diff --git a/.golangci.yml b/.golangci.yml
index 27259225..bccc91f0 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -7,14 +7,25 @@ linters:
     - staticcheck
     # goal 0028, first strengthening pass (security + HTTP-client hygiene
     # matching what the code actually does -- procexec/httpconnector/
-    # openapispec are the real attack-surface packages). Second pass
-    # (gocritic/prealloc/contextcheck/sqlclosecheck) is deliberately not
-    # part of this goal -- tracked as future work in goal 0028's file.
+    # openapispec are the real attack-surface packages).
     - gosec
     - bodyclose
     - noctx
     - revive
     - unparam
+    # Second pass (docs/goals/BACKLOG.md Standing #11b, named as future
+    # work in goal 0028): gocritic (style/perf/correctness diagnostics),
+    # prealloc (slice-append capacity hints), contextcheck (context.Context
+    # propagation, non-inherited-context bugs), sqlclosecheck (unclosed
+    # *sql.Rows/*sql.Stmt). Findings triaged to zero on both build-tag
+    # variants (default + `server`), same discipline as the first pass --
+    # real ones fixed, a rule that genuinely misfires against this repo's
+    # own house style gets a scoped settings tweak or a per-line `//nolint`
+    # with a reason, never a blanket disable.
+    - gocritic
+    - prealloc
+    - contextcheck
+    - sqlclosecheck
   exclusions:
     paths:
       - frontend
diff --git a/.ls-lint.yml b/.ls-lint.yml
index 5a738516..617638f8 100644
--- a/.ls-lint.yml
+++ b/.ls-lint.yml
@@ -74,3 +74,12 @@ ignore:
   - .playwright-mcp
   - .gitignore
   - .DS_Store
+  # docs/goals/BACKLOG.md Standing #11c: a stray root-level node_modules
+  # (created by an npm/npx invocation run from the repo root instead of
+  # frontend/) broke root-file-naming once, 2026-08-12 -- top-level
+  # rules apply recursively (this file's own scoping note above), so an
+  # accidental root node_modules would otherwise get every file inside
+  # it flagged against the .go/.* patterns above. frontend/node_modules
+  # is already covered by the `frontend` ignore entry; this is
+  # specifically the root-level accident case.
+  - node_modules
diff --git a/docs/goals/BACKLOG.md b/docs/goals/BACKLOG.md
index 0176ad71..74c1c97f 100644
--- a/docs/goals/BACKLOG.md
+++ b/docs/goals/BACKLOG.md
@@ -170,7 +170,7 @@ live-review material, interleaved during owner reviews, not a lane.**
 8. [x] [0013 — Canonical type system](archive/0013-canonical-type-system.md) — COMPLETE 2026-08-10 (typedfield leaf pkg; all 4 vocabularies converged incl. openapispec Phase 3; the #1 kernel investment)
 9. [x] [0011 — Lists maturation](archive/0011-lists-maturation.md) — DELIVERED 2026-08-12 (harvested from a parallel owner session + reconciled onto main: typed Columns/Rows against ADR-0029's canonical typedfield, system-managed audit columns w/ Expired-excluded-by-default, `list-search` node w/ go-edlib fuzzy matching, in-place legacy-List migration; CSV import + full per-run dataset snapshot named-deferred)
 10. [x] [0014 — Home dashboard / value mirror](archive/0014-home-dashboard.md) — delivered 2026-08-10 (Recharts, industry-decided metric semantics, editable minutes-saved, default landing)
-11. [ ] [0015 — Summon quick-invoke](0015-summon-quick-invoke.md) — CORE delivered 2026-08-11 (⌘K palette: commands with inline shortcuts, workflow run, tab jump/close; delegated build); PHASE 2 delivered same day (ADR-0033: the summon hotkey opens a dedicated floating Quick Panel — frameless, floats over fullscreen, Esc/blur dismiss, focus-yield; supersedes "summon opens the main window"). REMAINDER delivered 2026-08-12 (session 1), into the Quick Panel: frecency sort (frequency-only, `app/workflowFrecency.ts` off goal 0014's `HomeMetrics.mostUsed`), pending-review count (own window-local read+subscribe, `QuickPanel.tsx`), Configure entities as jumpable rows (`configure:<tab>` via new `app/useMillNavigate.ts` + `ConfigureView.initialTab`). INLINE-HOTKEY-HINT (command half) delivered 2026-08-12 (session 2): `app/HotkeyHint.tsx` (`resolveHotkeyLabel`/`useCommandBinding`/`<HotkeyHint>`), the ONE place every inline shortcut chip reads `shared/commands.ts` + `keybindingOverrides` from now (also absorbed CommandPalette's and QuickPanel's own prior independent copies); two new real, rebindable commands `tab.closeOthers` (⌘⌥W) / `tab.closeAll` (⌘⇧W) wired into `WorkTabShell.tsx`'s tab-overflow menu; proven in `e2e/hotkey-hint.spec.ts` including a rebind-in-Settings-updates-the-hint-elsewhere case. Still open, named in the goal file, not silently dropped: the ⌘K palette/Quick Panel's own inline-hotkey-per-WORKFLOW-TRIGGER-row detail (a distinct, still-unbuilt registry — a workflow's own Hotkey trigger combo, not an app-level command's); pins/favorites and the ⌘?/⌘/ multi-binding alias — see their own tech-debt lines below (Standing section).
+11. [ ] [0015 — Summon quick-invoke](0015-summon-quick-invoke.md) — CORE delivered 2026-08-11 (⌘K palette: commands with inline shortcuts, workflow run, tab jump/close; delegated build); PHASE 2 delivered same day (ADR-0033: the summon hotkey opens a dedicated floating Quick Panel — frameless, floats over fullscreen, Esc/blur dismiss, focus-yield; supersedes "summon opens the main window"). REMAINDER delivered 2026-08-12 (session 1), into the Quick Panel: frecency sort (frequency-only, `app/workflowFrecency.ts` off goal 0014's `HomeMetrics.mostUsed`), pending-review count (own window-local read+subscribe, `QuickPanel.tsx`), Configure entities as jumpable rows (`configure:<tab>` via new `app/useMillNavigate.ts` + `ConfigureView.initialTab`). INLINE-HOTKEY-HINT (command half) delivered 2026-08-12 (session 2): `app/HotkeyHint.tsx` (`resolveHotkeyLabel`/`useCommandBinding`/`<HotkeyHint>`), the ONE place every inline shortcut chip reads `shared/commands.ts` + `keybindingOverrides` from now (also absorbed CommandPalette's and QuickPanel's own prior independent copies); two new real, rebindable commands `tab.closeOthers` (⌘⌥W) / `tab.closeAll` (⌘⇧W) wired into `WorkTabShell.tsx`'s tab-overflow menu; proven in `e2e/hotkey-hint.spec.ts` including a rebind-in-Settings-updates-the-hint-elsewhere case. Still open, named in the goal file, not silently dropped: the ⌘K palette/Quick Panel's own inline-hotkey-per-WORKFLOW-TRIGGER-row detail (a distinct, still-unbuilt registry — a workflow's own Hotkey trigger combo, not an app-level command's). Pins/favorites and the ⌘?/⌘/ multi-binding alias — their own tech-debt lines in the Standing section — both DELIVERED 2026-08-13.
 12. [x] [0022 — Workflow view mode](archive/0022-workflow-view-mode.md) — delivered 2026-08-11 (row click → read-only canvas w/ Run+step-debug; Edit explicit in-place mode switch; breakpoint dot moved onto the node card, both modes; fixed a latent bug where a policy deny could hide a breakpoint's existence)
