diff --git a/CHANGELOG.md b/CHANGELOG.md
index fe44e31..2750d55 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,27 @@ This file is updated as part of the change, not reconstructed when a version is
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-09-26
+
+### Added
+
+- **Tab organization**: reorder open document tabs by dragging inside the tab strip, or with `Alt+Left` / `Alt+Right` while a tab has keyboard focus. Middle-click closes a tab, and the strip scrolls the active tab back into view when tabs overflow. Tab order is session chrome - it does not move files or change the Folder.
+- **Link hover source peek**: hovering a document link shows where it resolves (path, heading status, other matching documents) and a short excerpt of the target's Markdown source. The excerpt is shown as source, not as rendered HTML, and uses the document text that hover already reads. Not Preview and not a second renderer.
+
+### Changed
+
+- Tab navigation follows visible tab order: `Ctrl/Cmd+Tab` and `Ctrl/Cmd+Shift+Tab` activate the next or previous tab in the strip and wrap at the ends, instead of walking most-recently-used order. `Ctrl/Cmd+PageDown` / `Ctrl/Cmd+PageUp` keep doing the same and now appear as accelerators in Navigate and in Settings keyboard help.
+- Language defaults to **System**: Fulvid follows the operating system language when it has that language, and English otherwise. A language chosen in Settings -> Language still wins and is kept, and regional system tags (`de-DE`, `pt_BR`) match by primary language. Guide: [docs/I18N.md](docs/I18N.md).
+
+### Fixed
+
+- Saving a document keeps that file's own permissions. A save used to replace them with the process default, so a document kept private (`0600`) came back readable by other accounts on the machine.
+- Document text shown in editor hover tooltips (link labels, headings, paths, candidate matches) stays literal text. It could previously be read as Markdown, so a crafted heading or filename could turn a tooltip into a clickable external link or an image request.
+- A Folder scan stops at a ceiling on total document text as well as on document count and depth, so a very large tree degrades to a partial Folder - still reported as partial - instead of loading document bodies without bound.
+- Typing with Preview open no longer walks the whole Folder scan on every keystroke, which was noticeable in Folders with thousands of documents.
+- A Graph background worker that fails to start is terminated instead of being left running. The layout is still computed in-process in that case, as before.
+- `Ctrl/Cmd+Shift+Tab` and the Tab trap in dialogs register on WebKit builds that report the chord as `ISO_Left_Tab` (Linux).
+
 ## [1.0.0] - 2026-09-19
 
 First stable release of Fulvid.
@@ -190,7 +211,8 @@ First release of Fulvid, a standalone desktop editor for Markdown and MDX.
 - Inert Preview and Export HTML from the same renderer. Export writes a `.html` file and cannot overwrite a Markdown or MDX note.
 - English and Spanish application chrome. Document text, filenames, and link targets are not translated.
 
-[Unreleased]: https://github.com/ManuelGil/fulvid/compare/v1.0.0...HEAD
+[Unreleased]: https://github.com/ManuelGil/fulvid/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/ManuelGil/fulvid/releases/tag/v1.1.0
 [1.0.0]: https://github.com/ManuelGil/fulvid/releases/tag/v1.0.0
 [0.12.0]: https://github.com/ManuelGil/fulvid/releases/tag/v0.12.0
 [0.11.0]: https://github.com/ManuelGil/fulvid/releases/tag/v0.11.0
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 24a5b21..28a60ff 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -20,8 +20,10 @@ Keep pull requests focused.
 - UI selection goes through `selectDocument`. `activateDocument` is session-internal. Surfaces open a document through `openOrActivate`. Do not wire editor buffers to Focus changes.
 - Folder I/O uses `assertWithinWorkspace` (lexical) plus `assertCanonicallyContained` (symlink/realpath). Standalone Open and Save As use host dialogs and grants. No generic absolute-path read/write RPC.
 - Preview and Export HTML share `renderMarkdownPreview`. Do not add a second Markdown renderer.
-- Dispose canvas, workers, and observers with their owner ([docs/ARCHITECTURE.md](docs/ARCHITECTURE.md#resources)).
+- Dispose canvas, workers, and observers with their owner ([docs/ARCHITECTURE.md](docs/ARCHITECTURE.md#resources)). Packaged Linux memory baseline and when to re-measure: [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md#memory-footprint-and-future-considerations).
 - Presentation tokens: [`src/mainview/styles/`](src/mainview/styles/). Chrome icons: [`AppIcon.vue`](src/mainview/shell/AppIcon.vue). Quick Actions rules (groups, overflow tiers, a11y): [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md#quick-actions-toolbar). Do not fork Monaco or edit `node_modules` for icons; widget Codicons are remapped in `monacoLucideIcons.ts`. Launcher icon: [`assets/README.md`](assets/README.md).
+- A bound the reader can see belongs to one owner: the store that clamps a value also exports the range its control offers (`EDITOR_FONT_SIZE_LIMITS`, `layoutStore`'s `*_LIMITS`, `LAYOUT_RESIZE_STEP_PX`). Do not restate a min/max on an input.
+- Name timer delays and size caps where they are enforced (`*_MS`, `MAX_*`) rather than inlining the number at the call. A number a reader cannot explain is the thing the next contributor changes by accident.
 - UI wording: [docs/I18N.md](docs/I18N.md). Settings hints should say what changes, when it applies, and give a concrete example.
 - Releases: [docs/DISTRIBUTION.md](docs/DISTRIBUTION.md). Actions is the main path. The Linux Makefile is a local helper.
 - User-facing changes: add an entry under `Unreleased` in [CHANGELOG.md](CHANGELOG.md) in the same change. When a version is released, move those entries under that version, open a new empty `Unreleased` section, bump `package.json` / `electrobun.config.ts`, and add `docs/releases/vX.Y.Z.md`. Do not reconstruct a version from git history at the last minute, log every commit, or rewrite a published version except to fix a factual error.
@@ -66,7 +68,8 @@ Controlled mitigation matrix (about 55s each, same machine/WebKitGTK 2.52.6/Vite
 | minimal HTTP wait (`/`, `/@vite/client`, `/main.ts`) | readiness gate only | keep small |
 | `forwardConsole: false` | no change in reconnect rate | keep for Cursor-agent console hygiene (Vite auto-enables forwardConsole when an agent is detected) |
 | `__electrobun` stub | not an HMR metric | keep for rare Vite-HTTP preload race |
-| `WEBKIT_DISABLE_COMPOSITING_MODE=1` | separate from HMR; targets `GLXBadWindow` | Linux HMR only |
+| `WEBKIT_DISABLE_COMPOSITING_MODE=1` | helps `views://` / GLXBadWindow; **breaks Vite HMR HTTP** (no `[vite] connected`, white window) | `bun run start` / `bun run dev` and Linux compatibility CI only - **not** `dev:hmr` |
+| `GDK_BACKEND=x11` | avoids Wayland GDK blank paint | Linux local runners (`electrobunDev.ts`, `devHmr.ts`) unless `FULVID_KEEP_GDK_BACKEND=1` |
 
 What Fulvid does:
 
@@ -74,10 +77,10 @@ What Fulvid does:
 - `scripts/devHmr.ts` waits only for `/`, `/@vite/client`, and `/main.ts` before `electrobun dev` (do not expand this list without new measurements).
 - `vite.config.ts` sets `server.forwardConsole: false` so Cursor-agent sessions do not pipe console over the HMR socket (Vite's default is agent-detected `true`, otherwise `false`). This is not a proven reconnect fix.
 - `electrobunClient.ts` installs a minimal `window.__electrobun` bridge if preload has not yet, so Electroview.init does not throw under Vite HTTP.
-- `scripts/devHmr.ts` defaults `WEBKIT_DISABLE_COMPOSITING_MODE=1` on Linux when unset (same profile as Linux compatibility CI) for `GLXBadWindow`, not for `WebLoaderStrategy` failures.
+- Shared `scripts/linuxWebViewEnv.ts`: both runners use `electrobunDevProcessEnv`. On Linux, force `GDK_BACKEND=x11` unless `FULVID_KEEP_GDK_BACKEND=1`. Only the `views://` profile defaults `WEBKIT_DISABLE_COMPOSITING_MODE=1` when unset. The HMR profile clears an inherited compositing disable on Linux only. Windows and macOS runners do not set or clear these variables.
 - Does **not** filter or hide WebKit/GLX messages.
 - Does **not** switch to CEF, add a WebView watchdog, or auto-restart the renderer.
-- Does **not** set compositing env in packaged production code; override locally if needed: `WEBKIT_DISABLE_COMPOSITING_MODE=1`.
+- Does **not** set compositing env in packaged production code; override locally if needed: `WEBKIT_DISABLE_COMPOSITING_MODE=1` (avoid on `dev:hmr`).
 
 Upstream direction: Electrobun native Wayland support (remove forced `GDK_BACKEND=x11`) plus WebKitGTK NetworkProcess stability under heavy ESM load. Re-test HMR after Electrobun/WebKitGTK upgrades. No exact upstream bug matching this Vite+Electrobun HMR scenario was identified; related WebKit work exists around NetworkProcess kills under load (RealtimeKit).
 
@@ -105,13 +108,13 @@ Static checks and integration carry most of the signal. A unit test is an except
 | Format / lint / types | `bun run format:check`, `bun run lint`, `bun run typecheck` | Prettier, ESLint, `vue-tsc` |
 | Unit | `bun run test:unit` | `*.unit.test.ts` |
 | Integration | `bun run test:integration` | `*.integration.test.ts` |
-| Smoke | `bun run smoke` | `*.smoke.test.ts` plus built shell; optional desktop launch |
+| Smoke | `bun run smoke` | Built shell; also re-runs the lifecycle integration test; optional desktop launch |
 | Compatibility smoke | `bun run smoke:compatibility` | Packaged-app CI check (`FULVID_SMOKE_LAUNCH=1` to start the binary) |
 | Aggregate | `bun run test` | Unit plus integration (what CI validate runs) |
 
 Write a unit test when the property is deterministic, lives in one module, and integration would bury it. Do not add a unit test to raise coverage, restate TypeScript, freeze private structure, wrap a trivial helper, or duplicate an integration test.
 
-Use integration when the behavior crosses modules, the filesystem, document lifecycle, or the RPC trust boundary. `documentLifecycle.smoke.test.ts` is the reference for a real editing loop. Graph canvas behavior is smoke or manual.
+Use integration when the behavior crosses modules, the filesystem, document lifecycle, or the RPC trust boundary. `documentLifecycle.integration.test.ts` is the reference for a real editing loop and runs in `bun run test` / `validate`. Graph canvas behavior is smoke or manual.
 
 ### Cross-platform contract
 
diff --git a/README.md b/README.md
index 60a0bcb..c3ee306 100644
--- a/README.md
+++ b/README.md
@@ -41,9 +41,11 @@ It is open source (MIT). The source in this repository is the product.
 
 Open a Markdown or MDX file and edit it. Untitled tabs work when you are still deciding where the file lives. Save and Save As write source, not a converted note format.
 
+Keep several documents open in the tab strip. `Ctrl/Cmd+Tab` and `Ctrl/Cmd+PageDown` activate the next tab in tab order, `Ctrl/Cmd+Shift+Tab` and `Ctrl/Cmd+PageUp` the previous one, and the strip scrolls the active tab back into view when the tabs overflow. Change the order by dragging a tab, or with `Alt+Left` / `Alt+Right` while a tab has keyboard focus. Middle-click closes a tab.
+
 Open a folder when you want Explorer, Quick Open, Global Search, Graph, and Document Context. Those views read the same files you are editing. They are optional. Writing still comes first.
 
-Follow links that are actually in the source. You choose one link mode for the session: Markdown (default) or Wikilink. Broken links stay visible. Fulvid does not create a file because a link points at a missing path.
+Follow links that are actually in the source. You choose one link mode for the session: Markdown (default) or Wikilink. Hovering a document link shows where it resolves: the path, the heading when the link points at one, and a short peek of its Markdown source, as source rather than a rendered page. Broken links stay visible, and the hover says the link matches no document and lists the documents that came close. Fulvid does not create a file because a link points at a missing path.
 
 Search in two places. Local find is the editor's own find (`Ctrl/Cmd+F`). Global Search (`Ctrl/Cmd+Shift+F`) looks through document content in the open folder. Quick Open (`Ctrl/Cmd+P`) jumps to a document by title, filename, or path in that folder - it does not search content.
 
@@ -57,7 +59,7 @@ Look at an Outline of headings, or at Document Context for references and facts
 
 Install **local Extensions** when you want small add-ons - a menu command, a note template, or a bounded selection transform - without giving them the filesystem, network, or the live editor. Packs live under your user data folder as ordinary files you can inspect. Details: [docs/EXTENSIONS.md](docs/EXTENSIONS.md). Catalog: sibling [`fulvid-extensions`](../fulvid-extensions/).
 
-The chrome is English or Spanish. Document text, filenames, and link targets are never translated.
+The chrome is translated for the locales listed in [docs/I18N.md](docs/I18N.md). It follows your operating system language when Fulvid has that language and English when it does not, or you can choose one in Settings. Document text, filenames, and link targets are never translated.
 
 ![MDX opened as source in Fulvid](assets/screenshots/editor-mdx.png)
 
@@ -114,7 +116,7 @@ A document on disk is a `.md`, `.markdown`, or `.mdx` file. Untitled buffers liv
 
 Folder reads and writes stay inside the folder you opened. Opening a single file, or using Save As, goes through the operating system's file dialog. Later saves of that standalone file use the grant issued at dialog time.
 
-A save that did not reach disk does not pretend it did. If the file's modification time changed since Fulvid last read or saved it, you get a conflict instead of a silent overwrite.
+A save that did not reach disk does not pretend it did. If the file's modification time changed since Fulvid last read or saved it, you get a conflict instead of a silent overwrite. A save replaces the text in the file and leaves the file's own permissions alone, so a document you keep private stays private.
 
 You can keep using git, another editor, or a static generator on the same tree. Fulvid is a guest on the filesystem, not the owner of it.
 
@@ -154,7 +156,7 @@ Fulvid is a good fit if you:
 
 ## Who Fulvid is not for
 
-Skip Fulvid if you need a personal knowledge manager, a cloud workspace, live collaboration, or a place that executes MDX as an application. It is not a generic IDE, not a plugin platform, and not a publishing pipeline.
+Skip Fulvid if you need a personal knowledge manager, a cloud workspace, live collaboration, or a place that executes MDX as an application. It is not a generic IDE, not a plugin marketplace, and not a publishing pipeline.
 
 Those are other products. Fulvid stays a desktop editor for local Markdown and MDX files.
 
@@ -162,7 +164,7 @@ Those are other products. Fulvid stays a desktop editor for local Markdown and M
 
 Fulvid is built as a desktop app for Linux, Windows, and macOS. There is no 32-bit build.
 
-**Linux.** Packaging produces a Debian package (`fulvid_<version>_linux-x64.deb`) and a `.tar.gz` archive. Those files are meant for GitHub Releases. There is no Flathub, Snap, or AppImage package today.
+**Linux.** Packaging produces a Debian package (`fulvid_<version>_linux-x64.deb`) and a `.tar.gz` archive for GitHub Releases. There is no Flathub, Snap, or AppImage package.
 
 **Windows.** Packaging produces a zip (`fulvid_<version>_win-x64-Setup.zip`) for 64-bit Windows.
 
@@ -172,9 +174,9 @@ Unsigned local builds may need an OS security approval the first time they run.
 
 ## Installation
 
-GitHub Releases is the public download channel. There is not a published release on that page yet, so the way to run Fulvid today is from source.
+Download a published build from [GitHub Releases](https://github.com/ManuelGil/fulvid/releases) and pick the artifact for your platform (see [Platforms](#platforms)). That is the public install channel.
 
-When a release is published, download it from [GitHub Releases](https://github.com/ManuelGil/fulvid/releases) and pick the file for your platform. Until then, use the steps below.
+To run from source for development or contribution:
 
 You need [Bun](https://bun.sh) **1.4.2** or newer on the host (what `bun run doctor` checks). Electrobun's and Vite's CLIs also need [Node](https://nodejs.org/) 18 or newer on `PATH` (`#!/usr/bin/env node`). The packaged app embeds Electrobun 2.0.1 with Hutch's Bun **1.4.0** runtime - that packaged Bun version is independent of the host Bun you use to develop.
 
diff --git a/assets/screenshots/README.md b/assets/screenshots/README.md
index 471d74b..aca94c3 100644
--- a/assets/screenshots/README.md
+++ b/assets/screenshots/README.md
@@ -1,6 +1,6 @@
 # Screenshots
 
-Window captures from Fulvid (product UI). Older product shots are from 0.1.0; annotation shots match the current Add/Edit Quick Action UX.
+Window captures from Fulvid (product UI). Some early product shots predate 1.0.0 chrome; annotation shots match the Add/Edit Quick Action UX. Treat this set as illustrative, not a full feature catalog.
 
 | File | Shows |
 | --- | --- |
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 1538aeb..459c345 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -4,7 +4,7 @@ Who owns behavior in Fulvid.
 
 Vocabulary: [CONCEPTS.md](./CONCEPTS.md). Rules: [INVARIANTS.md](./INVARIANTS.md). Graph pipeline: [GRAPH.md](./GRAPH.md).
 
-Every user-visible behavior has **one owner**. Pages and the shell choose what is on screen; they do not own product rules. Reuse the document session, buffers, document-link parse/resolve (`documentLink` + `linkSemantics`), Preview renderer, and filesystem RPC. Do not add a second store, parser, renderer, resolver, or lifecycle.
+Every user-visible behavior has **one owner**. Pages and the shell choose what is on screen; they do not own product rules. Reuse the document session, buffers, document-link parse/resolve (`documentLink` + `linkSemantics`), Preview renderer, and filesystem RPC. Do not add a second store, parser, renderer, resolver, or lifecycle. **No new owner without a concrete new observable behavior.**
 
 ## Owners
 
@@ -88,7 +88,7 @@ The right sidebar shows one panel: Explorer, Search options (on `/search`), Docu
 
 ### Extension UI boundary
 
-Presentation may become extension-capable later; **authority does not**. An extension is never an owner.
+Presentation may be extension-capable; **authority does not**. An extension is never an owner.
 
 The Extension System orchestrates declared capabilities; it does not become the owner of filesystem, document, editor, window, search, graph, or renderer authority.
 
@@ -131,3 +131,47 @@ If a component owns a canvas, worker, observer, or subscription, that resource d
 Ignore superseded async results. Do not keep workers or renderers alive across routes without an owner, cache disposed renderers, or teleport GPU/worker components without matching dispose.
 
 Vite/Monaco HMR is `bun run dev:hmr`: [CONTRIBUTING.md](../CONTRIBUTING.md#desktop-toolchain).
+
+## Memory footprint and future considerations
+
+### Baseline
+
+Linux packaged Fulvid **1.0.0** (Electrobun 2.0.1, Bun 1.4.0, WebKitGTK 2.52.6, Ubuntu 24.04.5 / Wayland / x86_64), cold launch, **5-run median** across the Fulvid process tree (`smaps_rollup`):
+
+| Mark | Median RSS | Median PSS |
+| --- | --- | --- |
+| Early peak (~5 s) | ~596.8 MiB | ~369.4 MiB |
+| Idle (~60 s) | ~550.9 MiB | ~322.9 MiB |
+
+This is a **Linux packaged benchmark reference**, not a cross-platform guarantee and not a claim about Electrobun or WebKit in isolation.
+
+A diagnostic shell-floor build (Monaco removed from the running editor path) measured ~479.5 MiB RSS / ~256.0 MiB PSS idle. The Monaco stack therefore accounts for roughly **~67 MiB PSS** of the measured baseline.
+
+### Interpretation
+
+Prefer **PSS** over summed RSS when comparing physical footprint: shared library pages counted fully in each process make sum-RSS overstate unique usage. Do not treat virtual address space (`VmSize`) as RAM.
+
+The dominant measured idle cost is the **WebKitGTK content process** and the **Bun / native host**, not Graph, Preview, i18n catalogs, or empty-extension discovery. No evidence from this investigation established an application-level memory leak.
+
+Fulvid's current UX intentionally keeps the editor ready on launch. Deferring Monaco until first interaction may reduce idle memory, but that would be a product/UX change rather than a transparent implementation optimization.
+
+### Future engineering rules
+
+- Keep feature-specific functionality lazy when it is not required at startup.
+- Do not eagerly initialize Graph/Sigma, Preview, extension runtimes, or other optional subsystems.
+- Avoid loading large libraries on the critical startup path unless the feature is required for the initial editor experience.
+- Do not duplicate document content or create parallel caches/indexes solely for convenience.
+- Dispose listeners, timers, Monaco resources, WebView resources, and other lifecycle-bound objects at their existing owner boundary (see [Resources](#resources)).
+- Avoid retaining hidden views, editors, models, parsed documents, graph data, or other large structures after their lifecycle ends.
+- Prefer measuring before optimizing. Treat RSS and PSS separately.
+- Do not trade security or editor behavior for arbitrary memory targets.
+
+### When to investigate again
+
+Revisit only with evidence such as: unbounded growth under a normal workload; a significant regression from the baseline above; retention after closing/discarding large documents or views; a new feature with a substantial persistent allocation; a WebKit/Bun/runtime upgrade that materially changes the footprint; or reproducible user reports of excessive consumption.
+
+When investigating: reproduce first; use the **packaged** build; isolate the responsible process; measure RSS and PSS; compare to this baseline; attribute the increase to application code, WebKit, runtime, or native dependencies; avoid speculative optimization.
+
+### Runtime maintenance
+
+WebKitGTK evolves independently of Fulvid and can include memory-management and security fixes. Supported-distro/runtime upgrades should be **benchmarked**, not assumed to improve or worsen memory. Example: WebKitGTK 2.52.6 included a memory-usage improvement for pages using font variations; that does not imply a later version is better without measurement.
diff --git a/docs/CONCEPTS.md b/docs/CONCEPTS.md
index e6bbcbd..d03b776 100644
--- a/docs/CONCEPTS.md
+++ b/docs/CONCEPTS.md
@@ -44,7 +44,7 @@ Product copy uses **Folder**, never Workspace. Host code may still use `workspac
 
 Settings choose one `linkMode`: `"markdown"` (default) or `"wikilink"`. That mode governs scan, resolution, editor providers, Preview, references, rename, and Graph.
 
-When several Folder documents match the same stem, alias, or title, resolution stays **first-wins** (deterministic scan order). Surfaces may show the other matches as honesty (`alsoMatches` on hover; Context notes that Fulvid opens the first match). That list is derived from the scan - not a second identity or persisted state. An unresolved link with exactly one near-match may offer that candidate as a soft open (definition / Inspector); it does not change first-wins for resolved links.
+When several Folder documents match the same stem, alias, or title, resolution stays **first-wins** (deterministic scan order). Surfaces may show the other matches as honesty (`alsoMatches` on hover; Context notes that Fulvid opens the first match). That list is derived from the scan - not a second identity or persisted state. An unresolved link with exactly one near-match may offer that candidate as a soft open (definition / Inspector); it does not change first-wins for resolved links. Editor link hover is an honesty/inspector surface (path, anchor status, matches) plus a short **source** Markdown peek of the target - not Preview, not HTML, and not a second renderer.
 
 **Find references** (`Shift+F12`) lists heading and fragment locations. **Rename heading** (`F2`) rewrites that heading and known fragment targets as text. F2 does not rename files.
 
diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md
index d109457..723091e 100644
--- a/docs/DISTRIBUTION.md
+++ b/docs/DISTRIBUTION.md
@@ -1,6 +1,6 @@
 # Distribution
 
-GitHub Releases is the only public download channel. No version is published yet. Until then, run Fulvid from source (see the README).
+GitHub Releases is the only public download channel. Install artifacts for tagged versions are published there. Running from source remains available for development (see the README).
 
 Release notes for a tag live under [releases/](./releases/) and are copied onto that GitHub Release by hand. The chronological list of user-facing changes is [CHANGELOG.md](../CHANGELOG.md).
 
@@ -38,12 +38,12 @@ Canary packaging exists for development. Canary builds are not published as GitH
 
 ### Linux
 
-The `.deb` and the `-Setup.tar.gz` archive are what Linux packaging produces today. The `.deb` sits next to the archive; it does not replace it.
+The `.deb` and the `-Setup.tar.gz` archive are what Linux packaging produces. The `.deb` sits next to the archive; it does not replace it.
 
 | Format | Status |
 | --- | --- |
-| Debian (`.deb`) | Produced by current packaging. Not downloadable until a GitHub Release exists. |
-| Linux archive | Produced by current packaging. Same set as the `.deb`. |
+| Debian (`.deb`) | Produced by packaging; published on GitHub Releases for tagged versions. |
+| Linux archive | Produced by packaging; same set as the `.deb`. |
 | Snap | Notes and a draft only. No Store listing. |
 | AppImage | Notes only. No `.AppImage` is produced. |
 | Flatpak / Flathub | Notes only. Not submitted. No manifest. |
@@ -97,7 +97,7 @@ if: startsWith(github.ref, 'refs/tags/v')
 
 Who can create or move `v*` tags is a GitHub repository permission.
 
-Release body notes live under [releases/](./releases/) (`v1.0.0.md` for the current release notes; use `vX.Y.Z.md` for the version you are shipping). Actions generates a commit list automatically; replace or append the curated notes on the Release when needed.
+Release body notes live under [releases/](./releases/) (`v1.1.0.md` for the current release notes; use `vX.Y.Z.md` for the version you are shipping). Actions generates a commit list automatically; replace or append the curated notes on the Release when needed.
 
 
 ## Verification
diff --git a/docs/EXTENSION-AUTHOR-CONTRACT.md b/docs/EXTENSION-AUTHOR-CONTRACT.md
index 2e854e8..82d483e 100644
--- a/docs/EXTENSION-AUTHOR-CONTRACT.md
+++ b/docs/EXTENSION-AUTHOR-CONTRACT.md
@@ -121,7 +121,7 @@ Guest has no `os` / `io` / `require` / `load` / `host.call`.
 | `editor.getSelection()` | bounded selection snapshot string |
 | `editor.replaceSelection(text)` | **only generic write primitive**; empty selection inserts at cursor; stale selection rejected |
 
-Possible today: insert at cursor, replace/transform selection, seed a new buffer via `document.createUntitled`.  
+Possible: insert at cursor, replace/transform selection, seed a new buffer via `document.createUntitled`.
 **Not** available: arbitrary range rewrite / multi-cursor / full-buffer `setText`. Prefer selection + untitled composition over wishing for a larger editor API.
 
 ### `document`
diff --git a/docs/EXTERNAL-OPEN.md b/docs/EXTERNAL-OPEN.md
index 2193dee..5f1bd06 100644
--- a/docs/EXTERNAL-OPEN.md
+++ b/docs/EXTERNAL-OPEN.md
@@ -7,7 +7,7 @@ This is the internal layer, plus the Linux desktop `Exec` field that feeds it.
 launcher arguments to the Bun host, and there is no browser extension. What
 exists is the contract, the single host-side handler, one argv adapter, and a
 desktop entry that is ready to pass local paths once the launcher does. See
-[Status](#status) for exactly what is wired today.
+[Status](#status) for exactly what is wired.
 
 ## What an external open request is
 
diff --git a/docs/I18N.md b/docs/I18N.md
index fb60dce..07efad0 100644
--- a/docs/I18N.md
+++ b/docs/I18N.md
@@ -24,6 +24,12 @@ Language names in the selector stay as native endonyms in every locale.
 
 `pt` uses neutral Portuguese suitable for a global desktop product (not a strongly regional Brazilian or European variant).
 
+## Default language
+
+By default, Fulvid follows the operating system language when that language is supported. English is used when the system language is not supported. An explicit language selected in Fulvid takes precedence.
+
+Settings stores a preference of `system` or a catalog code (`de`, `en`, ...). Resolution (preference -> OS -> English) runs before the UI mounts so the first paint matches the effective language. Regional OS tags such as `de-DE` or `pt_BR` match by primary language against the allowlist above.
+
 ## Context
 
 Read the control, the label next to it, and the action it performs. The same idea may need a different shape as a button, tooltip, hint, empty state, error, menu, or statusbar item.
@@ -155,11 +161,11 @@ English: short labels; extra detail in hints. Other locales: natural contemporar
 
 1. Add `src/mainview/i18n/<language>.ts` with the same key tree as `en.ts`.
 2. Register it in `src/mainview/i18n/index.ts` `messages`.
-3. Add the locale to `Locale`, `VALID_LOCALES`, and the Settings language select in `SettingsPage.vue`.
+3. Add the locale to `SUPPORTED_LOCALES` in `resolveLocale.ts` and the Settings language select in `SettingsPage.vue`.
 4. Add the language endonym keys under `settings.*` in every catalog.
 5. Run `bun run i18n:check`.
 
-The auditor treats the first locale in sorted order as the structural reference (`de` today).
+The auditor treats the first locale in sorted order as the structural reference (`de` when locales are sorted alphabetically).
 
 ## Validation
 
diff --git a/docs/INVARIANTS.md b/docs/INVARIANTS.md
index fd1728d..1e966de 100644
--- a/docs/INVARIANTS.md
+++ b/docs/INVARIANTS.md
@@ -67,7 +67,7 @@ The renderer is untrusted. It may ask for a document inside a folder the person
 | Desktop actions | Reveal and copy accept only an approved root, something inside an authorized root, or a granted document |
 | Grants | A grant token maps to one absolute path, is shaped like a UUID, and the grant table is bounded |
 | Error containment | Failures cross the boundary as codes from `filesystemErrors`. No host path, errno, or stack reaches the UI |
-| Scan ceilings | A folder scan is bounded in document count and depth, and per-file analysis is capped. A partial scan is reported, never silent |
+| Scan ceilings | A folder scan is bounded in document count and depth, per-file analysis is capped, and the total document text one scan carries is capped. A partial scan is reported, never silent |
 | External open | An external request is intent, never privilege. It earns exactly what the equivalent dialog earns, through the same authorities. See [EXTERNAL-OPEN.md](./EXTERNAL-OPEN.md) |
 | Save integrity | A save that did not reach disk never clears dirty. Creating a document is an exclusive create, so a concurrent create is reported rather than overwritten. In-flight writes capture path and content at start; abandoned buffers skip post-write mutation. Rename/delete/detach/quit drain that buffer's save queue before moving or removing the filesystem identity |
 
diff --git a/docs/REPOSITORY.md b/docs/REPOSITORY.md
index bfab703..fb36597 100644
--- a/docs/REPOSITORY.md
+++ b/docs/REPOSITORY.md
@@ -21,7 +21,7 @@ src/mainview/pages/      Routes: editor/, search/, graph/, settings/
 src/mainview/modules/    workspace/, editor/, search/, quickOpen/, graph/, document/, settings/
 src/mainview/app/        Bootstrap, router, layout, folder lifecycle
 src/mainview/shell/      Menus, sidebars, AppIcon.vue
-src/mainview/i18n/       EN/ES catalogs; see I18N.md
+src/mainview/i18n/       UI locale catalogs (en/es/de/fr/it/nl/pt); see I18N.md
 src/mainview/styles/
 tests/                   Mirrors src/bun, src/mainview, and scripts/
 tests/extensions/        Extension contract/security tests (+ disposable fixtures/)
@@ -47,8 +47,23 @@ docs/                    Includes EXTENSIONS.md + EXTENSION-PRODUCT-CONTRACT.md
 | Outline | `modules/editor/outline/OutlinePanel.vue` |
 | Preview | `modules/editor/preview/PreviewPane.vue` |
 
-Tests mirror `src/` and `scripts/`. Names are `.unit.test.ts`, `.integration.test.ts`, and `.smoke.test.ts`. Unit tests are the exception; see [CONTRIBUTING.md](../CONTRIBUTING.md#testing). Smoke is `bun run smoke`, not part of `bun run test`.
+Tests mirror `src/` and `scripts/`. Names are `.unit.test.ts` and `.integration.test.ts` (what `bun run test` / `validate` run). `bun run smoke` checks the built shell and may re-run the lifecycle integration test; optional desktop launch is separate. See [CONTRIBUTING.md](../CONTRIBUTING.md#testing).
 
