zoomIn, zoomOut, resetZoom, fitToView, fitToCards, revealCards, animateTo, cancelAnimation, setCanvasState, panBy, commitLive, applyLiveToDom, getLiveState]);
+  }), [zoomIn, zoomOut, resetZoom, fitToView, fitToCards, fitTidy, revealCards, animateTo, cancelAnimation, setCanvasState, panBy, commitLive, applyLiveToDom, getLiveState]);
 
   return {
     ...state,
diff --git a/frontend/src/app/pages/Dashboard/hooks/interaction/useDashboardClipboard.ts b/frontend/src/app/pages/Dashboard/hooks/interaction/useDashboardClipboard.ts
index d3f7e0b8..984bd89c 100644
--- a/frontend/src/app/pages/Dashboard/hooks/interaction/useDashboardClipboard.ts
+++ b/frontend/src/app/pages/Dashboard/hooks/interaction/useDashboardClipboard.ts
@@ -1,22 +1,15 @@
 import { useEffect } from 'react';
 import { useAppDispatch } from '@/shared/hooks';
-import {
-  duplicateSession,
-  expandSession,
-  type AgentSession,
-} from '@/shared/state/agentsSlice';
-import {
-  addViewCard,
-  pasteBrowserCard,
-  placeCard,
-  type CardPosition,
-  type ViewCardPosition,
-  type BrowserCardPosition,
+import type { AgentSession } from '@/shared/state/agentsSlice';
+import type {
+  CardPosition,
+  ViewCardPosition,
+  BrowserCardPosition,
 } from '@/shared/state/dashboardLayoutSlice';
 import type { Output } from '@/shared/state/outputsSlice';
-import { store } from '@/shared/state/store';
 import { setClipboardCards, getClipboardCards, type ClipboardCard } from '@/shared/dashboardClipboard';
-import type { CardType, useDashboardSelection } from '../state/useDashboardSelection';
+import { pasteClipboardCards } from './pasteClipboardCards';
+import type { useDashboardSelection } from '../state/useDashboardSelection';
 
 type Selection = ReturnType<typeof useDashboardSelection>;
 
@@ -102,68 +95,16 @@ export function useDashboardClipboard({
   }, [selection.selectedIds, sessions, cards, viewCards, browserCards, outputs, expandedSessionIds]);
 
   useEffect(() => {
-    const PASTE_OFFSET = 40;
-    const handlePaste = async (e: KeyboardEvent) => {
+    const handlePaste = (e: KeyboardEvent) => {
       if (!isActive) return;  // Don't fire shortcuts when dashboard is hidden
       if (!(e.metaKey || e.ctrlKey) || e.key.toLowerCase() !== 'v') return;
       const tag = (e.target as HTMLElement)?.tagName;
       if (tag === 'INPUT' || tag === 'TEXTAREA' || (e.target as HTMLElement)?.isContentEditable) return;
-
-      const copied = getClipboardCards();
-      if (copied.length === 0) return;
+      if (getClipboardCards().length === 0) return;
       e.preventDefault();
-
-      selection.deselectAll();
-      const newSelection = new Map<string, CardType>();
-
-      for (const card of copied) {
-        const px = card.x + PASTE_OFFSET;
-        const py = card.y - PASTE_OFFSET;
-
-        if (card.type === 'agent') {
-          const action = await dispatch(duplicateSession({ sessionId: card.id, dashboardId }));
-          if (duplicateSession.fulfilled.match(action)) {
-            const newId = action.payload.id;
-            dispatch(placeCard({
-              sessionId: newId,
-              x: px,
-              y: py,
-              width: card.width,
-              height: card.height,
-              expandedSessionIds,
-            }));
-            if (card.expanded) {
-              dispatch(expandSession(newId));
-            }
-            newSelection.set(newId, 'agent');
-          }
-        } else if (card.type === 'view') {
-          // Pasting an app whose card is already open creates a NEW independent instance (own runtime + ports) instead of no-op'ing.
-          const outputId = card.id.split('#')[0];
-          dispatch(addViewCard({ outputId, expandedSessionIds, x: px, y: py, width: card.width, height: card.height, newInstance: true }));
-          const viewCards = store.getState().dashboardLayout.viewCards;
-          let pastedKey = outputId;
-          for (const [key, vc] of Object.entries(viewCards)) {
-            if (vc.output_id === outputId && (vc.instance ?? 1) >= (viewCards[pastedKey]?.instance ?? 1)) pastedKey = key;
-          }
-          newSelection.set(pastedKey, 'view');
-        } else if (card.type === 'browser') {
-          const browserId = `browser-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
-          dispatch(pasteBrowserCard({
-            id: browserId, tabs: card.meta.tabs || [], url: card.meta.url || '',
-            x: px, y: py, width: card.width, height: card.height,
-          }));
-          newSelection.set(browserId, 'browser');
-        }
-      }
-
-      if (newSelection.size > 0) {
-        for (const [id, type] of newSelection) {
-          selection.selectCard(id, type, true);
-        }
-      }
+      void pasteClipboardCards({ dispatch, dashboardId, expandedSessionIds, selection });
     };
     window.addEventListener('keydown', handlePaste);
     return () => window.removeEventListener('keydown', handlePaste);
-  }, [dispatch, dashboardId, expandedSessionIds, selection]);
+  }, [dispatch, dashboardId, expandedSessionIds, selection, isActive]);
 }
diff --git a/frontend/src/app/pages/Dashboard/hooks/interaction/useDashboardInteractions.ts b/frontend/src/app/pages/Dashboard/hooks/interaction/useDashboardInteractions.ts
index a4a7a99e..eecd4762 100644
--- a/frontend/src/app/pages/Dashboard/hooks/interaction/useDashboardInteractions.ts
+++ b/frontend/src/app/pages/Dashboard/hooks/interaction/useDashboardInteractions.ts
@@ -206,9 +206,11 @@ export function useDashboardInteractions({
     selection.handleCanvasMouseMove(e.nativeEvent);
   }, [canvas.handlers, selection]);
 
-  const handleViewportMouseUp = useCallback((e: React.MouseEvent) => {
+  // Reports whether the release ended a marquee drag; the canvas uses that to tell a right-DRAG
+  // (rubber band) from a right-CLICK (context menu) without ever arbitrating on mousedown.
+  const handleViewportMouseUp = useCallback((e: React.MouseEvent): boolean => {
     canvas.handlers.onMouseUp();
-    selection.handleCanvasMouseUp(e.nativeEvent);
+    return selection.handleCanvasMouseUp(e.nativeEvent);
   }, [canvas.handlers, selection]);
 
   // Double-click empty canvas → zoom OUT anchored at the cursor (Google Maps style). It must never
diff --git a/frontend/src/app/pages/Dashboard/hooks/interaction/useOverlayScrollPassthrough.ts b/frontend/src/app/pages/Dashboard/hooks/interaction/useOverlayScrollPassthrough.ts
index 123aa5d2..eb9934b7 100644
--- a/frontend/src/app/pages/Dashboard/hooks/interaction/useOverlayScrollPassthrough.ts
+++ b/frontend/src/app/pages/Dashboard/hooks/interaction/useOverlayScrollPassthrough.ts
@@ -1,4 +1,5 @@
 import { useRef, useEffect } from 'react';
+import { getScrollFocusedCard } from '@/shared/cardScrollFocus';
 
 /** Forwards wheel events through an overlay to the content beneath while keeping overlay click/drag; passes pinch-zoom. */
 export function useOverlayScrollPassthrough(active: boolean) {
@@ -10,6 +11,8 @@ export function useOverlayScrollPassthrough(active: boolean) {
 
     const handleWheel = (e: WheelEvent) => {
       if (e.ctrlKey || e.metaKey) return;
+      const cardId = el.closest('[data-select-id]')?.getAttribute('data-select-id') ?? null;
+      const cardOwnsScroll = !cardId || cardId === getScrollFocusedCard();
 
       el.style.pointerEvents = 'none';
       const underneath = document.elementFromPoint(e.clientX, e.clientY);
@@ -61,6 +64,9 @@ export function useOverlayScrollPassthrough(active: boolean) {
         }
 
         if (canScrollY || canScrollX) {
+          // Host content under the overlay follows the canvas rule: only the card you clicked INTO
+          // gets the plain wheel, otherwise swallowing it here is what kills zoom over a card.
+          if (!cardOwnsScroll) return;
           e.stopPropagation();
           e.preventDefault();
           node.scrollBy(dx, dy);
diff --git a/frontend/src/app/pages/Dashboard/hooks/interaction/useWebviewSuspend.ts b/frontend/src/app/pages/Dashboard/hooks/interaction/useWebviewSuspend.ts
index 753a81dc..c2029c8f 100644
--- a/frontend/src/app/pages/Dashboard/hooks/interaction/useWebviewSuspend.ts
+++ b/frontend/src/app/pages/Dashboard/hooks/interaction/useWebviewSuspend.ts
@@ -10,6 +10,7 @@ import { getWebview } from '@/shared/browserRegistry';
 import { getActivity, isAnyBrowserBusy } from '@/shared/browserCommandHandler';
 import { isKeepAliveBrowser } from '@/shared/browserFocus';
 import { captureTabCapsule } from '@/shared/browserStateCapsule';
+import { getMinimizedShot } from '../../desktop/minimizedShots';
 
 const isElectron = typeof navigator !== 'undefined' && navigator.userAgent.includes('Electron');
 
@@ -83,6 +84,22 @@ function cardIsAudible(browserId: string, card: BrowserCardPosition): boolean {
   return false;
 }
 
+// Parked in the minimize rail: the card renders off-canvas behind a frozen still, so a live renderer
+// sitting behind it is pure waste (same call DashboardViewCard already makes for app previews).
+function isMinimized(browserId: string): boolean {
+  return !!store.getState().dashboardLayout.minimizedCards[browserId];
+}
+
+// Restoring from the rail flies the camera to the card, and that flight outlives one settle beat; without a grace the off-screen rule re-parks the card mid-flight and it flickers back to a dead snapshot.
+const RESTORE_GRACE_MS = 4000;
+const restoredAt = new Map<string, number>();
+
+function withinRestoreGrace(browserId: string): boolean {
+  const t = restoredAt.get(browserId);
+  for (const [k, v] of restoredAt) if (Date.now() - v > RESTORE_GRACE_MS) restoredAt.delete(k);
+  return t !== undefined && Date.now() - t < RESTORE_GRACE_MS;
+}
+
 // A card we must never snapshot-swap: an agent is driving it, it's in the keep-alive set (recently used), or it's playing audio. Suspending destroys the webContents (sessionStorage, playback), the things we're preserving.
 function mustStayLive(browserId: string, card: BrowserCardPosition): boolean {
   // The shield class marks a live card/marquee drag: suspending a browser MID-DRAG unmounts the
@@ -107,6 +124,8 @@ export function useWebviewSuspend(
 ) {
   const dispatch = useAppDispatch();
   const suspended = useAppSelector((s) => s.dashboardLayout.suspendedBrowserCards);
+  const minimized = useAppSelector((s) => s.dashboardLayout.minimizedCards);
+  const prevMinimizedRef = useRef<Record<string, boolean>>({});
   const vpRef = useRef<Viewport>({ panX, panY, zoom, vpW: 1200, vpH: 800 });
 
   // Window resize changes the viewport without touching pan/zoom/cards; tick so the evaluation below reruns, or a shrunken window never suspends anything.
@@ -134,6 +153,9 @@ export function useWebviewSuspend(
       vpH: el ? el.clientHeight : 800,
     };
 
+    const wasMinimized = prevMinimizedRef.current;
+    prevMinimizedRef.current = minimized;
+
     const liveCount = Object.keys(browserCards).filter((id) => !suspended[id]).length;
     let budget = MAX_LIVE_WEBVIEWS - liveCount;
     const parked = Object.keys(suspended)
@@ -146,7 +168,14 @@ export function useWebviewSuspend(
         budget--;
         continue;
       }
-      if (budget <= 0) continue;
+      if (budget <= 0 || minimized[id]) continue;
+      // Un-minimizing is an explicit "give it back", so it wakes the card wherever the camera happens to be pointing.
+      if (wasMinimized[id]) {
+        restoredAt.set(id, Date.now());
+        dispatch(resumeBrowserCard(id));
+        budget--;
+        continue;
+      }
       const bigEnough = card.width * zoom >= RESUME_MIN_CARD_PX;
       if (bigEnough && cardIntersectsViewport(card, vpRef.current, RESUME_MARGIN_PX)) {
         dispatch(resumeBrowserCard(id));
@@ -156,15 +185,19 @@ export function useWebviewSuspend(
 
     const timer = setTimeout(async () => {
       const isSuspended = (id: string) => !!store.getState().dashboardLayout.suspendedBrowserCards[id];
+      // Read live, not off the effect's closure: this re-runs after an await, and the user can restore a card mid-capture.
+      const wantsPark = (id: string, card: BrowserCardPosition): boolean =>
+        isMinimized(id)
+        || (!withinRestoreGrace(id) && !cardIntersectsViewport(card, vpRef.current, SUSPEND_MARGIN_PX));
       await refreshVisibleFrames(browserCards, isSuspended, vpRef.current);
       for (const [id, card] of Object.entries(browserCards)) {
         if (isSuspended(id)) continue;
-        if (cardIntersectsViewport(card, vpRef.current, SUSPEND_MARGIN_PX)) continue;
+        if (!wantsPark(id, card)) continue;
         if (mustStayLive(id, card)) continue;
         // An empty dataUrl still suspends (placeholder renders): a card whose capture hangs/fails must not keep its renderer alive forever.
         const dataUrl = await captureForSuspend(id, card);
         // The capture await yielded; conditions may have changed under us.
-        if (cardIntersectsViewport(card, vpRef.current, SUSPEND_MARGIN_PX) || mustStayLive(id, card)) continue;
+        if (!wantsPark(id, card) || mustStayLive(id, card)) continue;
         dispatch(suspendBrowserCard({ browserId: id, dataUrl }));
       }
 
@@ -183,7 +216,7 @@ export function useWebviewSuspend(
     }, SETTLE_MS);
 
     return () => clearTimeout(timer);
-  }, [browserCards, suspended, panX, panY, zoom, viewportRef, dispatch, resizeTick]);
+  }, [browserCards, suspended, minimized, panX, panY, zoom, viewportRef, dispatch, resizeTick]);
 }
 
 function distFromCenter(card: BrowserCardPosition, vp: Viewport): number {
@@ -219,6 +252,7 @@ async function refreshVisibleFrames(
   if (isAnyBrowserBusy()) return;
   for (const [id, card] of Object.entries(cards)) {
     if (isSuspended(id)) continue;
+    if (isMinimized(id)) continue;
     if (!cardIntersectsViewport(card, vp, 0)) continue;
     const prev = lastFrames.get(id);
     if (prev && Date.now() - prev.at < FRAME_TTL_MS) continue;
@@ -232,12 +266,14 @@ async function captureForSuspend(id: string, card: BrowserCardPosition): Promise
   for (const tab of card.tabs ?? []) {
     await captureTabCapsule(getWebview(id, tab.id), tab.id);
   }
-  const live = await captureCard(id, card);
+  // A minimized card is already parked off-canvas and will never paint again, so asking it for a frame
+  // just burns the capture timeout; the shot frozen on the way in is the only real one it has.
+  const live = isMinimized(id) ? '' : await captureCard(id, card);
   if (live) {
     rememberFrame(id, live);
     return live;
   }
-  return lastFrames.get(id)?.dataUrl ?? '';
+  return lastFrames.get(id)?.dataUrl ?? getMinimizedShot(id) ?? '';
 }
 
 async function captureCard(id: string, card: BrowserCardPosition): Promise<string> {
diff --git a/frontend/src/app/pages/Dashboard/hooks/lifecycle/orphanViewCardKeys.test.ts b/frontend/src/app/pages/Dashboard/hooks/lifecycle/orphanViewCardKeys.test.ts
new file mode 100644
index 00000000..420d783b
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/hooks/lifecycle/orphanViewCardKeys.test.ts
@@ -0,0 +1,38 @@
+// Run: node --test frontend/src/app/pages/Dashboard/hooks/lifecycle/orphanViewCardKeys.test.ts
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { orphanViewCardKeys } from './orphanViewCardKeys.ts';
+
+const app = { id: 'app1', name: 'Calculator' };
+
+test('a live app keeps its primary card', () => {
+  const cards = { app1: { output_id: 'app1' } };
+  assert.deepEqual(orphanViewCardKeys(cards, { app1: app }), []);
+});
+
+test('a second instance of a live app is not an orphan', () => {
+  const cards = { app1: { output_id: 'app1' }, 'app1#2': { output_id: 'app1' } };
+  assert.deepEqual(orphanViewCardKeys(cards, { app1: app }), []);
+});
+
+test('deleting the app orphans every instance of it', () => {
+  const cards = {
+    app1: { output_id: 'app1' },
+    'app1#2': { output_id: 'app1' },
+    'app1#3': { output_id: 'app1' },
+  };
+  assert.deepEqual(orphanViewCardKeys(cards, {}), ['app1', 'app1#2', 'app1#3']);
+});
+
+test('one deleted app does not take a surviving app down with it', () => {
+  const cards = {
+    app1: { output_id: 'app1' },
+    'app1#2': { output_id: 'app1' },
+    app2: { output_id: 'app2' },
+  };
+  assert.deepEqual(orphanViewCardKeys(cards, { app2: { id: 'app2' } }), ['app1', 'app1#2']);
+});
+
+test('no cards means nothing to prune', () => {
+  assert.deepEqual(orphanViewCardKeys({}, { app1: app }), []);
+});
diff --git a/frontend/src/app/pages/Dashboard/hooks/lifecycle/orphanViewCardKeys.ts b/frontend/src/app/pages/Dashboard/hooks/lifecycle/orphanViewCardKeys.ts
new file mode 100644
index 00000000..e79c80f4
--- /dev/null
+++ b/frontend/src/app/pages/Dashboard/hooks/lifecycle/orphanViewCardKeys.ts
@@ -0,0 +1,11 @@
+// A view card's record key is the bare output id ONLY for the primary; every extra instance is
+// `${output_id}#N`. Reading the key as if it were an output id therefore pronounced every secondary
+// instance dead on arrival and swept it off the canvas. Always resolve through output_id.
+export function orphanViewCardKeys(
+  viewCards: Readonly<Record<string, { output_id: string }>>,
+  outputs: Readonly<Record<string, unknown>>,
+): string[] {
+  return Object.entries(viewCards)
+    .filter(([, card]) => !outputs[card.output_id])
+    .map(([cardKey]) => cardKey);
+}
diff --git a/frontend/src/app/pages/Dashboard/hooks/lifecycle/useDashboardCardActions.ts b/frontend/src/app/pages/Dashboard/hooks/lifecycle/useDashboardCardActions.ts
index 88c25191..a9482142 100644
--- a/frontend/src/app/pages/Dashboard/hooks/lifecycle/useDashboardCardActions.ts
+++ b/frontend/src/app/pages/Dashboard/hooks/lifecycle/useDashboardCardActions.ts
@@ -17,6 +17,9 @@ import type { CardType, useDashboardSelection } from '../state/useDashboardSelec
 import type { CanvasActions } from '../interaction/useCanvasControls';
 import { useSpawnPlacement } from './useSpawnPlacement';
 
+// Title bubble + cost line, the strip an expanded card floats above itself.
+const EXPANDED_HEADER_H = 64;
+
 type Selection = ReturnType<typeof useDashboardSelection>;
 
 interface UseDashboardCardActionsArgs {
@@ -111,18 +114,26 @@ export function useDashboardCardActions({
     const {
       cards: tidied, viewCards: tidiedViews, browserCards: tidiedBrowsers,
       workflowCards: tidiedWorkflows, workflowsHub: tidiedHub,
+      workflowsMonitorCard: tidiedMonitor, settingsCard: tidiedSettings,
     } = store.getState().dashboardLayout;
     const allRects = [
-      ...Object.values(tidied).map((c) => ({
-        x: c.x, y: c.y, width: c.width,
-        height: expandedSet.has(c.session_id) ? Math.max(EXPANDED_CARD_MIN_H, c.height) : c.height,
-      })),
+      ...Object.values(tidied).map((c) => {
+        // An expanded card wears its title bubble ABOVE its rect, so the camera has to be told about that strip or Tidy frames the card and beheads it.
+        const isExpanded = expandedSet.has(c.session_id);
+        const height = isExpanded ? Math.max(EXPANDED_CARD_MIN_H, c.height) : c.height;
+        return isExpanded
+          ? { x: c.x, y: c.y - EXPANDED_HEADER_H, width: c.width, height: height + EXPANDED_HEADER_H }
+          : { x: c.x, y: c.y, width: c.width, height };
+      }),
       ...Object.values(tidiedViews).map((c) => ({ x: c.x, y: c.y, width: c.width, height: c.height })),
       ...Object.values(tidiedBrowsers).map((c) => ({ x: c.x, y: c.y, width: c.width, height: c.height })),
       ...Object.values(tidiedWorkflows).map((c) => ({ x: c.x, y: c.y, width: c.width, height: c.height })),
-      ...(tidiedHub ? [{ x: tidiedHub.x, y: tidiedHub.y, width: tidiedHub.width, height: tidiedHub.height }] : []),
+      // The hub, the monitor and Settings get tidied into the grid too, so the camera has to know about them or it frames a stale box.
+      ...[tidiedHub, tidiedMonitor, tidiedSettings]
+        .filter((c): c is NonNullable<typeof c> => !!c)
+        .map((c) => ({ x: c.x, y: c.y, width: c.width, height: c.height })),
     ];
-    canvasActions.fitToCards(allRects);
+    canvasActions.fitTidy(allRects);
   }, [dispatch, canvasActions]);
 
   return {
diff --git a/frontend/src/app/pages/Dashboard/hooks/lifecycle/useDashboardLifecycle.ts b/frontend/src/app/pages/Dashboard/hooks/lifecycle/useDashboardLifecycle.ts
index 879d09b0..b5921356 100644
--- a/frontend/src/app/pages/Dashboard/hooks/lifecycle/useDashboardLifecycle.ts
+++ b/frontend/src/app/pages/Dashboard/hooks/lifecycle/useDashboardLifecycle.ts
@@ -23,6 +23,8 @@ import {
 } from '@/shared/state/dashboardLayoutSlice';
 import { fetchOutputs, type Output } from '@/shared/state/outputsSlice';
 import { generateDashboardName } from '@/shared/state/dashboardsSlice';
+import { isUserLaunchedSession } from '@/shared/state/isUserLaunchedSession';
+import { REVEAL_MIN_ZOOM } from '../../canvas/revealZoom';
 import { fetchWorkflows, fetchAllRuns, fetchActiveRuns } from '@/shared/state/workflowsSlice';
 import { fetchMissedRuns } from '@/shared/state/missedRunsSlice';
 import { fetchProviderHealth } from '@/shared/state/subscriptionsSlice';
@@ -31,6 +33,7 @@ import { initBrowserCommandHandler } from '@/shared/browserCommandHandler';
 import { getKeepAliveBrowserIds } from '@/shared/browserFocus';
 import { prepareDashboardSwitch } from '@/shared/dashboardSwitchTeardown';
 import { removeViewCardCleanly } from '@/shared/viewTeardown';
+import { orphanViewCardKeys } from './orphanViewCardKeys';
 import { clearPendingBrowserUrl, clearPendingFocusAgentId } from '@/shared/state/tempStateSlice';
 import { API_BASE } from '@/shared/config';
 import type { CanvasActions } from '../interaction/useCanvasControls';
@@ -187,7 +190,7 @@ export function useDashboardLifecycle({
     if (!layoutInitialized || hasFittedRef.current) return;
     if (pendingFocusAgentId) return;
     hasFittedRef.current = true;
-    const timer = setTimeout(() => canvasActions.fitToView(), 150);
+    const timer = setTimeout(() => canvasActions.fitToView(REVEAL_MIN_ZOOM), 150);
     return () => clearTimeout(timer);
   }, [isActive, layoutInitialized, canvasActions, pendingFocusAgentId]);
 
@@ -302,7 +305,7 @@ export function useDashboardLifecycle({
   useEffect(() => {
     if (!layoutInitialized) return;
     const dashboardSessionIds = Object.values(sessions)
-      .filter((s) => s.dashboard_id === dashboardId && !s.workflow_run_id && !s.workflow_edit_id && s.mode !== 'browser-agent' && s.mode !== 'invoked-agent' && s.mode !== 'sub-agent')
+      .filter((s) => s.dashboard_id === dashboardId && isUserLaunchedSession(s))
       .map((s) => s.id);
     const liveIds = dashboardSessionIds.sort().join(',');
     if (liveIds === prevSessionIdsRef.current) return;
@@ -313,7 +316,7 @@ export function useDashboardLifecycle({
   // Prune orphan view cards whose underlying output was deleted (e.g. via the Views page). Without this, the layout entry persists in the minimap and contentBounds even though DashboardViewCard renders nothing. Gated on outputsRefetched (THIS open's fresh fetch), NOT the sticky global outputsLoaded: on a freshly-imported dashboard the global flag is already true from a prior dashboard, so the old gate pruned the just-imported app card against a stale apps list and the debounced save persisted the wipe.
   useEffect(() => {
     if (!layoutInitialized || !outputsRefetched) return;
-    const orphans = Object.keys(viewCards).filter((id) => !outputs[id]);
+    const orphans = orphanViewCardKeys(viewCards, outputs);
     if (orphans.length === 0) return;
     // Serialize teardown (quiesce each GPU surface first): pruning several orphaned app cards in one
     // pass would rip their webviews out simultaneously, the same GPU-process SIGSEGV as mass delete.
diff --git a/frontend/src/app/pages/Dashboard/hooks/state/useDashboardSelection.ts b/frontend/src/app/pages/Dashboard/hooks/state/useDashboardSelection.ts
index d4ac7b09..5bda5ff6 100644
--- a/frontend/src/app/pages/Dashboard/hooks/state/useDashboardSelection.ts
+++ b/frontend/src/app/pages/Dashboard/hooks/state/useDashboardSelection.ts
@@ -244,22 +244,22 @@ export function useDashboardSelection(
     [screenToCanvas, computeMarqueeSelection],
   );
 
+  // Returns true when the release ended a real marquee DRAG, so the caller can tell a rubber-band
+  // gesture from a plain click without duplicating the threshold bookkeeping.
   const handleCanvasMouseUp = useCallback(
-    (e: MouseEvent) => {
+    (e: MouseEvent): boolean => {
       const origin = marqueeOriginRef.current;
-      if (!origin) return;
+      if (!origin) return false;
 
-      if (!isDraggingMarqueeRef.current) {
-        if (!e.shiftKey) {
-          deselectAll();
-        }
-      }
+      const dragged = isDraggingMarqueeRef.current;
+      if (!dragged && !e.shiftKey) deselectAll();
 
       marqueeOriginRef.current = null;
       isDraggingMarqueeRef.current = false;
       setMarquee(null);
       document.body.style.userSelect = '';
       document.body.classList.remove('dashboard-marquee-active');
+      return dragged;
     },
     [deselectAll],
   );
diff --git a/frontend/src/app/pages/Settings/SettingsAppCard.tsx b/frontend/src/app/pages/Settings/SettingsAppCard.tsx
index 19563dc5..e488227c 100644
--- a/frontend/src/app/pages/Settings/SettingsAppCard.tsx
+++ b/frontend/src/app/pages/Settings/SettingsAppCard.tsx
@@ -5,7 +5,7 @@ import {
   closeSettingsCard,
   setSettingsCardPosition,
   setSettingsCardSize,
-  toggleSettingsCardFullscreen,
+  toggleMinimizeCard,
   SETTINGS_CARD_ID,
 } from '@/shared/state/dashboardLayoutSlice';
 import type { CardType } from '@/shared/state/dashboardLayoutSlice';
@@ -43,7 +43,7 @@ const SettingsAppCard: React.FC<Props> = ({
 }) => {
   const c = useClaudeTokens();
   const dispatch = useAppDispatch();
-  const isFullscreen = useAppSelector((s) => !!s.dashboardLayout.settingsCard?.fullscreen);
+  const isMinimized = useAppSelector((s) => !!s.dashboardLayout.minimizedCards[SETTINGS_CARD_ID]);
 
   const commitPosition = useCallback((x: number, y: number) => {
     dispatch(setSettingsCardPosition({ x, y }));
@@ -52,6 +52,7 @@ const SettingsAppCard: React.FC<Props> = ({
     dispatch(setSettingsCardSize({ width, height }));
   }, [dispatch]);
   const close = useCallback(() => { dispatch(closeSettingsCard()); }, [dispatch]);
+  const minimize = useCallback(() => { dispatch(toggleMinimizeCard({ cardId: SETTINGS_CARD_ID })); }, [dispatch]);
 
   return (
     <CanvasWindowCard
@@ -64,7 +65,7 @@ const SettingsAppCard: React.FC<Props> = ({
       cardWidth={cardWidth}
       cardHeight={cardHeight}
       cardZOrder={cardZOrder}
-      fullscreen={isFullscreen}
+      minimized={isMinimized}
       minWidth={MIN_W}
       minHeight={MIN_H}
       background={c.bg.page}
@@ -81,7 +82,7 @@ const SettingsAppCard: React.FC<Props> = ({
       onCommitPosition={commitPosition}
       onCommitSize={commitSize}
     >
-      {({ header, onTileZone }) => (
+      {({ header, tileZone, onTileZone }) => (
         <>
           <div
             onPointerDown={header.onPointerDown}
@@ -102,17 +103,7 @@ const SettingsAppCard: React.FC<Props> = ({
               onClick={(e) => e.stopPropagation()}
               style={{ display: 'flex', alignItems: 'center' }}
             >
-              <WindowControls
-                onClose={close}
-                onMinimize={close}
-                onTile={(zone) => {
-                  if (zone === 'fullscreen' || zone === 'restore') { dispatch(toggleSettingsCardFullscreen()); return; }
-                  if (isFullscreen) dispatch(toggleSettingsCardFullscreen());
-                  onTileZone(zone);
-                }}
-                tiled={isFullscreen}
-                noTileMenu={isFullscreen}
-              />
+              <WindowControls onClose={close} onMinimize={minimize} onTile={onTileZone} tiled={!!tileZone} />
             </span>
             <div style={{ display: 'flex', alignItems: 'center', gap: 8 }}>
               <SettingsIcon sx={{ fontSize: 18, color: c.text.secondary, display: 'block' }} />
diff --git a/frontend/src/app/pages/Settings/sections/general/DictationModelPicker.tsx b/frontend/src/app/pages/Settings/sections/general/DictationModelPicker.tsx
new file mode 100644
index 00000000..35bd4150
--- /dev/null
+++ b/frontend/src/app/pages/Settings/sections/general/DictationModelPicker.tsx
@@ -0,0 +1,97 @@
+import React, { useCallback, useEffect, useState } from 'react';
+import Box from '@mui/material/Box';
+import MenuItem from '@mui/material/MenuItem';
+import Select from '@mui/material/Select';
+import LinearProgress from '@mui/material/LinearProgress';
+import Typography from '@mui/material/Typography';
+import type { VoiceModel } from '@/types/electron';
+import { useClaudeTokens } from '@/shared/styles/ThemeContext';
+
+// The speech model is the biggest speed/accuracy lever dictation has, so it is a real choice rather
+// than a hidden constant. Picking one that isn't downloaded yet starts the fetch and shows progress;
+// dictation keeps working on whatever model is already on disk until the new one lands.
+const DictationModelPicker: React.FC<{
+  value: string | null;
+  onChange: (id: string) => void;
+}> = ({ value, onChange }) => {
+  const c = useClaudeTokens();
+  const [models, setModels] = useState<VoiceModel[]>([]);
+  const [selected, setSelected] = useState<string>('');
+  const [pct, setPct] = useState<number>(0);
+  const [downloadingId, setDownloadingId] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+
+  const refresh = useCallback(async (): Promise<void> => {
+    const res = await window.openswarm?.voiceModels?.();
+    if (!res) return;
+    setModels(res.models);
+    setSelected(value || res.selected);
+  }, [value]);
+
+  useEffect(() => { void refresh(); }, [refresh]);
+
+  // Poll only while a download is actually running, so an idle Settings tab costs nothing.
+  useEffect(() => {
+    if (!downloadingId) return undefined;
+    let live = true;
+    const tick = async (): Promise<void> => {
+      const st = await window.openswarm?.voiceStatus?.();
+      if (!live) return;
+      if (!st) { setDownloadingId(null); return; }
+      setPct(st.pct || 0);
+      if (st.error) { setError(st.error); setDownloadingId(null); return; }
+      if (!st.downloading) { setDownloadingId(null); void refresh(); return; }
+      window.setTimeout(() => { void tick(); }, 700);
+    };
+    void tick();
+    return () => { live = false; };
+  }, [downloadingId, refresh]);
+
+  const pick = useCallback(async (id: string): Promise<void> => {
+    setSelected(id);
+    setError(null);
+    onChange(id);
+    const res = await window.openswarm?.voiceSetModel?.(id);
+    if (res && !res.ready) { setPct(0); setDownloadingId(id); }
+    else void refresh();
+  }, [onChange, refresh]);
+
+  if (!models.length) return null; // web build or no bridge: nothing to choose between
+
+  return (
+    <Box>
+      <Select
+        value={selected}
+        onChange={(e) => { void pick(String(e.target.value)); }}
+        size="small"
+        sx={{
+          minWidth: 230,
+          fontSize: '0.8125rem',
+          color: c.text.primary,
+          '& .MuiOutlinedInput-notchedOutline': { borderColor: c.border.subtle },
+        }}
+      >
+        {models.map((m) => (
+          <MenuItem key={m.id} value={m.id} sx={{ fontSize: '0.8125rem' }}>
+            {`${m.label} — ${m.sizeMb} MB${m.installed ? '' : ' (download)'}`}
+          </MenuItem>
+        ))}
+      </Select>
+      {downloadingId && (
+        <Box sx={{ mt: 1 }}>
+          <LinearProgress variant="determinate" value={pct} sx={{ height: 4, borderRadius: 2 }} />
+          <Typography sx={{ fontSize: '0.6875rem', color: c.text.tertiary, mt: 0.5 }}>
+            {`Downloading ${downloadingId}, ${pct}%`}
+          </Typography>
+        </Box>
+      )}
+      {error && (
+        <Typography sx={{ fontSize: '0.6875rem', color: c.status?.error ?? c.text.tertiary, mt: 0.5 }}>
+          {`Download failed (${error}). Pick it again to retry.`}
+        </Typography>
+      )}
+    </Box>
+  );
+};
+
+export default DictationModelPicker;
diff --git a/frontend/src/app/pages/Settings/sections/general/GeneralInterface.tsx b/frontend/src/app/pages/Settings/sections/general/GeneralInterface.tsx
index c66ea94e..9cc29ddc 100644
--- a/frontend/src/app/pages/Settings/sections/general/GeneralInterface.tsx
+++ b/frontend/src/app/pages/Settings/sections/general/GeneralInterface.tsx
@@ -15,6 +15,7 @@ import AccentColorPad from '@/app/components/theme/AccentColorPad';
 import type { SettingsStyles } from '../settingsStyles';
 import { settingSelectAttrs } from '../settingSelect';
 import ShortcutRecorderChip, { dictationDefaultCombo, comboDisplay } from './ShortcutRecorderChip';
+import DictationModelPicker from './DictationModelPicker';
 
 const GeneralInterface: React.FC<{
   form: AppSettings;
@@ -104,6 +105,17 @@ const GeneralInterface: React.FC<{
         />
       </Box>
 
+      <Box sx={inlineRowSx} {...settingSelectAttrs('dictation_model', 'Dictation model', 'Interface', 'Speech model used for dictation; bigger is more accurate but slower.')}>
+        <Box sx={{ mr: 3 }}>
+          <Typography sx={labelSx}>Dictation model</Typography>
+          <Typography sx={descSx}>Runs on this machine, nothing is uploaded. Bigger is more accurate but slower to transcribe.</Typography>
+        </Box>
+        <DictationModelPicker
+          value={form.dictation_model ?? null}
+          onChange={(id) => setForm({ ...form, dictation_model: id })}
+        />
+      </Box>
+
       <Box sx={rowSx} {...settingSelectAttrs('accent_color', 'Accent color', 'Interface', 'The accent color used across the app.')}>
         <Typography sx={labelSx}>Accent color</Typography>
         <Typography sx={{ ...descSx, mb: 1.5 }}>
diff --git a/frontend/src/app/pages/Settings/sections/subscription/SubscriptionCard.tsx b/frontend/src/app/pages/Settings/sections/subscription/SubscriptionCard.tsx
index 5aaba333..9ee724c3 100644
--- a/frontend/src/app/pages/Settings/sections/subscription/SubscriptionCard.tsx
+++ b/frontend/src/app/pages/Settings/sections/subscription/SubscriptionCard.tsx
@@ -6,25 +6,42 @@ import CircularProgress from '@mui/material/CircularProgress';
 import { useClaudeTokens } from '@/shared/styles/ThemeContext';
 import type { SubscriptionProvider } from './subscriptionProviders';
 
-const SubscriptionCard: React.FC<{ provider: SubscriptionProvider; connected: boolean; onConnect: () => void; onDisconnect: () => void; connecting: boolean; userCode?: string; disconnecting?: boolean }> = ({ provider, connected, onConnect, onDisconnect, connecting, userCode, disconnecting }) => {
+interface Props {
+  provider: SubscriptionProvider;
+  connected: boolean;
+  connecting: boolean;
+  confirmingDisconnect: boolean;
+  disconnecting: boolean;
+  error?: string;
+  userCode?: string;
+  onConnect: () => void;
+  onRequestDisconnect: () => void;
+  onCancelDisconnect: () => void;
+  onDisconnect: () => void;
+}
+
+const SubscriptionCard: React.FC<Props> = ({
+  provider, connected, connecting, confirmingDisconnect, disconnecting, error, userCode,
+  onConnect, onRequestDisconnect, onCancelDisconnect, onDisconnect,
+}) => {
   const c = useClaudeTokens();
-  const isPreview = (provider as any).preview;
   const dotColor = connected ? c.status.success : connecting ? c.accent.primary : c.border.medium;
+  const linkButton = {
+    border: 'none', background: 'transparent', p: 0, cursor: 'pointer',
+    fontFamily: 'inherit', fontSize: '0.6875rem', transition: 'color 0.15s ease',
+  } as const;
 
   return (
     <Box sx={{
       p: 1.5, borderRadius: `${c.radius.md}px`,
       border: `1px solid ${connected ? c.status.success + '30' : connecting ? c.accent.primary + '30' : c.border.subtle}`,
       bgcolor: connected ? `${c.status.success}06` : connecting ? `${c.accent.primary}06` : 'transparent',
-      opacity: isPreview ? 0.5 : 1,
+      opacity: provider.preview ? 0.5 : 1,
       transition: c.transition,
-      '&:hover': isPreview ? {} : {
+      '&:hover': provider.preview ? {} : {
         borderColor: connected ? c.status.success + '4d' : c.border.medium,
         boxShadow: c.shadow.sm,
       },
-      // affirm "Connected" at rest, reveal "Disconnect" on hover so the undo never shouts
-      '&:hover .sub-rest': { opacity: 0 },
-      '&:hover .sub-undo': { opacity: 1, pointerEvents: 'auto' },
     }}>
       <Box sx={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 1 }}>
         <Box sx={{ display: 'flex', alignItems: 'center', gap: 1, minWidth: 0 }}>
@@ -44,21 +61,32 @@ const SubscriptionCard: React.FC<{ provider: SubscriptionProvider; connected: bo
           </Box>
         </Box>
 
-        {isPreview ? (
+        {provider.preview ? (
           <Typography sx={{ fontSize: '0.625rem', color: c.text.ghost, fontStyle: 'italic', flexShrink: 0 }}>
             Coming soon
           </Typography>
         ) : connected ? (
           disconnecting ? (
-            <CircularProgress size={14} sx={{ color: c.text.ghost }} />
-          ) : (
-            <Box sx={{ position: 'relative', flexShrink: 0, minWidth: 72, height: 16 }}>
-              <Typography className="sub-rest" sx={{ position: 'absolute', right: 0, top: 0, fontSize: '0.6875rem', fontWeight: 500, color: c.status.success, transition: 'opacity 0.18s ease' }}>
-                Connected
-              </Typography>
-              <Typography className="sub-undo" onClick={onDisconnect} sx={{ position: 'absolute', right: 0, top: 0, fontSize: '0.6875rem', color: c.text.tertiary, cursor: 'pointer', opacity: 0, pointerEvents: 'none', transition: 'opacity 0.18s ease', '&:hover': { color: c.status.error } }}>
+            <Box sx={{ display: 'flex', alignItems: 'center', gap: 0.8, flexShrink: 0 }}>
+              <CircularProgress size={14} sx={{ color: c.text.ghost }} />
+              <Typography sx={{ fontSize: '0.6875rem', color: c.text.muted }}>Disconnecting...</Typography>
+            </Box>
+          ) : confirmingDisconnect ? (
+            <Box sx={{ display: 'flex', alignItems: 'center', gap: 1.25, flexShrink: 0 }}>
+              <Typography sx={{ fontSize: '0.6875rem', color: c.text.secondary }}>Disconnect?</Typography>
+              <Box component="button" type="button" onClick={onCancelDisconnect} sx={{ ...linkButton, color: c.text.tertiary, '&:hover': { color: c.text.primary } }}>
+                Cancel
+              </Box>
+              <Box component="button" type="button" onClick={onDisconnect} sx={{ ...linkButton, color: c.status.error, fontWeight: 600, '&:hover': { opacity: 0.75 } }}>
                 Disconnect
-              </Typography>
+              </Box>
+            </Box>
+          ) : (
+            <Box sx={{ display: 'flex', alignItems: 'center', gap: 1.25, flexShrink: 0 }}>
+              <Typography sx={{ fontSize: '0.6875rem', fontWeight: 500, color: c.status.success }}>Connected</Typography>
+              <Box component="button" type="button" onClick={onRequestDisconnect} sx={{ ...linkButton, color: c.text.tertiary, '&:hover': { color: c.status.error } }}>
+                Disconnect
+              </Box>
             </Box>
           )
         ) : connecting && userCode ? (
@@ -77,6 +105,12 @@ const SubscriptionCard: React.FC<{ provider: SubscriptionProvider; connected: bo
           </Button>
         )}
       </Box>
+
+      {error && (
+        <Typography sx={{ mt: 0.75, fontSize: '0.625rem', color: c.status.error, lineHeight: 1.4 }}>
+          {error}
+        </Typography>
+      )}
     </Box>
   );
 };
diff --git a/frontend/src/app/pages/Settings/sections/subscription/SubscriptionCards.tsx b/frontend/src/app/pages/Settings/sections/subscription/SubscriptionCards.tsx
index 8e5e1976..d5a6d76d 100644
--- a/frontend/src/app/pages/Settings/sections/subscription/SubscriptionCards.tsx
+++ b/frontend/src/app/pages/Settings/sections/subscription/SubscriptionCards.tsx
@@ -11,12 +11,24 @@ import {
   setSubscriptionStatus,
   markSubscriptionConnected,
   selectSubscriptionConnections,
+  type SubscriptionConnection,
 } from '@/shared/state/subscriptionsSlice';
 import { API_BASE } from '@/shared/config';
 import { SUBSCRIPTION_PROVIDERS } from './subscriptionProviders';
 import SubscriptionCard from './SubscriptionCard';
 import { runConnectFlow } from './subscriptionConnect';
 