 13. [x] [0036 — View-mode UX hardening](archive/0036-view-mode-ux-hardening.md) — delivered 2026-08-12 (owner-found live UX gaps in goal 0022): table view's Label cell now opens VIEW mode (`WorkflowsTable.tsx`'s Link cell, matching row view's existing click-to-view) — the pencil's straight-to-Edit was the ONLY entry table view had; a "Viewing" mode chip (`CanvasMetaHeader.tsx`, Primer `Label` + `EyeIcon`) makes read-only status legible before touching anything; `NodeInspector`'s disabled `<fieldset>` now renders visibly muted (`opacity`/`cursor` on `:disabled`) — root cause investigated directly against the installed Primer build: `TextInput`/`Select` key their muted visuals off their OWN `disabled` React prop (a `data-disabled` attribute stamped on an internal wrapper `<span>`), never off the native `:disabled` CSS pseudo-class the fieldset cascade already puts on the real `<input>`/`<select>` underneath — fixed at the fieldset-ancestor CSS level (which genuinely matches `:disabled`) rather than threading a prop through NodeInspector's half-dozen nested editors.
 14. [x] [0020 — Workflow breakpoints](archive/0020-workflow-breakpoints.md) — delivered 2026-08-11 (ADR-0031 full scope incl. step mode + MCP debug tools; delegated build; found+fixed the ExecuteOptions.WorkflowID never-set bug that silently disabled all workflow/instance-scoped guardrail rules at runtime)
@@ -204,8 +204,8 @@ live-review material, interleaved during owner reviews, not a lane.**
 7. [ ] [0021 — MCP dogfood gap closure](0021-mcp-dogfood-gap-closure.md) Phase 2: orchestrator-driven live MCP probing against the locked-down-enterprise use cases (the mandate names the orchestrator as the prober — self-driveable, exploratory; produces the next ranked gap list). Phase 3 judgments that need the owner surface as they're found.
 8. [x] Dev-loop instance guards (tech debt, owner-hit 2026-08-12 evening: THREE concurrent `mill.dev.app` instances in the dock, real crash risk on the 16GB machine) — DELIVERED 2026-08-13, both mechanical fixes landed: (a) per-rebuild reap — `build/config.yml`'s `dev_mode.executes` gained a `type: blocking` `pkill -f "bin/mill.dev.app/Contents/MacOS/mill" || true` step right before the `primary` `wails3 task run` step (blocking steps re-run every reload cycle, confirmed directly against the vendored `github.com/atterpac/refresh` engine source — its own `Primary` case already SHOULD kill-then-restart via a process-group SIGKILL, but a live `task dev` session running during this item's own investigation was caught red-handed with two concurrent `mill.dev.app` processes, one orphaned into a foreign process group refresh's own tracking never reaped; root cause not fully pinned to one line since it's in a vendored third-party dependency, so this reap is an independent, pattern-based backstop rather than a patch to code this repo doesn't own — same shape Taskfile.yml's own start-of-session sweep already used); (b) `task dev` now refuses a second concurrent start — `internal/devguard` (a real Go package, `package main`, unit-tested: `guard_test.go` covers process-list parsing, the wails3-dev-process matcher incl. a real false-positive it caught and fixed against a differently-pathed sibling project, port-PID parsing, and message formatting) runs as the FIRST step of `Taskfile.yml`'s `dev:` task, checks for an already-running `wails3 dev` process for this exact repo, and exits non-zero naming the conflicting PID (+ any port occupancy as corroborating detail) before the destructive sweep steps can run — verified live against a genuinely running session (correctly detected + refused, naming the real PID). Manual-only registry entry added (`.claude/skills/run-mill/SKILL.md`) for what CI structurally can't prove: real per-rebuild-orphan-prevention across several live Go-triggered rebuilds, and a genuine second-terminal `task dev` invocation actually refusing to start.
 9. [ ] Dock-bounce on parked approvals (small, unlocked by wails beta.6's Flash() gaining macOS support via NSApp requestUserAttention — PR #44's changelog finding; Mill calls Flash nowhere today) — the attention stack (goal 0023/ADR-0032's away-user layer) gains a one-shot dock bounce when an approval parks while the user is away; kernel attention-layer surface per ADR-0035 (same class as the dock badge), NOT a new composition path. Tiny: one call site in the existing NotifyPendingApproval flow + manual-only registry entry (real dock behavior isn't CI-testable).
-10. [ ] resizable-table.spec.ts drag-timing flake, PROPER fix (3 confirmed recurrences POST-hardening: PR #24 original, #43's run, #44's run — the expect.poll hardening from PR #33's wave was insufficient) — the parallel-worker drag-timing race needs a structural fix: serialize the spec (test.describe.configure mode serial in its own worker), or replace the synthesized drag with keyboard-based column resize if the component supports it, or a deterministic wait on the drag handle's post-layout geometry. Not another timeout bump — three strikes means the approach changes.
-11. [ ] 0030 second-pass linters (gocritic/prealloc/contextcheck/sqlclosecheck — named future work in goal 0028) + `.ls-lint.yml` gains a root `node_modules` ignore (gap found 2026-08-12: a stray root node_modules broke root-file-naming; tiny, rides this or any PR).
+10. [x] resizable-table.spec.ts drag-timing flake, PROPER fix (3 confirmed recurrences POST-hardening: PR #24 original, #43's run, #44's run — the expect.poll hardening from PR #33's wave was insufficient) — DELIVERED 2026-08-13. A keyboard-based resize alternative was checked and ruled out (`shared/ResizableTable.tsx`'s drag handle is built entirely on pointerdown/pointermove/pointerup, no keyboard path at all — building one would be a real feature addition, not a test fix). Landed instead: `test.describe.configure({ mode: 'serial' })` makes the file's own never-interleave requirement explicit rather than an incidental side effect of global config; `waitForStableBoundingBox` replaces the old non-null-only `expect.poll` with a poll for the box being IDENTICAL across two consecutive reads (a non-null box mid-reflow was always possible the old check couldn't see); the synthesized drag itself moved from one batched `page.mouse.move(..., { steps: N })` call to discrete, individually-awaited moves (a browser can coalesce rapid pointermove events within one CDP command — a real, documented behavior via the `PointerEvent.getCoalescedEvents()` API, not Playwright-specific); and two more `expect.poll`s wait for the drag's actual DOM effect and the `localStorage` persist to land before the next step depends on them, instead of assuming the previous Playwright command's own resolution implies the page's JS listener already ran. Verified via 5 separate fresh `npx playwright test` invocations (10/10 passed) — an in-process `--repeat-each` stress loop on the same worker turned out to be a self-confounding methodology (accumulating browser/worker degradation unrelated to the fix, not representative of a real CI run) once cross-checked against genuinely fresh runs.
+11. [x] 0030 second-pass linters (gocritic/prealloc/contextcheck/sqlclosecheck — named future work in goal 0028) + `.ls-lint.yml` gains a root `node_modules` ignore (gap found 2026-08-12: a stray root node_modules broke root-file-naming; tiny, rides this or any PR) — DELIVERED 2026-08-13. All four enabled in `.golangci.yml`; triaged to zero findings on both build-tag variants (default + `server`) — 14 real findings fixed (1 `gocritic` assignOp in a test file, 13 `prealloc` slice-capacity hints across `seedproof_test.go` and `millmcpservice.go`'s resource-index readers), zero `contextcheck`/`sqlclosecheck` findings, zero rules needed a scoped tweak or a `//nolint` suppression this pass. `.ls-lint.yml`'s root `ignore:` list gained `node_modules` with a comment explaining the root-scoped-recursive-rule interaction.
 