 Product copy uses **Folder**. Host code may keep `workspace*` identifiers.
 
 Distribution: [DISTRIBUTION.md](./DISTRIBUTION.md).
+
+## Documentation map
+
+| Need | Start here |
+| --- | --- |
+| Product vocabulary | [CONCEPTS.md](./CONCEPTS.md) |
+| Ownership / architecture | [ARCHITECTURE.md](./ARCHITECTURE.md) |
+| Enforceable rules | [INVARIANTS.md](./INVARIANTS.md) |
+| Security contract | [SECURITY-AND-RESILIENCE.md](./SECURITY-AND-RESILIENCE.md) |
+| Extensions | [EXTENSIONS.md](./EXTENSIONS.md) |
+| Platforms / CI smoke | [compatibility.md](./compatibility.md) |
+| Packaging / Releases | [DISTRIBUTION.md](./DISTRIBUTION.md) |
+| Contributor actions | [../CONTRIBUTING.md](../CONTRIBUTING.md) |
+| User-facing history | [../CHANGELOG.md](../CHANGELOG.md), [releases/](./releases/) |
+| Historical security evidence | [security/](./security/) (not the living control list) |
diff --git a/docs/SECURITY-AND-RESILIENCE.md b/docs/SECURITY-AND-RESILIENCE.md
index b809fdf..4d06aa6 100644
--- a/docs/SECURITY-AND-RESILIENCE.md
+++ b/docs/SECURITY-AND-RESILIENCE.md
@@ -133,8 +133,8 @@ Unreadable or vanished entries during a scan are skipped and counted. That is a
 Automated coverage that is actually in the repository:
 
 - **Unit tests** - Preview inertness and density timing; link resolution scale and semantics; RPC parameter shape and size; `selectDocument` paired with Focus; Writing Focus is independent of native Full Screen; Extension contract tests under `tests/extensions/` ([EXTENSIONS.md](./EXTENSIONS.md#tests-as-security-contracts))
-- **Integration tests** - folder containment (lexical and canonical, including symlinks); grants; External Open resolve path; scan skip of unreadable or vanished entries; scan ceilings; document I/O and exclusive create; RPC error containment
-- **Smoke** - real editing loop; optional packaged launch (`bun run smoke:compatibility`); Lua packaged runtime (`bun run smoke:lua-packaged`)
+- **Integration tests** - folder containment (lexical and canonical, including symlinks); grants; External Open resolve path; scan skip of unreadable or vanished entries; scan ceilings; document I/O and exclusive create; the composed editing loop (`documentLifecycle.integration.test.ts`); RPC error containment
+- **Smoke** - built shell checks and optional packaged launch (`bun run smoke` / `bun run smoke:compatibility`); Lua packaged runtime (`bun run smoke:lua-packaged`)
 - **Compatibility CI** - package and launch on the images in [compatibility.md](./compatibility.md). That is runtime compatibility, not a filesystem red team
 - **Contributor gate** - `bun run validate` (format, translations, lint, types, tests, web build, doctor)
 - **Dependency health** - frozen lockfile and advisory audit (`bun run deps:check`)
diff --git a/docs/compatibility.md b/docs/compatibility.md
index 650a8df..beb5bb8 100644
--- a/docs/compatibility.md
+++ b/docs/compatibility.md
@@ -39,7 +39,7 @@ Electrobun's CLI (`electrobun.cjs`) and Vite's CLI start with `#!/usr/bin/env no
 | --- | --- |
 | Ubuntu 24.04 (`ubuntu-24.04`) | Tested. Build, `.deb`, launch under Xvfb, filesystem smoke |
 | Debian 13 (`debian:13` container) | Tested separately from Ubuntu. Same checks |
-| Ubuntu 26.04 | Current Ubuntu LTS. Supported as a WebKitGTK 4.1 host. **Not tested** here: the GitHub runner image is still preview |
+| Ubuntu 26.04 | Supported as a WebKitGTK 4.1 host. **Not tested** in this matrix (no GitHub-hosted job yet) |
 | Ubuntu 22.04, Debian 12 | Unsupported. Electrobun 2.0.1 ships Cottontail 0.5.0 (`GLIBC_2.38`, `GLIBCXX_3.4.32`) and `libNativeWrapper.so` (`GLIBC_2.38`, `GLIBCXX_3.4.32`). Ubuntu 22.04 is glibc 2.35; Debian 12 is glibc 2.36 |
 | Ubuntu 20.04, Debian 11, 32-bit | Unsupported |
 
@@ -51,7 +51,7 @@ Local smoke after a Linux package:
 FULVID_SMOKE_LAUNCH=1 bun run smoke:compatibility
 ```
 
-Without `FULVID_SMOKE_LAUNCH`, the script still checks `dist/` and the filesystem editing loop.
+Without `FULVID_SMOKE_LAUNCH`, the script still checks `dist/` and re-runs the filesystem editing-loop integration test.
 
 Linux compatibility CI launches under Xvfb with `GDK_BACKEND=x11` and `WEBKIT_DISABLE_COMPOSITING_MODE=1`. On a local Wayland desktop, Electrobun 2.0.1 still forces X11 (XWayland); `GLXBadWindow` and occasional WebKit `internallyFailedLoadTimerFired` lines during `bun run dev:hmr` are documented under [CONTRIBUTING.md](../CONTRIBUTING.md#linux-wayland--devhmr-console-noise). They are not treated as Fulvid application regressions.
 
@@ -91,7 +91,7 @@ No Apple signing secrets on these jobs.
 | Windows x64 | Tested | **Verified** (Compatibility Windows CI) |
 | macOS arm64 | Tested | **Verified** (Compatibility macOS CI - 26 Apple Silicon) |
 
-Evidence (Compatibility CI): [Windows run 34909418780](https://github.com/ManuelGil/fulvid/actions/runs/34909418780), [macOS run 34909421392](https://github.com/ManuelGil/fulvid/actions/runs/34909421392). Packaged Lua runtime is verified on the three supported desktop architectures above.
+Evidence: Compatibility Linux / Windows / macOS workflows on `main` (see When compatibility CI runs). Packaged Lua runtime is verified on the three supported desktop architectures above.
 
 The Lua smoke checks packaged `bun/glue.wasm`, Wasm init, discovery + `ui.notify`, invalid-pack isolation, and lightweight interrupt/memory probes against the packaged module. It does not launch the UI and does not replace `smoke:compatibility`.
 
diff --git a/docs/github-distribution.md b/docs/github-distribution.md
index 77475cb..78c2a6e 100644
--- a/docs/github-distribution.md
+++ b/docs/github-distribution.md
@@ -35,7 +35,7 @@ if: startsWith(github.ref, 'refs/tags/v')
 It downloads `fulvid-linux/`, `fulvid-windows/`, and `fulvid-macos/`, renames shared metadata (`SHA256SUMS`, `release-manifest.json`, `build.log`) with a platform suffix, and calls `softprops/action-gh-release` with `GITHUB_TOKEN`. That job is the only one with `contents: write`.
 
 - If no Release exists for the tag, one is created (`Fulvid <tag>`).
-- The action sets `generate_release_notes: true` (GitHub's commit list). When attaching notes by hand, use the matching file under [releases/](./releases/) (`v1.0.0.md` for the current release notes; use `vX.Y.Z.md` for the version you are shipping).
+- The action sets `generate_release_notes: true` (GitHub's commit list). When attaching notes by hand, use the matching file under [releases/](./releases/) (`v1.1.0.md` for the current release notes; use `vX.Y.Z.md` for the version you are shipping).
 - If a Release already exists, new assets are uploaded. `overwrite_files: false`, so a name already on the Release fails the upload.
 - A re-run does not replace existing assets.
 
diff --git a/docs/linux-release.md b/docs/linux-release.md
index 8d35c6d..81a3729 100644
--- a/docs/linux-release.md
+++ b/docs/linux-release.md
@@ -61,4 +61,4 @@ gpg --verify artifacts/SHA256SUMS.asc artifacts/SHA256SUMS
 (cd artifacts && sha256sum -c SHA256SUMS)
 ```
 
-Copy the files you need onto a GitHub Release yourself. Use the matching file under [releases/](./releases/) as the body (`v1.0.0.md` for the current release notes; use `vX.Y.Z.md` for the version you are shipping).
+Copy the files you need onto a GitHub Release yourself. Use the matching file under [releases/](./releases/) as the body (`v1.1.0.md` for the current release notes; use `vX.Y.Z.md` for the version you are shipping).
diff --git a/docs/releases/v1.0.0.md b/docs/releases/v1.0.0.md
index 9cc1a2b..cfd815d 100644
--- a/docs/releases/v1.0.0.md
+++ b/docs/releases/v1.0.0.md
@@ -10,7 +10,7 @@ First stable release. Graph keyboard scope, Settings keyboard navigation, Sponso
 - **Sponsors**: Settings -> About opens GitHub Sponsors in the system browser.
 - **Folder boundaries**: scan stays inside the open Folder (no symlink/junction follow-out); create/save refuse trailing spaces and reserved device stems more consistently.
 
-## Download names (when published)
+## Download names
 
 | Platform | Artifact |
 | --- | --- |
diff --git a/docs/releases/v1.1.0.md b/docs/releases/v1.1.0.md
new file mode 100644
index 0000000..a26aebf
--- /dev/null
+++ b/docs/releases/v1.1.0.md
@@ -0,0 +1,29 @@
+# Fulvid 1.1.0
+
+Tab organization and a source peek on document-link hover, with the application language following the operating system, on top of the 1.0.0 editor surface.
+
+## Highlights
+
+- **Tab organization**: reorder open document tabs by dragging inside the tab strip, or with `Alt+Left` / `Alt+Right` while a tab has keyboard focus. Middle-click closes a tab, and the strip scrolls the active tab back into view when tabs overflow.
+- **Tab navigation in visible order**: `Ctrl/Cmd+Tab` and `Ctrl/Cmd+Shift+Tab` walk the strip and wrap at the ends instead of most-recently-used order. `Ctrl/Cmd+PageDown` / `Ctrl/Cmd+PageUp` do the same and now appear as accelerators in Navigate and in Settings keyboard help.
+- **Link hover source peek**: hovering a document link shows where it resolves (path, heading status, other matching documents) and a short excerpt of the target's Markdown source, shown as source rather than rendered HTML.
+- **System language**: Settings -> Language defaults to System and follows the operating system language when Fulvid has that language, English otherwise. A language chosen there still wins.
+- **Save keeps file permissions**: saving a document no longer replaces that file's own permissions with the process default.
+
+## Download names
+
+| Platform | Artifact |
+| --- | --- |
+| Linux x64 (Debian) | `fulvid_1.1.0_linux-x64.deb` |
+| Linux x64 (archive) | `fulvid_1.1.0_linux-x64-Setup.tar.gz` |
+| macOS Apple Silicon | `fulvid_1.1.0_macos-arm64.dmg` |
+| Windows x64 | `fulvid_1.1.0_win-x64-Setup.zip` |
+
+Automatic GitHub Release publication is enabled for `v*` tags; see DISTRIBUTION.md.
+
+## Notes
+
+- Editor hover tooltips show document text (link labels, headings, paths, candidate matches) as literal text, so a heading or filename cannot turn a tooltip into a link or an image request.
+- A Folder scan also stops at a ceiling on total document text; a tree past it still loads as a partial Folder and is still reported as partial.
+- Tab order is session chrome. It does not move files or change the Folder.
+- MDX remains inert source. Export HTML behavior is unchanged.
diff --git a/electrobun.config.ts b/electrobun.config.ts
index 4538767..df8193a 100644
--- a/electrobun.config.ts
+++ b/electrobun.config.ts
@@ -16,7 +16,7 @@ export default {
   app: {
     name: "Fulvid",
     identifier: "fulvid.imgil.dev",
-    version: "1.0.0",
+    version: "1.1.0",
   },
   build: {
     mainProcess: "bun",
diff --git a/package.json b/package.json
index a8de261..a7b73b5 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "fulvid",
   "description": "A standalone desktop editor for Markdown and MDX",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "type": "module",
   "private": true,
   "icon": "assets/fulvid.png",
@@ -33,9 +33,9 @@
     "url": "https://github.com/ManuelGil/fulvid/issues"
   },
   "scripts": {
-    "dev": "bun run build && electrobun dev --watch",
+    "dev": "bun run build && bun run scripts/electrobunDev.ts dev --watch",
     "dev:hmr": "bun run prepare:electrobun && concurrently --kill-others-on-fail \"vite --port 5173\" \"bun run scripts/devHmr.ts\"",
-    "start": "bun run build && electrobun dev",
+    "start": "bun run build && bun run scripts/electrobunDev.ts dev",
     "prepare:electrobun": "electrobun prepare --env=dev",
     "build": "bun run prepare:electrobun && vite build",
     "build:canary": "electrobun prepare --env=canary && vite build && electrobun build --env=canary",
diff --git a/packaging/linux/README.md b/packaging/linux/README.md
index 079a242..577935b 100644
--- a/packaging/linux/README.md
+++ b/packaging/linux/README.md
@@ -1,6 +1,10 @@
 # Linux packaging
 