+/** What POST /agents/subscriptions/disconnect answers; `ok` is the backend's verified end state, never a guess. */
+interface DisconnectResponse {
+  ok?: boolean;
+  removed?: number;
+  error?: string;
+}
+
+function isProviderActive(connections: SubscriptionConnection[], providerId: string): boolean {
+  return connections.some((p) => p.provider === providerId && (p.isActive || p.testStatus === 'active'));
+}
+
 function friendlyConnectError(detail: string): string {
   const d = (detail || '').trim();
   const lower = d.toLowerCase();
@@ -36,6 +48,8 @@ const SubscriptionCards: React.FC = () => {
   const connections = useAppSelector(selectSubscriptionConnections);
   const [connecting, setConnecting] = useState<string | null>(null);
   const [disconnecting, setDisconnecting] = useState<string | null>(null);
+  const [confirmingDisconnect, setConfirmingDisconnect] = useState<string | null>(null);
+  const [disconnectError, setDisconnectError] = useState<{ provider: string; message: string } | null>(null);
   const [userCode, setUserCode] = useState('');
   const [pollTimer, setPollTimer] = useState<any>(null);
   const [connectError, setConnectError] = useState<string | null>(null);
@@ -70,15 +84,18 @@ const SubscriptionCards: React.FC = () => {
     return () => { cancelled = true; clearInterval(interval); };
   }, [fetchStatus]);
 
-  const isConnected = (providerId: string) =>
-    connections.some(
-      (p: any) =>
-        p.provider === providerId && (p.isActive || p.testStatus === 'active'),
-    );
+  const isConnected = (providerId: string) => isProviderActive(connections, providerId);
+
+  // A pending confirm on a lane that died some other way (reconnect, cascade wipe) would pop back on reconnect.
+  useEffect(() => {
+    if (confirmingDisconnect && !isProviderActive(connections, confirmingDisconnect)) setConfirmingDisconnect(null);
+  }, [confirmingDisconnect, connections]);
 
   const handleConnect = async (providerId: string) => {
     if (pollTimer) { clearInterval(pollTimer); setPollTimer(null); }
     setConnectError(null);
+    setConfirmingDisconnect(null);
+    setDisconnectError(null);
     setConnecting(providerId);
     setUserCode('');
 
@@ -105,20 +122,27 @@ const SubscriptionCards: React.FC = () => {
   };
 
   const handleDisconnect = async (providerId: string) => {
+    if (disconnecting) return;
+    setConfirmingDisconnect(null);
+    setDisconnectError(null);
     setDisconnecting(providerId);
+    // No settle delay: the backend only answers ok after re-reading 9Router, so the lane is already gone.
     try {
-      await fetch(`${API_BASE}/agents/subscriptions/disconnect`, {
+      const r = await fetch(`${API_BASE}/agents/subscriptions/disconnect`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ provider: providerId }),
       });
-    } catch {}
-    // Wait briefly for 9Router to process, then refresh subscription status + model picker.
-    setTimeout(() => {
-      fetchStatus();
-      refreshPickerModels();
-      setDisconnecting(null);
-    }, 500);
+      const data = (await r.json().catch(() => ({}))) as DisconnectResponse;
+      if (!r.ok || !data.ok) {
+        setDisconnectError({ provider: providerId, message: data.error || 'Could not disconnect. Please try again.' });
+      }
+    } catch {
+      setDisconnectError({ provider: providerId, message: 'Could not reach OpenSwarm. Please try again.' });
+    }
+    await fetchStatus();
+    refreshPickerModels();
+    setDisconnecting(null);
   };
 
   // 4s safety-net poller while connecting; clears Connecting state whenever 9Router reports the provider isActive (handles Windows postMessage failures).
@@ -206,9 +230,13 @@ const SubscriptionCards: React.FC = () => {
           provider={p}
           connected={isConnected(p.id)}
           onConnect={() => handleConnect(p.id)}
+          onRequestDisconnect={() => { setDisconnectError(null); setConfirmingDisconnect(p.id); }}
+          onCancelDisconnect={() => setConfirmingDisconnect(null)}
           onDisconnect={() => handleDisconnect(p.id)}
           connecting={connecting === p.id}
+          confirmingDisconnect={confirmingDisconnect === p.id}
           disconnecting={disconnecting === p.id}
+          error={disconnectError?.provider === p.id ? disconnectError.message : undefined}
           userCode={connecting === p.id ? userCode : undefined}
         />
       ))}
diff --git a/frontend/src/app/pages/Skills/CommunitySkillsDialog.tsx b/frontend/src/app/pages/Skills/CommunitySkillsDialog.tsx
index 22f6fc49..cb4398a5 100644
--- a/frontend/src/app/pages/Skills/CommunitySkillsDialog.tsx
+++ b/frontend/src/app/pages/Skills/CommunitySkillsDialog.tsx
@@ -12,6 +12,7 @@ import CircularProgress from '@mui/material/CircularProgress';
 import Alert from '@mui/material/Alert';
 import InputAdornment from '@mui/material/InputAdornment';
 import SearchIcon from '@mui/icons-material/Search';
+import { EmptyState } from '@/app/components/feedback/Loading';
 import OpenInNewIcon from '@mui/icons-material/OpenInNew';
 import WarningAmberIcon from '@mui/icons-material/WarningAmber';
 import { useClaudeTokens } from '@/shared/styles/ThemeContext';
@@ -132,9 +133,7 @@ const CommunitySkillsDialog: React.FC<Props> = ({ open, onClose, onInstalled })
             />
             {loading && <Box sx={{ display: 'flex', justifyContent: 'center', py: 3 }}><CircularProgress size={22} /></Box>}
             {!loading && results.length === 0 && (
-              <Typography sx={{ fontSize: '0.8125rem', color: c.text.tertiary, textAlign: 'center', py: 3 }}>
-                {query.trim() ? 'No matching skills.' : 'Type to search the community registry.'}
-              </Typography>
+              <EmptyState title={query.trim() ? 'No matching skills.' : 'Type to search the community registry.'} />
             )}
             {!loading && results.map((s) => (
               <Box key={`${s.source}/${s.skillId}`}
diff --git a/frontend/src/app/pages/Views/HistoryPanel.tsx b/frontend/src/app/pages/Views/HistoryPanel.tsx
index 4280046e..8100a3f2 100644
--- a/frontend/src/app/pages/Views/HistoryPanel.tsx
+++ b/frontend/src/app/pages/Views/HistoryPanel.tsx
@@ -8,6 +8,7 @@ import Fade from '@mui/material/Fade';
 import RestoreIcon from '@mui/icons-material/Restore';
 import ContentCopyIcon from '@mui/icons-material/ContentCopy';
 import HistoryIcon from '@mui/icons-material/History';
+import { EmptyState } from '@/app/components/feedback/Loading';
 import BookmarkAddOutlinedIcon from '@mui/icons-material/BookmarkAddOutlined';
 import { useAppDispatch, useAppSelector } from '@/shared/hooks';
 import { useClaudeTokens } from '@/shared/styles/ThemeContext';
@@ -162,12 +163,11 @@ const HistoryPanel: React.FC<Props> = ({ outputId, isAgentActive, saveLabel, onB
             <CircularProgress size={22} sx={{ color: c.text.tertiary }} />
           </Box>
         ) : versions.length === 0 ? (
-          <Box sx={{ textAlign: 'center', pt: 6, px: 2 }}>
-            <HistoryIcon sx={{ fontSize: 34, color: c.text.tertiary, opacity: 0.5, mb: 1 }} />
-            <Typography sx={{ fontSize: '0.875rem', color: c.text.muted, lineHeight: 1.5 }}>
-              No history yet. Every time you change your app, we'll save a snapshot here so you can go back.
-            </Typography>
-          </Box>
+          <EmptyState
+            icon={<HistoryIcon sx={{ fontSize: 32 }} />}
+            title="No history yet"
+            hint="Every time you change your app, we'll save a snapshot here so you can go back."
+          />
         ) : (
           <>
             <Box sx={{ display: 'flex', alignItems: 'center', gap: 1, py: 1 }}>
diff --git a/frontend/src/app/pages/Workflows/SchedulePopover.tsx b/frontend/src/app/pages/Workflows/SchedulePopover.tsx
index 48e8b6b4..5d83fc1a 100644
--- a/frontend/src/app/pages/Workflows/SchedulePopover.tsx
+++ b/frontend/src/app/pages/Workflows/SchedulePopover.tsx
@@ -31,6 +31,7 @@ interface Props {
   historyQuery: string;
   onHistoryQueryChange: (q: string) => void;
   onHistorySelect: (id: string) => void;
+  onHistoryContextMenu?: (e: React.MouseEvent, entry: { id: string; name: string }) => void;
   onNewChat: () => void;
   onWorkflowSelect: (id: string) => void;
   onExpand: () => void;
@@ -50,7 +51,7 @@ interface Props {
 
 export default function SchedulePopover({
   mode, onModeChange, historyResults, historyLoading, historyQuery, onHistoryQueryChange,
-  onHistorySelect, onNewChat, onWorkflowSelect, onExpand,
+  onHistorySelect, onHistoryContextMenu, onNewChat, onWorkflowSelect, onExpand,
   allRuns, allRunsLoading, onRunOpen, workflowTitleFor,
   historyScrollRef, onHistoryScroll,
   hideTopChrome = false,
@@ -98,12 +99,9 @@ export default function SchedulePopover({
   // Both Search and Schedule modes render at the same fixed dimensions so toggling chips doesn't resize the popover. Schedule sets the floor: its 7-day calendar needs ~620w x ~420h, search inherits the same.
   const POPOVER_W = 620;
   const CONTENT_H = 420;
-
   return (
     <Box sx={{ display: 'flex', flexDirection: 'column', width: POPOVER_W, maxWidth: POPOVER_W, gap: 0.75, flexShrink: 0 }}>
-      {/* Floating mode chips. Hidden when the parent toolbar supplies its
-          own pill row (Image #32 / #54); kept around so the legacy callers
-          that surface Schedule mode still have a way in. */}
+      {/* Floating mode chips. Hidden when the parent toolbar supplies its own pill row; kept for legacy callers that surface Schedule mode. */}
       {!hideTopChrome && (
         <Box sx={{ display: 'flex', alignItems: 'center', gap: 0.6, px: 0.5 }}>
           <ModeChip label="Search" icon={<SearchIcon sx={{ fontSize: 14 }} />} active={mode === 'search'} onClick={() => onModeChange('search')} />
@@ -175,7 +173,7 @@ export default function SchedulePopover({
                     {bucket !== prevBucket && (
                       <Typography sx={{ px: 1, pt: idx === 0 ? 0.75 : 1.5, pb: 0.5, fontSize: '0.6563rem', fontWeight: 600, letterSpacing: '0.06em', textTransform: 'uppercase', color: c.text.ghost }}>{bucket}</Typography>
                     )}
-                    <Box onClick={() => onHistorySelect(entry.id)} sx={{ display: 'flex', alignItems: 'center', gap: 1, px: 1, py: 0.8, cursor: 'pointer', borderRadius: `${c.radius.md}px`, '&:hover': { bgcolor: c.bg.elevated } }}>
+                    <Box onClick={() => onHistorySelect(entry.id)} onContextMenu={(e: React.MouseEvent) => onHistoryContextMenu?.(e, entry)} sx={{ display: 'flex', alignItems: 'center', gap: 1, px: 1, py: 0.8, cursor: 'pointer', borderRadius: `${c.radius.md}px`, '&:hover': { bgcolor: c.bg.elevated } }}>
                       <Box sx={{ display: 'inline-flex', alignItems: 'center', justifyContent: 'center', width: 24, height: 24, borderRadius: '7px', bgcolor: c.bg.elevated, color: c.text.muted, flexShrink: 0 }}>
                         <ChatBubbleOutlineIcon sx={{ fontSize: 13 }} />
                       </Box>
diff --git a/frontend/src/app/pages/Workflows/WorkflowNoticeToast.tsx b/frontend/src/app/pages/Workflows/WorkflowNoticeToast.tsx
new file mode 100644
index 00000000..7c4ab5d1
--- /dev/null
+++ b/frontend/src/app/pages/Workflows/WorkflowNoticeToast.tsx
@@ -0,0 +1,38 @@
+// The server's own words when it refuses something the user asked for. Today that is a delete the
+// cloud would not let go of; without it the card simply stays put and the click looks broken.
+
+import React from 'react';
+import Snackbar from '@mui/material/Snackbar';
+import Alert from '@mui/material/Alert';
+import { useClaudeTokens } from '@/shared/styles/ThemeContext';
+import { useAppDispatch, useAppSelector } from '@/shared/hooks';
+import { dismissNoticeToast } from '@/shared/state/workflowsSlice';
+
+export default function WorkflowNoticeToast() {
+  const c = useClaudeTokens();
+  const dispatch = useAppDispatch();
+  const notice = useAppSelector((s) => s.workflows.noticeToast);
+
+  return (
+    <Snackbar
+      open={Boolean(notice)}
+      autoHideDuration={9000}
+      onClose={(_, reason) => { if (reason !== 'clickaway') dispatch(dismissNoticeToast()); }}
+      anchorOrigin={{ vertical: 'bottom', horizontal: 'left' }}
+    >
+      <Alert
+        icon={false}
+        severity="warning"
+        onClose={() => dispatch(dismissNoticeToast())}
+        sx={{
+          bgcolor: c.bg.surface,
+          color: c.text.primary,
+          border: `1px solid ${c.border.medium}`,
+          maxWidth: 420,
+        }}
+      >
+        {notice}
+      </Alert>
+    </Snackbar>
+  );
+}
diff --git a/frontend/src/app/pages/Workflows/app/CloudRunSection.tsx b/frontend/src/app/pages/Workflows/app/CloudRunSection.tsx
new file mode 100644
index 00000000..13736877
--- /dev/null
+++ b/frontend/src/app/pages/Workflows/app/CloudRunSection.tsx
@@ -0,0 +1,174 @@
+import React from 'react';
+import type { CSSProperties } from 'react';
+import { useAppDispatch } from '@/shared/hooks';
+import { openSettingsCard } from '@/shared/state/dashboardLayoutSlice';
+import type { Workflow } from '@/shared/state/workflowsSlice';
+import { useWC } from './uiKit';
+import type { WCPalette } from './uiKit';
+import { clockOf, relativeDayLabel } from './model';
+import { cloudAvailability, usageText } from './cloudAvailability';
+import type { CloudProbe } from './cloudAvailability';
+import type { HostedState } from './cloudApi';
+import type { CloudStatusHandle } from './useCloudStatus';
+
+const CLOUD_PATH = 'M17.5 19a4.5 4.5 0 0 0 .5-8.97A6 6 0 0 0 6.2 10.5 4 4 0 0 0 6.5 19z';
+
+function hostedOf(probe: CloudProbe) {
+  if (probe.phase !== 'answered' || probe.status.state !== 'ready') return null;
+  return probe.status.hosted;
+}
+
+// The cloud's own clock, printed from the answer we just fetched; our mirrored copy only moves on a probe.
+function nextCloudRunText(hosted: HostedState): string {
+  if (!hosted.enabled) return 'Paused in the cloud';
+  if (!hosted.next_run_at) return 'No cloud run scheduled';
+  const at = new Date(hosted.next_run_at);
+  return `Next cloud run ${relativeDayLabel(at)} at ${clockOf(at)}`;
+}
+
+const Bullet: React.FC<{ wc: WCPalette; accent?: boolean; children: React.ReactNode }> = ({ wc, accent, children }) => (
+  <div style={{ marginTop: 9, display: 'flex', alignItems: 'center', gap: 8 }}>
+    <div style={{ width: 14, display: 'flex', justifyContent: 'center', flex: 'none' }}>
+      <div style={{ width: 6, height: 6, borderRadius: '50%', background: accent ? wc.accent : wc.muted }} />
+    </div>
+    <span style={{ fontSize: 12.5, color: wc.ink4 }}>{children}</span>
+  </div>
+);
+
+const Note: React.FC<{ wc: WCPalette; tone: 'quiet' | 'warn'; children: React.ReactNode }> = ({ wc, tone, children }) => (
+  <div
+    style={{
+      display: 'flex', alignItems: 'flex-start', gap: 8, marginTop: 9, padding: '8px 10px', borderRadius: 8,
+      background: tone === 'warn' ? `${wc.warn}14` : `rgba(${wc.inkRGB},0.04)`,
+      border: `1px solid ${tone === 'warn' ? `${wc.warn}40` : 'transparent'}`,
+      fontSize: 11.5, lineHeight: 1.45, color: wc.ink4,
+    }}
+  >
+    {children}
+  </div>
+);
+
+const CloudRunSection: React.FC<{ workflow: Workflow; cloud: CloudStatusHandle }> = ({ workflow, cloud }) => {
+  const WC = useWC();
+  const dispatch = useAppDispatch();
+  const availability = cloudAvailability(cloud.probe);
+  const hosted = hostedOf(cloud.probe);
+  const target = cloud.probe.phase === 'answered' ? cloud.probe.status.target : workflow.execution_target ?? 'device';
+  const onCloud = target === 'cloud';
+  const usage = usageText(cloud.probe, availability);
+  const canPickCloud = availability.kind === 'available' && !cloud.pending;
+
+  const seg = (active: boolean, enabled: boolean): CSSProperties => ({
+    flex: 1, padding: '6px 2px', borderRadius: 7, border: 'none', fontSize: 11.5, fontWeight: 600,
+    cursor: enabled ? 'pointer' : 'default',
+    background: active ? WC.paper : 'transparent',
+    color: active ? WC.ink : enabled ? WC.muted : WC.faint,
+    boxShadow: active ? WC.shadow.sm : 'none',
+  });
+
+  const link: CSSProperties = {
+    background: 'none', border: 'none', padding: 0, marginLeft: 4, cursor: 'pointer',
+    color: WC.accent, fontSize: 11.5, fontWeight: 600, textDecoration: 'underline',
+  };
+
+  return (
+    <div style={{ marginTop: 13, paddingTop: 13, borderTop: `1px solid ${WC.line}` }}>
+      <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 10 }}>
+        <span style={{ display: 'flex', alignItems: 'center', gap: 8, fontSize: 13, color: WC.ink3 }}>
+          <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke={WC.muted} strokeWidth="1.8" style={{ flex: 'none' }}><path d={CLOUD_PATH} /></svg>
+          Runs on
+        </span>
+        <div style={{ display: 'flex', width: 186, background: WC.inset, border: `1px solid ${WC.line}`, borderRadius: 9, padding: 3, gap: 2 }}>
+          <button
+            onClick={() => { if (onCloud && !cloud.pending) cloud.choose('device', workflow.schedule.enabled); }}
+            style={seg(!onCloud, !cloud.pending)}
+          >
+            This device
+          </button>
+          <button
+            onClick={() => { if (!onCloud && canPickCloud) cloud.choose('cloud', workflow.schedule.enabled); }}
+            style={seg(onCloud, canPickCloud)}
+            title={availability.kind === 'blocked' ? availability.reason : undefined}
+          >
+            Cloud
+          </button>
+        </div>
+      </div>
+
+      {cloud.pending && <Note wc={WC} tone="quiet">Talking to the cloud…</Note>}
+
+      {/* A refusal used to swallow every other branch, including the one holding the upgrade link, so being told you need Pro removed the way to get Pro. Carry the action through. */}
+      {!cloud.pending && cloud.refusal && (
+        <Note wc={WC} tone="warn">
+          <span>
+            {cloud.refusal}
+            {availability.kind === 'blocked' && availability.action === 'sign_in' && (
+              <button onClick={() => dispatch(openSettingsCard())} style={link}>Sign in</button>
+            )}
+            {availability.kind === 'blocked' && availability.action === 'plans' && (
+              <button onClick={() => dispatch(openSettingsCard())} style={link}>See plans</button>
+            )}
+            <button onClick={cloud.retry} style={link}>Try again</button>
+          </span>
+        </Note>
+      )}
+
+      {!cloud.pending && !cloud.refusal && availability.kind === 'checking' && (
+        <Note wc={WC} tone="quiet">Checking what your account allows…</Note>
+      )}
+
+      {!cloud.pending && !cloud.refusal && availability.kind === 'unknown' && (
+        <Note wc={WC} tone="warn">
+          <span>
+            Can&apos;t reach the cloud, so we can&apos;t tell whether this can run there.
+            {onCloud
+              ? ' It stays scheduled in the cloud; nothing changed.'
+              : ' This workflow still runs on this device.'}
+            <button onClick={cloud.refresh} style={link}>Try again</button>
+          </span>
+        </Note>
+      )}
+
+      {!cloud.pending && !cloud.refusal && availability.kind === 'blocked' && (
+        <Note wc={WC} tone="quiet">
+          <span>
+            {availability.reason}
+            {availability.action === 'sign_in' && (
+              <button onClick={() => dispatch(openSettingsCard())} style={link}>Sign in</button>
+            )}
+            {availability.action === 'plans' && (
+              <button onClick={() => dispatch(openSettingsCard())} style={link}>See plans</button>
+            )}
+          </span>
+        </Note>
+      )}
+
+      {!cloud.pending && !cloud.refusal && availability.kind === 'available' && !onCloud && (
+        <Note wc={WC} tone="quiet">Cloud runs fire on our servers, so they still happen with this app closed.</Note>
+      )}
+
+      {!cloud.pending && onCloud && hosted === null && cloud.probe.phase === 'answered' && cloud.probe.status.state === 'ready' && (
+        <Note wc={WC} tone="warn">
+          <span>
+            This is set to run in the cloud, but the cloud has no copy of it, so nothing is running it.
+            <button onClick={() => cloud.choose('device', workflow.schedule.enabled)} style={link}>Move it back here</button>
+          </span>
+        </Note>
+      )}
+
+      {!cloud.pending && onCloud && hosted && !hosted.in_sync && (
+        <Note wc={WC} tone="warn">
+          <span>
+            The cloud is still running the version you sent it. Your later edits are not up there yet.
+            <button onClick={() => cloud.choose('cloud', workflow.schedule.enabled)} style={link}>Send the current version</button>
+          </span>
+        </Note>
+      )}
+
+      {onCloud && hosted && <Bullet wc={WC} accent>{nextCloudRunText(hosted)}</Bullet>}
+      {usage && <Bullet wc={WC}>{usage}</Bullet>}
+    </div>
+  );
+};
+
+export default CloudRunSection;
diff --git a/frontend/src/app/pages/Workflows/app/HistoryCard.tsx b/frontend/src/app/pages/Workflows/app/HistoryCard.tsx
index aafaafc3..5cc60bfd 100644
--- a/frontend/src/app/pages/Workflows/app/HistoryCard.tsx
+++ b/frontend/src/app/pages/Workflows/app/HistoryCard.tsx
@@ -3,36 +3,88 @@ import { useAppDispatch, useAppSelector } from '@/shared/hooks';
 import { fetchRuns } from '@/shared/state/workflowsSlice';
 import { openWorkflowMonitor } from '@/shared/state/dashboardLayoutSlice';
 import { useWC, FONT_SERIF, statusChip, statusDot, statusLabel } from './uiKit';
+import type { WCPalette } from './uiKit';
 import { toRunRow, whenText } from './model';
+import { useCloudRuns } from './useCloudRuns';
+import { toCloudHistoryRow } from './cloudRunRow';
+import type { CloudHistoryRow } from './cloudRunRow';
+
+interface Entry extends CloudHistoryRow {
+  where: 'device' | 'cloud';
+  open?: () => void;
+}
+
+const Row: React.FC<{ entry: Entry; wc: WCPalette; now: Date }> = ({ entry, wc, now }) => (
+  <div
+    onClick={entry.open}
+    title={entry.open ? 'Open this run' : undefined}
+    style={{ display: 'flex', alignItems: 'center', gap: 11, padding: '9px 0', borderBottom: `1px solid rgba(${wc.inkRGB},0.05)`, cursor: entry.open ? 'pointer' : 'default' }}
+  >
+    <div style={statusDot(entry.tone, wc)} />
+    <div style={{ flex: 1, minWidth: 0 }}>
+      {/* Why a run did not happen is a sentence, not a label, so let it wrap rather than ellipsing the part that answers the question. */}
+      <div title={entry.summary} style={{ fontSize: 12.5, color: wc.ink2, overflow: 'hidden', display: '-webkit-box', WebkitBoxOrient: 'vertical', WebkitLineClamp: 3 }}>{entry.summary}</div>
+      <div style={{ fontFamily: "'JetBrains Mono',monospace", fontSize: 10.5, color: wc.muted2, marginTop: 2 }}>
+        {[entry.where === 'cloud' ? 'Cloud' : null, whenText(entry.when, now), entry.durationText, entry.costText]
+          .filter(Boolean)
+          .join(' · ')}
+      </div>
+    </div>
+    <span style={statusChip(entry.tone, wc)}>{entry.label}</span>
+  </div>
+);
 
 const HistoryCard: React.FC<{ workflowId: string; title: string }> = ({ workflowId, title }) => {
   const WC = useWC();
   const dispatch = useAppDispatch();
   const runs = useAppSelector((s) => s.workflows.runs[workflowId]);
+  const workflow = useAppSelector((s) => s.workflows.items[workflowId]);
+  const onCloud = workflow?.execution_target === 'cloud';
+  const cloudRuns = useCloudRuns(workflowId, onCloud, workflow?.updated_at ?? '');
 
   useEffect(() => { dispatch(fetchRuns(workflowId)); }, [workflowId, dispatch]);
 
-  const rows = (runs || []).slice(0, 8).map((r) => toRunRow(r, title));
+  const local: Entry[] = (runs || []).map((r) => {
+    const row = toRunRow(r, title);
+    return {
+      id: row.id,
+      label: statusLabel(row.status),
+      tone: row.status,
+      summary: row.summary,
+      when: row.when,
+      durationText: row.durationText,
+      costText: '',
+      where: 'device',
+      open: () => dispatch(openWorkflowMonitor({ workflowId, runId: row.id })),
+    };
+  });
+  const remote: Entry[] =
+    cloudRuns.phase === 'answered' && cloudRuns.response.state === 'ready'
+      ? cloudRuns.response.runs.map((r) => ({ ...toCloudHistoryRow(r, title), where: 'cloud' as const }))
+      : [];
+  const rows = [...local, ...remote]
+    .sort((a, b) => (b.when?.getTime() ?? 0) - (a.when?.getTime() ?? 0))
+    .slice(0, 8);
+
+  // A history we could not load is not an empty history, and must never be drawn as one.
+  const cloudBlind =
+    onCloud && (cloudRuns.phase === 'checking' || (cloudRuns.phase === 'answered' && cloudRuns.response.state !== 'ready'));
   const now = new Date();
 
   return (
     <div style={{ background: WC.paper, border: `1px solid rgba(${WC.inkRGB},0.08)`, borderRadius: WC.radius.lg, padding: 16 }}>
       <div style={{ fontFamily: FONT_SERIF, fontSize: 16, fontWeight: 500, color: WC.ink, marginBottom: 12 }}>History</div>
-      {rows.length === 0 && <div style={{ fontSize: 12.5, color: WC.muted2 }}>No runs yet.</div>}
+      {rows.length === 0 && !cloudBlind && <div style={{ fontSize: 12.5, color: WC.muted2 }}>No runs yet.</div>}
       <div style={{ display: 'flex', flexDirection: 'column' }}>
-        {rows.map((r) => (
-          <div key={r.id} onClick={() => dispatch(openWorkflowMonitor({ workflowId, runId: r.id }))} title="Open this run" style={{ display: 'flex', alignItems: 'center', gap: 11, padding: '9px 0', borderBottom: `1px solid rgba(${WC.inkRGB},0.05)`, cursor: 'pointer' }}>
-            <div style={statusDot(r.status, WC)} />
-            <div style={{ flex: 1, minWidth: 0 }}>
-              <div style={{ fontSize: 12.5, color: WC.ink2, whiteSpace: 'nowrap', overflow: 'hidden', textOverflow: 'ellipsis' }}>{r.summary}</div>
-              <div style={{ fontFamily: "'JetBrains Mono',monospace", fontSize: 10.5, color: WC.muted2, marginTop: 2 }}>
-                {whenText(r.when, now)}{r.durationText ? ` · ${r.durationText}` : ''}
-              </div>
-            </div>
-            <span style={statusChip(r.status, WC)}>{statusLabel(r.status)}</span>
-          </div>
-        ))}
+        {rows.map((entry) => <Row key={`${entry.where}-${entry.id}`} entry={entry} wc={WC} now={now} />)}
       </div>
+      {cloudBlind && (
+        <div style={{ fontSize: 11.5, color: WC.muted2, marginTop: rows.length ? 10 : 0 }}>
+          {cloudRuns.phase === 'checking'
+            ? 'Loading cloud runs…'
+            : 'Couldn’t load this workflow’s cloud runs, so any that ran are not shown here.'}
+        </div>
+      )}
     </div>
   );
 };
diff --git a/frontend/src/app/pages/Workflows/app/LeftRail.tsx b/frontend/src/app/pages/Workflows/app/LeftRail.tsx
index db1a07c5..d78f0536 100644
--- a/frontend/src/app/pages/Workflows/app/LeftRail.tsx
+++ b/frontend/src/app/pages/Workflows/app/LeftRail.tsx
@@ -31,8 +31,6 @@ const LeftRail: React.FC<{ nav: AppNav }> = ({ nav }) => {
     return workflows.filter((w) => w.title.toLowerCase().includes(q));
   }, [workflows, query]);
 
-  const activeCount = workflows.filter((w) => isScheduleActive(w.schedule)).length;
-
   const onDelete = (id: string) => {
     // Soft-delete: moves to Trash (recoverable), so no scary confirm.
     dispatch(deleteWorkflow(id));
@@ -84,7 +82,8 @@ const LeftRail: React.FC<{ nav: AppNav }> = ({ nav }) => {
 
       <div style={{ padding: '14px 16px 6px', flex: 'none', display: 'flex', alignItems: 'center', justifyContent: 'space-between' }}>
         <span style={{ fontFamily: "'JetBrains Mono',monospace", fontSize: 10.5, letterSpacing: '0.08em', textTransform: 'uppercase', color: WC.muted2 }}>Workflows</span>
-        <span style={{ fontFamily: "'JetBrains Mono',monospace", fontSize: 10.5, color: WC.muted2 }}>{activeCount}</span>
+        {/* Counts what the list below is actually showing. It used to count only the scheduled ones, so a real workflow sat under a header that said 0. */}
+        <span style={{ fontFamily: "'JetBrains Mono',monospace", fontSize: 10.5, color: WC.muted2 }}>{filtered.length}</span>
       </div>
 
       <div style={{ flex: 1, overflowY: 'auto', padding: '0 8px', minHeight: 0 }}>
diff --git a/frontend/src/app/pages/Workflows/app/RunMonitor.tsx b/frontend/src/app/pages/Workflows/app/RunMonitor.tsx
index 1e4dd702..3eb79ae7 100644
--- a/frontend/src/app/pages/Workflows/app/RunMonitor.tsx
+++ b/frontend/src/app/pages/Workflows/app/RunMonitor.tsx
@@ -11,6 +11,7 @@ import {
 } from '@/shared/state/dashboardLayoutSlice';
 import type { CardType } from '@/shared/state/dashboardLayoutSlice';
 import WorkflowTitle from './WorkflowTitle';
+import { isScheduleActive } from '@/app/pages/Workflows/scheduleUtils';
 
 const DRAG_THRESHOLD = 3;
 
@@ -231,7 +232,10 @@ const RunMonitor: React.FC<Props> = ({ workflow, cardX, cardY, cardWidth, cardHe
         <div style={{ flex: 1, minHeight: 0, overflow: 'auto', padding: '16px 18px', display: 'flex', flexDirection: 'column', gap: 16 }}>
           <div>
             <div style={{ fontSize: 10.5, fontWeight: 700, letterSpacing: '0.07em', textTransform: 'uppercase', color: c.text.tertiary, marginBottom: 6 }}>Schedule</div>
-            <div style={{ fontSize: 14, fontWeight: 600, color: c.text.primary }}>{formatSchedule(workflow.schedule)}</div>
+            {/* A paused workflow fell through formatSchedule to "Scheduled for 9:00 AM", so this card announced a schedule while the panel beside it said Not scheduled. */}
+            <div style={{ fontSize: 14, fontWeight: 600, color: c.text.primary }}>
+              {isScheduleActive(workflow.schedule) ? formatSchedule(workflow.schedule) : 'Not scheduled'}
+            </div>
             {workflow.next_run_at && (
               <div style={{ fontSize: 12, color: c.text.tertiary, marginTop: 3 }}>
                 Next run {new Date(workflow.next_run_at).toLocaleString([], { weekday: 'short', month: 'short', day: 'numeric', hour: 'numeric', minute: '2-digit' })}
diff --git a/frontend/src/app/pages/Workflows/app/ScheduleCard.tsx b/frontend/src/app/pages/Workflows/app/ScheduleCard.tsx
index a9ab59a5..94c20975 100644
--- a/frontend/src/app/pages/Workflows/app/ScheduleCard.tsx
+++ b/frontend/src/app/pages/Workflows/app/ScheduleCard.tsx
@@ -7,6 +7,8 @@ import {
   freqOf, patchForFreq, intervalMinutes, timeInputValue, parseTimeInput, ordinal, nextRunText, type Freq,
 } from './model';
 import { useWorkflowPatch } from './useWorkflowPatch';
+import { useCloudStatus } from './useCloudStatus';
+import CloudRunSection from './CloudRunSection';
 import RepeatField from './RepeatField';
 
 const FREQS: Array<[Freq, string]> = [['daily', 'Daily'], ['weekly', 'Weekly'], ['monthly', 'Monthly'], ['interval', 'Interval']];
@@ -15,9 +17,11 @@ const DAY_LABELS: Array<[string, number]> = [['S', 0], ['M', 1], ['T', 2], ['W',
 const ScheduleCard: React.FC<{ workflow: Workflow }> = ({ workflow }) => {
   const WC = useWC();
   const patch = useWorkflowPatch();
+  const cloud = useCloudStatus(workflow);
   const sched = workflow.schedule;
   const freq = freqOf(sched);
   const enabled = sched.enabled;
+  const onCloud = workflow.execution_target === 'cloud';
 
   const patchSched = (p: Partial<ScheduleConfig>) => patch(workflow, { schedule: { ...sched, ...p } });
 
@@ -32,6 +36,11 @@ const ScheduleCard: React.FC<{ workflow: Workflow }> = ({ workflow }) => {
 
   // Turning a weekly schedule on with no days picked is "unconfigured", so the backend silently forces it back off and the switch looks dead. Seed today's weekday so the default Weekly 9am toggles on (and stays on) in one click.
   const toggleEnabled = () => {
+    // While the cloud holds the timer, this switch is the CLOUD's switch: flipping only our copy would pause nothing.
+    if (onCloud) {
+      cloud.choose('cloud', !enabled);
+      return;
+    }
     if (!enabled && sched.repeat_unit === 'week' && sched.on_days.length === 0) {
       patchSched({ enabled: true, on_days: [new Date().getDay()] });
     } else {
@@ -197,16 +206,21 @@ const ScheduleCard: React.FC<{ workflow: Workflow }> = ({ workflow }) => {
         <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke={WC.muted} strokeWidth="1.8" style={{ flex: 'none' }}><circle cx="12" cy="12" r="9" /><path d="M12 7v5l3 2" /></svg>
         <span style={{ fontSize: 12.5, color: WC.ink4 }}>{describeSchedule(sched)}</span>
       </div>
-      <div style={{ marginTop: 7, display: 'flex', alignItems: 'center', gap: 8 }}>
-        <div style={{ width: 14, display: 'flex', justifyContent: 'center', flex: 'none' }}><div style={{ width: 6, height: 6, borderRadius: '50%', background: WC.accent }} /></div>
-        <span style={{ fontSize: 12.5, color: WC.ink4 }}>Next run {nextRunText(workflow, workflow.next_run_at ? new Date(workflow.next_run_at) : null)}</span>
-      </div>
+      {/* On cloud our copy of next_run_at is a mirror that only refreshes on a probe, so the cloud section prints the time it just fetched instead. */}
+      {!onCloud && (
+        <div style={{ marginTop: 7, display: 'flex', alignItems: 'center', gap: 8 }}>
+          <div style={{ width: 14, display: 'flex', justifyContent: 'center', flex: 'none' }}><div style={{ width: 6, height: 6, borderRadius: '50%', background: WC.accent }} /></div>
+          <span style={{ fontSize: 12.5, color: WC.ink4 }}>Next run {nextRunText(workflow, workflow.next_run_at ? new Date(workflow.next_run_at) : null)}</span>
+        </div>
+      )}
       {maxRuns != null && (
         <div style={{ marginTop: 7, display: 'flex', alignItems: 'center', gap: 8 }}>
           <div style={{ width: 14, display: 'flex', justifyContent: 'center', flex: 'none' }}><div style={{ width: 6, height: 6, borderRadius: '50%', background: WC.muted }} /></div>
           <span style={{ fontSize: 12.5, color: WC.ink4 }}>{sched.runs_count} of {maxRuns} run{maxRuns === 1 ? '' : 's'} done</span>
         </div>
       )}
+
+      <CloudRunSection workflow={workflow} cloud={cloud} />
     </div>
   );
 };
diff --git a/frontend/src/app/pages/Workflows/app/WorkflowsAppCard.tsx b/frontend/src/app/pages/Workflows/app/WorkflowsAppCard.tsx
index 5c5e5443..1c37139c 100644
--- a/frontend/src/app/pages/Workflows/app/WorkflowsAppCard.tsx
+++ b/frontend/src/app/pages/Workflows/app/WorkflowsAppCard.tsx
@@ -1,6 +1,6 @@
 import React, { useCallback, useEffect } from 'react';
 import { useAppDispatch, useAppSelector } from '@/shared/hooks';
-import { setWorkflowsHubPosition, setWorkflowsHubSize } from '@/shared/state/dashboardLayoutSlice';
+import { setWorkflowsHubPosition, setWorkflowsHubSize, WORKFLOWS_HUB_ID } from '@/shared/state/dashboardLayoutSlice';
 import CanvasWindowCard from '@/app/pages/Dashboard/cards/CanvasWindowCard';
 import type { CardType } from '@/shared/state/dashboardLayoutSlice';
 import { useWC } from './uiKit';
@@ -34,7 +34,7 @@ const WorkflowsAppCard: React.FC<Props> = ({
 }) => {
   const WC = useWC();
   const dispatch = useAppDispatch();
-  const isFullscreen = useAppSelector((s) => !!s.dashboardLayout.workflowsHub?.fullscreen);
+  const isMinimized = useAppSelector((s) => !!s.dashboardLayout.minimizedCards[WORKFLOWS_HUB_ID]);
 
   // Keep fonts/keyframes available while the card is mounted.
   useEffect(() => { ensureAssets(); }, []);
@@ -48,7 +48,7 @@ const WorkflowsAppCard: React.FC<Props> = ({
 
   return (
     <CanvasWindowCard
-      cardId="workflows-hub"
+      cardId={WORKFLOWS_HUB_ID}
       cardType="workflows-hub"
       selectType="workflows-hub-card"
       selectName="Workflows"
@@ -57,7 +57,7 @@ const WorkflowsAppCard: React.FC<Props> = ({
       cardWidth={cardWidth}
       cardHeight={cardHeight}
       cardZOrder={cardZOrder}
-      fullscreen={isFullscreen}
+      minimized={isMinimized}
       minWidth={MIN_W}
       minHeight={MIN_H}
       background={WC.page}
@@ -74,8 +74,8 @@ const WorkflowsAppCard: React.FC<Props> = ({
       onCommitPosition={commitPosition}
       onCommitSize={commitSize}
     >
-      {({ header, onTileZone }) => (
-        <WorkflowsAppContent header={header} onTileZone={onTileZone} />
+      {({ header, tileZone, onTileZone }) => (
+        <WorkflowsAppContent header={header} tileZone={tileZone} onTileZone={onTileZone} />
       )}
     </CanvasWindowCard>
   );
diff --git a/frontend/src/app/pages/Workflows/app/WorkflowsAppContent.tsx b/frontend/src/app/pages/Workflows/app/WorkflowsAppContent.tsx
index 63f1d91c..84412c1d 100644
--- a/frontend/src/app/pages/Workflows/app/WorkflowsAppContent.tsx
+++ b/frontend/src/app/pages/Workflows/app/WorkflowsAppContent.tsx
@@ -1,7 +1,7 @@
 import React, { useEffect, useMemo, useState } from 'react';
 import EventRepeatIcon from '@mui/icons-material/EventRepeat';
 import { useAppDispatch, useAppSelector } from '@/shared/hooks';
-import { clearWorkflowsAppTarget, closeWorkflowsApp, toggleWorkflowsHubFullscreen } from '@/shared/state/dashboardLayoutSlice';
+import { clearWorkflowsAppTarget, closeWorkflowsApp, toggleMinimizeCard, WORKFLOWS_HUB_ID } from '@/shared/state/dashboardLayoutSlice';
 import WindowControls from '@/app/pages/Dashboard/cards/WindowControls';
 import {
   fetchWorkflows, fetchAllRuns, fetchPausedState, fetchActiveRuns, fetchDeletedWorkflows,
@@ -18,11 +18,10 @@ import ComposeView from './ComposeView';
 import TrashView from './TrashView';
 