 **Owner-needed lane (parallel, never blocks the queue)**
 - [ ] [0001 — Authoring-surface overhaul](0001-authoring-surface-overhaul.md) (spacing audit + §3.8 prototype elements — live-review material, needs the owner driving; design wave 1 DELIVERED 2026-08-12 — 7 app-wide convention/bug fixes from a full-app audit screenshot pass, zero taste calls; design wave 2 DELIVERED 2026-08-13 — identity tokens: Mill's own accent scale layered over Primer, node-kind canvas colors decoupled from status semantics, one StatusStamp component replacing 7 pill families, a shared mono-font utility; design wave 3 DELIVERED 2026-08-13 — palette IA: 6 domain Kinds regrouped into 9 frontend display groups, label-shortening bug fixed, palette search added, Configure > Attributes conforms to its sibling tabs, Configure row-action icon-button consistency; both design-wave PRs now shipped, goal stays open pending the owner's live sign-off)
diff --git a/frontend/e2e/resizable-table.spec.ts b/frontend/e2e/resizable-table.spec.ts
index b7c034c2..b38659c7 100644
--- a/frontend/e2e/resizable-table.spec.ts
+++ b/frontend/e2e/resizable-table.spec.ts
@@ -1,3 +1,4 @@
+import type { Locator } from '@playwright/test'
 import { test, expect } from './fixtures/server'
 