-Manual Linux release scripts. GitHub Actions does not call this directory for the `.deb`; it inlines the same Debian steps. Procedure: [linux-release.md](../../docs/linux-release.md).
+Linux packaging scripts and desktop/metainfo stubs.
+
+- **Release workflow** (`release.yml`): inlines Debian packaging steps; uses `desktop/fulvid.desktop` and `runtime-libraries.tsv` from this tree. It does not call `make` or `package.sh`.
+- **Compatibility Linux** (`compatibility-linux.yml`): runs `package.sh` (which sources `lib.sh` and `deb.sh`) for package + smoke.
+- **Manual maintainer path**: `make` + scripts here. Procedure: [linux-release.md](../../docs/linux-release.md).
 
 ```text
 packaging/linux/
diff --git a/packaging/linux/lib.sh b/packaging/linux/lib.sh
index 4b4dd31..4014131 100755
--- a/packaging/linux/lib.sh
+++ b/packaging/linux/lib.sh
@@ -1,4 +1,5 @@
-# Linux manual packaging helpers. Not used by GitHub Actions or other platforms.
+# Linux packaging helpers (manual Make path and Compatibility Linux package.sh).
+# release.yml inlines Debian steps and does not source this file.
 # shellcheck shell=bash
 
 ROOT="$(CDPATH='' cd -- "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
diff --git a/packaging/linux/metainfo/README.md b/packaging/linux/metainfo/README.md
index 34ce2bc..a40e874 100644
--- a/packaging/linux/metainfo/README.md
+++ b/packaging/linux/metainfo/README.md
@@ -9,7 +9,7 @@ Present: name, summary, description, developer, licenses, URLs, categories, icon
 Omitted on purpose:
 
 - Adopted Flatpak App ID
-- `<releases>` until a GitHub Release exists
+- `<releases>` (candidate file is not wired into shipping packaging; keep AppStream releases out until this file is an adopted install path)
 - `<screenshot>` URLs (files exist in [assets/screenshots/](../../../assets/screenshots/); do not invent a public URL)
 
 `appstreamcli validate --no-net` succeeds. Pedantic check reports `releases-info-missing`.
diff --git a/packaging/linux/snap/intended-snapcraft.yaml b/packaging/linux/snap/intended-snapcraft.yaml
index 8ab3ce6..02b6355 100644
--- a/packaging/linux/snap/intended-snapcraft.yaml
+++ b/packaging/linux/snap/intended-snapcraft.yaml
@@ -16,7 +16,7 @@
 
 name: fulvid
 base: core24
-version: "1.0.0"
+version: "1.1.0"
 summary: A standalone desktop editor for Markdown and MDX
 description: |
   Fulvid is a standalone desktop editor for Markdown and MDX.
diff --git a/scripts/compatibilitySmoke.ts b/scripts/compatibilitySmoke.ts
index 186b93c..0c15c46 100644
--- a/scripts/compatibilitySmoke.ts
+++ b/scripts/compatibilitySmoke.ts
@@ -341,7 +341,7 @@ verifyBuiltShell();
 console.log("  dist/index.html and bundled assets look usable.\n");
 
 console.log("-> Filesystem editing loop\n");
-run("bun", ["test", "tests/bun/filesystem/io/documentLifecycle.smoke.test.ts"]);
+run("bun", ["test", "tests/bun/filesystem/io/documentLifecycle.integration.test.ts"]);
 
 if (launchRequested) {
   console.log("\n-> Packaged launch\n");
diff --git a/scripts/devHmr.ts b/scripts/devHmr.ts
index 26b9c65..af514dd 100644
--- a/scripts/devHmr.ts
+++ b/scripts/devHmr.ts
@@ -5,13 +5,14 @@
  * WebKitGTK `internallyFailedLoadTimerFired` and HMR reconnect rates.
  * Vite `server.warmup.clientFiles` is the measured win for transform churn.
  *
- * On Linux, Electrobun 2.0.1 forces GDK_BACKEND=x11 (XWayland on Wayland
- * sessions). Accelerated compositing then often logs GLXBadWindow. Linux
- * compatibility CI already launches with WEBKIT_DISABLE_COMPOSITING_MODE=1.
- * Inherit an explicit value; otherwise default to the same profile for HMR
- * only. That env targets GLX/compositing, not the HMR WebSocket path. This
- * does not silence stderr and does not change packaged builds.
+ * On Linux, force `GDK_BACKEND=x11` (unless `FULVID_KEEP_GDK_BACKEND=1`) so
+ * an inherited Wayland GDK backend does not blank the window. Do **not** set
+ * `WEBKIT_DISABLE_COMPOSITING_MODE` here: with Vite HTTP that flag stops page
+ * JS from evaluating (no `[vite] connected`). Compositing disable stays on
+ * the `views://` path in `electrobunDev.ts` / Linux compatibility CI.
  */
+import { electrobunDevProcessEnv } from "./linuxWebViewEnv";
+
 const devServerUrl = "http://127.0.0.1:5173";
 const warmupPaths = ["/", "/@vite/client", "/main.ts"];
 const timeoutMs = 30_000;
@@ -44,25 +45,13 @@ async function waitForVite(): Promise<void> {
 
 await waitForVite();
 
-/** Linux HMR only: do not inject this env on Windows/macOS or into packaged builds. */
-function linuxWebKitCompositingEnv(
-  platform: NodeJS.Platform,
-  existing: string | undefined,
-): Record<string, string> {
-  if (platform !== "linux" || existing !== undefined) {
-    return {};
-  }
-  return { WEBKIT_DISABLE_COMPOSITING_MODE: "1" };
-}
-
 const electrobun = Bun.spawn(["bun", "x", "electrobun", "dev"], {
   stdin: "inherit",
   stdout: "inherit",
   stderr: "inherit",
-  env: {
-    ...process.env,
-    ...linuxWebKitCompositingEnv(process.platform, process.env.WEBKIT_DISABLE_COMPOSITING_MODE),
-  },
+  env: electrobunDevProcessEnv(process.platform, process.env, {
+    disableCompositing: false,
+  }),
 });
 
 const forwardSignal = (signal: NodeJS.Signals): void => {
diff --git a/scripts/electrobunDev.ts b/scripts/electrobunDev.ts
new file mode 100644
index 0000000..555d0c4
--- /dev/null
+++ b/scripts/electrobunDev.ts
@@ -0,0 +1,32 @@
+/**
+ * Launch Electrobun for local `bun run start` / `bun run dev`.
+ *
+ * On Linux, apply the `views://` paint profile: `WEBKIT_DISABLE_COMPOSITING_MODE=1`
+ * when unset, and `GDK_BACKEND=x11`. An inherited Wayland GDK backend can leave
+ * a blank window while the DOM still mounts (body background only).
+ *
+ * Packaged builds are unchanged. Set `FULVID_KEEP_GDK_BACKEND=1` to skip the
+ * GDK override when deliberately testing Wayland.
+ */
+import { electrobunDevProcessEnv } from "./linuxWebViewEnv";
+
+const electrobunArgs = process.argv.slice(2);
+if (electrobunArgs.length === 0) {
+  throw new Error("Usage: bun run scripts/electrobunDev.ts <electrobun-args...>");
+}
+
+const electrobun = Bun.spawn(["bun", "x", "electrobun", ...electrobunArgs], {
+  stdin: "inherit",
+  stdout: "inherit",
+  stderr: "inherit",
+  env: electrobunDevProcessEnv(process.platform, process.env),
+});
+
+const forwardSignal = (signal: NodeJS.Signals): void => {
+  electrobun.kill(signal);
+};
+
+process.on("SIGINT", () => forwardSignal("SIGINT"));
+process.on("SIGTERM", () => forwardSignal("SIGTERM"));
+
+process.exit(await electrobun.exited);
diff --git a/scripts/linuxWebViewEnv.ts b/scripts/linuxWebViewEnv.ts
new file mode 100644
index 0000000..71b1a1b
--- /dev/null
+++ b/scripts/linuxWebViewEnv.ts
@@ -0,0 +1,60 @@
+/**
+ * Linux WebView launch env for local Electrobun runners.
+ *
+ * `GDK_BACKEND=x11` avoids a blank window when an inherited Wayland GDK
+ * backend paints only the body background. Skip with `FULVID_KEEP_GDK_BACKEND=1`.
+ *
+ * `WEBKIT_DISABLE_COMPOSITING_MODE=1` helps the packaged `views://` path
+ * (`bun run start` / `bun run dev`) against GLXBadWindow. Do **not** enable
+ * it for Vite HMR (`http://127.0.0.1:5173`): on Linux/WebKitGTK that flag
+ * prevents the page JS from evaluating (no `[vite] connected`, white window).
+ */
+export type LinuxWebViewEnvOptions = {
+  /**
+   * When true (default), set `WEBKIT_DISABLE_COMPOSITING_MODE=1` if unset.
+   * Pass false for the HMR HTTP loader path.
+   */
+  disableCompositing?: boolean;
+};
+
+export function linuxWebViewPaintEnv(
+  platform: NodeJS.Platform,
+  env: NodeJS.ProcessEnv,
+  options: LinuxWebViewEnvOptions = {},
+): Record<string, string> {
+  if (platform !== "linux") {
+    return {};
+  }
+
+  const disableCompositing = options.disableCompositing ?? true;
+  const next: Record<string, string> = {};
+
+  if (disableCompositing && env.WEBKIT_DISABLE_COMPOSITING_MODE === undefined) {
+    next.WEBKIT_DISABLE_COMPOSITING_MODE = "1";
+  }
+  if (env.FULVID_KEEP_GDK_BACKEND === undefined) {
+    next.GDK_BACKEND = "x11";
+  }
+
+  return next;
+}
+
+/**
+ * Env object for `Bun.spawn` of local Electrobun runners.
+ * Windows/macOS: copy of `env` unchanged (no Linux paint keys added or removed).
+ * Linux HMR (`disableCompositing: false`): also clears inherited compositing disable.
+ */
+export function electrobunDevProcessEnv(
+  platform: NodeJS.Platform,
+  env: NodeJS.ProcessEnv,
+  options: LinuxWebViewEnvOptions = {},
+): NodeJS.ProcessEnv {
+  const next: NodeJS.ProcessEnv = {
+    ...env,
+    ...linuxWebViewPaintEnv(platform, env, options),
+  };
+  if (platform === "linux" && options.disableCompositing === false) {
+    delete next.WEBKIT_DISABLE_COMPOSITING_MODE;
+  }
+  return next;
+}
diff --git a/scripts/smoke.ts b/scripts/smoke.ts
index cccf401..b1faa14 100644
--- a/scripts/smoke.ts
+++ b/scripts/smoke.ts
@@ -1,8 +1,9 @@
 /**
- * Integration and runtime smoke checks for critical Fulvid flows.
+ * Runtime smoke checks for critical Fulvid flows.
  *
- * Runs real filesystem integration tests, verifies the built shell, and when a
- * display server is available launches the desktop app briefly on Linux.
+ * Re-runs the filesystem editing-loop integration test, verifies the built
+ * shell, and when a display server is available launches the desktop app
+ * briefly on Linux.
  *
  * Run with: bun run smoke
  */
@@ -98,8 +99,8 @@ async function launchDesktopSmoke(): Promise<void> {
 
 console.log("\nFulvid smoke\n");
 
-console.log("-> Integration tests\n");
-run("bun", ["test", "tests/bun/filesystem/io/documentLifecycle.smoke.test.ts"]);
+console.log("-> Filesystem editing loop (integration)\n");
+run("bun", ["test", "tests/bun/filesystem/io/documentLifecycle.integration.test.ts"]);
 
 console.log("\n-> Built shell\n");
 verifyBuiltShell();
diff --git a/src/bun/extensions/discoverExtensions.ts b/src/bun/extensions/discoverExtensions.ts
index cd31752..c0608b5 100644
--- a/src/bun/extensions/discoverExtensions.ts
+++ b/src/bun/extensions/discoverExtensions.ts
@@ -75,7 +75,28 @@ export function getDiscoveredExtensions(): ExtensionDiscoveryResult {
 
 function boundReason(raw: string): string {
   const reason = raw.split(/\r?\n/, 1)[0]?.trim() || raw;
-  return reason.length > 300 ? `${reason.slice(0, 300)}...` : reason;
+  const limit = EXTENSION_PACK_LIMITS.maxFailureReasonChars;
+  return reason.length > limit ? `${reason.slice(0, limit)}...` : reason;
+}
+
+/**
+ * The bounded reason a pack failed, from whichever error type reported it.
+ *
+ * `ExtensionPackError` and `LuaExtensionLoadError` both carry a written reason;
+ * anything else contributes only its message, and `fallback` covers a throw
+ * that is not an Error at all.
+ */
+function extensionFailureReason(error: unknown, fallback: string): string {
+  if (error instanceof ExtensionPackError) {
+    return boundReason(error.reason);
+  }
+  if (error instanceof LuaExtensionLoadError) {
+    return boundReason(error.reason);
+  }
+  if (error instanceof Error) {
+    return boundReason(error.message);
+  }
+  return boundReason(fallback);
 }
 
 function emptyResult(): ExtensionDiscoveryResult {
@@ -380,13 +401,7 @@ export async function installExtensionFromDirectory(
       manifest = await readManifest(sourceReal);
       await preflightEntry(sourceReal, manifest);
     } catch (error) {
-      const reason =
-        error instanceof ExtensionPackError
-          ? error.reason
-          : error instanceof Error
-            ? error.message
-            : "invalid extension pack";
-      return lifecycleError(boundReason(reason));
+      return lifecycleError(extensionFailureReason(error, "invalid extension pack"));
     }
 
     const destination = join(root, manifest.id);
@@ -409,15 +424,9 @@ export async function installExtensionFromDirectory(
     } catch (error) {
       await rm(staging, { recursive: true, force: true }).catch(() => undefined);
       await rm(destination, { recursive: true, force: true }).catch(() => undefined);
-      const reason =
-        error instanceof ExtensionPackError
-          ? error.reason
-          : error instanceof Error
-            ? error.message
-            : "extension install failed";
       return {
         status: "error",
-        reason: boundReason(reason),
+        reason: extensionFailureReason(error, "extension install failed"),
         discovery: await discoverExtensionsUnlocked(),
       };
     }
@@ -455,12 +464,9 @@ export async function uninstallExtensionPack(
     try {
       await rm(packPath, { recursive: true, force: false });
     } catch (error) {
-      const reason = boundReason(
-        error instanceof Error ? error.message : "could not delete extension pack",
-      );
       return {
         status: "error",
-        reason,
+        reason: extensionFailureReason(error, "could not delete extension pack"),
         discovery: await discoverExtensionsUnlocked(),
       };
     }
@@ -577,13 +583,7 @@ async function preloadExtensionPack(
     }
     await preflightEntry(packRoot, manifest);
   } catch (error) {
-    const reason = boundReason(
-      error instanceof ExtensionPackError
-        ? error.reason
-        : error instanceof Error
-          ? error.message
-          : "unknown extension load error",
-    );
+    const reason = extensionFailureReason(error, "unknown extension load error");
     const dot = directoryName.indexOf(".");
     return {
       id: directoryName,
@@ -633,15 +633,7 @@ async function preloadExtensionPack(
       commands,
     };
   } catch (error) {
-    const reason = boundReason(
-      error instanceof ExtensionPackError
-        ? error.reason
-        : error instanceof LuaExtensionLoadError
-          ? error.reason
-          : error instanceof Error
-            ? error.message
-            : "unknown extension load error",
-    );
+    const reason = extensionFailureReason(error, "unknown extension load error");
     return baseDiscovered(manifest, packRoot, "failed", reason);
   }
 }
diff --git a/src/bun/extensions/lua/luaEngine.ts b/src/bun/extensions/lua/luaEngine.ts
index de5c23b..a4aa75d 100644
--- a/src/bun/extensions/lua/luaEngine.ts
+++ b/src/bun/extensions/lua/luaEngine.ts
@@ -8,6 +8,7 @@ import { join } from "node:path";
 
 import { LuaFactory, LuaTimeoutError, type LuaEngine } from "wasmoon";
 
+import { EXTENSION_PACK_LIMITS } from "../../../mainview/extensions/extensionManifest";
 import { luaExecutionBudgetMs, luaMemoryBudgetBytes } from "./luaLimits";
 
 const requireWasmoonAsset = createRequire(import.meta.url);
@@ -105,7 +106,8 @@ export function describeLuaRuntimeFailure(error: unknown): string {
   // wasmoon embeds the chunk text as [string "..."]:line: message - drop the source.
   const withoutChunk = firstLine.replace(/^\[string "[\s\S]*"\]:(\d+):\s*/, "lua:$1: ");
   const bounded = withoutChunk.trim() || "lua runtime failed";
-  return bounded.length > 300 ? `${bounded.slice(0, 300)}...` : bounded;
+  const limit = EXTENSION_PACK_LIMITS.maxFailureReasonChars;
+  return bounded.length > limit ? `${bounded.slice(0, limit)}...` : bounded;
 }
 
 /** Create a reduced guest engine with real execution and memory budgets. */
diff --git a/src/bun/extensions/lua/luaExtensionRuntime.ts b/src/bun/extensions/lua/luaExtensionRuntime.ts
index e5ce5b3..b789909 100644
--- a/src/bun/extensions/lua/luaExtensionRuntime.ts
+++ b/src/bun/extensions/lua/luaExtensionRuntime.ts
@@ -474,6 +474,14 @@ export async function loadLuaExtensionPack(
   }
 }
 
+/**
+ * Run one registered Lua command.
+ *
+ * The RPC handler always passes the request object; a bare `namespacedId` is
+ * accepted so a contract test can invoke a command that needs no editor or
+ * document snapshot. Either way the id and both snapshots are revalidated here -
+ * nothing about the shape of the argument grants anything.
+ */
 export async function invokeLuaExtensionCommand(
   request: LuaInvokeRequest | string,
 ): Promise<LuaInvokeResult> {
diff --git a/src/bun/filesystem/io/documentIo.ts b/src/bun/filesystem/io/documentIo.ts
index 00d50af..c496cc4 100644
--- a/src/bun/filesystem/io/documentIo.ts
+++ b/src/bun/filesystem/io/documentIo.ts
@@ -13,7 +13,7 @@
  * edited even when the folder scan truncated it.
  */
 import { randomUUID } from "node:crypto";
-import { mkdir, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, relative, resolve } from "node:path";
 
 import {
@@ -63,6 +63,9 @@ function assertStandaloneDocumentPath(targetPath: string): string {
   return absolutePath;
 }
 
+/** Longest single filename common filesystems accept. */
+const MAX_BASENAME_LENGTH = 255;
+
 function requireSafeBasename(value: string): string {
   if (typeof value !== "string") {
     throw new WorkspaceBoundaryError("unsafeName");
@@ -70,7 +73,7 @@ function requireSafeBasename(value: string): string {
   // Refuse padded/illegal/reserved names rather than repair them.
   if (
     !value ||
-    value.length > 255 ||
+    value.length > MAX_BASENAME_LENGTH ||
     value.includes("/") ||
     value.includes("\\") ||
     value.includes("\0") ||
@@ -190,6 +193,19 @@ async function assertExpectedMtime(
   }
 }
 
+/** Permission bits of an existing file, or null when nothing is there yet. */
+async function fileModeOrNull(targetPath: string): Promise<number | null> {
+  try {
+    const information = await stat(targetPath);
+    return information.mode & 0o777;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+
 /**
  * Replace `targetPath` by writing a unique temp file (`wx`) then renaming over
  * it. Same-filesystem rename is atomic; it is not compare-and-replace.
@@ -205,12 +221,31 @@ async function assertExpectedMtime(
  */
 async function writeAtomically(targetPath: string, content: string): Promise<void> {
   const temporaryPath = `${targetPath}.${randomUUID()}.tmp`;
+  // The rename installs a new inode, so without this the saved document would
+  // carry the process umask instead of its own permissions: a note kept at 0600
+  // came back 0644, readable by every other account on the machine.
+  //
+  // The mode is set twice on purpose. At creation, so the temp file next to the
+  // document is never wider than the document itself, not even for the moment
+  // before the rename. After, because `open` also subtracts the umask, which
+  // would drop a bit the document legitimately had.
+  const existingMode = await fileModeOrNull(targetPath);
 
   try {
     await writeFile(temporaryPath, content, {
       encoding: "utf8",
       flag: "wx",
+      ...(existingMode === null ? {} : { mode: existingMode }),
     });
+    if (existingMode !== null) {
+      try {
+        await chmod(temporaryPath, existingMode);
+      } catch {
+        // Filesystems that fix permissions at mount time (FAT, some network
+        // shares) refuse chmod, and there the mode was never the document's to
+        // keep. The content still has to reach disk.
+      }
+    }
     await rename(temporaryPath, targetPath);
   } finally {
     await rm(temporaryPath, { force: true });
diff --git a/src/bun/filesystem/scanning/noteAnalyzer.ts b/src/bun/filesystem/scanning/noteAnalyzer.ts
index 770b0da..b551591 100644
--- a/src/bun/filesystem/scanning/noteAnalyzer.ts
+++ b/src/bun/filesystem/scanning/noteAnalyzer.ts
@@ -74,15 +74,33 @@ function countWords(text: string): number {
   return trimmed.split(/\s+/).length;
 }
 
+/** Longest UTF-8 encoding, so only the final few bytes can be a partial sequence. */
+const MAX_UTF8_SEQUENCE_BYTES = 4;
+
+/** How many bytes the sequence starting at this lead byte occupies. */
+function utf8SequenceLength(leadByte: number): number {
+  if (leadByte >= 0xf0) {
+    return 4;
+  }
+  if (leadByte >= 0xe0) {
+    return 3;
+  }
+  if (leadByte >= 0xc0) {
+    return 2;
+  }
+  return 1;
+}
+
 /** Drop a trailing partial UTF-8 sequence left by a byte-level cut. */
 function trimPartialUtf8(bytes: Uint8Array): Uint8Array {
-  for (let index = bytes.length - 1; index >= 0 && index > bytes.length - 5; index -= 1) {
+  const firstPossibleLead = bytes.length - MAX_UTF8_SEQUENCE_BYTES;
+  for (let index = bytes.length - 1; index >= 0 && index >= firstPossibleLead; index -= 1) {
     const byte = bytes[index];
     if ((byte & 0b1100_0000) === 0b1000_0000) {
       continue;
     }
     // A lead byte: keep its sequence only when all of it was read.
-    const expected = byte < 0x80 ? 1 : byte >= 0xf0 ? 4 : byte >= 0xe0 ? 3 : byte >= 0xc0 ? 2 : 1;
+    const expected = utf8SequenceLength(byte);
     return bytes.length - index >= expected ? bytes : bytes.subarray(0, index);
   }
   return bytes;
diff --git a/src/bun/filesystem/scanning/scanDirectory.ts b/src/bun/filesystem/scanning/scanDirectory.ts
index 41c82ad..0146376 100644
--- a/src/bun/filesystem/scanning/scanDirectory.ts
+++ b/src/bun/filesystem/scanning/scanDirectory.ts
@@ -64,6 +64,22 @@ export type ScanOptions = {
  */
 export const MAX_SCANNED_DOCUMENTS = 5_000;
 const MAX_SCAN_DEPTH = 24;
+/**
+ * Total document body one scan may hand the renderer, in UTF-16 code units of
+ * `ScannedNote.content`.
+ *
+ * The document count alone does not bound memory: every note carries its body
+ * for Search, capped per file at `MAX_ANALYZED_BYTES` (2 MiB), so the count
+ * ceiling on its own permits gigabytes across one RPC reply. This keeps the
+ * aggregate in the same order as the folders Fulvid is for, and a folder past it
+ * is reported as partial through `truncated` instead of loading silently.
+ *
+ * It bounds body text, which is what dominates a reply; the parsed metadata
+ * beside it stays bounded by the per-file analysis cap and the document count.
+ * The budget is checked before each note, so the notes that load are always
+ * whole and a reply can exceed it by at most one note's body.
+ */
+const MAX_SCANNED_CONTENT_CHARS = 128 * 1024 * 1024;
 
 type MarkdownPathCollection = {
   paths: string[];
@@ -179,6 +195,12 @@ export async function scanWorkspace(
   testFaults?: {
     beforeReadDirectory?: (directory: string) => void | Promise<void>;
     beforeAnalyzeFile?: (filePath: string) => void | Promise<void>;
+    /**
+     * Lower the content budget so a test can reach it without writing 128 MiB.
+     * Clamped with `Math.min`: this seam can only tighten the ceiling, never
+     * widen it, and no RPC handler passes this argument.
+     */
+    contentBudgetChars?: number;
   },
 ): Promise<{ scannedNotes: ScannedNote[]; truncated: boolean; skipped: number }> {
   const linkMode = options.linkMode ?? "markdown";
@@ -193,11 +215,25 @@ export async function scanWorkspace(
   collected.paths.sort(compareDocumentPaths);
   const scannedNotes: ScannedNote[] = [];
   let skipped = collected.skipped;
+  let truncated = collected.truncated;
+  let analyzedChars = 0;
+  const contentBudget = Math.min(
+    MAX_SCANNED_CONTENT_CHARS,
+    testFaults?.contentBudgetChars ?? MAX_SCANNED_CONTENT_CHARS,
+  );
 
   for (const entryPath of collected.paths) {
+    if (analyzedChars >= contentBudget) {
+      // The folder holds more text than one scan may carry. Stop here and say
+      // so: the notes already collected stay usable.
+      truncated = true;
+      break;
+    }
     try {
       await testFaults?.beforeAnalyzeFile?.(entryPath);
-      scannedNotes.push(await scannedNoteFromFile(rootPath, entryPath, linkMode));
+      const note = await scannedNoteFromFile(rootPath, entryPath, linkMode);
+      analyzedChars += note.content?.length ?? 0;
+      scannedNotes.push(note);
     } catch (error) {
       if (!isSkippableScanError(error)) {
         throw error;
@@ -208,7 +244,7 @@ export async function scanWorkspace(
     }
   }
 
-  return { scannedNotes, truncated: collected.truncated, skipped };
+  return { scannedNotes, truncated, skipped };
 }
 
 /** List the supported filesystem entries directly under a workspace folder. */
diff --git a/src/bun/index.ts b/src/bun/index.ts
index 6646b75..ccdb233 100644
--- a/src/bun/index.ts
+++ b/src/bun/index.ts
@@ -161,6 +161,11 @@ mainWindowHolder.window.on("will-close", (event: unknown) => {
   mainRPC.send.windowCloseRequested({});
 });
 
+// Electrobun 2.0.1 emits no move/resize event, so the frame is sampled instead.
+// Often enough that a normal quit keeps the last placement, rare enough that an
+// idle window is not writing to userData constantly.
+const WINDOW_FRAME_SAMPLE_MS = 2_500;
+
 setInterval(() => {
   try {
     const mainWindow = mainWindowHolder.window;
@@ -170,6 +175,6 @@ setInterval(() => {
   } catch {
     // Window may be closing.
   }
-}, 2500);
+}, WINDOW_FRAME_SAMPLE_MS);
 
 console.log("Fulvid started");
diff --git a/src/mainview/app/App.vue b/src/mainview/app/App.vue
index 941660d..315e256 100644
--- a/src/mainview/app/App.vue
+++ b/src/mainview/app/App.vue
@@ -23,7 +23,7 @@ import {
   workspaceName,
   validatedFocus,
 } from "./workspaceState";
-import { APP_ROUTE_NAMES } from "./router";
+import { APP_ROUTE_NAMES, type AppRouteName } from "./router";
 import { notify } from "./notify";
 import ToastHost from "./ToastHost.vue";
 import DialogHost from "./DialogHost.vue";
@@ -42,6 +42,7 @@ import {
   openOrActivate,
   selectDocument,
 } from "../modules/editor/document/documentBuffers";
+import { adjacentOpenDocumentIndex } from "../modules/editor/editorTabNavigation";
 import {
   documentTemplateTitleFromParentPath,
   renderDocumentTemplate,
@@ -53,11 +54,7 @@ import {
   documentLocationFromBuffer,
   windowTitleForDocumentLocation,
 } from "../modules/editor/document/documentLocation";
-import {
-  activeId,
-  nextMruDocument,
-  pendingReveal,
-} from "../modules/editor/document/documentSession";
+import { activeId, pendingReveal } from "../modules/editor/document/documentSession";
 import {
   closeInspector,
   inspectorOpen,
@@ -66,10 +63,12 @@ import {
   peekDocument,
 } from "../modules/workspace/focus/focusState";
 import { isTextEntryTarget } from "./isTypingTarget";
+import { isTabKey } from "./isTabKey";
 import {
   closeLeftSidebar,
   closeRightSidebar,
   CONTEXTUAL_WIDTH_LIMITS,
+  LAYOUT_RESIZE_STEP_PX,
   leftSidebarOpen,
   layout,
   openLeftSidebar,
@@ -352,11 +351,10 @@ function closeContextPanel(): void {
 
 function activateAdjacentDocument(direction: -1 | 1): void {
   const currentIndex = openBuffers.value.findIndex((buffer) => buffer.id === activeId.value);
-  if (currentIndex < 0 || openBuffers.value.length < 2) {
+  const nextIndex = adjacentOpenDocumentIndex(currentIndex, direction, openBuffers.value.length);
+  if (nextIndex === null) {
     return;
   }
-  const nextIndex =
-    (currentIndex + direction + openBuffers.value.length) % openBuffers.value.length;
   const nextBuffer = openBuffers.value[nextIndex];
   if (!nextBuffer) {
     return;
@@ -364,16 +362,6 @@ function activateAdjacentDocument(direction: -1 | 1): void {
   selectDocument(nextBuffer.id);
 }
 
-function activateMruDocument(direction: 1 | -1): void {
-  const nextId = nextMruDocument(direction);
-  if (!nextId) {
-    activateAdjacentDocument(direction);
-    return;
-  }
-  // No-op when the id is no longer open.
-  selectDocument(nextId);
-}
-
 function overlayFocusableElements(): HTMLElement[] {
   return [
     ...document.querySelectorAll<HTMLElement>(
@@ -387,6 +375,9 @@ function overlayFocusableElements(): HTMLElement[] {
   );
 }
 
+/** Ctrl/Cmd chords the native application menu owns when it draws the bar itself. */
+const NATIVE_MENU_ACCELERATOR_KEYS = new Set(["n", "o", "s", "w", "f", "h", "p"]);
+
 function handleModifierShortcut(event: KeyboardEvent, insideMonaco: boolean): boolean {
   const modifier = event.metaKey || event.ctrlKey;
   if (!modifier) {
@@ -402,11 +393,14 @@ function handleModifierShortcut(event: KeyboardEvent, insideMonaco: boolean): bo
   }
 
   const key = event.key.toLowerCase();
+  // A native menu bar already delivers its own accelerators, so handling these
+  // here too would run the command twice. The HTML fallback bar draws no
+  // accelerators, so on that platform this handler stays the only route.
   if (
     usesNativeApplicationMenu() &&
     !event.shiftKey &&
     !event.altKey &&
-    ["n", "o", "s", "w", "f", "h", "p"].includes(key)
+    NATIVE_MENU_ACCELERATOR_KEYS.has(key)
   ) {
     return false;
   }
@@ -459,9 +453,9 @@ function handleModifierShortcut(event: KeyboardEvent, insideMonaco: boolean): bo
     void runCommand("openFile");
     return true;
   }
-  if (event.key === "Tab") {
+  if (isTabKey(event)) {
     event.preventDefault();
-    activateMruDocument(event.shiftKey ? -1 : 1);
+    activateAdjacentDocument(event.shiftKey ? -1 : 1);
     return true;
   }
   if (event.key === "PageDown") {
@@ -483,7 +477,7 @@ function handleModifierShortcut(event: KeyboardEvent, insideMonaco: boolean): bo
 }
 
 function trapOverlayTab(event: KeyboardEvent): boolean {
-  if (!overlayOpen.value || event.key !== "Tab") {
+  if (!overlayOpen.value || !isTabKey(event)) {
     return false;
   }
 
@@ -507,33 +501,28 @@ function trapOverlayTab(event: KeyboardEvent): boolean {
   return true;
 }
 
+/** Unmodified digits that jump straight to a route. */
+const ROUTE_BY_NAVIGATION_DIGIT = new Map<string, AppRouteName>([
+  ["1", APP_ROUTE_NAMES.editor],
+  ["2", APP_ROUTE_NAMES.search],
+  ["3", APP_ROUTE_NAMES.graph],
+]);
+
 function handleNavigationShortcut(event: KeyboardEvent): boolean {
-  const key = event.key.toLowerCase();
-  if (
-    event.metaKey ||
-    event.ctrlKey ||
-    event.altKey ||
-    isTextEntryTarget(event.target) ||
-    !["/", "1", "2", "3", "i", "g"].includes(key)
-  ) {
+  if (event.metaKey || event.ctrlKey || event.altKey || isTextEntryTarget(event.target)) {
     return false;
   }
 
+  const key = event.key.toLowerCase();
   if (key === "/") {
     event.preventDefault();
     openGlobalSearch();
     return true;
   }
-  if (key === "1" || key === "2" || key === "3") {
+  const digitRoute = ROUTE_BY_NAVIGATION_DIGIT.get(key);
+  if (digitRoute) {
     event.preventDefault();
-    void router.push({
-      name:
-        key === "1"
-          ? APP_ROUTE_NAMES.editor
-          : key === "2"
-            ? APP_ROUTE_NAMES.search
-            : APP_ROUTE_NAMES.graph,
-    });
+    void router.push({ name: digitRoute });
     return true;
   }
   if (key === "i") {
@@ -548,9 +537,12 @@ function handleNavigationShortcut(event: KeyboardEvent): boolean {
     }
     return true;