 // The three-pane Workflows body plus its title bar. The card wraps this with drag/resize geometry and passes the drag handlers in; the title bar lives here because Share needs to know which workflow is open.
-const WorkflowsAppContent: React.FC<{ header: CardHeader; onTileZone?: (zone: string) => void }> = ({ header, onTileZone }) => {
+const WorkflowsAppContent: React.FC<{ header: CardHeader; tileZone: string | undefined; onTileZone: (zone: string) => void }> = ({ header, tileZone, onTileZone }) => {
   const WC = useWC();
   const dispatch = useAppDispatch();
   const target = useAppSelector((s) => s.dashboardLayout.workflowsAppTarget);
-  const isFullscreen = useAppSelector((s) => !!s.dashboardLayout.workflowsHub?.fullscreen);
   const dashboardId = useAppSelector((s) => s.tempState.lastDashboardId) || undefined;
 
   const [mode, setMode] = useState<AppMode>('home');
@@ -84,14 +83,9 @@ const WorkflowsAppContent: React.FC<{ header: CardHeader; onTileZone?: (zone: st
         >
           <WindowControls
             onClose={() => dispatch(closeWorkflowsApp())}
-            onMinimize={() => dispatch(closeWorkflowsApp())}
-            onTile={(zone) => {
-              if (zone === 'fullscreen' || zone === 'restore') { dispatch(toggleWorkflowsHubFullscreen()); return; }
-              if (isFullscreen) dispatch(toggleWorkflowsHubFullscreen());
-              onTileZone?.(zone);
-            }}
-            tiled={isFullscreen}
-            noTileMenu={isFullscreen}
+            onMinimize={() => dispatch(toggleMinimizeCard({ cardId: WORKFLOWS_HUB_ID }))}
+            onTile={onTileZone}
+            tiled={!!tileZone}
           />
         </span>
         <div style={{ display: 'flex', alignItems: 'center', gap: 8 }}>
diff --git a/frontend/src/app/pages/Workflows/app/cloudApi.ts b/frontend/src/app/pages/Workflows/app/cloudApi.ts
new file mode 100644
index 00000000..8589f904
--- /dev/null
+++ b/frontend/src/app/pages/Workflows/app/cloudApi.ts
@@ -0,0 +1,123 @@
+import { API_BASE, getAuthToken } from '@/shared/config';
+
+// Mirrors backend/apps/workflows/cloud/status.py. `unknown` is a first-class answer, not a
+// degraded `ready`: it carries no plan, no limits and no counts, so a failed fetch cannot be
+// rendered as "you are not entitled" or "0 runs left".
+export type CloudTarget = 'device' | 'cloud';
+
+export interface CloudLimits {
+  workflows: number;
+  runs_per_month: number;
+  concurrent: number;
+}
+
+export interface CloudUsage {
+  workflows_enabled: number;
+  runs_this_month: number;
+}
+
+export interface CloudCapability {
+  ok: boolean;
+  reason: string | null;
+}
+
+export interface HostedState {
+  id: string;
+  enabled: boolean;
+  next_run_at: string | null;
+  /** False when the workflow was edited after we pushed it, so the cloud holds older prose. */
+  in_sync: boolean;
+}
+
+interface CloudStatusShared {
+  target: CloudTarget;
+  schedule_supported: boolean;
+  schedule_reason: string | null;
+}
+
+export interface CloudStatusReady extends CloudStatusShared {
+  state: 'ready';
+  plan: string | null;
+  limits: CloudLimits;
+  usage: CloudUsage;
+  /** Null when the control plane could not tell us; create re-checks either way. */
+  capability: CloudCapability | null;
+  hosted: HostedState | null;
+}
+
+export interface CloudStatusSignedOut extends CloudStatusShared {
+  state: 'signed_out';
+}
+
+export interface CloudStatusUnknown extends CloudStatusShared {
+  state: 'unknown';
+  detail: string;
+}
+
+export type CloudStatus = CloudStatusReady | CloudStatusSignedOut | CloudStatusUnknown;
+
+export interface CloudRun {
+  id: string;
+  status: string;
+  started_at: string | null;
+  finished_at: string | null;
+  error: string | null;
+  answer: string | null;
+  notices: string[];
+  cost_usd: number | null;
+}
+
+export type CloudRunsResponse =
+  | { state: 'ready'; runs: CloudRun[] }
+  | { state: 'signed_out' | 'unknown'; detail: string | null };
+
+export interface TargetOutcome {
+  ok: boolean;
+  message: string | null;
+}
+
+const base = `${API_BASE}/cloud_workflows`;
+
+function headers(): Record<string, string> {
+  let tok = '';
+  try { tok = getAuthToken(); } catch { tok = ''; }
+  return { 'Content-Type': 'application/json', ...(tok ? { Authorization: `Bearer ${tok}` } : {}) };
+}
+
+// Null means our own backend did not answer, which the caller must render as "cannot tell" rather than as a denial.
+export async function fetchCloudStatus(workflowId: string): Promise<CloudStatus | null> {
+  try {
+    const res = await fetch(`${base}/${encodeURIComponent(workflowId)}/status`, { headers: headers() });
+    if (!res.ok) return null;
+    return (await res.json()) as CloudStatus;
+  } catch {
+    return null;
+  }
+}
+
+export async function fetchCloudRuns(workflowId: string): Promise<CloudRunsResponse> {
+  try {
+    const res = await fetch(`${base}/${encodeURIComponent(workflowId)}/runs`, { headers: headers() });
+    if (!res.ok) return { state: 'unknown', detail: null };
+    return (await res.json()) as CloudRunsResponse;
+  } catch {
+    return { state: 'unknown', detail: null };
+  }
+}
+
+export async function setCloudTarget(
+  workflowId: string,
+  body: { target: CloudTarget; enabled: boolean },
+): Promise<TargetOutcome> {
+  try {
+    const res = await fetch(`${base}/${encodeURIComponent(workflowId)}/target`, {
+      method: 'POST',
+      headers: headers(),
+      body: JSON.stringify(body),
+    });
+    if (!res.ok) return { ok: false, message: 'Something went wrong on this machine, so nothing changed.' };
+    return (await res.json()) as TargetOutcome;
+  } catch {
+    return { ok: false, message: 'Something went wrong on this machine, so nothing changed.' };
+  }
+}
diff --git a/frontend/src/app/pages/Workflows/app/cloudAvailability.ts b/frontend/src/app/pages/Workflows/app/cloudAvailability.ts
new file mode 100644
index 00000000..ec08107f
--- /dev/null
+++ b/frontend/src/app/pages/Workflows/app/cloudAvailability.ts
@@ -0,0 +1,68 @@
+import type { CloudStatus, CloudStatusReady } from './cloudApi';
+
+// One probe, three honest outcomes plus "still asking". Anything we have not heard back about is
+// `unknown`, never a refusal: a hiccup that renders as "not entitled" is a paywall built out of a
+// dropped packet.
+export type CloudProbe =
+  | { phase: 'checking' }
+  | { phase: 'unreachable' }
+  | { phase: 'answered'; status: CloudStatus };
+
+export type CloudAvailability =
+  | { kind: 'checking' }
+  | { kind: 'unknown'; detail: string | null }
+  | { kind: 'blocked'; reason: string; action: 'sign_in' | 'plans' | null }
+  | { kind: 'available' };
+
+const PLAN_REQUIRED = 'Cloud runs come with Pro and up. On this plan, workflows run on this device.';
+
+function blockedForAccount(status: CloudStatusReady): CloudAvailability | null {
+  if (status.limits.workflows === 0) {
+    return { kind: 'blocked', reason: PLAN_REQUIRED, action: 'plans' };
+  }
+  // A workflow already up there is holding one of the slots, so its own slot must not read as full.
+  const holdsASlot = status.hosted !== null;
+  if (!holdsASlot && status.usage.workflows_enabled >= status.limits.workflows) {
+    return {
+      kind: 'blocked',
+      reason: `${status.usage.workflows_enabled} of ${status.limits.workflows} cloud workflows used. Turn one off to move this one up.`,
+      action: null,
+    };
+  }
+  return null;
+}
+
+/** Whether the Cloud choice can be offered, and if not, the sentence that says why.
+ *  Reasons about the workflow itself come first: telling someone to upgrade for a job the runner
+ *  could never do is a sale, not an answer. */
+export function cloudAvailability(probe: CloudProbe): CloudAvailability {
+  if (probe.phase === 'checking') return { kind: 'checking' };
+  if (probe.phase === 'unreachable') return { kind: 'unknown', detail: null };
+  const status = probe.status;
+  if (!status.schedule_supported && status.schedule_reason) {
+    return { kind: 'blocked', reason: status.schedule_reason, action: null };
+  }
+  if (status.state === 'unknown') return { kind: 'unknown', detail: status.detail };
+  if (status.state === 'signed_out') {
+    return {
+      kind: 'blocked',
+      reason: 'Sign in to your OpenSwarm account to run workflows in the cloud.',
+      action: 'sign_in',
+    };
+  }
+  if (status.capability && !status.capability.ok && status.capability.reason) {
+    return { kind: 'blocked', reason: status.capability.reason, action: null };
+  }
+  return blockedForAccount(status) ?? { kind: 'available' };
+}
+
+/** The account-wide ceiling, said so plainly nobody reads it as this one workflow's count.
+ *  Null whenever we are unsure of the numbers, or cloud is not on the table for this workflow. */
+export function usageText(probe: CloudProbe, availability: CloudAvailability): string | null {
+  if (probe.phase !== 'answered' || probe.status.state !== 'ready') return null;
+  const onCloud = probe.status.target === 'cloud';
+  if (!onCloud && availability.kind !== 'available') return null;
+  const { usage, limits } = probe.status;
+  if (limits.runs_per_month === 0) return null;
+  return `Your plan: ${usage.runs_this_month} of ${limits.runs_per_month} cloud runs this month`;
+}
diff --git a/frontend/src/app/pages/Workflows/app/cloudRunRow.ts b/frontend/src/app/pages/Workflows/app/cloudRunRow.ts
new file mode 100644
index 00000000..c1e05559
--- /dev/null
+++ b/frontend/src/app/pages/Workflows/app/cloudRunRow.ts
@@ -0,0 +1,86 @@
+import type { CloudRun } from './cloudApi';
+import type { RunStatus } from './uiKit';
+
+// A cloud run that never started reports as "dispatch_unavailable: fly_capacity: ...", which is a
+// sentence for us, not for the person who was expecting a report at 9am. Every refusal the
+// dispatcher can produce gets a plain answer to the only question they have: did it run, and why not.
+const REFUSAL_TEXT: Record<string, string> = {
+  runner_not_configured: "Cloud runs weren't available on our side, so this didn't start. You weren't charged for it.",
+  callback_not_configured: "Cloud runs weren't available on our side, so this didn't start. You weren't charged for it.",
+  fly_unauthorized: "Cloud runs weren't available on our side, so this didn't start. You weren't charged for it.",
+  fly_rejected: "Cloud runs weren't available on our side, so this didn't start. You weren't charged for it.",
+  fly_capacity: "The cloud had no room at that moment, so this didn't start. You weren't charged for it.",
+  fly_unreachable: "We couldn't reach the machine meant to run this, so it didn't start. You weren't charged for it.",
+  workflow_definition_invalid:
+    "The cloud's copy of this workflow was unreadable, so nothing ran. Switch it back to this device and up to the cloud again to resend it.",
+  no_cloud_credential:
+    "No AI account is connected to the cloud for this workspace, so there was nothing to run this with.",
+  slot_already_run: 'This slot had already run, so it was not run a second time.',
+};
+
+const STATUS_LABEL: Record<string, string> = {
+  pending: 'Starting',
+  running: 'Running',
+  succeeded: 'Success',
+  failed: 'Failed',
+  dispatch_unavailable: "Didn't run",
+};
+
+const STATUS_TONE: Record<string, RunStatus> = {
+  pending: 'running',
+  running: 'running',
+  succeeded: 'success',
+  failed: 'failure',
+  dispatch_unavailable: 'skipped',
+};
+
+export interface CloudHistoryRow {
+  id: string;
+  label: string;
+  tone: RunStatus;
+  summary: string;
+  when: Date | null;
+  durationText: string;
+  costText: string;
+}
+
+/** Split "reason: detail" on the FIRST colon only, and only accept a reason we actually know.
+ *  An unrecognised prefix falls through to the raw text: showing the truth beats guessing at it. */
+export function explainCloudFailure(error: string | null): string {
+  if (!error) return '';
+  const at = error.indexOf(': ');
+  if (at < 0) return error;
+  const reason = error.slice(0, at);
+  const detail = error.slice(at + 2);
+  // The runner-capability detail is already the sentence we would have written.
+  if (reason === 'runner_capability') return detail;
+  return REFUSAL_TEXT[reason] ?? error;
+}
+
+function duration(run: CloudRun): string {
+  if (!run.started_at || !run.finished_at) return '';
+  const ms = new Date(run.finished_at).getTime() - new Date(run.started_at).getTime();
+  if (Number.isNaN(ms) || ms < 0) return '';
+  const s = Math.round(ms / 1000);
+  return s < 60 ? `${s}s` : `${Math.floor(s / 60)}m ${s % 60}s`;
+}
+
+function cost(run: CloudRun): string {
+  if (run.cost_usd === null || run.cost_usd === undefined) return '';
+  if (run.cost_usd === 0) return '$0.00';
+  return run.cost_usd < 0.01 ? '<$0.01' : `$${run.cost_usd.toFixed(2)}`;
+}
+
+export function toCloudHistoryRow(run: CloudRun, fallbackTitle: string): CloudHistoryRow {
+  const failed = run.status === 'failed' || run.status === 'dispatch_unavailable';
+  const explained = explainCloudFailure(run.error);
+  return {
+    id: run.id,
+    label: STATUS_LABEL[run.status] ?? run.status,
+    tone: STATUS_TONE[run.status] ?? 'skipped',
+    summary: (failed && explained) || run.answer || fallbackTitle,
+    when: run.started_at ? new Date(run.started_at) : null,
+    durationText: duration(run),
+    costText: cost(run),
+  };
+}
diff --git a/frontend/src/app/pages/Workflows/app/useCloudRuns.ts b/frontend/src/app/pages/Workflows/app/useCloudRuns.ts
new file mode 100644
index 00000000..6f58672c
--- /dev/null
+++ b/frontend/src/app/pages/Workflows/app/useCloudRuns.ts
@@ -0,0 +1,49 @@
+import { useEffect, useRef, useState } from 'react';
+import { fetchCloudRuns } from './cloudApi';
+import type { CloudRunsResponse } from './cloudApi';
+
+export type CloudRunsProbe =
+  | { phase: 'idle' }
+  | { phase: 'checking' }
+  | { phase: 'answered'; response: CloudRunsResponse };
+
+/** Run history for the cloud copy. Only asks when the workflow is actually up there, so a
+ *  device-only workflow never makes a network call to find out it has no cloud runs. */
+export function useCloudRuns(workflowId: string, hosted: boolean, revision: string): CloudRunsProbe {
+  const [probe, setProbe] = useState<CloudRunsProbe>({ phase: 'idle' });
+  const live = useRef(true);
+
+  useEffect(() => {
+    live.current = true;
+    return () => { live.current = false; };
+  }, []);
+
+  useEffect(() => {
+    if (!hosted) {
+      setProbe({ phase: 'idle' });
+      return;
+    }
+    setProbe((prev) => (prev.phase === 'answered' ? prev : { phase: 'checking' }));
+    fetchCloudRuns(workflowId).then((response) => {
+      if (live.current) setProbe({ phase: 'answered', response });
+    });
+  }, [workflowId, hosted, revision]);
+
+  // A cloud run reports to the cloud, not to us, so a run in flight is the one case worth asking again about. The poll stops itself the moment nothing is live.
+  const watching =
+    probe.phase === 'answered' &&
+    probe.response.state === 'ready' &&
+    probe.response.runs.some((r) => r.status === 'pending' || r.status === 'running');
+
+  useEffect(() => {
+    if (!hosted || !watching) return undefined;
+    const timer = setInterval(() => {
+      fetchCloudRuns(workflowId).then((response) => {
+        if (live.current) setProbe({ phase: 'answered', response });
+      });
+    }, 30000);
+    return () => clearInterval(timer);
+  }, [hosted, watching, workflowId]);
+
+  return probe;
+}
diff --git a/frontend/src/app/pages/Workflows/app/useCloudStatus.ts b/frontend/src/app/pages/Workflows/app/useCloudStatus.ts
new file mode 100644
index 00000000..d11b8314
--- /dev/null
+++ b/frontend/src/app/pages/Workflows/app/useCloudStatus.ts
@@ -0,0 +1,69 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { useAppDispatch } from '@/shared/hooks';
+import { fetchWorkflows } from '@/shared/state/workflowsSlice';
+import type { Workflow } from '@/shared/state/workflowsSlice';
+import { fetchCloudStatus, setCloudTarget } from './cloudApi';
+import type { CloudTarget, TargetOutcome } from './cloudApi';
+import type { CloudProbe } from './cloudAvailability';
+
+export interface CloudStatusHandle {
+  probe: CloudProbe;
+  /** True while a flip is in flight; the control must not accept a second one. */
+  pending: boolean;
+  /** Set only by a refused flip, and cleared by the next attempt. */
+  refusal: string | null;
+  retry: () => void;
+  choose: (target: CloudTarget, enabled: boolean) => void;
+  refresh: () => void;
+}
+
+/** The cloud's answer for one workflow, fetched off the render path so the Workflows app paints
+ *  and stays usable whether or not there is a cloud, an account, or a network. */
+export function useCloudStatus(workflow: Workflow): CloudStatusHandle {
+  const dispatch = useAppDispatch();
+  const [probe, setProbe] = useState<CloudProbe>({ phase: 'checking' });
+  const [pending, setPending] = useState(false);
+  const [refusal, setRefusal] = useState<string | null>(null);
+  const live = useRef(true);
+  const workflowId = workflow.id;
+  const dashboardId = workflow.dashboard_id;
+
+  useEffect(() => {
+    live.current = true;
+    return () => { live.current = false; };
+  }, []);
+
+  const refresh = useCallback(() => {
+    fetchCloudStatus(workflowId).then((status) => {
+      if (!live.current) return;
+      setProbe(status ? { phase: 'answered', status } : { phase: 'unreachable' });
+    });
+  }, [workflowId]);
+
+  // Only a different workflow blanks the answer. Re-asking about the SAME one keeps the last answer on screen while it happens, so an edit does not strobe the card.
+  useEffect(() => { setProbe({ phase: 'checking' }); }, [workflowId]);
+
+  // Re-ask when the workflow changes in a way the answer depends on: a different schedule can stop being expressible in the cloud, and edited steps can stop being runnable there.
+  useEffect(() => { refresh(); }, [refresh, workflow.updated_at]);
+
+  const choose = useCallback((target: CloudTarget, enabled: boolean) => {
+    if (pending) return;
+    setPending(true);
+    setRefusal(null);
+    setCloudTarget(workflowId, { target, enabled }).then((outcome: TargetOutcome) => {
+      if (!live.current) return;
+      setPending(false);
+      if (!outcome.ok) setRefusal(outcome.message);
+      // Refresh either way: a refusal usually means the reasons on screen are stale too.
+      refresh();
+      if (outcome.ok) dispatch(fetchWorkflows(dashboardId ?? undefined));
+    });
+  }, [dispatch, pending, refresh, workflowId, dashboardId]);
+
+  // refresh() deliberately leaves `refusal` alone: choose() calls it right after setting one, and
+  // clearing there would wipe the message before it rendered. A user-driven retry is a different
+  // intent, so it gets its own door; without it a refusal outlived the thing that caused it.
+  const retry = useCallback(() => { setRefusal(null); refresh(); }, [refresh]);
+
+  return { probe, pending, refusal, choose, refresh, retry };
+}
diff --git a/frontend/src/shared/TopLayerPortal.tsx b/frontend/src/shared/TopLayerPortal.tsx
new file mode 100644
index 00000000..bdc47ceb
--- /dev/null
+++ b/frontend/src/shared/TopLayerPortal.tsx
@@ -0,0 +1,16 @@
+import React from 'react';
+import { createPortal } from 'react-dom';
+
+// A low-z or transformed ancestor traps position:fixed, so anything that must win every stacking fight mounts on body instead.
+const TOP_LAYER = 2147483647;
+
+interface Props {
+  children: React.ReactNode;
+}
+
+const TopLayerPortal: React.FC<Props> = ({ children }) => createPortal(
+  <div style={{ position: 'fixed', inset: 0, zIndex: TOP_LAYER }}>{children}</div>,
+  document.body,
+);
+
+export default TopLayerPortal;
diff --git a/frontend/src/shared/cardScrollFocus.ts b/frontend/src/shared/cardScrollFocus.ts
index 21489fa8..6c523a09 100644
--- a/frontend/src/shared/cardScrollFocus.ts
+++ b/frontend/src/shared/cardScrollFocus.ts
@@ -1,11 +1,32 @@
 // The card you've clicked INTO, so plain scroll reads its content (chat transcript, scheduled-task
 // list) while scroll everywhere else zooms the canvas (Google Maps model). Imperative + read on the
-// wheel handler so no re-render; cleared when you click blank canvas. Browser/app cards aren't tracked
-// here: their guest page owns its own scroll/zoom (Maps, Figma), so plain wheel always stays in them.
+// wheel handler so no re-render. Browser/app cards aren't tracked here: their guest page owns its own
+// scroll/zoom (Maps, Figma), so plain wheel always stays in them.
 let scrollFocusedCardId: string | null = null;
 
+// Message bubbles carry their own data-select-id, so match the card by walking, not by closest().
+function insideFocusedCard(target: EventTarget | null): boolean {
+  let el = target as HTMLElement | null;
+  while (el) {
+    if (el.getAttribute?.('data-select-id') === scrollFocusedCardId) return true;
+    el = el.parentElement;
+  }
+  return false;
+}
+
+// Focus follows the cursor: the moment it leaves the card, scroll belongs to the canvas again, so a
+// chat you once clicked can't own the wheel forever and make zoom look broken. Listen on pointermove,
+// not pointerover: boundary events also fire when a re-render swaps the element under a still cursor.
+function releaseOnPointerLeave(e: PointerEvent): void {
+  if (insideFocusedCard(e.target)) return;
+  setScrollFocusedCard(null);
+}
+
 export function setScrollFocusedCard(id: string | null): void {
+  if (id === scrollFocusedCardId) return;
   scrollFocusedCardId = id;
+  if (id) document.addEventListener('pointermove', releaseOnPointerLeave, true);
+  else document.removeEventListener('pointermove', releaseOnPointerLeave, true);
 }
 
 export function getScrollFocusedCard(): string | null {
diff --git a/frontend/src/shared/notifications.ts b/frontend/src/shared/notifications.ts
index f7f0beaa..b52d92cc 100644
--- a/frontend/src/shared/notifications.ts
+++ b/frontend/src/shared/notifications.ts
@@ -59,3 +59,66 @@ export function notifyAgentCompletion(p: AgentCompletionPayload): void {
     // Notification API can throw if sandboxed or headless; fail silently.
   }
 }
+
+export type WorkflowNotificationOutcome = 'open' | 'ack' | 'rerun' | 'edit';
+
+export interface WorkflowRunNotification {
+  workflowId: string;
+  workflowTitle: string;
+  runId?: string;
+  sessionId?: string;
+  status: string;
+  tierKind?: string;
+  fallback?: boolean;
+}
+
+const SUCCESS_TITLES = ['{name} is done', '{name} just wrapped up', 'Heads up: {name} finished', '{name} is ready'];
+const FAILURE_TITLES = ['{name} hit a snag', "{name} couldn't finish", 'Something went sideways on {name}'];
+const LATE_TITLES = ['{name} caught up late', '{name} ran late but made it'];
+
+function workflowTitleFor(p: WorkflowRunNotification): string {
+  const name = p.workflowTitle || 'Workflow';
+  const pool = p.status === 'success' ? SUCCESS_TITLES
+    : p.status === 'failure' ? FAILURE_TITLES
+      : p.status === 'ran_late' ? LATE_TITLES
+        : null;
+  if (!pool) return `${name}: ${p.status}`;
+  // Seed by workflow id + current minute so two workflows pick different copy while one workflow stays stable across a few minutes.
+  const seed = Math.abs((p.workflowId.length + Math.floor(Date.now() / 60_000)) | 0);
+  return pool[seed % pool.length].replace('{name}', name);
+}
+
+function workflowBodyFor(p: WorkflowRunNotification): string {
+  if (p.tierKind && p.fallback) {
+    return `Would have ${p.tierKind === 'call' ? 'called' : 'texted'} you. (Cloud SMS not wired yet.)`;
+  }
+  const verb = typeof navigator !== 'undefined' && /Mac/i.test(navigator.platform) ? 'Tap' : 'Click';
+  if (p.status === 'success') return `${verb} to see what it did.`;
+  if (p.status === 'failure') return `${verb} to see what went wrong.`;
+  return `${verb} to open the run.`;
+}
+
+/** Native OS notification for a finished workflow run. Prefers the Electron main process, which reaches Notification Center even with the window hidden or the renderer backgrounded; the renderer's own Notification API is the browser-only fallback and it only fires when the tab is hidden. */
+export function notifyWorkflowRun(p: WorkflowRunNotification): void {
+  const bridge = typeof window !== 'undefined' ? window.openswarm : undefined;
+  if (!bridge?.notify) {
+    notifyAgentCompletion({
+      sessionId: p.sessionId || p.workflowId,
+      sessionName: p.workflowTitle || 'Workflow',
+      status: p.status === 'success' ? 'completed' : 'error',
+    });
+    return;
+  }
+  bridge.notify({
+    title: workflowTitleFor(p),
+    body: workflowBodyFor(p),
+    deepLink: `openswarm://workflow/${p.workflowId}/run/${p.runId || ''}`,
+    runId: p.runId,
+    workflowId: p.workflowId,
+    actions: [
+      { text: 'Looks good', outcome: 'ack' },
+      { text: 'Re-run', outcome: 'rerun' },
+      { text: 'Adjust', outcome: 'edit' },
+    ],
+  }).catch(() => { /* the OS refused it; the run is still on the canvas */ });
+}
diff --git a/frontend/src/shared/state/dashboardLayoutSlice.ts b/frontend/src/shared/state/dashboardLayoutSlice.ts
index c00233d9..f459634c 100644
--- a/frontend/src/shared/state/dashboardLayoutSlice.ts
+++ b/frontend/src/shared/state/dashboardLayoutSlice.ts
@@ -1,5 +1,6 @@
 import { createSlice, createAsyncThunk, PayloadAction, createAction } from '@reduxjs/toolkit';
-import { launchAndSendFirstMessage, resumeSession } from './agentsSlice';
+import { launchAndSendFirstMessage, resumeSession, collapseSession, collapseAllSessions, setExpandedSessionIds } from './agentsSlice';
+import { untileClosedChats } from './untileClosedChats';
 import { API_BASE } from '@/shared/config';
 import { getLastDashboardId } from '@/shared/lastDashboardId';
 
@@ -26,7 +27,9 @@ export const DEFAULT_WORKFLOWS_HUB_W = DEFAULT_BROWSER_CARD_W;
 export const DEFAULT_WORKFLOWS_HUB_H = DEFAULT_BROWSER_CARD_H;
 export const DEFAULT_SETTINGS_CARD_W = 900;
 export const DEFAULT_SETTINGS_CARD_H = 640;
+// The two singleton windows have no card map to key off, so they own these fixed ids everywhere (selection, minimize, z-order).
 export const SETTINGS_CARD_ID = 'settings';
+export const WORKFLOWS_HUB_ID = 'workflows-hub';
 export const EXPANDED_CARD_MIN_H = 620;
 export const GRID_GAP = 24;
 // Gap between the Workflows window and the cards it spawns (run monitor, that monitor's browser). Keeps the hub -> monitor -> browser row evenly spaced.
@@ -110,8 +113,6 @@ export interface WorkflowsHubPosition {
   width: number;
   height: number;
   zOrder: number;
-  // Full size view: the card fills the whole dashboard (reuses the fullscreen tile geometry).
-  fullscreen?: boolean;
 }
 
 // One entry in the Ctrl/Cmd+Shift+T "reopen last closed" stack: a full snapshot for browser/view/workflow/tab, just the session id for an agent (its session is brought back via resumeSession).
@@ -344,10 +345,11 @@ export function findOpenGridCell(
   occupiedRects: Rect[],
   newW: number,
   newH: number,
+  colLimit?: number,
 ): { x: number; y: number } {
   const cellW = DEFAULT_CARD_W + GRID_GAP;
   const cellH = DEFAULT_CARD_H + GRID_GAP;
-  const maxCols = Math.max(
+  const maxCols = colLimit ?? Math.max(
     1,
     Math.floor((window.innerWidth - GRID_ORIGIN.x) / cellW) || GRID_COLS_FALLBACK,
   );
@@ -364,6 +366,34 @@ export function findOpenGridCell(
   }
 }
 
+// Tidy packs into the grid shape that fills the SCREEN best. The default column count is derived from
+// window.innerWidth, which is screen pixels pretending to be world units: it laid 8 cards out as a
+// 2-wide, 4-tall ribbon that the camera then had to pull back to 41% to show.
+function tidyColumnCount(itemSizes: Array<{ w: number; h: number }>): number {
+  const cellW = DEFAULT_CARD_W + GRID_GAP;
+  const cellH = DEFAULT_CARD_H + GRID_GAP;
+  let cells = 0;
+  let widest = 1;
+  for (const s of itemSizes) {
+    const cols = Math.max(1, Math.ceil(s.w / cellW));
+    cells += cols * Math.max(1, Math.ceil(s.h / cellH));
+    widest = Math.max(widest, cols);
+  }
+  const vw = window.innerWidth || 1440;
+  const vh = window.innerHeight || 900;
+  let best = widest;
+  let bestZoom = 0;
+  for (let cols = widest; cols <= Math.max(widest, cells); cols++) {
+    const rows = Math.ceil(cells / cols);
+    const zoom = Math.min(vw / (cols * cellW), vh / (rows * cellH));
+    if (zoom > bestZoom) {
+      bestZoom = zoom;
+      best = cols;
+    }
+  }
+  return best;
+}
+
 // Like findOpenGridCell but biased to stay near a proposed (x,y) anchor. Used when the backend hands us a card with a position that's already occupied (sub-agent or sub-browser spawning on top of its parent or a sibling). Spirals outward from the anchor on a grid, snapping to cell-aligned positions so the result still looks intentional, not dropped from orbit. Caps the spiral search at ~1000 cells to avoid pathological work in adversarial layouts, falls back to findOpenGridCell after that. Cost: O(rects × cells_scanned). Spawn events are rare (not per-frame), so this only runs when a new card appears. Typical scan resolves in <10 cells, well below the cap. No perf impact on steady-state UI.
 export function findOpenSpotNear(
   anchorX: number,
@@ -569,16 +599,17 @@ const dashboardLayoutSlice = createSlice({
   name: 'dashboardLayout',
   initialState,
   reducers: {
-    // Window controls (traffic lights). Minimize toggles a per-card pill; tiling snaps a card to a
-    // macOS-style viewport zone (green = 'fill'). Minimizing an un-tiles and vice-versa, so a card
-    // is never both pill'd and tiled at once.
+    // Window controls (traffic lights). Minimize parks a card in the right-edge rail; tiling snaps it
+    // to a macOS-style viewport zone. Rule 6 of the tiling set (see cards/useCardTiling.ts): a parked
+    // card keeps its zone and restores back into it, but never keeps 'fullscreen', which would leave
+    // an off-canvas card hiding the whole shell.
     toggleMinimizeCard(state, action: PayloadAction<{ cardId: string }>) {
       const id = action.payload.cardId;
       if (state.minimizedCards[id]) {
         delete state.minimizedCards[id];
       } else {
         state.minimizedCards[id] = true;
-        if (state.tiledCards[id]) delete state.tiledCards[id];
+        if (state.tiledCards[id] === 'fullscreen') delete state.tiledCards[id];
       }
     },
     setTiledCard(state, action: PayloadAction<{ cardId: string; zone: string }>) {
@@ -766,19 +797,19 @@ const dashboardLayoutSlice = createSlice({
       ];
       allItems.sort((a, b) => a.y - b.y || a.x - b.x);
 
+      const sizeOf = (item: typeof allItems[number]): { w: number; h: number } => ({
+        w: item.storedW,
+        h: item.kind === 'agent' && expanded.has(item.id)
+          ? Math.max(EXPANDED_CARD_MIN_H, item.storedH)
+          : item.storedH,
+      });
+      const cols = tidyColumnCount(allItems.map(sizeOf));
       const placedRects: Rect[] = [];
 
       for (const item of allItems) {
-        let w: number, h: number;
-        if (item.kind === 'agent') {
-          w = item.storedW;
-          h = expanded.has(item.id) ? Math.max(EXPANDED_CARD_MIN_H, item.storedH) : item.storedH;
-        } else {
-          w = item.storedW;
-          h = item.storedH;
-        }
+        const { w, h } = sizeOf(item);
 
-        const pos = findOpenGridCell(placedRects, w, h);
+        const pos = findOpenGridCell(placedRects, w, h, cols);
         placedRects.push({ x: pos.x, y: pos.y, w, h });
 
         if (item.kind === 'agent') {
@@ -1093,6 +1124,9 @@ const dashboardLayoutSlice = createSlice({
 
     removeWorkflowCard(state, action: PayloadAction<string>) {
       delete state.workflowCards[action.payload];
+      // Rule 7: a dead card must never keep owning a tile; a stale entry poisons every reader of it.
+      delete state.tiledCards[action.payload];
+      delete state.minimizedCards[action.payload];
     },
 
     // Rekey draft- id to the server-assigned id without visually hopping the card.
@@ -1115,6 +1149,7 @@ const dashboardLayoutSlice = createSlice({
     openWorkflowsHub(state, action: PayloadAction<{ expandedSessionIds?: string[] } | undefined>) {
       if (state.workflowsHub) {
         state.workflowsHub.zOrder = state.nextZOrder++;
+        delete state.minimizedCards[WORKFLOWS_HUB_ID];
         state.pendingFocusWorkflowsHub = true;
         return;
       }
@@ -1136,6 +1171,8 @@ const dashboardLayoutSlice = createSlice({
 
     closeWorkflowsHub(state) {
       state.workflowsHub = null;
+      delete state.minimizedCards[WORKFLOWS_HUB_ID];
+      delete state.tiledCards[WORKFLOWS_HUB_ID];
     },
 
     // The Workflows app is an on-canvas card (like chat/browser/view cards), backed by the singleton workflowsHub geometry. Opening it creates or raises that card and pans to it; an optional workflowId deep-links to that workflow's detail once the card mounts.
@@ -1143,6 +1180,8 @@ const dashboardLayoutSlice = createSlice({
       state.workflowsAppTarget = action.payload?.workflowId ?? null;
       if (state.workflowsHub) {
         state.workflowsHub.zOrder = state.nextZOrder++;
+        // Opening means visible: a parked window must come back to the canvas, or the focus pan flies to empty space.
+        delete state.minimizedCards[WORKFLOWS_HUB_ID];
         state.pendingFocusWorkflowsHub = true;
         return;
       }
@@ -1160,19 +1199,14 @@ const dashboardLayoutSlice = createSlice({
 
     closeWorkflowsApp(state) {
       state.workflowsHub = null;
+      delete state.tiledCards[WORKFLOWS_HUB_ID];
+      delete state.minimizedCards[WORKFLOWS_HUB_ID];
       state.workflowsAppTarget = null;
       state.workflowsMonitorId = null;
       state.workflowsMonitorRunId = null;
       state.workflowsMonitorCard = null;
     },
 
-    toggleWorkflowsHubFullscreen(state) {
-      if (state.workflowsHub) {
-        state.workflowsHub.fullscreen = !state.workflowsHub.fullscreen;
-        state.workflowsHub.zOrder = state.nextZOrder++;
-      }
-    },
-
     clearWorkflowsAppTarget(state) {
       state.workflowsAppTarget = null;
     },
@@ -1232,6 +1266,7 @@ const dashboardLayoutSlice = createSlice({
     openSettingsCard(state, action: PayloadAction<{ expandedSessionIds?: string[] } | undefined>) {
       if (state.settingsCard) {
         state.settingsCard.zOrder = state.nextZOrder++;
+        delete state.minimizedCards[SETTINGS_CARD_ID];
         state.pendingFocusSettingsCard = true;
         return;
       }
@@ -1249,6 +1284,8 @@ const dashboardLayoutSlice = createSlice({
 
     closeSettingsCard(state) {
       state.settingsCard = null;
+      delete state.minimizedCards[SETTINGS_CARD_ID];
+      delete state.tiledCards[SETTINGS_CARD_ID];
       state.pendingFocusSettingsCard = false;
     },
 
@@ -1256,12 +1293,6 @@ const dashboardLayoutSlice = createSlice({
       state.pendingFocusSettingsCard = false;
     },
 