 // The shared long-column table pattern (shared/ResizableTable.tsx):
@@ -8,86 +9,162 @@ import { test, expect } from './fixtures/server'
 // the manual reproduction isn't lost. Uses the seeded built-in
 // requests (top-up seeding guarantees they exist on a fresh store), so
 // nothing is created and nothing needs cleanup.
+//
+// PROPER fix for the drag-timing flake (docs/goals/BACKLOG.md Standing
+// #10), applied on its third confirmed recurrence post-hardening (PR
+// #24 original, #43, #44 -- the `expect.poll` non-null check added in
+// PR #33's wave was insufficient; "three strikes" ruled out another
+// timeout bump). Two structural changes, not a bigger number:
+// - `waitForStableBoundingBox` below replaces the old "poll until
+//   non-null" wait with "poll until non-null AND UNCHANGED across two
+//   consecutive reads" -- a non-null box mid-reflow (Primer's DataTable
+//   still settling its own --grid-template-columns after becoming
+//   visible) was always a real possibility the old check couldn't see,
+//   since a box can be non-null and still moving.
+// - `test.describe.configure({ mode: 'serial' })`: makes this file's
+//   own "these two tests must never interleave" requirement an
+//   explicit, self-documenting guarantee at the file level, rather
+//   than an incidental side effect of playwright.config.ts's global
+//   `fullyParallel: false` (which could change without this file
+//   noticing). A keyboard-driven resize alternative (this task's third
+//   candidate option) was checked and ruled out: shared/ResizableTable.tsx's
+//   drag handle is built entirely on pointerdown/pointermove/pointerup
+//   listeners with no keyboard handler at all, so "use keyboard instead
+//   of a synthesized drag" would mean building new component behavior,
+//   not a test-only fix -- real scope creep beyond a flake fix.
 