   }
-  event.preventDefault();
-  void router.push({ name: APP_ROUTE_NAMES.graph });
-  return true;
+  if (key === "g") {
+    event.preventDefault();
+    void router.push({ name: APP_ROUTE_NAMES.graph });
+    return true;
+  }
+  return false;
 }
 
 function closePanelsOnEscape(event: KeyboardEvent): boolean {
@@ -1303,8 +1295,10 @@ onBeforeUnmount(() => {
           :aria-valuemin="CONTEXTUAL_WIDTH_LIMITS.min"
           :aria-valuemax="CONTEXTUAL_WIDTH_LIMITS.max"
           @pointerdown="startContextualResize"
-          @keydown.left.prevent="setContextualWidth(layout.contextualWidth + 8)"
-          @keydown.right.prevent="setContextualWidth(layout.contextualWidth - 8)"
+          @keydown.left.prevent="setContextualWidth(layout.contextualWidth + LAYOUT_RESIZE_STEP_PX)"
+          @keydown.right.prevent="
+            setContextualWidth(layout.contextualWidth - LAYOUT_RESIZE_STEP_PX)
+          "
         />
         <header class="app-shell__panel-header">
           <span class="app-shell__panel-title">{{ contextPanelLabel }}</span>
diff --git a/src/mainview/app/isTabKey.ts b/src/mainview/app/isTabKey.ts
new file mode 100644
index 0000000..f8f4ff6
--- /dev/null
+++ b/src/mainview/app/isTabKey.ts
@@ -0,0 +1,10 @@
+/**
+ * Tab identity for shortcut handlers.
+ *
+ * Some WebKit builds report Shift+Tab / Ctrl+Shift+Tab as
+ * `key: "ISO_Left_Tab"` while `code` stays `"Tab"`. Matching only `"Tab"`
+ * drops those chords; `code === "Tab"` covers layout-specific `key` values.
+ */
+export function isTabKey(event: Pick<KeyboardEvent, "key" | "code">): boolean {
+  return event.key === "Tab" || event.key === "ISO_Left_Tab" || event.code === "Tab";
+}
diff --git a/src/mainview/app/layoutStore.ts b/src/mainview/app/layoutStore.ts
index 4ae7aa4..59b0a9f 100644
--- a/src/mainview/app/layoutStore.ts
+++ b/src/mainview/app/layoutStore.ts
@@ -9,18 +9,25 @@ import { computed, ref, watch } from "vue";
 
 const STORAGE_KEY = "fulvid.layout.v1";
 
-const SIDEBAR_MIN = 200;
-const SIDEBAR_MAX = 360;
-const SIDEBAR_DEFAULT = 252;
-const INSPECTOR_MIN = 260;
-const INSPECTOR_MAX = 440;
-const INSPECTOR_DEFAULT = 320;
-const CONTEXTUAL_MIN = 260;
-const CONTEXTUAL_MAX = 440;
-const CONTEXTUAL_DEFAULT = 320;
-const PREVIEW_MIN = 0.25;
-const PREVIEW_MAX = 0.65;
-const PREVIEW_DEFAULT = 0.42;
+/**
+ * One resizable dimension: the bounds it is clamped to and the width it starts
+ * at. Declared once so a sanitize fallback, a setter, and the slider a surface
+ * exposes cannot drift apart.
+ */
+type LayoutRange = {
+  readonly min: number;
+  readonly max: number;
+  readonly default: number;
+};
+
+export const SIDEBAR_WIDTH_LIMITS: LayoutRange = { min: 200, max: 360, default: 252 };
+export const INSPECTOR_WIDTH_LIMITS: LayoutRange = { min: 260, max: 440, default: 320 };
+export const CONTEXTUAL_WIDTH_LIMITS: LayoutRange = { min: 260, max: 440, default: 320 };
+/** Fraction of the editor pane given to Preview, not a pixel width. */
+export const PREVIEW_RATIO_LIMITS: LayoutRange = { min: 0.25, max: 0.65, default: 0.42 };
+
+/** Arrow-key step for every width resize handle. */
+export const LAYOUT_RESIZE_STEP_PX = 8;
 
 /** Shell collapses sidebars/overlays at this width. Keep CSS `@media` in sync. */
 export const NARROW_VIEWPORT_MAX_PX = 900;
@@ -41,28 +48,19 @@ function clamp(value: number, min: number, max: number): number {
   return Number.isFinite(value) ? Math.min(max, Math.max(min, value)) : min;
 }
 
-function clampedNumber(value: unknown, fallback: number, min: number, max: number): number {
-  return clamp(typeof value === "number" ? value : fallback, min, max);
+/** A persisted width or ratio held inside its range, otherwise the default. */
+function clampedNumber(value: unknown, range: LayoutRange): number {
+  return clamp(typeof value === "number" ? value : range.default, range.min, range.max);
 }
 
 function sanitize(value: unknown): LayoutIntent {
   const source = value && typeof value === "object" ? (value as Partial<LayoutIntent>) : {};
 
   return {
-    sidebarWidth: clampedNumber(source.sidebarWidth, SIDEBAR_DEFAULT, SIDEBAR_MIN, SIDEBAR_MAX),
-    inspectorWidth: clampedNumber(
-      source.inspectorWidth,
-      INSPECTOR_DEFAULT,
-      INSPECTOR_MIN,
-      INSPECTOR_MAX,
-    ),
-    contextualWidth: clampedNumber(
-      source.contextualWidth,
-      CONTEXTUAL_DEFAULT,
-      CONTEXTUAL_MIN,
-      CONTEXTUAL_MAX,
-    ),
-    previewRatio: clampedNumber(source.previewRatio, PREVIEW_DEFAULT, PREVIEW_MIN, PREVIEW_MAX),
+    sidebarWidth: clampedNumber(source.sidebarWidth, SIDEBAR_WIDTH_LIMITS),
+    inspectorWidth: clampedNumber(source.inspectorWidth, INSPECTOR_WIDTH_LIMITS),
+    contextualWidth: clampedNumber(source.contextualWidth, CONTEXTUAL_WIDTH_LIMITS),
+    previewRatio: clampedNumber(source.previewRatio, PREVIEW_RATIO_LIMITS),
     leftSidebarOpen: typeof source.leftSidebarOpen === "boolean" ? source.leftSidebarOpen : true,
     rightSidebar:
       source.rightSidebar === "explorer" ||
@@ -100,26 +98,6 @@ export const rightSidebar = computed<RightSidebar>({
   },
 });
 
-export const SIDEBAR_WIDTH_LIMITS = {
-  min: SIDEBAR_MIN,
-  max: SIDEBAR_MAX,
-} as const;
-
-export const INSPECTOR_WIDTH_LIMITS = {
-  min: INSPECTOR_MIN,
-  max: INSPECTOR_MAX,
-} as const;
-
-export const CONTEXTUAL_WIDTH_LIMITS = {
-  min: CONTEXTUAL_MIN,
-  max: CONTEXTUAL_MAX,
-} as const;
-
-export const PREVIEW_RATIO_LIMITS = {
-  min: PREVIEW_MIN,
-  max: PREVIEW_MAX,
-} as const;
-
 function applyLayout(intent: LayoutIntent): void {
   if (typeof document === "undefined") {
     return;
@@ -133,28 +111,28 @@ function applyLayout(intent: LayoutIntent): void {
 export function setSidebarWidth(width: number): void {
   layout.value = {
     ...layout.value,
-    sidebarWidth: clamp(width, SIDEBAR_MIN, SIDEBAR_MAX),
+    sidebarWidth: clamp(width, SIDEBAR_WIDTH_LIMITS.min, SIDEBAR_WIDTH_LIMITS.max),
   };
 }
 
 export function setInspectorWidth(width: number): void {
   layout.value = {
     ...layout.value,
-    inspectorWidth: clamp(width, INSPECTOR_MIN, INSPECTOR_MAX),
+    inspectorWidth: clamp(width, INSPECTOR_WIDTH_LIMITS.min, INSPECTOR_WIDTH_LIMITS.max),
   };
 }
 
 export function setContextualWidth(width: number): void {
   layout.value = {
     ...layout.value,
-    contextualWidth: clamp(width, CONTEXTUAL_MIN, CONTEXTUAL_MAX),
+    contextualWidth: clamp(width, CONTEXTUAL_WIDTH_LIMITS.min, CONTEXTUAL_WIDTH_LIMITS.max),
   };
 }
 
 export function setPreviewRatio(ratio: number): void {
   layout.value = {
     ...layout.value,
-    previewRatio: clamp(ratio, PREVIEW_MIN, PREVIEW_MAX),
+    previewRatio: clamp(ratio, PREVIEW_RATIO_LIMITS.min, PREVIEW_RATIO_LIMITS.max),
   };
 }
 
diff --git a/src/mainview/extensions/extensionManifest.ts b/src/mainview/extensions/extensionManifest.ts
index bdfb910..cf77f9c 100644
--- a/src/mainview/extensions/extensionManifest.ts
+++ b/src/mainview/extensions/extensionManifest.ts
@@ -66,6 +66,19 @@ export const EXTENSION_PACK_LIMITS = {
   maxKeywordChars: 32,
   maxLicenseChars: 64,
   maxUrlChars: 500,
+  /** Author string, or each field of the author object. */
+  maxAuthorChars: 200,
+  /** Menu placements one pack may declare - matches `maxCommandsPerExtension`. */
+  maxActions: 16,
+  /** Placement title override - matches the Lua `maxCommandTitleChars` budget. */
+  maxActionTitleChars: 200,
+  /** Placement sort key: a bounded integer, not an arbitrary number. */
+  maxActionOrder: 10_000,
+  /**
+   * Load/invoke failure reason shown in Settings. Bounded so a guest error, a
+   * traceback, or a pasted source line cannot become the inventory row.
+   */
+  maxFailureReasonChars: 300,
 } as const;
 
 /**
@@ -287,7 +300,7 @@ function parseAuthor(
 ): { ok: true; author: ExtensionAuthor } | { ok: false; reason: string } {
   if (typeof value === "string") {
     const trimmed = value.trim();
-    if (trimmed.length === 0 || trimmed.length > 200) {
+    if (trimmed.length === 0 || trimmed.length > EXTENSION_PACK_LIMITS.maxAuthorChars) {
       return { ok: false, reason: "invalid author" };
     }
     return { ok: true, author: trimmed };
@@ -295,7 +308,7 @@ function parseAuthor(
   if (!isRecord(value) || typeof value.name !== "string" || value.name.trim().length === 0) {
     return { ok: false, reason: "invalid author" };
   }
-  if (value.name.length > 200) {
+  if (value.name.length > EXTENSION_PACK_LIMITS.maxAuthorChars) {
     return { ok: false, reason: "author exceeds size limit" };
   }
   const author: { name: string; email?: string; url?: string } = { name: value.name.trim() };
@@ -303,7 +316,7 @@ function parseAuthor(
     if (
       typeof value.email !== "string" ||
       value.email.trim().length === 0 ||
-      value.email.length > 200
+      value.email.length > EXTENSION_PACK_LIMITS.maxAuthorChars
     ) {
       return { ok: false, reason: "invalid author email" };
     }
@@ -477,7 +490,7 @@ export function validateExtensionManifest(value: unknown): ManifestValidationRes
     if (!Array.isArray(value.actions)) {
       return { reason: "actions must be an array" };
     }
-    if (value.actions.length > 16) {
+    if (value.actions.length > EXTENSION_PACK_LIMITS.maxActions) {
       return { reason: "too many actions" };
     }
     const seenActionIds = new Set<string>();
@@ -512,7 +525,7 @@ export function validateExtensionManifest(value: unknown): ManifestValidationRes
           typeof rawAction.order !== "number" ||
           !Number.isInteger(rawAction.order) ||
           rawAction.order < 0 ||
-          rawAction.order > 10_000
+          rawAction.order > EXTENSION_PACK_LIMITS.maxActionOrder
         ) {
           return { reason: "invalid action order: integer 0..10000 required" };
         }
@@ -522,7 +535,7 @@ export function validateExtensionManifest(value: unknown): ManifestValidationRes
         if (typeof rawAction.title !== "string" || rawAction.title.trim().length === 0) {
           return { reason: "invalid action title: non-empty string required" };
         }
-        if (rawAction.title.length > 200) {
+        if (rawAction.title.length > EXTENSION_PACK_LIMITS.maxActionTitleChars) {
           return { reason: "action title exceeds size limit" };
         }
         placement.title = rawAction.title.trim();
diff --git a/src/mainview/i18n/de.ts b/src/mainview/i18n/de.ts
index a8fbf0c..1dbc7ac 100644
--- a/src/mainview/i18n/de.ts
+++ b/src/mainview/i18n/de.ts
@@ -704,7 +704,11 @@ export default {
     shortcutSaveAs: "Das aktive Dokument als neue Datei speichern",
     shortcutClose: "Den aktiven Tab schließen",
     shortcutCloseOthers: "Alle anderen Tabs schließen",
-    shortcutTabs: "Zwischen geöffneten Dokument-Tabs wechseln",
+    shortcutTabs: "Den nächsten oder vorherigen geöffneten Tab in Tab-Reihenfolge aktivieren",
+    shortcutTabsOrder: "Den nächsten oder vorherigen geöffneten Tab in Tab-Reihenfolge aktivieren",
+    shortcutTabList:
+      "Den vorherigen oder nächsten Tab aktivieren, wenn der Tab-Streifen fokussiert ist",
+    shortcutMoveTab: "Den fokussierten Dokument-Tab nach links oder rechts verschieben",
     shortcutContext: "Dokumentkontext für das ausgewählte Dokument öffnen (I).",
     shortcutGraph: "Wo ist dieses Dokument?",
     shortcutEscape:
@@ -733,7 +737,7 @@ export default {
     sponsorHint: "Öffnet die GitHub-Sponsors-Seite in deinem Browser.",
     locale: "Sprache",
     localeHint:
-      "Ändert Menüs, Einstellungen und Meldungen in Fulvid sofort. Deine Dokumente bleiben in der Sprache, in der du sie geschrieben hast.",
+      "System folgt der Betriebssystemsprache, wenn Fulvid sie unterstützt; sonst Englisch. Eine hier gewählte Sprache bleibt erhalten. Deine Dokumente bleiben in der Sprache, in der du sie geschrieben hast.",
     english: "English",
     spanish: "Español",
     german: "Deutsch",
@@ -854,7 +858,7 @@ export default {
     missingAnchor: 'Die Überschrift "{anchor}" existiert in diesem Dokument nicht.',
     candidates: "Mögliche Treffer: {items}",
     alsoMatches: "Passt ebenfalls: {items}",
-    open: "{path} öffnen",
+    open: "Öffnen",
     unresolvedTitle: "Dieser Link passt zu keinem Dokument",
     heading: "Überschrift #{anchor}: {status}",
     missingAnchorStatus: "fehlt",
diff --git a/src/mainview/i18n/en.ts b/src/mainview/i18n/en.ts
index 85db088..2977e4c 100644
--- a/src/mainview/i18n/en.ts
+++ b/src/mainview/i18n/en.ts
@@ -690,7 +690,10 @@ export default {
     shortcutSaveAs: "Save the active document as a new file",
     shortcutClose: "Close the active tab",
     shortcutCloseOthers: "Close every other tab",
-    shortcutTabs: "Move between open document tabs",
+    shortcutTabs: "Activate the next or previous open tab in tab order",
+    shortcutTabsOrder: "Activate the next or previous open tab in tab order",
+    shortcutTabList: "Activate the previous or next tab when the tab strip is focused",
+    shortcutMoveTab: "Move the focused open document tab left or right",
     shortcutContext: "Open Document Context for the selected document (I).",
     shortcutGraph: "Where is this document?",
     shortcutEscape:
@@ -717,7 +720,7 @@ export default {
     sponsorHint: "Opens the GitHub Sponsors page in your browser.",
     locale: "Language",
     localeHint:
-      "Changes Fulvid's menus, Settings, and messages right away. Your documents stay in whatever language you wrote them in.",
+      "System follows your operating system language when Fulvid supports it; otherwise English. Choosing a language here keeps that choice. Your documents stay in whatever language you wrote them in.",
     english: "English",
     spanish: "Español",
     german: "Deutsch",
@@ -835,7 +838,7 @@ export default {
     missingAnchor: 'Heading "{anchor}" does not exist in that document.',
     candidates: "Possible matches: {items}",
     alsoMatches: "Also matches: {items}",
-    open: "Open {path}",
+    open: "Open",
     unresolvedTitle: "This link does not match a document",
     heading: "Heading #{anchor}: {status}",
     missingAnchorStatus: "missing",
diff --git a/src/mainview/i18n/es.ts b/src/mainview/i18n/es.ts
index c55ca51..a009229 100644
--- a/src/mainview/i18n/es.ts
+++ b/src/mainview/i18n/es.ts
@@ -701,7 +701,11 @@ export default {
     shortcutSaveAs: "Guardar el documento activo como archivo nuevo",
     shortcutClose: "Cerrar la pestaña activa",
     shortcutCloseOthers: "Cerrar todas las demás pestañas",
-    shortcutTabs: "Moverse entre documentos abiertos",
+    shortcutTabs: "Activar la pestaña abierta siguiente o anterior en el orden de pestañas",
+    shortcutTabsOrder: "Activar la pestaña abierta siguiente o anterior en el orden de pestañas",
+    shortcutTabList:
+      "Activar la pestaña anterior o siguiente cuando la franja de pestañas tiene el foco",
+    shortcutMoveTab: "Mover a izquierda o derecha la pestaña del documento enfocada",
     shortcutContext: "Abrir el contexto del documento seleccionado (I).",
     shortcutGraph: "¿Dónde está este documento?",
     shortcutEscape:
@@ -729,7 +733,7 @@ export default {
     sponsorHint: "Abre la página de GitHub Sponsors en tu navegador.",
     locale: "Idioma",
     localeHint:
-      "Cambia al momento los menús, Ajustes y mensajes de Fulvid. Tus documentos se quedan en el idioma en que los escribiste.",
+      "Sistema sigue el idioma del sistema operativo si Fulvid lo admite; si no, inglés. Una elección aquí se conserva. Tus documentos se quedan en el idioma en que los escribiste.",
     english: "English",
     spanish: "Español",
     german: "Deutsch",
@@ -851,7 +855,7 @@ export default {
     missingAnchor: 'El encabezado "{anchor}" no existe en ese documento.',
     candidates: "Posibles coincidencias: {items}",
     alsoMatches: "También coincide con: {items}",
-    open: "Abrir {path}",
+    open: "Abrir",
     unresolvedTitle: "Este enlace no coincide con un documento",
     heading: "Encabezado #{anchor}: {status}",
     missingAnchorStatus: "ausente",
diff --git a/src/mainview/i18n/fr.ts b/src/mainview/i18n/fr.ts
index 069bcb7..46d1861 100644
--- a/src/mainview/i18n/fr.ts
+++ b/src/mainview/i18n/fr.ts
@@ -711,7 +711,10 @@ export default {
     shortcutSaveAs: "Enregistrer le document actif dans un nouveau fichier",
     shortcutClose: "Fermer l'onglet actif",
     shortcutCloseOthers: "Fermer tous les autres onglets",
-    shortcutTabs: "Passer d'un onglet de document ouvert à l'autre",
+    shortcutTabs: "Activer l'onglet ouvert suivant ou précédent dans l'ordre des onglets",
+    shortcutTabsOrder: "Activer l'onglet ouvert suivant ou précédent dans l'ordre des onglets",
+    shortcutTabList: "Activer l'onglet précédent ou suivant lorsque la barre d'onglets a le focus",
+    shortcutMoveTab: "Déplacer l'onglet de document focalisé vers la gauche ou la droite",
     shortcutContext: "Ouvrir le Contexte du document sélectionné (I).",
     shortcutGraph: "Où est ce document ?",
     shortcutEscape:
@@ -739,7 +742,7 @@ export default {
     sponsorHint: "Ouvre la page GitHub Sponsors dans votre navigateur.",
     locale: "Langue",
     localeHint:
-      "Modifie immédiatement les menus, paramètres et messages de Fulvid. Vos documents restent dans la langue dans laquelle vous les avez écrits.",
+      "Système suit la langue du système d'exploitation lorsque Fulvid la prend en charge ; sinon l'anglais. Un choix ici est conservé. Vos documents restent dans la langue dans laquelle vous les avez écrits.",
     english: "English",
     spanish: "Español",
     german: "Deutsch",
@@ -860,7 +863,7 @@ export default {
     missingAnchor: 'Le titre "{anchor}" n\'existe pas dans ce document.',
     candidates: "Correspondances possibles : {items}",
     alsoMatches: "Correspond aussi : {items}",
-    open: "Ouvrir {path}",
+    open: "Ouvrir",
     unresolvedTitle: "Ce lien ne correspond à aucun document",
     heading: "Titre #{anchor} : {status}",
     missingAnchorStatus: "manquant",
diff --git a/src/mainview/i18n/index.ts b/src/mainview/i18n/index.ts
index 7a54c0f..4117258 100644
--- a/src/mainview/i18n/index.ts
+++ b/src/mainview/i18n/index.ts
@@ -1,5 +1,7 @@
 /**
- * Locale runtime. Catalogs are static modules; `settings.locale` is the source of truth.
+ * Locale runtime. Catalogs are static modules; `settings.locale` is the
+ * preference source of truth. Active UI locale is resolved before mount:
+ * explicit preference -> supported OS language -> English.
  */
 import { createI18n } from "vue-i18n";
 import { watch } from "vue";
@@ -12,10 +14,13 @@ import fr from "./fr";
 import it from "./it";
 import nl from "./nl";
 import pt from "./pt";
+import { readOsLocaleTags, resolveLocalePreference } from "./resolveLocale";
+
+const initialLocale = resolveLocalePreference(settings.value.locale, readOsLocaleTags());
 
 export const i18n = createI18n({
   legacy: false,
-  locale: settings.value.locale,
+  locale: initialLocale,
   fallbackLocale: "en",
   messages: {
     de,
@@ -30,7 +35,8 @@ export const i18n = createI18n({
 
 watch(
   () => settings.value.locale,
-  (locale) => {
+  (preference) => {
+    const locale = resolveLocalePreference(preference, readOsLocaleTags());
     i18n.global.locale.value = locale;
     if (typeof document !== "undefined") {
       document.documentElement.lang = locale;
diff --git a/src/mainview/i18n/it.ts b/src/mainview/i18n/it.ts
index ec907e4..b09837b 100644
--- a/src/mainview/i18n/it.ts
+++ b/src/mainview/i18n/it.ts
@@ -704,7 +704,11 @@ export default {
     shortcutSaveAs: "Salva il documento attivo come nuovo file",
     shortcutClose: "Chiudi la scheda attiva",
     shortcutCloseOthers: "Chiudi tutte le altre schede",
-    shortcutTabs: "Spostati tra le schede dei documenti aperti",
+    shortcutTabs: "Attiva la scheda aperta successiva o precedente nell'ordine delle schede",
+    shortcutTabsOrder: "Attiva la scheda aperta successiva o precedente nell'ordine delle schede",
+    shortcutTabList:
+      "Attiva la scheda precedente o successiva quando la barra delle schede ha il focus",
+    shortcutMoveTab: "Sposta a sinistra o a destra la scheda del documento focalizzata",
     shortcutContext: "Apri il Contesto del documento selezionato (I).",
     shortcutGraph: "Dov'è questo documento?",
     shortcutEscape:
@@ -731,7 +735,7 @@ export default {
     sponsorHint: "Apre la pagina GitHub Sponsors nel browser.",
     locale: "Lingua",
     localeHint:
-      "Cambia subito menu, Impostazioni e messaggi di Fulvid. I documenti restano nella lingua in cui li hai scritti.",
+      "Sistema segue la lingua del sistema operativo se Fulvid la supporta; altrimenti l'inglese. Una scelta qui viene mantenuta. I documenti restano nella lingua in cui li hai scritti.",
     english: "English",
     spanish: "Español",
     german: "Deutsch",
@@ -852,7 +856,7 @@ export default {
     missingAnchor: 'Il titolo "{anchor}" non esiste in quel documento.',
     candidates: "Possibili corrispondenze: {items}",
     alsoMatches: "Corrisponde anche: {items}",
-    open: "Apri {path}",
+    open: "Apri",
     unresolvedTitle: "Questo collegamento non corrisponde a un documento",
     heading: "Titolo #{anchor}: {status}",
     missingAnchorStatus: "mancante",
diff --git a/src/mainview/i18n/nl.ts b/src/mainview/i18n/nl.ts
index bf0fa8e..8f8d03a 100644
--- a/src/mainview/i18n/nl.ts
+++ b/src/mainview/i18n/nl.ts
@@ -703,7 +703,11 @@ export default {
     shortcutSaveAs: "Het actieve document als nieuw bestand opslaan",
     shortcutClose: "Het actieve tabblad sluiten",
     shortcutCloseOthers: "Alle andere tabbladen sluiten",
-    shortcutTabs: "Wisselen tussen geopende documenttabbladen",
+    shortcutTabs: "Activeer het volgende of vorige geopende tabblad in tabbladvolgorde",
+    shortcutTabsOrder: "Activeer het volgende of vorige geopende tabblad in tabbladvolgorde",
+    shortcutTabList:
+      "Activeer het vorige of volgende tabblad wanneer de tabbladbalk de focus heeft",
+    shortcutMoveTab: "Verplaats het gefocuste documenttabblad naar links of rechts",
     shortcutContext: "Documentcontext voor het geselecteerde document openen (I).",
     shortcutGraph: "Waar is dit document?",
     shortcutEscape:
@@ -729,7 +733,7 @@ export default {
     sponsorHint: "Opent de GitHub Sponsors-pagina in je browser.",
     locale: "Taal",
     localeHint:
-      "Wijzigt de menu's, instellingen en berichten van Fulvid direct. Je documenten blijven in de taal waarin je ze hebt geschreven.",
+      "Systeem volgt de taal van het besturingssysteem als Fulvid die ondersteunt; anders Engels. Een hier gekozen taal blijft behouden. Je documenten blijven in de taal waarin je ze hebt geschreven.",
     english: "English",
     spanish: "Español",
     german: "Deutsch",
@@ -851,7 +855,7 @@ export default {
     missingAnchor: 'Kop "{anchor}" bestaat niet in dat document.',
     candidates: "Mogelijke overeenkomsten: {items}",
     alsoMatches: "Komt ook overeen: {items}",
-    open: "{path} openen",
+    open: "Openen",
     unresolvedTitle: "Deze koppeling komt niet overeen met een document",
     heading: "Kop #{anchor}: {status}",
     missingAnchorStatus: "ontbreekt",
diff --git a/src/mainview/i18n/pt.ts b/src/mainview/i18n/pt.ts
index 0d963bd..af44e49 100644
--- a/src/mainview/i18n/pt.ts
+++ b/src/mainview/i18n/pt.ts
@@ -703,7 +703,11 @@ export default {
     shortcutSaveAs: "Guardar o documento ativo como um novo ficheiro",
     shortcutClose: "Fechar o separador ativo",
     shortcutCloseOthers: "Fechar todos os outros separadores",
-    shortcutTabs: "Alternar entre separadores de documentos abertos",
+    shortcutTabs: "Ativar o separador aberto seguinte ou anterior na ordem dos separadores",
+    shortcutTabsOrder: "Ativar o separador aberto seguinte ou anterior na ordem dos separadores",
+    shortcutTabList:
+      "Ativar o separador anterior ou seguinte quando a faixa de separadores tem o foco",
+    shortcutMoveTab: "Mover o separador do documento focado para a esquerda ou para a direita",
     shortcutContext: "Abrir o Contexto do documento selecionado (I).",
     shortcutGraph: "Onde está este documento?",
     shortcutEscape:
@@ -731,7 +735,7 @@ export default {
     sponsorHint: "Abre a página do GitHub Sponsors no seu navegador.",
     locale: "Idioma",
     localeHint:
-      "Altera imediatamente os menus, as Definições e as mensagens do Fulvid. Os seus documentos mantêm o idioma em que foram escritos.",
+      "Sistema segue o idioma do sistema operativo quando o Fulvid o suporta; caso contrário, inglês. Uma escolha aqui é mantida. Os seus documentos mantêm o idioma em que foram escritos.",
     english: "English",
     spanish: "Español",
     german: "Deutsch",
@@ -854,7 +858,7 @@ export default {
     missingAnchor: 'O título "{anchor}" não existe nesse documento.',
     candidates: "Possíveis correspondências: {items}",
     alsoMatches: "Também corresponde: {items}",
-    open: "Abrir {path}",
+    open: "Abrir",
     unresolvedTitle: "Esta ligação não corresponde a um documento",
     heading: "Título #{anchor}: {status}",
     missingAnchorStatus: "em falta",
diff --git a/src/mainview/i18n/resolveLocale.ts b/src/mainview/i18n/resolveLocale.ts
new file mode 100644
index 0000000..9baabfe
--- /dev/null
+++ b/src/mainview/i18n/resolveLocale.ts
@@ -0,0 +1,105 @@
+/**
+ * Resolve Fulvid UI locale from preference + OS locale tags.
+ *
+ * Precedence: explicit preference -> OS language if in the allowlist -> English.
+ * Regional tags (de-DE, pt_BR) match by primary language subtag only.
+ */
+
+export const SUPPORTED_LOCALES = ["de", "en", "es", "fr", "it", "nl", "pt"] as const;
+export type Locale = (typeof SUPPORTED_LOCALES)[number];
+
+export const LOCALE_PREFERENCES = ["system", ...SUPPORTED_LOCALES] as const;
+export type LocalePreference = (typeof LOCALE_PREFERENCES)[number];
+
+export const DEFAULT_LOCALE_PREFERENCE: LocalePreference = "system";
+export const FALLBACK_LOCALE: Locale = "en";
+
+/**
+ * Normalize BCP 47 / POSIX-ish locale tags to lowercase hyphen form.
+ * Returns "" when the value cannot yield a language subtag.
+ */
+export function normalizeLocaleTag(raw: unknown): string {
+  if (typeof raw !== "string") {
+    return "";
+  }
+  const trimmed = raw.trim();
+  if (!trimmed) {
+    return "";
+  }
+  // Drop encoding / charset and glibc modifiers: es_ES.UTF-8@euro -> es_ES
+  const withoutSuffix = trimmed.split(/[.@]/, 2)[0] ?? "";
+  const normalized = withoutSuffix
+    .replace(/[_\s./]+/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-|-$/g, "")
+    .toLowerCase();
+  if (!normalized || normalized === "c" || normalized === "posix") {
+    return "";
+  }
+  const primary = normalized.split("-", 1)[0] ?? "";
+  if (!/^[a-z]{2,3}$/.test(primary)) {
+    return "";
+  }
+  return normalized;
+}
+
+/** Map a locale tag to a Fulvid catalog locale, or null when unsupported. */
+export function matchSupportedLocale(raw: unknown): Locale | null {
+  const tag = normalizeLocaleTag(raw);
+  if (!tag) {
+    return null;
+  }
+  const primary = tag.split("-", 1)[0] ?? "";
+  return (SUPPORTED_LOCALES as readonly string[]).includes(primary) ? (primary as Locale) : null;
+}
+
+/**
+ * Resolve the active UI locale.
+ * Explicit catalog preferences win; "system" (and unknown values) walk osTags.
+ */
+export function resolveLocalePreference(
+  preference: unknown,
+  osTags: readonly unknown[] = [],
+): Locale {
+  if (
+    typeof preference === "string" &&
+    preference !== "system" &&
+    (SUPPORTED_LOCALES as readonly string[]).includes(preference)
+  ) {
+    return preference as Locale;
+  }
+  for (const tag of osTags) {
+    const match = matchSupportedLocale(tag);
+    if (match) {
+      return match;
+    }
+  }
+  return FALLBACK_LOCALE;
+}
+
+/**
+ * OS / WebView locale candidates. Prefer navigator.languages order, then
+ * navigator.language. Inject `source` in tests; do not invent tags.
+ */
+export function readOsLocaleTags(
+  source: { languages?: readonly string[]; language?: string } | undefined = typeof navigator !==
+  "undefined"
+    ? navigator
+    : undefined,
+): string[] {
+  if (!source) {
+    return [];
+  }
+  const tags: string[] = [];
+  if (Array.isArray(source.languages)) {
+    for (const tag of source.languages) {
+      if (typeof tag === "string" && tag.trim()) {
+        tags.push(tag);
+      }
+    }
+  }
+  if (typeof source.language === "string" && source.language.trim()) {
+    tags.push(source.language);
+  }
+  return tags;
+}
diff --git a/src/mainview/modules/document/inspector/InspectorDrawer.vue b/src/mainview/modules/document/inspector/InspectorDrawer.vue
index 35d5e45..e11c1f8 100644
--- a/src/mainview/modules/document/inspector/InspectorDrawer.vue
+++ b/src/mainview/modules/document/inspector/InspectorDrawer.vue
@@ -43,7 +43,12 @@ import FactSection from "../facts/FactSection.vue";
 import FactStatement from "../facts/FactStatement.vue";
 import ContextMenu, { type ContextMenuAction } from "../../../shell/ContextMenu.vue";
 import { notify } from "../../../app/notify";
-import { INSPECTOR_WIDTH_LIMITS, layout, setInspectorWidth } from "../../../app/layoutStore";
+import {
+  INSPECTOR_WIDTH_LIMITS,
+  LAYOUT_RESIZE_STEP_PX,
+  layout,
+  setInspectorWidth,
+} from "../../../app/layoutStore";
 import {
   workspaceNotes,
   copyWorkspacePath,
@@ -398,8 +403,8 @@ onBeforeUnmount(() => {
       :aria-valuemax="INSPECTOR_WIDTH_LIMITS.max"
       tabindex="0"
       @pointerdown="startInspectorResize"
-      @keydown.left.prevent="setInspectorWidth(layout.inspectorWidth + 8)"
-      @keydown.right.prevent="setInspectorWidth(layout.inspectorWidth - 8)"
+      @keydown.left.prevent="setInspectorWidth(layout.inspectorWidth + LAYOUT_RESIZE_STEP_PX)"
+      @keydown.right.prevent="setInspectorWidth(layout.inspectorWidth - LAYOUT_RESIZE_STEP_PX)"
     />
 
     <header class="inspector-panel__header">
@@ -568,7 +573,7 @@ onBeforeUnmount(() => {
                 v-if="entry.candidates.length === 1"
                 type="button"
                 class="inspector-panel__unresolved inspector-panel__unresolved--action"
-                :title="t('links.open', { path: entry.candidates[0].relativePath })"
+                :title="t('links.open')"
                 @click="openConnectedDocument(entry.candidates[0].path)"
               >
                 {{ formatUnresolvedLink(entry.link) }}