-    toggleSettingsCardFullscreen(state) {
-      if (!state.settingsCard) return;
-      state.settingsCard.fullscreen = !state.settingsCard.fullscreen;
-      state.settingsCard.zOrder = state.nextZOrder++;
-    },
-
     setSettingsCardPosition(state, action: PayloadAction<{ x: number; y: number }>) {
       if (!state.settingsCard) return;
       state.settingsCard.x = action.payload.x;
@@ -1453,8 +1484,14 @@ const dashboardLayoutSlice = createSlice({
       const [moved] = source.tabs.splice(idx, 1);
       // Fresh id: reusing the old one makes the receiving BrowserCard think the tab is already initialized, so its webview never loads the URL and sits at about:blank.
       const tab = { ...moved, id: generateTabId() };
-      if (source.tabs.length === 0) {
+      const spun = {
+        owner: source.spawned_by ?? null,
+        x: source.x, y: source.y, width: source.width, height: source.height, dashboard_id: source.dashboard_id,
+      };
+      const dissolved = source.tabs.length === 0;
+      if (dissolved) {
         delete state.browserCards[fromBrowserId];
+        delete state.suspendedBrowserCards[fromBrowserId];
       } else if (source.activeTabId === tabId) {
         const nextActive = source.tabs[Math.min(idx, source.tabs.length - 1)];
         source.activeTabId = nextActive.id;
@@ -1466,18 +1503,24 @@ const dashboardLayoutSlice = createSlice({
         target.url = tab.url;
         target.zOrder = state.nextZOrder++;
       } else {
-        const id = `browser-${Date.now().toString(36)}`;
+        // The last tab leaving is the card MOVING, so it keeps its id; either way it keeps its agent
+        // owner, or the agent stops recognising its own browser and spawns a second one next time it
+        // browses. keep_open because pulling it out is the user claiming it: the owner finishing must
+        // not delete it out from under them, exactly as when it had no owner at all.
+        const id = dissolved ? fromBrowserId : `browser-${Date.now().toString(36)}`;
         state.browserCards[id] = {
           browser_id: id,
           url: tab.url,
           tabs: [tab],
           activeTabId: tab.id,
-          x: x ?? source.x + 60,
-          y: y ?? source.y + 60,
-          width: source.width,
-          height: source.height,
+          x: x ?? spun.x + 60,
+          y: y ?? spun.y + 60,
+          width: spun.width,
+          height: spun.height,
           zOrder: state.nextZOrder++,
-          dashboard_id: source.dashboard_id,
+          dashboard_id: spun.dashboard_id,
+          spawned_by: spun.owner,
+          keep_open: true,
         };
       }
     },
@@ -1746,6 +1789,17 @@ const dashboardLayoutSlice = createSlice({
         // Fail-open for RENDERING only; saveArmed stays false so this client can never persist the empty layout it booted with over the server's real one (the wipe that hit 2026-07-20).
         state.initialized = true;
       })
+      // Rule 8 of the tiling set: a chat's zone belongs to its OPEN state, so every action that closes
+      // chats untiles them here, in the same dispatch. See untileClosedChats.
+      .addCase(collapseSession, (state, action) => {
+        untileClosedChats(state.tiledCards, [action.payload], []);
+      })
+      .addCase(collapseAllSessions, (state) => {
+        untileClosedChats(state.tiledCards, Object.keys(state.cards), []);
+      })
+      .addCase(setExpandedSessionIds, (state, action) => {
+        untileClosedChats(state.tiledCards, Object.keys(state.cards), action.payload);
+      })
       .addCase(fetchSessionRejectedAction, (state, action) => {
         // 404/410 means permanent; strip the card. Other failure modes leave it (next fetch may succeed).
         const payload = action.payload;
@@ -1766,6 +1820,13 @@ const dashboardLayoutSlice = createSlice({
           delete state.cards[draftId];
           state.cards[session.id] = { ...card, session_id: session.id, zOrder: state.nextZOrder++ };
         }
+        // The zone rides the re-key too: left behind, a tiled draft pops out of its tile AND strands an
+        // entry no reader can ever clear (a stranded 'fullscreen' hides the whole shell until reload).
+        const draftZone = state.tiledCards[draftId];
+        if (draftZone) {
+          delete state.tiledCards[draftId];
+          state.tiledCards[session.id] = draftZone;
+        }
         // Carry an optimistic browser tether from the draft id to the real session id, in place (no flicker, no stale draft endpoint).
         for (const entry of Object.values(state.glowingBrowserCards)) {
           if (entry.sourceId === draftId) entry.sourceId = session.id;
@@ -1853,7 +1914,6 @@ export const {
   closeWorkflowsHub,
   openWorkflowsApp,
   closeWorkflowsApp,
-  toggleWorkflowsHubFullscreen,
   clearWorkflowsAppTarget,
   openWorkflowMonitor,
   closeWorkflowMonitor,
@@ -1866,7 +1926,6 @@ export const {
   openSettingsCard,
   closeSettingsCard,
   clearPendingFocusSettingsCard,
-  toggleSettingsCardFullscreen,
   setSettingsCardPosition,
   setSettingsCardSize,
   recordClosedCard,
@@ -1901,8 +1960,9 @@ export const selectFullscreenCardId = (state: { dashboardLayout: DashboardLayout
   if (!entry) return null;
   const id = entry[0];
   // Belt over the reducer hygiene: an entry whose card is gone (any removal path) must not hold the app in fullscreen.
-  const exists = id in s.cards || id in s.viewCards || id in s.browserCards || id in s.workflowCards;
-  return exists ? id : null;
+  const exists = id in s.cards || id in s.viewCards || id in s.browserCards || id in s.workflowCards
+    || (id === WORKFLOWS_HUB_ID && !!s.workflowsHub) || (id === SETTINGS_CARD_ID && !!s.settingsCard);
+  return exists && !s.minimizedCards[id] ? id : null;
 };
 
 export default dashboardLayoutSlice.reducer;
diff --git a/frontend/src/shared/state/isUserLaunchedSession.ts b/frontend/src/shared/state/isUserLaunchedSession.ts
new file mode 100644
index 00000000..20c595cf
--- /dev/null
+++ b/frontend/src/shared/state/isUserLaunchedSession.ts
@@ -0,0 +1,14 @@
+// Plumbing chats the UI spins up for itself: a workflow card's Edit Agent, a workflow run, a browser
+// or sub agent working for a parent. They are real sessions, they just aren't things the user started.
+const PLUMBING_MODES: ReadonlySet<string> = new Set(['browser-agent', 'invoked-agent', 'sub-agent']);
+
+export interface SessionOrigin {
+  mode: string;
+  workflow_run_id?: string | null;
+  workflow_edit_id?: string | null;
+}
+
+/** True for a chat the user started themselves, which is the only kind that earns a card or a notification. */
+export function isUserLaunchedSession(session: SessionOrigin): boolean {
+  return !session.workflow_run_id && !session.workflow_edit_id && !PLUMBING_MODES.has(session.mode);
+}
diff --git a/frontend/src/shared/state/settingsSlice.ts b/frontend/src/shared/state/settingsSlice.ts
index 82295bb9..47f10c40 100644
--- a/frontend/src/shared/state/settingsSlice.ts
+++ b/frontend/src/shared/state/settingsSlice.ts
@@ -46,6 +46,7 @@ export interface AppSettings {
   theme: 'light' | 'dark';
   new_agent_shortcut: string;
   dictation_shortcut?: string | null;
+  dictation_model?: string | null;
   anthropic_api_key: string | null;
   openai_api_key?: string | null;
   google_api_key?: string | null;
@@ -139,7 +140,12 @@ export interface BrowseResult {
 interface SettingsState {
   data: AppSettings;
   loading: boolean;
+  /** We have the user's real settings. Anything that judges the user (no model connected, onboarding
+   *  not done, free runs spent) must read THIS, never `settled`: a failed fetch is not an answer. */
   loaded: boolean;
+  /** The first fetch finished, either way. Only the paint gate wants this, so a dead backend shows a
+   *  window with an honest error instead of a blank one. */
+  settled: boolean;
   modalOpen: boolean;
   /** When non-null, Settings opens to this tab instead of 'general'. */
   initialTab: string | null;
@@ -168,6 +174,7 @@ export const DEFAULT_SETTINGS: AppSettings = {
   theme: 'light',
   new_agent_shortcut: 'Meta+l',
   dictation_shortcut: null,
+  dictation_model: null,
   anthropic_api_key: null,
   browser_homepage: 'https://duckduckgo.com',
   browser_import_signins: false,
@@ -182,6 +189,7 @@ const initialState: SettingsState = {
   data: DEFAULT_SETTINGS,
   loading: false,
   loaded: false,
+  settled: false,
   modalOpen: false,
   initialTab: null,
   draft: null,
@@ -334,6 +342,7 @@ const settingsSlice = createSlice({
       .addCase(fetchSettings.fulfilled, (state, action) => {
         state.loading = false;
         state.loaded = true;
+        state.settled = true;
         // Drop a stale response: on boot three fetches race (initial, sub-sync, free-trial mint); if the pre-mint one resolves last it would wipe the armed trial. Newest wins.
         if (state.latestWriteId && action.meta.requestId !== state.latestWriteId) return;
         // Fill any field an older backend shape omitted so no consumer reads undefined; the payload still wins for everything it does send.
@@ -347,7 +356,8 @@ const settingsSlice = createSlice({
       })
       .addCase(fetchSettings.rejected, (state) => {
         state.loading = false;
-        state.loaded = true;
+        state.settled = true;
+        // `loaded` deliberately stays put. A failed fetch is not an answer, and claiming one made every gate read DEFAULT_SETTINGS as fact: with the backend down the app greeted a configured user as a brand-new one and offered to sell them a subscription. A refresh that fails keeps the last good copy; a first fetch that fails stays unknown.
       })
       .addCase(updateSettingsPatch.fulfilled, (state, action) => {
         // A user save is authoritative; claim newest so an in-flight GET can't overwrite it, and consume the draft so reopening shows the saved state.
diff --git a/frontend/src/shared/state/untileClosedChats.test.ts b/frontend/src/shared/state/untileClosedChats.test.ts
new file mode 100644
index 00000000..6d208f1f
--- /dev/null
+++ b/frontend/src/shared/state/untileClosedChats.test.ts
@@ -0,0 +1,28 @@
+// Run: node --test frontend/src/shared/state/untileClosedChats.test.ts
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { untileClosedChats } from './untileClosedChats.ts';
+
+test('collapsing one chat drops that chat tile and nothing else', () => {
+  const tiled: Record<string, string> = { a: 'left', b: 'fullscreen' };
+  untileClosedChats(tiled, ['a'], []);
+  assert.deepEqual(tiled, { b: 'fullscreen' });
+});
+
+test('restoring a saved expansion list untiles every chat missing from it', () => {
+  const tiled: Record<string, string> = { a: 'left', b: 'fullscreen', c: 'right' };
+  untileClosedChats(tiled, ['a', 'b', 'c'], ['b']);
+  assert.deepEqual(tiled, { b: 'fullscreen' });
+});
+
+test('non-chat tiles (browsers, apps, windows) are never touched', () => {
+  const tiled: Record<string, string> = { chat: 'left', 'browser-1': 'right' };
+  untileClosedChats(tiled, ['chat'], []);
+  assert.deepEqual(tiled, { 'browser-1': 'right' });
+});
+
+test('an open chat keeps its tile', () => {
+  const tiled: Record<string, string> = { a: 'fullscreen' };
+  untileClosedChats(tiled, ['a'], ['a']);
+  assert.deepEqual(tiled, { a: 'fullscreen' });
+});
diff --git a/frontend/src/shared/state/untileClosedChats.ts b/frontend/src/shared/state/untileClosedChats.ts
new file mode 100644
index 00000000..8c93fc75
--- /dev/null
+++ b/frontend/src/shared/state/untileClosedChats.ts
@@ -0,0 +1,14 @@
+// A tiled chat IS an open chat, so the two states can never be allowed to drift apart. Anything that
+// closes chats drops their zones in the SAME reducer: an after-the-fact effect leaves a window where
+// the card is tile-sized but wearing the collapsed skin, and on a busy machine that window has been
+// measured at 17 seconds (the "fullscreen turns white" bug).
+export function untileClosedChats(
+  tiledCards: Record<string, string>,
+  chatCardIds: string[],
+  openChatIds: readonly string[],
+): void {
+  const open = new Set(openChatIds);
+  for (const id of chatCardIds) {
+    if (!open.has(id)) delete tiledCards[id];
+  }
+}
diff --git a/frontend/src/shared/state/workflowsSlice.ts b/frontend/src/shared/state/workflowsSlice.ts
index 445e0250..b5f77347 100644
--- a/frontend/src/shared/state/workflowsSlice.ts
+++ b/frontend/src/shared/state/workflowsSlice.ts
@@ -74,6 +74,9 @@ export interface Workflow {
   steps: WorkflowStep[];
   actions: ActionsConfig;
   schedule: ScheduleConfig;
+  /** Where a SCHEDULED fire runs. Only the cloud_workflows routes may change it, and only once
+   *  the cloud has actually taken (or released) the workflow. Manual runs are always local. */
+  execution_target?: 'device' | 'cloud';
   permissions: PermissionTier[];
   source_session_id?: string | null;
   dashboard_id?: string | null;
@@ -200,12 +203,14 @@ interface State {
   allRuns: WorkflowRun[];
   allRunsLoading: boolean;
   runningToast: RunningToast | null;
+  /** One-off explanation for something the user asked for that the server refused. */
+  noticeToast: string | null;
   runControlPending: Record<string, WorkflowRunControlAction>;
   deleted: Workflow[];
   deletedLoading: boolean;
 }
 
-const initialState: State = { items: {}, runs: {}, openCards: {}, loaded: false, loading: false, paused: false, active: [], cloudSmsEnabled: false, allRuns: [], allRunsLoading: false, runningToast: null, runControlPending: {}, deleted: [], deletedLoading: false };
+const initialState: State = { items: {}, runs: {}, openCards: {}, loaded: false, loading: false, paused: false, active: [], cloudSmsEnabled: false, allRuns: [], allRunsLoading: false, runningToast: null, noticeToast: null, runControlPending: {}, deleted: [], deletedLoading: false };
 
 function mergeRunIntoState(state: State, r: WorkflowRun) {
   const arr = state.runs[r.workflow_id] || [];
@@ -402,8 +407,13 @@ export const discardDraft = createAsyncThunk('workflows/discardDraft', async (id
   return (await res.json()) as Workflow;
 });
 
-export const deleteWorkflow = createAsyncThunk('workflows/delete', async (id: string) => {
-  await fetch(`${API}/${id}`, { method: 'DELETE' });
+export const deleteWorkflow = createAsyncThunk('workflows/delete', async (id: string, { rejectWithValue }) => {
+  const res = await fetch(`${API}/${id}`, { method: 'DELETE' });
+  // A refused delete must not remove the card: the workflow is still there, and if it is cloud-hosted it is still running.
+  if (!res.ok) {
+    const body = await res.json().catch(() => null);
+    return rejectWithValue(typeof body?.detail === 'string' ? body.detail : "Couldn't delete this workflow. Try again in a moment.");
+  }
   return id;
 });
 
@@ -414,9 +424,12 @@ export const fetchDeletedWorkflows = createAsyncThunk('workflows/fetchDeleted',
   return data.workflows as Workflow[];
 });
 
-export const restoreWorkflow = createAsyncThunk('workflows/restore', async (id: string) => {
+export const restoreWorkflow = createAsyncThunk('workflows/restore', async (id: string, { dispatch }) => {
   const res = await fetch(`${API}/${id}/restore`, { method: 'POST' });
   if (!res.ok) throw new Error(`restore failed ${res.status}`);
+  // Trashing drops the run rows from the store; the server kept them, so pull them back or a restored workflow claims "No runs yet" over a real history.
+  void dispatch(fetchRuns(id));
+  void dispatch(fetchAllRuns(200));
   return (await res.json()) as Workflow;
 });
 
@@ -567,6 +580,9 @@ const slice = createSlice({
     dismissRunningToast(state) {
       state.runningToast = null;
     },
+    dismissNoticeToast(state) {
+      state.noticeToast = null;
+    },
   },
   extraReducers: (builder) => {
     builder
@@ -588,6 +604,9 @@ const slice = createSlice({
       .addCase(updateWorkflow.fulfilled, (state, action) => { state.items[action.payload.id] = action.payload; })
       .addCase(commitDraft.fulfilled, (state, action) => { state.items[action.payload.id] = action.payload; })
       .addCase(discardDraft.fulfilled, (state, action) => { state.items[action.payload.id] = action.payload; })
+      .addCase(deleteWorkflow.rejected, (state, action) => {
+        state.noticeToast = typeof action.payload === 'string' ? action.payload : "Couldn't delete this workflow. Try again in a moment.";
+      })
       .addCase(deleteWorkflow.fulfilled, (state, action) => {
         delete state.items[action.payload];
         delete state.runs[action.payload];
@@ -667,5 +686,6 @@ export const {
   upsertWorkflow,
   removeWorkflow,
   dismissRunningToast,
+  dismissNoticeToast,
 } = slice.actions;
 export default slice.reducer;
diff --git a/frontend/src/shared/voice/VoiceDictationContext.tsx b/frontend/src/shared/voice/VoiceDictationContext.tsx
index b78a2d65..06c216e1 100644
--- a/frontend/src/shared/voice/VoiceDictationContext.tsx
+++ b/frontend/src/shared/voice/VoiceDictationContext.tsx
@@ -12,12 +12,19 @@ export function VoiceDictationProvider({ children }: { children: React.ReactNode
   const { state, lastText, error, pct, feedback, toggle, start, stop, volumeRef } = useVoiceDictation();
   const holdMode = useAppSelector((s) => s.settings.data.voice_hold_to_talk ?? true);
   const dictationShortcut = useAppSelector((s) => s.settings.data.dictation_shortcut ?? null);
+  const dictationModel = useAppSelector((s) => s.settings.data.dictation_model ?? null);
 
   // Push the user's combo to main on boot and on change so every hotkey tier rebinds live.
   useEffect(() => {
     const bridge = window as unknown as { openswarm?: { setVoiceHotkey?: (combo: string | null) => void } };
     bridge.openswarm?.setVoiceHotkey?.(dictationShortcut);
   }, [dictationShortcut]);
+
+  // Main boots with the catalog default, so a user who picked something else has to say so on every
+  // launch or dictation quietly runs on the wrong model.
+  useEffect(() => {
+    if (dictationModel) void window.openswarm?.voiceSetModel?.(dictationModel);
+  }, [dictationModel]);
   const stateRef = useRef(state);
   stateRef.current = state;
   const heldRef = useRef(false);
@@ -28,7 +35,7 @@ export function VoiceDictationProvider({ children }: { children: React.ReactNode
       // flips state to 'recording', so without this the mic could be started by a click but never
       // stopped by one.
       if (stateRef.current === 'recording') { heldRef.current = false; void stop(); return; }
-      if (stateRef.current === 'idle') { heldRef.current = true; void start(); }
+      if (stateRef.current === 'idle') { heldRef.current = true; void start(true); }
     } else {
       toggle();
     }
diff --git a/frontend/src/shared/voice/createSilenceDetector.ts b/frontend/src/shared/voice/createSilenceDetector.ts
new file mode 100644
index 00000000..f14b4ba6
--- /dev/null
+++ b/frontend/src/shared/voice/createSilenceDetector.ts
@@ -0,0 +1,65 @@
+// Endpointing: decide when the speaker has finished so tap-to-dictate stops itself instead of
+// recording (and transcribing) the gap between "done talking" and "remembered to press again".
+// Energy based on purpose: the mic stream is already float PCM in hand, and a Silero ONNX model
+// would mean shipping onnxruntime into the renderer for a decision this cheap.
+//
+// Every constant is borrowed from shipping code rather than guessed: the 0.004 RMS speech floor is
+// TypeWhisper's, the 0.02 peak companion is openwhispr's, and the 1400ms silence window with a
+// 400ms minimum-speech guard is what Whispering's Silero endpointer uses.
+//
+// The peak test is the load-bearing half. Speech is spiky and room tone is flat, so RMS alone calls
+// a noisy room "talking" forever and the recording never ends; requiring a real peak separates them.
+
+const FRAME_MS = 20;
+const SPEECH_RMS = 0.004;
+const SPEECH_PEAK = 0.02;
+const MIN_SPEECH_MS = 400;
+const SILENCE_HOLD_MS = 1400;
+const MAX_UTTERANCE_MS = 120_000;
+
+export type SilenceVerdict = 'listening' | 'ended' | 'too-long';
+
+export interface SilenceDetector {
+  // Feed every captured chunk; any verdict other than 'listening' means stop recording now.
+  push(samples: Float32Array): SilenceVerdict;
+}
+
+export function createSilenceDetector(sampleRate: number): SilenceDetector {
+  const frameSize = Math.max(1, Math.round((sampleRate * FRAME_MS) / 1000));
+  let elapsedMs = 0;
+  let speechMs = 0;
+  let silenceMs = 0;
+  // Frames straddle chunk boundaries, so carry the partial frame across pushes; dropping the
+  // remainder would make every constant here quietly run ~6% long.
+  let sumSquares = 0;
+  let peak = 0;
+  let framed = 0;
+
+  return {
+    push(samples: Float32Array): SilenceVerdict {
+      for (let i = 0; i < samples.length; i++) {
+        const v = samples[i];
+        sumSquares += v * v;
+        const mag = v < 0 ? -v : v;
+        if (mag > peak) peak = mag;
+        if (++framed < frameSize) continue;
+        const rms = Math.sqrt(sumSquares / frameSize);
+        const isSpeech = rms >= SPEECH_RMS && peak >= SPEECH_PEAK;
+        sumSquares = 0;
+        peak = 0;
+        framed = 0;
+        elapsedMs += FRAME_MS;
+        if (elapsedMs >= MAX_UTTERANCE_MS) return 'too-long';
+        if (isSpeech) {
+          speechMs += FRAME_MS;
+          silenceMs = 0;
+        } else if (speechMs >= MIN_SPEECH_MS) {
+          // Only count quiet AFTER real speech, so an empty room never ends a recording by itself.
+          silenceMs += FRAME_MS;
+        }
+        if (speechMs >= MIN_SPEECH_MS && silenceMs >= SILENCE_HOLD_MS) return 'ended';
+      }
+      return 'listening';
+    },
+  };
+}
diff --git a/frontend/src/shared/voice/useVoiceDictation.ts b/frontend/src/shared/voice/useVoiceDictation.ts
index 23426ec2..e2028a31 100644
--- a/frontend/src/shared/voice/useVoiceDictation.ts
+++ b/frontend/src/shared/voice/useVoiceDictation.ts
@@ -3,6 +3,7 @@ import { API_BASE } from '@/shared/config';
 import { encodeWav, VOICE_SAMPLE_RATE } from './encodeWav';
 import { playVoiceCue } from './voiceCues';
 import { injectAtFocus } from './injectAtFocus';
+import { createSilenceDetector } from './createSilenceDetector';
 
 export type VoiceState = 'idle' | 'recording' | 'transcribing' | 'preparing';
 
@@ -63,6 +64,8 @@ export function useVoiceDictation() {
   const stateRef = useRef<VoiceState>('idle');
   // Live mic level (0..1) for the aurora; a ref, not state, so 60Hz visuals never re-render React.
   const volumeRef = useRef<number>(0);
+  // The capture callback has to reach stop(), which is defined after start(); a ref breaks the knot.
+  const stopRef = useRef<(() => Promise<void>) | null>(null);
   stateRef.current = state;
 
   // First-run: the model is downloading. Poll progress until it lands, then drop back to idle so the
@@ -95,7 +98,9 @@ export function useVoiceDictation() {
     return out;
   }, []);
 
-  const start = useCallback(async (): Promise<void> => {
+  // `hold` = the user is physically holding a key or button, so they own the end of the utterance
+  // and silence must never cut them off mid-thought. Only a tap session endpoints itself.
+  const start = useCallback(async (hold = false): Promise<void> => {
     if (stateRef.current !== 'idle') return;
     if (!window.openswarm?.voiceTranscribe) { setError('desktop-only'); return; } // no Electron bridge = web build
     setError(null);
@@ -105,6 +110,7 @@ export function useVoiceDictation() {
       const source = ctx.createMediaStreamSource(stream);
       const node = ctx.createScriptProcessor(4096, 1, 1);
       const chunks: Float32Array[] = [];
+      const endpointer = hold ? null : createSilenceDetector(ctx.sampleRate);
       node.onaudioprocess = (e): void => {
         const data = e.inputBuffer.getChannelData(0);
         chunks.push(new Float32Array(data));
@@ -113,6 +119,7 @@ export function useVoiceDictation() {
         for (let i = 0; i < data.length; i += 8) sum += data[i] * data[i];
         const rms = Math.sqrt(sum / (data.length / 8));
         volumeRef.current = volumeRef.current * 0.7 + Math.min(1, rms * 6) * 0.3;
+        if (endpointer && endpointer.push(data) !== 'listening') void stopRef.current?.();
       };
       source.connect(node);
       node.connect(ctx.destination);
@@ -180,6 +187,8 @@ export function useVoiceDictation() {
     }
   }, [teardown, pollModel]);
 
+  stopRef.current = stop;
+
   const toggle = useCallback((): void => {
     if (stateRef.current === 'recording') void stop();
     else if (stateRef.current === 'idle') void start();
diff --git a/frontend/src/shared/ws/WebSocketManager.ts b/frontend/src/shared/ws/WebSocketManager.ts
index 41af5a00..f671b9cd 100644
--- a/frontend/src/shared/ws/WebSocketManager.ts
+++ b/frontend/src/shared/ws/WebSocketManager.ts
@@ -35,7 +35,7 @@ import { displaySessionName } from '../state/sessionDisplay';
 import { upsertRun, ackRun, runWorkflowNow, openWorkflowCard, upsertWorkflow, removeWorkflow } from '../state/workflowsSlice';
 import { stepsSignature } from '@/app/pages/Workflows/scheduleUtils';
 import { getAuthToken } from '../config';
-import { notifyAgentCompletion } from '../notifications';
+import { notifyAgentCompletion, notifyWorkflowRun } from '../notifications';
 
 // Phase 0 boot instrumentation: one-shot flag so we report the first streamed agent token to Electron main exactly once per app launch. Module scope (not instance) because multiple WebSocketManagers exist (one per session WS).
 let firstAgentResponseMarked = false;
@@ -771,55 +771,17 @@ class WebSocketManager {
         break;
 
       case 'workflow:notify':
-        try {
-          notifyAgentCompletion({
-            sessionId: data.session_id || data.workflow_id,
-            sessionName: data.workflow_title || 'Workflow',
-            status: data.status === 'success' ? 'completed' : 'error',
+        if (data.workflow_id) {
+          notifyWorkflowRun({
+            workflowId: data.workflow_id,
+            workflowTitle: data.workflow_title || 'Workflow',
+            runId: data.run_id,
+            sessionId: data.session_id,
+            status: data.status,
+            tierKind: data.tier_kind,
+            fallback: data.fallback,
           });
-        } catch { /* notifications are best-effort */ }
-        try {
-          const w: any = (window as any).openswarm;
-          if (w?.notify) {
-            // Seed by workflow id + current minute so multiple workflows pick different copy while a single workflow stays stable within a few minutes.
-            const seed = ((data.workflow_id || '').length + Math.floor(Date.now() / 60000)) | 0;
-            const SUCCESS_TITLES = [
-              `${data.workflow_title || 'Workflow'} — done`,
-              `${data.workflow_title || 'Workflow'} just wrapped up`,
-              `Heads up: ${data.workflow_title || 'Workflow'} finished`,
-              `${data.workflow_title || 'Workflow'} is ready`,
-            ];
-            const FAILURE_TITLES = [
-              `${data.workflow_title || 'Workflow'} hit a snag`,
-              `${data.workflow_title || 'Workflow'} couldn't finish`,
-              `Something went sideways on ${data.workflow_title || 'Workflow'}`,
-            ];
-            const LATE_TITLES = [
-              `${data.workflow_title || 'Workflow'} caught up late`,
-              `${data.workflow_title || 'Workflow'} ran late but made it`,
-            ];
-            const pool = data.status === 'success' ? SUCCESS_TITLES
-              : data.status === 'failure' ? FAILURE_TITLES
-              : data.status === 'ran_late' ? LATE_TITLES
-              : [`${data.workflow_title || 'Workflow'} • ${data.status}`];
-            const title = pool[Math.abs(seed) % pool.length];
-            const isMac = (typeof navigator !== 'undefined' && /Mac/i.test(navigator.platform));
-            const body = data.tier_kind && data.fallback
-              ? `Would have ${data.tier_kind === 'call' ? 'called' : 'texted'} you. (Cloud SMS not wired yet.)`
-              : data.status === 'success'
-                ? (isMac ? 'Tap to see what it did.' : 'Click to see what it did.')
-                : data.status === 'failure'
-                  ? (isMac ? 'Tap to see what went wrong.' : 'Click to see what went wrong.')
-                  : (isMac ? 'Tap to open the run.' : 'Click to open the run.');
-            const deepLink = data.workflow_id ? `openswarm://workflow/${data.workflow_id}/run/${data.run_id || ''}` : undefined;
-            const actions = [
-              { text: 'Looks good', outcome: 'ack' },
-              { text: 'Re-run', outcome: 'rerun' },
-              { text: 'Adjust', outcome: 'edit' },
-            ];
-            w.notify({ title, body, deepLink, runId: data.run_id, workflowId: data.workflow_id, actions });
-          }
-        } catch { /* native notif optional */ }
+        }
         break;
 
       case 'dashboard:browser_card_keep':
diff --git a/frontend/src/types/electron.d.ts b/frontend/src/types/electron.d.ts
index 55b62ef6..9d782dde 100644
--- a/frontend/src/types/electron.d.ts
+++ b/frontend/src/types/electron.d.ts
@@ -1,5 +1,14 @@
 export {};
 
+// One entry in the dictation model catalog, as the main process reports it.
+export interface VoiceModel {
+  id: string;
+  label: string;
+  note: string;
+  sizeMb: number;
+  installed: boolean;
+}
+
 declare global {
   namespace JSX {
     interface IntrinsicElements {
@@ -31,6 +40,23 @@ declare global {
     total: number;
   }
 
+  // A finished-run notification handed to the OS by the Electron main process.
+  interface OpenSwarmNotifyRequest {
+    title: string;
+    body?: string;
+    deepLink?: string;
+    runId?: string;
+    workflowId?: string;
+    actions?: Array<{ text: string; outcome: 'open' | 'ack' | 'rerun' | 'edit' }>;
+  }
+
+  interface OpenSwarmNotifyAction {
+    outcome: 'open' | 'ack' | 'rerun' | 'edit';
+    runId?: string;
+    workflowId?: string;
+    deepLink?: string;
+  }
+
   interface OpenSwarmAPI {
     getBackendPort: () => number;
     getWebviewPreloadPath: () => string;
@@ -55,7 +81,9 @@ declare global {
     hardReset?: () => Promise<void>;
     clearBrowserData?: () => Promise<{ ok: boolean }>;
     voiceWarmup?: () => Promise<{ ok: boolean; error?: string }>;
-    voiceStatus?: () => Promise<{ downloading: boolean; pct: number; error: string | null }>;
+    voiceStatus?: () => Promise<{ downloading: boolean; id: string | null; pct: number; error: string | null }>;
+    voiceModels?: () => Promise<{ models: VoiceModel[]; selected: string }>;
+    voiceSetModel?: (id: string) => Promise<{ ok: boolean; ready: boolean }>;
     voiceTranscribe?: (wav: ArrayBuffer) => Promise<{ ok: boolean; text?: string; error?: string }>;
     voiceInject?: (text: string) => Promise<{ ok: boolean; pasted?: boolean; error?: string }>;
     onVoiceToggle?: (cb: () => void) => () => void;
@@ -63,6 +91,8 @@ declare global {
     voiceRequestHoldPermission?: () => Promise<boolean>;
     onAuthUrl?: (cb: (url: string) => void) => () => void;
     onOauthClaim?: (cb: (url: string) => void) => () => void;
+    notify?: (payload: OpenSwarmNotifyRequest) => Promise<boolean>;
+    onNotificationAction?: (cb: (payload: OpenSwarmNotifyAction) => void) => () => void;
   }
 
   interface Window {
diff --git a/linter/README.md b/linter/README.md
index 5a877caa..4676a74c 100644
--- a/linter/README.md
+++ b/linter/README.md
@@ -42,6 +42,16 @@ These rules apply to `.py`, `.ts`, `.tsx`, `.js`, and `.jsx` files.
 
 Both are backend-only and grandfather pre-existing debt via the `no-underscore-names` / `p-private` exception lists; new code must be clean. (Ported from Haik's linter, which also adds Pyright + Ruff and should eventually supersede this subset.)
 
+### Cross-entity references
+
+**Declared reference targets (`dangling-refs`)** — Backend entities are JSON records that point at each other with bare strings (`Workflow.edit_agent_session_id`, `Output.workspace_id`, `CardPosition.session_id`). The type says `str`, so nothing warns a reader that the referent may be gone, and the miss renders as a blank card instead of a designed empty state.
+
+Every field named `*_id` / `*_ids` on a pydantic `BaseModel` under `backend/` must therefore be declared in `backend/config/entity_references.py`, which names the entity it points at and the store that resolves that entity by id. A model's own primary key is spelled `id`, so it never matches; neither do words that merely end in "id" (`uuid`, `grid`, `valid`), since the underscore is required.
+
+The registry is verified in both directions: an entry for a field that no longer exists is an error, and so is an `EntityStore` whose lookup function has been renamed away. A registry nobody checks is a registry that rots.
+
+Pre-existing fields are grandfathered per FIELD, not per file — the exception entries are keyed `<path>::<Model>.<field>`, so a new id field added to an already-listed model is still caught. A file glob would exempt `workflows/models.py` forever, which is exactly where the next dangling pointer lands.
+
 ## How it runs
 
 ### Linter watch (automatic)
@@ -154,6 +164,7 @@ The project's code conventions live here (a tracked file) rather than in `CLAUDE
 ### Enforced by the linter
 - **No leading `_`** — use `p_` for private. (`no-underscore-names`, backend)
 - **`p_` is a private access boundary** — a `p_` name used across files/classes must be public. (`p-private`, backend)
+- **Cross-entity id fields declare their target.** A new `*_id` on a backend model must be registered in `backend/config/entity_references.py`. (`dangling-refs`, backend)
 - **No runtime import cycles.** (`import-cycles`)
 - **File and folder size caps.** (`max-file-lines`, `max-folder-items`)
 