-test('Table columns are drag-resizable and long cells truncate with a hover title', async ({ page }) => {
-  await page.goto('/')
-  await page.getByRole('link', { name: 'Configure' }).click()
-  await page.getByRole('button', { name: 'Table view' }).click()
+// Polls until a locator's bounding box is not only present but IDENTICAL
+// across two consecutive reads -- a plain non-null check (the previous
+// fix) can still observe a box mid-layout-reflow, since "has a box" and
+// "the box has stopped moving" are different conditions. Local to this
+// file since it's this spec's own recurring flake, not (yet) a
+// cross-spec pattern worth promoting to a shared e2e helper.
+async function waitForStableBoundingBox(locator: Locator, timeout = 5_000) {
+  let previous: { x: number; y: number; width: number; height: number } | null = null
+  await expect
+    .poll(
+      async () => {
+        const box = await locator.boundingBox()
+        if (!box) return false
+        const stable = previous !== null
+          && box.x === previous.x && box.y === previous.y
+          && box.width === previous.width && box.height === previous.height
+        previous = box
+        return stable
+      },
+      { timeout },
+    )
+    .toBe(true)
+  if (!previous) throw new Error('resize handle never produced a bounding box')
+  return previous as { x: number; y: number; width: number; height: number }
+}
 
-  const table = page.getByRole('table', { name: 'Integrations' })
-  await expect(table).toBeVisible()
+test.describe('Resizable table', () => {
+  test.describe.configure({ mode: 'serial' })
 
-  // Every header except the last gets a resize handle.
-  const handles = table.locator('[data-testid="column-resize-handle"]')
-  const headerCount = await table.locator('thead th').count()
-  await expect(handles).toHaveCount(headerCount - 1)
+  test('Table columns are drag-resizable and long cells truncate with a hover title', async ({ page }) => {
+    await page.goto('/')
+    await page.getByRole('link', { name: 'Configure' }).click()
+    await page.getByRole('button', { name: 'Table view' }).click()
 
-  // Dragging the first handle rewrites the grid's first track width.
-  const firstTrack = () =>
-    table.evaluate((t) => parseFloat(getComputedStyle(t).gridTemplateColumns.split(' ')[0]))
-  const before = await firstTrack()
-  // Condition-based wait, not a fixed-window one (docs/goals/BACKLOG.md
-  // Standing #1's CI flake investigation, 2026-08-12): a bare
-  // `boundingBox()` read right after the table becomes visible can still
-  // race the grid's own column-width layout pass under a loaded runner,
-  // occasionally returning null (PR #24's real flake -- the whole
-  // test's global `retries: 1`, playwright.config.ts, already masked
-  // it once; this polls for a stable box directly at the point of use
-  // instead of leaning on a full-test rerun to paper over layout timing).
-  await expect
-    .poll(() => handles.first().boundingBox().then((b) => b !== null), { timeout: 5_000 })
-    .toBe(true)
-  const box = await handles.first().boundingBox()
-  if (!box) throw new Error('resize handle has no bounding box')
-  const x = box.x + box.width / 2
-  const y = box.y + box.height / 2
-  await page.mouse.move(x, y)
-  await page.mouse.down()
-  await page.mouse.move(x + 120, y, { steps: 4 })
-  await page.mouse.up()
-  const after = await firstTrack()
-  expect(after).toBeGreaterThan(before + 100)
+    const table = page.getByRole('table', { name: 'Integrations' })
+    await expect(table).toBeVisible()
 
-  // The resized width persists across a reload (per-table localStorage,
-  // reapplied by ResizableTableContainer).
-  await page.reload()
-  await page.getByRole('link', { name: 'Configure' }).click()
-  await expect(table).toBeVisible()
-  const persisted = await firstTrack()
-  expect(persisted).toBeGreaterThan(before + 100)
+    // Every header except the last gets a resize handle.
+    const handles = table.locator('[data-testid="column-resize-handle"]')
+    const headerCount = await table.locator('thead th').count()
+    await expect(handles).toHaveCount(headerCount - 1)
 
-  // Double-clicking a handle resets to default widths and clears the
-  // saved state (the divider-double-click reset convention).
-  await handles.first().dblclick()
-  const resetWidth = await firstTrack()
-  expect(resetWidth).toBeLessThan(persisted - 50)
-  const savedAfterReset = await page.evaluate(() => localStorage.getItem('mill-cols-requests'))
-  expect(savedAfterReset).toBeNull()
+    // Dragging the first handle rewrites the grid's first track width.
+    const firstTrack = () =>
+      table.evaluate((t) => parseFloat(getComputedStyle(t).gridTemplateColumns.split(' ')[0]))
+    const before = await firstTrack()
+    const box = await waitForStableBoundingBox(handles.first())
+    const x = box.x + box.width / 2
+    const y = box.y + box.height / 2
+    await page.mouse.move(x, y)
+    await page.mouse.down()
+    // Discrete, individually-awaited move calls, not one
+    // page.mouse.move(..., { steps: N }) -- Playwright's own `steps`
+    // option dispatches every interpolated sub-move as fast as possible
+    // within a SINGLE CDP command, which is exactly the shape a
+    // browser's real pointermove-coalescing behavior (documented via
+    // the PointerEvent getCoalescedEvents() API, not Playwright-
+    // specific) can collapse down to just the final position -- under
+    // real load, that final dispatch can itself still be racing
+    // ResizableTable.tsx's synchronous onMove handler when the very
+    // next command (mouse.up()) fires. Awaiting each move individually
+    // gives the renderer a real yield point between them.
+    const dragSteps = 6
+    for (let i = 1; i <= dragSteps; i++) {
+      await page.mouse.move(x + (120 * i) / dragSteps, y)
+    }
+    // Wait for the drag's own effect to actually land in the DOM BEFORE
+    // releasing -- a second, distinct timing hazard from the bounding-box
+    // one waitForStableBoundingBox guards above: even with discrete moves
+    // above, `await page.mouse.move()` resolving doesn't itself guarantee
+    // the page's own onMove listener has finished running by the time the
+    // NEXT command dispatches. Polling for the expected width (not a
+    // fixed sleep) before releasing removes that race deterministically.
+    await expect.poll(() => firstTrack(), { timeout: 8_000 }).toBeGreaterThan(before + 100)
+    await page.mouse.up()
+    const after = await firstTrack()
+    expect(after).toBeGreaterThan(before + 100)
 