diff --git a/src/mainview/modules/document/links/linkHoverSourcePeek.ts b/src/mainview/modules/document/links/linkHoverSourcePeek.ts
new file mode 100644
index 0000000..3f4e7d5
--- /dev/null
+++ b/src/mainview/modules/document/links/linkHoverSourcePeek.ts
@@ -0,0 +1,181 @@
+/**
+ * Short Markdown-source peek for document-link hover.
+ *
+ * Uses the same target text already loaded for hover/heading checks
+ * (`contentForPath`). Does not render HTML, call marked, summarize, or
+ * invent text. Distinct from PreviewPane / `renderMarkdownPreview`.
+ */
+
+/** How much of the target we may scan to build the peek (large-file ceiling). */
+export const LINK_HOVER_PEEK_READ_CAP = 4_096;
+
+/** Soft visual cap: a few lines in the hover tooltip. */
+export const LINK_HOVER_PEEK_MAX_LINES = 5;
+
+/** Soft visual cap: short enough that path + honesty stay primary. */
+export const LINK_HOVER_PEEK_MAX_CHARS = 220;
+
+const CLOSED_FRONTMATTER_RE = /^---\r?\n[\s\S]*?\r?\n---\r?\n?/;
+
+export type LinkHoverSourcePeekOptions = {
+  /** 1-based heading line when the link targets a fragment. */
+  startLineNumber?: number;
+};
+
+function offsetOfLine(content: string, lineNumber1Based: number): number {
+  if (lineNumber1Based <= 1) {
+    return 0;
+  }
+  let line = 1;
+  for (let index = 0; index < content.length; index += 1) {
+    if (content.charCodeAt(index) === 0x0a) {
+      line += 1;
+      if (line === lineNumber1Based) {
+        return index + 1;
+      }
+    }
+  }
+  return content.length;
+}
+
+/** Start of body after a closed YAML frontmatter block; else 0. */
+export function markdownBodyStartOffset(content: string): number {
+  const match = CLOSED_FRONTMATTER_RE.exec(content);
+  return match ? match[0].length : 0;
+}
+
+/**
+ * Escape text so Monaco hover Markdown renders it literally.
+ *
+ * A hover body is Markdown, and the values composed into one come from
+ * documents: a link label, a heading in the target, a filename. Left raw, a
+ * heading such as `![](https://host/pixel.png)` becomes an image request from a
+ * tooltip, and `[text](https://host)` becomes a clickable external link -
+ * document content reaching the network, which `isTrusted: false` and
+ * `supportHtml: false` do not prevent because both are ordinary Markdown.
+ *
+ * The single rule for that escape lives here; annotation hovers use it too.
+ */
+export function escapeHoverMarkdownText(text: string): string {
+  return text.replace(/([\\`*_{}[\]()#+\-.!|<>~])/g, "\\$1");
+}
+
+/**
+ * Fence source so Monaco hover Markdown cannot turn it into links/HTML.
+ * Lengthens the fence if the excerpt already contains the same backtick run.
+ */
+export function linkHoverPeekAsHoverMarkdown(peek: string): string {
+  let fence = "```";
+  while (peek.includes(fence)) {
+    fence += "`";
+  }
+  return `${fence}markdown\n${peek}\n${fence}`;
+}
+
+/**
+ * Compact hover body: identity, path only when it adds information, optional
+ * honesty lines, then a secondary source peek in one Markdown block.
+ *
+ * Every part except `peek` is emitted as Markdown, so callers pass text that is
+ * already safe: run document-derived values through `escapeHoverMarkdownText`
+ * first. Detail lines arrive localized, with the untrusted values already
+ * escaped inside them, so this function cannot escape them itself.
+ */
+export function linkHoverContentsMarkdown(parts: {
+  title: string;
+  path?: string | null;
+  detailLines?: readonly string[];
+  peek?: string | null;
+}): string {
+  const lines: string[] = [`**${parts.title}**`];
+  if (parts.path && parts.path !== parts.title) {
+    lines.push(parts.path);
+  }
+  for (const detail of parts.detailLines ?? []) {
+    if (detail) {
+      lines.push(detail);
+    }
+  }
+  const header = lines.join("\n");
+  if (!parts.peek) {
+    return header;
+  }
+  return `${header}\n\n${linkHoverPeekAsHoverMarkdown(parts.peek)}`;
+}
+
+/**
+ * Small excerpt of Markdown source from `content`, or null when there is
+ * nothing useful to show (empty / frontmatter-only).
+ */
+export function linkHoverSourcePeek(
+  content: string,
+  options: LinkHoverSourcePeekOptions = {},
+): string | null {
+  if (!content) {
+    return null;
+  }
+
+  const bodyOffset = markdownBodyStartOffset(content);
+  const headingOffset =
+    options.startLineNumber !== undefined
+      ? offsetOfLine(content, options.startLineNumber)
+      : bodyOffset;
+  const startOffset = Math.max(bodyOffset, headingOffset);
+  if (startOffset >= content.length) {
+    return null;
+  }
+
+  const window = content.slice(startOffset, startOffset + LINK_HOVER_PEEK_READ_CAP);
+  const truncatedByReadCap = startOffset + LINK_HOVER_PEEK_READ_CAP < content.length;
+  const lines = window.split(/\r?\n/);
+
+  let firstContent = 0;
+  while (firstContent < lines.length && lines[firstContent]?.trim() === "") {
+    firstContent += 1;
+  }
+  if (firstContent >= lines.length) {
+    return null;
+  }
+
+  const taken: string[] = [];
+  let chars = 0;
+  let truncated = truncatedByReadCap;
+  for (let index = firstContent; index < lines.length; index += 1) {
+    const line = lines[index] ?? "";
+    if (taken.length >= LINK_HOVER_PEEK_MAX_LINES) {
+      truncated = true;
+      break;
+    }
+    const newlineCost = taken.length > 0 ? 1 : 0;
+    const remaining = LINK_HOVER_PEEK_MAX_CHARS - chars - newlineCost;
+    if (remaining <= 0) {
+      truncated = true;
+      break;
+    }
+    if (line.length > remaining) {
+      taken.push(`${line.slice(0, remaining)}...`);
+      truncated = true;
+      break;
+    }
+    taken.push(line);
+    chars += line.length + newlineCost;
+  }
+
+  if (taken.length === 0) {
+    return null;
+  }
+
+  // Drop trailing blank lines so the fence does not look padded.
+  while (taken.length > 0 && taken[taken.length - 1]?.trim() === "") {
+    taken.pop();
+  }
+  if (taken.length === 0) {
+    return null;
+  }
+
+  let peek = taken.join("\n");
+  if (truncated && !peek.endsWith("...")) {
+    peek = `${peek}\n...`;
+  }
+  return peek;
+}
diff --git a/src/mainview/modules/editor/EditorTabs.vue b/src/mainview/modules/editor/EditorTabs.vue
index fa3c4d2..87991a7 100644
--- a/src/mainview/modules/editor/EditorTabs.vue
+++ b/src/mainview/modules/editor/EditorTabs.vue
@@ -1,13 +1,15 @@
 <script setup lang="ts">
-import { computed, nextTick, ref, useId } from "vue";
+import { computed, nextTick, ref, useId, watch } from "vue";
 import { useI18n } from "vue-i18n";
 
 import type { DocumentBuffer } from "./document/documentBuffers";
-import { isDocumentDirty } from "./document/documentBuffers";
+import { isDocumentDirty, reorderOpenDocuments } from "./document/documentBuffers";
 import { documentLocationFromBuffer, tabLabelsForBuffers } from "./document/documentLocation";
 import ContextMenu from "../../shell/ContextMenu.vue";
 import AppIcon from "../../shell/AppIcon.vue";
 import { canCloseOtherEditorTabs, editorTabContextActions } from "./editorTabContextMenu";
+import { adjacentTabReorderIndex, tabDropReorderIndex } from "./editorTabReorder";
+import { revealTabInOverflowStrip, shouldCloseTabOnAuxClick } from "./editorTabStrip";
 
 const { t } = useI18n();
 const tabIdPrefix = useId();
@@ -29,6 +31,12 @@ const menuOpen = ref(false);
 const menuX = ref(0);
 const menuY = ref(0);
 const menuTarget = ref<string | null>(null);
+/** Index of the dragged tab while a pointer reorder is in progress. */
+const dragFromIndex = ref<number | null>(null);
+/** Insertion marker: line before this index, or `buffers.length` for end. */
+const dropMarkerIndex = ref<number | null>(null);
+/** Suppress the click that follows a completed drag. */
+const suppressNextActivate = ref(false);
 
 const tabLabels = computed(() => tabLabelsForBuffers(props.buffers));
 
@@ -69,6 +77,39 @@ function focusActiveTab(): void {
   }
 }
 
+function revealActiveTabInStrip(): void {
+  if (!props.activeId) {
+    return;
+  }
+  revealTabInOverflowStrip(tabElements.get(props.activeId));
+}
+
+watch(
+  () => props.activeId,
+  (id) => {
+    if (!id) {
+      return;
+    }
+    void nextTick(() => revealActiveTabInStrip());
+  },
+  { immediate: true },
+);
+
+function moveFocusedTab(index: number, direction: -1 | 1): void {
+  const toIndex = adjacentTabReorderIndex(index, direction, props.buffers.length);
+  if (toIndex === null) {
+    return;
+  }
+  const buffer = props.buffers[index];
+  if (!buffer) {
+    return;
+  }
+  if (!reorderOpenDocuments(index, toIndex)) {
+    return;
+  }
+  focusTab(buffer.id);
+}
+
 function onTabKeydown(event: KeyboardEvent, index: number): void {
   if (event.key === "ContextMenu" || (event.shiftKey && event.key === "F10")) {
     const buffer = props.buffers[index];
@@ -80,6 +121,16 @@ function onTabKeydown(event: KeyboardEvent, index: number): void {
     openTabMenu(buffer.id, bounds.left, bounds.bottom);
     return;
   }
+  if (
+    event.altKey &&
+    !event.ctrlKey &&
+    !event.metaKey &&
+    (event.key === "ArrowLeft" || event.key === "ArrowRight")
+  ) {
+    event.preventDefault();
+    moveFocusedTab(index, event.key === "ArrowLeft" ? -1 : 1);
+    return;
+  }
   if (!["ArrowLeft", "ArrowRight", "Home", "End"].includes(event.key)) {
     return;
   }
@@ -102,6 +153,14 @@ function onTabKeydown(event: KeyboardEvent, index: number): void {
   focusTab(nextBuffer.id);
 }
 
+function onTabActivate(id: string): void {
+  if (suppressNextActivate.value) {
+    suppressNextActivate.value = false;
+    return;
+  }
+  emit("activate", id);
+}
+
 function onTabContextMenu(event: MouseEvent, id: string): void {
   event.preventDefault();
   (event.currentTarget as HTMLElement).querySelector<HTMLButtonElement>('[role="tab"]')?.focus();
@@ -142,6 +201,73 @@ function closeTab(id: string): void {
   focusActiveTab();
 }
 
+function onTabAuxClick(event: MouseEvent, id: string): void {
+  if (!shouldCloseTabOnAuxClick(event)) {
+    return;
+  }
+  event.preventDefault();
+  closeTab(id);
+}
+
+function clearDragState(): void {
+  dragFromIndex.value = null;
+  dropMarkerIndex.value = null;
+}
+
+function onTabDragStart(event: DragEvent, index: number): void {
+  const target = event.target;
+  if (target instanceof Element && target.closest(".editor-tabs__close")) {
+    event.preventDefault();
+    return;
+  }
+  if (!event.dataTransfer || props.buffers.length < 2) {
+    event.preventDefault();
+    return;
+  }
+  dragFromIndex.value = index;
+  dropMarkerIndex.value = index;
+  event.dataTransfer.effectAllowed = "move";
+  event.dataTransfer.setData("text/plain", props.buffers[index]?.id ?? "");
+}
+
+function onTabDragOver(event: DragEvent, overIndex: number): void {
+  if (dragFromIndex.value === null) {
+    return;
+  }
+  event.preventDefault();
+  if (event.dataTransfer) {
+    event.dataTransfer.dropEffect = "move";
+  }
+  const item = event.currentTarget as HTMLElement;
+  const rect = item.getBoundingClientRect();
+  const placeAfter = event.clientX > rect.left + rect.width / 2;
+  dropMarkerIndex.value = placeAfter ? overIndex + 1 : overIndex;
+}
+
+function onTabDrop(event: DragEvent, overIndex: number): void {
+  event.preventDefault();
+  const fromIndex = dragFromIndex.value;
+  if (fromIndex === null) {
+    clearDragState();
+    return;
+  }
+  const item = event.currentTarget as HTMLElement;
+  const rect = item.getBoundingClientRect();
+  const placeAfter = event.clientX > rect.left + rect.width / 2;
+  const toIndex = tabDropReorderIndex(fromIndex, overIndex, placeAfter);
+  clearDragState();
+  if (toIndex === fromIndex) {
+    return;
+  }
+  if (reorderOpenDocuments(fromIndex, toIndex)) {
+    suppressNextActivate.value = true;
+  }
+}
+
+function onTabDragEnd(): void {
+  clearDragState();
+}
+
 defineExpose({ focusActiveTab });
 </script>
 
@@ -154,14 +280,25 @@ defineExpose({ focusActiveTab });
       :aria-label="t('tabs.openDocuments')"
     >
       <div
-        v-for="buffer in buffers"
+        v-for="(buffer, index) in buffers"
         :key="buffer.id"
         class="editor-tabs__item"
+        :class="{
+          'editor-tabs__item--drop-before':
+            dropMarkerIndex === index && dragFromIndex !== null && dragFromIndex !== index,
+          'editor-tabs__item--dragging': dragFromIndex === index,
+        }"
         role="presentation"
+        draggable="true"
         @contextmenu="onTabContextMenu($event, buffer.id)"
+        @auxclick="onTabAuxClick($event, buffer.id)"
+        @dragstart="onTabDragStart($event, index)"
+        @dragover="onTabDragOver($event, index)"
+        @drop="onTabDrop($event, index)"
+        @dragend="onTabDragEnd"
       >
         <button
-          :id="activeId === buffer.id ? 'active-document-tab' : tabId(buffers.indexOf(buffer))"
+          :id="activeId === buffer.id ? 'active-document-tab' : tabId(index)"
           :ref="(element) => setTabElement(buffer.id, element)"
           class="editor-tabs__tab"
           type="button"
@@ -177,8 +314,8 @@ defineExpose({ focusActiveTab });
           :aria-expanded="menuOpen && menuTarget === buffer.id"
           aria-controls="document-editor-panel"
           :title="tabTooltip(buffer)"
-          @keydown="onTabKeydown($event, buffers.indexOf(buffer))"
-          @click="emit('activate', buffer.id)"
+          @keydown="onTabKeydown($event, index)"
+          @click="onTabActivate(buffer.id)"
         >
           <span class="editor-tabs__title">{{ tabLabel(buffer) }}</span>
           <span
@@ -198,6 +335,11 @@ defineExpose({ focusActiveTab });
           <AppIcon name="close" :size="13" />
         </button>
       </div>
+      <div
+        v-if="dropMarkerIndex === buffers.length && dragFromIndex !== null"
+        class="editor-tabs__drop-end"
+        aria-hidden="true"
+      />
     </div>
     <button
       class="editor-tabs__new"
@@ -248,6 +390,21 @@ defineExpose({ focusActiveTab });
   border-bottom: 2px solid transparent;
 }
 
+.editor-tabs__item--drop-before {
+  box-shadow: inset 2px 0 0 $accent;
+}
+
+.editor-tabs__item--dragging {
+  opacity: 0.55;
+}
+
+.editor-tabs__drop-end {
+  flex: 0 0 auto;
+  width: 2px;
+  align-self: stretch;
+  background: $accent;
+}
+
 .editor-tabs__tab,
 .editor-tabs__close {
   border: 0;
@@ -304,6 +461,10 @@ defineExpose({ focusActiveTab });
   box-shadow: none;
 }
 
+.editor-tabs__item:has([aria-selected="true"]).editor-tabs__item--drop-before {
+  box-shadow: inset 2px 0 0 $accent;
+}
+
 .editor-tabs__item:has([aria-selected="true"]) .editor-tabs__tab {
   color: $text-primary;
 }
diff --git a/src/mainview/modules/editor/document/documentAnnotations.ts b/src/mainview/modules/editor/document/documentAnnotations.ts
index 765bf44..862c22c 100644
--- a/src/mainview/modules/editor/document/documentAnnotations.ts
+++ b/src/mainview/modules/editor/document/documentAnnotations.ts
@@ -13,6 +13,8 @@
  */
 import type * as Monaco from "monaco-editor/editor";
 
+import { escapeHoverMarkdownText } from "../../document/links/linkHoverSourcePeek";
+
 export const DOCUMENT_ANNOTATION_GLYPH_CLASS = "fulvid-document-annotation-glyph";
 
 /** Soft cap: a handful of temporary notes, not an archive. */
@@ -50,9 +52,11 @@ const annotationsByModel = new WeakMap<TextModel, AnnotationRecord[]>();
  * Monaco hover uses Markdown. Escape so annotation text stays plain and
  * cannot become emphasis, links, or HTML. Paired with isTrusted/supportHtml
  * false on the hover payload in annotationDecoration.
+ *
+ * One rule for every hover body: `escapeHoverMarkdownText`.
  */
 export function annotationTextAsHoverMarkdown(text: string): string {
-  return text.replace(/([\\`*_{}[\]()#+\-.!|<>~])/g, "\\$1");
+  return escapeHoverMarkdownText(text);
 }
 
 /** Collapse whitespace, drop C0/DEL controls, cap length. Empty -> null. */
diff --git a/src/mainview/modules/editor/document/documentBuffers.ts b/src/mainview/modules/editor/document/documentBuffers.ts
index 765b177..fa79ced 100644
--- a/src/mainview/modules/editor/document/documentBuffers.ts
+++ b/src/mainview/modules/editor/document/documentBuffers.ts
@@ -27,7 +27,9 @@ import {
   clearSessionDocuments,
   nextUntitledId,
   pendingReveal,
+  openIds,
   registerDocument,
+  reorderOpenDocuments as reorderSessionOpenDocuments,
   replaceDocumentId,
   unregisterDocument,
   untitledNumberFromId,
@@ -67,6 +69,7 @@ import type {
   DocumentWriteResult,
   GrantedDocumentSnapshot,
   GrantedDocumentWriteResult,
+  MarkdownFileType,
   SaveAsResult,
 } from "../../workspace/filesystem/workspaceTypes";
 
@@ -212,6 +215,37 @@ export const activeBuffer = computed(() => {
   return buffers.value.find((buffer) => buffer.id === activeId.value) ?? null;
 });
 
+/**
+ * Move an open document in tab order. Keeps `buffers` and session `openIds`
+ * aligned. Does not change `activeId`, dirty/save state, Focus, or MRU.
+ */
+export function reorderOpenDocuments(fromIndex: number, toIndex: number): boolean {
+  const list = buffers.value;
+  if (
+    fromIndex < 0 ||
+    toIndex < 0 ||
+    fromIndex >= list.length ||
+    toIndex >= list.length ||
+    list.length !== openIds.value.length
+  ) {
+    return false;
+  }
+  if (fromIndex === toIndex) {
+    return true;
+  }
+  const next = [...list];
+  const [moved] = next.splice(fromIndex, 1);
+  if (!moved) {
+    return false;
+  }
+  next.splice(toIndex, 0, moved);
+  if (!reorderSessionOpenDocuments(fromIndex, toIndex)) {
+    return false;
+  }
+  buffers.value = next;
+  return true;
+}
+
 function bufferKey(rootPath: string, path: string): string {
   return `${rootPath.replace(/\\/g, "/")}${BUFFER_OPEN_KEY_SEP}${path.replace(/\\/g, "/")}`;
 }
@@ -761,7 +795,7 @@ function reidentifyAsPersisted(
 export function saveAsDocument(
   buffer: DocumentBuffer,
   basename: string,
-  defaultExtension: "md" | "markdown" | "mdx" = "mdx",
+  defaultExtension: MarkdownFileType = "mdx",
   overwrite = false,
 ): Promise<{ result: SaveAsResult; buffer: DocumentBuffer }> {
   return queueBufferWrite(buffer, () =>
@@ -785,7 +819,7 @@ function monacoVersionStillOnDisk(
 async function saveAsDocumentNow(
   buffer: DocumentBuffer,
   basename: string,
-  defaultExtension: "md" | "markdown" | "mdx",
+  defaultExtension: MarkdownFileType,
   overwrite: boolean,
 ): Promise<{ result: SaveAsResult; buffer: DocumentBuffer }> {
   if (isAbandonedBuffer(buffer)) {
diff --git a/src/mainview/modules/editor/document/documentFileNames.ts b/src/mainview/modules/editor/document/documentFileNames.ts
index 4bb04df..a26930c 100644
--- a/src/mainview/modules/editor/document/documentFileNames.ts
+++ b/src/mainview/modules/editor/document/documentFileNames.ts
@@ -4,6 +4,9 @@
  */
 import { isMarkdownFile, isSafeDocumentBasename } from "../../workspace/filesystem/workspaceTypes";
 
+/** Keep a suggested name short enough to read in the Save As field. */
+const MAX_SUGGESTED_SLUG_CHARS = 48;
+
 /**
  * Attach the default extension when missing; refuse unsupported or unsafe names.
  * Returns null when the name must not be written.
@@ -39,7 +42,7 @@ export function suggestUntitledSaveBasename(content: string, defaultExtension: s
     .replace(/[^\w\s-]+/g, "")
     .trim()
     .replace(/\s+/g, "-")
-    .slice(0, 48)
+    .slice(0, MAX_SUGGESTED_SLUG_CHARS)
     .replace(/^-+|-+$/g, "");
   if (!slug || !isSafeDocumentBasename(`${slug}.${extension}`)) {
     return `untitled.${extension}`;
diff --git a/src/mainview/modules/editor/document/documentLocation.ts b/src/mainview/modules/editor/document/documentLocation.ts
index c0428f9..d2f42c4 100644
--- a/src/mainview/modules/editor/document/documentLocation.ts
+++ b/src/mainview/modules/editor/document/documentLocation.ts
@@ -30,6 +30,9 @@ export type DocumentLocationSource = {
 /** Default visual budget for compact relative paths in the editor header. */
 export const DOCUMENT_LOCATION_MAX_LENGTH = 52;
 
+/** Tighter budget for a tab label, which shares the strip with its siblings. */
+export const TAB_LABEL_MAX_LENGTH = 40;
+
 export const DOCUMENT_LOCATION_DESTINATIONS: readonly DocumentLocationDestination[] = [
   "main-panel",
   "window-title",
@@ -153,7 +156,7 @@ export function disambiguatedRelativePath(path: string, others: readonly string[
 export function tabLabelForBuffer(
   buffer: DocumentLocationSource,
   openBuffers: readonly DocumentLocationSource[],
-  maxLength: number = 40,
+  maxLength: number = TAB_LABEL_MAX_LENGTH,
 ): string {
   const collisions = openBuffers.filter((candidate) => candidate.title === buffer.title);
   if (collisions.length <= 1) {
@@ -179,7 +182,7 @@ export function tabLabelForBuffer(
 
 export function tabLabelsForBuffers(
   openBuffers: readonly DocumentLocationSource[],
-  maxLength: number = 40,
+  maxLength: number = TAB_LABEL_MAX_LENGTH,
 ): ReadonlyMap<string, string> {
   const labels = new Map<string, string>();
   for (const buffer of openBuffers) {
diff --git a/src/mainview/modules/editor/document/documentSession.ts b/src/mainview/modules/editor/document/documentSession.ts
index 2821707..0b9d825 100644
--- a/src/mainview/modules/editor/document/documentSession.ts
+++ b/src/mainview/modules/editor/document/documentSession.ts
@@ -77,24 +77,6 @@ function removeDocumentMru(id: DocumentId): void {
   documentMru.value = documentMru.value.filter((openId) => openId !== id);
 }
 
-function mruIndexAfter(currentIndex: number, direction: 1 | -1, stackLength: number): number {
-  if (currentIndex < 0) {
-    return direction === 1 ? 1 : stackLength - 1;
-  }
-  return (currentIndex + direction + stackLength) % stackLength;
-}
-
-export function nextMruDocument(direction: 1 | -1): DocumentId | null {
-  const openSet = new Set(openIds.value);
-  const mruStack = documentMru.value.filter((id) => openSet.has(id));
-  if (mruStack.length < 2) {
-    return null;
-  }
-  const currentIndex = activeId.value ? mruStack.indexOf(activeId.value) : -1;
-  const nextIndex = mruIndexAfter(currentIndex, direction, mruStack.length);
-  return mruStack[nextIndex] ?? null;
-}
-
 export function registerDocument(id: DocumentId): void {
   if (!openIds.value.includes(id)) {
     openIds.value = [...openIds.value, id];
@@ -102,6 +84,28 @@ export function registerDocument(id: DocumentId): void {
   touchDocumentMru(id);
 }
 
+/**
+ * Move an open document in the session order. Does not change `activeId`, MRU,
+ * pending reveal, or buffer membership. Indices are positions in `openIds`.
+ */
+export function reorderOpenDocuments(fromIndex: number, toIndex: number): boolean {
+  const ids = openIds.value;
+  if (fromIndex < 0 || toIndex < 0 || fromIndex >= ids.length || toIndex >= ids.length) {
+    return false;
+  }
+  if (fromIndex === toIndex) {
+    return true;
+  }
+  const next = [...ids];
+  const [moved] = next.splice(fromIndex, 1);
+  if (moved === undefined) {
+    return false;
+  }
+  next.splice(toIndex, 0, moved);
+  openIds.value = next;
+  return true;
+}
+
 export function unregisterDocument(id: DocumentId): void {
   openIds.value = openIds.value.filter((openId) => openId !== id);
   removeDocumentMru(id);
diff --git a/src/mainview/modules/editor/document/sessionChangeMarkers.ts b/src/mainview/modules/editor/document/sessionChangeMarkers.ts
index d3287f5..472ad73 100644
--- a/src/mainview/modules/editor/document/sessionChangeMarkers.ts
+++ b/src/mainview/modules/editor/document/sessionChangeMarkers.ts
@@ -32,6 +32,11 @@ export const CHANGE_MARKER_ADDED_CLASS = "fulvid-change-marker-added";
 export const CHANGE_MARKER_DELETED_CLASS = "fulvid-change-marker-deleted";
 
 const CHANGE_MARKER_DEBOUNCE_MS = 200;
+/**
+ * Upper bound on one transient DiffEditor settling. Generous on purpose: it is a
+ * stuck-editor guard, not a responsiveness budget, and the queue is serialized.
+ */
+const DIFF_SETTLE_TIMEOUT_MS = 60_000;
 
 type MonacoApi = typeof Monaco;
 type TextModel = Monaco.editor.ITextModel;
@@ -102,7 +107,7 @@ function waitForLineChanges(
       settled = true;
       disposable.dispose();
       reject(new Error("change marker diff timed out"));
-    }, 60_000);
+    }, DIFF_SETTLE_TIMEOUT_MS);
 
     const finish = (): void => {
       if (settled) {
diff --git a/src/mainview/modules/editor/editorTabNavigation.ts b/src/mainview/modules/editor/editorTabNavigation.ts
new file mode 100644
index 0000000..fda308a
--- /dev/null
+++ b/src/mainview/modules/editor/editorTabNavigation.ts
@@ -0,0 +1,15 @@
+/**
+ * Pure index math for open-document adjacent activation (Ctrl/Cmd+Tab,
+ * Ctrl/Cmd+Shift+Tab, PageDown/PageUp). Callers pass `openBuffers` order.
+ * Wrap is intentional. Distinct from Alt+Arrow reorder (no wrap).
+ */
+export function adjacentOpenDocumentIndex(
+  currentIndex: number,
+  direction: -1 | 1,
+  length: number,
+): number | null {
+  if (currentIndex < 0 || length < 2) {
+    return null;
+  }
+  return (currentIndex + direction + length) % length;
+}
diff --git a/src/mainview/modules/editor/editorTabReorder.ts b/src/mainview/modules/editor/editorTabReorder.ts
new file mode 100644
index 0000000..f7c6d54
--- /dev/null
+++ b/src/mainview/modules/editor/editorTabReorder.ts
@@ -0,0 +1,39 @@
+/**
+ * Pure index math for open-document tab reordering.
+ * Callers apply the result through `reorderOpenDocuments` only.
+ */
+
+/** Next index for Alt+Arrow tab move, or null at the strip edge (no wrap). */
+export function adjacentTabReorderIndex(
+  fromIndex: number,
+  direction: -1 | 1,
+  length: number,
+): number | null {
+  if (length < 2 || fromIndex < 0 || fromIndex >= length) {
+    return null;
+  }
+  const toIndex = fromIndex + direction;
+  if (toIndex < 0 || toIndex >= length) {
+    return null;
+  }
+  return toIndex;
+}
+
+/**
+ * Target index for `reorderOpenDocuments` when dropping onto `overIndex`.
+ * `placeAfter` means insert after the hovered tab in the pre-remove order.
+ */
+export function tabDropReorderIndex(
+  fromIndex: number,
+  overIndex: number,
+  placeAfter: boolean,
+): number {
+  if (fromIndex === overIndex && !placeAfter) {
+    return fromIndex;
+  }
+  let toIndex = placeAfter ? overIndex + 1 : overIndex;
+  if (fromIndex < toIndex) {
+    toIndex -= 1;
+  }
+  return toIndex;
+}
diff --git a/src/mainview/modules/editor/editorTabStrip.ts b/src/mainview/modules/editor/editorTabStrip.ts
new file mode 100644
index 0000000..75c2a0c
--- /dev/null
+++ b/src/mainview/modules/editor/editorTabStrip.ts
@@ -0,0 +1,46 @@
+/**
+ * Pure helpers for open-document tab strip chrome.
+ * Callers apply results through existing EditorTabs close/activate paths only.
+ */
+
+const CLOSE_CONTROL_SELECTOR = ".editor-tabs__close";
+
+export type TabStripRevealTarget = {
+  getClientRects: () => ArrayLike<unknown>;
+  scrollIntoView: (options?: ScrollIntoViewOptions) => void;
+};
+
+/** Scroll the active tab into the strip when it has layout; no-op when hidden. */
+export function revealTabInOverflowStrip(tab: TabStripRevealTarget | null | undefined): void {
+  if (!tab || tab.getClientRects().length === 0) {
+    return;
+  }
+  tab.scrollIntoView({ inline: "nearest", block: "nearest" });
+}
+
+export type TabAuxClickEvent = {
+  button: number;
+  target: EventTarget | null;
+};
+
+function isCloseControlTarget(target: EventTarget | null): boolean {
+  if (!target || typeof target !== "object" || !("closest" in target)) {
+    return false;
+  }
+  const closest = (target as { closest?: unknown }).closest;
+  if (typeof closest !== "function") {
+    return false;
+  }
+  return Boolean((closest as (selector: string) => unknown).call(target, CLOSE_CONTROL_SELECTOR));
+}
+
+/**
+ * Whether a middle-button auxclick should close the tab via the existing close path.
+ * Ignores the dedicated close control so middle-click there cannot double-fire.
+ */
+export function shouldCloseTabOnAuxClick(event: TabAuxClickEvent): boolean {
+  if (event.button !== 1) {
+    return false;
+  }
+  return !isCloseControlTarget(event.target);
+}
diff --git a/src/mainview/modules/editor/monaco/MonacoHost.vue b/src/mainview/modules/editor/monaco/MonacoHost.vue
index 3d9f32a..f358186 100644
--- a/src/mainview/modules/editor/monaco/MonacoHost.vue
+++ b/src/mainview/modules/editor/monaco/MonacoHost.vue
@@ -1090,6 +1090,27 @@ onBeforeUnmount(() => {
 @use "../../../styles/colors" as *;
 @use "../../../styles/variables" as *;
 
+/*
+ * Content hover (links, glyphs): floating inspector chrome.
+ * Monaco already paints border/background via editorHoverWidget tokens and
+ * box-shadow via --vscode-shadow-lg, but Fulvid never sets that shadow var,
+ * and dark themes often use the same token for editor and elevated surface.
+ * Scope stays on .monaco-hover only - not suggest/find/peek widgets.
+ */
+.monaco-editor .monaco-hover,
+.monaco-editor .monaco-resizable-hover {
+  background-color: color-mix(in srgb, $surface-elevated 75%, $surface);
+  border: 1px solid $border;
+  box-shadow: $shadow-soft;
+}
+
+/* Keep the source peek secondary inside the same hover body. */
+.monaco-editor .monaco-hover .markdown-hover .hover-contents pre,
+.monaco-editor .monaco-hover .markdown-hover .hover-contents .code {
+  margin-top: 0.35em;
+  margin-bottom: 0;
+}
+
 /* Overlay widgets live under Monaco's DOM, outside Vue scoped attributes. */
 .fulvid-monaco-back-to-top {
   display: inline-flex;
diff --git a/src/mainview/modules/editor/monaco/documentLanguage.ts b/src/mainview/modules/editor/monaco/documentLanguage.ts
index 4a2c31d..4291728 100644
--- a/src/mainview/modules/editor/monaco/documentLanguage.ts
+++ b/src/mainview/modules/editor/monaco/documentLanguage.ts
@@ -13,6 +13,10 @@
  * - outline and folding
  * - Monaco providers (links, definition, hover, references, rename)
  * - registerDocumentLanguage (per-model attach)
+ *
+ * Link hover is honesty (path / anchor / matches) plus an optional short
+ * Markdown-source peek of the target. It is not PreviewPane and must not
+ * call `renderMarkdownPreview`.
  */
 import * as monaco from "monaco-editor/editor";
 import { watch } from "vue";
@@ -27,6 +31,11 @@ import {
   resolveDocumentLink,
   type DocumentLink,
 } from "../../document/links/documentLink";
+import {
+  escapeHoverMarkdownText,
+  linkHoverContentsMarkdown,
+  linkHoverSourcePeek,
+} from "../../document/links/linkHoverSourcePeek";
 import { readDocument } from "../../workspace/filesystem/workspaceScanner";
 import { settings } from "../../settings/settingsStore";