@@ -190,6 +201,7 @@ linter/
     knip.py            # knip unused-code runner
     endpoints.py       # orphaned endpoint detection
     classes.py         # class-level dead code detection
+    dangling_refs.py   # cross-entity id fields must declare a target entity
   config/              # all configuration files
     config.json        # enabled checks, rules, exclusions, exceptions
     pyrightconfig.json # python type checking config
@@ -211,6 +223,7 @@ deferred.
 | `max-file-lines` (300) | on | Our 300-line precedence. Active for new files; existing debt is grandfathered (see below). |
 | `max-folder-items` (7) | on | Grandfathered per subtree via `.lintignore-max-folder-items` markers in `backend/`, `frontend/`, `debugger/`, `electron/`, `scripts/`. |
 | `vulture` | on | Dead-code detection over `backend/`. Runs against `backend/.venv/bin/vulture`. |
+| `dangling-refs` | on | Cross-entity id fields on backend models must declare a target entity. 42 of the 74 existing fields are in the registry; the other 32 are grandfathered per field. |
 | `no-nested-imports` | off | We deliberately use function-level / lazy imports to break import cycles (400+ sites). Flagging them all is wrong for this codebase. |
 | `eslint`, `knip` | off | Node tooling, deferred to a later pass. |
 | `endpoints` | off | Orphaned-endpoint triage deferred. |
diff --git a/linter/checks/dangling_refs.py b/linter/checks/dangling_refs.py
new file mode 100644
index 00000000..bd2ba3cd
--- /dev/null
+++ b/linter/checks/dangling_refs.py
@@ -0,0 +1,255 @@
+"""Every cross-entity id field on a backend pydantic model must say what it points at.
+
+OpenSwarm stores entities as JSON records that reference each other with bare strings
+(``Workflow.edit_agent_session_id``, ``Output.workspace_id``, ``CardPosition.session_id``). The
+type says ``str``, so nothing tells a reader the referent may be gone, and a reader that forgets
+renders a blank instead of a designed empty state. Measured on real data: 0 of 5 workflow chat
+pointers resolved, and 8 of 10 app workspaces had no record at all.
+
+The rule: a field named ``*_id`` / ``*_ids`` on a class that inherits from pydantic ``BaseModel``
+must be declared in ``backend/config/entity_references.py``, which names the entity it points at
+and the store that resolves it. A model's own primary key is spelled ``id`` and so never matches.
+Pre-existing fields are grandfathered per FIELD (not per file) in the ``dangling-refs`` exception
+list, keyed ``<path>::<Model>.<field>``, so a new field in an old model is still caught.
+
+The registry is checked back: an entry for a field that no longer exists is an error, and so is a
+store whose lookup function has been renamed away. A registry nobody verifies is a registry that
+rots.
+
+Scoped to ``backend/`` Python, like checks/classes.py. One AST pass, no imports of backend code
+(CI lints with a bare interpreter that has no pydantic).
+"""
+
+from __future__ import annotations
+
+import ast
+from pathlib import Path
+from typing import Dict, List, Optional, Set, Tuple
+
+from . import CheckError, is_excepted, is_excluded, is_lintignored
+
+RULE = "dangling-refs"
+REGISTRY_REL = "backend/config/entity_references.py"
+REFERENCES_NAME = "CROSS_ENTITY_REFERENCES"
+STORES_NAME = "ENTITY_STORES"
+KIND_ENUM_NAME = "EntityKind"
+
+# (dotted module, model name, field name)
+FieldKey = Tuple[str, str, str]
+
+
+def p_dotted(rel: str) -> str:
+    """``backend/apps/foo/models.py`` -> ``backend.apps.foo.models``."""
+    parts = list(Path(rel).with_suffix("").parts)
+    if parts and parts[-1] == "__init__":
+        parts.pop()
+    return ".".join(parts)
+
+
+def p_const_str(node: Optional[ast.AST]) -> Optional[str]:
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return node.value
+    return None
+
+
+def p_attr_name(node: Optional[ast.AST]) -> Optional[str]:
+    """``EntityKind.SESSION`` -> ``SESSION``."""
+    return node.attr if isinstance(node, ast.Attribute) else None
+
+
+def p_base_names(node: ast.ClassDef) -> List[str]:
+    names: List[str] = []
+    for base in node.bases:
+        target: ast.AST = base.value if isinstance(base, ast.Subscript) else base
+        if isinstance(target, ast.Name):
+            names.append(target.id)
+        elif isinstance(target, ast.Attribute):
+            names.append(target.attr)
+    return names
+
+
+def p_is_class_var(node: ast.AnnAssign) -> bool:
+    annotation: ast.AST = node.annotation
+    if isinstance(annotation, ast.Subscript):
+        annotation = annotation.value
+    if isinstance(annotation, ast.Name):
+        return annotation.id == "ClassVar"
+    return isinstance(annotation, ast.Attribute) and annotation.attr == "ClassVar"
+
+
+class BackendIndex:
+    """Everything one AST pass over ``backend/`` needs to hand the rest of the check."""
+
+    def __init__(self) -> None:
+        self.bases: Dict[str, List[str]] = {}
+        self.top_level: Dict[str, Set[str]] = {}
+        # (rel path, dotted module, model, field, lineno, col)
+        self.id_fields: List[Tuple[str, str, str, str, int, int]] = []
+        self.p_model_cache: Dict[str, bool] = {}
+
+    def is_model(self, name: str, seen: Optional[Set[str]] = None) -> bool:
+        if name == "BaseModel":
+            return True
+        cached = self.p_model_cache.get(name)
+        if cached is not None:
+            return cached
+        seen = seen if seen is not None else set()
+        if name in seen:
+            return False
+        seen.add(name)
+        result = any(self.is_model(b, seen) for b in self.bases.get(name, []))
+        self.p_model_cache[name] = result
+        return result
+
+
+def p_index_file(index: BackendIndex, tree: ast.Module, rel: str) -> None:
+    module = p_dotted(rel)
+    names: Set[str] = set()
+    for node in tree.body:
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
+            names.add(node.name)
+        elif isinstance(node, ast.Assign):
+            names.update(t.id for t in node.targets if isinstance(t, ast.Name))
+        elif isinstance(node, ast.AnnAssign) and isinstance(node.target, ast.Name):
+            names.add(node.target.id)
+    index.top_level[module] = names
+
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.ClassDef):
+            continue
+        index.bases.setdefault(node.name, []).extend(p_base_names(node))
+        for stmt in node.body:
+            if not isinstance(stmt, ast.AnnAssign) or not isinstance(stmt.target, ast.Name):
+                continue
+            field = stmt.target.id
+            if not (field.endswith("_id") or field.endswith("_ids")) or p_is_class_var(stmt):
+                continue
+            index.id_fields.append((rel, module, node.name, field, stmt.lineno, stmt.col_offset))
+
+
+class Registry:
+    """The parsed contents of entity_references.py, as data."""
+
+    def __init__(self) -> None:
+        self.kinds: Set[str] = set()
+        self.stores: Dict[str, Tuple[str, str, int]] = {}
+        self.references: Dict[FieldKey, Tuple[str, int]] = {}
+
+
+def p_list_literal(tree: ast.Module, name: str) -> Optional[List[ast.expr]]:
+    for node in tree.body:
+        if isinstance(node, ast.Assign):
+            targets: List[ast.expr] = list(node.targets)
+        elif isinstance(node, ast.AnnAssign):
+            targets = [node.target]
+        else:
+            continue
+        if any(isinstance(t, ast.Name) and t.id == name for t in targets):
+            return list(node.value.elts) if isinstance(node.value, ast.List) else None
+    return None
+
+
+def p_parse_registry(path: Path) -> Registry:
+    try:
+        tree = ast.parse(path.read_text(), filename=REGISTRY_REL)
+    except (OSError, SyntaxError) as exc:
+        raise CheckError(f"cannot read the reference registry at {REGISTRY_REL}: {exc}") from exc
+
+    registry = Registry()
+    for node in tree.body:
+        if isinstance(node, ast.ClassDef) and node.name == KIND_ENUM_NAME:
+            for stmt in node.body:
+                if isinstance(stmt, ast.Assign):
+                    registry.kinds.update(t.id for t in stmt.targets if isinstance(t, ast.Name))
+
+    stores = p_list_literal(tree, STORES_NAME)
+    references = p_list_literal(tree, REFERENCES_NAME)
+    if stores is None or references is None:
+        raise CheckError(f"{REGISTRY_REL} must assign {STORES_NAME} and {REFERENCES_NAME} to list literals")
+
+    for element in stores:
+        if not isinstance(element, ast.Call):
+            continue
+        kw = {k.arg: k.value for k in element.keywords if k.arg}
+        kind = p_attr_name(kw.get("kind"))
+        module = p_const_str(kw.get("module"))
+        lookup = p_const_str(kw.get("lookup"))
+        if kind and module and lookup:
+            registry.stores[kind] = (module, lookup, element.lineno)
+
+    for element in references:
+        if not isinstance(element, ast.Call):
+            continue
+        kw = {k.arg: k.value for k in element.keywords if k.arg}
+        module = p_const_str(kw.get("module"))
+        model = p_const_str(kw.get("model"))
+        field = p_const_str(kw.get("field"))
+        target = p_attr_name(kw.get("target"))
+        if module and model and field and target:
+            registry.references[(module, model, field)] = (target, element.lineno)
+    return registry
+
+
+def p_registry_error(lineno: int, message: str) -> str:
+    return f"{REGISTRY_REL}:{lineno}:1: error: [{RULE}] {message}"
+
+
+def p_check_registry(registry: Registry, index: BackendIndex) -> List[str]:
+    """Fail loudly when the registry has drifted from the code it describes."""
+    errors: List[str] = []
+    for kind, (module, lookup, lineno) in sorted(registry.stores.items()):
+        if kind not in registry.kinds:
+            errors.append(p_registry_error(lineno, f"store kind '{kind}' is not a member of {KIND_ENUM_NAME}"))
+        elif lookup not in index.top_level.get(module, set()):
+            errors.append(p_registry_error(lineno, f"store for '{kind}' points at {module}.{lookup}, which no longer exists"))
+
+    declared = {(module, model, field) for _, module, model, field, _, _ in index.id_fields}
+    for (module, model, field), (target, lineno) in sorted(registry.references.items()):
+        if target not in registry.stores:
+            errors.append(p_registry_error(lineno, f"'{model}.{field}' targets '{target}', which has no {STORES_NAME} row"))
+        if (module, model, field) not in declared:
+            errors.append(p_registry_error(lineno, f"'{model}.{field}' in {module} matches no field on a backend model; it was renamed or removed"))
+    return errors
+
+
+def run_dangling_refs_check(
+    root: Path,
+    exceptions: Dict[str, List[str]],
+    excludes: List[str],
+    ignores: Optional[Dict[Path, Set[str]]] = None,
+) -> List[str]:
+    """Flag ``*_id`` / ``*_ids`` fields on backend models that declare no target entity."""
+    backend = root / "backend"
+    if not backend.is_dir():
+        return []
+
+    index = BackendIndex()
+    for pyfile in sorted(backend.rglob("*.py")):
+        if is_excluded(pyfile, root, excludes):
+            continue
+        # Forward slashes even on Windows, so the config's exception globs match there too.
+        rel = pyfile.relative_to(root).as_posix()
+        try:
+            tree = ast.parse(pyfile.read_text(), filename=rel)
+        except (OSError, SyntaxError):
+            continue
+        p_index_file(index, tree, rel)
+
+    registry = p_parse_registry(root / REGISTRY_REL)
+    errors = p_check_registry(registry, index)
+
+    for rel, module, model, field, lineno, col in index.id_fields:
+        if not index.is_model(model):
+            continue
+        if (module, model, field) in registry.references:
+            continue
+        if is_excepted(f"{rel}::{model}.{field}", RULE, exceptions):
+            continue
+        if ignores and is_lintignored(root / rel, root, RULE, ignores):
+            continue
+        errors.append(
+            f"{rel}:{lineno}:{col + 1}: error: [{RULE}] cross-entity id field "
+            f"'{model}.{field}' declares no target entity; add an EntityReference for it in "
+            f"{REGISTRY_REL}, or grandfather '{rel}::{model}.{field}' in the dangling-refs exceptions"
+        )
+    return errors
diff --git a/linter/config/config.json b/linter/config/config.json
index b26b5225..88b64536 100644
--- a/linter/config/config.json
+++ b/linter/config/config.json
@@ -11,6 +11,7 @@
     "classes": false,
     "no-underscore-names": true,
     "p-private": true,
+    "dangling-refs": true,
     "ruff": true,
     "pyright": true
   },
@@ -19,10 +20,11 @@
     "eslint-knip": "Node tooling deferred to a later pass.",
     "classes": "Placeholder check, not wired up. endpoints: orphaned-endpoint triage deferred.",
     "max-file-lines-exceptions": "Grandfather list of pre-existing >300-line files (existing debt, not new). Paths updated after the folder-tree restructure moved several of them. The two manager/prompt/* entries are from the agent_manager decomposition: prompt_context.py aggregates the system-prompt context builders and attachments.py is one cohesive 230-line attachment resolver; both are single-responsibility and a few lines over, not splittable without an artificial seam.",
-    "max-folder-items-exceptions": "Exact-path allow for folders intentionally over the cap. The rule trips at >7 (7 items is fine, the 8th tips it), so only genuinely 8+ folders are listed. backend/ and backend/apps are FastAPI feature-package registries (each child is an app mounted in main.py); agents/ aggregates agent subsystems; agents/manager/ is the agent_manager god-object decomposition (cohesive AgentManager mixins + standalone run helpers + the streaming/permissions/prompt/session subtrees), conventionally flat like agents/ and core/ since its standalone helpers are heterogeneous and don't group cleanly; agents/manager/streaming and agents/manager/session are flat peer collections of one-module-per-concern handlers; core/, tools_lib/, tests/ are conventionally flat. Frontend: app/pages is the page registry, AgentChat/ChatInput/Settings-sections/Onboarding are organizational parents, and shared/state (Redux slices) plus hooks/steps/mcp-cards/Views are flat peer collections. scripts/, electron/, linter/checks/ are flat tool dirs. These replaced blanket .lintignore-max-folder-items sentinels (backend, frontend, scripts, electron, linter/checks) so the rule still catches NEW unplanned bloat everywhere else. Kept as whole-subtree sentinels on purpose: debugger/ (self-contained injected sub-tool with its own Vite GUI), webapp_template (Vite scaffold payload), and vendored mcp-bundles. 2026-07 desktop-shell additions: Dashboard canvas/cards/desktop + hooks/interaction + hooks/lifecycle, AgentChat bubbles/tool-ui, and shared/styles are flat peer collections (one component or hook per concern) that crossed 7 as the redesign surface grew. frontend/src/toolui carries a whole-subtree .lintignore: vendored tool-ui component library (pierre), same treatment as mcp-bundles.",
+    "max-folder-items-exceptions": "Exact-path allow for folders intentionally over the cap. The rule trips at >7 (7 items is fine, the 8th tips it), so only genuinely 8+ folders are listed. backend/ and backend/apps are FastAPI feature-package registries (each child is an app mounted in main.py); agents/ aggregates agent subsystems; agents/manager/ is the agent_manager god-object decomposition (cohesive AgentManager mixins + standalone run helpers + the streaming/permissions/prompt/session subtrees), conventionally flat like agents/ and core/ since its standalone helpers are heterogeneous and don't group cleanly; agents/manager/streaming and agents/manager/session are flat peer collections of one-module-per-concern handlers; core/, tools_lib/, tests/ are conventionally flat. Frontend: app/pages is the page registry, AgentChat/ChatInput/Settings-sections/Onboarding are organizational parents, and shared/state (Redux slices) plus hooks/steps/mcp-cards/Views are flat peer collections. scripts/, electron/, linter/checks/ are flat tool dirs. These replaced blanket .lintignore-max-folder-items sentinels (backend, frontend, scripts, electron, linter/checks) so the rule still catches NEW unplanned bloat everywhere else. Kept as whole-subtree sentinels on purpose: debugger/ (self-contained injected sub-tool with its own Vite GUI), webapp_template (Vite scaffold payload), and vendored mcp-bundles. 2026-07 desktop-shell additions: Dashboard canvas/cards/desktop + hooks/interaction + hooks/lifecycle, AgentChat bubbles/tool-ui, and shared/styles are flat peer collections (one component or hook per concern) that crossed 7 as the redesign surface grew. frontend/src/toolui carries a whole-subtree .lintignore: vendored tool-ui component library (pierre), same treatment as mcp-bundles. openswarm-edge/app is the edge's flat one-module-per-concern set (routing, bundles, inject, ratelimit, sandbox, and the vendored code_safety gate); it crossed 7 when the sandbox's static gate was split out to mirror the desktop file byte for byte. AgentChat/parsing joined when the narration/deliverable classifier landed: it is the same flat one-module-per-parser collection as the rest of that subtree.",
     "import-cycles": "Flags RUNTIME circular imports only (SCC>1). Skips type-only imports (import type / export type) and dynamic import() since neither runs at module init, which is why the idiomatic Redux store<->hooks type cycle is not flagged. Frontend alias resolution comes from import-cycle-aliases. Zero cycles today; the check keeps it that way.",
     "ruff + pyright": "Ported from Haik's linter (haik/feat/ingest). ruff is narrowed to F401/F811/F841 (unused imports/redefs/locals) and intentionally DROPS Haik's ARG001/ARG002 (unused args): our SDK-callback signatures require unused params (can_use_tool/pre_tool_hook take a `context` they don't use) and we ban the `_unused` prefix, so ARG is noise here. pyright runs Haik's existence-only config (typeCheckingMode off) with reportAttributeAccessIssue ENABLED: the AgentManager behavior classes now inherit a typing-only AgentManagerProtocol base (manager/AgentManagerProtocol.py) that declares the composed __init__ state + cross-class methods, so the checker sees self.sessions etc. from inside a mixin. pyright caught real bugs: a dangling `_conns` ref + TWO broken lazy imports (`_load_all`/`_load` from outputs.py, renamed to load_all/load in workspace_io but the import sites weren't updated \u2014 App Builder workspace seeding/name-sync was silently failing in a try/except). The one grandfathered SURFACE file (handle_assistant_message) is the SDK-optional try/except-import boundary (TextBlock=object fallback defeats isinstance narrowing). Both grandfather pre-existing debt by file; the refactor surface is clean. Requires `ruff` + `pyright` on PATH (added to requirements-dev.txt); pyright's config expects the venv at backend/.venv.",
-    "no-underscore-names + p-private": "Convention checks ported verbatim from Haik's linter (haik/feat/ingest): no-underscore-names bans leading-underscore names (a dead-code-tooling blind spot; use p_ for private), p-private enforces that p_-prefixed names are accessed only inside their owning file/class (cross-file/class use means the name should be public). Backend Python only. The exception lists grandfather pre-existing debt that landed with the workflows/analytics forward-ports (eric's 'don't mass-migrate untouched files' rule); the agent_manager refactor surface is clean. NOTE: Haik's full linter (his branch also adds pyright + ruff and runs a different enabled set) should eventually supersede this; these two were lifted to enforce the p_ conventions on eric/dev now. browser_cookies.py and its Windows round-trip test are excepted for `_fields_` only: a ctypes.Structure protocol name required by the ctypes metaclass, not our naming."
+    "no-underscore-names + p-private": "Convention checks ported verbatim from Haik's linter (haik/feat/ingest): no-underscore-names bans leading-underscore names (a dead-code-tooling blind spot; use p_ for private), p-private enforces that p_-prefixed names are accessed only inside their owning file/class (cross-file/class use means the name should be public). Backend Python only. The exception lists grandfather pre-existing debt that landed with the workflows/analytics forward-ports (eric's 'don't mass-migrate untouched files' rule); the agent_manager refactor surface is clean. NOTE: Haik's full linter (his branch also adds pyright + ruff and runs a different enabled set) should eventually supersede this; these two were lifted to enforce the p_ conventions on eric/dev now. browser_cookies.py and its Windows round-trip test are excepted for `_fields_` only: a ctypes.Structure protocol name required by the ctypes metaclass, not our naming.",
+    "dangling-refs": "Every *_id / *_ids field on a backend pydantic model must name the entity it points at, in backend/config/entity_references.py. A model's own primary key is spelled `id`, which never matches the suffix, and neither do words that merely END in id (uuid, grid, valid) since the underscore is required. 42 of the 74 existing fields are declared in the registry (sessions, dashboards, workflows, workflow runs, apps/outputs, workspaces); the 32 listed here are grandfathered debt, and the entry is keyed <path>::<Model>.<field> rather than by file ON PURPOSE, so a NEW id field added to an already-listed model is still caught (a file glob would exempt workflows/models.py forever, which is exactly where the next dangling pointer lands). The grandfathered set is what does not resolve against a store: renderer-owned live objects (browser_id, selected_browser_ids, selected_setting_ids), ids internal to a single record (active_branch_id, msg_id, parent_id, fork_point_message_id, compacted_through_msg_id), external protocol ids we do not own (sdk_session_id, client_message_id, connection_id, installation_id, user_id), telemetry echoes (analytics bridges), and the skill-registry / .swarm-bundle entities that have no backend store module yet. Move an entry out of this list and into the registry when its entity gets one. backend/tests/*::* is blanket-exempt: a test-local model is not a persisted entity. The registry is checked back both ways, so an entry for a deleted field, or a store whose lookup function was renamed, is an error too."
   },
   "rules": {
     "max-file-lines": 300,
@@ -151,46 +153,50 @@
       "frontend/src/shared/browserCommandHandler.ts",
       "frontend/src/shared/state/agentsSlice.ts",
       "frontend/src/shared/state/dashboardLayoutSlice.ts",
-      "frontend/src/shared/ws/WebSocketManager.ts"
+      "frontend/src/shared/ws/WebSocketManager.ts",
+      "backend/apps/workflows/cloud/client.py"
     ],
     "max-folder-items": [
       "backend",
       "backend/apps",
-      "backend/apps/reddit_mcp_shim",
-      "backend/apps/x_mcp_shim",
-      "backend/apps/tiktok_mcp_shim",
       "backend/apps/agents",
       "backend/apps/agents/core",
       "backend/apps/agents/manager",
       "backend/apps/agents/manager/session",
       "backend/apps/agents/manager/streaming",
       "backend/apps/outputs",
-      "backend/apps/tools_lib",
+      "backend/apps/reddit_mcp_shim",
       "backend/apps/service",
+      "backend/apps/tiktok_mcp_shim",
+      "backend/apps/tools_lib",
+      "backend/apps/x_mcp_shim",
       "backend/tests",
-      "frontend/src/shared",
-      "frontend/src/shared/state",
-      "frontend/src/shared/hooks",
+      "electron",
+      "frontend/src/app/components/Onboarding",
+      "frontend/src/app/components/Onboarding/steps",
       "frontend/src/app/pages",
       "frontend/src/app/pages/AgentChat",
       "frontend/src/app/pages/AgentChat/ChatInput",
       "frontend/src/app/pages/AgentChat/ChatInput/hooks",
-      "frontend/src/app/pages/AgentChat/mcp-cards",
       "frontend/src/app/pages/AgentChat/bubbles",
+      "frontend/src/app/pages/AgentChat/mcp-cards",
+      "frontend/src/app/pages/AgentChat/parsing",
       "frontend/src/app/pages/AgentChat/tool-ui",
       "frontend/src/app/pages/Dashboard/canvas",
       "frontend/src/app/pages/Dashboard/cards",
       "frontend/src/app/pages/Dashboard/desktop",
       "frontend/src/app/pages/Dashboard/hooks/interaction",
       "frontend/src/app/pages/Dashboard/hooks/lifecycle",
-      "frontend/src/shared/styles",
       "frontend/src/app/pages/Settings/sections",
       "frontend/src/app/pages/Views",
-      "frontend/src/app/components/Onboarding",
-      "frontend/src/app/components/Onboarding/steps",
+      "frontend/src/shared",
+      "frontend/src/shared/hooks",
+      "frontend/src/shared/state",
+      "frontend/src/shared/styles",
+      "linter/checks",
+      "openswarm-edge/app",
       "scripts",
-      "electron",
-      "linter/checks"
+      "backend/apps/workflows/cloud"
     ],
     "no-nested-imports": [],
     "import-cycles": [],
@@ -231,6 +237,41 @@
       "backend/tests/test_workflows_semantics.py",
       "backend/tests/test_workflows_storage.py"
     ],
+    "dangling-refs": [
+      "backend/apps/agents/core/models.py::AgentSession.active_branch_id",
+      "backend/apps/agents/core/models.py::AgentSession.browser_id",
+      "backend/apps/agents/core/models.py::AgentSession.compacted_through_msg_id",
+      "backend/apps/agents/core/models.py::AgentSession.sdk_session_id",
+      "backend/apps/agents/core/models.py::ApprovalResponse.request_id",
+      "backend/apps/agents/core/models.py::Message.branch_id",
+      "backend/apps/agents/core/models.py::Message.client_message_id",
+      "backend/apps/agents/core/models.py::Message.parent_id",
+      "backend/apps/agents/core/models.py::MessageBranch.fork_point_message_id",
+      "backend/apps/agents/core/models.py::MessageBranch.parent_branch_id",
+      "backend/apps/agents/manager/Messaging.py::QueuedMessage.client_message_id",
+      "backend/apps/agents/manager/Messaging.py::QueuedMessage.selected_browser_ids",
+      "backend/apps/agents/manager/Messaging.py::QueuedMessage.selected_setting_ids",
+      "backend/apps/agents/manager/permissions/workflow_approval.py::WorkflowApprovalMemory.current_step_id",
+      "backend/apps/agents/manager/streaming/PartialReply.py::PartialReply.branch_id",
+      "backend/apps/agents/manager/streaming/PartialReply.py::PartialReply.msg_id",
+      "backend/apps/agents/manager/streaming/state.py::ThinkingState.msg_id",
+      "backend/apps/agents/manager/streaming/state.py::TurnState.stream_text_msg_id",
+      "backend/apps/dashboards/models.py::BrowserCardPosition.browser_id",
+      "backend/apps/nine_router/credential_store.py::ProviderCredential.connection_id",
+      "backend/apps/outputs/models.py::OutputVersion.parent_id",
+      "backend/apps/service/analytics/agent_bridge.py::BroadcastMessage.branch_id",
+      "backend/apps/service/analytics/agent_bridge.py::BroadcastMessage.parent_id",
+      "backend/apps/service/analytics/frontend_bridge.py::FrontendEventProps.dashboard_id",
+      "backend/apps/service/analytics/frontend_bridge.py::FrontendEventProps.step_id",
+      "backend/apps/settings/models.py::AppSettings.installation_id",
+      "backend/apps/settings/models.py::AppSettings.user_id",
+      "backend/apps/skill_registry/skill_registry.py::p_InstallRequest.skill_id",
+      "backend/apps/skill_registry/skill_registry.py::p_UpdateRequest.skill_id",
+      "backend/apps/swarm/models.py::EntityRef.bundle_id",
+      "backend/apps/swarm/models.py::ImportCommitResponse.root_id",
+      "backend/apps/swarm/models.py::Manifest.bundle_id",
+      "backend/tests/*::*"
+    ],
     "ruff": [
       "backend/apps/agents/agents.py",
       "backend/apps/agents/browser/browser_agent.py",
diff --git a/linter/config/vulture_whitelist.py b/linter/config/vulture_whitelist.py
index 91ddb509..5de8dfcc 100644
--- a/linter/config/vulture_whitelist.py
+++ b/linter/config/vulture_whitelist.py
@@ -72,3 +72,9 @@ resolve_forced_tools
 used_llm
 usage_summary
 last_run_at
+
+# config/entity_references.py: the cross-entity reference registry. Its consumer is
+# the dangling-refs linter check, which reads the file as data rather than importing
+# it, so vulture sees two module-level tables nobody touches.
+ENTITY_STORES
+CROSS_ENTITY_REFERENCES
diff --git a/linter/lint.py b/linter/lint.py
index ccd605f2..b318d26c 100644
--- a/linter/lint.py
+++ b/linter/lint.py
@@ -18,6 +18,7 @@ from checks.knip import run_knip
 from checks.endpoints import run_endpoint_check
 from checks.classes import run_class_check
 from checks.cycles import run_cycle_check
+from checks.dangling_refs import run_dangling_refs_check
 from checks.no_underscore_names import run_underscore_check
 from checks.p_private import run_p_private_check
 from checks.ruff import run_ruff
@@ -33,7 +34,7 @@ def load_config() -> dict[str, Any]:
         return json.load(f)
 
 
-def run_checks(root: Path) -> tuple[list[str], list[str], list[str], list[str], list[str], list[str], list[str], list[str], list[str], list[str], list[str]]:
+def run_checks(root: Path) -> tuple[list[str], list[str], list[str], list[str], list[str], list[str], list[str], list[str], list[str], list[str], list[str], list[str]]:
     config = load_config()
     enabled: dict[str, bool] = config.get("enabled", {})
     rules: dict[str, int] = config["rules"]
@@ -114,6 +115,14 @@ def run_checks(root: Path) -> tuple[list[str], list[str], list[str], list[str],
     underscore_errors = run_underscore_check(root, exceptions, excludes, ignores) if enabled.get("no-underscore-names", False) else []
     p_private_errors = run_p_private_check(root, exceptions, excludes, ignores) if enabled.get("p-private", False) else []
 
+    # A dangling reference becomes a linter error at declaration time, not a blank card six months later.
+    dangling_ref_errors: list[str] = []
+    if enabled.get("dangling-refs", False):
+        try:
+            dangling_ref_errors = run_dangling_refs_check(root, exceptions, excludes, ignores)
+        except CheckError as e:
+            dangling_ref_errors = [f"dangling-refs: check could not run: {e.reason}"]
+
     # ruff (scoped dead-code codes) + pyright (existence errors), also from Haik's
     # linter. Both shell out to a tool, so a missing tool / timeout raises CheckError
     # and is surfaced as a loud error rather than a silently-clean empty result.
@@ -130,7 +139,7 @@ def run_checks(root: Path) -> tuple[list[str], list[str], list[str], list[str],
         except CheckError as e:
             pyright_errors = [f"pyright: check could not run: {e.reason}"]
 
-    return sorted(structural_errors), sorted(vulture_errors), sorted(eslint_errors), sorted(knip_errors), sorted(endpoint_errors), sorted(class_errors), sorted(cycle_errors), sorted(underscore_errors), sorted(p_private_errors), sorted(ruff_errors), sorted(pyright_errors)
+    return sorted(structural_errors), sorted(vulture_errors), sorted(eslint_errors), sorted(knip_errors), sorted(endpoint_errors), sorted(class_errors), sorted(cycle_errors), sorted(underscore_errors), sorted(p_private_errors), sorted(dangling_ref_errors), sorted(ruff_errors), sorted(pyright_errors)
 
 
 def _print_section(name: str, errors: list[str]) -> None:
@@ -145,8 +154,8 @@ def print_results(
     eslint_errors: list[str], knip_errors: list[str],
     endpoint_errors: list[str], class_errors: list[str],
     cycle_errors: list[str], underscore_errors: list[str],
-    p_private_errors: list[str], ruff_errors: list[str],
-    pyright_errors: list[str],
+    p_private_errors: list[str], dangling_ref_errors: list[str],
+    ruff_errors: list[str], pyright_errors: list[str],
 ) -> None:
     _print_section("structural", structural_errors)
     _print_section("vulture", vulture_errors)
@@ -157,6 +166,7 @@ def print_results(
     _print_section("import-cycles", cycle_errors)
     _print_section("no-underscore-names", underscore_errors)
     _print_section("p-private", p_private_errors)
+    _print_section("dangling-refs", dangling_ref_errors)
     _print_section("ruff", ruff_errors)
     _print_section("pyright", pyright_errors)
 
diff --git a/openswarm-edge/app/code_safety.py b/openswarm-edge/app/code_safety.py
new file mode 100644
index 00000000..d05364ff
--- /dev/null
+++ b/openswarm-edge/app/code_safety.py
@@ -0,0 +1,223 @@
+"""Static safety gate for published apps' backend.py compute.
+
+VENDORED, verbatim below this docstring, from backend/apps/outputs/code_safety.py
+(the desktop App Builder gate). test_edge_sandbox_mirrors_backend.py in the
+backend suite fails if the two drift, because a gate that is only tightened on
+the desktop leaves the internet-facing copy open.
+"""
+
+import ast
+import importlib
+import types
+from typing import Dict, List, Optional, Set
+
+# Modules backend code is allowed to import. This is not an OS-level jail, so keep the list to "data shaping" libraries; no I/O, no networking, no subprocess. It pairs with cwd=tempdir + minimal env so the blast radius stays small.
+ALLOWED_MODULES = frozenset({
+    "json", "math", "re", "datetime", "collections", "itertools",
+    "functools", "statistics", "decimal", "fractions", "random",
+    "string", "textwrap", "unicodedata", "csv", "copy", "enum",
+    "dataclasses", "typing", "abc", "numbers", "uuid", "hashlib",
+    "base64", "binascii", "operator", "heapq", "bisect", "array",
+})
+
+# Builtins that punch holes through the allowlist or do I/O. Most are also deleted off `builtins` inside the subprocess; exec/compile/__import__ can't be, because the import machinery runs on them.
+P_BLOCKED_BUILTINS = frozenset({
+    "exec", "eval", "compile", "__import__", "open", "input",
+    "breakpoint", "exit", "quit",
+})
+
+# These hand back a live namespace dict, which is every blocked name again through a different door. Warned about but never deleted: library code calls them constantly, and a scrubbed `builtins` would break `import csv` itself.
+P_NAMESPACE_BUILTINS = frozenset({"vars", "globals", "locals"})
+
+# Spell an attribute as a string and the AST can't read it, so these are allowed only with a plain literal that would have passed written out longhand.
+P_DYNAMIC_ATTR_BUILTINS = frozenset({"getattr", "setattr", "delattr"})
+
+# Modules the executor preamble binds into the user's namespace with no import. `json` stays usable (it is allowlisted anyway); these three were the free handles that made the whole allowlist decorative.
+P_SANDBOX_MODULE_HANDLES = frozenset({"sys", "io", "builtins"})
+
+# Dunders that hold a reference to nothing at all, and `if __name__ == "__main__"` is far too common to punish.
+P_INERT_DUNDERS = frozenset({"__name__", "__file__", "__doc__"})
+
+
+class UnsafeCodeError(Exception):
+    """Raised when the static gate rejects user-supplied backend code."""
+
+
+def p_is_dunder(name: str) -> bool:
+    return len(name) > 4 and name.startswith("__") and name.endswith("__")
+
+
+def p_dotted_chain(node: ast.expr) -> Optional[List[str]]:
+    """['json', 'codecs', 'open'] for `json.codecs.open`; None when the chain
+    doesn't start at a plain name."""
+    parts: List[str] = []
+    current: ast.expr = node
+    while isinstance(current, ast.Attribute):
+        parts.append(current.attr)
+        current = current.value
+    if not isinstance(current, ast.Name):
+        return None
+    parts.append(current.id)
+    parts.reverse()
+    return parts
+
+
+def p_resolved_module(chain: List[str], aliases: Dict[str, str]) -> Optional[str]:
+    """The name of the module an attribute chain resolves to, or None if it
+    resolves to something that isn't a module.
+
+    `json.codecs` is a module and `datetime.time` is a class, and only the live
+    object knows which; matching attribute names against a list of module names
+    would flag both. So resolve against the module actually imported. Safe to
+    import here because `aliases` only ever holds allowlisted stdlib roots.
+    """
+    root = aliases.get(chain[0])
+    if root is None:
+        return None
+    try:
+        value: object = importlib.import_module(root)
+        for attr in chain[1:]:
+            value = getattr(value, attr)
+    except Exception:
+        return None
+    return value.__name__ if isinstance(value, types.ModuleType) else None
+
+
+def p_module_aliases(tree: ast.Module) -> Dict[str, str]:
+    """Local name -> allowlisted module it holds. Plain assignment counts, so
+    `m = json` doesn't launder `m.codecs` past the chain check. Modules outside
+    the allowlist are never recorded, which is what keeps the resolver above
+    from importing anything a hostile file names."""
+    aliases: Dict[str, str] = {"json": "json"}
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                root = alias.name.split(".")[0]
+                if root in ALLOWED_MODULES:
+                    aliases[alias.asname or root] = root
+    assigns = [n for n in ast.walk(tree) if isinstance(n, ast.Assign)]
+    for _ in range(len(assigns)):
+        before = len(aliases)
+        for node in assigns:
+            if len(node.targets) != 1 or not isinstance(node.targets[0], ast.Name):
+                continue
+            chain = p_dotted_chain(node.value)
+            resolved = p_resolved_module(chain, aliases) if chain else None
+            if resolved and resolved.split(".")[0] in ALLOWED_MODULES:
+                aliases[node.targets[0].id] = resolved
+        if len(aliases) == before:
+            break
+    return aliases
+
+
+def p_dunder_warning(attr: str, prefix: str) -> Optional[str]:
+    if p_is_dunder(attr) and attr not in P_INERT_DUNDERS:
+        return f"Uses dunder '{prefix}{attr}', which walks the object graph past the allowlist"
+    return None
+
+
+def p_attribute_warning(chain: List[str], aliases: Dict[str, str]) -> Optional[str]:
+    """The verdict on one resolved attribute chain, dunders first."""
+    for attr in chain[1:]:
+        dunder = p_dunder_warning(attr, ".")
+        if dunder:
+            return dunder
+    for depth in range(2, len(chain) + 1):
+        reached = p_resolved_module(chain[:depth], aliases)
+        if reached and reached.split(".")[0] not in ALLOWED_MODULES:
+            return f"Reaches module '{reached}' via '{'.'.join(chain[:depth])}' (outside the safe-data-shaping allowlist)"
+    return None
+
+
+def p_call_warning(node: ast.Call, aliases: Dict[str, str]) -> Optional[str]:
+    if not isinstance(node.func, ast.Name):
+        return None
+    name = node.func.id
+    if name in P_BLOCKED_BUILTINS:
+        return f"Calls builtin '{name}()' which can escape the sandbox"
+    if name in P_NAMESPACE_BUILTINS:
+        return f"Calls '{name}()', which hands back the sandbox's own namespace"
+    if name not in P_DYNAMIC_ATTR_BUILTINS:
+        return None
+    attr = node.args[1] if len(node.args) > 1 else None
+    if not isinstance(attr, ast.Constant) or not isinstance(attr.value, str):
+        return f"Computes an attribute name for '{name}()', which can spell any escape as a string"
+    base = p_dotted_chain(node.args[0])
+    if base is None:
+        return p_dunder_warning(attr.value, ".")
+    return p_attribute_warning(base + [attr.value], aliases)
+
+
+def p_star_import_warning(module: str, aliases: Dict[str, str]) -> Optional[str]:
+    """`from json import *` binds whatever json's __all__ names, which is a
+    short list of functions today but is not ours to assume."""
+    try:
+        imported = importlib.import_module(module)
+    except Exception:
+        return None
+    names = getattr(imported, "__all__", None) or [n for n in dir(imported) if not n.startswith("_")]
+    for name in names:
+        warning = p_attribute_warning([module, str(name)], aliases)
+        if warning:
+            return warning
+    return None
+
+
+def get_code_warnings(code: str) -> List[str]:
+    """Return human-readable warnings for every static risk, without raising.
+
+    `/api/outputs/execute` surfaces these in the run dialog, so an Output that
+    genuinely needs `pandas` gets a "review and click Run Anyway" affordance
+    instead of a silent 500. An empty list is what buys the no-prompt auto-run
+    path, so anything that could reach past the allowlist has to land in it. A
+    syntax error is reported as a warning rather than raised, so the dialog can
+    show it next to the code.
+    """
+    try:
+        tree = ast.parse(code)
+    except SyntaxError as e:
+        return [f"Syntax error: {e}"]
+
+    aliases = p_module_aliases(tree)
+    warnings: List[str] = []
+    seen: Set[str] = set()
+
+    def note(msg: Optional[str]) -> None:
+        if msg and msg not in seen:
+            seen.add(msg)
+            warnings.append(msg)
+
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                if alias.name.split(".")[0] not in ALLOWED_MODULES:
+                    note(f"Imports '{alias.name}' (outside the safe-data-shaping allowlist)")
+        elif isinstance(node, ast.ImportFrom):
+            root = (node.module or "").split(".")[0]
+            if root not in ALLOWED_MODULES:
+                note(f"Imports from '{node.module}' (outside the safe-data-shaping allowlist)")
+                continue
+            for alias in node.names:
+                if alias.name == "*":
+                    note(p_star_import_warning(root, aliases))
+                else:
+                    note(p_attribute_warning([root, alias.name], aliases))
+        elif isinstance(node, ast.Call):
+            note(p_call_warning(node, aliases))
+        elif isinstance(node, ast.Attribute):
+            chain = p_dotted_chain(node)
+            note(p_attribute_warning(chain, aliases) if chain else p_dunder_warning(node.attr, "."))
+        elif isinstance(node, ast.Name):
+            if node.id in P_SANDBOX_MODULE_HANDLES:
+                note(f"References '{node.id}', a live module the sandbox binds but the allowlist withholds")
+            else:
+                note(p_dunder_warning(node.id, ""))
+    return warnings
+
+
+def validate_code_safety(code: str) -> None:
+    """Raise UnsafeCodeError on the first static risk. The strict wrapper around
+    get_code_warnings, for callers with no user to ask."""
+    warnings = get_code_warnings(code)
+    if warnings:
+        raise UnsafeCodeError(warnings[0])
diff --git a/openswarm-edge/app/main.py b/openswarm-edge/app/main.py
index 1c0cecd2..fa819cf3 100644
--- a/openswarm-edge/app/main.py
+++ b/openswarm-edge/app/main.py
@@ -20,7 +20,8 @@ from .bundles import get_bundle, resolve_file
 from .fallback import apex_page, not_found_page
 from .inject import inject_runtime
 from .ratelimit import RateLimiter
-from .sandbox import UnsafeCodeError, run_backend
+from .code_safety import UnsafeCodeError
+from .sandbox import run_backend
 
 APPS_BASE_DOMAIN = os.environ.get("APPS_BASE_DOMAIN", "openswarm.host")
 # The metered-LLM call goes to the cloud over Fly's PRIVATE 6PN mesh (encrypted,
diff --git a/openswarm-edge/app/sandbox.py b/openswarm-edge/app/sandbox.py
index c7a0947e..585c6830 100644
--- a/openswarm-edge/app/sandbox.py
+++ b/openswarm-edge/app/sandbox.py
@@ -1,13 +1,13 @@
 """Sandboxed Python runner for published apps' backend.py compute.
 
 VENDORED from backend/apps/outputs/executor.py (the desktop App Builder runtime).
-Keep the allow/deny lists + the subprocess hardening in sync with that file; this
-is the same data-shaping sandbox, just running in the edge instead of on the
-desktop. Pure compute only: no network, no disk, no subprocess, no secrets. Safe
-to run multi-tenant on one machine because nothing here can reach shared state."""
+Keep the subprocess hardening in sync with that file; this is the same
+data-shaping sandbox, just running in the edge instead of on the desktop. The
+static gate it runs on every call lives in the vendored app/code_safety.py. Pure
+compute only: no network, no disk, no subprocess, no secrets. Safe to run
+multi-tenant on one machine because nothing here can reach shared state."""
 from __future__ import annotations
 
-import ast
 import asyncio
 import json
 import os
@@ -15,46 +15,10 @@ import sys
 import tempfile
 from dataclasses import dataclass
 
+from app.code_safety import ALLOWED_MODULES, validate_code_safety
+
 TIMEOUT_SECONDS = 30
 
-_ALLOWED_MODULES = frozenset({
-    "json", "math", "re", "datetime", "collections", "itertools",
-    "functools", "statistics", "decimal", "fractions", "random",
-    "string", "textwrap", "unicodedata", "csv", "copy", "enum",
-    "dataclasses", "typing", "abc", "numbers", "uuid", "hashlib",
-    "base64", "binascii", "operator", "heapq", "bisect", "array",
-})
-
-_BLOCKED_BUILTINS = frozenset({
-    "exec", "eval", "compile", "__import__", "open", "input",
-    "breakpoint", "exit", "quit",
-})
-
-
-class UnsafeCodeError(Exception):
-    """AST validation rejected the backend code."""
-
-
-def validate_code_safety(code: str) -> None:
-    """Raise UnsafeCodeError on the first AST-visible risk. Published apps are
-    vetted at publish time, but we re-check here: the edge never trusts that the
-    bundle in storage matches what was scanned."""
-    try:
-        tree = ast.parse(code)
-    except SyntaxError as e:
-        raise UnsafeCodeError(f"Syntax error: {e}")
-    for node in ast.walk(tree):
-        if isinstance(node, ast.Import):
-            for alias in node.names:
-                if alias.name.split(".")[0] not in _ALLOWED_MODULES:
-                    raise UnsafeCodeError(f"import '{alias.name}' is not allowed")
-        elif isinstance(node, ast.ImportFrom):
-            if node.module and node.module.split(".")[0] not in _ALLOWED_MODULES:
-                raise UnsafeCodeError(f"import from '{node.module}' is not allowed")
-        elif isinstance(node, ast.Call):
-            if isinstance(node.func, ast.Name) and node.func.id in _BLOCKED_BUILTINS:
-                raise UnsafeCodeError(f"builtin '{node.func.id}()' is not allowed")
-
 
 def _minimal_env() -> dict:
     return {
@@ -79,19 +43,22 @@ async def run_backend(code: str, input_data: dict) -> ComputeResult:
 
     preamble = (
         "import json, sys, io, builtins\n"
-        "for _b in ('exec','eval','compile','open','input',\n"
-        "           'breakpoint','exit','quit'):\n"
-        "    try: delattr(builtins, _b)\n"
-        "    except AttributeError: pass\n"
-        "_orig_stdout = sys.stdout\n"
-        "_capture = io.StringIO()\n"
-        "sys.stdout = _capture\n"
+        "p_stdout = sys.stdout\n"
+        "p_capture = io.StringIO()\n"
+        "sys.stdout = p_capture\n"
         "input_data = json.loads(sys.stdin.read())\n"
         "result = {}\n"
+        # Warm the allowlist BEFORE scrubbing builtins: half the stdlib borrows the builtins the scrub deletes while it loads (tokenize does `from builtins import open`, taking `import dataclasses` with it). Then the module handles go, because leaving `sys` bound hands gate-passing code a live `sys.modules['os']` with no import statement in sight.
+        f"for p_name in {tuple(sorted(ALLOWED_MODULES))!r}:\n"
+        "    try: __import__(p_name)\n"
+        "    except ImportError: pass\n"
+        "for p_name in ('open','input','breakpoint','exit','quit'):\n"
+        "    try: delattr(builtins, p_name)\n"
+        "    except AttributeError: pass\n"
+        "del sys, io, builtins, p_name\n"
     )
     postamble = (
-        "\nsys.stdout = _orig_stdout\n"
-        'json.dump({"__stdout__": _capture.getvalue(), "__result__": result}, sys.stdout)\n'
+        "\np_stdout.write(json.dumps({\"__stdout__\": p_capture.getvalue(), \"__result__\": result}))\n"
     )
     wrapper = preamble + code + postamble
 
diff --git a/openswarm-edge/tests/test_edge.py b/openswarm-edge/tests/test_edge.py
index 8d05a695..6d5a6f1a 100644
--- a/openswarm-edge/tests/test_edge.py
+++ b/openswarm-edge/tests/test_edge.py
@@ -21,7 +21,9 @@ from app.main import slug_from_host
 from app.bundles import unpack, resolve_file
 from app.inject import inject_runtime
 from app.ratelimit import RateLimiter
-from app.sandbox import validate_code_safety, run_backend, UnsafeCodeError
+from app.code_safety import validate_code_safety, UnsafeCodeError
+from app import sandbox as edge_sandbox
+from app.sandbox import run_backend
 
 
 def test_slug_from_host():
@@ -179,11 +181,51 @@ def test_sandbox_rejects_unsafe_and_allows_safe():
     validate_code_safety("import math\nresult={'x': math.pi}")  # no raise
 
 
+def test_sandbox_rejects_the_module_handle_escapes():
+    """Issue #134 at the public tier: the preamble's own `sys`/`io` handles, an
+    attribute chain onto a withheld module, and the dunder walk."""
+    for code in (
+        "result = {'cwd': sys.modules['os'].getcwd()}",
+        "result = {'x': str(io.open)}",
+        "result = {'c': str(json.codecs)}",
+        "result = {'n': len(().__class__.__bases__[0].__subclasses__())}",
+        "result = {'c': str(getattr(json, 'codecs'))}",
+    ):
+        try:
+            validate_code_safety(code)
+            assert False, f"expected UnsafeCodeError for {code!r}"
+        except UnsafeCodeError:
+            pass
+
+
 def test_sandbox_runs_safe_code():
     res = asyncio.run(run_backend("result = {'sum': sum(input_data['nums'])}", {"nums": [1, 2, 3]}))
     assert res.result == {"sum": 6}
 