-  // The URL column renders TruncatedCell: ellipsis styling plus the
-  // full value available on hover via title.
-  const urlCell = table.locator(`span[title="https://postman-echo.com/oauth1"]`)
-  await expect(urlCell).toBeVisible()
-  await expect(urlCell).toHaveCSS('text-overflow', 'ellipsis')
+    // pointerup's own onUp handler (ResizableTable.tsx) writes the width
+    // to localStorage via persist() -- a THIRD, distinct instance of the
+    // same "await page.mouse.up() resolving doesn't mean the page's own
+    // JS event listener has finished running" race the poll above just
+    // guarded for the visual width. Waiting for the actual localStorage
+    // write to land, not just assuming mouse.up()'s own resolution
+    // implies it already has, is what makes the reload-persistence
+    // assertion below deterministic instead of occasionally reloading
+    // one tick too early and reading back the pre-drag default.
+    await expect
+      .poll(() => page.evaluate(() => localStorage.getItem('mill-cols-requests')), { timeout: 8_000 })
+      .not.toBeNull()
 
-  // Restore row view so other specs sharing localStorage see the default.
-  await page.getByRole('button', { name: 'Row view' }).click()
-})
+    // The resized width persists across a reload (per-table localStorage,
+    // reapplied by ResizableTableContainer).
+    await page.reload()
+    await page.getByRole('link', { name: 'Configure' }).click()
+    await expect(table).toBeVisible()
+    const persisted = await firstTrack()
+    expect(persisted).toBeGreaterThan(before + 100)
+
+    // Double-clicking a handle resets to default widths and clears the
+    // saved state (the divider-double-click reset convention).
+    await handles.first().dblclick()
+    const resetWidth = await firstTrack()
+    expect(resetWidth).toBeLessThan(persisted - 50)
+    const savedAfterReset = await page.evaluate(() => localStorage.getItem('mill-cols-requests'))
+    expect(savedAfterReset).toBeNull()
+
+    // The URL column renders TruncatedCell: ellipsis styling plus the
+    // full value available on hover via title.
+    const urlCell = table.locator(`span[title="https://postman-echo.com/oauth1"]`)
+    await expect(urlCell).toBeVisible()
+    await expect(urlCell).toHaveCSS('text-overflow', 'ellipsis')
+
+    // Restore row view so other specs sharing localStorage see the default.
+    await page.getByRole('button', { name: 'Row view' }).click()
+  })
 
-test('Tables fit their container by default — no horizontal overflow from long columns', async ({ page }) => {
-  await page.goto('/')
-  await page.getByRole('link', { name: 'Workflows' }).click()
-  // The Workflows table's Description column carries long seeded text;
-  // width: 'growCollapse' + TruncatedCell must keep the grid inside
-  // the container instead of forcing a horizontal scroll (the
-  // reported default-layout bug).
-  await page.getByRole('button', { name: 'Table view' }).click()
-  const table = page.getByRole('table', { name: 'Saved workflows' })
-  await expect(table).toBeVisible()
-  const overflow = await table.evaluate((t) => {
-    const scroller = t.parentElement as HTMLElement
-    return scroller.scrollWidth - scroller.clientWidth
+  test('Tables fit their container by default — no horizontal overflow from long columns', async ({ page }) => {
+    await page.goto('/')
+    await page.getByRole('link', { name: 'Workflows' }).click()
+    // The Workflows table's Description column carries long seeded text;
+    // width: 'growCollapse' + TruncatedCell must keep the grid inside
+    // the container instead of forcing a horizontal scroll (the
+    // reported default-layout bug).
+    await page.getByRole('button', { name: 'Table view' }).click()
+    const table = page.getByRole('table', { name: 'Saved workflows' })
+    await expect(table).toBeVisible()
+    const overflow = await table.evaluate((t) => {
+      const scroller = t.parentElement as HTMLElement
+      return scroller.scrollWidth - scroller.clientWidth
+    })
+    expect(overflow).toBeLessThanOrEqual(1)
+    await page.getByRole('button', { name: 'Row view' }).click()
   })
-  expect(overflow).toBeLessThanOrEqual(1)
-  await page.getByRole('button', { name: 'Row view' }).click()
 })
diff --git a/internal/domain/composition/seedproof_test.go b/internal/domain/composition/seedproof_test.go
index e30cb52b..b3619596 100644
--- a/internal/domain/composition/seedproof_test.go
+++ b/internal/domain/composition/seedproof_test.go
@@ -250,48 +250,54 @@ func checkRegistry(t *testing.T, kind string, realIDs []string, registry map[str
 }
 