 import { i18n } from "../../../i18n";
@@ -66,6 +75,8 @@ const markerSchedulers = new Set<() => void>();
 let stopContextWatch: (() => void) | null = null;
 let providersRegistered = false;
 const FRONTMATTER_MARKER_OWNER = "editor-frontmatter";
+/** Coalesce marker recomputation while typing so diagnostics trail edits, not keystrokes. */
+const MARKER_DEBOUNCE_MS = 80;
 
 function scheduleAllMarkers(): void {
   for (const schedule of markerSchedulers) {
@@ -728,7 +739,7 @@ export function registerFrontmatterDiagnostics(
     markerTimer = setTimeout(() => {
       markerTimer = null;
       update();
-    }, 80);
+    }, MARKER_DEBOUNCE_MS);
   };
   const disposable = model.onDidChangeContent(scheduleUpdate);
   update();
@@ -1035,9 +1046,7 @@ function createProviders(api: typeof monaco): void {
                   fragment: link.anchor,
                 })
               : api.Uri.file(absolutePath(context.rootPath, targetPath)),
-            tooltip: i18n.global.t("links.open", {
-              path: targetPath,
-            }),
+            tooltip: i18n.global.t("links.open"),
           };
         }),
       };
@@ -1150,32 +1159,56 @@ function createProviders(api: typeof monaco): void {
         resolved.path && link.anchor && targetContent
           ? findMarkdownHeading(targetContent, link.anchor)
           : undefined;
+      // Anchors, heading text and paths are document content. They are escaped
+      // before entering the localized message, because the hover body is
+      // rendered as Markdown (see `escapeHoverMarkdownText`).
       const headingText = link.anchor
-        ? `\n\n${i18n.global.t("links.heading", {
-            anchor: link.anchor,
-            status: targetHeading ? targetHeading.text : i18n.global.t("links.missingAnchorStatus"),
-          })}`
+        ? i18n.global.t("links.heading", {
+            anchor: escapeHoverMarkdownText(link.anchor),
+            status: targetHeading
+              ? escapeHoverMarkdownText(targetHeading.text)
+              : i18n.global.t("links.missingAnchorStatus"),
+          })
         : "";
       const alsoMatchesText =
         resolved.path && resolved.alsoMatches.length > 0
-          ? `\n\n${i18n.global.t("links.alsoMatches", {
-              items: resolved.alsoMatches.join(", "),
-            })}`
+          ? i18n.global.t("links.alsoMatches", {
+              items: resolved.alsoMatches.map(escapeHoverMarkdownText).join(", "),
+            })
           : "";
       const candidates = resolved.path ? [] : candidateNotesForLink(link.target, context.notes);
       const candidateText =
         candidates.length > 0
-          ? `\n\n${i18n.global.t("links.candidates", {
-              items: candidates.map((candidate) => candidate.path).join(", "),
-            })}`
+          ? i18n.global.t("links.candidates", {
+              items: candidates
+                .map((candidate) => escapeHoverMarkdownText(candidate.path))
+                .join(", "),
+            })
           : "";
+      const peek =
+        resolved.path && targetContent
+          ? linkHoverSourcePeek(targetContent, {
+              startLineNumber: targetHeading?.lineNumber,
+            })
+          : null;
+      const value = resolved.path
+        ? linkHoverContentsMarkdown({
+            title: escapeHoverMarkdownText(link.label ?? link.target),
+            path: escapeHoverMarkdownText(resolved.path),
+            detailLines: [headingText, alsoMatchesText],
+            peek,
+          })
+        : linkHoverContentsMarkdown({
+            title: i18n.global.t("links.unresolvedTitle"),
+            detailLines: [escapeHoverMarkdownText(link.target), candidateText],
+          });
       return {
         range: rangeForTextRange(model, link.range),
         contents: [
           {
-            value: resolved.path
-              ? `**${link.label ?? link.target}**\n\n${resolved.path}${headingText}${alsoMatchesText}`
-              : `**${i18n.global.t("links.unresolvedTitle")}**\n\n${link.target}${candidateText}`,
+            value,
+            isTrusted: false,
+            supportHtml: false,
           },
         ],
       };
@@ -1423,7 +1456,7 @@ export function registerDocumentLanguage(
     markerTimer = setTimeout(() => {
       markerTimer = null;
       updateMarkers(model);
-    }, 80);
+    }, MARKER_DEBOUNCE_MS);
   };
   markerSchedulers.add(scheduleMarkers);
   const contentDisposable = model.onDidChangeContent(scheduleAllMarkers);
diff --git a/src/mainview/modules/editor/outline/OutlinePanel.vue b/src/mainview/modules/editor/outline/OutlinePanel.vue
index 231ae2f..3befca9 100644
--- a/src/mainview/modules/editor/outline/OutlinePanel.vue
+++ b/src/mainview/modules/editor/outline/OutlinePanel.vue
@@ -24,6 +24,8 @@ const { t } = useI18n();
 const rows = ref<OutlineRow[]>([]);
 const activeVersion = computed(() => activeBuffer.value?.changeVersion.value ?? 0);
 const rowElements = new Map<string, HTMLButtonElement>();
+/** Coalesce rebuilds while typing: the outline follows the model, not each keystroke. */
+const OUTLINE_REFRESH_DEBOUNCE_MS = 80;
 let refreshTimer: ReturnType<typeof setTimeout> | null = null;
 let focusedInitialRow = false;
 let refocusAfterRefresh = false;
@@ -109,7 +111,7 @@ function scheduleOutlineRefresh(): void {
   refreshTimer = setTimeout(() => {
     refreshTimer = null;
     refreshOutline();
-  }, 80);
+  }, OUTLINE_REFRESH_DEBOUNCE_MS);
 }
 
 watch(
diff --git a/src/mainview/modules/editor/preview/PreviewPane.vue b/src/mainview/modules/editor/preview/PreviewPane.vue
index 68a528e..7323989 100644
--- a/src/mainview/modules/editor/preview/PreviewPane.vue
+++ b/src/mainview/modules/editor/preview/PreviewPane.vue
@@ -138,12 +138,19 @@ function setScrollRatio(ratio: number): void {
 
 defineExpose({ setScrollRatio });
 
+/**
+ * Live inputs: the text being typed and the settings that change how it renders.
+ *
+ * `notes` is watched separately and never from here. It is the whole Folder scan
+ * (up to `MAX_SCANNED_DOCUMENTS` notes, each carrying its body), so traversing it
+ * on a watcher that also tracks `content` costs a deep walk of the corpus per
+ * keystroke: measured at ~300 ms per character with a 5,000-note folder.
+ */
 watch(
   () =>
     [
       props.path,
       props.content,
-      props.notes,
       props.linkMode,
       settings.value.links.resolution,
       locale.value,
@@ -155,7 +162,21 @@ watch(
     }
     scheduleRender();
   },
-  { deep: true, immediate: true },
+  { immediate: true },
+);
+
+/**
+ * Preview resolves link targets against the scan, so it re-renders when the scan
+ * changes. Depth 1 is enough: a scan update replaces whole note objects
+ * (`workspaceState.applyScannedNote` / `applyRenamedNote` splice the array, and a
+ * rescan replaces it), so a `ScannedNote` must not be mutated in place.
+ */
+watch(
+  () => props.notes,
+  () => {
+    scheduleRender();
+  },
+  { deep: 1 },
 );
 
 onBeforeUnmount(() => {
diff --git a/src/mainview/modules/editor/writingFocus.ts b/src/mainview/modules/editor/writingFocus.ts
index 478ebd4..8110e5f 100644
--- a/src/mainview/modules/editor/writingFocus.ts
+++ b/src/mainview/modules/editor/writingFocus.ts
@@ -7,7 +7,13 @@ export function toggleWritingFocus(): void {
   writingFocusActive.value = !writingFocusActive.value;
 }
 
-/** Focus chrome overlay applies only on the editor route. */
+/**
+ * Focus chrome overlay applies only on the editor route.
+ *
+ * The route name is compared as a literal rather than through `APP_ROUTE_NAMES`
+ * so this module stays independent of the router: callers pass whatever their
+ * route object reports, and nothing here needs vue-router to be loaded.
+ */
 export function writingFocusHidesEditorChrome(routeName: unknown): boolean {
   return writingFocusActive.value && routeName === "editor";
 }
diff --git a/src/mainview/modules/graph/core/graphProjection.ts b/src/mainview/modules/graph/core/graphProjection.ts
index 150077b..770112b 100644
--- a/src/mainview/modules/graph/core/graphProjection.ts
+++ b/src/mainview/modules/graph/core/graphProjection.ts
@@ -10,18 +10,18 @@ import type { ScannedNote } from "../../workspace/filesystem/workspaceTypes";
 import type { GraphViewState } from "./graphViewState";
 import type { ReferenceGraph, ReferenceGraphEdge } from "./graphTypes";
 
+function addNeighbor(adjacency: Map<string, Set<string>>, from: string, to: string): void {
+  const neighbors = adjacency.get(from) ?? new Set<string>();
+  neighbors.add(to);
+  adjacency.set(from, neighbors);
+}
+
 function buildUndirectedAdjacency(edges: ReferenceGraphEdge[]): Map<string, Set<string>> {
   const adjacency = new Map<string, Set<string>>();
 
   for (const edge of edges) {
-    if (!adjacency.has(edge.source)) {
-      adjacency.set(edge.source, new Set());
-    }
-    if (!adjacency.has(edge.target)) {
-      adjacency.set(edge.target, new Set());
-    }
-    adjacency.get(edge.source)!.add(edge.target);
-    adjacency.get(edge.target)!.add(edge.source);
+    addNeighbor(adjacency, edge.source, edge.target);
+    addNeighbor(adjacency, edge.target, edge.source);
   }
 
   return adjacency;
diff --git a/src/mainview/modules/graph/core/graphStructuralSelection.ts b/src/mainview/modules/graph/core/graphStructuralSelection.ts
index b93f7f9..8dd5ae8 100644
--- a/src/mainview/modules/graph/core/graphStructuralSelection.ts
+++ b/src/mainview/modules/graph/core/graphStructuralSelection.ts
@@ -6,6 +6,13 @@
  */
 import type { ReferenceGraph, ReferenceGraphEdge } from "./graphTypes";
 
+/**
+ * Depth for a node the focus BFS never reached. Only the bands matter to
+ * `selectStructuralEdges` (focus is 0, neighbor 1, secondary 2), so any value
+ * past secondary behaves the same; naming it keeps that intent visible.
+ */
+const BEYOND_SECONDARY_DEPTH = 3;
+
 export function buildDepthMap(
   graph: ReferenceGraph,
   edges: ReferenceGraphEdge[],
@@ -49,7 +56,7 @@ export function buildDepthMap(
 
   for (const node of graph.nodes) {
     if (!depths.has(node.id)) {
-      depths.set(node.id, 3);
+      depths.set(node.id, BEYOND_SECONDARY_DEPTH);
     }
   }
 
@@ -70,8 +77,8 @@ export function selectStructuralEdges(
       return true;
     }
 
-    const sourceDepth = depthMap.get(edge.source) ?? 99;
-    const targetDepth = depthMap.get(edge.target) ?? 99;
+    const sourceDepth = depthMap.get(edge.source) ?? BEYOND_SECONDARY_DEPTH;
+    const targetDepth = depthMap.get(edge.target) ?? BEYOND_SECONDARY_DEPTH;
     const minDepth = Math.min(sourceDepth, targetDepth);
     const maxDepth = Math.max(sourceDepth, targetDepth);
 
diff --git a/src/mainview/modules/graph/graphComputationSession.ts b/src/mainview/modules/graph/graphComputationSession.ts
index 7a70325..dd0f475 100644
--- a/src/mainview/modules/graph/graphComputationSession.ts
+++ b/src/mainview/modules/graph/graphComputationSession.ts
@@ -102,6 +102,20 @@ export function createGraphComputationSession(options: {
 
           worker.postMessage(referenceGraph);
         } catch {
+          // A worker that was constructed but never started must not outlive
+          // this call: WebKitGTK can fail the constructor or the structured
+          // clone, and the sync fallback below would otherwise leave that
+          // worker running until the next compute or terminate.
+          const orphan = active;
+          if (orphan) {
+            orphan.settled = true;
+            try {
+              orphan.worker.terminate();
+            } catch {
+              // Worker may already be dead.
+            }
+            active = null;
+          }
           resolve(options.runSync(referenceGraph));
         }
       });
diff --git a/src/mainview/modules/search/searchResults.ts b/src/mainview/modules/search/searchResults.ts
index 44c6ce3..139ce7e 100644
--- a/src/mainview/modules/search/searchResults.ts
+++ b/src/mainview/modules/search/searchResults.ts
@@ -7,6 +7,7 @@
  */
 import { documentFileType, type ScannedNote } from "../workspace/filesystem/workspaceTypes";
 import { runSearchStrategy } from "./searchStrategies";
+import type { SearchFileType } from "./searchOptions";
 import type {
   SearchDocumentGroup,
   SearchHit,
@@ -97,7 +98,7 @@ export function limitSearchGroups(
 
 export function filterNotesByFileType<T extends { path: string }>(
   notes: readonly T[],
-  fileType: "all" | "md" | "markdown" | "mdx",
+  fileType: SearchFileType,
 ): T[] {
   if (fileType === "all") {
     return [...notes];
diff --git a/src/mainview/modules/search/searchStrategies.ts b/src/mainview/modules/search/searchStrategies.ts
index 52c688b..f627677 100644
--- a/src/mainview/modules/search/searchStrategies.ts
+++ b/src/mainview/modules/search/searchStrategies.ts
@@ -61,6 +61,8 @@ const MAX_REGEX_LENGTH = 120;
 const MAX_STRATEGY_STEPS = 40_000;
 /** Wall-clock budget for one Search run (regex `exec` can hang beyond step counts). */
 const MAX_SEARCH_WALL_MS = 75;
+/** Result-row budget: enough context to recognize the match, short enough to scan. */
+const MAX_SNIPPET_CHARS = 180;
 
 export type SearchStrategyLimits = {
   maxPerDocument: number;
@@ -218,7 +220,7 @@ function positionAt(
   };
 }
 
-function snippetAt(text: string, offset: number, matchLength: number, maxLength = 180): string {
+function snippetAt(text: string, offset: number, matchLength: number): string {
   const matchEnd = Math.min(text.length, offset + Math.max(0, matchLength));
   const lineStart = text.lastIndexOf("\n", offset - 1) + 1;
   const firstLineEndIndex = text.indexOf("\n", offset);
@@ -228,13 +230,13 @@ function snippetAt(text: string, offset: number, matchLength: number, maxLength
     ? text.slice(lineStart, matchEnd).replace(/\s+/g, " ")
     : text.slice(lineStart, firstLineEnd);
   const line = rawLine.trim();
-  if (line.length <= maxLength) {
+  if (line.length <= MAX_SNIPPET_CHARS) {
     return line;
   }
 
   const leadingWhitespace = rawLine.length - rawLine.trimStart().length;
   const matchIndex = Math.max(0, offset - lineStart - leadingWhitespace);
-  const windowLength = Math.max(maxLength, matchLength);
+  const windowLength = Math.max(MAX_SNIPPET_CHARS, matchLength);
   const contextBefore = Math.max(0, Math.floor((windowLength - matchLength) / 2));
   const start = Math.max(0, Math.min(matchIndex - contextBefore, line.length - windowLength));
   const end = Math.min(line.length, start + windowLength);
diff --git a/src/mainview/modules/settings/settingsSearch.ts b/src/mainview/modules/settings/settingsSearch.ts
index fb07374..5aa9475 100644
--- a/src/mainview/modules/settings/settingsSearch.ts
+++ b/src/mainview/modules/settings/settingsSearch.ts
@@ -33,7 +33,7 @@ export const SETTINGS_SEARCH_ENTRIES: readonly SettingsSearchEntry[] = [
     category: "language",
     labelKey: "settings.locale",
     hintKey: "settings.localeHint",
-    terms: ["language", "idioma", "i18n"],
+    terms: ["language", "idioma", "i18n", "system"],
   },
   {
     id: "general.reset",
diff --git a/src/mainview/modules/settings/settingsStore.ts b/src/mainview/modules/settings/settingsStore.ts
index c163126..29f7651 100644
--- a/src/mainview/modules/settings/settingsStore.ts
+++ b/src/mainview/modules/settings/settingsStore.ts
@@ -9,6 +9,7 @@
 import { ref, watch } from "vue";
 import { setDocumentLinkSettings, type LinkResolutionMode } from "../document/links/linkSemantics";
 import type { LinkSyntax } from "../document/links/documentLink";
+import type { MarkdownFileType } from "../workspace/filesystem/workspaceTypes";
 import {
   DOCUMENT_LOCATION_DESTINATIONS,
   type DocumentLocationDestination,
@@ -18,8 +19,14 @@ import {
   THEME_PREFERENCES,
   type ThemePreference,
 } from "../editor/monaco/monacoThemes";
+import {
+  DEFAULT_LOCALE_PREFERENCE,
+  LOCALE_PREFERENCES,
+  type Locale,
+  type LocalePreference,
+} from "../../i18n/resolveLocale";
 
-export type Locale = "de" | "en" | "es" | "fr" | "it" | "nl" | "pt";
+export type { Locale, LocalePreference };
 export type LinkMode = LinkSyntax;
 export type WorkspaceStartup = "none" | "last";
 export type StatusbarIndicator =
@@ -90,7 +97,8 @@ export interface EditorSettings {
 }
 
 export interface FulvidSettings {
-  locale: Locale;
+  /** Explicit catalog locale, or "system" to follow a supported OS language. */
+  locale: LocalePreference;
   appearance: {
     theme: ThemePreference;
     interfaceTextScale: InterfaceTextScale;
@@ -114,7 +122,7 @@ export interface FulvidSettings {
     linkMode: LinkMode;
     resolution: LinkResolutionMode;
     /** New file / Save As when the name has no extension. Never renames existing files. */
-    defaultExtension: "md" | "markdown" | "mdx";
+    defaultExtension: MarkdownFileType;
     /** Document Context lists only. Graph still uses every resolved link. */
     showIncomingLinks: boolean;
     showOutgoingLinks: boolean;
@@ -127,7 +135,7 @@ export interface FulvidSettings {
 
 /** Single source of defaults for load, sanitize fallbacks, and reset. */
 const DEFAULT_SETTINGS: FulvidSettings = {
-  locale: "en",
+  locale: DEFAULT_LOCALE_PREFERENCE,
   appearance: {
     theme: DEFAULT_THEME,
     interfaceTextScale: "normal",
@@ -189,7 +197,7 @@ const STORAGE_KEY = "fulvid.settings.v1";
 /** Storage key for tests and recovery tooling - not a second settings authority. */
 export const SETTINGS_STORAGE_KEY = STORAGE_KEY;
 
-const VALID_LOCALES: readonly Locale[] = ["de", "en", "es", "fr", "it", "nl", "pt"];
+const VALID_LOCALE_PREFERENCES: readonly LocalePreference[] = LOCALE_PREFERENCES;
 const VALID_EDITOR_FONT_FAMILIES: readonly EditorFontFamily[] = ["monospace", "system", "serif"];
 const VALID_EDITOR_LINE_HEIGHTS: readonly EditorLineHeight[] = ["auto", "compact", "comfortable"];
 const VALID_EDITOR_TAB_SIZES: readonly EditorTabSize[] = [2, 4, 8];
@@ -205,6 +213,12 @@ const VALID_ICON_SCALES: readonly IconScale[] = ["small", "normal", "large"];
 const VALID_INTERFACE_DENSITIES: readonly InterfaceDensity[] = ["normal", "compact"];
 const VALID_READING_STATISTICS: readonly ReadingStatisticsMode[] = ["off", "words", "wordsAndTime"];
 
+/**
+ * Editor document font size range. Exported so the Settings control offers the
+ * same bounds this store clamps to - one rule, not a UI copy of it.
+ */
+export const EDITOR_FONT_SIZE_LIMITS = { min: 10, max: 24 } as const;
+
 /** A persisted value when it is one of `allowed`, otherwise the default. */
 function oneOf<T>(allowed: readonly T[], value: unknown, fallback: T): T {
   return (allowed as readonly unknown[]).includes(value) ? (value as T) : fallback;
@@ -251,7 +265,7 @@ export function sanitizeSettings(value: unknown): FulvidSettings {
   const defaults = DEFAULT_SETTINGS;
 
   return {
-    locale: oneOf(VALID_LOCALES, source.locale, defaults.locale),
+    locale: oneOf(VALID_LOCALE_PREFERENCES, source.locale, defaults.locale),
     appearance: {
       theme: oneOf(THEME_PREFERENCES, appearance.theme, DEFAULT_THEME),
       interfaceTextScale: oneOf(
@@ -292,7 +306,10 @@ export function sanitizeSettings(value: unknown): FulvidSettings {
     editor: {
       fontSize:
         typeof editor.fontSize === "number" && Number.isFinite(editor.fontSize)
-          ? Math.min(24, Math.max(10, editor.fontSize))
+          ? Math.min(
+              EDITOR_FONT_SIZE_LIMITS.max,
+              Math.max(EDITOR_FONT_SIZE_LIMITS.min, editor.fontSize),
+            )
           : defaults.editor.fontSize,
       fontFamily: oneOf(VALID_EDITOR_FONT_FAMILIES, editor.fontFamily, defaults.editor.fontFamily),
       lineHeight: oneOf(VALID_EDITOR_LINE_HEIGHTS, editor.lineHeight, defaults.editor.lineHeight),
diff --git a/src/mainview/modules/workspace/filesystem/filesystemRpc.ts b/src/mainview/modules/workspace/filesystem/filesystemRpc.ts
index 9b58c14..1f48efb 100644
--- a/src/mainview/modules/workspace/filesystem/filesystemRpc.ts
+++ b/src/mainview/modules/workspace/filesystem/filesystemRpc.ts
@@ -13,6 +13,7 @@ import type {
   GrantedDocumentSnapshot,
   GrantedDocumentWriteResult,
   HtmlExportResult,
+  MarkdownFileType,
   SaveAsResult,
   WorkspaceScan,
 } from "./workspaceTypes";
@@ -33,7 +34,7 @@ export type FilesystemRPC = {
         params: {
           basename: string;
           content: string;
-          defaultExtension: "md" | "markdown" | "mdx";
+          defaultExtension: MarkdownFileType;
           overwrite?: boolean;
         };
         response: SaveAsResult;
diff --git a/src/mainview/modules/workspace/filesystem/workspaceScanner.ts b/src/mainview/modules/workspace/filesystem/workspaceScanner.ts
index f0beb55..4b6da02 100644
--- a/src/mainview/modules/workspace/filesystem/workspaceScanner.ts
+++ b/src/mainview/modules/workspace/filesystem/workspaceScanner.ts
@@ -9,6 +9,7 @@ import type {
   GrantedDocumentWriteResult,
   FileSystemEntry,
   HtmlExportResult,
+  MarkdownFileType,
   SaveAsResult,
   WorkspaceScan,
 } from "./workspaceTypes";
@@ -78,7 +79,7 @@ export async function pickAndOpenDocument(): Promise<GrantedDocumentSnapshot | n
 export async function pickAndSaveDocument(
   basename: string,
   content: string,
-  defaultExtension: "md" | "markdown" | "mdx",
+  defaultExtension: MarkdownFileType,
   overwrite = false,
 ): Promise<SaveAsResult> {
   return desktopRequest().pickAndSaveDocument({
diff --git a/src/mainview/modules/workspace/filesystem/workspaceTypes.ts b/src/mainview/modules/workspace/filesystem/workspaceTypes.ts
index ecc52a6..e99bc3b 100644
--- a/src/mainview/modules/workspace/filesystem/workspaceTypes.ts
+++ b/src/mainview/modules/workspace/filesystem/workspaceTypes.ts
@@ -7,6 +7,9 @@ import type { DocumentLink } from "../../document/links/documentLink";
 
 export type MarkdownFileType = "md" | "markdown" | "mdx";
 
+/** Longest single filename common filesystems accept. */
+const MAX_BASENAME_LENGTH = 255;
+
 /** Names Windows refuses regardless of extension (CON, PRN, COM1, ...). */
 export const RESERVED_DEVICE_NAMES = new Set([
   "con",
@@ -61,7 +64,7 @@ function isSafePathBasename(name: string): boolean {
   if (
     !basenameValue ||
     basenameValue !== name ||
-    basenameValue.length > 255 ||
+    basenameValue.length > MAX_BASENAME_LENGTH ||
     basenameValue === "." ||
     basenameValue === ".." ||
     basenameValue.includes("/") ||
diff --git a/src/mainview/pages/editor/EditorPage.vue b/src/mainview/pages/editor/EditorPage.vue
index 254e8c1..1b28e92 100644
--- a/src/mainview/pages/editor/EditorPage.vue
+++ b/src/mainview/pages/editor/EditorPage.vue
@@ -1080,6 +1080,12 @@ function onPreviewMediaChange(event: MediaQueryListEvent): void {
  * Monaco's alternativeVersionId is not Vue-reactive - do not watch it. Live
  * edits are observed via MonacoHost `contentChange` (onDidChangeModelContent).
  */
+/**
+ * Coalesce always-on document packs while typing. Long enough that a pack is not
+ * re-invoked per keystroke, short enough that a pause refreshes before the reader
+ * looks away.
+ */
+const DOCUMENT_ACTIVATION_DEBOUNCE_MS = 180;
 let documentActivationTimer: ReturnType<typeof setTimeout> | null = null;
 let documentActivationGeneration = 0;
 
@@ -1119,7 +1125,7 @@ function scheduleDocumentActivationRefresh(): void {
         }
       }
     })();
-  }, 180);
+  }, DOCUMENT_ACTIVATION_DEBOUNCE_MS);
 }
 
 watch(
diff --git a/src/mainview/pages/settings/SettingsPage.vue b/src/mainview/pages/settings/SettingsPage.vue
index ccca73f..d8ba5bf 100644
--- a/src/mainview/pages/settings/SettingsPage.vue
+++ b/src/mainview/pages/settings/SettingsPage.vue
@@ -8,6 +8,7 @@
 import { computed, nextTick, onBeforeUnmount, onMounted, ref, watch } from "vue";
 import PageShell from "../../shell/PageShell.vue";
 import {
+  EDITOR_FONT_SIZE_LIMITS,
   patchSettings,
   resetSettingsToDefaults,
   settings,
@@ -705,6 +706,7 @@ async function onOpenSponsorPage(): Promise<void> {
                   setLocale(($event.target as HTMLSelectElement).value as FulvidSettings['locale'])
                 "
               >
+                <option value="system">{{ t("settings.system") }}</option>
                 <option value="de">{{ t("settings.german") }}</option>
                 <option value="en">{{ t("settings.english") }}</option>
                 <option value="es">{{ t("settings.spanish") }}</option>
@@ -736,8 +738,8 @@ async function onOpenSponsorPage(): Promise<void> {
                 <input
                   class="settings-option__number"
                   type="number"
-                  min="10"
-                  max="24"
+                  :min="EDITOR_FONT_SIZE_LIMITS.min"
+                  :max="EDITOR_FONT_SIZE_LIMITS.max"
                   step="1"
                   :value="settings.editor.fontSize"
                   :aria-label="t('settings.editorFontSize')"
@@ -2023,9 +2025,33 @@ async function onOpenSponsorPage(): Promise<void> {
                 <dd>{{ t("settings.shortcutCloseOthers") }}</dd>
               </div>
               <div class="settings-shortcuts__row">
-                <dt><kbd>Left</kbd> <kbd>Right</kbd></dt>
+                <dt>
+                  <kbd>{{ primaryModifier }}</kbd
+                  ><kbd>Tab</kbd>
+                  /
+                  <kbd>{{ primaryModifier }}</kbd
+                  ><kbd>Shift</kbd><kbd>Tab</kbd>
+                </dt>
                 <dd>{{ t("settings.shortcutTabs") }}</dd>
               </div>
+              <div class="settings-shortcuts__row">
+                <dt>
+                  <kbd>{{ primaryModifier }}</kbd
+                  ><kbd>PageDown</kbd>
+                  /
+                  <kbd>{{ primaryModifier }}</kbd
+                  ><kbd>PageUp</kbd>
+                </dt>
+                <dd>{{ t("settings.shortcutTabsOrder") }}</dd>
+              </div>
+              <div class="settings-shortcuts__row">
+                <dt><kbd>Left</kbd> <kbd>Right</kbd></dt>
+                <dd>{{ t("settings.shortcutTabList") }}</dd>
+              </div>
+              <div class="settings-shortcuts__row">
+                <dt><kbd>Alt</kbd><kbd>Left</kbd> <kbd>Alt</kbd><kbd>Right</kbd></dt>
+                <dd>{{ t("settings.shortcutMoveTab") }}</dd>
+              </div>
               <div class="settings-shortcuts__row">
                 <dt><kbd>I</kbd></dt>
                 <dd>{{ t("settings.shortcutContext") }}</dd>
diff --git a/src/mainview/shell/AppSidebar.vue b/src/mainview/shell/AppSidebar.vue
index b60de0c..701a784 100644
--- a/src/mainview/shell/AppSidebar.vue
+++ b/src/mainview/shell/AppSidebar.vue
@@ -8,6 +8,7 @@ import ContextMenu, { type ContextMenuAction } from "./ContextMenu.vue";
 import { notify } from "../app/notify";
 import { describeFilesystemError } from "../modules/workspace/filesystem/workspaceScanner";
 import {
+  LAYOUT_RESIZE_STEP_PX,
   SIDEBAR_WIDTH_LIMITS,
   closeLeftSidebar,
   openLeftSidebar,
@@ -314,8 +315,8 @@ async function runWorkspaceMenu(id: string): Promise<void> {
         :aria-valuemax="SIDEBAR_WIDTH_LIMITS.max"
         tabindex="0"
         @pointerdown="startSidebarResize"
-        @keydown.left.prevent="setSidebarWidth(layout.sidebarWidth - 8)"
-        @keydown.right.prevent="setSidebarWidth(layout.sidebarWidth + 8)"
+        @keydown.left.prevent="setSidebarWidth(layout.sidebarWidth - LAYOUT_RESIZE_STEP_PX)"
+        @keydown.right.prevent="setSidebarWidth(layout.sidebarWidth + LAYOUT_RESIZE_STEP_PX)"
       />
     </template>
   </aside>
diff --git a/src/mainview/shell/applicationMenu/applicationMenuModel.ts b/src/mainview/shell/applicationMenu/applicationMenuModel.ts
index 4107ca5..0886c8d 100644
--- a/src/mainview/shell/applicationMenu/applicationMenuModel.ts
+++ b/src/mainview/shell/applicationMenu/applicationMenuModel.ts
@@ -583,12 +583,14 @@ export function applicationMenuTemplate(platform: DesktopPlatform): readonly App
               type: "command",
               id: "nextTab",
               label: "menu.nextTab",
+              shortcut: "Ctrl/Cmd+PageDown",
               availability: "hasMultipleTabs",
             },
             {
               type: "command",
               id: "previousTab",
               label: "menu.previousTab",
+              shortcut: "Ctrl/Cmd+PageUp",
               availability: "hasMultipleTabs",
             },
           ],
diff --git a/src/mainview/shell/commands.ts b/src/mainview/shell/commands.ts
index 7bbb6a0..8299d6c 100644
--- a/src/mainview/shell/commands.ts
+++ b/src/mainview/shell/commands.ts
@@ -494,8 +494,14 @@ export function hasCommandHandler(id: CommandId): boolean {
   return handlers.has(id);
 }
 
+/** How long a command waits for a lazily mounted page to claim it before giving up. */
+const COMMAND_HANDLER_WAIT_MS = 3_000;
+
 /** Wait for a lazy-loaded page to register its handler after navigation. */
-export async function waitForCommandHandler(id: CommandId, timeoutMs = 3000): Promise<boolean> {
+export async function waitForCommandHandler(
+  id: CommandId,
+  timeoutMs = COMMAND_HANDLER_WAIT_MS,
+): Promise<boolean> {
   if (handlers.has(id)) {
     return true;
   }
diff --git a/tests/bun/filesystem/io/documentIo.integration.test.ts b/tests/bun/filesystem/io/documentIo.integration.test.ts
index 47e7996..8a0286d 100644
--- a/tests/bun/filesystem/io/documentIo.integration.test.ts
+++ b/tests/bun/filesystem/io/documentIo.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { chmod, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -19,7 +19,7 @@ import {
   documentConflictMessage,
   filesystemErrorMessage,
 } from "../../../../src/mainview/modules/workspace/filesystem/workspaceErrors.ts";
-import { linkDirectory } from "../../../support/platform";
+import { linkDirectory, posixModeBitsDenyAccess } from "../../../support/platform";
 
 async function makeWorkspace(): Promise<string> {
   return mkdtemp(join(tmpdir(), "editor-document-io-"));
@@ -275,4 +275,45 @@ describe("filename identity", () => {
       await rm(root, { recursive: true, force: true });
     }
   });
+
+  // Regression: temp+rename installs a new inode, so a save used to replace the
+  // document's own permissions with the process umask - a note kept private at
+  // 0600 came back 0644. Save writes content, never a wider mode.
+  test.skipIf(!posixModeBitsDenyAccess)(
+    "keeps the document's permissions across an atomic replace",
+    async () => {