 
+def test_sandbox_runs_allowlisted_imports():
+    """The builtins scrub used to delete exec/eval, which broke `import statistics`
+    and every namedtuple; a sandbox that can't run real code isn't secure, it's off."""
+    res = asyncio.run(run_backend(
+        "import statistics, datetime\n"
+        "result = {'mean': statistics.mean(input_data['nums']), 'd': datetime.time(9, 0).isoformat()}",
+        {"nums": [1, 2, 3]},
+    ))
+    assert res.result == {"mean": 2, "d": "09:00:00"}
+
+
+def test_sandbox_subprocess_has_no_module_handles(monkeypatch):
+    """Second wall: pretend a payload beats the gate, and the subprocess still
+    has no module left to grab."""
+    monkeypatch.setattr(edge_sandbox, "validate_code_safety", lambda code: None)
+    for handle in ("sys", "io", "builtins"):
+        try:
+            asyncio.run(run_backend(f"result = {{'x': str({handle})}}", {}))
+            assert False, f"{handle} was still reachable"
+        except RuntimeError as e:
+            assert "NameError" in str(e)
+
+
 def test_inject_runtime():
     out = inject_runtime(b"<html><head><title>x</title></head><body>hi</body></html>").decode()
     assert "OUTPUT_COMPUTE" in out and "OUTPUT_LLM" in out
diff --git a/openswarm-runner/Dockerfile b/openswarm-runner/Dockerfile
new file mode 100644
index 00000000..31fec01b
--- /dev/null
+++ b/openswarm-runner/Dockerfile
@@ -0,0 +1,177 @@
+# syntax=docker/dockerfile:1
+#
+# One OpenSwarm workflow run, then exit. Build context is the REPO ROOT, not this
+# directory, because the image needs backend/ and requirements.lock:
+#
+#   docker build --platform linux/amd64 -f openswarm-runner/Dockerfile -t openswarm-runner .
+#
+# Layout the image commits to (all three are load-bearing, backend code resolves
+# them with zero changes when OPENSWARM_PACKAGED=1):
+#   /app/backend      the FastAPI orchestrator
+#   /app/router       9router's standalone server, found by p_find_9router_dir()
+#   /app/python-env   UV_PYTHON target probed by tools_lib/mcp_config.py
+#
+# Plus the renderer half, which exists so browser tools work the way they do on a
+# laptop instead of being denied:
+#   /app/electron-runtime   the same CastLabs Electron build the desktop app ships
+#   /app/electron           the desktop shell's own main process, unmodified
+#   /app/frontend           the production webpack bundle, served off loopback
+#
+# amd64 only. CastLabs publishes no linux-arm64 build, and running a DIFFERENT
+# Electron than the desktop app ships would quietly undo the point of this image.
+
+ARG PYTHON_VERSION=3.13
+ARG NODE_VERSION=20
+ARG ROUTER_VERSION=0.3.60
+ARG UV_VERSION=0.11.8
+# Must track electron/package.json's devDependency, or the container drives a different browser than the laptop does.
+ARG ELECTRON_VERSION=42.3.3+wvcus
+ARG ELECTRON_SHA256=5b6ce3a4d13f07fc63d79e884f6a40d1bc8a1cdf82cb2d130c26e8c1530649cb
+
+FROM node:${NODE_VERSION}-bookworm-slim AS node
+
+# 9router 0.3.60 is pure JavaScript; --ignore-scripts skips a postinstall that only rebuilds a native addon the standalone server never loads.
+FROM node AS router
+ARG ROUTER_VERSION
+WORKDIR /stage
+RUN printf '{"name":"router-stage","version":"0.0.0","private":true}\n' > package.json \
+ && npm install "9router@${ROUTER_VERSION}" --no-save --no-audit --no-fund --silent --ignore-scripts \
+ && test -f node_modules/9router/app/server.js \
+ && test -z "$(find node_modules/9router -name '*.node' -print -quit)"
+
+# The App Builder's template dependencies, installed once here and shipped ALREADY EXTRACTED at
+# the digest path backend/apps/outputs/view_builder_templates.py already probes. Without it the
+# first CreateApp in a run pays a cold npm install against the public registry, and a run with no
+# egress just fails. NOT $BUILDPLATFORM: vite pulls in a platform-specific esbuild, so this has to
+# resolve on the arch the container will actually run on.
+FROM node:${NODE_VERSION}-bookworm-slim AS webapp-template
+WORKDIR /stage
+COPY backend/apps/outputs/webapp_template/frontend/package.json ./package.json
+RUN set -eux; \
+    npm install --no-audit --no-fund --loglevel=error --ignore-scripts; \
+    test -x node_modules/.bin/vite; \
+    digest="$(sha256sum package.json | cut -c1-12)"; \
+    mkdir -p "/out/${digest}"; \
+    mv node_modules "/out/${digest}/node_modules"
+
+# Webpack output is architecture-independent, so this runs natively on the build host rather than under emulation.
+FROM --platform=$BUILDPLATFORM node:${NODE_VERSION}-bookworm-slim AS frontend
+WORKDIR /src
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci --no-audit --no-fund --silent
+COPY frontend ./
+RUN npm run build && test -f dist/index.html
+
+# The shell's runtime deps only. --ignore-scripts leaves uiohook-napi without its prebuilt addon, which is correct: it taps a real keyboard, there isn't one here, and voiceHotkey already requires it inside a try.
+FROM --platform=$BUILDPLATFORM node:${NODE_VERSION}-bookworm-slim AS shell-deps
+WORKDIR /stage
+COPY electron/package.json electron/package-lock.json ./
+RUN npm install --omit=dev --ignore-scripts --no-audit --no-fund --silent
+
+FROM debian:bookworm-slim AS electron
+ARG ELECTRON_VERSION
+ARG ELECTRON_SHA256
+ARG TARGETARCH
+RUN set -eux; \
+    test "${TARGETARCH}" = "amd64" || { echo "the renderer half is amd64-only: CastLabs ships no linux-${TARGETARCH} Electron" >&2; exit 1; }; \
+    apt-get update && apt-get install -y --no-install-recommends curl ca-certificates unzip; \
+    url="https://github.com/castlabs/electron-releases/releases/download/v${ELECTRON_VERSION}/electron-v${ELECTRON_VERSION}-linux-x64.zip"; \
+    curl -fsSL -o /tmp/electron.zip "${url}"; \
+    echo "${ELECTRON_SHA256}  /tmp/electron.zip" | sha256sum -c -; \
+    mkdir -p /stage; \
+    unzip -q /tmp/electron.zip -d /stage; \
+    rm /tmp/electron.zip; \
+    test -x /stage/electron
+
+FROM python:${PYTHON_VERSION}-slim-bookworm AS uv
+ARG UV_VERSION
+ARG TARGETARCH
+RUN set -eux; \
+    apt-get update && apt-get install -y --no-install-recommends curl ca-certificates; \
+    case "${TARGETARCH}" in \
+      amd64) triple=x86_64-unknown-linux-gnu; sha=56dd1b66701ecb62fe896abb919444e4b83c5e8645cca953e6ddd496ff8a0feb ;; \
+      arm64) triple=aarch64-unknown-linux-gnu; sha=eee8dd658d20e5ac85fec9c2326b6cbc9d83a1eef09ef07433e58698ac849591 ;; \
+      *) echo "unsupported TARGETARCH ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL -o /tmp/uv.tar.gz "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-${triple}.tar.gz"; \
+    echo "${sha}  /tmp/uv.tar.gz" | sha256sum -c -; \
+    mkdir -p /stage; \
+    tar -xzf /tmp/uv.tar.gz -C /stage --strip-components=1
+
+# Wheels only: the runtime image ships no compiler, so a source build here is a build-time failure rather than a 3am surprise.
+FROM python:${PYTHON_VERSION}-slim-bookworm AS pydeps
+COPY backend/requirements.lock /tmp/requirements.lock
+RUN pip install --no-cache-dir --require-hashes --only-binary=:all: \
+      --prefix=/opt/pydeps -r /tmp/requirements.lock
+
+FROM python:${PYTHON_VERSION}-slim-bookworm
+
+# The X server plus every shared object `ldd` reports the Electron binary wanting, and the fonts without which every page renders as boxes. Derived from ldd on the real binary, not from a blog post.
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends \
+      git ca-certificates \
+      xvfb fonts-liberation \
+      libasound2 libatk-bridge2.0-0 libatk1.0-0 libatspi2.0-0 libcairo2 libcups2 \
+      libdbus-1-3 libdrm2 libexpat1 libgbm1 libglib2.0-0 libgtk-3-0 libnss3 \
+      libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 \
+      libxfixes3 libxkbcommon0 libxrandr2 libxtst6; \
+    rm -rf /var/lib/apt/lists/*
+
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+# npm and npx too, not just node. They are shims into lib/node_modules, so copying the tree and
+# re-linking is the only way to get them; a `node` with no `npm` is what left the App Builder
+# scaffolding an app it could never install, build or serve.
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+COPY --from=pydeps /opt/pydeps /usr/local
+
+# Numeric owner on every /app copy, because a `chown -R /app` afterwards rewrites the whole tree into a second layer and the image pays for it twice (that cost 493MB before this line existed). Numeric, not `runner`, because the user is created further down.
+COPY --from=router --chown=10001:10001 /stage/node_modules/9router/app /app/router
+COPY --chown=10001:10001 backend /app/backend
+COPY --chown=10001:10001 openswarm-runner/runner /app/runner
+COPY --chown=10001:10001 electron /app/electron
+COPY --from=shell-deps --chown=10001:10001 /stage/node_modules /app/electron/node_modules
+COPY --from=electron --chown=10001:10001 /stage /app/electron-runtime
+COPY --from=frontend --chown=10001:10001 /src/dist /app/frontend
+
+# After backend/, never before: mcp_config.resolve_command probes uv-bin last, and the repo's own copy is Mach-O.
+COPY --from=uv --chown=10001:10001 /stage/uv /app/backend/uv-bin/uv
+COPY --from=uv --chown=10001:10001 /stage/uvx /app/backend/uv-bin/uvx
+
+# Also after backend/, and at the exact path bundled_extracted_modules() looks for.
+COPY --from=webapp-template --chown=10001:10001 /out /app/backend/apps/outputs/webapp_template_cache
+
+RUN set -eux; \
+    if ls /app/backend/.env* >/dev/null 2>&1; then echo "a dotenv reached the image; fix Dockerfile.dockerignore" >&2; exit 1; fi; \
+    ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm; \
+    ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx; \
+    npm --version >/dev/null; \
+    mkdir -p /app/python-env/bin; \
+    ln -s /usr/local/bin/python3 /app/python-env/bin/python3; \
+    find /app/backend -name '__pycache__' -type d -prune -exec rm -rf {} +; \
+    useradd --create-home --uid 10001 --shell /usr/sbin/nologin runner; \
+    mkdir -p /data; \
+    ln -s /data/openswarm /app/backend/data; \
+    mkdir -p /tmp/.X11-unix; \
+    chmod 1777 /tmp/.X11-unix; \
+    chown runner:runner /data; \
+    printf '[user]\n\tname = OpenSwarm Cloud Run\n\temail = cloud-run@openswarm.local\n[init]\n\tdefaultBranch = main\n[safe]\n\tdirectory = *\n' > /etc/gitconfig
+
+USER runner
+WORKDIR /app
+ENV HOME=/home/runner \
+    PYTHONPATH=/app \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    OPENSWARM_HEADLESS=1 \
+    OPENSWARM_PACKAGED=1 \
+    OPENSWARM_DATA_ROOT=/data/openswarm \
+    OPENSWARM_HOST=127.0.0.1 \
+    OPENSWARM_PORT=8324 \
+    DATA_DIR=/data/9router \
+    NODE_ENV=production \
+    ELECTRON_BIN=/app/electron-runtime/electron \
+    OPENSWARM_RUN_WORKSPACE=/data/workspace \
+    OPENSWARM_NODE_PATH=/usr/local/bin/node
+
+ENTRYPOINT ["python3", "-m", "runner.main"]
diff --git a/openswarm-runner/Dockerfile.dockerignore b/openswarm-runner/Dockerfile.dockerignore
new file mode 100644
index 00000000..3eb6885b
--- /dev/null
+++ b/openswarm-runner/Dockerfile.dockerignore
@@ -0,0 +1,33 @@
+*
+!backend
+!openswarm-runner/runner
+!electron
+!frontend
+
+# A developer's real OAuth client secrets live here; baking them into an image that
+# gets pushed to a registry is how a laptop leaks credentials. The Dockerfile asserts
+# they are gone, so this list failing open fails the build instead of shipping.
+backend/.env
+backend/.env.*
+
+backend/data
+backend/.venv
+backend/uv-bin
+backend/tests
+backend/.pytest_cache
+
+# The bundle is built in a stage inside the image. A developer's stale local dist must
+# never be what a cloud run renders.
+frontend/dist
+frontend/node_modules
+electron/node_modules
+electron/dist
+electron/build-staging
+electron/python-env
+# Prebuilt Mach-O addons for the mac trackpad; main.js already skips a missing one.
+electron/native
+**/*.test.js
+
+**/__pycache__
+**/*.pyc
+**/.DS_Store
diff --git a/openswarm-runner/README.md b/openswarm-runner/README.md
new file mode 100644
index 00000000..3e8606a5
--- /dev/null
+++ b/openswarm-runner/README.md
@@ -0,0 +1,158 @@
+# openswarm-runner
+
+One ephemeral Linux container that executes ONE OpenSwarm workflow run and exits.
+One Fly Firecracker machine per run, no state kept.
+
+## Build
+
+The build context is the **repo root**, not this directory (the image needs `backend/`,
+`electron/`, `frontend/` and `backend/requirements.lock`). **amd64 only**, see the
+renderer section:
+
+```bash
+docker build --platform linux/amd64 -f openswarm-runner/Dockerfile -t openswarm-runner .
+```
+
+Nothing has to be built on the host first: the frontend bundle and the shell's node
+modules are built in their own stages inside the image.
+
+## Run
+
+The container is told everything it needs by one JSON run spec in `OPENSWARM_RUN_SPEC`
+(or a path in `OPENSWARM_RUN_SPEC_FILE`). See `runner/run_spec.py` for the typed shape.
+
+```json
+{
+  "run_id": "cr_01J...",
+  "workflow": { "id": "wf_1", "title": "Daily digest", "model": "opus-5",
+                "steps": [{ "text": "summarize my inbox" }] },
+  "credentials": [
+    { "provider": "claude", "auth_type": "oauth",
+      "access_token": "<already refreshed by the control plane>",
+      "expires_at": "2026-07-31T20:00:00Z" }
+  ],
+  "callback": { "url": "https://api.openswarm.com/api/cloud-runs/cr_01J.../report",
+                "token": "<two-party runner token, not a user credential>" },
+  "max_run_seconds": 1800,
+  "needs_browser": true
+}
+```
+
+Exit codes: `0` ok, `1` runner crash, `2` bad spec, `3` credential expired on arrival,
+`4` backend never came up, `5` workflow failed, `6` wall-clock cap hit,
+`7` no Electron window ever registered.
+
+## Files the run makes
+
+`/data/workspace` is the agent's working directory and **the only path whose contents survive**.
+It is seeded as `default_folder` before the backend boots, and the agent is told in its system
+prompt that files saved there come back and everything else is destroyed.
+
+After the workflow reaches a terminal state (including a timeout, so partial work still lands) the
+runner walks that directory and POSTs each file to `callback.artifacts_url`, then sends the
+terminal report. That order is load-bearing: the per-run callback token is refused once the run is
+closed, so uploading afterwards would be rejected.
+
+Caps, applied in the runner AND again at the control plane, which is the one that counts:
+
+| Limit | Value |
+| --- | --- |
+| One file | 20 MB |
+| One run, all files | 50 MB |
+| Files per run | 40 |
+
+Nothing is ever truncated. A file past a cap is not sent and instead arrives as a row in the
+report's `files[]` carrying a written reason, so the user reads "your 512 MB render could not be
+sent" rather than finding a 20 MB fragment. `.git`, `node_modules`, `__pycache__`, `.venv`,
+`.claude` and the usual caches are skipped, and symlinks are never followed.
+
+## Skills and connected apps
+
+`skills[]` in the run spec is written to `~/.claude/skills/<id>/` before boot. This is not a
+nicety: the backend registers the Skill tool only when at least one non-built-in skill exists on
+disk, so a container without them has no Skill tool at all and answers from general knowledge in
+the same confident voice it would use with the real thing.
+
+`unavailable_mcp_servers[]` is **names only**. The user's MCP credentials (Slack session cookies,
+Notion and GitHub access tokens, Google refresh tokens) never leave their machine, so the names go
+up purely so the run's system prompt can tell the agent which apps exist and are out of reach.
+`McpServerNote` forbids extra fields, so there is no shape a secret could travel in.
+
+## What the image carries for the App Builder
+
+`node`, `npm` and `npx`, plus the App Builder template's `node_modules` pre-installed at the digest
+path `bundled_extracted_modules()` probes. Without npm, `CreateApp` scaffolded an app that could
+never install, build or serve; without the baked cache, the first `CreateApp` in a run would pay a
+cold registry install. `git` also carries a system identity (`/etc/gitconfig`), so a workflow that
+commits does not die on "Author identity unknown".
+
+## The renderer
+
+OpenSwarm's browser tier is not an HTTP client. Element serialization and every click,
+type and scroll live in `frontend/src/shared/browserCommandHandler.ts` and drive a live
+Electron `<webview>`; the backend only relays commands over the dashboard WebSocket. So
+the container runs **the real desktop shell**, unmodified, on a virtual display:
+
+```
+Xvfb :99 -> Electron (ELECTRON_DEV=1, OPENSWARM_DEV_URL=<bundle>#/dashboard/cloud-run)
+         -> registers on /ws/dashboard -> browser tools are live
+```
+
+`ELECTRON_DEV=1` is the same path `bash run.sh` uses: the shell attaches to the backend
+already running here instead of spawning a second one. The bundle is served off loopback
+on `:4173`, the same port the packaged app prefers, and deep-linked at the run's one
+dashboard so no human has to click anything.
+
+Three things follow from this and are worth knowing before you touch it:
+
+- **amd64 only.** CastLabs (whose Electron the desktop app ships) publishes no
+  linux-arm64 build. Running a *different* Electron in the cloud than users run on their
+  laptops would quietly undo the point of the image, so the build refuses other arches.
+- **`--no-sandbox`.** Chromium's setuid sandbox needs a root-owned binary and its
+  namespace sandbox needs unprivileged user namespaces; a non-root container under
+  Docker's default seccomp has neither. The wall this run relies on is the Firecracker VM
+  around the whole container, not Chromium's own layer. The flag lives in a named constant
+  in `runner/renderer_process.py` rather than inside a launch string, on purpose.
+- **`needs_browser: false` skips it.** Boot costs roughly 15s and ~500MB of the run's
+  memory, so a workflow that never opens a page can opt out. Default is on: parity is the
+  reason this image exists, and opting out should be the thing you have to say.
+
+If Electron starts but no window ever registers, the run **fails** (exit 7) rather than
+proceeding without a browser. A browser workflow that silently ran blind produces a
+confident wrong answer, which is worse than no answer.
+
+## The credential rule
+
+**A `providerConnections[]` entry this runner writes never contains a `refreshToken`.**
+9Router's refresh dispatcher bails on `if (!b || !b.refreshToken) return null`, so
+omitting the field is what makes the container incapable of rotating the user's grant.
+If it ever rotated, the user's laptop would be left replaying a dead token and the
+provider would revoke the whole grant family.
+
+Two independent walls enforce it, and a third makes a leak require deleting the code
+that builds the entry:
+
+1. `ProviderCredential` forbids extra fields, so a spec carrying `refreshToken` fails
+   validation before the backend boots.
+2. `assert_no_refresh_token` re-reads the assembled db payload just before the write.
+3. `router_connection` assembles the entry from a fixed key list, never a passthrough.
+
+All three live in `runner/seed/router_credentials.py`.
+
+An access token that arrives expired fails the run (exit 3). The runner never refreshes.
+
+## Test
+
+```bash
+PYTHONPATH=.:openswarm-runner backend/.venv/bin/python3 -m pytest openswarm-runner/tests -q
+```
+
+The Electron boot itself needs Linux and a display, so the tests pin the contract around
+it (the deep link, the bundle check, the three ways "no window" ends) rather than the
+boot. Proving the browser tier actually behaves means running a real page in both places
+and comparing; see the parity matrix in the cloud-browser work notes.
+
+## Deploy
+
+Not deployed. `fly.toml` is written but never applied; read its header first, the app
+has to be created onto its own isolated private network by hand before any deploy.
diff --git a/openswarm-runner/fly.toml b/openswarm-runner/fly.toml
new file mode 100644
index 00000000..ff2ed454
--- /dev/null
+++ b/openswarm-runner/fly.toml
@@ -0,0 +1,51 @@
+# openswarm-runner: one ephemeral Firecracker machine per workflow run. Boots the
+# backend headless, runs the workflow, reports, exits. Nothing here is long-lived.
+#
+# THIS APP MUST NOT SHARE THE TRUSTED 6PN MESH with openswarm-cloud / openswarm-edge.
+# The agent inside has Bash and executes user prose, so from in here
+# `curl http://openswarm-cloud.internal:8080` must resolve to nothing. Fly decides an
+# app's private network AT CREATE TIME and fly.toml cannot express it, so the app is
+# created once, by hand, onto its own isolated network:
+#
+#   fly apps create openswarm-runner --org openswarm --network openswarm-runner-isolated
+#   fly deploy . --config openswarm-runner/fly.toml --dockerfile openswarm-runner/Dockerfile
+#
+# (deploy runs from the REPO ROOT: the image needs backend/ in its build context.)
+# Verify the isolation after the first deploy, do not assume it:
+#   fly ssh console -a openswarm-runner -C "getent hosts openswarm-cloud.internal"   # must fail
+#
+# There is deliberately no [http_service] and no [[services]]: the runner takes no
+# inbound traffic and gets no public IP. It reaches the control plane outbound over
+# the public internet with the callback token in the run spec, which is why the two
+# do not need a shared private network in the first place.
+#
+# Machines are created per run by the control plane (Machines API, auto_destroy=true,
+# run spec passed as OPENSWARM_RUN_SPEC). This file is the app-level shape they inherit.
+
+app = 'openswarm-runner'
+primary_region = 'iad'
+kill_signal = 'SIGTERM'
+kill_timeout = '30s'
+
+[build]
+  dockerfile = 'Dockerfile'
+
+[env]
+  # Hard wall-clock cap, enforced twice inside the container: the poll loop stops the
+  # run at this mark, and an independent thread kills the process 90s later. A run
+  # spec asking for more is clamped down to this, never up.
+  RUNNER_MAX_RUN_SECONDS = '1800'
+  OPENSWARM_HEADLESS = '1'
+  OPENSWARM_PACKAGED = '1'
+  OPENSWARM_DATA_ROOT = '/data/openswarm'
+  OPENSWARM_HOST = '127.0.0.1'
+  OPENSWARM_PORT = '8324'
+  DATA_DIR = '/data/9router'
+
+# No [[mounts]]: a run's state is garbage the moment it ends, and an ephemeral rootfs
+# means one run cannot leave a credential lying around for the next tenant to find.
+
+[[vm]]
+  cpu_kind = 'shared'
+  cpus = 2
+  memory_mb = 4096
diff --git a/openswarm-runner/runner/__init__.py b/openswarm-runner/runner/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/openswarm-runner/runner/boot/__init__.py b/openswarm-runner/runner/boot/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/openswarm-runner/runner/boot/backend_process.py b/openswarm-runner/runner/boot/backend_process.py
new file mode 100644
index 00000000..b4114933
--- /dev/null
+++ b/openswarm-runner/runner/boot/backend_process.py
@@ -0,0 +1,111 @@
+"""Boot the OpenSwarm backend inside the container and wait until it answers.
+
+Spawned the same way the desktop shell spawns it (`python -m uvicorn backend.main:app`
+on loopback) so the cloud path and the laptop path are the same code on the same
+socket. Loopback, not 0.0.0.0: every caller of this API lives in this container, and
+the agent running inside it has Bash, so there is no reason to publish the port onto
+the machine's private network.
+"""
+
+import os
+import subprocess
+import time
+from typing import Dict, List, Optional
+
+import httpx
+from pydantic import BaseModel, ConfigDict, InstanceOf
+from typeguard import typechecked
+
+HOST = "127.0.0.1"
+HEALTH_PATH = "/api/health/check"
+# 9Router is a Next.js standalone server: it binds `process.env.HOSTNAME || '0.0.0.0'`, and Docker sets HOSTNAME to the container id, so left alone it listens on the container's eth0 address and every probe of 127.0.0.1:20128 gets ECONNREFUSED. Set on the backend's env because the backend is what spawns node.
+ROUTER_BIND_HOSTNAME = "127.0.0.1"
+AUTH_TOKEN_FILENAME = "auth.token"
+# The backend imports the whole app graph before it binds; on a cold Fly machine that has been measured in tens of seconds, so the budget is generous rather than tight.
+BOOT_TIMEOUT_SECONDS = 120.0
+SHUTDOWN_GRACE_SECONDS = 10.0
+
+
+class BackendUnavailable(RuntimeError):
+    """The backend never came up, or died while we were using it."""
+
+
+class BackendProcess(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    process: InstanceOf[subprocess.Popen]
+    base_url: str
+    token: str
+
+    @typechecked
+    def headers(self) -> Dict[str, str]:
+        return {"Authorization": f"Bearer {self.token}"}
+
+    @typechecked
+    def is_alive(self) -> bool:
+        return self.process.poll() is None
+
+
+@typechecked
+def p_command(port: int) -> List[str]:
+    return ["python3", "-m", "uvicorn", "backend.main:app", "--host", HOST, "--port", str(port)]
+
+
+@typechecked
+def p_read_auth_token(data_root: str) -> str:
+    """The backend mints this before it binds, so by the time health passes the file exists."""
+    path = os.path.join(data_root, AUTH_TOKEN_FILENAME)
+    try:
+        with open(path, "r", encoding="utf-8") as handle:
+            return handle.read().strip()
+    except OSError as exc:
+        raise BackendUnavailable(f"backend is up but its auth token is unreadable at {path}: {exc}") from exc
+
+
+@typechecked
+def start_backend(app_root: str, data_root: str, port: int, deadline: float) -> BackendProcess:
+    """Spawn the backend and block until it answers health, or raise BackendUnavailable."""
+    environment = dict(os.environ)
+    environment["OPENSWARM_DATA_ROOT"] = data_root
+    environment["OPENSWARM_HEADLESS"] = "1"
+    environment["OPENSWARM_PORT"] = str(port)
+    environment["OPENSWARM_HOST"] = HOST
+    environment["HOSTNAME"] = ROUTER_BIND_HOSTNAME
+    environment["PYTHONPATH"] = app_root
+
+    process = subprocess.Popen(p_command(port), cwd=app_root, env=environment)
+    base_url = f"http://{HOST}:{port}"
+    budget = min(time.monotonic() + BOOT_TIMEOUT_SECONDS, deadline)
+
+    with httpx.Client(timeout=2.0) as client:
+        while time.monotonic() < budget:
+            if process.poll() is not None:
+                raise BackendUnavailable(f"backend exited during startup with code {process.returncode}")
+            try:
+                healthy = client.get(f"{base_url}{HEALTH_PATH}").status_code == 200
+            except httpx.HTTPError:
+                healthy = False
+            if healthy:
+                try:
+                    token = p_read_auth_token(data_root)
+                except BackendUnavailable:
+                    stop_backend(process)
+                    raise
+                return BackendProcess(process=process, base_url=base_url, token=token)
+            time.sleep(0.25)
+
+    stop_backend(process)
+    raise BackendUnavailable(f"backend did not answer {HEALTH_PATH} within its startup budget")
+
+
+@typechecked
+def stop_backend(process: Optional[subprocess.Popen]) -> None:
+    """SIGTERM then SIGKILL. The machine is about to die anyway; this just stops the logs mid-sentence."""
+    if process is None or process.poll() is not None:
+        return
+    process.terminate()
+    try:
+        process.wait(timeout=SHUTDOWN_GRACE_SECONDS)
+    except subprocess.TimeoutExpired:
+        process.kill()
+        process.wait(timeout=SHUTDOWN_GRACE_SECONDS)
diff --git a/openswarm-runner/runner/boot/renderer_process.py b/openswarm-runner/runner/boot/renderer_process.py
new file mode 100644
index 00000000..19267da0
--- /dev/null
+++ b/openswarm-runner/runner/boot/renderer_process.py
@@ -0,0 +1,233 @@
+"""Boot the real Electron shell inside the container so browser tools have a window to drive.
+
+The browser tier is not an HTTP client: the element serialization and every click, type and
+scroll live in the frontend and drive a live Electron `<webview>`. There is no way to get
+laptop-identical behaviour without the laptop's actual renderer, so this starts one on a
+virtual display and points it at the backend that is already running in this container.
+
+The Electron process runs the same `ELECTRON_DEV=1` path a developer uses (`bash run.sh`):
+the shell attaches to an existing backend on OPENSWARM_PORT instead of spawning its own, and
+loads whatever OPENSWARM_DEV_URL says. Here that URL is the packaged frontend bundle served
+off loopback, deep-linked straight at the run's dashboard so the window registers without a
+human clicking anything.
+"""
+
+import functools
+import http.server
+import logging
+import os
+import shutil
+import socketserver
+import subprocess
+import threading
+import time
+from typing import Dict, List, Optional
+
+import httpx
+from pydantic import BaseModel, ConfigDict, InstanceOf
+from typeguard import typechecked
+
+logger = logging.getLogger("runner.renderer")
+
+HOST = "127.0.0.1"
+RENDERER_HEALTH_PATH = "/api/health/renderer"
+# Same port the packaged app prefers, so the renderer's origin (and therefore its localStorage) is the one the frontend was built expecting.
+FRONTEND_PORT = 4173
+DISPLAY = ":99"
+XVFB_SCREEN = "1920x1080x24"
+# Cold Electron under a virtual display: Xvfb, Chromium boot, React mount, then the deferred dashboard socket. Measured in the low tens of seconds, so the budget is generous rather than tight.
+RENDERER_TIMEOUT_SECONDS = 180.0
+XVFB_READY_TIMEOUT_SECONDS = 20.0
+SHUTDOWN_GRACE_SECONDS = 5.0
+
+# Chromium's setuid sandbox needs a root-owned binary and its namespace sandbox needs unprivileged
+# user namespaces, neither of which a non-root container under Docker's default seccomp profile has.
+# The isolation this run relies on is the Firecracker VM around the whole container, not Chromium's
+# own layer. Stated here rather than buried in a launch string, because dropping a sandbox is a
+# choice and the reader deserves to see it made.
+SANDBOX_FLAGS: List[str] = ["--no-sandbox"]
+# /dev/shm defaults to 64MB in a container, which Chromium overruns and then crashes on.
+CONTAINER_CHROMIUM_FLAGS: List[str] = ["--disable-dev-shm-usage", "--disable-gpu"]
+
+
+class RendererUnavailable(RuntimeError):
+    """No Electron window ever registered, so browser tools would be dead this run."""
+
+
+class RendererProcess(BaseModel):
+    """The virtual display and the Electron shell drawing into it. Dies with the run."""
+
+    model_config = ConfigDict(validate_assignment=True)
+
+    xvfb: InstanceOf[subprocess.Popen]
+    electron: InstanceOf[subprocess.Popen]
+    url: str
+
+    @typechecked
+    def is_alive(self) -> bool:
+        return self.electron.poll() is None and self.xvfb.poll() is None
+
+
+@typechecked
+def dashboard_url(port: int, dashboard_id: str) -> str:
+    """The frontend deep-link that mounts a dashboard directly. HashRouter, so the route is a fragment."""
+    return f"http://{HOST}:{port}/index.html#/dashboard/{dashboard_id}"
+
+
+@typechecked
+def serve_frontend(frontend_dir: str) -> int:
+    """Serve the built bundle off loopback in a daemon thread; returns the port it landed on.
+
+    Falls back to an OS-assigned port if 4173 is held, exactly like the packaged shell does.
+    """
+    if not os.path.isfile(os.path.join(frontend_dir, "index.html")):
+        raise RendererUnavailable(
+            f"no frontend bundle at {frontend_dir}; the image must be built with frontend/dist in it"
+        )
+
+    handler = functools.partial(http.server.SimpleHTTPRequestHandler, directory=frontend_dir)
+
+    class p_Server(socketserver.ThreadingTCPServer):
+        daemon_threads = True
+        allow_reuse_address = True
+
+    try:
+        server = p_Server((HOST, FRONTEND_PORT), handler)
+    except OSError:
+        server = p_Server((HOST, 0), handler)
+    port = server.server_address[1]
+    threading.Thread(target=server.serve_forever, daemon=True, name="frontend-server").start()
+    logger.info("frontend bundle served from %s on %s:%d", frontend_dir, HOST, port)
+    return port
+
+
+@typechecked
+def p_x_socket_ready(display: str) -> bool:
+    return os.path.exists(f"/tmp/.X11-unix/X{display.lstrip(':')}")
+
+
+@typechecked
+def start_xvfb(display: str = DISPLAY) -> subprocess.Popen:
+    """Bring up the virtual display and wait for its socket, so Electron never races it."""
+    if shutil.which("Xvfb") is None:
+        raise RendererUnavailable("Xvfb is not installed in this image, so there is no display to draw on")
+    process = subprocess.Popen(
+        ["Xvfb", display, "-screen", "0", XVFB_SCREEN, "-nolisten", "tcp"],
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.PIPE,
+    )
+    budget = time.monotonic() + XVFB_READY_TIMEOUT_SECONDS
+    while time.monotonic() < budget:
+        if process.poll() is not None:
+            raise RendererUnavailable(f"Xvfb exited immediately with code {process.returncode}")
+        if p_x_socket_ready(display):
+            logger.info("virtual display %s up (%s)", display, XVFB_SCREEN)
+            return process
+        time.sleep(0.1)
+    p_stop(process)
+    raise RendererUnavailable(f"Xvfb never created a socket for {display}")
+
+
+@typechecked
+def p_electron_env(backend_port: int, url: str, display: str) -> Dict[str, str]:
+    environment = dict(os.environ)
+    # The dev path: attach to the backend already running here rather than spawning a second one, and load the bundle we are serving instead of a webpack dev server.
+    environment["ELECTRON_DEV"] = "1"
+    environment["OPENSWARM_DEV_URL"] = url
+    environment["OPENSWARM_PORT"] = str(backend_port)
+    environment["DISPLAY"] = display
+    environment["ELECTRON_DISABLE_SECURITY_WARNINGS"] = "1"
+    environment.pop("OPENSWARM_PACKAGED", None)
+    return environment
+
+
+@typechecked
+def start_electron(app_root: str, backend_port: int, url: str, display: str = DISPLAY) -> subprocess.Popen:
+    binary = os.environ.get("ELECTRON_BIN", "/app/electron-runtime/electron")
+    if not os.path.isfile(binary):
+        raise RendererUnavailable(f"no Electron binary at {binary}; the image was built without a renderer")
+    app_dir = os.path.join(app_root, "electron")
+    command = [binary, app_dir, *SANDBOX_FLAGS, *CONTAINER_CHROMIUM_FLAGS]
+    logger.info("starting Electron: %s", " ".join(command))
+    return subprocess.Popen(command, cwd=app_dir, env=p_electron_env(backend_port, url, display))
+
+
+@typechecked
+def await_registration(
+    base_url: str,
+    headers: Dict[str, str],
+    electron: subprocess.Popen,
+    deadline: float,
+) -> None:
+    """Block until the backend reports a renderer on its dashboard socket, or raise.
+
+    Polls the backend rather than the Electron process because "the window is up" and "the
+    window can be driven" are different claims, and only the second one matters.
+    """
+    budget = min(time.monotonic() + RENDERER_TIMEOUT_SECONDS, deadline)
+    with httpx.Client(timeout=5.0) as client:
+        while time.monotonic() < budget:
+            if electron.poll() is not None:
+                raise RendererUnavailable(
+                    f"Electron exited with code {electron.returncode} before any window registered"
+                )
+            try:
+                body = client.get(f"{base_url}{RENDERER_HEALTH_PATH}", headers=headers).json()
+            except (httpx.HTTPError, ValueError):
+                body = {}
+            if body.get("attached"):
+                logger.info("renderer registered (%s dashboard connection(s))", body.get("connections"))
+                return
+            time.sleep(0.5)
+    raise RendererUnavailable(
+        "Electron started but no renderer ever registered on the dashboard WebSocket within "
+        f"{RENDERER_TIMEOUT_SECONDS:.0f}s, so browser tools would be dead this run"
+    )
+
+
+@typechecked
+def start_renderer(
+    app_root: str,
+    frontend_dir: str,
+    backend_base_url: str,
+    backend_headers: Dict[str, str],
+    backend_port: int,
+    dashboard_id: str,
+    deadline: float,
+) -> RendererProcess:
+    """Display, bundle server, Electron, then block until the window is actually drivable."""
+    url = dashboard_url(serve_frontend(frontend_dir), dashboard_id)
+    xvfb = start_xvfb()
+    try:
+        electron = start_electron(app_root, backend_port, url)
+    except BaseException:
+        p_stop(xvfb)
+        raise
+    try:
+        await_registration(backend_base_url, backend_headers, electron, deadline)
+    except BaseException:
+        p_stop(electron)
+        p_stop(xvfb)
+        raise
+    return RendererProcess(xvfb=xvfb, electron=electron, url=url)
+
+
+@typechecked
+def p_stop(process: Optional[subprocess.Popen]) -> None:
+    if process is None or process.poll() is not None:
+        return
+    process.terminate()
+    try:
+        process.wait(timeout=SHUTDOWN_GRACE_SECONDS)
+    except subprocess.TimeoutExpired:
+        process.kill()
+        process.wait(timeout=SHUTDOWN_GRACE_SECONDS)
+
+
+@typechecked
+def stop_renderer(renderer: Optional[RendererProcess]) -> None:
+    """Electron first, then the display it was drawing on."""
+    if renderer is None:
+        return
+    p_stop(renderer.electron)
+    p_stop(renderer.xvfb)
diff --git a/openswarm-runner/runner/main.py b/openswarm-runner/runner/main.py
new file mode 100644
index 00000000..ac6b177f
--- /dev/null
+++ b/openswarm-runner/runner/main.py
@@ -0,0 +1,260 @@
+"""One workflow run, one container, one exit code.
+
+Boots the backend headless, executes the workflow the control plane asked for,
+reports the result, and dies. Nothing here is meant to survive the run.
+"""
+
+import logging
+import os
+import subprocess
+import sys
+import threading
+import time
+from datetime import datetime, timezone
+from typing import Optional
+
+from pydantic import BaseModel, ConfigDict
+from typeguard import typechecked
+
+from runner.boot.backend_process import BackendProcess, BackendUnavailable, start_backend, stop_backend
+from runner.boot.renderer_process import RendererProcess, RendererUnavailable, start_renderer, stop_renderer
+from runner.results.deliverables import collect
+from runner.results.report import RunReport, deliver_files, send_report
+from runner.run_spec import CLOUD_RUN_DASHBOARD_ID, CallbackTarget, InvalidRunSpec, RunSpec, load_run_spec
+from runner.seed.data_root import seed_data_root
+from runner.seed.router_credentials import write_router_db
+from runner.seed.skills import write_skills
+from runner.workflow_run import RunOutcome, RunProgress, WorkflowRunFailed, execute_workflow
+
+EXIT_OK = 0
+EXIT_INTERNAL = 1
+EXIT_BAD_SPEC = 2
+EXIT_CREDENTIAL_EXPIRED = 3
+EXIT_BACKEND_UNAVAILABLE = 4
+EXIT_WORKFLOW_FAILED = 5
+EXIT_DEADLINE = 6
+EXIT_RENDERER_UNAVAILABLE = 7
+
+DEFAULT_APP_ROOT = "/app"
+DEFAULT_FRONTEND_DIR = "/app/frontend"
+DEFAULT_DATA_ROOT = "/data/openswarm"
+DEFAULT_ROUTER_DATA_DIR = "/data/9router"
+# The agent's own folder, and the only place on this machine whose contents come home.
+DEFAULT_RUN_WORKSPACE = "/data/workspace"
+DEFAULT_PORT = 8324
+# Slack between the soft deadline (stop the run, report it) and the hard one (kill the process).
+# Has to cover the file upload as well as the report's retries, so it is minutes, not seconds; the
+# control plane's own kill sits further out again (dispatch.ts MACHINE_GRACE_MS).
+REPORT_GRACE_SECONDS = 240.0
+# Ceiling the control plane cannot raise. A cap a caller can override is not a cap.
+MAX_RUN_SECONDS_ENV = "RUNNER_MAX_RUN_SECONDS"
+DEFAULT_MAX_RUN_SECONDS = 1800
+
+logger = logging.getLogger("runner")
+
+
+class Heartbeat(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    run_id: str
+    interval_seconds: float
+    callback: Optional[CallbackTarget] = None
+    last_sent: float = 0.0
+
+    @typechecked
+    def maybe_send(self, progress: RunProgress) -> None:
+        now = time.monotonic()
+        if now - self.last_sent < self.interval_seconds:
+            return
+        self.last_sent = now
+        send_report(self.callback, RunReport(
+            run_id=self.run_id,
+            phase="heartbeat",
+            status=progress.status,
+            active_step_idx=progress.active_step_idx,
+            last_tool_label=progress.last_tool_label,
+        ))
+
+
+@typechecked
+def effective_max_run_seconds(spec: RunSpec) -> int:
+    """The shorter of what the job asked for and what this machine's config allows."""
+    try:
+        ceiling = int(os.environ.get(MAX_RUN_SECONDS_ENV, "") or DEFAULT_MAX_RUN_SECONDS)
+    except ValueError:
+        ceiling = DEFAULT_MAX_RUN_SECONDS
+    return max(60, min(spec.max_run_seconds, ceiling))
+
+
+@typechecked
+def arm_hard_stop(seconds: float) -> None:
+    """Independent backstop on machine-seconds; fires even if the graceful path is wedged."""
+    def p_fire() -> None:
+        time.sleep(seconds)
+        logger.error("hard wall-clock stop after %.0fs, killing the run", seconds)
+        os._exit(EXIT_DEADLINE)
+
+    threading.Thread(target=p_fire, daemon=True, name="hard-stop").start()
+
+
+@typechecked
+def p_fail(
+    spec: Optional[RunSpec],
+    status: str,
+    message: str,
+    code: int,
+    workspace: Optional[str] = None,
+) -> int:
+    """Report a failure, handing over anything the run managed to make first.
+
+    `workspace` is passed only where the agent actually ran: a workflow that died on step 3 may
+    have written a perfectly good report on step 1, and losing it because a later step threw is
+    exactly the "the file died with the machine" problem this whole path exists to fix.
+    """
+    logger.error("%s: %s", status, message)
+    files = (
+        deliver_files(spec.callback, workspace, collect(workspace))
+        if spec is not None and workspace is not None
+        else []
+    )
+    send_report(
+        spec.callback if spec else None,
+        RunReport(
+            run_id=spec.run_id if spec else "unknown",
+            phase="finished",
+            status=status,
+            exit_code=code,
+            error=message,
+            files=files,
+        ),
+    )
+    return code
+
+
+@typechecked
+def p_exit_code_for(outcome: RunOutcome) -> int:
+    if outcome.status in ("success", "ran_late"):
+        return EXIT_OK
+    if outcome.status == "timed_out":
+        return EXIT_DEADLINE
+    return EXIT_WORKFLOW_FAILED
+
+
+@typechecked
+def p_run(spec: RunSpec, deadline: float) -> int:
+    now = datetime.now(timezone.utc)
+    expired = spec.expired_credentials(now)
+    if expired:
+        names = ", ".join(credential.provider for credential in expired)
+        return p_fail(
+            spec,
+            "failure",
+            f"access token for {names} is expired or about to expire; the runner never refreshes, "
+            "so the control plane must re-issue it",
+            EXIT_CREDENTIAL_EXPIRED,
+        )
+
+    app_root = os.environ.get("OPENSWARM_APP_ROOT", DEFAULT_APP_ROOT)
+    data_root = os.environ.get("OPENSWARM_DATA_ROOT", DEFAULT_DATA_ROOT)
+    router_data_dir = os.environ.get("DATA_DIR", DEFAULT_ROUTER_DATA_DIR)
+    workspace = os.environ.get("OPENSWARM_RUN_WORKSPACE", DEFAULT_RUN_WORKSPACE)
+    port = int(os.environ.get("OPENSWARM_PORT", str(DEFAULT_PORT)))
+
+    write_router_db(router_data_dir, spec.credentials, now)
+    seed_data_root(data_root, workspace, spec)
+    write_skills(os.path.expanduser("~"), spec.skills)
+    logger.info("seeded data root %s and router db in %s", data_root, router_data_dir)