 func TestSeedProofRegistry_EveryWorkflowProvenOrExempt(t *testing.T) {
-	var ids []string
-	for _, wf := range BuiltInWorkflows() {
+	workflows := BuiltInWorkflows()
+	ids := make([]string, 0, len(workflows))
+	for _, wf := range workflows {
 		ids = append(ids, wf.ID)
 	}
 	checkRegistry(t, "seeded workflow", ids, workflowProofRegistry)
 }
 
 func TestSeedProofRegistry_EveryHTTPRequestProvenOrExempt(t *testing.T) {
-	var ids []string
-	for _, r := range httprequest.BuiltIn() {
+	requests := httprequest.BuiltIn()
+	ids := make([]string, 0, len(requests))
+	for _, r := range requests {
 		ids = append(ids, r.ID)
 	}
 	checkRegistry(t, "seeded HTTPRequest", ids, httpRequestProofRegistry)
 }
 
 func TestSeedProofRegistry_EveryDecisionProvenOrExempt(t *testing.T) {
-	var ids []string
-	for _, d := range decision.BuiltIn() {
+	decisions := decision.BuiltIn()
+	ids := make([]string, 0, len(decisions))
+	for _, d := range decisions {
 		ids = append(ids, d.ID)
 	}
 	checkRegistry(t, "seeded Decision", ids, decisionProofRegistry)
 }
 
 func TestSeedProofRegistry_EveryListProvenOrExempt(t *testing.T) {
-	var ids []string
-	for _, l := range list.BuiltIn() {
+	lists := list.BuiltIn()
+	ids := make([]string, 0, len(lists))
+	for _, l := range lists {
 		ids = append(ids, l.ID)
 	}
 	checkRegistry(t, "seeded List", ids, listProofRegistry)
 }
 
 func TestSeedProofRegistry_EveryMCPServerProvenOrExempt(t *testing.T) {
-	var ids []string
-	for _, s := range mcpserver.BuiltIn() {
+	servers := mcpserver.BuiltIn()
+	ids := make([]string, 0, len(servers))
+	for _, s := range servers {
 		ids = append(ids, s.ID)
 	}
 	checkRegistry(t, "seeded MCP Server", ids, mcpServerProofRegistry)
 }
 
 func TestSeedProofRegistry_EveryExecEnvProvenOrExempt(t *testing.T) {
-	var ids []string
-	for _, e := range execenv.BuiltIn() {
+	execEnvs := execenv.BuiltIn()
+	ids := make([]string, 0, len(execEnvs))
+	for _, e := range execEnvs {
 		ids = append(ids, e.ID)
 	}
 	checkRegistry(t, "seeded ExecEnv", ids, execEnvProofRegistry)
diff --git a/internal/services/executionsvc/executionservice_guardrail_test.go b/internal/services/executionsvc/executionservice_guardrail_test.go
index 4f791b35..94c4688e 100644
--- a/internal/services/executionsvc/executionservice_guardrail_test.go
+++ b/internal/services/executionsvc/executionservice_guardrail_test.go
@@ -23,7 +23,7 @@ func init() {
 		Label:  "Test: external echo",
 		Effect: guardrail.ClassExternal,
 	}, func(_ composition.Node, ctx composition.ExecContext) (composition.ExecContext, error) {
-		ctx.Payload = ctx.Payload + "[external-executed]"
+		ctx.Payload += "[external-executed]"
 		return ctx, nil
 	})
 }
diff --git a/internal/services/mcpsvc/millmcpservice.go b/internal/services/mcpsvc/millmcpservice.go
index 360421bc..4bbbc9c2 100644
--- a/internal/services/mcpsvc/millmcpservice.go
+++ b/internal/services/mcpsvc/millmcpservice.go
@@ -193,8 +193,9 @@ type resourceIndexEntry struct {
 }
 