+      const root = await makeWorkspace();
+      try {
+        const created = await createDocument(root, "private.md", "# secret\n", "markdown");
+        await chmod(created.absolutePath, 0o600);
+
+        const opened = await readDocument(root, "private.md");
+        const written = await writeDocument(
+          root,
+          "private.md",
+          "# secret edited\n",
+          opened.mtimeMs,
+          "markdown",
+        );
+
+        expect((await stat(written.absolutePath)).mode & 0o777).toBe(0o600);
+
+        // A mode wider than the umask default has to survive too: `open` clips
+        // the creation mode, so only the chmod after it keeps this bit.
+        await chmod(written.absolutePath, 0o666);
+        const reopened = await readDocument(root, "private.md");
+        const widened = await writeDocument(
+          root,
+          "private.md",
+          "# secret widened\n",
+          reopened.mtimeMs,
+          "markdown",
+        );
+        expect((await stat(widened.absolutePath)).mode & 0o777).toBe(0o666);
+        expect(await readFile(created.absolutePath, "utf8")).toBe("# secret widened\n");
+      } finally {
+        await rm(root, { recursive: true, force: true });
+      }
+    },
+  );
 });
diff --git a/tests/bun/filesystem/io/documentLifecycle.smoke.test.ts b/tests/bun/filesystem/io/documentLifecycle.integration.test.ts
similarity index 100%
rename from tests/bun/filesystem/io/documentLifecycle.smoke.test.ts
rename to tests/bun/filesystem/io/documentLifecycle.integration.test.ts
diff --git a/tests/bun/filesystem/scanning/scanDirectory.integration.test.ts b/tests/bun/filesystem/scanning/scanDirectory.integration.test.ts
index 9650f2a..13a546a 100644
--- a/tests/bun/filesystem/scanning/scanDirectory.integration.test.ts
+++ b/tests/bun/filesystem/scanning/scanDirectory.integration.test.ts
@@ -85,6 +85,33 @@ describe("filesystem Explorer listing and scan", () => {
     }
   }, 60_000);
 
+  // The document count alone does not bound what one scan hands the renderer:
+  // every note carries its body for Search. The test budget can only tighten the
+  // production ceiling, which is how this reaches it without writing 128 MiB.
+  test("stops at the aggregate content ceiling and keeps the notes it loaded whole", async () => {
+    const root = await makeWorkspace();
+    try {
+      const body = `# note\n${"x".repeat(4_000)}\n`;
+      for (let index = 0; index < 3; index += 1) {
+        await writeFile(join(root, `note-${index}.md`), body, "utf8");
+      }
+
+      const scan = await scanWorkspace(
+        root,
+        { linkMode: "markdown" },
+        { contentBudgetChars: body.length * 2 },
+      );
+      expect(scan.truncated).toBe(true);
+      expect(scan.scannedNotes).toHaveLength(2);
+      // Unreadable entries stay a separate signal from a folder cut short.
+      expect(scan.skipped).toBe(0);
+      // A partial scan never returns a partial note.
+      expect(scan.scannedNotes.map((note) => note.content)).toEqual([body, body]);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
   test("skips hostile entries without failing, and keeps empty vs skipped-only scans distinct", async () => {
     const deniedRoot = await makeWorkspace();
     const denied = resolve(join(deniedRoot, "denied"));
diff --git a/tests/extensions/extensionAdversarial.unit.test.ts b/tests/extensions/extensionAdversarial.unit.test.ts
index 8de7652..056a02f 100644
--- a/tests/extensions/extensionAdversarial.unit.test.ts
+++ b/tests/extensions/extensionAdversarial.unit.test.ts
@@ -20,12 +20,12 @@ import {
   LUA_EXTENSION_LIMITS,
   setLuaExecutionBudgetForTests,
 } from "../../src/bun/extensions/lua/luaLimits.ts";
-import { parseExtensionDecorationRanges } from "../../src/mainview/extensions/decorationCapability.ts";
 import {
   loadValidatedLuaPack,
   luaManifest,
   tempExtensionRoot,
   writeExtensionPack,
+  cleanupTempExtensionRoots,
 } from "./manifestTestHelpers.ts";
 import {
   configureExtensionHostActions,
@@ -39,7 +39,8 @@ import {
   resetEditorExtensionSeamForTests,
 } from "../../src/mainview/extensions/editorExtensionSeam.ts";
 
-afterEach(() => {
+afterEach(async () => {
+  await cleanupTempExtensionRoots();
   resetExtensionRegistryForTests();
   resetEditorExtensionSeamForTests();
   resetLuaCommandStore();
@@ -90,7 +91,7 @@ describe("adversarial lua sandbox", () => {
 });
 
 describe("adversarial resource bounds", () => {
-  test("rejects oversized titles, notify flood, decoration coords, and reveal", async () => {
+  test("rejects oversized titles, notify flood, and reveal", async () => {
     const root = await tempExtensionRoot("bounds");
     const title = "T".repeat(LUA_EXTENSION_LIMITS.maxCommandTitleChars.value + 1);
     const titlePack = await writeExtensionPack(
@@ -136,19 +137,6 @@ commands.register({
       expect(flood.error).toMatch(/size limit/i);
     }
 
-    const max = LUA_EXTENSION_LIMITS.maxRevealPosition.value;
-    expect(
-      parseExtensionDecorationRanges([
-        {
-          startLine: max + 1,
-          startColumn: 1,
-          endLine: max + 1,
-          endColumn: 2,
-          style: "info",
-        },
-      ]),
-    ).toEqual({ ok: false, error: "invalid decoration range" });
-
     const revealPack = await writeExtensionPack(
       root,
       "test.adv-reveal",
diff --git a/tests/extensions/extensionDecorationOwnership.unit.test.ts b/tests/extensions/extensionDecorationOwnership.unit.test.ts
index 65f3f6f..b5f63b9 100644
--- a/tests/extensions/extensionDecorationOwnership.unit.test.ts
+++ b/tests/extensions/extensionDecorationOwnership.unit.test.ts
@@ -1,8 +1,9 @@
 /**
  * Ownership for extension decorations: packs pick colors; Fulvid paints safely.
  */
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 
+import { LUA_EXTENSION_LIMITS } from "../../src/bun/extensions/lua/luaLimits.ts";
 import {
   appearanceClassKey,
   cssClassForExtensionAppearance,
@@ -16,6 +17,10 @@ import {
   resetExtensionAppearanceStylesForTests,
 } from "../../src/mainview/extensions/decorationCapability.ts";
 
+afterEach(() => {
+  resetExtensionAppearanceStylesForTests();
+});
+
 describe("extension-owned decoration appearance", () => {
   test("decoration parse rejects injection; apply maps closed styles and distinct appearance classes", () => {
     expect(parseDecorationColor("#d29922")).toEqual({ ok: true, color: "#d29922" });
@@ -28,6 +33,19 @@ describe("extension-owned decoration appearance", () => {
       parseDecorationAppearance({ backgroundColor: "#abc", color: "expression(alert(1))" }).ok,
     ).toBe(false);
 
+    const maxPos = LUA_EXTENSION_LIMITS.maxRevealPosition.value;
+    expect(
+      parseExtensionDecorationRanges([
+        {
+          startLine: maxPos + 1,
+          startColumn: 1,
+          endLine: maxPos + 1,
+          endColumn: 2,
+          style: "info",
+        },
+      ]),
+    ).toEqual({ ok: false, error: "invalid decoration range" });
+
     expect(
       parseExtensionDecorationRanges([
         { startLine: 1, startColumn: 1, endLine: 1, endColumn: 4, style: "warn" },
diff --git a/tests/extensions/extensionDiscovery.unit.test.ts b/tests/extensions/extensionDiscovery.unit.test.ts
index 5f2ddd9..fb44514 100644
--- a/tests/extensions/extensionDiscovery.unit.test.ts
+++ b/tests/extensions/extensionDiscovery.unit.test.ts
@@ -8,7 +8,12 @@ import {
   resetExtensionDiscoveryForTests,
 } from "../../src/bun/extensions/discoverExtensions.ts";
 import { namespacedExtensionCommandId } from "../../src/mainview/extensions/extensionManifest.ts";
-import { luaManifest, tempExtensionRoot, writeExtensionPack } from "./manifestTestHelpers.ts";
+import {
+  luaManifest,
+  tempExtensionRoot,
+  writeExtensionPack,
+  cleanupTempExtensionRoots,
+} from "./manifestTestHelpers.ts";
 import {
   configureExtensionHostActions,
   listExtensionCommands,
@@ -28,7 +33,8 @@ commands.register({
 })
 `;
 
-afterEach(() => {
+afterEach(async () => {
+  await cleanupTempExtensionRoots();
   resetExtensionDiscoveryForTests();
   resetExtensionRegistryForTests();
 });
diff --git a/tests/extensions/extensionEditorCapability.unit.test.ts b/tests/extensions/extensionEditorCapability.unit.test.ts
index 87f863e..aad6d2e 100644
--- a/tests/extensions/extensionEditorCapability.unit.test.ts
+++ b/tests/extensions/extensionEditorCapability.unit.test.ts
@@ -36,6 +36,7 @@ import {
   luaManifest,
   tempExtensionRoot,
   writeExtensionPack,
+  cleanupTempExtensionRoots,
 } from "./manifestTestHelpers.ts";
 
 const EDITOR_FIXTURE = join(import.meta.dir, "fixtures/test.contract-lua-editor");
@@ -119,7 +120,8 @@ function registerEditorFixture(): void {
   });
 }
 
-afterEach(() => {
+afterEach(async () => {
+  await cleanupTempExtensionRoots();
   resetEditorExtensionSeamForTests();
   resetExtensionRegistryForTests();
   resetLuaCommandStore();
@@ -234,7 +236,7 @@ commands.register({
     ).toEqual({ ok: true, notifications: ["plain-data"] });
   });
 
-  test("stale apply, no editor, oversized, and capability denial fail closed", async () => {
+  test("stale apply, no editor, oversized, and nil-without-cap fail closed", async () => {
     const root = await tempExtensionRoot("fail");
     const pack = join(root, "test.contract-lua-editor");
     await cp(EDITOR_FIXTURE, pack, { recursive: true });
@@ -303,7 +305,8 @@ commands.register({
       expect(bigResult.error).toMatch(/exceeds size limit/);
     }
 
-    // Capability denial covered in adversarial; keep nil-without-cap smoke for editor surface.
+    // Capability denial with an editor snapshot is covered in adversarial.
+    // Keep the editor-surface smoke: without the capability, editor stays nil.
     const noed = await writeExtensionPack(
       root,
       "test.contract-lua-noed",
@@ -325,16 +328,6 @@ commands.register({
       },
     );
     await loadValidatedLuaPack(noed);
-    expect(
-      await invokeLuaExtensionCommand({
-        namespacedId: "test.contract-lua-noed.ping",
-        editor: editorSnap("secret"),
-      }),
-    ).toEqual({
-      ok: false,
-      error: "editor capability not granted",
-      failureKind: "commandFailed",
-    });
     expect(await invokeLuaExtensionCommand("test.contract-lua-noed.ping")).toEqual({
       ok: true,
       notifications: ["ok"],
diff --git a/tests/extensions/extensionLifecycle.unit.test.ts b/tests/extensions/extensionLifecycle.unit.test.ts
index 59de6cc..c2ce54f 100644
--- a/tests/extensions/extensionLifecycle.unit.test.ts
+++ b/tests/extensions/extensionLifecycle.unit.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, test } from "bun:test";
-import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 
@@ -22,9 +22,12 @@ import {
 import { findLuaCommand } from "../../src/bun/extensions/lua/luaExtensionRuntime.ts";
 import { luaManifest } from "./manifestTestHelpers.ts";
 
+const lifecycleTempRoots = new Set<string>();
+
 async function tempUserData(label: string): Promise<string> {
   const root = join(tmpdir(), `fulvid-lifecycle-${label}-${crypto.randomUUID()}`);
   await mkdir(root, { recursive: true });
+  lifecycleTempRoots.add(root);
   return root;
 }
 
@@ -49,9 +52,14 @@ commands.register({
   return pack;
 }
 
-afterEach(() => {
+afterEach(async () => {
   resetExtensionDiscoveryForTests();
   resetExtensionAllowancesForTests();
+  const roots = [...lifecycleTempRoots];
+  lifecycleTempRoots.clear();
+  await Promise.all(
+    roots.map((root) => rm(root, { recursive: true, force: true }).catch(() => undefined)),
+  );
 });
 
 describe("extension install/uninstall lifecycle", () => {
diff --git a/tests/extensions/extensionLiveDocumentLifecycle.unit.test.ts b/tests/extensions/extensionLiveDocumentLifecycle.unit.test.ts
index 486dfde..3b6c86e 100644
--- a/tests/extensions/extensionLiveDocumentLifecycle.unit.test.ts
+++ b/tests/extensions/extensionLiveDocumentLifecycle.unit.test.ts
@@ -5,7 +5,7 @@
  */
 import { afterEach, describe, expect, test } from "bun:test";
 import { existsSync } from "node:fs";
-import { cp, mkdir } from "node:fs/promises";
+import { cp, mkdir, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 
@@ -44,12 +44,19 @@ const OFFICIAL_PACKS_AVAILABLE = existsSync(TODO_PACK) && existsSync(MDX_PACK);
 const TODO_REFRESH = "imgildev.todo-decorator.todoRefresh";
 const MDX_REFRESH = "imgildev.mdx-comments.mdxCommentsRefresh";
 
-afterEach(() => {
+const liveDocTempRoots = new Set<string>();
+
+afterEach(async () => {
   resetExtensionDiscoveryForTests();
   resetExtensionRegistryForTests();
   resetExtensionAllowancesForTests();
   resetEditorExtensionSeamForTests();
   resetLuaFactoryForTests();
+  const roots = [...liveDocTempRoots];
+  liveDocTempRoots.clear();
+  await Promise.all(
+    roots.map((root) => rm(root, { recursive: true, force: true }).catch(() => undefined)),
+  );
 });
 
 async function loadBothPacks(): Promise<void> {
@@ -57,6 +64,7 @@ async function loadBothPacks(): Promise<void> {
     throw new Error("official packs unavailable; test should have been skipped");
   }
   const userData = join(tmpdir(), `fulvid-live-doc-${crypto.randomUUID()}`);
+  liveDocTempRoots.add(userData);
   const root = join(userData, "extensions");
   await mkdir(root, { recursive: true });
   await cp(TODO_PACK, join(root, "imgildev.todo-decorator"), { recursive: true });
diff --git a/tests/extensions/extensionLuaRuntime.unit.test.ts b/tests/extensions/extensionLuaRuntime.unit.test.ts
index 295cf01..959a6ff 100644
--- a/tests/extensions/extensionLuaRuntime.unit.test.ts
+++ b/tests/extensions/extensionLuaRuntime.unit.test.ts
@@ -28,11 +28,13 @@ import {
   luaManifest,
   tempExtensionRoot,
   writeExtensionPack,
+  cleanupTempExtensionRoots,
 } from "./manifestTestHelpers.ts";
 
 const NOTIFY_FIXTURE = join(import.meta.dir, "fixtures/test.contract-lua-notify");
 
-afterEach(() => {
+afterEach(async () => {
+  await cleanupTempExtensionRoots();
   setLuaExecutionBudgetForTests(null);
   setLuaMemoryBudgetForTests(null);
   resetExtensionDiscoveryForTests();
@@ -135,22 +137,8 @@ describe("lua execution and memory budgets", () => {
 
     setLuaExecutionBudgetForTests(100);
     const root = await tempExtensionRoot("loop");
-    const loopLoad = await writeExtensionPack(
-      root,
-      "test.contract-lua-loop",
-      luaManifest("test.contract-lua-loop"),
-      {
-        "entry.lua": `
-commands.register({ id = "one", title = "One", run = function() end })
-while true do end
-`,
-      },
-    );
-    await expect(loadValidatedLuaPack(loopLoad)).rejects.toMatchObject({
-      reason: "execution limit exceeded",
-    });
-    expect(findLuaCommand("test.contract-lua-loop.one")).toBeNull();
-
+    // Load-time infinite loop is covered in extensionAdversarial. Keep invoke-time
+    // hang and discovery neighbor isolation here.
     const good = await writeExtensionPack(
       root,
       "test.contract-lua-good",
diff --git a/tests/extensions/extensionOrganicIntegration.unit.test.ts b/tests/extensions/extensionOrganicIntegration.unit.test.ts
index 3a9b6ce..ebe6b74 100644
--- a/tests/extensions/extensionOrganicIntegration.unit.test.ts
+++ b/tests/extensions/extensionOrganicIntegration.unit.test.ts
@@ -10,7 +10,12 @@ import {
 } from "../../src/bun/extensions/discoverExtensions.ts";
 import { resetExtensionAllowancesForTests } from "../../src/bun/extensions/extensionAllowances.ts";
 import { validateExtensionManifest } from "../../src/mainview/extensions/extensionManifest.ts";
-import { luaManifest, tempExtensionRoot, writeExtensionPack } from "./manifestTestHelpers.ts";
+import {
+  luaManifest,
+  tempExtensionRoot,
+  writeExtensionPack,
+  cleanupTempExtensionRoots,
+} from "./manifestTestHelpers.ts";
 import { integrateExtensionActionsIntoMenus } from "../../src/mainview/shell/applicationMenu/applicationMenuModel.ts";
 import { resetExtensionRegistryForTests } from "../../src/mainview/extensions/extensionRegistry.ts";
 
@@ -33,7 +38,8 @@ async function writePack(
   await writeExtensionPack(root, id, manifest, { "entry.lua": entry });
 }
 
-afterEach(() => {
+afterEach(async () => {
+  await cleanupTempExtensionRoots();
   resetExtensionDiscoveryForTests();
   resetExtensionRegistryForTests();
   resetExtensionAllowancesForTests();
diff --git a/tests/extensions/manifestTestHelpers.ts b/tests/extensions/manifestTestHelpers.ts
index dfb4be0..fc59bd2 100644
--- a/tests/extensions/manifestTestHelpers.ts
+++ b/tests/extensions/manifestTestHelpers.ts
@@ -2,13 +2,15 @@
  * Shared helpers for extension unit tests - valid publisher.name manifests
  * and on-disk pack fixtures.
  */
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 
 import { loadLuaExtensionPack } from "../../src/bun/extensions/lua/luaExtensionRuntime.ts";
 import { validateExtensionManifest } from "../../src/mainview/extensions/extensionManifest.ts";
 
+const tempRoots = new Set<string>();
+
 export function splitExtensionId(id: string): { publisher: string; name: string } {
   const dot = id.indexOf(".");
   if (dot <= 0 || dot === id.length - 1) {
@@ -41,9 +43,19 @@ export function luaManifest(
 export async function tempExtensionRoot(label: string): Promise<string> {
   const root = join(tmpdir(), `fulvid-ext-${label}-${crypto.randomUUID()}`);
   await mkdir(root, { recursive: true });
+  tempRoots.add(root);
   return root;
 }
 
+/** Remove roots created by {@link tempExtensionRoot} during this process. */
+export async function cleanupTempExtensionRoots(): Promise<void> {
+  const roots = [...tempRoots];
+  tempRoots.clear();
+  await Promise.all(
+    roots.map((root) => rm(root, { recursive: true, force: true }).catch(() => undefined)),
+  );
+}
+
 /** Write a pack under `root/<id>` and return the pack directory. */
 export async function writeExtensionPack(
   root: string,
diff --git a/tests/mainview/app/dialogs.unit.test.ts b/tests/mainview/app/dialogs.unit.test.ts
index 322881e..90fabaa 100644
--- a/tests/mainview/app/dialogs.unit.test.ts
+++ b/tests/mainview/app/dialogs.unit.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 
 import {
   activeDialog,
@@ -11,6 +11,10 @@ import {
   submitQuickOpen,
 } from "../../../src/mainview/app/dialogs.ts";
 
+afterEach(() => {
+  cancelDialog();
+});
+
 // Intent: DialogHost owns dialog lifecycle through this module - replace dismisses
 // the prior request, cancel/submit resolve exactly once, empty submit is a no-op.
 describe("dialog lifecycle", () => {
diff --git a/tests/mainview/app/isTabKey.unit.test.ts b/tests/mainview/app/isTabKey.unit.test.ts
new file mode 100644
index 0000000..aa33cd7
--- /dev/null
+++ b/tests/mainview/app/isTabKey.unit.test.ts
@@ -0,0 +1,23 @@
+import { describe, expect, test } from "bun:test";
+
+import { isTabKey } from "../../../src/mainview/app/isTabKey.ts";
+
+describe("isTabKey", () => {
+  test("matches plain Tab", () => {
+    expect(isTabKey({ key: "Tab", code: "Tab" })).toBe(true);
+  });
+
+  test("matches ISO_Left_Tab used by some WebKit Shift+Tab paths", () => {
+    expect(isTabKey({ key: "ISO_Left_Tab", code: "Tab" })).toBe(true);
+    expect(isTabKey({ key: "ISO_Left_Tab", code: "ISO_Left_Tab" })).toBe(true);
+  });
+
+  test("matches by code when key is layout-specific but code is Tab", () => {
+    expect(isTabKey({ key: "Unidentified", code: "Tab" })).toBe(true);
+  });
+
+  test("rejects unrelated keys", () => {
+    expect(isTabKey({ key: "t", code: "KeyT" })).toBe(false);
+    expect(isTabKey({ key: "PageDown", code: "PageDown" })).toBe(false);
+  });
+});
diff --git a/tests/mainview/app/layoutStore.unit.test.ts b/tests/mainview/app/layoutStore.unit.test.ts
index a7155e8..3022e05 100644
--- a/tests/mainview/app/layoutStore.unit.test.ts
+++ b/tests/mainview/app/layoutStore.unit.test.ts
@@ -1,6 +1,7 @@
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, beforeEach, describe, expect, test } from "bun:test";
 
 const store = new Map<string, string>();
+const previousLocalStorage = (globalThis as { localStorage?: unknown }).localStorage;
 
 (globalThis as { localStorage?: unknown }).localStorage = {
   getItem: (key: string) => store.get(key) ?? null,
@@ -34,6 +35,14 @@ afterEach(() => {
   store.clear();
 });
 
+afterAll(() => {
+  if (previousLocalStorage === undefined) {
+    delete (globalThis as { localStorage?: unknown }).localStorage;
+  } else {
+    (globalThis as { localStorage?: unknown }).localStorage = previousLocalStorage;
+  }
+});
+
 // Intent: persisted geometry stays safe at startup and within usable bounds.
 describe("persisted layout", () => {
   test("corrupt or out-of-range layout degrades to usable defaults", async () => {
diff --git a/tests/mainview/i18n/resolveLocale.unit.test.ts b/tests/mainview/i18n/resolveLocale.unit.test.ts
new file mode 100644
index 0000000..42e8867
--- /dev/null
+++ b/tests/mainview/i18n/resolveLocale.unit.test.ts
@@ -0,0 +1,74 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  FALLBACK_LOCALE,
+  matchSupportedLocale,
+  normalizeLocaleTag,
+  readOsLocaleTags,
+  resolveLocalePreference,
+} from "../../../src/mainview/i18n/resolveLocale";
+
+// Intent: OS -> Fulvid locale mapping is allowlist-only, preference-aware, and fail-closed to English.
+describe("resolveLocale", () => {
+  test("normalizes tags and matches only the supported allowlist", () => {
+    expect(normalizeLocaleTag("en-US")).toBe("en-us");
+    expect(normalizeLocaleTag("en_GB")).toBe("en-gb");
+    expect(normalizeLocaleTag("pt-BR")).toBe("pt-br");
+    expect(normalizeLocaleTag("es_ES.UTF-8")).toBe("es-es");
+    expect(normalizeLocaleTag("fr_FR.UTF-8@euro")).toBe("fr-fr");
+    expect(normalizeLocaleTag("  NL_nl  ")).toBe("nl-nl");
+    expect(normalizeLocaleTag("C")).toBe("");
+    expect(normalizeLocaleTag("POSIX")).toBe("");
+    expect(normalizeLocaleTag("")).toBe("");
+    expect(normalizeLocaleTag(null)).toBe("");
+    expect(normalizeLocaleTag(42)).toBe("");
+    expect(normalizeLocaleTag("!!!")).toBe("");
+
+    expect(matchSupportedLocale("de")).toBe("de");
+    expect(matchSupportedLocale("de-DE")).toBe("de");
+    expect(matchSupportedLocale("de_AT")).toBe("de");
+    expect(matchSupportedLocale("fr-FR")).toBe("fr");
+    expect(matchSupportedLocale("es-MX")).toBe("es");
+    expect(matchSupportedLocale("pt-BR")).toBe("pt");
+    expect(matchSupportedLocale("it_IT.UTF-8")).toBe("it");
+    expect(matchSupportedLocale("nl-NL")).toBe("nl");
+    expect(matchSupportedLocale("en-US")).toBe("en");
+
+    expect(matchSupportedLocale("ja")).toBeNull();
+    expect(matchSupportedLocale("zh-CN")).toBeNull();
+    expect(matchSupportedLocale("")).toBeNull();
+    expect(matchSupportedLocale(undefined)).toBeNull();
+    expect(matchSupportedLocale("not a locale")).toBeNull();
+    expect(matchSupportedLocale("123")).toBeNull();
+  });
+
+  test("resolves explicit preference over OS, then OS over English", () => {
+    expect(resolveLocalePreference("system", ["de-DE"])).toBe("de");
+    expect(resolveLocalePreference("system", ["fr_CA.UTF-8"])).toBe("fr");
+    expect(resolveLocalePreference("system", ["ja-JP", "es-MX"])).toBe("es");
+    expect(resolveLocalePreference("system", ["ja-JP"])).toBe(FALLBACK_LOCALE);
+    expect(resolveLocalePreference("system", [])).toBe(FALLBACK_LOCALE);
+    expect(resolveLocalePreference("system", [null, "", "!!!"])).toBe(FALLBACK_LOCALE);
+    expect(resolveLocalePreference("system")).toBe(FALLBACK_LOCALE);
+
+    expect(resolveLocalePreference("en", ["de-DE"])).toBe("en");
+    expect(resolveLocalePreference("it", ["fr-FR"])).toBe("it");
+    const persisted = "de" as const;
+    expect(resolveLocalePreference(persisted, ["en-US"])).toBe("de");
+    expect(resolveLocalePreference(persisted, ["zh-CN"])).toBe("de");
+
+    expect(resolveLocalePreference("ja", ["nl-NL"])).toBe("nl");
+    expect(resolveLocalePreference(undefined, ["pt-BR"])).toBe("pt");
+    expect(resolveLocalePreference({}, [])).toBe(FALLBACK_LOCALE);
+
+    expect(
+      readOsLocaleTags({
+        languages: ["de-DE", "en-US"],
+        language: "fr-FR",
+      }),
+    ).toEqual(["de-DE", "en-US", "fr-FR"]);
+    expect(readOsLocaleTags({ language: "es-ES" })).toEqual(["es-ES"]);
+    expect(readOsLocaleTags({ languages: ["", "  "], language: "" })).toEqual([]);
+    expect(readOsLocaleTags(undefined)).toEqual([]);
+  });
+});
diff --git a/tests/mainview/modules/document/links/linkHoverSourcePeek.unit.test.ts b/tests/mainview/modules/document/links/linkHoverSourcePeek.unit.test.ts
new file mode 100644
index 0000000..05971aa
--- /dev/null
+++ b/tests/mainview/modules/document/links/linkHoverSourcePeek.unit.test.ts
@@ -0,0 +1,128 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  LINK_HOVER_PEEK_MAX_CHARS,
+  LINK_HOVER_PEEK_MAX_LINES,
+  LINK_HOVER_PEEK_READ_CAP,
+  escapeHoverMarkdownText,
+  linkHoverContentsMarkdown,
+  linkHoverPeekAsHoverMarkdown,
+  linkHoverSourcePeek,
+  markdownBodyStartOffset,
+} from "../../../../../src/mainview/modules/document/links/linkHoverSourcePeek.ts";
+
+describe("linkHoverSourcePeek", () => {
+  test("returns null for empty or whitespace-only bodies", () => {
+    expect(linkHoverSourcePeek("")).toBeNull();
+    expect(linkHoverSourcePeek("   \n\n  ")).toBeNull();
+    expect(linkHoverSourcePeek("---\ntitle: x\n---\n\n")).toBeNull();
+  });
+
+  test("skips closed frontmatter and peeks body source", () => {
+    const content = "---\ntitle: Secret\n---\n\n# Hello\n\nBody paragraph.\n";
+    expect(markdownBodyStartOffset(content)).toBeGreaterThan(0);
+    expect(linkHoverSourcePeek(content)).toBe("# Hello\n\nBody paragraph.");
+  });
+
+  test("starts at a heading line when provided", () => {
+    const content = "# Intro\n\nLead.\n\n## Target\n\nUseful bit.\n";
+    const peek = linkHoverSourcePeek(content, { startLineNumber: 5 });
+    expect(peek).toBe("## Target\n\nUseful bit.");
+    expect(peek).not.toContain("# Intro");
+  });
+
+  test("caps lines and characters without dumping large documents", () => {
+    const lines = Array.from({ length: 40 }, (_, index) => `Line ${index + 1} ${"x".repeat(40)}`);
+    const peek = linkHoverSourcePeek(lines.join("\n"));
+    expect(peek).not.toBeNull();
+    expect(peek!.split("\n").length).toBeLessThanOrEqual(LINK_HOVER_PEEK_MAX_LINES + 1);
+    expect(peek!.replace(/\.\.\.$/, "").length).toBeLessThanOrEqual(LINK_HOVER_PEEK_MAX_CHARS);
+    expect(peek).toContain("...");
+  });
+
+  test("read cap bounds how much source is scanned before soft visual caps", () => {
+    const huge = `${"y".repeat(LINK_HOVER_PEEK_READ_CAP + 500)}\n# After cap\n`;
+    const peek = linkHoverSourcePeek(huge);
+    expect(peek).not.toBeNull();
+    expect(peek).not.toContain("# After cap");
+    expect(peek!.replace(/\.\.\.$/, "").length).toBeLessThanOrEqual(LINK_HOVER_PEEK_MAX_CHARS);
+  });
+
+  test("unclosed frontmatter is not treated as body skip", () => {
+    const content = "---\ntitle: open\n\n# Still visible\n";
+    expect(markdownBodyStartOffset(content)).toBe(0);
+    expect(linkHoverSourcePeek(content)).toContain("---");
+    expect(linkHoverSourcePeek(content)).toContain("# Still visible");
+  });
+
+  test("hover markdown fences source so it stays inert text", () => {
+    const peek = "# Title\n\nSee [link](other.md) and `code`.";
+    const markdown = linkHoverPeekAsHoverMarkdown(peek);
+    expect(markdown.startsWith("```markdown\n")).toBe(true);
+    expect(markdown.endsWith("\n```")).toBe(true);
+    expect(markdown).toContain(peek);
+    const nested = linkHoverPeekAsHoverMarkdown("already has ``` inside");
+    expect(nested.startsWith("````")).toBe(true);
+  });
+});
+
+describe("linkHoverContentsMarkdown", () => {
+  test("omits path when it repeats the identity title", () => {
+    expect(
+      linkHoverContentsMarkdown({
+        title: "notes/alpha.md",
+        path: "notes/alpha.md",
+        peek: "# Alpha",
+      }),
+    ).toBe("**notes/alpha.md**\n\n```markdown\n# Alpha\n```");
+  });
+
+  test("keeps path when it adds information beyond the title", () => {
+    expect(
+      linkHoverContentsMarkdown({
+        title: "Alpha",
+        path: "notes/alpha.md",
+        detailLines: ["Heading #section: Section"],
+        peek: "## Section\n\nBody.",
+      }),
+    ).toBe(
+      "**Alpha**\nnotes/alpha.md\nHeading #section: Section\n\n```markdown\n## Section\n\nBody.\n```",
+    );
+  });
+
+  test("skips empty honesty lines", () => {
+    expect(
+      linkHoverContentsMarkdown({
+        title: "Alpha",
+        path: "notes/alpha.md",
+        detailLines: ["", "Also matches: other.md"],
+      }),
+    ).toBe("**Alpha**\nnotes/alpha.md\nAlso matches: other.md");
+  });
+});
+
+// Intent: hover bodies are Markdown, and the values composed into one come from
+// documents. A heading or filename must not be able to become a link, an image
+// request, or emphasis in the tooltip. Every hover value passes through this one
+// function, so representative syntax proves the boundary - the point is not to
+// cover Markdown grammar.
+describe("escapeHoverMarkdownText", () => {
+  test("keeps document text inert instead of renderable Markdown", () => {
+    expect(escapeHoverMarkdownText("[click](https://host/x)")).toBe(
+      "\\[click\\]\\(https://host/x\\)",
+    );
+    expect(escapeHoverMarkdownText("![](https://host/pixel.png)")).toBe(
+      "\\!\\[\\]\\(https://host/pixel\\.png\\)",
+    );
+    expect(escapeHoverMarkdownText("<https://host>")).toBe("\\<https://host\\>");
+    expect(escapeHoverMarkdownText("**bold** _em_ `code`")).toBe(
+      "\\*\\*bold\\*\\* \\_em\\_ \\`code\\`",
+    );
+  });
+
+  test("leaves an ordinary path readable", () => {
+    const escaped = escapeHoverMarkdownText("notes/alpha-one.md");
+    expect(escaped).toBe("notes/alpha\\-one\\.md");
+    expect(escaped).not.toMatch(/[^\\][[\]()]/);
+  });
+});
diff --git a/tests/mainview/modules/document/links/linkSemantics.unit.test.ts b/tests/mainview/modules/document/links/linkSemantics.unit.test.ts
index 68206f1..cbcf47f 100644
--- a/tests/mainview/modules/document/links/linkSemantics.unit.test.ts
+++ b/tests/mainview/modules/document/links/linkSemantics.unit.test.ts
@@ -163,5 +163,25 @@ describe("link semantics", () => {
     expect(documentLinkNavigationPath(link("Note"), candidates)).toBeNull();
     expect(documentLinkNavigationPath(link("missing"), candidates)).toBeNull();