+
+    backend: Optional[BackendProcess] = None
+    process: Optional[subprocess.Popen] = None
+    renderer: Optional[RendererProcess] = None
+    try:
+        backend = start_backend(app_root, data_root, port, deadline)
+        process = backend.process
+        logger.info("backend healthy at %s", backend.base_url)
+
+        if spec.needs_browser:
+            renderer = start_renderer(
+                app_root=app_root,
+                frontend_dir=os.environ.get("OPENSWARM_FRONTEND_DIR", DEFAULT_FRONTEND_DIR),
+                backend_base_url=backend.base_url,
+                backend_headers=backend.headers(),
+                backend_port=port,
+                dashboard_id=CLOUD_RUN_DASHBOARD_ID,
+                deadline=deadline,
+            )
+            logger.info("renderer attached at %s, browser tools are live", renderer.url)
+
+        send_report(spec.callback, RunReport(run_id=spec.run_id, phase="started", status="running"))
+        heartbeat = Heartbeat(
+            run_id=spec.run_id,
+            interval_seconds=float(spec.callback.heartbeat_seconds) if spec.callback else 30.0,
+            callback=spec.callback,
+        )
+        outcome = execute_workflow(backend, spec.workflow.id, deadline, heartbeat.maybe_send)
+    except BackendUnavailable as exc:
+        return p_fail(spec, "failure", str(exc), EXIT_BACKEND_UNAVAILABLE)
+    except RendererUnavailable as exc:
+        # Loud, not silent: a browser workflow that quietly ran without a window produces a
+        # confident wrong answer, which is worse than no answer.
+        return p_fail(spec, "failure", str(exc), EXIT_RENDERER_UNAVAILABLE)
+    except WorkflowRunFailed as exc:
+        return p_fail(spec, "failure", str(exc), EXIT_WORKFLOW_FAILED, workspace)
+    finally:
+        stop_renderer(renderer)
+        stop_backend(process)
+
+    # Files before the terminal report, always: the callback token is refused the moment the run
+    # is closed, so this is the only order in which both the files and the receipt can land.
+    files = deliver_files(spec.callback, workspace, collect(workspace))
+
+    code = p_exit_code_for(outcome)
+    logger.info("run %s finished as %s (exit %d)", spec.run_id, outcome.status, code)
+    send_report(spec.callback, RunReport(
+        run_id=spec.run_id,
+        phase="finished",
+        status=outcome.status,
+        exit_code=code,
+        error=outcome.error,
+        cost_usd=outcome.cost_usd,
+        answer=outcome.answer,
+        transcript=outcome.transcript,
+        system_notices=outcome.system_notices,
+        files=files,
+    ))
+    return code
+
+
+@typechecked
+def main() -> int:
+    logging.basicConfig(
+        level=logging.INFO,
+        format="%(asctime)s %(levelname).1s %(name)s: %(message)s",
+        datefmt="%H:%M:%S",
+    )
+    try:
+        spec = load_run_spec()
+    except InvalidRunSpec as exc:
+        return p_fail(None, "failure", str(exc), EXIT_BAD_SPEC)
+
+    budget = effective_max_run_seconds(spec)
+    arm_hard_stop(budget + REPORT_GRACE_SECONDS)
+    deadline = time.monotonic() + budget
+    try:
+        return p_run(spec, deadline)
+    except Exception as exc:
+        logger.exception("runner crashed")
+        # Re-uploading a file the successful path already sent is harmless: the control plane keys
+        # a run's files on their path, so a second delivery overwrites one row rather than billing
+        # the budget twice.
+        return p_fail(
+            spec,
+            "failure",
+            f"runner crashed: {exc}",
+            EXIT_INTERNAL,
+            os.environ.get("OPENSWARM_RUN_WORKSPACE", DEFAULT_RUN_WORKSPACE),
+        )
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/openswarm-runner/runner/results/__init__.py b/openswarm-runner/runner/results/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/openswarm-runner/runner/results/deliverables.py b/openswarm-runner/runner/results/deliverables.py
new file mode 100644
index 00000000..5aaba20f
--- /dev/null
+++ b/openswarm-runner/runner/results/deliverables.py
@@ -0,0 +1,193 @@
+"""What the run made, and what of it is allowed to come home.
+
+A cloud run's machine is destroyed the moment it exits, so a file it wrote is gone
+unless something carries it out. This module is the "what": it walks the one
+directory a run is given as its working folder and decides, per file, deliver or
+refuse. The "how" (handing bytes to the control plane) lives in runner.results.report.
+
+Refusing loudly is the whole point of the caps. A user who asked for a video and
+got a 20MB fragment of one is worse off than a user who was told the video was too
+big, so nothing here ever truncates a file: it either arrives whole or it arrives
+as a sentence explaining why it did not.
+"""
+
+import hashlib
+import logging
+import os
+from typing import List, Optional, Tuple
+
+from pydantic import BaseModel, ConfigDict, Field
+from typeguard import typechecked
+
+logger = logging.getLogger(__name__)
+
+# Per-file ceiling. Deliverables are reports, spreadsheets, charts and small archives; a run that
+# produces something bigger is doing a different job than this pipe was built for.
+MAX_FILE_BYTES = 20 * 1024 * 1024
+# Per-run ceiling, enforced in walk order so the first files still arrive when a later one blows it.
+MAX_TOTAL_BYTES = 50 * 1024 * 1024
+MAX_FILES = 40
+# Longest path we will accept, so a deep tree cannot produce a name no filesystem will take back.
+MAX_RELATIVE_PATH_CHARS = 180
+
+# Machinery, not deliverables. Everything here is either regenerable (dependencies, caches,
+# compiled bytecode) or the run's own plumbing, and shipping it would blow the file budget on
+# things nobody asked for.
+EXCLUDED_DIRS = frozenset({
+    ".git",
+    ".claude",
+    "node_modules",
+    "__pycache__",
+    ".venv",
+    "venv",
+    ".pytest_cache",
+    ".ruff_cache",
+    ".mypy_cache",
+    ".cache",
+    ".npm",
+})
+EXCLUDED_NAMES = frozenset({".DS_Store", ".gitignore", ".gitkeep"})
+
+READ_CHUNK_BYTES = 1024 * 1024
+
+
+class Deliverable(BaseModel):
+    """One file that fits, addressed by its path relative to the run's workspace."""
+
+    model_config = ConfigDict(validate_assignment=True)
+
+    path: str
+    size_bytes: int
+    sha256: str
+
+
+class Refused(BaseModel):
+    """One file that does not come home, and the sentence the user gets instead."""
+
+    model_config = ConfigDict(validate_assignment=True)
+
+    path: str
+    size_bytes: int
+    reason: str
+
+
+class Harvest(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    files: List[Deliverable] = Field(default_factory=list)
+    refused: List[Refused] = Field(default_factory=list)
+
+    @typechecked
+    def total_bytes(self) -> int:
+        return sum(item.size_bytes for item in self.files)
+
+
+@typechecked
+def human_bytes(count: int) -> str:
+    if count < 1024:
+        return f"{count} B"
+    if count < 1024 * 1024:
+        return f"{count / 1024:.0f} KB"
+    if count < 1024 * 1024 * 1024:
+        return f"{count / (1024 * 1024):.1f} MB"
+    return f"{count / (1024 * 1024 * 1024):.1f} GB"
+
+
+@typechecked
+def p_digest(path: str) -> Optional[str]:
+    """sha256, streamed. None when the file went away mid-walk, which is not an error."""
+    digest = hashlib.sha256()
+    try:
+        with open(path, "rb") as handle:
+            while True:
+                chunk = handle.read(READ_CHUNK_BYTES)
+                if not chunk:
+                    break
+                digest.update(chunk)
+    except OSError as exc:
+        logger.warning("could not read %s while harvesting: %s", path, exc)
+        return None
+    return digest.hexdigest()
+
+
+@typechecked
+def p_walk(workspace: str) -> List[Tuple[str, int]]:
+    """Every candidate file under the workspace as (relative path, size), sorted for determinism."""
+    found: List[Tuple[str, int]] = []
+    for directory, subdirs, filenames in os.walk(workspace):
+        subdirs[:] = sorted(name for name in subdirs if name not in EXCLUDED_DIRS)
+        for filename in sorted(filenames):
+            if filename in EXCLUDED_NAMES:
+                continue
+            absolute = os.path.join(directory, filename)
+            # Symlinks are not followed: a run that linked to /etc/passwd must not exfiltrate it.
+            if os.path.islink(absolute) or not os.path.isfile(absolute):
+                continue
+            try:
+                size = os.path.getsize(absolute)
+            except OSError:
+                continue
+            found.append((os.path.relpath(absolute, workspace), size))
+    return found
+
+
+@typechecked
+def collect(workspace: str) -> Harvest:
+    """Decide, for every file in the run's workspace, whether it comes home."""
+    harvest = Harvest()
+    if not os.path.isdir(workspace):
+        return harvest
+
+    running_total = 0
+    for relative, size in p_walk(workspace):
+        if len(relative) > MAX_RELATIVE_PATH_CHARS:
+            harvest.refused.append(Refused(
+                path=relative[:MAX_RELATIVE_PATH_CHARS] + "...",
+                size_bytes=size,
+                reason="its path is too long to save anywhere",
+            ))
+            continue
+        if size == 0:
+            continue
+        if size > MAX_FILE_BYTES:
+            harvest.refused.append(Refused(
+                path=relative,
+                size_bytes=size,
+                reason=(
+                    f"it is {human_bytes(size)} and a single cloud-run file cannot exceed "
+                    f"{human_bytes(MAX_FILE_BYTES)}"
+                ),
+            ))
+            continue
+        if len(harvest.files) >= MAX_FILES:
+            harvest.refused.append(Refused(
+                path=relative,
+                size_bytes=size,
+                reason=f"this run already produced the maximum of {MAX_FILES} files",
+            ))
+            continue
+        if running_total + size > MAX_TOTAL_BYTES:
+            harvest.refused.append(Refused(
+                path=relative,
+                size_bytes=size,
+                reason=(
+                    f"the run's files already total {human_bytes(running_total)} and the limit "
+                    f"is {human_bytes(MAX_TOTAL_BYTES)}"
+                ),
+            ))
+            continue
+        digest = p_digest(os.path.join(workspace, relative))
+        if digest is None:
+            harvest.refused.append(Refused(path=relative, size_bytes=size, reason="it could not be read"))
+            continue
+        harvest.files.append(Deliverable(path=relative, size_bytes=size, sha256=digest))
+        running_total += size
+
+    logger.info(
+        "harvested %d file(s) totalling %s from %s, refused %d",
+        len(harvest.files),
+        human_bytes(running_total),
+        workspace,
+        len(harvest.refused),
+    )
+    return harvest
diff --git a/openswarm-runner/runner/results/report.py b/openswarm-runner/runner/results/report.py
new file mode 100644
index 00000000..ca769138
--- /dev/null
+++ b/openswarm-runner/runner/results/report.py
@@ -0,0 +1,168 @@
+"""Tell the control plane what happened, and hand it whatever the run made.
+
+The terminal report is the run's only receipt. Files go up BEFORE it, on purpose:
+the per-run callback token stops working the instant the run reaches a terminal
+state, so "upload, then close" is the only order in which both can succeed, and it
+means the window for writing files to a run closes exactly when the run does.
+"""
+
+import logging
+import os
+import time
+from typing import List, Literal, Optional
+from urllib.parse import quote
+
+import httpx
+from pydantic import BaseModel, ConfigDict, Field
+from typeguard import typechecked
+
+from runner.results.deliverables import Harvest, human_bytes
+from runner.run_spec import CallbackTarget
+
+logger = logging.getLogger(__name__)
+
+TERMINAL_ATTEMPTS = 5
+TERMINAL_BACKOFF_SECONDS = 2.0
+REQUEST_TIMEOUT_SECONDS = 15.0
+# One file, one shot, generous: 20MB over a cold uplink is slower than any report.
+UPLOAD_TIMEOUT_SECONDS = 120.0
+FILE_PATH_HEADER = "X-Openswarm-File-Path"
+FILE_SHA256_HEADER = "X-Openswarm-File-Sha256"
+
+
+class ReportedFile(BaseModel):
+    """One file the run produced, delivered or not, always named."""
+
+    model_config = ConfigDict(validate_assignment=True)
+
+    path: str
+    size_bytes: int
+    delivered: bool
+    # Present only when delivered is False. Written for a human, because it is shown to one.
+    reason: Optional[str] = None
+
+
+class RunReport(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    run_id: str
+    phase: Literal["started", "heartbeat", "finished"]
+    status: str
+    exit_code: Optional[int] = None
+    error: Optional[str] = None
+    cost_usd: float = 0.0
+    active_step_idx: Optional[int] = None
+    last_tool_label: Optional[str] = None
+    answer: str = ""
+    transcript: str = ""
+    # The backend calls a run "success" even when the provider rejected the token; these are how the control plane sees that.
+    system_notices: List[str] = Field(default_factory=list)
+    # Every file the run made, including the ones that were too big to send. A deliverable that
+    # silently vanished is the failure this list exists to make impossible.
+    files: List[ReportedFile] = Field(default_factory=list)
+
+
+@typechecked
+def p_post_once(callback: CallbackTarget, report: RunReport) -> bool:
+    try:
+        with httpx.Client(timeout=REQUEST_TIMEOUT_SECONDS) as client:
+            response = client.post(
+                callback.url,
+                headers={"Authorization": f"Bearer {callback.token}"},
+                json=report.model_dump(mode="json"),
+            )
+        if response.status_code < 300:
+            return True
+        logger.warning("report %s rejected with HTTP %s", report.phase, response.status_code)
+        return False
+    except httpx.HTTPError as exc:
+        logger.warning("report %s failed to send: %s", report.phase, exc)
+        return False
+
+
+@typechecked
+def send_report(callback: Optional[CallbackTarget], report: RunReport) -> bool:
+    """Post a report. Terminal reports retry; heartbeats get one shot and are never retried."""
+    if callback is None:
+        logger.info("no callback configured; %s report kept local: %s", report.phase, report.status)
+        return True
+    if report.phase != "finished":
+        return p_post_once(callback, report)
+    for attempt in range(TERMINAL_ATTEMPTS):
+        if p_post_once(callback, report):
+            return True
+        if attempt + 1 < TERMINAL_ATTEMPTS:
+            time.sleep(TERMINAL_BACKOFF_SECONDS * (attempt + 1))
+    logger.error("terminal report for run %s never landed after %d attempts", report.run_id, TERMINAL_ATTEMPTS)
+    return False
+
+
+@typechecked
+def p_upload_one(client: httpx.Client, callback: CallbackTarget, workspace: str, relative: str, sha256: str) -> Optional[str]:
+    """Push one file. Returns None on success, or the sentence explaining the failure."""
+    try:
+        with open(os.path.join(workspace, relative), "rb") as handle:
+            response = client.post(
+                str(callback.artifacts_url),
+                headers={
+                    "Authorization": f"Bearer {callback.token}",
+                    "Content-Type": "application/octet-stream",
+                    FILE_PATH_HEADER: quote(relative, safe="/"),
+                    FILE_SHA256_HEADER: sha256,
+                },
+                content=handle.read(),
+            )
+    except OSError as exc:
+        return f"it could not be read back off disk ({exc.strerror or exc})"
+    except httpx.HTTPError as exc:
+        return f"the upload did not complete ({type(exc).__name__})"
+    if response.status_code < 300:
+        return None
+    # The control plane refuses with prose it wrote for the user; keep its words rather than ours.
+    detail = (response.text or "").strip()
+    try:
+        body = response.json()
+        if isinstance(body, dict) and isinstance(body.get("error"), str):
+            detail = body["error"]
+    except ValueError:
+        pass
+    return detail[:300] if detail else f"the storage service answered HTTP {response.status_code}"
+
+
+@typechecked
+def deliver_files(callback: Optional[CallbackTarget], workspace: str, harvest: Harvest) -> List[ReportedFile]:
+    """Hand every deliverable to the control plane and report honestly on each one.
+
+    Never raises and never fails the run: a workflow whose answer is good and whose
+    attachment did not make it should still deliver the answer, with the miss stated.
+    """
+    reported = [
+        ReportedFile(path=item.path, size_bytes=item.size_bytes, delivered=False, reason=item.reason)
+        for item in harvest.refused
+    ]
+    if not harvest.files:
+        return reported
+    if callback is None or not callback.artifacts_url:
+        for item in harvest.files:
+            reported.append(ReportedFile(
+                path=item.path,
+                size_bytes=item.size_bytes,
+                delivered=False,
+                reason="this run had nowhere to send files, so it kept them on the machine",
+            ))
+        return reported
+
+    with httpx.Client(timeout=UPLOAD_TIMEOUT_SECONDS) as client:
+        for item in harvest.files:
+            failure = p_upload_one(client, callback, workspace, item.path, item.sha256)
+            if failure is None:
+                logger.info("delivered %s (%s)", item.path, human_bytes(item.size_bytes))
+            else:
+                logger.warning("could not deliver %s: %s", item.path, failure)
+            reported.append(ReportedFile(
+                path=item.path,
+                size_bytes=item.size_bytes,
+                delivered=failure is None,
+                reason=failure,
+            ))
+    return reported
diff --git a/openswarm-runner/runner/run_spec.py b/openswarm-runner/runner/run_spec.py
new file mode 100644
index 00000000..db6487e7
--- /dev/null
+++ b/openswarm-runner/runner/run_spec.py
@@ -0,0 +1,215 @@
+"""Typed description of the single workflow run this container exists to execute.
+
+The control plane hands the container exactly one of these (JSON in
+OPENSWARM_RUN_SPEC, or a path in OPENSWARM_RUN_SPEC_FILE) and nothing else. Every
+field is validated before the backend boots, so a malformed job dies in under a
+second instead of burning a machine-minute discovering it.
+"""
+
+import json
+import os
+from datetime import datetime, timedelta, timezone
+from typing import List, Literal, Optional
+
+from pydantic import BaseModel, ConfigDict, Field, model_validator
+from typeguard import typechecked
+
+from backend.apps.workflows.models import Workflow
+
+SPEC_ENV = "OPENSWARM_RUN_SPEC"
+SPEC_FILE_ENV = "OPENSWARM_RUN_SPEC_FILE"
+
+# The one dashboard a cloud run has. Fixed rather than generated so the Electron window can be
+# deep-linked at it before the backend has even booted, and so a workflow arriving with the
+# laptop dashboard id it was authored against gets repointed at a dashboard that exists here.
+CLOUD_RUN_DASHBOARD_ID = "cloud-run"
+
+# Headroom the access token must still have on arrival. The control plane refreshes right before dispatch; anything thinner than this means its clock or its queue is broken, and we must not paper over that by refreshing ourselves.
+MIN_TOKEN_LIFETIME = timedelta(minutes=2)
+
+# A skill is prose plus the odd small script. These bounds keep a run spec from becoming a file
+# transfer, and are enforced here so an oversized one dies before a machine is billed for it.
+MAX_SKILLS = 60
+MAX_SKILL_FILE_CHARS = 200_000
+
+
+class InvalidRunSpec(ValueError):
+    """The control plane handed us something we refuse to run."""
+
+
+class ProviderCredential(BaseModel):
+    """One already-refreshed provider credential, spendable but not rotatable.
+
+    `extra="forbid"` is the first of two walls keeping a refresh token out of this
+    container: a payload carrying `refreshToken` fails validation here and the run
+    dies loudly. See runner.router_credentials for the second wall and the why.
+    """
+
+    model_config = ConfigDict(validate_assignment=True, extra="forbid")
+
+    provider: str = Field(min_length=1)
+    auth_type: Literal["oauth", "api_key"]
+    label: str = "OpenSwarm cloud run"
+    access_token: Optional[str] = None
+    api_key: Optional[str] = None
+    expires_at: Optional[datetime] = None
+    scope: Optional[str] = None
+
+    @model_validator(mode="after")
+    def p_require_matching_secret(self) -> "ProviderCredential":
+        if self.auth_type == "oauth":
+            if not self.access_token:
+                raise ValueError(f"credential for {self.provider!r} is oauth but carries no access_token")
+            if self.expires_at is None:
+                raise ValueError(f"credential for {self.provider!r} is oauth but carries no expires_at")
+            if self.api_key:
+                raise ValueError(f"credential for {self.provider!r} carries both an access_token and an api_key")
+        else:
+            if not self.api_key:
+                raise ValueError(f"credential for {self.provider!r} is api_key but carries no api_key")
+            if self.access_token:
+                raise ValueError(f"credential for {self.provider!r} carries both an access_token and an api_key")
+        return self
+
+    @typechecked
+    def remaining_lifetime(self, now: datetime) -> Optional[timedelta]:
+        """How long this credential is still good for; None when it cannot expire."""
+        if self.expires_at is None:
+            return None
+        return self.expires_at.astimezone(timezone.utc) - now.astimezone(timezone.utc)
+
+
+class CallbackTarget(BaseModel):
+    """Where the run reports back. The token is a dedicated two-party secret, never a user credential."""
+
+    model_config = ConfigDict(validate_assignment=True, extra="forbid")
+
+    url: str = Field(min_length=1)
+    token: str = Field(min_length=1)
+    heartbeat_seconds: int = Field(default=30, ge=5, le=300)
+    # Where the run's files go. Named outright rather than derived from `url`, so a control plane
+    # that cannot accept files says so by leaving it out instead of being guessed at.
+    artifacts_url: Optional[str] = None
+
+
+class SkillFile(BaseModel):
+    """One file inside a skill folder. Text only: a skill is prose plus small scripts."""
+
+    model_config = ConfigDict(validate_assignment=True, extra="forbid")
+
+    path: str = Field(min_length=1, max_length=180)
+    text: str = Field(max_length=MAX_SKILL_FILE_CHARS)
+
+    @model_validator(mode="after")
+    def p_reject_escaping_path(self) -> "SkillFile":
+        parts = self.path.split("/")
+        if self.path.startswith("/") or "\\" in self.path or any(p in ("", ".", "..") for p in parts):
+            raise ValueError(f"skill file path {self.path!r} is not a plain relative path")
+        return self
+
+
+class SkillPayload(BaseModel):
+    """One of the user's skills, carried up so the agent has the same know-how it has at home.
+
+    Skills are the user's own writing, not credentials. Nothing in here is a token, and the
+    control plane never learns anything from it that it could spend.
+    """
+
+    model_config = ConfigDict(validate_assignment=True, extra="forbid")
+
+    # Also the folder name under ~/.claude/skills, so it has to survive being a directory.
+    id: str = Field(min_length=1, max_length=80, pattern=r"^[A-Za-z0-9][A-Za-z0-9_-]*$")
+    files: List[SkillFile] = Field(min_length=1)
+
+    @model_validator(mode="after")
+    def p_require_skill_md(self) -> "SkillPayload":
+        if not any(file.path == "SKILL.md" for file in self.files):
+            raise ValueError(f"skill {self.id!r} has no SKILL.md, so nothing would ever load it")
+        return self
+
+
+class McpServerNote(BaseModel):
+    """A server the user has connected at home, named so the agent can say it cannot reach it.
+
+    Deliberately carries NO transport and NO secret. The user's MCP credentials (Slack session
+    cookies, Notion and GitHub access tokens, Google refresh tokens) stay on their laptop, so this
+    is a list of names and nothing else. Its whole job is to stop the agent quietly answering
+    "update my Notion" from general knowledge because it never knew Notion existed.
+    """
+
+    model_config = ConfigDict(validate_assignment=True, extra="forbid")
+
+    name: str = Field(min_length=1, max_length=120)
+
+
+class RunSpec(BaseModel):
+    model_config = ConfigDict(validate_assignment=True, extra="forbid")
+
+    run_id: str = Field(min_length=1)
+    workflow: Workflow
+    credentials: List[ProviderCredential] = Field(min_length=1)
+    callback: Optional[CallbackTarget] = None
+    # The user's skills, shipped so a cloud run is as capable as the same workflow at home.
+    skills: List[SkillPayload] = Field(default_factory=list, max_length=MAX_SKILLS)
+    # Names only. See McpServerNote for why there is no config here.
+    unavailable_mcp_servers: List[McpServerNote] = Field(default_factory=list, max_length=100)
+    # Hard wall-clock ceiling. Fly bills by machine-second, so an agent that wedges must cost a bounded amount.
+    max_run_seconds: int = Field(default=1800, ge=60, le=7200)
+    # Boot Electron under a virtual display so browser steps work. On by default: parity is the
+    # point of running in a container at all, and a workflow that never touches a browser is the
+    # exception that should have to say so. Costs a few seconds and a few hundred MB when on.
+    needs_browser: bool = True
+
+    @typechecked
+    def expired_credentials(self, now: datetime) -> List[ProviderCredential]:
+        """Credentials too close to expiry to spend. The runner cannot refresh, so this is fatal, not a retry."""
+        stale: List[ProviderCredential] = []
+        for credential in self.credentials:
+            remaining = credential.remaining_lifetime(now)
+            if remaining is not None and remaining < MIN_TOKEN_LIFETIME:
+                stale.append(credential)
+        return stale
+
+    @typechecked
+    def workflow_for_disk(self) -> Workflow:
+        """The workflow as this container should see it: one run, never a schedule.
+
+        A cloud-executed workflow arrives with its schedule still configured. Left
+        enabled, the container's own scheduler would fire it a second time inside
+        the box, so the timer is stripped here rather than trusted to stay off.
+
+        It also arrives pointing at whatever dashboard it was authored on, which does not
+        exist in this container; left alone, the first browser card would 404 looking for
+        it. Repointed at the one dashboard this run has.
+        """
+        copy = self.workflow.model_copy(deep=True)
+        copy.dashboard_id = CLOUD_RUN_DASHBOARD_ID
+        copy.schedule.enabled = False
+        copy.deleted_at = None
+        copy.draft_steps = None
+        copy.next_run_at = None
+        return copy
+
+
+@typechecked
+def load_run_spec() -> RunSpec:
+    """Parse the run spec from the environment, or raise InvalidRunSpec with a legible reason."""
+    raw = os.environ.get(SPEC_ENV, "").strip()
+    source = SPEC_ENV
+    if not raw:
+        path = os.environ.get(SPEC_FILE_ENV, "").strip()
+        if not path:
+            raise InvalidRunSpec(f"no run spec: set {SPEC_ENV} to JSON or {SPEC_FILE_ENV} to a file path")
+        source = f"{SPEC_FILE_ENV}={path}"
+        try:
+            with open(path, "r", encoding="utf-8") as handle:
+                raw = handle.read()
+        except OSError as exc:
+            raise InvalidRunSpec(f"cannot read run spec from {source}: {exc}") from exc
+
+    try:
+        return RunSpec.model_validate_json(raw)
+    except json.JSONDecodeError as exc:
+        raise InvalidRunSpec(f"run spec from {source} is not valid JSON: {exc}") from exc
+    except ValueError as exc:
+        raise InvalidRunSpec(f"run spec from {source} is not a valid RunSpec: {exc}") from exc
diff --git a/openswarm-runner/runner/seed/__init__.py b/openswarm-runner/runner/seed/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/openswarm-runner/runner/seed/data_root.py b/openswarm-runner/runner/seed/data_root.py
new file mode 100644
index 00000000..7741ff7c
--- /dev/null
+++ b/openswarm-runner/runner/seed/data_root.py
@@ -0,0 +1,137 @@
+"""Lay down the backend's data dir before it boots, so the run is ready on the first tick.
+
+Everything here is written pre-boot on purpose: the workflow store and the settings
+store both load from disk once at startup, so seeding files is cheaper and more
+deterministic than replaying create/PATCH calls over HTTP (no aux LLM naming call,
+no schedule normalization, no chance of the container inventing a second workflow).
+"""
+
+import json
+import os
+import tempfile
+from typing import Any, Dict
+
+from typeguard import typechecked
+
+from backend.apps.dashboards.models import Dashboard
+from backend.apps.settings.models import AppSettings
+from runner.run_spec import CLOUD_RUN_DASHBOARD_ID, RunSpec
+
+# 9Router provider id -> the AppSettings field the backend reads a raw key from.
+API_KEY_SETTINGS_FIELD: Dict[str, str] = {
+    "anthropic": "anthropic_api_key",
+    "openai": "openai_api_key",
+    "gemini": "google_api_key",
+    "google": "google_api_key",
+    "openrouter": "openrouter_api_key",
+}
+
+# One synthetic id for every cloud run. Without it each ephemeral container mints a fresh uuid and analytics sees a brand-new "install" per run.
+CLOUD_RUNNER_INSTALLATION_ID = "openswarm-cloud-runner"
+
+# Told to the agent in as many words, because it cannot find this out any other way and the
+# consequence of not knowing is a report written to a folder that is deleted minutes later.
+DELIVERY_NOTE = (
+    "You are running in the OpenSwarm cloud on a throwaway machine. Your working directory is "
+    "the ONLY place that survives: every file you save there is delivered back to the user, and "
+    "everything else on this machine is destroyed the moment this run ends. So when a task asks "
+    "for a document, spreadsheet, image or archive, write it to a plainly named file in your "
+    "working directory rather than only pasting it into your reply. Do not write deliverables to "
+    "/tmp or to your home directory; they will not come back."
+)
+
+
+@typechecked
+def p_write_json(path: str, payload: Any) -> None:
+    """Atomic, owner-only write; these files hold API keys."""
+    directory = os.path.dirname(path)
+    os.makedirs(directory, mode=0o700, exist_ok=True)
+    handle, temp_path = tempfile.mkstemp(dir=directory, prefix=".seed-", suffix=".json")
+    try:
+        with os.fdopen(handle, "w", encoding="utf-8") as stream:
+            json.dump(payload, stream, indent=2)
+        os.chmod(temp_path, 0o600)
+        os.replace(temp_path, path)
+    except BaseException:
+        if os.path.exists(temp_path):
+            os.unlink(temp_path)
+        raise
+
+
+@typechecked
+def unavailable_apps_note(spec: RunSpec) -> str:
+    """Name the user's connected apps this run cannot reach, so silence is not mistaken for absence.
+
+    Their MCP credentials never leave the laptop, so the servers are not here and never will be
+    mid-run. Without this sentence the agent has no way to know the app exists, and "update my
+    Notion" comes back as a confident paragraph about Notion rather than an admission.
+    """
+    names = [server.name for server in spec.unavailable_mcp_servers]
+    if not names:
+        return ""
+    return (
+        "These apps are connected on the user's own computer but NOT reachable from this cloud "
+        f"run, because their sign-in details stay on that computer: {', '.join(sorted(names))}. "
+        "If a task needs one of them, say plainly that it cannot be done from a cloud run and "
+        "that it has to run on their machine. Never guess at, invent, or describe from memory "
+        "what one of those apps contains."
+    )
+
+
+@typechecked
+def settings_for_run(spec: RunSpec, workspace: str) -> AppSettings:
+    """The AppSettings a cloud run needs: this workflow's model, this run's keys, no telemetry.
+
+    `default_folder` is what makes the run's files findable afterwards. Left unset, the agent
+    falls back to $HOME and the launcher reroutes it into a per-session scratch directory whose
+    name nothing outside the backend can predict, so the harvest would have nowhere to look.
+    """
+    settings = AppSettings()
+    settings.default_model = spec.workflow.model
+    settings.connection_mode = "own_key"
+    settings.analytics_opt_in = False
+    settings.installation_id = CLOUD_RUNNER_INSTALLATION_ID
+    settings.default_folder = workspace
+    additions = [DELIVERY_NOTE, unavailable_apps_note(spec)]
+    settings.default_system_prompt = "\n\n".join(
+        part for part in [settings.default_system_prompt or "", *additions] if part
+    ).strip()
+    for credential in spec.credentials:
+        if credential.auth_type != "api_key":
+            continue
+        field = API_KEY_SETTINGS_FIELD.get(credential.provider)
+        if field is None:
+            raise ValueError(
+                f"no settings field for api_key provider {credential.provider!r}; "
+                f"supported: {', '.join(sorted(set(API_KEY_SETTINGS_FIELD)))}"
+            )
+        setattr(settings, field, credential.api_key)
+    return settings
+
+
+@typechecked
+def seed_data_root(data_root: str, workspace: str, spec: RunSpec) -> None:
+    """Write the workflow, settings and dashboard records the backend will read at boot.
+
+    The dashboard exists so the Electron window has somewhere to land and browser cards have
+    somewhere to render. Writing it here rather than letting the backend's first-boot migration
+    invent one keeps its id knowable before anything has started.
+
+    The workspace sits OUTSIDE the data root deliberately: it is the agent's own folder, and a
+    Glob or Grep run inside it should not sweep up the settings file its API keys live in.
+    """
+    os.makedirs(workspace, mode=0o700, exist_ok=True)
+    workflow = spec.workflow_for_disk()
+    p_write_json(
+        os.path.join(data_root, "workflows", f"{workflow.id}.json"),
+        workflow.model_dump(mode="json"),
+    )
+    p_write_json(
+        os.path.join(data_root, "settings", "settings.json"),
+        settings_for_run(spec, workspace).model_dump(mode="json"),
+    )
+    dashboard = Dashboard(id=CLOUD_RUN_DASHBOARD_ID, name=spec.workflow.title or "Cloud run")
+    p_write_json(
+        os.path.join(data_root, "dashboards", f"{dashboard.id}.json"),
+        dashboard.model_dump(mode="json"),
+    )
diff --git a/openswarm-runner/runner/seed/router_credentials.py b/openswarm-runner/runner/seed/router_credentials.py
new file mode 100644
index 00000000..5d2d719f
--- /dev/null
+++ b/openswarm-runner/runner/seed/router_credentials.py
@@ -0,0 +1,128 @@
+"""Write 9Router's credential db for one cloud run, without a refresh token. Ever.
+
+This container must be structurally incapable of rotating the user's OAuth grant.
+9Router's refresh dispatcher bails on `if (!b || !b.refreshToken) return null`, so a
+providerConnections entry with no such field is one it can spend and never rotate.
+If the runner did rotate, the user's laptop would be left replaying a dead token and
+the provider would revoke their entire grant family. That is the whole safety
+property of this file, not a style preference.
+
+Two independent walls hold it up:
+  1. ProviderCredential forbids extra fields, so a payload carrying `refreshToken`
+     never parses into the process at all.
+  2. assert_no_refresh_token re-reads the assembled payload just before the write
+     and refuses anything whose key names a refresh token, however it got there.
+"""
+
+import json
+import os
+import tempfile
+from datetime import datetime, timezone
+from typing import Any, Dict, List
+from uuid import uuid4
+
+from typeguard import typechecked
+
+from runner.run_spec import ProviderCredential
+
+DB_FILENAME = "db.json"
+
+# Normalized key fragment that must never appear anywhere in the db we write.
+FORBIDDEN_KEY_FRAGMENT = "refreshtoken"
+
+
+class RefreshTokenLeak(RuntimeError):
+    """A refresh token reached the credential writer. Fail the run rather than write it."""
+
+
+@typechecked
+def p_normalize_key(key: str) -> str:
+    return "".join(char for char in key.lower() if char.isalnum())
+
+
+@typechecked
+def p_iso(moment: datetime) -> str:
+    """9Router timestamps are ISO-8601 UTC with a Z suffix; match it exactly."""
+    return moment.astimezone(timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z")
+
+
+@typechecked
+def assert_no_refresh_token(payload: Any, path: str = "$") -> None:
+    """Raise if any key anywhere under `payload` names a refresh token."""
+    if isinstance(payload, dict):
+        for key, value in payload.items():
+            if FORBIDDEN_KEY_FRAGMENT in p_normalize_key(str(key)):
+                raise RefreshTokenLeak(
+                    f"refusing to write a 9Router db containing a refresh token at {path}.{key}"
+                )
+            assert_no_refresh_token(value, f"{path}.{key}")
+    elif isinstance(payload, list):
+        for index, value in enumerate(payload):
+            assert_no_refresh_token(value, f"{path}[{index}]")
+
+
+@typechecked
+def router_connection(credential: ProviderCredential, now: datetime) -> Dict[str, Any]:
+    """Build one providerConnections entry from an allow-list of keys, never a passthrough."""
+    if credential.auth_type != "oauth":
+        raise ValueError(f"credential for {credential.provider!r} is not an oauth connection")
+    entry: Dict[str, Any] = {
+        "id": str(uuid4()),
+        "provider": credential.provider,
+        "authType": "oauth",
+        "name": credential.label,
+        "priority": 1,
+        "isActive": True,
+        "createdAt": p_iso(now),
+        "updatedAt": p_iso(now),
+        "accessToken": credential.access_token,
+        "testStatus": "active",
+    }
+    if credential.expires_at is not None:
+        entry["expiresAt"] = p_iso(credential.expires_at)
+    if credential.scope:
+        entry["scope"] = credential.scope
+    return entry
+
+
+@typechecked
+def router_db_payload(credentials: List[ProviderCredential], now: datetime) -> Dict[str, Any]:
+    """A complete 9Router db seeded with this run's subscription connections and nothing else."""
+    return {
+        "providerConnections": [
+            router_connection(credential, now)
+            for credential in credentials
+            if credential.auth_type == "oauth"
+        ],
+        "providerNodes": [],
+        "proxyPools": [],
+        "modelAliases": {},
+        "mitmAlias": {},
+        "combos": [],
+        "apiKeys": [],
+        "customModels": [],
+        "pricing": {},
+        "settings": {},
+    }
+
+
+@typechecked
+def write_router_db(data_dir: str, credentials: List[ProviderCredential], now: datetime) -> str:
+    """Write $DATA_DIR/db.json owner-only and return its path."""
+    payload = router_db_payload(credentials, now)
+    assert_no_refresh_token(payload)
+
+    os.makedirs(data_dir, mode=0o700, exist_ok=True)
+    os.chmod(data_dir, 0o700)
+    path = os.path.join(data_dir, DB_FILENAME)
+    handle, temp_path = tempfile.mkstemp(dir=data_dir, prefix=".db-", suffix=".json")
+    try:
+        with os.fdopen(handle, "w", encoding="utf-8") as stream:
+            json.dump(payload, stream, indent=2)
+        os.chmod(temp_path, 0o600)
+        os.replace(temp_path, path)
+    except BaseException:
+        if os.path.exists(temp_path):
+            os.unlink(temp_path)
+        raise
+    return path
diff --git a/openswarm-runner/runner/seed/skills.py b/openswarm-runner/runner/seed/skills.py
new file mode 100644
index 00000000..e0399b01
--- /dev/null
+++ b/openswarm-runner/runner/seed/skills.py
@@ -0,0 +1,52 @@
+"""Lay the user's skills down where the backend looks for them, before it boots.
+
+backend/apps/skills/skills.py hardwires SKILLS_DIR to ~/.claude/skills and gates the whole
+Skill tool on at least one non-built-in skill existing there. A container that ships without
+them does not get a degraded Skill tool, it gets no Skill tool at all, and the agent then
+answers from general knowledge in a voice that sounds exactly as confident as the real thing.
+
+Written pre-boot for the same reason the workflow is: the skill index is read once at startup.
+"""
+
+import logging
+import os
+from typing import List
+
+from typeguard import typechecked
+
+from runner.run_spec import SkillPayload
+
+logger = logging.getLogger(__name__)
+
+SKILLS_DIRNAME = os.path.join(".claude", "skills")
+
+
+@typechecked
+def skills_dir(home: str) -> str:
+    return os.path.join(home, SKILLS_DIRNAME)
+
+
+@typechecked
+def write_skills(home: str, skills: List[SkillPayload]) -> int:
+    """Write every skill folder. Returns how many landed.
+
+    Paths were already proven relative and non-escaping by SkillFile's validator; this re-checks
+    the joined result anyway, because the one place a path traversal is worth catching twice is
+    the line that actually opens the file.
+    """
+    root = skills_dir(home)
+    os.makedirs(root, mode=0o700, exist_ok=True)
+    written = 0
+    for skill in skills:
+        folder = os.path.join(root, skill.id)
+        for file in skill.files:
+            target = os.path.abspath(os.path.join(folder, file.path))
+            if not target.startswith(os.path.abspath(folder) + os.sep):
+                raise ValueError(f"skill {skill.id!r} file {file.path!r} resolves outside its own folder")
+            os.makedirs(os.path.dirname(target), mode=0o700, exist_ok=True)
+            with open(target, "w", encoding="utf-8") as handle:
+                handle.write(file.text)
+        written += 1
+    if written:
+        logger.info("seeded %d skill(s) into %s", written, root)
+    return written
diff --git a/openswarm-runner/runner/workflow_run.py b/openswarm-runner/runner/workflow_run.py
new file mode 100644
index 00000000..2e516f90
--- /dev/null
+++ b/openswarm-runner/runner/workflow_run.py
@@ -0,0 +1,273 @@
+"""Drive one workflow through the backend's own HTTP surface and collect its result.
+
+Deliberately no shortcuts into agent_manager: the cloud run fires the same route the
+Run button fires, so the MCP gate, action filtering, provider routing and history all
+behave exactly as they do on a laptop.
+"""
+
+import json
+import logging
+import time
+from typing import Any, Callable, Dict, List, Optional
+
+import httpx
+from pydantic import BaseModel, ConfigDict, Field
+from typeguard import typechecked
+
+from runner.boot.backend_process import BackendProcess
+
+logger = logging.getLogger(__name__)
+
+TERMINAL_STATUSES = ("success", "failure", "ran_late", "skipped")
+POLL_INTERVAL_SECONDS = 1.0
+TRANSCRIPT_MAX_CHARS = 14000
+# The backend is one process on one event loop, and a heavy tool call can hold it: MCP registry