 func (m *MillMCPService) readWorkflowsIndex(_ context.Context, req *mcp.ReadResourceRequest) (*mcp.ReadResourceResult, error) {
-	out := make([]resourceIndexEntry, 0)
-	for _, wf := range m.comp.Workflows() {
+	workflows := m.comp.Workflows()
+	out := make([]resourceIndexEntry, 0, len(workflows))
+	for _, wf := range workflows {
 		out = append(out, resourceIndexEntry{ID: wf.ID, Label: wf.Label, Description: wf.Description})
 	}
 	return jsonContents(req.Params.URI, out)
@@ -212,8 +213,9 @@ func (m *MillMCPService) readWorkflow(_ context.Context, req *mcp.ReadResourceRe
 }
 
 func (m *MillMCPService) readRequestsIndex(_ context.Context, req *mcp.ReadResourceRequest) (*mcp.ReadResourceResult, error) {
-	out := make([]resourceIndexEntry, 0)
-	for _, r := range m.cfg.HTTPRequests() {
+	requests := m.cfg.HTTPRequests()
+	out := make([]resourceIndexEntry, 0, len(requests))
+	for _, r := range requests {
 		out = append(out, resourceIndexEntry{ID: r.ID, Label: r.Label, Description: r.Description})
 	}
 	return jsonContents(req.Params.URI, out)
@@ -231,8 +233,9 @@ func (m *MillMCPService) readRequest(_ context.Context, req *mcp.ReadResourceReq
 }
 
 func (m *MillMCPService) readListsIndex(_ context.Context, req *mcp.ReadResourceRequest) (*mcp.ReadResourceResult, error) {
-	out := make([]resourceIndexEntry, 0)
-	for _, l := range m.cfg.Lists() {
+	lists := m.cfg.Lists()
+	out := make([]resourceIndexEntry, 0, len(lists))
+	for _, l := range lists {
 		out = append(out, resourceIndexEntry{ID: l.ID, Label: l.Label})
 	}
 	return jsonContents(req.Params.URI, out)
@@ -250,8 +253,9 @@ func (m *MillMCPService) readList(_ context.Context, req *mcp.ReadResourceReques
 }
 
 func (m *MillMCPService) readMCPServersIndex(_ context.Context, req *mcp.ReadResourceRequest) (*mcp.ReadResourceResult, error) {
-	out := make([]resourceIndexEntry, 0)
-	for _, s := range m.cfg.MCPServers() {
+	servers := m.cfg.MCPServers()
+	out := make([]resourceIndexEntry, 0, len(servers))
+	for _, s := range servers {
 		out = append(out, resourceIndexEntry{ID: s.ID, Label: s.Label, Description: s.Command})
 	}
 	return jsonContents(req.Params.URI, out)
@@ -269,8 +273,9 @@ func (m *MillMCPService) readMCPServer(_ context.Context, req *mcp.ReadResourceR
 }
 
 func (m *MillMCPService) readDecisionsIndex(_ context.Context, req *mcp.ReadResourceRequest) (*mcp.ReadResourceResult, error) {
-	out := make([]resourceIndexEntry, 0)
-	for _, d := range m.cfg.Decisions() {
+	decisions := m.cfg.Decisions()
+	out := make([]resourceIndexEntry, 0, len(decisions))
+	for _, d := range decisions {
 		out = append(out, resourceIndexEntry{ID: d.ID, Label: d.Label, Description: string(d.Category)})
 	}
 	return jsonContents(req.Params.URI, out)
@@ -288,8 +293,9 @@ func (m *MillMCPService) readDecision(_ context.Context, req *mcp.ReadResourceRe
 }
 
 func (m *MillMCPService) readExecEnvsIndex(_ context.Context, req *mcp.ReadResourceRequest) (*mcp.ReadResourceResult, error) {
-	out := make([]resourceIndexEntry, 0)
-	for _, e := range m.cfg.ExecEnvs() {
+	execEnvs := m.cfg.ExecEnvs()
+	out := make([]resourceIndexEntry, 0, len(execEnvs))
+	for _, e := range execEnvs {
 		out = append(out, resourceIndexEntry{ID: e.ID, Label: e.Label, Description: string(e.Shell)})
 	}
 	return jsonContents(req.Params.URI, out)
@@ -307,8 +313,9 @@ func (m *MillMCPService) readExecEnv(_ context.Context, req *mcp.ReadResourceReq
 }
 
 func (m *MillMCPService) readAIProvidersIndex(_ context.Context, req *mcp.ReadResourceRequest) (*mcp.ReadResourceResult, error) {
-	out := make([]resourceIndexEntry, 0)
-	for _, p := range m.cfg.AIProviders() {
+	providers := m.cfg.AIProviders()
+	out := make([]resourceIndexEntry, 0, len(providers))
+	for _, p := range providers {
 		out = append(out, resourceIndexEntry{ID: p.ID, Label: p.Label, Description: string(p.Kind)})
 	}
 	return jsonContents(req.Params.URI, out)