     expect(documentLinkNavigationPath(link("alpha.md"), candidates)).toBe("alpha.md");
+
+    const tree = [
+      note("docs/a.md"),
+      note("docs/b.md"),
+      note("other/b.md", [], { name: "b.md", title: "Other B" }),
+    ];
+    expect(resolveDocumentPath("./b.md", tree, "both", "docs/a.md").path).toBe("docs/b.md");
+    expect(resolveDocumentPath("../other/b.md", tree, "both", "docs/a.md").path).toBe("other/b.md");
+    expect(resolveDocumentPath("../../escape.md", tree, "both", "docs/a.md").path).toBeNull();
+
+    expect(resolveDocumentPath("b.md", tree, "path").path).toBeNull();
+    expect(resolveDocumentPath("docs/b.md", tree, "path").path).toBe("docs/b.md");
+    expect(resolveDocumentPath("b", tree, "stem").path).toBe("docs/b.md");
+    expect(resolveDocumentPath("b", tree, "stem").alsoMatches).toEqual(["other/b.md"]);
+    // Stem mode still accepts path-shaped targets via stem/path index, not title/alias.
+    expect(resolveDocumentPath("docs/b.md", tree, "stem")).toEqual({
+      path: "docs/b.md",
+      reason: "stem",
+      alsoMatches: [],
+    });
   });
 });
diff --git a/tests/mainview/modules/editor/document/documentAnnotations.unit.test.ts b/tests/mainview/modules/editor/document/documentAnnotations.unit.test.ts
index 5a7ec21..da68e94 100644
--- a/tests/mainview/modules/editor/document/documentAnnotations.unit.test.ts
+++ b/tests/mainview/modules/editor/document/documentAnnotations.unit.test.ts
@@ -1,7 +1,6 @@
 import { describe, expect, test } from "bun:test";
 
 import {
-  annotationTextAsHoverMarkdown,
   applyDocumentAnnotationPresentation,
   clearDocumentAnnotations,
   findDocumentAnnotationNear,
@@ -93,14 +92,14 @@ describe("document annotations", () => {
       annotations[1],
     );
 
-    // Annotation text comes from the user and is shown in Monaco hover Markdown.
-    // Escaping + isTrusted:false is the XSS boundary for that surface.
     expect(normalizeAnnotationText("  hello   world  ")).toBe("hello world");
     expect(normalizeAnnotationText("x".repeat(DOCUMENT_ANNOTATION_TEXT_MAX + 40))?.length).toBe(
       DOCUMENT_ANNOTATION_TEXT_MAX,
     );
-    expect(annotationTextAsHoverMarkdown("a <b>tag</b>")).toBe("a \\<b\\>tag\\</b\\>");
 
+    // Annotation text comes from the user and is shown in Monaco hover Markdown.
+    // Escaping + isTrusted:false is the XSS boundary for that surface, asserted
+    // below on the decoration Monaco actually receives.
     const model = createFakeModel();
     const api = fakeApi as never;
     const added = upsertDocumentAnnotationOnLine(api, model as never, 2, 1, "note <b>x</b>", true);
diff --git a/tests/mainview/modules/editor/document/documentBuffers.unit.test.ts b/tests/mainview/modules/editor/document/documentBuffers.unit.test.ts
index df73487..7aa1d1a 100644
--- a/tests/mainview/modules/editor/document/documentBuffers.unit.test.ts
+++ b/tests/mainview/modules/editor/document/documentBuffers.unit.test.ts
@@ -245,14 +245,20 @@ const {
   openBuffers,
   openDocument,
   renameDocumentBuffer,
+  reorderOpenDocuments,
   selectDocument,
   restoreUntitledDrafts,
 } = await import("../../../../../src/mainview/modules/editor/document/documentBuffers.ts");
-const { activeId, clearSessionDocuments, smallestAvailableUntitledNumber, untitledNumberFromId } =
-  await import("../../../../../src/mainview/modules/editor/document/documentSession.ts");
+const {
+  activeId,
+  clearSessionDocuments,
+  openIds,
+  smallestAvailableUntitledNumber,
+  untitledNumberFromId,
+} = await import("../../../../../src/mainview/modules/editor/document/documentSession.ts");
 const { bindFocusToWorkspace, clearFocusState, currentFocus } =
   await import("../../../../../src/mainview/modules/workspace/focus/focusState");
-const { patchSettings, settings } =
+const { patchSettings, resetSettingsToDefaults, settings } =
   await import("../../../../../src/mainview/modules/settings/settingsStore.ts");
 
 afterEach(() => {
@@ -284,6 +290,7 @@ afterEach(() => {
   lastWrittenContent = "";
   lastWrittenPath = "";
   nextReadContent = null;
+  resetSettingsToDefaults();
   patchSettings({ editor: { ...settings.value.editor, defaultEol: "lf" } });
 });
 
@@ -539,6 +546,164 @@ describe("document buffers", () => {
     expect(untitledNumberFromId("untitled:0")).toBeNull();
   });
 
+  test("reorderOpenDocuments moves strip order without changing active or dirty state", async () => {
+    bindFocusToWorkspace("/workspace");
+    const first = await openDocument("/workspace", "one.md");
+    const second = await openDocument("/workspace", "two.md");
+    const third = await openDocument("/workspace", "three.md");
+    second.model.setValue("# dirty two");
+    expect(selectDocument(second.id)).toBe(true);
+    expect(isDocumentDirty(second)).toBe(true);
+    expect(openBuffers.value.map((buffer) => buffer.id)).toEqual([first.id, second.id, third.id]);
+
+    expect(reorderOpenDocuments(0, 2)).toBe(true);
+    expect(openBuffers.value.map((buffer) => buffer.id)).toEqual([second.id, third.id, first.id]);
+    expect(openIds.value).toEqual([second.id, third.id, first.id]);
+    expect(activeId.value).toBe(second.id);
+    expect(isDocumentDirty(second)).toBe(true);
+    expect(second.model.getValue()).toBe("# dirty two");
+
+    expect(reorderOpenDocuments(-1, 0)).toBe(false);
+    expect(reorderOpenDocuments(0, 0)).toBe(true);
+  });
+
+  test("open-order wrap for adjacent tab chords follows strip order after reorder", async () => {
+    const { adjacentOpenDocumentIndex } =
+      await import("../../../../../src/mainview/modules/editor/editorTabNavigation.ts");
+
+    bindFocusToWorkspace("/workspace");
+    const one = await openDocument("/workspace", "1.md");
+    const two = await openDocument("/workspace", "2.md");
+    const three = await openDocument("/workspace", "3.md");
+    const four = await openDocument("/workspace", "4.md");
+    expect(openBuffers.value.map((buffer) => buffer.id)).toEqual([
+      one.id,
+      two.id,
+      three.id,
+      four.id,
+    ]);
+    expect(selectDocument(one.id)).toBe(true);
+
+    // Same walk used by Ctrl/Cmd+Tab, Ctrl/Cmd+Shift+Tab, PageDown, and PageUp.
+    const walk = (direction: -1 | 1, steps: number): string[] => {
+      const ids = [activeId.value!];
+      for (let step = 0; step < steps; step += 1) {
+        const currentIndex = openBuffers.value.findIndex((buffer) => buffer.id === activeId.value);
+        const nextIndex = adjacentOpenDocumentIndex(
+          currentIndex,
+          direction,
+          openBuffers.value.length,
+        );
+        expect(nextIndex).not.toBeNull();
+        const nextId = openBuffers.value[nextIndex!]!.id;
+        expect(selectDocument(nextId)).toBe(true);
+        ids.push(nextId);
+      }
+      return ids;
+    };
+
+    expect(walk(1, 4)).toEqual([one.id, two.id, three.id, four.id, one.id]);
+    expect(walk(-1, 4)).toEqual([one.id, four.id, three.id, two.id, one.id]);
+
+    expect(reorderOpenDocuments(0, 2)).toBe(true);
+    expect(openBuffers.value.map((buffer) => buffer.id)).toEqual([
+      two.id,
+      three.id,
+      one.id,
+      four.id,
+    ]);
+    expect(selectDocument(two.id)).toBe(true);
+    expect(walk(1, 4)).toEqual([two.id, three.id, one.id, four.id, two.id]);
+    expect(walk(-1, 4)).toEqual([two.id, four.id, one.id, three.id, two.id]);
+
+    // With a single tab or no active tab the chord has nowhere to go.
+    expect(adjacentOpenDocumentIndex(0, 1, 1)).toBeNull();
+    expect(adjacentOpenDocumentIndex(0, 1, 0)).toBeNull();
+    expect(adjacentOpenDocumentIndex(-1, 1, openBuffers.value.length)).toBeNull();
+  });
+
+  test("closing the active tab activates the strip neighbor, not MRU", async () => {
+    bindFocusToWorkspace("/workspace");
+    const one = await openDocument("/workspace", "close-1.md");
+    const two = await openDocument("/workspace", "close-2.md");
+    const three = await openDocument("/workspace", "close-3.md");
+    expect(selectDocument(two.id)).toBe(true);
+    // Touch one last so MRU would prefer it if close used MRU.
+    expect(selectDocument(one.id)).toBe(true);
+    expect(selectDocument(two.id)).toBe(true);
+
+    expect(closeDocumentById(two.id, true)).toBe(true);
+    expect(activeId.value).toBe(three.id);
+    expect(openBuffers.value.map((buffer) => buffer.id)).toEqual([one.id, three.id]);
+  });
+
+  test("keyboard and drop index math drive the same reorderOpenDocuments contract", async () => {
+    const { adjacentTabReorderIndex, tabDropReorderIndex } =
+      await import("../../../../../src/mainview/modules/editor/editorTabReorder.ts");
+
+    expect(adjacentTabReorderIndex(0, -1, 3)).toBeNull();
+    expect(adjacentTabReorderIndex(2, 1, 3)).toBeNull();
+    expect(adjacentTabReorderIndex(1, -1, 3)).toBe(0);
+    expect(adjacentTabReorderIndex(1, 1, 3)).toBe(2);
+
+    // Pointer drop equivalent to Alt+ArrowRight from index 0: insert after neighbor.
+    expect(tabDropReorderIndex(0, 1, true)).toBe(1);
+    expect(tabDropReorderIndex(1, 1, false)).toBe(1);
+
+    bindFocusToWorkspace("/workspace");
+    const first = await openDocument("/workspace", "a.md");
+    const second = await openDocument("/workspace", "b.md");
+    const third = await openDocument("/workspace", "c.md");
+    expect(selectDocument(first.id)).toBe(true);
+    const from = 0;
+    const to = adjacentTabReorderIndex(from, 1, openBuffers.value.length);
+    expect(to).toBe(1);
+    expect(reorderOpenDocuments(from, to!)).toBe(true);
+    expect(openBuffers.value.map((buffer) => buffer.id)).toEqual([second.id, first.id, third.id]);
+    expect(activeId.value).toBe(first.id);
+
+    // Invalid / cancelled-equivalent: same index leaves order unchanged.
+    expect(reorderOpenDocuments(1, tabDropReorderIndex(1, 1, false))).toBe(true);
+    expect(openBuffers.value.map((buffer) => buffer.id)).toEqual([second.id, first.id, third.id]);
+    expect(activeId.value).toBe(first.id);
+  });
+
+  test("tab strip reveal and middle-click close stay on existing chrome paths", async () => {
+    const { revealTabInOverflowStrip, shouldCloseTabOnAuxClick } =
+      await import("../../../../../src/mainview/modules/editor/editorTabStrip.ts");
+
+    const scrollCalls: unknown[] = [];
+    revealTabInOverflowStrip({
+      getClientRects: () => [{}, {}],
+      scrollIntoView: (options) => {
+        scrollCalls.push(options);
+      },
+    });
+    expect(scrollCalls).toEqual([{ inline: "nearest", block: "nearest" }]);
+    revealTabInOverflowStrip({
+      getClientRects: () => [],
+      scrollIntoView: () => {
+        throw new Error("hidden strip must not scroll");
+      },
+    });
+
+    const tabTarget = {
+      closest: () => null,
+    };
+    const closeTarget = {
+      closest: (selector: string) => (selector === ".editor-tabs__close" ? closeTarget : null),
+    };
+    expect(
+      shouldCloseTabOnAuxClick({ button: 1, target: tabTarget as unknown as EventTarget }),
+    ).toBe(true);
+    expect(
+      shouldCloseTabOnAuxClick({ button: 1, target: closeTarget as unknown as EventTarget }),
+    ).toBe(false);
+    expect(
+      shouldCloseTabOnAuxClick({ button: 0, target: tabTarget as unknown as EventTarget }),
+    ).toBe(false);
+  });
+
   test("change markers reset on successful save and dispose on close", async () => {
     bindFocusToWorkspace("/workspace");
     const buffer = await openDocument("/workspace", "note.md");
diff --git a/tests/mainview/modules/editor/document/documentFileNames.unit.test.ts b/tests/mainview/modules/editor/document/documentFileNames.unit.test.ts
index ae6ba6d..18d4a6a 100644
--- a/tests/mainview/modules/editor/document/documentFileNames.unit.test.ts
+++ b/tests/mainview/modules/editor/document/documentFileNames.unit.test.ts
@@ -15,7 +15,6 @@ describe("document file names", () => {
     expect(resolveNewDocumentFileName("   ", "md")).toBeNull();
     expect(resolveNewDocumentFileName("notes.md ", "md")).toBeNull();
     expect(resolveNewDocumentFileName("notes.md.", "md")).toBeNull();
-    expect(resolveNewDocumentFileName(" CON.md", "md")).toBeNull();
     expect(resolveNewDocumentFileName("CON.md", "md")).toBeNull();
     expect(resolveNewDocumentFileName("note:ads.md", "md")).toBeNull();
 
diff --git a/tests/mainview/modules/editor/document/untitledDraftStore.unit.test.ts b/tests/mainview/modules/editor/document/untitledDraftStore.unit.test.ts
index b482288..49945a6 100644
--- a/tests/mainview/modules/editor/document/untitledDraftStore.unit.test.ts
+++ b/tests/mainview/modules/editor/document/untitledDraftStore.unit.test.ts
@@ -18,7 +18,7 @@ describe("untitled draft store", () => {
     resetUntitledDraftStoreForTests();
   });
 
-  test("persists latest content, rejects bad records, and deletes by recovery id", async () => {
+  test("persists latest content, rejects empty/bad records, and deletes by recovery id", async () => {
     resetUntitledDraftStoreForTests();
     await putUntitledDraft({ recoveryId: "", content: "x", updatedAt: 1 } as never);
     await putUntitledDraft({
@@ -26,6 +26,10 @@ describe("untitled draft store", () => {
       content: "x".repeat(MAX_UNTITLED_DRAFT_CHARS + 1),
       updatedAt: 1,
     });
+    await putUntitledDraft({ recoveryId: "empty", content: "", updatedAt: 1 });
+    await putUntitledDraft({ recoveryId: "ws", content: "\n\n  ", updatedAt: 2 });
+    scheduleUntitledDraftPersist("sched-empty", "   \n");
+    await flushUntitledDraftWrites();
     expect(await listUntitledDrafts()).toEqual([]);
 
     scheduleUntitledDraftPersist("r1", "first");
@@ -39,29 +43,16 @@ describe("untitled draft store", () => {
 
     await deleteUntitledDraft("r2");
     expect((await listUntitledDrafts()).map((draft) => draft.recoveryId)).toEqual(["r1"]);
-  });
-
-  test("empty and whitespace content never persists and clears an existing draft", async () => {
-    resetUntitledDraftStoreForTests();
-
-    await putUntitledDraft({ recoveryId: "empty", content: "", updatedAt: 1 });
-    await putUntitledDraft({ recoveryId: "ws", content: "\n\n  ", updatedAt: 2 });
-    scheduleUntitledDraftPersist("sched-empty", "   \n");
-    await flushUntitledDraftWrites();
-    expect(await listUntitledDrafts()).toEqual([]);
-
-    await putUntitledDraft({ recoveryId: "r4", content: "hello", updatedAt: 1 });
-    expect((await listUntitledDrafts()).map((draft) => draft.recoveryId)).toEqual(["r4"]);
 
-    scheduleUntitledDraftPersist("r4", "");
+    scheduleUntitledDraftPersist("r1", "");
     await flushUntitledDraftWrites();
     expect(await listUntitledDrafts()).toEqual([]);
 
-    scheduleUntitledDraftPersist("r4", "hello again");
+    scheduleUntitledDraftPersist("r1", "hello again");
     await flushUntitledDraftWrites();
     expect(await listUntitledDrafts()).toEqual([
       {
-        recoveryId: "r4",
+        recoveryId: "r1",
         content: "hello again",
         updatedAt: expect.any(Number),
       },
diff --git a/tests/mainview/modules/editor/markdown/markdownStructure.unit.test.ts b/tests/mainview/modules/editor/markdown/markdownStructure.unit.test.ts
index ab7bf41..095f183 100644
--- a/tests/mainview/modules/editor/markdown/markdownStructure.unit.test.ts
+++ b/tests/mainview/modules/editor/markdown/markdownStructure.unit.test.ts
@@ -5,10 +5,11 @@ import {
   parseMarkdownStructure,
 } from "../../../../../src/mainview/modules/editor/markdown/markdownStructure.ts";
 
-// Intent: keep outline parsing aligned with heading, fence, and frontmatter rules.
+// Intent: keep outline parsing aligned with heading, fence, frontmatter, and
+// setext-vs-thematic-break rules.
 // Growth boundary: add cases only for a new Markdown structural form.
 describe("Markdown structure", () => {
-  test("parses outline forms and resolves ATX and Setext anchors", () => {
+  test("parses outline forms and keeps setext underlines paragraph-only", () => {
     const structure = parseMarkdownStructure(`---
 title: Note
 ---
@@ -33,17 +34,9 @@ Configuration
     const content = "# API Reference\n\nSetup\n=====\n";
     expect(findMarkdownHeading(content, "api-reference")?.lineNumber).toBe(1);
     expect(findMarkdownHeading(content, "Setup")?.lineNumber).toBe(3);
-  });
-});
 
-// Intent: a `-` or `=` run is a setext underline only under paragraph text.
-// Growth boundary: add a case only for a block form that changes that answer.
-describe("Markdown structure setext boundaries", () => {
-  test("does not read a thematic break after a non-paragraph block as a heading", () => {
-    const headings = (content: string): string[] =>
-      parseMarkdownStructure(content).headings.map(
-        (heading) => `h${heading.depth}:${heading.text}`,
-      );
+    const headings = (source: string): string[] =>
+      parseMarkdownStructure(source).headings.map((heading) => `h${heading.depth}:${heading.text}`);
 
     // Representatives: list, quote, table (same non-paragraph rule).
     expect(headings("# Real\n\n- item\n---\n\n## After\n")).toEqual(["h1:Real", "h2:After"]);
@@ -53,18 +46,15 @@ describe("Markdown structure setext boundaries", () => {
     // Paragraph text still underlines, including a line that merely starts with a hyphen.
     expect(headings("Title\n---\n\n## After\n")).toEqual(["h2:Title", "h2:After"]);
     expect(headings("-notadash\n---\n\n## After\n")).toEqual(["h2:-notadash", "h2:After"]);
-  });
-
-  test("reports a multi-line setext heading at the first line of its paragraph", () => {
-    const structure = parseMarkdownStructure("alpha\nbeta\n---\n\n## After\n");
 
-    expect(structure.headings[0]).toMatchObject({
+    const multiline = parseMarkdownStructure("alpha\nbeta\n---\n\n## After\n");
+    expect(multiline.headings[0]).toMatchObject({
       lineNumber: 1,
       depth: 2,
       text: "alpha beta",
       anchor: "alpha-beta",
     });
-    expect(structure.headings[1]?.lineNumber).toBe(5);
+    expect(multiline.headings[1]?.lineNumber).toBe(5);
     expect(findMarkdownHeading("alpha\nbeta\n---\n", "alpha-beta")?.lineNumber).toBe(1);
   });
 });
diff --git a/tests/mainview/modules/editor/writingFocus.unit.test.ts b/tests/mainview/modules/editor/writingFocus.unit.test.ts
index 7e8689f..14ecab2 100644
--- a/tests/mainview/modules/editor/writingFocus.unit.test.ts
+++ b/tests/mainview/modules/editor/writingFocus.unit.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 
 import {
   canPersistWindowFrame,
@@ -14,6 +14,10 @@ import {
   writingFocusMonacoOptions,
 } from "../../../../src/mainview/modules/editor/writingFocus.ts";
 
+afterEach(() => {
+  writingFocusActive.value = false;
+});
+
 // Intent: Writing Focus is session chrome on the editor route only, and stays
 // orthogonal to native Full Screen (all four combinations). Host fullscreen
 // fails closed and never persists a fullscreen frame as normal bounds.
diff --git a/tests/mainview/modules/graph/graphComputationSession.unit.test.ts b/tests/mainview/modules/graph/graphComputationSession.unit.test.ts
index b6ac35e..f0ef937 100644
--- a/tests/mainview/modules/graph/graphComputationSession.unit.test.ts
+++ b/tests/mainview/modules/graph/graphComputationSession.unit.test.ts
@@ -115,14 +115,8 @@ describe("graph computation session", () => {
     // First worker was terminated when superseded.
     expect(workers[0]?.terminated).toBe(true);
 
-    const firstResult = await first;
     // Discarded composition stays empty while preserving focusPath.
-    expect(firstResult).toEqual({
-      focusPath: "a.md",
-      nodes: [],
-      edges: [],
-    });
-    expect(firstResult).toEqual(discardedComposedGraph(reference("a.md")));
+    expect(await first).toEqual({ focusPath: "a.md", nodes: [], edges: [] });
 
     supersedeSession.terminate();
     const secondResult = await second;
@@ -130,4 +124,43 @@ describe("graph computation session", () => {
     expect(supersedeSession.hasActive()).toBe(false);
     expect(workers[1]?.terminated).toBe(true);
   });
+
+  // Regression: a worker that was constructed but whose postMessage threw used
+  // to stay alive (and hasActive() kept reporting it) while compute already
+  // resolved through the sync fallback.
+  test("terminates a worker whose start throws before falling back", async () => {
+    const workers: Array<ReturnType<typeof silentWorker>> = [];
+    let failNextStart = true;
+    const session = createGraphComputationSession({
+      createWorker: () => {
+        const worker = silentWorker();
+        if (failNextStart) {
+          worker.postMessage = () => {
+            throw new Error("structured clone failed");
+          };
+        }
+        workers.push(worker);
+        return worker;
+      },
+      runSync: syncFallback,
+    });
+
+    await expect(session.compute(reference("boom.md"))).resolves.toEqual(
+      syncFallback(reference("boom.md")),
+    );
+    expect(workers[0]?.terminated).toBe(true);
+    expect(session.hasActive()).toBe(false);
+
+    // The next compute must still get a live worker: a stale `active` would make
+    // the following compute settle itself as discarded.
+    failNextStart = false;
+    const next = session.compute(reference("after.md"));
+    expect(session.hasActive()).toBe(true);
+    expect(workers).toHaveLength(2);
+    expect(workers[1]?.terminated).toBe(false);
+
+    // Settle the pending compute so the test leaves nothing in flight.
+    session.terminate();
+    await next;
+  });
 });
diff --git a/tests/mainview/modules/graph/graphKeyScope.unit.test.ts b/tests/mainview/modules/graph/graphKeyScope.unit.test.ts
index da766c4..871d272 100644
--- a/tests/mainview/modules/graph/graphKeyScope.unit.test.ts
+++ b/tests/mainview/modules/graph/graphKeyScope.unit.test.ts
@@ -16,11 +16,8 @@ function elementWithClosest(match: string | null): Element {
 // Intent: graph shortcuts must survive focus restore to #main-content, not only
 // nodes inside `.graph-workbench`, while remaining off app chrome.
 describe("graph key scope", () => {
-  test("accepts targets inside #main-content", () => {
+  test("accepts #main-content targets and refuses sidebar/chrome", () => {
     expect(isGraphKeyTargetInScope(elementWithClosest("#main-content"))).toBe(true);
-  });
-
-  test("refuses sidebar/chrome targets outside #main-content", () => {
     expect(isGraphKeyTargetInScope(elementWithClosest(null))).toBe(false);
     expect(isGraphKeyTargetInScope(null)).toBe(false);
   });
diff --git a/tests/mainview/modules/settings/settingsStore.unit.test.ts b/tests/mainview/modules/settings/settingsStore.unit.test.ts
index caf545a..72a4543 100644
--- a/tests/mainview/modules/settings/settingsStore.unit.test.ts
+++ b/tests/mainview/modules/settings/settingsStore.unit.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 
 import {
   appearanceDatasetFor,
@@ -12,8 +12,11 @@ import {
 } from "../../../../src/mainview/modules/settings/settingsStore";
 
 const memoryStorage = new Map<string, string>();
+const previousLocalStorage = (globalThis as { localStorage?: Storage }).localStorage;
+let memoryLocalStorageInstalled = false;
 
 function installMemoryLocalStorage(): void {
+  memoryLocalStorageInstalled = true;
   (globalThis as { localStorage?: Storage }).localStorage = {
     get length() {
       return memoryStorage.size;
@@ -35,11 +38,26 @@ function installMemoryLocalStorage(): void {
     },
   } as Storage;
 }
+
+afterEach(() => {
+  memoryStorage.clear();
+  if (memoryLocalStorageInstalled) {
+    if (previousLocalStorage === undefined) {
+      delete (globalThis as { localStorage?: Storage }).localStorage;
+    } else {
+      (globalThis as { localStorage?: Storage }).localStorage = previousLocalStorage;
+    }
+    memoryLocalStorageInstalled = false;
+  }
+  settings.value = defaultSettings();
+});
 // Intent: persisted settings fail closed. Unknown concepts must not hydrate.
 describe("settings sanitize", () => {
   test("accepts current fields, rejects unsupported enums, and resets to defaults", () => {
     expect(defaultSettings().appearance.theme).toBe("system");
+    expect(defaultSettings().locale).toBe("system");
     expect(sanitizeSettings({}).appearance.theme).toBe("system");
+    expect(sanitizeSettings({}).locale).toBe("system");
 
     const next = sanitizeSettings({
       locale: "es",
@@ -73,7 +91,9 @@ describe("settings sanitize", () => {
     expect(next).not.toHaveProperty("templates");
     expect(next).not.toHaveProperty("contextRoot");
     expect(next).not.toHaveProperty("contextRoots");
-    expect(sanitizeSettings({ locale: "ja" }).locale).toBe("en");
+    expect(sanitizeSettings({ locale: "ja" }).locale).toBe("system");
+    expect(sanitizeSettings({ locale: "system" }).locale).toBe("system");
+    expect(sanitizeSettings({ locale: "en" }).locale).toBe("en");
     expect(sanitizeSettings({ appearance: { theme: "constructor" } }).appearance.theme).toBe(
       "system",
     );
diff --git a/tests/mainview/shell/applicationMenu.unit.test.ts b/tests/mainview/shell/applicationMenu.unit.test.ts
index ab5d034..6c35cf2 100644
--- a/tests/mainview/shell/applicationMenu.unit.test.ts
+++ b/tests/mainview/shell/applicationMenu.unit.test.ts
@@ -33,7 +33,7 @@ const idleState: ApplicationMenuState = {
 // buffers can be confirmed. Extensions live under File. Full Screen shortcuts are
 // platform-specific (Ctrl differs from Cmd). Linux native menu is Electrobun's limit.
 describe("application menu", () => {
-  test("Save, Quit, Extensions, and Full Screen follow product ownership rules", () => {
+  test("Save, Quit, Extensions, and Full Screen follow product ownership rules", async () => {
     expect(menuItemEnabled("canSave", idleState)).toBe(false);
     expect(
       menuItemEnabled("canSave", {
@@ -117,5 +117,37 @@ describe("application menu", () => {
       // macOS Full Screen is Control+Command+F - not primary-mod equivalence with Ctrl.
       expect(darwinFullscreen.shortcut).toBe("Ctrl+Cmd+F");
     }
+
+    const winNavigate = win.find((menu) => menu.id === "navigate");
+    const winTabs = winNavigate?.items.find(
+      (item) => item.type === "submenu" && item.id === "tabs",
+    );
+    expect(winTabs?.type).toBe("submenu");
+    if (winTabs?.type === "submenu") {
+      const nextTab = winTabs.items.find(
+        (item) => item.type === "command" && item.id === "nextTab",
+      );
+      const previousTab = winTabs.items.find(
+        (item) => item.type === "command" && item.id === "previousTab",
+      );
+      expect(nextTab?.type).toBe("command");
+      expect(previousTab?.type).toBe("command");
+      if (nextTab?.type === "command") {
+        expect(nextTab.shortcut).toBe("Ctrl/Cmd+PageDown");
+      }
+      if (previousTab?.type === "command") {
+        expect(previousTab.shortcut).toBe("Ctrl/Cmd+PageUp");
+      }
+    }
+
+    const { default: en } = await import("../../../src/mainview/i18n/en.ts");
+    const { default: it } = await import("../../../src/mainview/i18n/it.ts");
+    // Settings: Tab / Shift+Tab and PageUp/PageDown both describe open-order navigation.
+    expect(en.settings.shortcutTabs).toContain("tab order");
+    expect(en.settings.shortcutTabsOrder).toContain("tab order");
+    expect(en.settings.shortcutTabs).toBe(en.settings.shortcutTabsOrder);
+    expect(en.settings.shortcutMoveTab).toContain("focused");
+    expect(en.settings.shortcutTabList).toContain("tab strip is focused");
+    expect(it.settings.shortcutMoveTab).toContain("focalizzata");
   });
 });
diff --git a/tests/scripts/linuxWebViewEnv.unit.test.ts b/tests/scripts/linuxWebViewEnv.unit.test.ts
new file mode 100644
index 0000000..e9ff8bc
--- /dev/null
+++ b/tests/scripts/linuxWebViewEnv.unit.test.ts
@@ -0,0 +1,83 @@
+import { describe, expect, test } from "bun:test";
+
+import { electrobunDevProcessEnv, linuxWebViewPaintEnv } from "../../scripts/linuxWebViewEnv";
+
+describe("linuxWebViewPaintEnv", () => {
+  test("is a no-op on Windows and macOS", () => {
+    const poisoned = {
+      WEBKIT_DISABLE_COMPOSITING_MODE: "1",
+      GDK_BACKEND: "wayland",
+      FULVID_KEEP_GDK_BACKEND: "1",
+    };
+    expect(linuxWebViewPaintEnv("darwin", poisoned)).toEqual({});
+    expect(linuxWebViewPaintEnv("win32", poisoned)).toEqual({});
+  });
+
+  test("views:// profile defaults compositing disable and X11", () => {
+    expect(linuxWebViewPaintEnv("linux", {})).toEqual({
+      WEBKIT_DISABLE_COMPOSITING_MODE: "1",
+      GDK_BACKEND: "x11",
+    });
+  });
+
+  test("HMR profile forces X11 only and does not set compositing disable", () => {
+    expect(linuxWebViewPaintEnv("linux", {}, { disableCompositing: false })).toEqual({
+      GDK_BACKEND: "x11",
+    });
+  });
+
+  test("respects an explicit compositing value on views://", () => {
+    expect(
+      linuxWebViewPaintEnv("linux", {
+        WEBKIT_DISABLE_COMPOSITING_MODE: "0",
+      }),
+    ).toEqual({
+      GDK_BACKEND: "x11",
+    });
+  });
+
+  test("FULVID_KEEP_GDK_BACKEND skips GDK override", () => {
+    expect(linuxWebViewPaintEnv("linux", { FULVID_KEEP_GDK_BACKEND: "1" })).toEqual({
+      WEBKIT_DISABLE_COMPOSITING_MODE: "1",
+    });
+    expect(
+      linuxWebViewPaintEnv(
+        "linux",
+        { FULVID_KEEP_GDK_BACKEND: "1" },
+        { disableCompositing: false },
+      ),
+    ).toEqual({});
+  });
+});
+
+describe("electrobunDevProcessEnv", () => {
+  test("merges the paint profile into the process env on Linux only", () => {
+    const base = {
+      PATH: "/usr/bin",
+      WEBKIT_DISABLE_COMPOSITING_MODE: "1",
+      GDK_BACKEND: "wayland",
+    };
+    expect(electrobunDevProcessEnv("win32", base)).toEqual(base);
+    expect(electrobunDevProcessEnv("darwin", base, { disableCompositing: false })).toEqual(base);
+    expect(electrobunDevProcessEnv("linux", { PATH: "/bin" })).toMatchObject({
+      PATH: "/bin",
+      WEBKIT_DISABLE_COMPOSITING_MODE: "1",
+      GDK_BACKEND: "x11",
+    });
+  });
+
+  test("Linux HMR clears inherited WEBKIT_DISABLE_COMPOSITING_MODE", () => {
+    const next = electrobunDevProcessEnv(
+      "linux",
+      {
+        PATH: "/bin",
+        WEBKIT_DISABLE_COMPOSITING_MODE: "1",
+        GDK_BACKEND: "wayland",
+      },
+      { disableCompositing: false },
+    );
+    expect(next.PATH).toBe("/bin");
+    expect(next.GDK_BACKEND).toBe("x11");
+    expect(next.WEBKIT_DISABLE_COMPOSITING_MODE).toBeUndefined();
+  });
+});