+# work has been measured keeping it from answering for well over a minute. A reply that is late
+# therefore means busy, not dead, so the budget is generous and lateness is never fatal. The only
+# thing that ends a run early is the process actually exiting.
+REQUEST_TIMEOUT_SECONDS = 60.0
+TRIGGER_RETRY_SECONDS = 5.0
+
+
+class WorkflowRunFailed(RuntimeError):
+    """The backend refused to start the run at all."""
+
+
+class RunProgress(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    run_id: str
+    status: str
+    active_step_idx: Optional[int] = None
+    last_tool_label: Optional[str] = None
+
+
+class RunOutcome(BaseModel):
+    model_config = ConfigDict(validate_assignment=True)
+
+    run_id: str
+    status: str
+    error: Optional[str] = None
+    cost_usd: float = 0.0
+    session_id: Optional[str] = None
+    transcript: str = ""
+    answer: str = ""
+    system_notices: List[str] = Field(default_factory=list)
+
+
+@typechecked
+def p_block_text(block: Dict[str, Any]) -> str:
+    kind = block.get("type")
+    if kind == "text":
+        return str(block.get("text") or "")
+    if kind == "tool_use":
+        return f"[tool {block.get('name')}] {json.dumps(block.get('input') or {})[:300]}"
+    if kind == "tool_result":
+        inner = block.get("content")
+        return f"[result] {inner if isinstance(inner, str) else json.dumps(inner)[:300]}"
+    return ""
+
+
+@typechecked
+def p_message_text(message: Dict[str, Any]) -> str:
+    content = message.get("content")
+    if isinstance(content, str):
+        return content
+    if isinstance(content, list):
+        parts = [p_block_text(block) for block in content if isinstance(block, dict)]
+        return "\n".join(part for part in parts if part)
+    return ""
+
+
+@typechecked
+def render_transcript(messages: List[Dict[str, Any]]) -> str:
+    """Role-tagged flatten, tail-biased so the end of a long run always survives the cap."""
+    lines: List[str] = []
+    for message in messages:
+        if message.get("hidden"):
+            continue
+        text = p_message_text(message).strip()
+        if text:
+            lines.append(f"{str(message.get('role') or '?').upper()}: {text}")
+    joined = "\n\n".join(lines)
+    if len(joined) > TRANSCRIPT_MAX_CHARS:
+        return "...(earlier turns trimmed)...\n\n" + joined[-TRANSCRIPT_MAX_CHARS:]
+    return joined
+
+
+@typechecked
+def final_answer(messages: List[Dict[str, Any]]) -> str:
+    """Last visible assistant text: the thing a user actually asked the workflow for."""
+    for message in reversed(messages):
+        if message.get("hidden") or message.get("role") != "assistant":
+            continue
+        text = p_message_text(message).strip()
+        if text:
+            return text
+    return ""
+
+
+@typechecked
+def system_notices(messages: List[Dict[str, Any]]) -> List[str]:
+    """Every system-role bubble in the session.
+
+    The backend appends a system message only when something went wrong (a dead
+    provider token, a run error, a blocked tool), and it does NOT fail the run for
+    those, so a workflow whose credential was rejected still comes back "success".
+    Keyed on the typed role, not on the prose, and reported rather than judged: the
+    control plane decides what a notice means for billing and retries.
+    """
+    notices: List[str] = []
+    for message in messages:
+        if message.get("role") != "system" or message.get("hidden"):
+            continue
+        text = p_message_text(message).strip()
+        if text:
+            notices.append(text)
+    return notices
+
+
+@typechecked
+def p_get_json(client: httpx.Client, backend: BackendProcess, path: str) -> Dict[str, Any]:
+    response = client.get(f"{backend.base_url}{path}", headers=backend.headers())
+    response.raise_for_status()
+    payload = response.json()
+    return payload if isinstance(payload, dict) else {}
+
+
+@typechecked
+def p_started_run_id(client: httpx.Client, backend: BackendProcess, workflow_id: str) -> Optional[str]:
+    """The newest run on record, or None. Safe to adopt: the runs file ships empty in every
+    container, so anything in this list was started by the POST we just made."""
+    try:
+        body = p_get_json(client, backend, f"/api/workflows/{workflow_id}/runs?limit=1")
+    except httpx.HTTPError:
+        return None
+    for record in body.get("runs") or []:
+        if isinstance(record, dict) and record.get("id"):
+            return str(record["id"])
+    return None
+
+
+@typechecked
+def trigger_run(client: httpx.Client, backend: BackendProcess, workflow_id: str, deadline: float) -> str:
+    """Start the run, waiting out a backend too busy to answer instead of failing the job.
+
+    A POST whose reply never arrived may still have started the run, so a retry looks for that
+    run before firing again. Posting blind would either execute the workflow twice or come back
+    "Previous run still active", and both are worse than waiting.
+    """
+    while True:
+        try:
+            response = client.post(
+                f"{backend.base_url}/api/workflows/{workflow_id}/run",
+                headers=backend.headers(),
+                json={},
+            )
+            response.raise_for_status()
+            body = response.json()
+            break
+        except httpx.HTTPError as exc:
+            if not backend.is_alive():
+                raise WorkflowRunFailed(f"backend died before the run could start: {exc}") from exc
+            adopted = p_started_run_id(client, backend, workflow_id)
+            if adopted:
+                logger.warning("trigger reply never arrived (%s); adopting the run it started", exc)
+                return adopted
+            if time.monotonic() >= deadline:
+                raise WorkflowRunFailed(f"backend never accepted the run trigger: {exc}") from exc
+            logger.warning("trigger did not answer (%s); backend is busy, retrying", exc)
+            time.sleep(TRIGGER_RETRY_SECONDS)
+
+    run_id = str(body.get("run_id") or "")
+    if not run_id:
+        raise WorkflowRunFailed(
+            f"backend accepted the trigger but never created a run for workflow {workflow_id}"
+        )
+    if body.get("status") == "failure":
+        raise WorkflowRunFailed(str(body.get("error") or "run failed immediately"))
+    return run_id
+
+
+@typechecked
+def p_find_run(client: httpx.Client, backend: BackendProcess, workflow_id: str, run_id: str) -> Dict[str, Any]:
+    body = p_get_json(client, backend, f"/api/workflows/{workflow_id}/runs?limit=50")
+    for record in body.get("runs") or []:
+        if isinstance(record, dict) and record.get("id") == run_id:
+            return record
+    return {}
+
+
+@typechecked
+def p_stop_run(client: httpx.Client, backend: BackendProcess, run_id: str) -> None:
+    try:
+        client.post(f"{backend.base_url}/api/workflows/runs/{run_id}/stop", headers=backend.headers())
+    except httpx.HTTPError:
+        pass
+
+
+@typechecked
+def p_collect_session(client: httpx.Client, backend: BackendProcess, session_id: str) -> List[Dict[str, Any]]:
+    try:
+        body = p_get_json(client, backend, f"/api/agents/sessions/{session_id}")
+    except httpx.HTTPError:
+        return []
+    messages = body.get("messages")
+    return [m for m in messages if isinstance(m, dict)] if isinstance(messages, list) else []
+
+
+@typechecked
+def execute_workflow(
+    backend: BackendProcess,
+    workflow_id: str,
+    deadline: float,
+    on_progress: Optional[Callable[[RunProgress], None]] = None,
+) -> RunOutcome:
+    """Fire the workflow, poll it to a terminal state, and pull the transcript back.
+
+    Blowing the deadline stops the run and reports `timed_out`; the caller still gets
+    whatever the agent produced before the wall came down.
+    """
+    with httpx.Client(timeout=REQUEST_TIMEOUT_SECONDS) as client:
+        run_id = trigger_run(client, backend, workflow_id, deadline)
+        record: Dict[str, Any] = {}
+        timed_out = False
+
+        while True:
+            try:
+                record = p_find_run(client, backend, workflow_id, run_id) or record
+            except httpx.HTTPError as exc:
+                # A poll that goes unanswered says the backend is busy, and the run it is busy
+                # with is this one. Crashing here used to throw away a run that then finished fine.
+                logger.warning("poll for run %s went unanswered (%s); still waiting", run_id, exc)
+            status = str(record.get("status") or "running")
+            if on_progress is not None:
+                on_progress(RunProgress(
+                    run_id=run_id,
+                    status=status,
+                    active_step_idx=record.get("active_step_idx"),
+                    last_tool_label=record.get("last_tool_label"),
+                ))
+            if status in TERMINAL_STATUSES:
+                break
+            if not backend.is_alive():
+                raise WorkflowRunFailed("backend died while the workflow was running")
+            if time.monotonic() >= deadline:
+                timed_out = True
+                p_stop_run(client, backend, run_id)
+                record = p_find_run(client, backend, workflow_id, run_id) or record
+                break
+            time.sleep(POLL_INTERVAL_SECONDS)
+
+        session_id = record.get("session_id")
+        messages = p_collect_session(client, backend, str(session_id)) if session_id else []
+        return RunOutcome(
+            run_id=run_id,
+            status="timed_out" if timed_out else str(record.get("status") or "failure"),
+            error=("wall-clock cap reached before the workflow finished" if timed_out else record.get("error")),
+            cost_usd=float(record.get("cost_usd") or 0.0),
+            session_id=str(session_id) if session_id else None,
+            transcript=render_transcript(messages),
+            answer=final_answer(messages),
+            system_notices=system_notices(messages),
+        )
diff --git a/openswarm-runner/tests/test_deliverables.py b/openswarm-runner/tests/test_deliverables.py
new file mode 100644
index 00000000..becaf220
--- /dev/null
+++ b/openswarm-runner/tests/test_deliverables.py
@@ -0,0 +1,174 @@
+"""What the run made, what comes home, and what is refused out loud instead of silently.
+
+The caps are the point. A truncated file is worse than a refused one, and a file that
+vanishes with no sentence attached is the failure the whole list exists to prevent.
+"""
+
+import os
+
+import pytest
+
+from runner.results.deliverables import (
+    MAX_FILE_BYTES,
+    MAX_FILES,
+    MAX_TOTAL_BYTES,
+    collect,
+    human_bytes,
+)
+from runner.results.report import deliver_files
+from runner.run_spec import CallbackTarget
+
+
+def write(root, relative: str, payload: bytes) -> str:
+    path = os.path.join(str(root), relative)
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    with open(path, "wb") as handle:
+        handle.write(payload)
+    return path
+
+
+def test_a_missing_workspace_is_an_empty_harvest_not_a_crash(tmp_path) -> None:
+    assert collect(str(tmp_path / "never-made")).files == []
+
+
+def test_ordinary_files_are_collected_with_their_digest(tmp_path) -> None:
+    write(tmp_path, "report.md", b"# Digest\n")
+    write(tmp_path, "data/rows.csv", b"a,b\n1,2\n")
+
+    # Walk order, and it is fixed: this directory's own files first, then subdirectories in name
+    # order, so a run's file list does not shuffle between two identical runs.
+    harvest = collect(str(tmp_path))
+    assert [f.path for f in harvest.files] == ["report.md", "data/rows.csv"]
+    assert harvest.files[0].size_bytes == len(b"# Digest\n")
+    # A digest travels with every file, so a corrupted upload is detectable rather than assumed fine.
+    assert len(harvest.files[0].sha256) == 64
+    assert harvest.refused == []
+
+
+def test_machinery_is_not_a_deliverable(tmp_path) -> None:
+    write(tmp_path, "report.md", b"keep me")
+    write(tmp_path, ".git/config", b"[core]")
+    write(tmp_path, "node_modules/left-pad/index.js", b"module.exports=1")
+    write(tmp_path, "__pycache__/x.pyc", b"\x00")
+    write(tmp_path, ".claude/worktrees/probe/README", b"scratch")
+
+    assert [f.path for f in collect(str(tmp_path)).files] == ["report.md"]
+
+
+def test_an_empty_file_is_neither_delivered_nor_complained_about(tmp_path) -> None:
+    write(tmp_path, "touched.txt", b"")
+    harvest = collect(str(tmp_path))
+    assert harvest.files == []
+    assert harvest.refused == []
+
+
+def test_a_file_over_the_cap_is_refused_whole_and_says_why(tmp_path) -> None:
+    write(tmp_path, "render.mp4", b"x" * (MAX_FILE_BYTES + 1))
+    write(tmp_path, "notes.md", b"still fine")
+
+    harvest = collect(str(tmp_path))
+    assert [f.path for f in harvest.files] == ["notes.md"]
+    assert len(harvest.refused) == 1
+    assert harvest.refused[0].path == "render.mp4"
+    assert "cannot exceed" in harvest.refused[0].reason
+    # Never a fragment: an over-sized file is absent, not shortened.
+    assert all(f.path != "render.mp4" for f in harvest.files)
+
+
+def test_the_run_total_stops_collecting_but_keeps_what_already_fit(tmp_path) -> None:
+    chunk = b"x" * MAX_FILE_BYTES
+    for index in range(MAX_TOTAL_BYTES // MAX_FILE_BYTES + 1):
+        write(tmp_path, f"blob-{index}.bin", chunk)
+
+    harvest = collect(str(tmp_path))
+    assert harvest.total_bytes() <= MAX_TOTAL_BYTES
+    assert len(harvest.files) >= 1
+    assert harvest.refused, "the file that blew the budget must be named, not dropped"
+    assert "limit is" in harvest.refused[0].reason
+
+
+def test_too_many_files_refuses_the_extras_by_name(tmp_path) -> None:
+    for index in range(MAX_FILES + 3):
+        write(tmp_path, f"note-{index:03d}.txt", b"hi")
+
+    harvest = collect(str(tmp_path))
+    assert len(harvest.files) == MAX_FILES
+    assert len(harvest.refused) == 3
+    assert all("maximum of" in item.reason for item in harvest.refused)
+
+
+def test_a_symlink_out_of_the_workspace_is_never_followed(tmp_path) -> None:
+    secret = tmp_path / "outside" / "id_rsa"
+    os.makedirs(secret.parent, exist_ok=True)
+    secret.write_text("PRIVATE KEY")
+    workspace = tmp_path / "ws"
+    os.makedirs(workspace, exist_ok=True)
+    os.symlink(str(secret), str(workspace / "borrowed.pem"))
+
+    assert collect(str(workspace)).files == []
+
+
+def test_with_nowhere_to_send_files_the_run_says_so_per_file(tmp_path) -> None:
+    write(tmp_path, "report.md", b"the answer")
+    reported = deliver_files(None, str(tmp_path), collect(str(tmp_path)))
+
+    assert len(reported) == 1
+    assert reported[0].delivered is False
+    assert "nowhere to send files" in (reported[0].reason or "")
+
+
+def test_a_control_plane_with_no_file_route_is_reported_not_guessed(tmp_path) -> None:
+    write(tmp_path, "report.md", b"the answer")
+    callback = CallbackTarget(url="https://cloud.test/report", token="two-party")
+    assert callback.artifacts_url is None
+
+    reported = deliver_files(callback, str(tmp_path), collect(str(tmp_path)))
+    assert reported[0].delivered is False
+
+
+def test_refusals_reach_the_report_even_when_nothing_was_delivered(tmp_path) -> None:
+    write(tmp_path, "render.mp4", b"x" * (MAX_FILE_BYTES + 1))
+    reported = deliver_files(None, str(tmp_path), collect(str(tmp_path)))
+
+    assert len(reported) == 1
+    assert reported[0].path == "render.mp4"
+    assert reported[0].delivered is False
+    assert "cannot exceed" in (reported[0].reason or "")
+
+
+@pytest.mark.parametrize(
+    "count,expected",
+    [(512, "512 B"), (2048, "2 KB"), (5 * 1024 * 1024, "5.0 MB"), (3 * 1024**3, "3.0 GB")],
+)
+def test_sizes_are_written_the_way_a_person_reads_them(count: int, expected: str) -> None:
+    assert human_bytes(count) == expected
+
+
+def test_a_failed_run_still_hands_over_what_it_managed_to_make(tmp_path, monkeypatch) -> None:
+    """A workflow that dies on step 3 may have written a perfectly good report on step 1."""
+    from runner import main
+    from runner.run_spec import RunSpec
+
+    write(tmp_path, "partial-report.md", b"# What I got through\n")
+    spec = RunSpec.model_validate({
+        "run_id": "cr-fail",
+        "workflow": {"id": "wf-1", "steps": [{"id": "s1", "text": "go"}]},
+        "credentials": [{"provider": "anthropic", "auth_type": "api_key", "api_key": "sk-test"}],
+    })
+
+    sent: list = []
+    monkeypatch.setattr(main, "send_report", lambda callback, report: sent.append(report) or True)
+    code = main.p_fail(spec, "failure", "step 3 blew up", main.EXIT_WORKFLOW_FAILED, str(tmp_path))
+
+    assert code == main.EXIT_WORKFLOW_FAILED
+    assert [f.path for f in sent[0].files] == ["partial-report.md"]
+
+
+def test_a_failure_with_no_workspace_reports_no_files_rather_than_guessing(monkeypatch) -> None:
+    from runner import main
+
+    sent: list = []
+    monkeypatch.setattr(main, "send_report", lambda callback, report: sent.append(report) or True)
+    main.p_fail(None, "failure", "bad spec", main.EXIT_BAD_SPEC)
+
+    assert sent[0].files == []
diff --git a/openswarm-runner/tests/test_renderer_process.py b/openswarm-runner/tests/test_renderer_process.py
new file mode 100644
index 00000000..f3eb79e2
--- /dev/null
+++ b/openswarm-runner/tests/test_renderer_process.py
@@ -0,0 +1,99 @@
+"""The renderer half: a run that asked for a browser must never quietly proceed without one.
+
+The Electron boot itself needs a Linux container and a real display, so what is pinned here is
+the contract around it: the deep link the window opens on, the bundle check, and the three ways
+"no window" is allowed to end (loudly, every time).
+"""
+
+import subprocess
+
+import pytest
+
+from runner.boot import renderer_process
+from runner.boot.renderer_process import (
+    CONTAINER_CHROMIUM_FLAGS,
+    RendererUnavailable,
+    SANDBOX_FLAGS,
+    await_registration,
+    dashboard_url,
+    serve_frontend,
+    start_electron,
+)
+from runner.run_spec import CLOUD_RUN_DASHBOARD_ID
+
+
+@pytest.fixture
+def dead_electron():
+    """A real Popen that has already exited; await_registration is typechecked on Popen."""
+    process = subprocess.Popen(["/bin/sh", "-c", "exit 9"])
+    process.wait()
+    return process
+
+
+@pytest.fixture
+def live_electron():
+    """A real Popen that stays up long enough for a poll loop to run against it."""
+    process = subprocess.Popen(["/bin/sh", "-c", "sleep 30"])
+    yield process
+    process.kill()
+    process.wait()
+
+
+def test_the_window_opens_on_the_run_dashboard_not_the_picker() -> None:
+    # HashRouter, so the route has to be a fragment or the static server 404s on it.
+    assert dashboard_url(4173, CLOUD_RUN_DASHBOARD_ID) == (
+        "http://127.0.0.1:4173/index.html#/dashboard/cloud-run"
+    )
+
+
+def test_a_missing_bundle_says_so_instead_of_serving_an_empty_dir(tmp_path) -> None:
+    with pytest.raises(RendererUnavailable, match="no frontend bundle"):
+        serve_frontend(str(tmp_path))
+
+
+def test_a_missing_electron_binary_fails_the_run_rather_than_the_workflow(tmp_path, monkeypatch) -> None:
+    monkeypatch.setenv("ELECTRON_BIN", str(tmp_path / "nope"))
+    with pytest.raises(RendererUnavailable, match="built without a renderer"):
+        start_electron(str(tmp_path), 8324, "http://127.0.0.1:4173/index.html")
+
+
+def test_chromium_is_launched_unsandboxed_on_purpose_and_out_of_shared_memory() -> None:
+    # Dropping Chromium's own sandbox is a real tradeoff (the Firecracker VM is the wall that's
+    # left), so it lives in a named constant a reviewer trips over, not inside a launch string.
+    assert SANDBOX_FLAGS == ["--no-sandbox"]
+    assert "--disable-dev-shm-usage" in CONTAINER_CHROMIUM_FLAGS
+
+
+def test_a_dead_electron_is_reported_as_dead_not_waited_out(monkeypatch, dead_electron) -> None:
+    monkeypatch.setattr(renderer_process, "RENDERER_TIMEOUT_SECONDS", 30.0)
+    with pytest.raises(RendererUnavailable, match="exited with code 9"):
+        await_registration("http://127.0.0.1:1", {}, dead_electron, deadline=1e9)
+
+
+def test_a_window_that_never_registers_times_out_loudly(monkeypatch, live_electron) -> None:
+    monkeypatch.setattr(renderer_process, "RENDERER_TIMEOUT_SECONDS", 0.5)
+    with pytest.raises(RendererUnavailable, match="no renderer ever registered"):
+        await_registration("http://127.0.0.1:1", {}, live_electron, deadline=1e9)
+
+
+def test_registration_is_believed_only_when_the_backend_says_a_socket_is_attached(monkeypatch, live_electron) -> None:
+    replies = [{"attached": False, "ever_attached": False, "connections": 0},
+               {"attached": True, "ever_attached": True, "connections": 1}]
+
+    class p_Response:
+        def json(self):
+            return replies.pop(0)
+
+    class p_Client:
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *exc):
+            return False
+
+        def get(self, url, headers=None):
+            return p_Response()
+
+    monkeypatch.setattr(renderer_process.httpx, "Client", lambda **kw: p_Client())
+    await_registration("http://127.0.0.1:1", {}, live_electron, deadline=1e9)
+    assert replies == []
diff --git a/openswarm-runner/tests/test_router_credentials.py b/openswarm-runner/tests/test_router_credentials.py
new file mode 100644
index 00000000..2dcfb232
--- /dev/null
+++ b/openswarm-runner/tests/test_router_credentials.py
@@ -0,0 +1,111 @@
+"""The runner must be structurally unable to rotate a user's OAuth grant.
+
+Every test here exists to make one class of bug unwritable: a refresh token reaching
+9Router's db.json. Delete either wall in runner/seed/router_credentials.py and these go red.
+"""
+
+import json
+import os
+import stat
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+from runner.run_spec import InvalidRunSpec, ProviderCredential, RunSpec, load_run_spec
+from runner.seed.router_credentials import (
+    RefreshTokenLeak,
+    assert_no_refresh_token,
+    router_db_payload,
+    write_router_db,
+)
+
+NOW = datetime(2026, 7, 31, 12, 0, 0, tzinfo=timezone.utc)
+ACCESS_TOKEN = "at-test-value-not-a-real-token"
+REFRESH_TOKEN = "rt-test-value-not-a-real-token"
+
+
+def spec_json(credential: dict) -> str:
+    return json.dumps({
+        "run_id": "run-1",
+        "workflow": {"id": "wf-1", "title": "Test", "steps": [{"text": "say hi"}]},
+        "credentials": [credential],
+    })
+
+
+def oauth_credential() -> ProviderCredential:
+    return ProviderCredential(
+        provider="claude",
+        auth_type="oauth",
+        access_token=ACCESS_TOKEN,
+        expires_at=NOW + timedelta(hours=8),
+    )
+
+
+@pytest.mark.parametrize("key", ["refreshToken", "refresh_token", "Refresh-Token", "oauthRefreshToken"])
+def test_a_spec_carrying_a_refresh_token_never_parses(key: str, tmp_path, monkeypatch) -> None:
+    payload = {
+        "provider": "claude",
+        "auth_type": "oauth",
+        "access_token": ACCESS_TOKEN,
+        "expires_at": (NOW + timedelta(hours=8)).isoformat(),
+        key: REFRESH_TOKEN,
+    }
+    monkeypatch.setenv("OPENSWARM_RUN_SPEC", spec_json(payload))
+    with pytest.raises(InvalidRunSpec) as caught:
+        load_run_spec()
+    assert key in str(caught.value)
+    assert not list(tmp_path.iterdir()), "a rejected spec must not leave anything on disk"
+
+
+@pytest.mark.parametrize("key", ["refreshToken", "refresh_token", "Refresh-Token", "oauthRefreshToken"])
+def test_the_writer_guard_rejects_a_poisoned_payload(key: str) -> None:
+    payload = {"providerConnections": [{"provider": "claude", key: REFRESH_TOKEN}]}
+    with pytest.raises(RefreshTokenLeak):
+        assert_no_refresh_token(payload)
+
+
+def test_the_guard_passes_a_clean_payload() -> None:
+    assert_no_refresh_token(router_db_payload([oauth_credential()], NOW))
+
+
+def test_written_db_carries_the_access_token_and_no_refresh_token(tmp_path) -> None:
+    path = write_router_db(str(tmp_path / "9router"), [oauth_credential()], NOW)
+    raw = open(path, "r", encoding="utf-8").read()
+
+    # Without this the "no refresh token" assertion below would also pass on an empty file.
+    assert ACCESS_TOKEN in raw
+    connection = json.loads(raw)["providerConnections"][0]
+    assert connection["provider"] == "claude"
+    assert connection["isActive"] is True
+    assert connection["expiresAt"] == "2026-07-31T20:00:00.000Z"
+
+    assert "refresh" not in raw.lower()
+    assert not any("refresh" in key.lower() for key in connection)
+
+
+def test_the_db_and_its_directory_are_owner_only(tmp_path) -> None:
+    path = write_router_db(str(tmp_path / "9router"), [oauth_credential()], NOW)
+    assert stat.S_IMODE(os.stat(path).st_mode) == 0o600
+    assert stat.S_IMODE(os.stat(os.path.dirname(path)).st_mode) == 0o700
+
+
+def test_an_api_key_credential_never_reaches_the_router_db(tmp_path) -> None:
+    credential = ProviderCredential(provider="anthropic", auth_type="api_key", api_key="sk-test-not-real")
+    path = write_router_db(str(tmp_path / "9router"), [credential], NOW)
+    assert json.loads(open(path, encoding="utf-8").read())["providerConnections"] == []
+
+
+def test_an_oauth_credential_without_an_access_token_is_rejected() -> None:
+    with pytest.raises(ValueError, match="no access_token"):
+        ProviderCredential(provider="claude", auth_type="oauth", expires_at=NOW)
+
+
+def test_an_expired_access_token_is_fatal_not_refreshable() -> None:
+    spec = RunSpec.model_validate_json(spec_json({
+        "provider": "claude",
+        "auth_type": "oauth",
+        "access_token": ACCESS_TOKEN,
+        "expires_at": (NOW + timedelta(seconds=30)).isoformat(),
+    }))
+    assert [credential.provider for credential in spec.expired_credentials(NOW)] == ["claude"]
+    assert spec.expired_credentials(NOW - timedelta(hours=1)) == []
diff --git a/openswarm-runner/tests/test_run_spec.py b/openswarm-runner/tests/test_run_spec.py
new file mode 100644
index 00000000..1733f5a5
--- /dev/null
+++ b/openswarm-runner/tests/test_run_spec.py
@@ -0,0 +1,94 @@
+"""The run spec is the only thing the control plane can say to this container."""
+
+import json
+import os
+import stat
+
+import pytest
+
+from runner.run_spec import InvalidRunSpec, RunSpec, load_run_spec
+from runner.seed.data_root import seed_data_root, settings_for_run
+
+VALID_CREDENTIAL = {"provider": "anthropic", "auth_type": "api_key", "api_key": "sk-test-not-real"}
+
+
+def spec_body(**overrides) -> dict:
+    body = {
+        "run_id": "run-1",
+        "workflow": {
+            "id": "wf-1",
+            "title": "Daily digest",
+            "model": "opus-5",
+            "steps": [{"text": "summarize the inbox"}],
+            "schedule": {"enabled": True, "repeat_unit": "day", "hour": 9},
+        },
+        "credentials": [VALID_CREDENTIAL],
+    }
+    body.update(overrides)
+    return body
+
+
+def test_a_missing_spec_names_both_env_vars(monkeypatch) -> None:
+    monkeypatch.delenv("OPENSWARM_RUN_SPEC", raising=False)
+    monkeypatch.delenv("OPENSWARM_RUN_SPEC_FILE", raising=False)
+    with pytest.raises(InvalidRunSpec, match="OPENSWARM_RUN_SPEC_FILE"):
+        load_run_spec()
+
+
+def test_a_spec_file_is_accepted(tmp_path, monkeypatch) -> None:
+    path = tmp_path / "spec.json"
+    path.write_text(json.dumps(spec_body()), encoding="utf-8")
+    monkeypatch.delenv("OPENSWARM_RUN_SPEC", raising=False)
+    monkeypatch.setenv("OPENSWARM_RUN_SPEC_FILE", str(path))
+    assert load_run_spec().workflow.title == "Daily digest"
+
+
+def test_unknown_top_level_fields_are_rejected(monkeypatch) -> None:
+    monkeypatch.setenv("OPENSWARM_RUN_SPEC", json.dumps(spec_body(surprise="hello")))
+    with pytest.raises(InvalidRunSpec, match="surprise"):
+        load_run_spec()
+
+
+def test_a_run_needs_at_least_one_credential(monkeypatch) -> None:
+    monkeypatch.setenv("OPENSWARM_RUN_SPEC", json.dumps(spec_body(credentials=[])))
+    with pytest.raises(InvalidRunSpec):
+        load_run_spec()
+
+
+def test_the_container_never_inherits_the_schedule() -> None:
+    spec = RunSpec.model_validate(spec_body())
+    assert spec.workflow.schedule.enabled is True
+    assert spec.workflow_for_disk().schedule.enabled is False
+
+
+def test_seeding_writes_the_workflow_and_owner_only_settings(tmp_path) -> None:
+    spec = RunSpec.model_validate(spec_body())
+    workspace = str(tmp_path / "workspace")
+    seed_data_root(str(tmp_path / "data"), workspace, spec)
+
+    workflow_path = tmp_path / "data" / "workflows" / "wf-1.json"
+    settings_path = tmp_path / "data" / "settings" / "settings.json"
+    assert json.loads(workflow_path.read_text())["schedule"]["enabled"] is False
+    assert stat.S_IMODE(os.stat(settings_path).st_mode) == 0o600
+
+    settings = json.loads(settings_path.read_text())
+    assert settings["anthropic_api_key"] == "sk-test-not-real"
+    assert settings["default_model"] == "opus-5"
+    assert settings["analytics_opt_in"] is False
+    # The agent's folder is the deliverable folder, and it exists before the backend boots.
+    assert settings["default_folder"] == workspace
+    assert os.path.isdir(workspace)
+
+
+def test_the_agent_is_told_its_files_only_survive_from_the_workspace(tmp_path) -> None:
+    spec = RunSpec.model_validate(spec_body())
+    prompt = settings_for_run(spec, str(tmp_path)).default_system_prompt or ""
+    assert "delivered back to the user" in prompt
+
+
+def test_an_unmappable_api_key_provider_fails_loudly(tmp_path) -> None:
+    spec = RunSpec.model_validate(spec_body(
+        credentials=[{"provider": "wat", "auth_type": "api_key", "api_key": "x"}]
+    ))
+    with pytest.raises(ValueError, match="no settings field"):
+        settings_for_run(spec, str(tmp_path))
diff --git a/openswarm-runner/tests/test_seed_skills.py b/openswarm-runner/tests/test_seed_skills.py
new file mode 100644
index 00000000..a046ca34
--- /dev/null
+++ b/openswarm-runner/tests/test_seed_skills.py
@@ -0,0 +1,83 @@
+"""The user's know-how travelling up, and their app credentials not travelling at all."""
+
+import os
+
+import pytest
+from pydantic import ValidationError
+
+from runner.run_spec import McpServerNote, RunSpec, SkillPayload
+from runner.seed.data_root import settings_for_run, unavailable_apps_note
+from runner.seed.skills import skills_dir, write_skills
+
+COFFEE = {
+    "id": "coffee-ratio",
+    "files": [
+        {"path": "SKILL.md", "text": "---\nname: coffee-ratio\ndescription: house ratio\n---\n\n1:16.5\n"},
+        {"path": "scripts/brew.py", "text": "print('brew')\n"},
+    ],
+}
+
+
+def p_spec(**overrides) -> RunSpec:
+    body = {
+        "run_id": "cr-1",
+        "workflow": {"id": "wf-1", "title": "Test", "steps": [{"id": "s1", "text": "go"}]},
+        "credentials": [{"provider": "anthropic", "auth_type": "api_key", "api_key": "sk-test"}],
+    }
+    body.update(overrides)
+    return RunSpec.model_validate(body)
+
+
+def test_a_skill_folder_lands_where_the_backend_looks_for_it(tmp_path) -> None:
+    written = write_skills(str(tmp_path), [SkillPayload.model_validate(COFFEE)])
+
+    assert written == 1
+    root = skills_dir(str(tmp_path))
+    assert root.endswith(os.path.join(".claude", "skills"))
+    with open(os.path.join(root, "coffee-ratio", "SKILL.md"), encoding="utf-8") as handle:
+        assert "house ratio" in handle.read()
+    assert os.path.isfile(os.path.join(root, "coffee-ratio", "scripts", "brew.py"))
+
+
+def test_no_skills_is_an_empty_directory_not_a_failure(tmp_path) -> None:
+    assert write_skills(str(tmp_path), []) == 0
+    assert os.path.isdir(skills_dir(str(tmp_path)))
+
+
+def test_a_skill_with_no_skill_md_is_refused_before_a_machine_boots() -> None:
+    with pytest.raises(ValidationError, match="no SKILL.md"):
+        SkillPayload.model_validate({"id": "x", "files": [{"path": "README.md", "text": "hi"}]})
+
+
+@pytest.mark.parametrize("bad", ["../escape.md", "/etc/passwd", "a/../../b.md", "a\\b.md", ""])
+def test_a_skill_path_that_could_climb_out_is_refused(bad: str) -> None:
+    with pytest.raises(ValidationError):
+        SkillPayload.model_validate({"id": "x", "files": [{"path": bad, "text": "hi"}]})
+
+
+@pytest.mark.parametrize("bad", ["../evil", "a/b", ".hidden", "has space", ""])
+def test_a_skill_id_that_is_not_a_plain_folder_name_is_refused(bad: str) -> None:
+    with pytest.raises(ValidationError):
+        SkillPayload.model_validate({"id": bad, "files": [{"path": "SKILL.md", "text": "hi"}]})
+
+
+def test_the_spec_cannot_carry_an_mcp_secret_at_all() -> None:
+    # extra="forbid" is the wall: there is no field for a token, so a payload with one dies here
+    # rather than landing in a container that runs the user's own prose with Bash.
+    with pytest.raises(ValidationError):
+        McpServerNote.model_validate({"name": "Notion", "access_token": "secret_abc"})
+    with pytest.raises(ValidationError):
+        McpServerNote.model_validate({"name": "Slack", "env": {"SLACK_MCP_XOXC_TOKEN": "xoxc-1"}})
+
+
+def test_unreachable_apps_are_named_in_the_prompt_so_silence_is_not_mistaken_for_absence(tmp_path) -> None:
+    spec = p_spec(unavailable_mcp_servers=[{"name": "Notion"}, {"name": "Google Workspace"}])
+    note = unavailable_apps_note(spec)
+
+    assert "Notion" in note and "Google Workspace" in note
+    assert "cannot be done from a cloud run" in note
+    assert note in (settings_for_run(spec, str(tmp_path)).default_system_prompt or "")
+
+
+def test_with_no_connected_apps_nothing_is_added_to_the_prompt(tmp_path) -> None:
+    assert unavailable_apps_note(p_spec()) == ""
diff --git a/openswarm-runner/tests/test_workflow_run.py b/openswarm-runner/tests/test_workflow_run.py
new file mode 100644
index 00000000..ce1f00eb
--- /dev/null
+++ b/openswarm-runner/tests/test_workflow_run.py
@@ -0,0 +1,123 @@
+"""Reading a finished session correctly, including the failures the backend calls success."""
+
+import subprocess
+import sys
+import time
+from typing import Any, Dict, Iterator
+
+import httpx
+import pytest
+
+from runner import workflow_run
+from runner.boot.backend_process import BackendProcess
+from runner.workflow_run import (
+    WorkflowRunFailed,
+    execute_workflow,
+    final_answer,
+    render_transcript,
+    system_notices,
+    trigger_run,
+)
+
+# Shape taken verbatim from a real container run whose provider token was rejected.
+REJECTED_TOKEN_SESSION = [
+    {"role": "user", "content": "Reply with exactly the word PONG and nothing else."},
+    {"role": "system", "content": "Provider authentication expired. Open Settings, Models and reconnect, then send your message again."},
+]
+
+ANSWERED_SESSION = [
+    {"role": "user", "content": "ping"},
+    {"role": "assistant", "content": [{"type": "tool_use", "name": "Bash", "input": {"command": "echo hi"}}]},
+    {"role": "assistant", "content": [{"type": "text", "text": "PONG"}]},
+    {"role": "assistant", "content": [{"type": "text", "text": "draft"}], "hidden": True},
+]
+
+
+def test_a_rejected_credential_surfaces_as_a_system_notice() -> None:
+    assert system_notices(REJECTED_TOKEN_SESSION) == [REJECTED_TOKEN_SESSION[1]["content"]]
+    assert final_answer(REJECTED_TOKEN_SESSION) == ""
+
+
+def test_a_healthy_run_raises_no_notices() -> None:
+    assert system_notices(ANSWERED_SESSION) == []
+
+
+def test_the_answer_is_the_last_visible_assistant_text() -> None:
+    assert final_answer(ANSWERED_SESSION) == "PONG"
+
+
+def test_the_transcript_keeps_tool_calls_and_drops_hidden_turns() -> None:
+    transcript = render_transcript(ANSWERED_SESSION)
+    assert "[tool Bash]" in transcript
+    assert "PONG" in transcript
+    assert "draft" not in transcript
+
+
+# A backend busy enough to miss a reply is the normal case, not a broken one: a single MCP
+# registry call has been measured holding its event loop past a minute. These pin that a late
+# reply never costs the user the run.
+
+RUN_ROW = {"id": "run_1", "status": "success", "session_id": "sess_1", "cost_usd": 0.0}
+
+
+@pytest.fixture
+def backend() -> Iterator[BackendProcess]:
+    """A real BackendProcess around a process that just sits there, so is_alive() is honest."""
+    process = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(60)"])
+    try:
+        yield BackendProcess(process=process, base_url="http://backend.test", token="t")
+    finally:
+        process.kill()
+        process.wait(timeout=10)
+
+
+def p_client(stalls: int) -> httpx.Client:
+    """A client whose first `stalls` requests time out, exactly like a starved event loop."""
+    state = {"left": stalls}
+
+    def handle(request: httpx.Request) -> httpx.Response:
+        if state["left"] > 0:
+            state["left"] -= 1
+            raise httpx.ReadTimeout("timed out", request=request)
+        if request.url.path.endswith("/run"):
+            return httpx.Response(200, json={"run_id": "run_1", "status": "running"})
+        if request.url.path.endswith("/runs"):
+            return httpx.Response(200, json={"runs": [RUN_ROW]})
+        return httpx.Response(404, json={})
+
+    return httpx.Client(transport=httpx.MockTransport(handle), timeout=1.0)
+
+
+def test_a_stalled_trigger_adopts_the_run_it_already_started(backend: BackendProcess) -> None:
+    # One unanswered POST, then the run it started is visible. Posting again would either run the
+    # workflow twice or come back "Previous run still active".
+    assert trigger_run(p_client(stalls=1), backend, "wf_1", time.monotonic() + 5.0) == "run_1"
+
+
+def test_a_dead_backend_fails_the_trigger_instead_of_waiting(backend: BackendProcess) -> None:
+    backend.process.kill()
+    backend.process.wait(timeout=10)
+    with pytest.raises(WorkflowRunFailed, match="backend died"):
+        trigger_run(p_client(stalls=99), backend, "wf_1", time.monotonic() + 5.0)
+
+
+def test_a_stalled_poll_does_not_throw_away_a_run_that_finishes(
+    backend: BackendProcess, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    polls = {"left": 2}
+
+    def p_find(*_args: Any, **_kwargs: Any) -> Dict[str, Any]:
+        if polls["left"] > 0:
+            polls["left"] -= 1
+            raise httpx.ReadTimeout("timed out")
+        return RUN_ROW
+
+    monkeypatch.setattr(workflow_run, "trigger_run", lambda *_a, **_k: "run_1")
+    monkeypatch.setattr(workflow_run, "p_find_run", p_find)
+    monkeypatch.setattr(workflow_run, "p_collect_session", lambda *_a, **_k: ANSWERED_SESSION)
+    monkeypatch.setattr(workflow_run, "POLL_INTERVAL_SECONDS", 0.01)
+
+    outcome = execute_workflow(backend, "wf_1", time.monotonic() + 10.0)
+    assert outcome.status == "success"
+    assert outcome.answer == "PONG"
+    assert polls["left"] == 0
diff --git a/scripts/ci/verify-all.js b/scripts/ci/verify-all.js
index 20a6ef6b..28504e12 100644
--- a/scripts/ci/verify-all.js
+++ b/scripts/ci/verify-all.js
@@ -36,6 +36,7 @@ function main() {
     ['deps fully pinned (reproducible backend builds)', 'verify-deps-pinned.js', []],
     ['no build-host paths leaked into the artifact', 'verify-host-leakage.js', appArg],
     ['locale paks shipped (empty --lang -> Blink null-deref crash)', 'verify-locale-paks.js', appArg],
+    ['native modules match the target arch (no x86_64 .node in an arm64 app)', 'verify-native-arch.js', appArg],
     ['9router deps shipped (else subscription service hangs)', 'verify-router-deps.js', appArg],
     ['bundled python runs (--version + import smoke)', 'verify-python-health.js', appArg],
     ['MCP bundles answer initialize over stdio', 'verify-mcp-bundles.js', appArg],
diff --git a/scripts/ci/verify-native-arch.js b/scripts/ci/verify-native-arch.js
new file mode 100644
index 00000000..2828c5dd
--- /dev/null
+++ b/scripts/ci/verify-native-arch.js
@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+// Guards against shipping a native module built for the WRONG architecture.
+// prebuildify packages (uiohook-napi, the dictation hotkey tap) ship one .node per platform+arch
+// they support: seven dirs, of which exactly one is ours. Six are dead weight, and on macOS an
+// x86_64 Mach-O inside an arm64 bundle is what makes the OS raise its Intel-deprecation dialog at
+// the user. electron/build/after-pack.js prunes them; this asserts the prune actually happened,
+// because an afterPack hook that silently no-ops (layout changed, module moved into the asar) would
+// otherwise ship the same bundle it always did with nobody the wiser.
+
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const h = require('./lib/app-harness');
+
+function parseArgs(argv) {
+  const out = { app: null };
+  for (let i = 0; i < argv.length; i++) if (argv[i] === '--app') out.app = argv[++i];
+  return out;
+}
+
+function findNodeFiles(root) {
+  const found = [];
+  (function walk(dir, depth) {
+    if (depth > 14) return;
+    let ents = [];
+    try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of ents) {
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) walk(full, depth + 1);
+      else if (e.isFile() && e.name.endsWith('.node')) found.push(full);
+    }
+  })(root, 0);
+  return found;
+}
+
+// `file` names every slice in a Mach-O, so a fat binary reports both and a wrong-arch one reports
+// only the wrong slice. On Windows/Linux there is no equivalent worth the dependency, so the gate
+// there just asserts no foreign prebuild DIRS survived.
+function machoArches(file) {
+  try {
+    return execFileSync('file', [file], { encoding: 'utf8' }).trim();
+  } catch (err) {
+    return `file failed: ${err && err.message}`;
+  }
+}
+
+function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const exe = h.packagedAppPath(args.app);
+  const root = process.platform === 'darwin' ? exe.slice(0, exe.indexOf('.app') + 4) : path.dirname(exe);
+  const want = process.arch === 'arm64' ? 'arm64' : 'x86_64';
+
+  const nodes = findNodeFiles(root);
+  process.stdout.write(`  ${nodes.length} .node file(s) under ${path.basename(root)}\n`);
+
+  const offenders = [];
+  for (const n of nodes) {
+    // A prebuilds dir for another OS is wrong no matter what `file` says about it.
+    const tuple = path.basename(path.dirname(n));
+    const platformOk = !tuple.includes('-') || tuple.startsWith(process.platform);
+    const desc = process.platform === 'darwin' ? machoArches(n) : '';
+    const archOk = process.platform !== 'darwin' || desc.includes(want);
+    if (!platformOk || !archOk) offenders.push(`${path.relative(root, n)}  [${tuple}]  ${desc.split(':').slice(1).join(':').trim()}`);
+  }
+
+  if (!offenders.length) {
+    process.stdout.write(`PASS  every bundled .node targets ${process.platform}/${want}\n`);
+    process.exit(0);
+  }
+  process.stderr.write(
+    `FAIL  packaged build ships ${offenders.length} native module(s) for the WRONG target:\n` +
+    offenders.map((o) => `      ${o}\n`).join('') +
+    `      An x86_64 .node inside an arm64 bundle makes macOS show its Intel-deprecation\n` +
+    `      dialog, and every foreign prebuild is dead weight the user downloads.\n` +
+    `      Fix: electron/build/after-pack.js pruneForeignPrebuilds() should have deleted these.\n` +
+    `      If they now live inside app.asar rather than app.asar.unpacked, the prune needs to\n` +
+    `      run before the asar is built (beforePack) instead.\n`);
+  process.exit(1);
+}
+
+main();